KR20030079141A - Method for Embodying a key agreement protocol - Google Patents

Abstract

PURPOSE: A method for implementing the key agreement protocol is provided to secure a safety and security by using Braid group since a method for solving the solution of a polynomial time has not been found. CONSTITUTION: A method for implementing the key agreement protocol includes the steps of: defining(SA401) a pair of sub-groups GA and HA of Bn; randomly selecting(SA402) aA ∈ GA and bA ∈ HA; selecting(SA403)Δ∈ Bn; calculating(SA404) Δp; calculating(SA405) xA = aAΔpbA; publishing(SA406) xA; receiving(SB407) xA; receiving(SA407) yB; and calculating(SA408) K = aAyBbA.

Description

Method for Embodying a key agreement protocol

The present invention relates to a key agreement protocol implementation method, in particular, a decomposition problem, or a problem that has long been known as a difficult problem in a public key cryptosystem based on braid group theory. Based on the safety of the generalized Diffie-Hellman type Decomposition Problem applied to the problem, the present invention relates to a method for implementing a protocol that achieves a key agreement between two transmitting and receiving entities.

Recently, with the development of the information communication network, as a variety of information is exchanged through the network, in order to prevent the information leaking to an illegal entity other than a suitable entity on a communication channel, a technique for encrypting a message is required. This cryptographic communication requires a key that specifies the inner workings of the cryptographic algorithm, the sender and receiver must share the same key, and the shared key is used to achieve cryptographic services such as message confidentiality, integrity, and personal identification. . As such, the process of sharing a key through two previously disclosed communication channels for cryptographic communication is called a key establishment protocol. The key establishment protocol can be roughly divided into a key transport protocol and a key agreement protocol. The key transfer protocol is a protocol in which one entity generates a key and securely delivers it to another entity, and the key agreement protocol is a protocol for generating a key with information exchanged between two entities.

The ultimate goal of the key agreement protocol is to securely share secret information to be used as a key, and ideally to have characteristics such as meeting a person in person. That is, secret information for generating a key should be shared only between legal objects, keys are randomly selected in a space where a key can be generated, and an illegal entity must not obtain any partial information about the key. The protocol for achieving this key agreement must be able to meet the safety and performance requirements. So far, various protocols have been proposed as key agreement and authentication protocols, and many of them have proved insecure against various attack methods. Therefore, in order to analyze a protocol, it is necessary to define the attacks that the protocol must resist and the attributes that must be satisfied.

On the other hand, the cipher systems known to date find it difficult to find solutions for operations defined in integers or finite fields, such as multiplication and addition, and equations derived from functions that apply them. It is used. The most widely known cryptosystems include factorization of large integers, discrete logarithm problems, and the application of them. Representative examples include RSA and ElGamal. In addition, so-called elliptic curve cryptosystems (ECCs) are being developed that convert the above-mentioned operations and difficult problems into the same problems as those defined on elliptic curves. One common property of such conventional cryptosystems is that the commutativity of operations holds, and solutions to them are gradually being developed with increasing computational speed of computers.

Recently, a cryptosystem based on braided group theory has been developed [Ko et al. New Public-key Cryptosystem Using Braid Groups, Advances in Cryptology-Crypto 2000]. This cryptosystem proposes a key agreement protocol based on the Generalized Conjugacy Search Problem, which applies the Conjugacy Search Problem, which has long been known as a difficult problem in the braided army. A consensus was used to construct a public key cryptosystem. It is not clear whether the conjugate problem can actually be solved within the polynomial time, but mathematically it can be solved using a super summit set (SSS), and mathematical solutions are developed for generalized conjugate problems. It is becoming. Therefore, in order to construct a more secure encryption system, the index n of the braided group Bn must be relatively large, and the size of the key must be increased in proportion to it.

The invention each secret belonging to the public key encryption system based on braided imgun theory as described above, wherein the braids Δ pertaining to the braided imgun B _n of the two entities initiating a protocol braided subgroup of imgun B _n G, H When the known public key y calculated from the keys a and b is y = aΔb, the safety is based on the difficulty of decomposing a or b from the known Δ, y or the difficulty of generalized Diffie-Hellman type decomposition. It also aims to provide a key agreement protocol implementation method that satisfies the protocol's safety requirements.

