Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3218—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs

Definitions

• the present invention relates to methods, systems and devices for proving the authenticity of an entity and / or the integrity and / or authenticity of a message.
• Patent EP 0 311 470 B 1 the inventors of which are Louis Guillou and Jean-Jacques Quisquater, describes such a process. We will refer to it below by designating it by the terms: "GQ patent” or "GQ process”. In the following, the present invention will sometimes be referred to as "GQ2", “GQ2 invention” or "GQ2 technology”.
• an entity called "trusted authority” assigns an identity to each entity called “witness” and calculates the RSA signature; during a personalization process, the trusted authority gives identity and signature to the witness. Thereafter, the witness proclaims: "Here is my identity; I know the RSA signature.” The witness proves without revealing it that he knows the RSA signature of his identity. Thanks to the public RSA verification key distributed by the trusted authority, an entity called “controller” verifies without knowing that the RSA signature corresponds to the proclaimed identity. The mechanisms using the GQ process take place "without knowledge transfer”. According to the GQ method, the witness does not know the RSA private key with which the trusted authority signs a large number of identities.
• the GQ technology previously described uses RSA technology.
• the GQ2 technology avoids the drawbacks presented by the RSA technology.
• the GQ method implements modulo calculations of numbers of 512 bits or more. These calculations relate to numbers having substantially the same size raised to powers of the order of 2 16 + 1.
• the existing microelectronic infrastructures in particular in the field of bank cards, make use of monolithic self-programmable microprocessors devoid of arithmetic coprocessors .
• the workload linked to the multiple arithmetic operations involved in processes such as the GQ process leads to calculation times which in some cases prove to be penalizing for consumers using bank cards to pay for their purchases.
• the invention relates to a method intended to prove to a controlling entity
• Said public value Gi is the square ( 2 of a base number g t lower than the f prime factors p embarkp 2 , ... p f .
• the base number g j is such that: the two equations: x 2 ⁇ i mod n and x 2 ⁇ - g ⁇ mod n have no solution in x in the ring of integers modulo n and such that: the equation: x v ⁇ ⁇ mod na solutions in x in the ring modulo n integers.
• the said method implements, according to the steps defined below, an entity called a witness.
• the witness calculates commitments R in the ring of integers modulo n. Each commitment is calculated:
• the witness receives one or more challenges d.
• Each challenge d has m integers d j hereinafter called elementary challenges.
• the witness calculates from each challenge of a response D,
• the method according to the invention is intended to prove the authenticity of an entity called a demonstrator at a entity called controller.
• Said demonstrator entity comprises the witness.
• Said demonstrator and controller entities execute the following steps:
• step 1 act of engagement R
• the witness calculates each engagement R by applying the process specified above.
• the demonstrator transmits to the controller all or part of each engagement R.
• step 2 act of challenge d
• the controller after having received all or part of each R engagement, produces challenges d in a number equal to the number of R engagements and transmits the challenges d to the demonstrator.
• the witness calculates D responses from challenges d by applying the process specified above. • step 4: act of control
• the demonstrator transmits each response D to the controller.
• the controller having the m public values G réelleG 2 , ...
• G m calculates from each challenge d and each response D a reconstructed engagement R 'satisfying a relation of the type: R' ⁇ G, dl . G 2 a . ... G m dm . D v mod n or has a relation of the type, R ' ⁇ D v / G 1 dl . G 2 d2 . ... G m dm . mod n.
• the controller verifies that each reconstructed engagement R 'reproduces all or part of each engagement R which has been transmitted to it,
• the demonstrator transmitted all of the R commitments
• the controller having the m public values G réelleG 2 , ... G m , checks that each engagement R satisfies a relation of the type: R ⁇ G ! dl . G 2 ⁇ . ... G m -B . D v mod n or has a relation of the type,
• the method according to the invention is intended to prove to an entity called controller the integrity of a message M associated with an entity called demonstrator.
• Said demonstrator entity comprises the witness.
• Said demonstrator and controller entities execute the following steps:
• step 1 act of engagement R At each call, the witness calculates each engagement R by applying the process specified above.
• step 2 act of challenge d
• the demonstrator applies a hash function h having as arguments the message M and all or part of each engagement R to calculate at least one token T.
• the demonstrator transmits the token T to the controller.
• the controller after receiving a token T, produces challenges d in a number equal to the number of engagements R and transmits the challenges d to the demonstrator.
• step 3 D response act The witness calculates D responses from the challenges by applying the process specified above.
• step 4 act of control
• the demonstrator transmits each response D to the controller.
• the controller having the m public values G réelleG 2 , ... G m , calculates from each challenge d and each response D a reconstructed commitment R 'satisfying a relationship of the type:
• the controller applies the hash function h having as arguments the message M and all or part of each reconstructed engagement R 'to reconstruct the token T ⁇ Then the controller verifies that the token T' is identical to the token T transmitted. Digital signature of a message and proof of its authenticity
• the method according to the invention 1 is intended to produce the digital signature of a message M by an entity called the signatory entity.
• Said signatory entity includes the witness.
• Said signatory entity performs a signature operation with a view to obtaining a signed message comprising:
• Said signatory entity executes the signature operation by implementing the following steps:
• step 1 act of engagement
