Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3218—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs

Definitions

• the present invention relates to the technical field of methods, systems and devices intended to prove the authenticity of an entity and / or the integrity and / or the authenticity of a message.
• Patent EP 0 311 470 B1 the inventors of which are Louis Guillou and Jean-Jacques Quisquater describes such a process. We will refer to it below by designating it by the terms: "GQ patent” or "GQ process”. Subsequently, we will sometimes designate by "GQ2", “invention GQ2” or “GQ2 technology” new developments in GQ technology which are the subject of pending requests filed on the same day as this request by France Telecom, TDF and the Company Mathrizk and having as inventor Louis Guillou and Jean-Jacques Quisquater. The characteristic features of these pending applications are recalled whenever necessary in the description which follows.
• an entity called “trusted authority” assigns an identity to each entity called “witness” and calculates the RSA signature; during a personalization process, the trusted authority gives identity and signature to the witness.
• the witness then proclaimed:
• the witness proved without revealing that he knows the RSA signature of his identity. Thanks to the public RSA verification key distributed by the trusted authority, an entity called “controller” verifies without knowing that the RSA signature corresponds to the proclaimed identity. The mechanisms using the GQ process take place "without knowledge transfer”. According to the GQ method, the witness does not know the RSA private key with which the trusted authority signs a large number of identities.
• the GQ technology previously described uses RSA technology. But if the RSA technology does depend on the factorization of the module n, this dependence is not an equivalence, far from it, as demonstrated by the so-called "multiplicative" attacks against the various digital signature standards implementing RSA technology.
• GQ2 technology The objective of GQ2 technology is twofold: on the one hand, to improve performance compared to RSA technology; on the other hand, avoid the problems inherent in RSA technology.
• Knowledge of the private key GQ2 is equivalent to knowledge of the factorization of module n. Any attack at the level of GQ2 triplets comes down to the factorization of the module n: this time there is equivalence.
• the workload is reduced, as much for the entity that signs or authenticates as for that which controls. Thanks to better use of the factorization problem, both in terms of security and performance, the GQ2 technology avoids the drawbacks presented by the RSA technology.
• the GQ method implements modulo calculations of numbers of 512 bits or more. These calculations relate to numbers having substantially the same size raised to powers of the order of 2 16 + 1.
• the existing microelectronic infrastructures in particular in the field of bank cards, make use of monolithic self-programmable microprocessors devoid of arithmetic coprocessors .
• the workload linked to the multiple arithmetic operations involved in processes such as the GQ process leads to calculation times which in some cases prove to be penalizing for consumers using bank cards to pay for their purchases. It is recalled here that, in seeking to increase the security of payment cards, the banking authorities pose a particularly delicate problem to solve.
• GQ2 technology implements prime factors with specific properties. Different techniques exist to produce these prime factors.
• the subject of the present invention is a method making it possible to systematically produce such prime factors.
• the invention applies to a method (GQ2 method) intended to prove to a controlling entity
• n consisting of the product of f prime factors p 1? p 2 , ... p f (f being greater than or equal to 2),
• the basic numbers g j are such that the two equations (1) and (2): x 2 ⁇ g j mod n and x 2 ⁇ - g ; mod n have no solution in x in the ring of integers modulo n, and such that equation (3): x v ⁇ ; 2 mod na solutions in x in the ring of integers modulo n.
• the method according to the invention makes it possible to produce the f prime factors p ⁇ , p 2 , ... p f . so that equations (1), (2) and (3) are satisfied.
• the method according to the invention comprises the step of choosing first:
• the safety parameter k is also chosen first.
• This particular value of the exponent v is one of the essential features of the GQ2 technology.
• the m basic numbers g x , g 2) , ... g m are chosen at least in part from the first whole numbers.
• the security parameter k is a small integer, in particular less than 100.
• the size of the module n is greater than several hundred bits.
• the prime factors p x , p 2 ⁇ , ... p f have a size close to the size of the module n divided by the number f of factors.
• the f prime factors p l 5 p 2> , ... p f are not chosen in any way.
• f prime factors p 1> 5 p 2> , ... p f a certain number of them: e will be chosen congruent to 1 modulo 4. This number e of prime factors can be zero. In the case where e is zero the module n will be hereinafter called the basic module, in the case where e> 0 the module n will be hereinafter called the mixed module.