1A to 2B are conceptual diagrams of constructors shown to explain the braided group theory introduced in the present invention.

1A is a geometric diagram of the unit constructor σ _i

1B is a geometric diagram of the unit generator σ _i ^-1

2A is a geometric diagram of constructor σ _i and constructor σ _j

2b is a geometric diagram of the product of the generator σ _i and the generator σ _j (σ _i σ _j )

3 is a block diagram of a protocol implementation system suitable for implementing a key agreement protocol according to the present invention.

Figure 4 is a flow chart showing an embodiment of a key agreement protocol implementation method according to the present invention

5 is a flowchart illustrating another embodiment of a key agreement protocol implementation method according to the present invention.

※ Explanation of code for main part of drawing

10: entity A20: entity B

30: Public Key Directory

An embodiment of the present invention for achieving the above object is a constructor in a method for implementing a protocol in which entity A, which initiates the protocol, and a corresponding entity B, achieve a key agreement based on the safety of difficulty of decomposition problem. From a braid group B _n with one defined operation and index n as a set, one entity A defines subgroups G _A , H _A , and another entity B defines subgroups G _B , H Define _B , but xy = yx is established for all braids x of G _A and all braids y of H _B , and xy = yx for all braids y of G _B and all braids y of H _A The two entities A, B, which define subgroups G _A , H _A , G _B , H _B so that a relationship is established, select one common braid from the braid group Bn, and the subgroup G _A defined by the self , H _A , and G _B , H _B each have their own private keys a _A , b _A and a first step of selecting a _B , b _B ; Calculating and publishing a public key with the selected private key and the common braid; And a third step of calculating a session key using the public key of the protocol initiating party and its private key.

Another embodiment of the present invention for achieving the above object is a method for implementing a protocol that achieves a key agreement based on the safety of the problem of the generalized Diffie-Hellman type decomposition problem between the entity A that initiates the protocol and the corresponding entity B For a set of constructors, one entity A defines subgroups G _A , H _A from a braid group B _n with one defined operation and index n, and another entity B defines a subgroup. We define G _B , H _B , where the arithmetic relation of xy = yx is established for all braids x of G _A and all braids y of H _B , and xy for all braids x of G _B and all braids y of H _A. The two entities A and B, which define subgroups G _A , H _A , G _B , and H _B so that the arithmetic relation of = yx is established, are each one or more secret keys a _A , b _A and select a _B , b _B , and use one common braid from the braid group Bn. Selecting a first step; A second step of generating a public key by performing one or more predefined operations of the group of braids with the common braid and one or more private keys thereof, and publishing the public key in a public key directory, respectively; A third key for receiving a key disclosed by the protocol initiating party from the public key directory, and performing a calculation defined in the braid group one or more times using the received public key and its own private key to calculate a session key It provides a key agreement protocol implementation method comprising the steps.

The above object of the present invention and the technical features and advantages of the present invention for achieving these objects will be more readily understood by reference to the accompanying drawings and the following detailed description. In the following invention, when the two parties A and B perform the key agreement protocol, the transmitting party initiating the protocol is called entity A and the other receiving party is called entity B. We propose a method of implementing a key agreement protocol that can provide security requirements for basic security as a preferred embodiment. However, the technical matters of the present invention are not limited thereto and may be variously modified and modified by those skilled in the art.

Some definitions and prerequisites are presented to help understand the key agreement protocol implementation method according to the preferred embodiments of the present invention as described above.

1. Group means a pair (G, *) with a set G and any operator * defined between its elements, not an empty set, and x * for any two elements x, y of group G y must be an element in group G, and the following three conditions must be met: Here, the operation symbol * is omitted, and x * y is written as xy, and it is called the product of x and y. For example, x * x * x * x = x ⁴ .

(a) xe = x = ex holds for any element x because of the identity circle e.

(b) For any element x, there is an inverse x ^-1 so that xx ^-1 = e = x ^-1 x.

(c) (xy) z = xyz = x (yz) holds for any three elements x, y, and z.

If group G holds xy = yx for any two elements x and y, G is called a commutative group, and if there are two elements for which xy = yx does not hold, G is called a noncommutative group.