• the witness calculates each engagement R by applying the process specified above.
• step 2 act of challenge d
• the signatory applies a hash function h having as arguments the message M and each commitment R to obtain a binary train.
• the signatory extracts from this binary train challenges d in a number equal to the number of commitments R.
• the witness calculates D responses from challenges d by applying the process specified above. Control operation
• an entity checks the signed message.
• Said controller entity having the signed message performs a control operation by performing the following steps. • case where the controller has commitments R, challenges d, responses D,
• the controller reconstructs, from each challenge d and each response D, commitments R 'satisfying relationships of the type: R' ⁇ G, dl . G 2 ". ... G m dm . D v mod n or to relations of the type:
• the present invention also relates to a system intended to prove to a controller server
• n consisting of the product of f prime factors p t , p 2 , ... p f (f being greater than or equal to 2),
• Said module, said exponent and said values are linked by relationships of the type:. Q ; v ⁇ 1. mod n or Gj ⁇ Q ( v mod n.
• Said public value G; is the square g ⁇ of a base number g t less than f prime factors pudgep 2 , ... p f .
• Said system comprises a witness device, in particular contained in a nomadic object appearing for example in the form of a microprocessor bank card.
• the witness device includes a memory area containing the f prime factors Pj and / or the parameters of the Chinese remains of the prime factors and / or the public module n and / or the m private values Qi and / or the £ m components Q uj (Q i ⁇ Q, mod p j ) private values Q, and the public exponent v.
• Said witness device also includes: - means of producing hazards, hereinafter designated the means of producing hazards of the witness device,
• each commitment is calculated:
• Said witness device also includes:
• - reception means hereinafter designated the means for receiving challenges d from the witness device, to receive one or more challenges d; each challenge d comprising m integers dj hereinafter called elementary challenges; means of calculation, hereinafter designated the means of calculating the responses D of the witness device, to calculate from each challenge of a response D,
• Said witness device also comprises transmission means for transmitting one or more commitments R and one or more responses D.
• Each group of numbers R, d, D constitutes a triplet noted ⁇ R, d, D ⁇ .
• the system according to the invention is intended to prove the authenticity of an entity called a demonstrator to an entity called a controller,
• Said system is such that it includes a demonstrator device associated with the demonstrator entity.
• Said demonstrator device is interconnected to the witness device by means of interconnection.
• H can be presented in particular in the form of logic microcircuits in a nomadic object, for example in the form of a microprocessor in a microprocessor bank card.
• the system also includes a controller device associated with the controller entity.
• Said controller device is in particular in the form of a terminal or a remote server.
• Said controller device comprises connection means for connecting it electrically; electromagnetically, optically or acoustically, in particular via a computer communication network, to the demonstrator device;
• Said system allows the following steps to be carried out:
• step 1 act of engagement
• the commitment calculation means R of the witness device calculate each engagement R by applying the process specified above.
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device, for transmitting all or part of each engagement R to the demonstrator device, via the interconnection means.
• the demonstrator device also includes transmission means, hereinafter designated the demonstrator transmission means, for transmitting all or part of each engagement R to the controller device, via the connection means.
• step 2 act of challenge d
• the controller device comprises challenge production means for • - producing, after having received all or part of each engagement R, challenges d in a number equal to the number of engagements R.
• the controller device also includes transmission means, ci -after designated the controller transmission means, to transmit the challenges d to the demonstrator, via the connection means.
• step 3 response act D
• the means for receiving challenges d from the witness device receive each challenge d from the demonstrator device, via the interconnection means.
• the means for calculating the responses D of the witness device calculate the responses D from the challenges d by applying the process specified above.
• step 4 act of control
• the demonstrator's transmission means transmit each response D to the controller.
• the controller also includes:
• comparison means hereinafter designated the comparison means of the controller device.
• the comparison means of the controller device compare each reconstructed engagement R 'with all or part of each engagement R received. Second case: the demonstrator transmitted all of the R commitments
• the calculation means and the comparison means of the controller device having the m public values G "G 2, ... G m, verify that each engagement R satisfies a relation of the type:
• the system according to the invention is intended to prove to an entity called a controller the integrity of a message M associated with an entity called a demonstrator.
• Said system is such that it includes a demonstrator device associated with the demonstrator entity.
• Said demonstrator device is interconnected to the witness device by means of interconnection.
• Said demonstrator device can be in particular in the form of logic microcircuits in a nomadic object for example in the form of a microprocessor in a microprocessor bank card.
• the system also includes a controller device associated with the controller entity.
• Said controller device is in particular in the form of a terminal or a remote server.
• Said controller device comprises connection means for electrically connecting it; electromagnetically, optically or acoustically, in particular via a computer communication network, to the demonstrator device.
• Said system performs the following steps:
• step 1 act of commitment R
• the means of calculating the commitments R of the witness device calculate each commitment R by applying the process specified above.