• the fe other prime factors are chosen congruent to 3 modulo 4. This number fe of prime factors is at least equal to 2. Choice of the prime factors congruent to 3 modulo 4
• Profile f . e . 1 (g f . E. 1 ) compared to the first fe-1 prime factors, from p j to p f . e-1> Two cases are then to be considered. In either of these two cases, the first condition will be different. If Profile fe . 1 (g f . E. 1 ) is flat, we choose p f . e such that it satisfies the first condition of being complementary to p x with respect to f .
• a factor u is calculated by applying the algorithm specified below for an index ii ranging from 1 to t-2.
• the algorithm consists in repeating as much as necessary, the following sequence:
• Step 1 we calculate w 2 / G ; (mod p).
• Step 2 we raise the result to the power 2 ' "11" 1 . There are two cases to consider.
• the candidate p is accepted as a prime factor congruent to 1 modulo 4 if at the end of the second test, for all m public values G ; , it was not rejected.
• the present invention also relates to a method (GQ2 method) applying the method which has just been described and which makes it possible, let us recall, to produce f prime factors p l 5 p 2 , ... p f having particular properties.
• the method applying the method which has just been described is intended to prove to a controlling entity,
• Said public value G j is the square ; 2 of the base number g j lower than the f prime factors p 15 p 2 , ... p f .
• the basic number g j is such that the two equations: x 2 s iinod n and x 2 ⁇ - ; mod n have no solution in x in the ring of integers modulo n and such that the equation: x v ⁇ g; 2 mod na solutions in x in the ring of integers modulo n.
• Said method implements according to the following steps an entity called witness.
• Said witness entity has the prime factors p ; and / or parameters of the Chinese remains of the prime factors and / or of the public module n and / or of the m private values Q j and / or of the fjn components Q i; j (Q ; j ⁇ Q ⁇ mod P j ) private values Q ; ⁇ t of the public exhibitor c.
• the witness calculates commitments R in the ring of integers modulo n. Each commitment is calculated:
• the witness receives one or more challenges d.
• Each challenge d comprising m integers d ; hereinafter called basic challenges.
• the witness calculates from each challenge of a response D, • either by carrying out operations of the type:
• the process is such that there are as many responses D as there are challenges d as there are commitments R, each group of numbers R, d, D constituting a triplet noted ⁇ R, d, D ⁇ .
• the pairs of private values Q x , Q 2 , ... Q m and public G 1? G 2 , ... G m we use the prime factors p x , p 2 , ... p f and / or the parameters of the Chinese remainders, the base numbers g x , g 2 , ... g m and / or the public values GG 2 , ... G m to calculate:
• the values t and u are calculated as indicated above in the case where P j is congruent to 1 modulo 4.
• this part of the invention relates more specifically to the production of sets of G02 keys intended to ensure dynamic authentication and digital signature.
• GQ2 technology does not use RSA technology. The objective is twofold: on the one hand, to improve performance compared to RSA technology; on the other hand, avoid the problems inherent in RSA technology.
• the private key GQ2 is the factorization of the module n. Any attack at the level of GQ2 triplets comes down to the factorization of the module n: this time there is equivalence. With GQ2 technology, the workload is reduced, as much for the entity that signs or authenticates as for that which controls. Thanks to better use of the factorization problem, both in terms of security and performance, the GQ2 technology competes with the RSA technology.
• GQ2 technology uses one or more small whole numbers larger than 1, say m small whole numbers (m ⁇ 1) called "base numbers" and denoted by g t .
• base numbers m small whole numbers
• v, n a public verification key
• the public verification exponent v is 2 k where k is a small integer greater than 1 (k ⁇ 2).
• the public module n is the product of at least two prime factors larger than the base numbers, say / prime factors (f ⁇ 2) denoted by ⁇ ., Of p, ... p f .
• the prime factors are chosen so that the public module does not have the properties following with respect to each of the m base numbers of g, to g m .
• equations (1) and (2) have no solution in x in the ring of integers modulo n, that is to say that g, - and -g t are two residues non quadratic (mod n). x 2 ⁇ g t (mod) (i) x 2 ⁇ -g t (mod n) (2)
• equation (3) has solutions at x in the ring of integers modulo n. x 2 ⁇ g 2 (mod ⁇ ) (3) Subsequently, these properties are also called the GQ2 principles.
• the public verification key (v, n) being fixed according to the base numbers of g ⁇ to g m with m ⁇ 1, each base number g, determines a pair of values GQ2 comprising a public value G i and a private value Q t : let m be noted pairs of G, ⁇ ) , at G m Q m .
• the private value Q t is one of the solutions to equation (3) or the reverse (mod n) of such a solution.
• the ring of integers modulo n is broken down into / Galois field, from CG (p,) to
• CG (p j ) Here are the projections of equations (1), (2) and (3) in CG (pj). x 2 ⁇ Si ( mod Pj) (La) x 2 ⁇ -g i (oâ Pj ) (2. a) x 2 " ⁇ g 2 (mod Pj ) (3 a)