2. The braid group is defined as follows.

First we tie the ends of the n strings to the bars one after another and say 1, 2, ... i, i + 1, ..., n, and do not cross the other ends of each of the strings on another bar. After setting up the bundled geometry,

i) Intersect the i-th string and the i + 1th string so that the left (i-th) string is above (in front of the drawing), and the other strings (1, 2, ..., i-1, i + 2) , i + 3, ..., n) is left as it is, the geometric shape as shown in Figure 1a is called the generator σ _i ,

ii) In contrast to the constructor σ _i , the right (i + 1) string intersects to the top and the other strings (1,2, ..., i-1, i + 1, i + 3, ..., n) is left as it is and the inverse of the generator σ _i ^-1 (Fig. 1B) (sigma _i reflected in the mirror becomes σ _i ^-1 ),

A group defined by the set {σ _i , σ ₂ , ..., σ _n-1 } having the constructor σ _i or its inverse σ _i ^-1 as an element and a ratio satisfying the following relationship The noncommutative group is called braided group Bn.

(a) If | ij | ≥2 and 1≤i, j≤n-1, then σ _i σ _j = σ _j σ _i

(b) If | ij | = 1, then σ _i σ _j σ _i = σ _j σ _i σ _i

Where | i | is the absolute value of the integer i, and the elements of the braid group Bn are represented by the product of the generators σ _i and their inverses σ _i ^-1 . For example, σ ₁ σ ₃ ^-1 σ ₁ ^-1 σ ₂ σ ₁ is an element of B ₄ .

In particular, the product σ _i σ _j of the constructors, as shown in FIG. 2A, is derived from the geometric shape corresponding to the generator σ _i and the generator σ _j , and the end of the string bounded by the lower bar of the generator σ _i is equal to the generator σ _j . It refers to the shape as shown in Figure 2b attached in order to match the end of the string tied to the upper bar. In addition, a word expressed as a product of the constructors is called a word, and there may be various ways of expressing one word. For example, σ ₁ σ ₂ σ ₁ σ ₂ ^-1 σ ₃ σ ₁ = σ ₂ σ ₁ σ ₂ σ ₂ ^-1 σ ₃ σ ₁ = σ ₂ σ ₁ σ ₃ σ _{1 =} σ ₂ σ ₃ σ ₁ σ ₁ is the same as Bn. This can be easily seen using the relations (a) and (b). In the present invention below, the elements of the braid group Bn will be referred to as braid, so when two words are given, the problem of determining whether they are the same braid or another braid is a word problem. This is called the word problem.

3 is a block diagram of a protocol implementation system suitable for implementing a key agreement protocol according to the present invention, and entity A (10) for initiating the protocol, corresponding entity B (20), and public key directory ( 30).

Referring to Figure 3, the two entities A, B (10, 20) are one common braid (Δ) belonging to the braid group Bn and subgroups G _A , H _A , and G _B respectively defined from the braid group Bn , Using each known public key x _A and y _B (or x _A , y _A , x _B , y _B ) computed from the private keys a _A , b _A and a _B , b _B belonging to H _B , It will generate a shared secure session key (secret key), and these two entities can be solved to obtain a _A , b _A or a _B , b _B from the known x _A or y _B or generalized Diffie-Hellmann type. Based on the difficulty of the decomposition problem, it becomes possible to implement a key agreement protocol that satisfies the safety requirements of the protocol. To this end, the two entities A, B (10, 20) are each a subgroup G from the braid group Bn with a defined operation (*) and index n as a set of constructors (σ _i ). _A , H _A , and G _B , H _B must be defined, and one braid (Δ) is selected from the braid group Bn to share a common parameter with the protocol initiating party. And each of the subgroups G _A , H _A , and G _B , H _B are all braids of the subgroups G _A , H _A defined by one entity and all of the subgroups G _B , H _B defined by the other entity B It should be defined that the law of exchange holds for the operation (*) defined above, which is not common to. That is, the two entities A and B initiating the protocol grab the subgroups G _A , H _A , G _B , H _B of the braided group Bn with the index n to satisfy the following two properties (a) and (b).