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device, for transmitting all or part of each engagement R to the demonstrator device, via the interconnection means.
• step 2 act of challenge d
• the demonstrator device comprises calculation means, hereinafter designated the demonstrator calculation means, applying a hash function h having as arguments the message M and all or part of each engagement R, to calculate at least one token T.
• the demonstrator device also includes. transmission means, hereinafter designated the transmission means of the demonstrator device, for transmitting each token T, via the connection means, to the controller device.
• the controller device also includes challenge production means for producing, after receiving the token T, challenges d in a number equal to the number of engagements R.
• the controller device also includes transmission means, hereinafter designated the means transmission from the controller, to transmit the challenges d to the demonstrator, via the connection means.
• the means for receiving the challenges d from the witness device receive each challenge d from the demonstrator device, via the interconnection means.
• the means for calculating the responses D of the witness device calculate the responses D from the challenges d by applying the process specified above.
• step 4 act of control
• the demonstrator's transmission means transmit each D response to the controller.
• the controller device also comprises comparison means, hereinafter designated the comparison means of the controller device, for comparing the calculated token T 'with the received token T.
• the system according to the invention is intended to prove the digital signature of a message M, hereinafter referred to as the signed message, by an entity called the signatory entity.
• the signed message includes: - the message M,
• Said system is such that it includes a signatory device associated with the signatory entity.
• Said signatory device is interconnected to the witness device by interconnection means and may in particular be in the form of logic microcircuits in a nomadic object for example in the form of a microprocessor in a microprocessor bank card.
• Said system allows the following steps to be carried out:
• step 1 act of engagement
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device, for transmitting all or part of each commitment R to the signatory device, via the interconnection means.
• step 2 act of challenge d
• the signatory device comprises calculation means, hereinafter designated the calculation means of the signatory device, applying a hash function h having as arguments the message M and all or part of each engagement R, to calculate a binary train and extract from this binary train challenges d in number equal to the number of commitments R.
• step 3 response act D
• the means for receiving challenges d from the witness device receive each challenge d from the signatory device, via the interconnection means.
• the means of calculating the responses D of the witness device calculate the responses D from the challenges d by applying the process specified above.
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device, for transmitting the responses D to the signatory device, via the interconnection means. Control operation
• an entity called controller checks the signed message.
• Said system comprises a controller device associated with the " controller " entity.
• Said controller device is in particular in the form of a terminal or a remote server.
• Said controller device comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to the signatory device.
• the signatory device associated with the signatory entity comprises transmission means, hereinafter designated the means of transmission of the signatory device, for transmitting to the controller device, the signed message, via the connection means.
• the controller device has a signed message comprising: - the message M,
• the controller device comprises: - calculation means, hereinafter designated the calculation means of the controller device,
• comparison means hereinafter designated the comparison means of the controller device.
• the means of calculation and comparison of the controller device verify that the commitments R, challenges d and responses D satisfy relations of type R ⁇ G, d, .G 2 d2 .... G- n d ⁇ , .D v modn or to relations of the type:
• Terminal device The invention also relates to a terminal device associated with an entity.
• the terminal device is in particular in the form of a nomad object " for example in the form of a microprocessor bank card.
• the ' terminal device is intended to prove to a controller device:
• n consisting of the product of f prime factors p n p 2 , ... p f (f being greater than or equal to 2),
• Said public value G j is the square & 2 of a base number g, less than the f prime factors p., P 2 , ... p f .
• the base number j is such that: the two equations: x 2 ⁇ giinod n and x ⁇ ⁇ - g j inod n have no solution in x in the ring of integers modulo n and such that: the equation : x v ⁇ g 2 mod na solutions at x in the ring of integers modulo n.
• Said terminal device comprises a memory having a control area device containing f prime factors P and / or parameters of the Chinese radicals of the prime factors and / or the public modulus n and / or the private ra ⁇ Q values; and / or the tm components Q ⁇ i (Q ⁇ j ⁇ Q; mod P j ) of the private values Qi and the public exponent v.
• Said witness device also includes:
• the witness device also includes:
• each challenge d comprising m integers d, hereinafter called elementary challenges;
• - calculation means hereinafter designated the means for calculating the responses D of the control device, to calculate from each challenge of a response D, • either by performing operations of the type:
• Said witness device also includes transmission means for transmitting one or more commitments R and one or more responses D. There are as many responses D as challenges d as commitments R Each group of numbers R, d, D constituting a triplet noted ⁇ R, d, D ⁇ . Case of proof of the authenticity of an entity
• the terminal device according to the invention is intended to prove the authenticity of an entity called a demonstrator to an entity called a controller.
• Said terminal device is such that it includes a demonstrator device associated with the demonstrator entity.