• Each private value Q i can be represented in a unique way by / private components, one by prime factor: Q. - ⁇ Q. (mod p.
• Each private component Q tj is a solution to equation (3.a) or else the reverse
• the parameters of the Chinese remainders can be as follows (there are a / -l, that is, one of less than prime factors).
• the first parameter of the Chinese remains is a ⁇ ⁇ p 2 (mod / ?,) ⁇ "1 (mod / ?,).
• the second parameter of the Chinese remains is ⁇ ⁇ ⁇ pp 2 (mod p 3 ) ⁇ ⁇ 1 (mod
• the third parameter of the Chinese remains is ⁇ ⁇ ⁇ pp 2. ... p x (mod p,) ⁇ "1 (mod pL).
• the object of the invention is a method for producing at random any set of GQ2 keys among all the possible sets, namely: - randomly producing any module among all the possible GQ2 modules, this is that is, the modules ensuring that, for each of the m base numbers g t , equations (1) and (2) have no solution in x in the ring of integers modulo n while the equation (3) in a. calculate all the possible solutions to each of the equations (3.a).
• the Chinese remainder technique then makes it possible to obtain a private value Q. from each set of / components from Q i X to Q if so as to obtain any solution in x of equation (3) among all possible solutions.
• ⁇ . Chinese Remains (Q i ⁇ , Q 2 , ...
• the period of the sequence ⁇ X ⁇ is p-l or a divisor of p-l. This period depends on the value of a. By definition, this period is called "the rank of a (mod p)". It is the index of appearance of the unit in the sequence ⁇ X ⁇ .
• the Galois body CG (p) has only one element of rank 1: it's 1, only one element of rank 2: it's -l , p'-l elements of rank p ', p'-l elements of rank 2.p', that is to say, of rank pl.
• CG (p) having for rank p-1 are called the “primitive” elements or even, “generators” of CG (p).
• the name is due to the fact that their successive powers in CG (p), that is to say, the terms of the sequence ⁇ X ⁇ for the indices going from 1 to pl, form a permutation of all the non-zero elements of CG (p).
• the public module n is the product of / prime factors, from / ?, to p f with / ⁇ 2, such that for each prime factor /? ; , the public exhibitor v is first with Pf-1.
• the key (v, p) respects the rank of the elements of CG (p): it swaps them.
• the inverse permutation is obtained by a key ($, •,?) Such as? -! divides vS j -1. Squares and square roots in CG (p)
• the elements x and px have the same square in CG (p).
• the key (2, p) does not permute the elements of CG (p) because pl is even.
• each non-zero element of odd rank carries a branch of length t comprising 2-1 elements, namely: an element of rank divisible by two but not by four, then, if t ⁇ 2, two elements of rank divisible by four but not by eight, then, if t ⁇ 3, four elements of rank divisible by eight but not by sixteen, then, if t ⁇ 4, eight elements of rank divisible by sixteen but not by 32, and so on.
• the 2 ' "1 ends of each branch are non-quadratic residues; their rank is divisible by 2'.
• Figures 1A to ID illustrate the function" squaring in CG (p) "by an oriented graph where each of the pl elements non-zero of the body finds its place: the non-quadratic residues are in white and the quadratic residues in black; among the quadratic residues, the elements of odd rank are encircled
• Figure 1A case where? 3 (mod 4); figure 1B: case where p is congruent to 5 (mod 8); - figure 1 C: case where /? Is congruent to 9 (mod 16); figure ID: case where p is congruent to 17 ( mod 32).
• the key (s, p) transforms every quadratic residue a into a first approximation of solution which we name r.
• the following algorithm establishes successive approximations to arrive at a square root of ⁇ from the integers r and b defined above; it uses two integer variables: w initialized by r to represent successive approximations and jj taking values among the powers of 2, from 2 to 2 ' "2 .
• equation (3.a) the rank of g 2 in CG (/?) Is divisible by 2 ", but not by 2" +1 ; the value of u is among the t-1 possible values, from 0 to t-2.
• the existence and the number of solutions in x in CG (p) to equation (3.a) depends on the values of k, t and u.
• equation (3.a) has no solution in x in CG (p).
• equation (3.a) has 2 'solutions at x in CG (p).
• equation (3.a) has 2 k solutions in x in CG (?).
• Equation (3) prohibits any prime factor /? congruent to 1 (mod 4) as soon as for one of the base numbers g, from g, to g m : or, the symbol of
• the legend of g with respect to p is equal to -1; or else, the Legendre symbol of g with respect to p is equal to +1 with the condition: u positive and greater than tk.
• p congruent to 1 (mod 4) it must fulfill one of the following two conditions for each of the base numbers g, from g, to g m , according to the two integers t and M defined above.
• a product of prime factors congruent to 1 (mod 4) cannot ensure all of the principles of GQ2 technology.
• Each GQ2 module must have at least two prime factors congruent to 3 (mod 4) such that, for each base number g, the Legendre symbol of g with respect to one differs from the Legendre symbol of g with respect to l 'other.
• all the prime factors are congruent to 3 (mod 4)
• we will say that the module GQ2 is basic.
• module n the module includes one or more prime factors congruent to 1 (mod 4), we will say that the module GQ2 is mixed.
• GQ2 is mixed.