(a) All braids x _i of subgroup G _A and all braids y _j of subgroup H _B are established by the exchange rule x _i y _j = y _j x _i for the operation (*) previously defined in the braid group. .

(b) All braids x _j of subgroup G _B and all braids y _i of subgroup H _A are established by the exchange rule x _j y _i = y _i x _j for the operation (*) previously defined in the braid group. .

For example, four subsets L _A , R _A , L _B , and R _B of a particular set of constructors {σ ₁ , σ ₂ , ..., σ _n-1 } are L _A ∩ R _B = Φ and L _{If B} ∩ R _A = Φ to be satisfied and each subset of Bn generated by each subset is G _A , H _A , G _B , H _B , respectively, G _A , H _A , G _B and H _B satisfy the above two properties (a) and (b).

4 is a flowchart illustrating an embodiment of a method for implementing a key agreement protocol according to the present invention, in which two entities A and B initiating the protocol (hereinafter referred to as receiving entity A and corresponding transmitting entity B). In this case, the entities A and B can be changed into a receiving entity as B and a transmitting entity as A), if necessary, by using a single braid. It illustrates the protocol implementation process from the first step to the third step to achieve.

The first step (SA401-SA403, SB401-SB403) is an initial setting step of defining various conditions that the two entities A and B initiating the protocol must know in advance in order to achieve a key agreement. This initial setup step involves two entities A and B, each of which has one defined operation (*) and an index n, from its braided group Bn, subgroups G _A , H _A , and G _B , H _B to meet specific conditions. In the defining step (SA401, SB401) and each of the subgroups G _A , H _A , and G _B , H _{B defined} above, the two entities A, B have their own secret keys a _A , b _A , And selecting a _B , b _B (a _A ∈ G _A , b _A ∈ H _A , a _B ∈ G _B , b _B ∈ H _B ) and a common one from the braid group Bn It may comprise a step (SA403, SB403) to select the braid (Δ). Here, all the braids of the subgroups G _A and H _A specified by the entity A are not common to all the braids of the subgroups G _B and H _B defined by the other entity B from the above condition (a) (b). It is natural that the law of exchange must be set for the operation (*) defined in the braid group Bn.

In the second steps SA404-SA406 and SB404-SB406, the two entities A and B each use the common braid Δ and their secret keys a _A , b _A , and a _B , b _B , respectively. By performing one or more operations (*) previously defined in the braided group to generate one public key (x _A , y _B ), and publicly disclose the public key in the public key directory. This public key generating and publishing step comprises the step of calculating a Δ ^p by exponential powering an arbitrary integer p to the common selected braid Δ performed by the entity A (SA404), the calculated Δ ^p and its secret Using the keys a _A and b _A , perform one or more operations (*) defined in the braid group to generate a new word x _A = a _A Δ ^p b _A consisting of a plurality of braid products. A step SA405, exposing the generated word x _A to a public key directory with a public key known to the protocol initiating party (SA406), and the other selected entity B in the common selected braid Δ step by the integer p exponentiation calculating a Δ ^p (SB404), and the calculated Δ ^p and his secret key a _b, previously defined operations (*) one or more times in the braid groups using b _b And the result of the operation is a new word y _B = b Δ ^p _B and step (SB405) for generating a _B, Initiation Protocol the generated word y _B is the other party can be configured to include a step (SB406) is exposed to the public key directory public key can be seen.

In the third step SA407-SA408 and SB407-SB408, the two entities A and B each receive a key disclosed by the protocol initiation counterpart from the public key directory, thereby receiving the received public key and its secret. A step of calculating one session key K by performing one or more operations (*) previously defined in the braid group with a key. The session key calculating step includes receiving a public key y _B of another entity B exposed in the public key directory (SA407) performed by the entity A, and receiving the received public key y _B and its own private key. calculating a session key K = a _A y _B b _A by performing one or more operations (*) defined in the braid group Bn using a _A and b _A (SA408), and the other entity B receiving a public key x _a of the entity a exposed to the public-key directory to perform (SB407), and the received public key x _a and his secret key a _B, b _B, using the braid groups Bn It may comprise a step (SB408) to calculate the session key K = a _B x _A b _B by performing one or more operations (*) previously defined in.

Referring to the key agreement protocol implementation according to the above embodiment.