• Said demonstrator device is interconnected to the witness device by interconnection means.
• D can be presented in particular in the form of logic microcircuits in a nomad object for example in the form of a microprocessor in a microprocessor bank card.
• Said demonstrator device also comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to the controller device associated with the controller entity.
• Said controller device is in particular in the form of a terminal or a remote server.
• Said terminal device makes it possible to execute the following steps:
• step 1 act of engagement
• the commitment calculation means R of the witness device calculate each engagement R by applying the process specified above.
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device, for transmitting all or part of each engagement R to the demonstrator device, via the r interconnection means.
• the demonstrator device also includes transmission means, hereinafter designated the demonstrator transmission means, for transmitting all or part of each engagement R to the controller device, via the connection means.
• the means for receiving challenges d from the witness device receive each challenge d from the controller device via the connection means between the controller device and the demonstrator device and via the interconnection means between the demonstrator device and the witness device.
• the means of calculating the responses D of the witness device calculate the responses D from the challenges d by applying the process specified above. above.
• step 4 act of control
• the demonstrator's transmission means transmit each response D to the controller device which carries out the control. Proof of the integrity of a message
• the teiminal device according to the invention is intended to prove to an entity called a controller the integrity of a message M associated with an entity called a demonstrator.
• Said terminal device is such that it includes a demonstrator device associated with the demonstrator entity, said demonstrator device is interconnected to the witness device by interconnection means. It can be presented in particular in the form of logic microcircuits in a nomad object for example in the form of a microprocessor in a microprocessor bank card.
• Said demonstrator device comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to the controller device associated with the controller entity.
• Said controller device is in particular in the form of a terminal or a remote server.
• Said terminal device makes it possible to execute the following steps:
• step 1 act of engagement
• the witness device comprises transmission means, hereinafter designated the means of transmission of the witness device, to transmit all or part of each commitment R to the demonstrator device, via the interconnection means.
• the demonstrator device comprises calculation means, hereinafter designated the demonstrator calculation means, applying a hash function h having as arguments the message M and all or part of each engagement R, to calculate at least one token T.
• the demonstrator device also comprises transmission means, hereinafter designated the means of transmission of the demonstrator device, for transmitting each token T, via the connection means, to the controller device. Said controller device produces, after receiving the token T, challenges d in a number equal to the number of engagements R.
• the means for receiving challenges d from the witness device receive each challenge d from the controller device via the connection means between the controller device and the demonstrator device and via the interconnection means between the demonstrator device and the witness device.
• the means of calculating the responses D of the witness device calculate the responses D from the challenges d by applying the process specified above.
• stage 4 act of control
• the means of transmission of the demonstrator transmit each response D to the controller device which carries out the control.
• the terminal device according to the invention is intended to produce the digital signature of a message M, hereinafter referred to as the signed message, by an entity called the signatory entity.
• the signed message includes:
• Said terminal device is such that it includes a signatory device associated with the signatory entity.
• Said signing device is interconnected to the witness device by means of interconnection.
• D can be presented in particular in the form of logic microcircuits in a nomad object for example in the form of a microprocessor in a microprocessor bank card.
• Said signatory device comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to the controller device associated with the controller entity.
• Said controller device is in particular in the form of a terminal or a remote server.
• Signature operation Said terminal device makes it possible to execute the following steps:
• step 1 act of commitment R
• the means of calculating the commitments R of the witness device calculate each commitment R by applying the process specified above.
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device, for transmitting all or part of each commitment R to the signatory device, via the interconnection means.
• step 2 act of challenge d
• the signatory device comprises calculation means, hereinafter designated the calculation means of the signatory device, applying a hash function h having as arguments the message M and all or part of each engagement R, to calculate a binary train and extract from this binary train challenges d in number equal to the number of commitments R.
• the means for receiving challenges d from the witness device receive each challenge d from the signatory device, via the interconnection means.
• the means of calculating the responses D of the witness device calculate the responses D from the challenges d by applying the process specified above.
• the witness device comprises transmission means, hereinafter designated the transmission means of the witness device for transmitting the responses D to the signatory device, via the interconnection means.
• Controller device The invention also relates to a controller device.
• the controller device can be in particular in the form of a terminal or a remote server associated with a controller entity.
• the controller device is intended to control:
• n consisting of the product of f prime factors p réellep 2 , ... p f (f being greater than or equal to 2) unknown to the controller device and the associated controller entity, - a public exponent v.