• the global constraints to be imposed on module n must be set: a size in bits (for example, 512 or 1024 bits) as well as a number of successive bits at 1 in high order (at least one of course, typically 16 or 32 bits), a number / of prime factors and an e number (which may be zero) of prime factors must be congruent to 1 (mod 4); the other prime factors, that is, at least two, must be congruent to 3 (mod 4).
• the module n will be the product of / prime factors of neighboring sizes.
• a basic GQ2 module is the product of prime factors all congruent to 3 (mod 4).
• a mixed GQ2 module therefore appears as the product of a basic GQ2 module by one or more other prime factors congruent to 1 (mod 4).
• Choice of the prime factors congruent to 3 (mod 4) From the second factor, the program requests and uses a basic number per factor. For the choice of the last factor congruent to 3 (mod 4), the program asks if there are other basic numbers, that is, if m is equal or greater. fe, then, if this is the case, requests and takes into account the last basic numbers, from g ⁇ to g m .
• the profile of g with respect to a single prime number congruent to 3 (mod 4) is always flat. This extension makes it possible to generalize the algorithm for choosing prime factors congruent to 3 (mod 4).
• the profiles of two basic numbers g, and g 2 are different, which implies at least three prime factors congruent to 3 (mod 4)
• the knowledge of the two private values ⁇ 2, and Q 2 induces the knowledge of two decompositions different from module n.
• the base numbers are small prime numbers
• the program ensures that the profiles of the 2 _e_1 -l multiplicative combinations of the first fe-1 base numbers are all different: they take all possible values.
• the notion of profile does not extend to the prime factors congruent to 1 (mod 4).
• Second prime factor p 2 congruent to 3 (mod 4) taking into account the first base number g,: Each candidate must be complementary to / ?, with respect to g j .
• Profile ⁇ g,) is flat, each candidate must be complementary to / ?, with respect to g Otherwise, among the i- basic numbers g ,, g 2 , ...
• G is on a cycle.
• G is on a cycle as soon as p is congruent to 5 (mod 8) and that the Legendre symbol of g, compared to p is worth +1.
• r is neither g, nor -g ,, then u>0; note that the key ⁇ (pl) l2 p) transforms any non-quadratic residue y into an element b which is a 2 nd primitive root of the unit.
• variable wa for value g, or -g ( .
• v is greater than jj, that is, k> tu, reject the candidate to move on to another.
• v is less than or equal to /) ' , that is, k ⁇ tu, continue the evaluation of the candidate.
• the public module n is the product of / prime factors / ?,, /? 2 , ... /? .
• the unsigned integer n can be represented by a binary sequence; this sequence respects the constraints imposed at the start of the program for the size in bits and for the number of successive bits at 1 in high order.
• the choice of prime factors ensures the following properties of the module n with respect to each of the m base numbers g x , g 2 , ... g m .
• equations (1) and (2) have no solution in x in the ring of integers modulo n.
• equation (3) has solutions at x in the ring of integers modulo n.
• Step (1) is executed successively for each of the m base numbers from g x to g m .
• Step (2) is executed successively for each of the m public values from G x to G m .
• We calculate an integer t such that /? - l is divisible by 2 'but not by 2 f + 1 , then an integer s (p-l + 2') / 2 t + l , so as to establish a key (s, p).
• the branch of z 4 carries two other solutions: it is the product of z by each of the two square roots of -1, that is, each of the two fourth primitive roots of the unit.
• y is a non-quadratic residue of CG (p)
• y to ⁇ 1 / 4 (mod p) is a square root of -1.
• the branch of the 2 nd power of z carries 2 ' ⁇ l solutions: these are the products (mod p) of z by each of the two roots 2 l th primitives of the unit.
• G is suitably placed on a fairly long branch, that is to say, t ⁇ k + u, there are 2 fc solutions on the branch where G is shown.
• a root 2 k th it is enough to reiterate k times of rank the algorithm of calculation of square root given above, so as to calculate the square roots of successive results up to a solution z.
• This calculation can of course be optimized to approach a 2 k th root directly and then adjust the approximation of a 2 k th root only once to reach a solution z.
• variable wa for value za At the end of the algorithm, the variable wa for value za.
• the generic solution to equation (3.a) is represented by zz- We go to step (4).
• n is the product of two prime factors congruent to 3 (mod 4); there are eight with three prime factors congruent to 3 (mod 4); there are sixteen with two prime factors congruent to 3 (mod 4) and a congruent to 5 (mod 8).
• n is the product of two prime factors congruent to 3 (mod 4); there are eight with three prime factors congruent to 3 (mod 4); there are sixteen with two prime factors congruent to 3 (mod 4) and a congruent to 5 (mod 8).
• Judicious use of these multiple values can complicate attacks by analyzing the power consumption of a smart card using GQ2.
• the constraints due to the m base numbers make applications less and less acceptable.
• k 6
• k 64
• m 3
• g, 3
• ⁇ 2 3 09AA6F4930E51A70CCDFA77442B10770DD1CD77490E3398A