First, the two entities A and B to form a key agreement are all braids of the subgroups G _A and H _A specified by the entity A from the braid group Bn having one defined operation (*) and the index n. From a) (b), the subgroups G _A , H _A , which are not common to all the braids of the subgroups G _B , H _B defined by another entity B, and whose exchange law holds for the calculation (*); and G _B and H _B are defined (SA401, SB401), respectively. Next, the receiving entity A (10) is the subgroup G _A in singles any braids, a _A to a random, it kept secret key out choose randomly any of the braids, b _A in subgroup H _A and (SA402 ), Randomly selecting a common braid (Δ) from the braid group Bn (SA403), and calculating the public key x _A = a _A Δ ^p b _A (where p is any integer) (SA404) Publish to the cache directory 30 (SA405).

Transmitting side entity B (20) is the subgroup G _B out from the pick any braids, a _B to a random, keeping subgroup secret key out choose randomly any of the braids, b _B from H _B and (SB402), the After randomly selecting a common braid Δ from the braid group Bn (SB403), the public key y _B = b _B Δ ^p a _B is calculated (SB404) and disclosed to the public key directory 30 (SB405). . This value has no security impact if left exposed in a public directory. Finally, the receiving entity A 10 receives (SA407) the public value y _B of the transmitting entity B 30 (SA407), and uses K = using the private keys a _A and b _A kept secret. Calculate a _A y _B b _A (SA408). The transmitting entity B 20 receives (SB407) the public value x _A of the receiving entity A 10 (SB407), and uses K = a _B x using the private keys a _B and b _B that it has kept secret. _A b _B is calculated (SB408). Here, the session key value K calculated by the entity A is a _A y _B b _A , and the session key value K calculated by the entity B is b _B x _A a _B. However, according to the respective braids belonging to the subgroups G _A , H _A and G _B , H _B specifically defined for the condition (a) (b) from the braid group Bn, the condition (a) (b _{B A} a _B = a _B b _A , and b _B a _A = a _A b _B. Therefore, the two session key value came up with substance is calculated each a _A y _B b _A and b _B x _A a _B is a _A y _B b _A = a _A b _B Δ ^p a _B b _A = b _B a _A Δ ^p b _A It is simply proved that a _B = b _B x _A a _B are identical to each other. By this process, the two entities A and B initiating the key agreement protocol calculate a single public key using single braid and disclose it to the protocol initiating party, and receive one public key exposed by the protocol initiating party. One session key can be calculated, whereby the two entities A and B automatically have one and the same session key K.

The key agreement protocol implemented by the above embodiment is the difficulty of Decomposition Problem, which is known as a difficult problem in the braid group (for example, Δ is a braid belonging to Bn, and the secret key a of entity A is subgroup G Difficulty in finding a or b when the private key b of entity B belongs to subgroup H, and knows Δ, y from public key y = aΔb; where G and H are part of braided group Bn Group security). That is, assume that the third party C knows the public key x _A = a _A Δ ^p b _A of entity A. And if the C is to find out a secret key of a _A, b _A of Group A, the C should seek the private key a _A, b _A of the entity A with the published x _A, Δ ^p. But this is what solves the decomposition problem, which has been a difficult problem for a long time, and is actually very difficult to solve. The same applies to B, of course.

5 is a flowchart illustrating another embodiment of a key agreement protocol implementation method according to the present invention, in which entity A, which initiates the protocol, and its corresponding entity B, have a difficulty in generalizing a dipy-Hellman type decomposition problem using double-plating We illustrate the implementation of the protocol from the first to the third phase, which is based on the security and makes the key agreement.

The first steps SA501-SA503 and SB501-SB503 are initial setting steps for defining various conditions that the two entities A and B initiating a protocol must know in advance in order to achieve a key agreement. Since the processing steps are the same as those of the illustrated first steps SA401-SA403 and SB401-SB403, a detailed description thereof will be omitted.

In the second steps SA504-SA506 and SB504-SB506, the two entities A and B each use the common braid Δ and their secret keys a _A , b _A , and a _B , b _B , respectively. By performing one or more operations (*) previously defined in the braid group to generate two public keys (x _A , y _A , x _B , y _B ), respectively, and publishing the public keys in the public key directory, respectively. This is the step.