• Said public value G is the square g ( 2 of a lower base number g i to the prime factors p embarkp 2 , ... p f .
• the basic number g ( is such that: the two equations: x 2 ⁇ g j mod n and x 2 ⁇ - & mod n have no solution in x in the ring of integers modulo n and such that: l equation: x v ⁇ j 2 mod na solutions at x in the ring of integers modulo n.
• the controller device is intended to prove the authenticity of an entity called a demonstrator to an entity called a controller.
• Said controller device comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to a demonstrator device associated with the demonstrator entity.
• Said controller device makes it possible to execute the following steps: • steps 1 and 2: act of engagement R, act of challenge d
• Said controller device also includes means for receiving all or part of the commitments R coming from the demonstrator device, via the connection means.
• the controller device comprises challenge production means for producing, after having received all or part of each engagement R, challenges d in number equal to the number of engagements R, each challenge d comprising m integers d ( hereinafter called challenges).
• the controller device also includes transmission means, hereinafter referred to as the controller transmission means, for transmitting the challenges d to the demonstrator, via the connection movens. • stages 3 and 4: response act D, control act
• Said controller device also includes:
• connection means - calculation means for receiving responses D from the demonstrator device, via the connection means - calculation means, hereinafter designated the calculation means of the controller device
• comparison means hereinafter designated the comparison means of the controller device.
• the calculation means of the controller device having the m public values G réelleG ⁇ ... G m , calculate from each challenge d and of each response D a reconstructed engagement R 'satisfying a relation of the type:
• the comparison means of the controller device compare each reconstructed engagement R 'with all or part of each engagement R received.
• the calculation means and comparison means of the controller device having m public values
• the controller device according to the invention is intended to prove the integrity of a message M associated with an entity called a demonstrator.
• Said controller device comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to a demonstrator device associated with the demonstrator entity.
• Said controller device makes it possible to carry out the following steps:
• Said controller device also comprises means for receiving tokens T from the demonstrator device, via the connection means.
• the controller device comprises challenge production means for producing, after receiving the token T, challenges d in a number equal to the number of engagements R, each challenge d comprising m integers d j hereinafter called elementary challenges.
• the controller device also includes transmission means, hereinafter designated the controller transmission means, for transmitting the challenges d to the demonstrator, via the connection means.
• Said controller device comprises means for receiving responses D from the demonstrator device, via the connection means.
• Said controller device also comprises calculation means, hereinafter designated the calculation means of the controller device, having m public values G réelleG 2 , ... G m , for one hand, calculating from each challenge d and of each response D a reconstructed engagement R ' satisfying a relationship of the type:
• R ' D v / G ⁇ d ,. G 2 d2 . ... G m dm . mod n then on the other hand, calculate by applying a hash function h having as arguments the message M and all or part of each reconstructed engagement R ', a token T'.
• the controller device also comprises comparison means, hereinafter designated the comparison means of the controller device, for comparing the calculated token T 'with the received token T.
• the controller device In a third alternative embodiment capable of being combined with one and / or the other of the first two, the controller device according to the invention is intended to prove the authenticity of the message M by controlling, by an entity called controller, a signed message.
• the signed message emitted by a signatory device associated with a signatory entity having a hash function h (message, R), comprises:
• Said controller device comprises connection means for connecting it electrically, electromagnetically, optically or acoustically, in particular via a computer communication network, to a signatory device associated with the signatory entity. Said controller device receives the signed message from the signatory device, via the connection means.
• the controller includes:
• comparison means hereinafter designated the comparison means of the controller device.
• the means of calculation and comparison of the controller device verify that the commitments R, challenges d and responses D satisfy relations of type R ⁇ G 1 dl .G 2 d2 .... G m dm .D v modn or to relations of the type:
• GQ technology dynamic authentication of entities and associated messages, as well as the digital signature of messages.
• the classic version of GQ technology uses RSA technology.
• this part of the invention relates more specifically to the use of sets of GO2 keys in the context of dynamic authentication and digital signature.
• GQ2 technology does not use RSA technology. The objective is twofold: on the one hand, to improve performance compared to RSA technology; on the other hand, avoid the problems inherent in RSA technology.
• GQ2 is the factorization of the module ⁇ . Any attack at the level of GQ2 striplets comes down to the factorization of the module n: this time there is equivalence. With GQ2 technology, the workload is reduced, as much for the entity that signs or authenticates as for that which controls. Thanks to a. better use of the factorization problem, both in terms of security and performance, GQ2 technology competes with RSA technology. GQ2 technology uses one or more small whole numbers larger than 1, say m small whole numbers (m ⁇ 1) called "base numbers" and denoted by g t . The basic numbers being fixed from g, to g m with m> 1, a public verification key (v, n) is chosen as follows.
• the public verification exponent v is 2 * where k is a small integer greater than 1 (k ⁇ 2).