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Complex Calculations (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Peptides Or Proteins (AREA)
• Error Detection And Correction (AREA)
• Agricultural Chemicals And Associated Chemicals (AREA)
• Mobile Radio Communication Systems (AREA)
• Storage Device Security (AREA)

Priority Applications (5)

Applications Claiming Priority (10)

Publications (2)

Family

ID=27515634

Family Applications (3)

Family Applications After (2)

Country Status (7)

Cited By (1)

Families Citing this family (8)

Family Cites Families (23)

• 2000
  • 2000-01-27 EP EP00901658.5A patent/EP1145482B1/fr not_active Expired - Lifetime
  • 2000-01-27 CN CNB008031975A patent/CN100377520C/zh not_active Expired - Lifetime
  • 2000-01-27 AU AU22984/00A patent/AU769464B2/en not_active Ceased
  • 2000-01-27 JP JP2000597915A patent/JP4772189B2/ja not_active Expired - Lifetime
  • 2000-01-27 JP JP2000597914A patent/JP2003519447A/ja not_active Withdrawn
  • 2000-01-27 AU AU22985/00A patent/AU769444B2/en not_active Ceased
  • 2000-01-27 WO PCT/FR2000/000189 patent/WO2000046947A2/fr not_active Ceased
  • 2000-01-27 CN CN00804617A patent/CN1408154A/zh active Pending
  • 2000-01-27 WO PCT/FR2000/000190 patent/WO2000045550A2/fr not_active Ceased
  • 2000-01-27 US US09/889,918 patent/US7386122B1/en not_active Expired - Lifetime
  • 2000-01-27 CA CA002361627A patent/CA2361627A1/en not_active Abandoned
  • 2000-01-27 AU AU22986/00A patent/AU769446C/en not_active Ceased
  • 2000-01-27 CA CA002360887A patent/CA2360887C/fr not_active Expired - Fee Related
  • 2000-01-27 EP EP00901657.7A patent/EP1145473B1/fr not_active Expired - Lifetime
  • 2000-01-27 JP JP2000596696A patent/JP4772965B2/ja not_active Expired - Lifetime
  • 2000-01-27 US US09/869,966 patent/US7266197B1/en not_active Expired - Lifetime
  • 2000-01-27 CA CA002360954A patent/CA2360954A1/en not_active Abandoned
  • 2000-01-27 CN CNB008047189A patent/CN1322700C/zh not_active Expired - Lifetime
  • 2000-01-27 WO PCT/FR2000/000188 patent/WO2000046946A2/fr not_active Ceased
  • 2000-01-27 EP EP00901656A patent/EP1145472A3/fr not_active Withdrawn

Also Published As

Similar Documents

Legal Events