This public key generation and disclosure step includes calculating exponents of arbitrary integers p and q to the common selected braid Δ performed by the entity A to calculate Δ ^p and Δ ^q , respectively (SA504), and calculating _A new word x _A consisting of a plurality of braid products as the result of the calculation by performing one or more operations (*) previously defined in the braid group using Δ ^p and Δ ^q and their secret keys a _A and b _A. = a _A Δ ^p b _A , y _A = b _A Δ ^q a _A respectively generated (SA505), and the generated words x _A and y _A are stored in the public key directory as a public key known to the protocol initiator. Exposing (SA506), and exponentially multiplying any integer p, q to the common selected braid Δ performed by the other entity B, and calculating Δ ^p , Δ ^q , respectively (SB504), and calculating the Δ ^p and Δ ^q and 1 to his private key a _B, calculated based on the braid groups are defined by using the b _B (*) times Phase done by a new word formed of a plurality of braided imgop a result of the calculation x _B = a _B Δ ^p b _B, y _B = b _B Δ ^q a and step (SB505) for generating respectively a _B, the generated word x _B , with the public key that the other party Al discloses a y _B protocol may comprise a step (SB506) is exposed to the public key directory.

The third step (SA507-SA508, SB507-SB508), the two entities A, B receive the keys disclosed by the protocol initiation counterpart from the public key directory, respectively, the received public keys and their own Computing two operations (K ₁ , K ₂ ) by performing one or more operations (*) previously defined in the braid group as a secret key.

The session key calculating step includes receiving a public key x _B , y _B of another entity B exposed in the public key directory (SA507) performed by the entity A, and receiving the received public key x _B , y Session key K ₁ = b _A x _B a _A , K ₂ = a _A y by performing one or more operations (*) defined in the braid group Bn using _B and its private keys a _A and b _A Calculating _B b _A , receiving the public keys x _A , y _A of the entity A exposed in the public key directory, performed by the other entity B (SB507), and receiving the received disclosure. Session key K ₁ = a _B x _A b _B , K by performing one or more operations (*) defined in braid group Bn using keys x _A , y _A and their secret keys a _B , b _B It may be configured to include a step (SB408) to calculate ₂ = b _B x _A a _B.

A key agreement protocol implementation according to another embodiment will now be described.

First, the two entities A and B to form a key agreement are all braids of the subgroups G _A and H _A specified by the entity A from the braid group Bn having one defined operation (*) and the index n. From a) (b), the subgroups G _A , H _A , which are not common to all the braids of the subgroups G _B , H _B defined by another entity B, and whose exchange law holds for the calculation (*), and G _B and H _B are defined (SA501 and SB501), respectively. Next, the receiving entity A (10) is the subgroup G _A in singles any braids, a _A to a random, it kept secret key out choose randomly any of the braids, b _A in subgroup H _A and (SA502 ), Randomly selecting a common braid (Δ) from the braid group Bn (SA503), and then public key x _A = a _A Δ ^p b _A , y _A = b _A Δ ^q a _A (where p, q Calculates an arbitrary integer (SA504) and publishes it to the empty cache directory 30 (SA505).