• the public module n is the product of at least two prime factors larger than the base numbers, say / prime factors (f ⁇ 2) denoted by p., De, ... p f
• the / prime factors are chosen so that the public module n has the following properties with respect to each of the m base numbers of g, to g m .
• equations (1) and (2) have no solution in x in the ring of integers modulo n, that is to say that g t and -g. are two non-quadratic residues (mod n).
• x 2 g, (mod ⁇ ) (1)
• equation (3) has solutions at x in the ring of integers modulo n.
• each base number g. determines a pair of values GQ2 comprising a public value G, and a private value Q t : let m denote couples from G, Q x to G m Q m .
• the private value Q t is one of the solutions to equation (3) or the reverse (mod n) of such a solution.
• the module n is broken down into / prime factors
• the ring of integers modulo n is broken down into / Galois field, from CG (p to- CG ⁇ ).
• the projections of equations (1), (2) and (3) in CG (p. X 2 ⁇ g ⁇ (mod p j ) (l .a) x 2 ⁇ -g, (mod p j ) (2.a )
• Each private value Q t can be represented in a unique way by / private components, one by prime factor: Q t ⁇ Q t (mod /?).
• Each private component Q ⁇ is a solution to equation (3.a) or the reverse
• the parameters of the Chinese remains can be as follows (there are -l, that is, one less than prime factors)
• the first parameter of the Chinese remains is ⁇ ⁇ ⁇ p 2 (mod / ?,) ⁇ ' ' (mod / ?,).
• the second parameter of the Chinese remains is ⁇ ⁇ ⁇ >,. /? - (mod />.) ⁇ " '(mod / ?.).
• the i th parameter of the Chinese remains is ⁇ ⁇ ⁇ /?,./? r ... / _ ⁇ (modp ,.) ⁇ " '(mod / ?,). 5 And so on.
• the classic representation in GO technology consists in storing m private values Q t and the public verification key (v, n); in GQ2 technology, this representation competes with the following two.
• the optimal representation in terms of workloads consists in storing the public exhibitor v, the / first factor /? y , m./ private components Q and fl parameters of the Chinese remains.
• the optimal representation in terms of private key size consists in storing the public exponent v, the m base numbers g, and the / factor first /?
• GQ2 technology does not allow a simple distinction to be made between two entities using the same module.
• each entity that authenticates or signs has its own GQ2 module.
• GQ2 modules with four prime factors, two of which are known to one entity and the other two to another.
• the dynamic authentication mechanism is a sequence of four acts: an act of commitment, an act of challenge, an act of response and an act of control.
• the demonstrator plays the acts of engagement and response /
• the controller plays the acts of challenge and control.
• a witness can be isolated, so as to isolate the most sensitive parameters and functions of the demonstrator, that is to say, the production of commitments and responses.
• the witness has the parameter k and the private key GQ2, that is to say, the factorization of the module n according to one of the three representations mentioned above: "the / prime factors and the m base numbers , • the private m./components, the prime factors and parameters of the Chinese remainders, • the m private values and the module n.
• the witness can correspond to a particular reahsation, for example, • a smart card linked to a PC forming the demonstrator together, or again, • particularly protected programs within a PC, or, • particularly protected programs within a smart card.
• the witness thus isolated is similar to the witness defined below within the signatory.
• the witness produces one or more commitments R, then as many responses D to as many challenges d.
• Each set ⁇ R, d, D ⁇ constitutes a triplet GQ2.
• the demonstrator also has, if necessary, a hash function and a message M.
• the controller has the module n and the parameters k and m; if necessary, it also has the same hash function and a message M '.
• the controller is able to reconstruct an engagement R 'from any challenge d and any response D.
• the parameters k and m inform the controller.
• the m base numbers of g, at g m are the first m prime numbers.
• Each challenge d must have m elementary challenges noted from d x to d m : one per basic number.
• Each elementary challenge from d x to d m must take a value from 0 to 2 * ⁇ '-l (the values from v / 2 to v-1 are not used).
• the value (kl) possible challenges are also likely, the value (kl).
• m dete ⁇ nine the security provided by each GQ2 triplet: an imposter who, by definition, does not know the factorization of the module has exactly a chance of success on 2 l * "l) ⁇ .
• m is from 15 to 20 , a triplet is sufficient to reasonably ensure dynamic authentication.
• the act of engagement includes the following operations.
• the witness When the witness has the m private values of Q x to Q m and of the module n, he randomly and privately draws one or more hazards r (0 ⁇ r ⁇ n); then, by k successive square elevations (mod n), it transforms each hazard r into an engagement R.
• each collection has a hazard r by prime factor / ?, (0 ⁇ r, ⁇ p; then, by k successive squared elevations (modp), it transforms each hazard r t into an engagement component R.
• R 3 06E14C8FC4DD312BA3B475F1F40CF01ACE2A88D5BB3C
• the witness establishes an engagement according to the technique of Chinese remains. There are as many commitments as there are collections of hazards.
• R Rest of China (R réelleR 2 , ... RR ⁇ 28AA7F12259BFBA81368EB49C93EEAB3F3EC6BF73B0EBD7 D3FC8395CFA1AD7FC0F9DAC169A4F6F1CETF or ? and a message M.
• the act of challenge consists in drawing at random one or more challenges of d composed each of m elementary challenges d x d ... d m ; each elementary challenge d ⁇ takes one of the values from 0 to v / 2-1. d ⁇ dd 2 ... d m
• d t ⁇ 00010 2, d ⁇ O
• ⁇ d t ⁇ 01011000 11100010 58 E2
• d d ⁇
• the controller transmits to the demonstrator each challenge d.
• the response act includes the following operations.
• the witness When the witness has the m private values of Q, at Q m and of the module n,. it calculates one or more responses D using each hazard r of the act of engagement and the private values according to the elementary challenges. D ⁇ rX (mod)
• the witness When the witness has the prime factors from p x to p. and mf private components Q., it calculates one or more collections of / response components using each collection of hazards in the act of engagement: each collection of response components has one component per prime factor.
• the witness For each collection of response components, the witness establishes an answer using the Chinese remains technique. There are as many answers as there are challenges.
• the demonstrator transmits each response D to the controller.
• control consists in controlling that each triplet ⁇ R, d, D ⁇ checks an equation of the following type for a non-zero value.
• the controller calculates a hash code H ' in chopping each restored engagement R 'and a message M'.
• Dynamic authentication is successful when the controller thus finds what he received at the end of the engagement act, that is to say, all or part of each engagement R, or else, the code hash H. s
• a sequence of elementary operations transforms the response
• the sequence includes k squares (mod n) separated by ⁇ r— 1 divisions or multipUcations (mod n) by basic numbers.
• mod n the number of bits
• the i th bit of the elementary challenge d indicates whether to use og
• the / th bit of the elementary challenge d 2 indicates whether to use g 2
• ... up to the i th bit of the elementary challenge d m which indicates whether to use g m .
• the first set of keys is an example for the first set of keys.
• D 1 (mod n) FD12E8E1F1370AEC9C7BA2E05C80AD2B692D341D46F3 2B93948715491F0EB091B7606CA1E744E0688367D7BB998F7B73D5F7 5 FDA95D5BD6347DC8778
• D 4 (mod n) 682A7AF280C49FE230BEE354BF6FFB30B7519E3C8 0 92DD07E5A781225BBD33920E5ADABBCD7284966D71 141EAA17AF
• D 8 (mod) BE9D828989A2C184E34BA8FE0F38481 1642B7B548F 870699E7869F8ED851FC3DB3830B2400C51651 1A0C28AFDD210EC3 939E69D413F0B ABC6DEC441974B A291 1 5 3 5.
• D % (mod n) 2B40122E225CD858B26D27B768632923F2BBE5
• D 2 (mod n) C66E585D8F132F7067617BC6D00BA699ABD74FB9D13E 24E6A6692CCSD2FC7B57352D66D34F5273C13F20E3FAA228D70AEC 693F8395ACEF9206B172A8A2C2CC.
• D 2 (mod n) 534C61 14D385C3E15355233C5B00D09C2490D1B8D8E
• D 4 (mod n) A9DC8DEA867697E76B4C18527DFFC49F4658473D03 4EC 1 DDE0EB21 F6F65978BE477C4231 AC9B 1EBD93D5D49422408E47 15919023B 16BC3C6C46A92BBDD6A
• the digital signature mechanism allows an entity called a signatory to produce signed messages and an entity called a controller to verify signed messages.
• Message M is any binary sequence: it can be empty.
• the message M is signed by adding to it a signature appendix which includes one or more commitments and / or challenges, as well as the corresponding responses.
• the controller has the same hash function, the parameters k and m and the module n. The parameters k and m inform the controller. On the one hand, each elementary challenge, from d to d m , must take a value from 0 to 2 * -1 -
• each challenge d must include m elementary challenges noted from d to d m , as many as basic numbers.
• the m basic numbers from g, " to g n , are the first m prime numbers.
• (kl). M being worth from 15 to 20, one can sign with four triplets GQ2 produced in parallel; with (kl).
• the signing operation is a sequence of three acts: an act of commitment, an act of challenge and an act of response. or more GQ2 triplets each comprising:. a commitment R ( ⁇ 0), a challenge of the compound of m elementary challenges denoted by d x, d 2, ... d m and a response D ( ⁇ 0)
• the signer features a hash function, the k parameter and the key private GQ2, that is to say, the factorization of the module n according to one of the three representations mentioned above.
• a witness who performs the acts of engagement and response, so as to isolate the most sensitive functions and parameters of the demonstrator.
• the witness has the parameter k and the private key GQ2, that is to say, the factorization of the module n according to one of the three representations mentioned above.
• the witness thus isolated is similar to the witness defined within the demonstrator. It may correspond to a particular embodiment, for example, • a smart card connected to a PC together forming the signatory, or, • programs particularly protected within a PC, or, • programs particularly protected within a smart card.
• the act of engagement includes the following operations.
• the witness When the witness has the m private values of Q x to Q m and of the module n, he randomly and privately draws one or more hazards r (0 ⁇ r ⁇ n); then, by k successive square elevations (mod n), it transforms each hazard r into an engagement R.
• each collection contains a hazard r by prime factor p t (0 ⁇ r ⁇ p); then, by k successive square elevations (mod / ?,), it transforms each hazard r into an engagement component R.
• the witness establishes an engagement according to the technique of Chinese remains. There are as many commitments as there are collections of hazards.
• the response act includes the following operations. When the witness has the m private values of Q x to Q m and of the module n, he calculates one or more responses D using each hazard r of the act of engagement and the private values according to the elementary challenges.
• each collection of response components includes one component per prime factor.
• each triplet GQ2 that is to say, each commitment R, each challenge d and each response D, or else, each commitment R and each corresponding response D, or else, each challenge d and each response D corresponding.
• the progress of the verification operation depends on the content of the signature appendix. We distinguish the three cases.
• the control operation comprises two independent processes, the chronology of which is indifferent.
• the controller accepts the signed message if and only if the following two conditions are met.
• each triplet must be coherent (an appropriate relation of the following type must be verified) and admissible (the comparison must be made on a non-zero value).
• the control operation begins with the reconstitution of one or more commitments R 'according to one of the two following formulas, whichever is appropriate. No reinstated commitment must be void.
• the controller must hash all the commitments R 'and the message M so as to reconstruct each challenge d.
• d d x d 2 ... d m , identical to those extracted from the Hash result (-W, R * )
• the controller accepts the signed message if and only if each reconstructed challenge is identical to the corresponding challenge listed in the appendix.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Complex Calculations (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Peptides Or Proteins (AREA)
• Error Detection And Correction (AREA)
• Storage Device Security (AREA)
• Agricultural Chemicals And Associated Chemicals (AREA)
• Mobile Radio Communication Systems (AREA)