Transmitting side entity B (20) is the portion of the group G _B in the singles any braids, a _B to a random hold subgroup secret key out choose randomly any of the braids, b _B from H _B and (SB502), the braided Randomly select one common braid (Δ) from the group Bn (SB503), then calculate the public key x _B = a _B Δ ^p b _B , y _B = b _B Δ ^q a _B (SB504) (30) (SB405). This value has no security impact if left exposed in a public directory. Finally, the receiving entity A 10 receives (SA507) the public values x _B and y _B of the transmitting entity B 30 (SA507), and uses the private keys a _A and b _A that they have kept secret. Calculate K ₁ = b _A x _B a _A , K ₂ = a _A y _B b _A (SA508). The transmitting entity B 20 receives (SB507) the public values x _A and y _A of the receiving entity A 10 (SB507), and uses the secret keys a _B and b _B that it has kept secret to K _1. = a _B y _A b _B , K ₂ = b _B x _A a _B is calculated (SB508). Here, the session key values K ₁ and K ₂ calculated by the entity A are K ₁ = b _A x _B a _A , K ₂ = a _A y _B b _A , and the session key values K ₁ and K ₂ calculated by the entity B, respectively. Are K ₁ = a _B y _A b _B and K ₂ = b _B x _A a _B, respectively. However, according to the respective braids belonging to the subgroups G _A , H _A , and G _B , H _B specifically defined for the condition (a) (b) from the braid group Bn, the condition (a) ( From b) b _A a _B = a _B b _A and b _B a _A = a _A b _B. Therefore, the values of one session key (K ₁ ) calculated by the two entities, respectively, b _A x _B a _A and a _B y _A b _B are x _B = a _B Δ ^q b _B , y _A = b _A Δ ^q a _A And b _A a _B = a _B b _A , b _B a _A = a _A b _B from b _A x _B a _A = b _A a _B Δ ^q b _B a _A = a _B b _A Δ ^q a _A b _B = a _B y _A b _B and the other session key (K ₂ ) values a _A y _B b _A and b _B x _A a _B are x _A = a _A Δ ^p b _A , y _B = b _B Δ ^p a _B and b _A a _B = a _B b _A , b _B a _A = a From _A b _B , a _A y _B b _A = a _A b _B Δ ^p a _B b _A = b _B It can be simply demonstrated that a _A Δ ^p b _A a _B = b _B x _A a _B is the same.

By this process, the two entities A and B initiating the key agreement protocol compute two public keys using single braiding, disclose them to the protocol initiating party, and receive two public keys exposed by the protocol initiating party. It is possible to calculate two session keys, so that the two entities A, B automatically have the same two identical session keys (K ₁ , K ₂ ).

The key agreement protocol implemented by the other embodiments described above is the difficulty of the Generalized Diffie-Hellamn type Decomposition Problem, which is known to be a difficult problem in the braided group (e.g., (Δ, y _A , y _B ) For key ∈ Bn x Bn x Bn and for A _A ∈ G _A , b _A ∈ H _A , a _B ∈ G _B , b _B ∈ H _B , the calculated and released key y _A = a _A Δb _A When B is the calculated and published key y _B = a _B Δb _B , b _B y _A a _B (or b _A y _B a _A ) using known Δ, y _A or known Δ, y _B Difficulty in obtaining b _B, a _B (or b _A, a _A ) from G _A , H _A , G _B , H _B , where subgroups of Bn are {G _A , H _B } and {G _B , _A pair of H _A }, respectively, for any two braids g ∈ G, h ∈ H, provided that the stability of the protocol satisfies the property of gh = hg, ie the third party C is an entity. A's public key x _A = a _A Δ ^p b _A , y _A = b _A Δ ^q a _A Suppose we know the public key x _B = a _B Δ ^q b _B , y _B = b _B Δ ^p a _B of entity B, and C is known as x _A , y _A , Δ ^p , Δ ^q or If we try to find out the session keys K ₁ , K ₂ which are the common secret keys of entity A and B from x _B , y _B , Δ ^q , Δ ^p , C is the private key a _A , b _A or entity B of entity A Without knowing the secret keys a _B and b _B , it is difficult to find the session key, which is a solution to the generalized Diffie-Hellman decomposition, which has long been a difficult problem. Indeed, it is also very difficult to solve, as well as for B.

According to the present invention, unlike the known cipher systems, by using a non-cyclic braid group, there is no known method for solving the polynomial time, so there is an advantage of securing safety and security. . In addition, since the product in the braid group is not a multiplication of numbers but a calculation of a starting set and a finishing set of permutations, there is an advantage that a key agreement can be achieved at a fast calculation speed. Therefore, the present invention not only can be used among computers in use at present, but also has an effect that it can be used as a useful encryption system for wireless communication (for example, communication using a mobile computer).