Priority Applications (5)

Applications Claiming Priority (10)

Publications (2)

Family

ID=27515634

Family Applications (3)

Family Applications After (2)

Country Status (7)

Cited By (3)

Families Citing this family (6)

Citations (1)

Family Cites Families (22)

• 2000
  • 2000-01-27 WO PCT/FR2000/000190 patent/WO2000045550A2/fr not_active Ceased
  • 2000-01-27 CN CNB008047189A patent/CN1322700C/zh not_active Expired - Lifetime
  • 2000-01-27 CA CA002360887A patent/CA2360887C/fr not_active Expired - Fee Related
  • 2000-01-27 CN CN00804617A patent/CN1408154A/zh active Pending
  • 2000-01-27 US US09/869,966 patent/US7266197B1/en not_active Expired - Lifetime
  • 2000-01-27 WO PCT/FR2000/000189 patent/WO2000046947A2/fr not_active Ceased
  • 2000-01-27 AU AU22986/00A patent/AU769446C/en not_active Ceased
  • 2000-01-27 JP JP2000597914A patent/JP2003519447A/ja not_active Withdrawn
  • 2000-01-27 CA CA002360954A patent/CA2360954A1/en not_active Abandoned
  • 2000-01-27 CA CA002361627A patent/CA2361627A1/en not_active Abandoned
  • 2000-01-27 JP JP2000596696A patent/JP4772965B2/ja not_active Expired - Lifetime
  • 2000-01-27 CN CNB008031975A patent/CN100377520C/zh not_active Expired - Lifetime
  • 2000-01-27 AU AU22984/00A patent/AU769464B2/en not_active Ceased
  • 2000-01-27 EP EP00901657.7A patent/EP1145473B1/fr not_active Expired - Lifetime
  • 2000-01-27 JP JP2000597915A patent/JP4772189B2/ja not_active Expired - Lifetime
  • 2000-01-27 EP EP00901658.5A patent/EP1145482B1/fr not_active Expired - Lifetime
  • 2000-01-27 EP EP00901656A patent/EP1145472A3/fr not_active Withdrawn
  • 2000-01-27 US US09/889,918 patent/US7386122B1/en not_active Expired - Lifetime
  • 2000-01-27 AU AU22985/00A patent/AU769444B2/en not_active Ceased
  • 2000-01-27 WO PCT/FR2000/000188 patent/WO2000046946A2/fr not_active Ceased

Patent Citations (1)

Also Published As

Similar Documents

Legal Events