Claims (6)

In a method for implementing a protocol in which the entity A initiating the protocol and the corresponding other entity B achieve a key agreement based on the safety of difficulty of decomposition or generalized Diffie-Hellman type decomposition, From a braid group B _n with one defined operation and index n as a set of constructors, one entity A defines subgroups G _A , H _A , and another entity B defines subgroups G _B , but defines a H _B, for all of braids, x and all braids, y in H _B of G _a and an operation relationship between the xy = yx is satisfied, the xy = yx for all braids, y of all braids, x and H _a of G _B The two entities A and B, which define subgroups G _A , H _A , G _B , and H _B so that arithmetic relations are established, each belong to the self-defined subgroups G _A , H _A and G _B , H _B. Selecting a private key of A _A , b _A and a _B , b _B and selecting one common braid from the braid group Bn; A second step of calculating and publishing a public key with the selected private key and the common braid; And And a third step of calculating a session key using the public key of the protocol initiating party and its private key. In a method of implementing a protocol in which the entity A initiating the protocol and the corresponding entity B achieve a key agreement based on the safety of the difficulty of decomposition or generalized Diffie-Hellman type decomposition, From a braid group B _n with one defined operation and index n as a set of constructors, one entity A defines subgroups G _A , H _A , and another entity B defines subgroups G _B , but defines a H _B, for all of braids, x and all braids, y in H _B of G _a and an operation relationship between the xy = yx is satisfied, the xy = yx for all braids, y of all braids, x and H _a of G _B The two entities A and B, which define subgroups G _A , H _A , G _B and H _B so that arithmetic relations are established, each have one or more secret keys a _A , b _A and a _B from the defined subgroups, respectively. selecting a b _B and selecting a common braid from the braid group Bn; A second step of generating a public key by performing one or more operations previously defined in the braid group with the common braid and one or more private keys thereof, and publishing the public key in a public key directory, respectively; And A third key for receiving a key disclosed by the protocol initiating party from the public key directory, and performing the operation defined in the braid group one or more times with the received public key and its private key to calculate a session key; Key consensus protocol implementation method comprising the steps. The method of claim 1 or 2, wherein the second step The entity A calculates Δ ^p by exponentially raising any integer p to the commonly selected braid Δ; The substance A generates the calculated Δ ^p and his secret key a _A, b _A the braided by performing the operations defined based on imgun word x _A = a a _A Δ ^p b _A, and the generated word x Exposing _A to a public key directory; The other entity B calculates Δ ^p by exponentially raising any integer p to the commonly selected braid Δ; And The resulting word y _B = b _B Δ ^p a _B to perform the operations defined based on the braid groups to the other entity B is the calculated Δ ^p and his secret key, a _B, b _B, and the generated word and exposing y _B to a public key directory. The method of claim 3, wherein the third step Wherein the entity A receives the word y _B of the other entity B exposed to the public-key directory, and calculating a session key K = y _A a _B b _A by using its own private key a and _A b _A; And The step of the other entity B receives the word x _A of the other entities A exposed to the public-key directory, and calculating a session key K = b _B x _A a _B by using its own secret key, a _B and b _B Key agreement protocol implementation method comprising a. The method of claim 1 or 2, wherein the second step The entity A exponentially multiplies one or more integers p and q with the commonly selected braid Δ to calculate Δ ^p , Δ ^q ; The entity A performs a pre-defined operation on the braid group with the calculated Δ ^p , Δ ^q and its private keys a _A , b _A , thereby providing a plurality of words x _A = a _A Δ ^p b _A , y _A = generating b _A Δ ^q a _A and exposing the generated plurality of words x _A , y _A to a public key directory; Calculating, by the other entity B, Δ ^p , Δ ^q by exponentially multiplying one or more integers p and q to the commonly selected braid Δ; And The other entity B performs a pre-defined operation on the braid group with the calculated Δ ^p , Δ ^q and its secret keys a _B , b _{B so} that a plurality of words x _B = a _B Δ ^p b _B , y _B generating a _B Δ ^q a _B and exposing the generated plurality of words x _B , y _B to a public key directory. The method of claim 5, wherein the third step The entity A receives a plurality of words x _B , y _B of another entity B exposed in the public key directory, and uses a plurality of session keys K ₁ = b _A x _B using its private keys a _A , b _A. calculating a _A , K ₂ = a _A y _B b _A ; And the other entity B receives a plurality of words x _A , y _A of the entity A exposed in the public key directory, and uses a plurality of session keys K ₁ = a _B x using its private keys a _B , b _{B. And} calculating _A b _B , K ₂ = b _B x _A a _B.