Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
  • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
  • H04L9/3252—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes

Definitions

• the present invention relates to trapdoor one-way encryption functions and cryptosystems utilising such functions.
• a trapdoor one-way function is a publicly computable function, which only one entity can invert.
• a special secret called a private key, is required to compute the inverse of TOWF.
• the classic example of a TOWF is the RSA function based on the relationship M ed ⁇ M (mod N).
• the numbers e and N are public values.
• the number N is chosen to be a product of two secret distinct primes p and q.
• the RSA function can be used as the basis of a cryptosystem that performs both digital signatures and public-key encryption.
• the hash function has two purposes: to compress M down to the size of digest which W 1 can handle and to prevent some potential attacks involving the conversion of a signature of one message to the signature of a related but unauthorized message
• H(M) W(S)
• An alternative cryptosystem is based on the difficulty of the discrete log problem
• a particularly robust cryptosystem, which bases its security on the discrete log problem utilizes elliptic curves and has the advantage of reduced bandwidth compared with RSA TWOF cryptosystems
• An elliptic curve E is the set of points (x, y) that satisfy the defining equation of the elliptic curve
• the defining equation is a quadratic in y and a cubic in x, and is non- singular
• the coordinates x and y are elements of a field, which is a set of elements that can be added, subtracted, multiplied, and divided (with the exception of zero for division) Examples of fields include rational numbers and real numbers
• finite fields which are the fields most often used in cryptography
• An example of a finite field is the set of integers modulo a prime q
• the defining equation of the elliptic curve can be in the Weierstrass form
• the elliptic curve E includes the points (x, y), which are all solutions to the defining equation, and one further point, namely the point O at infinity
• the elliptic curve E also has a group structure, which means that the two points P and Q on the curve can be added to form a third point P + Q
• the formula for adding points P and Q in terms of their coordinates is
• a polynomial in x and y is a sum of terms of the form a x m y n , where a is a field element (possibly depending on m and n), and m and n are non-negative integers
• x 2 y - 3y 4 + 1 is a polynomial in x and y
• any rational function r(x, y) and field elements u and v there is a value of the rational function r(x,y) at the point (u, v) The value is a field element or the point at infinity, and is written r(u, v) The value r(u, v) is obtained simply by
• Rational maps on elliptic curves can actually be added just like points on the curve
• the addition rules are similar, except that instead of doing operations with field elements, one instead does operations with rational functions, that is, with the symbolic functions of x and y
• a rational map (r, s) on E is considered equivalent to another rational map (r r , s') on E if r is equivalent to r' and s is equivalent to s 1 , as rational functions on E
• a special kind of rational map is an endomorphism.
• Every endomorphism has an action on an elliptic curve group that corresponds to a quadratic algebraic integer
• y 2 x 3 - 35x + 98, as ( r , ⁇ - f ) eyX> y) - ⁇ z ⁇ x + z i - 2) ' + z 2 - 2) 2
• the inventors have recognized that it is possible to use the attributes of elliptic curve cryptosystems to obtain a TOWF that provides a robust cryptosystem with a reduced bandwidth
• the present invention provides a cryptographic system operating on an elliptic curve E of order n
• the present invention provides method for performing cryptographic operations m a cryptographic system operating on an elliptic curve E of order n
• Figure 1 is a schematic representation of a cryptographic exchange scenario
• Figure 2 is a schematic representation showing an application of a trapdoor one- way function
• Figure 3 is a schematic representation showing an application of the trapdoor one- way function of Figure 2 for encryption
• Figure 4 is a schematic representation showing an application of the trapdoor one- way function of Figure 2 for digital signatures
• Figure 5 is a schematic representation showing an application of the trapdoor one- way function of Figure 2 for aggregated signatures
• Figure 6 is a schematic representation showing an application of the trapdoor one- way function of Figure 2 for aggregated signatures with a single message and multiple trapdoor one-way functions for multiple signers
• a cryptosystem 10 has a first entity 12, and a second entity 14 that communicate via a communication channel 16
• the first entity 12 and second entity 14 each have a cryptographic module 15 that applies public key functions or private key functions 18 available to both entities 12, 14
• Each entity 12, 14 will utilize the key functions 18 with the TOWF to obtain encryption/decryption or signing/ verifying as described above
• a suitable TOWF may be obtained by use of a quadratic algebraic integer z
• z a curve E and rational map defining [z] on E.
• the rational map [z] is the TOWF. Judicious selection of z will ensure that it has the necessary cryptographic attributes, namely:
• every rational map (i.e. from E to E) is a composition of a translation and an endomorphism, where the translation is easy to determine and invert, the most secure part of the rational map is the endomorphism. Therefore an endomorphism is the preferred implementation of the rational map.
• [0051 ] In order for [z] to be a trapdoor one-way function, it should be computationally infeasible to determine u and v from the public definition of [z], otherwise its inverse on E(F) is efficiently computable as [-w]([u] + [z]) Therefore, [z] needs to be given in a form that does not allow an easy determination of u and v
• [z] As a pair of rational functions, it is believed that u and v cannot easily be determined Typically, the first coordinate is a function of x only, so that [z] is somewhat in canonical form (r(x), g(x, y)), then the description for evaluating r(x) may potentially reveal the degree of the numerator of r(x), even though the full expansion of r(x) as a ratio of two polynomials may be mfeasible due to the large number of terms Since the degree of [z] is v, it is possible that the description of [z] will reveal v Therefore, to make sure that [z] is a one-way trapdoor, it is important to ensure that u is also not revealed, otherwise [z] could be inverted, as described above
• determining the endomorphism ring of a general elliptic curve is a non-trivial problem Since v and u essentially determine the endomorphism ring, up to an integer factor, it is generally mfeasible to determine v and u from a description of the elliptic curve alone It is therefore plausible that from the description of a single complex endomorphism, it is still a non-t ⁇ vial problem to determine the endomorphism ring In particular, this means it is still plausible that determining u from the description of [z] as a pair of rational functions is a non-trivial problem.
• the degree of z should be chosen such that it has a reasonably large order This helps to ensure that all possible values of u cannot be exhausted using the relationship u 2 ⁇ 4v This follows from above, because z must be an imaginary complex number
• the endomorphism's kernel intersects the group E(F) at only the point O, then the action of the endomorphism e on the group E(F) is mvertible
• the endomorphism e is an automorphism of the group E(F)
• the group E(F) will be cyclic, and in the following discussion, we assume that E(F) is cyclic
• the cost of this algorithm depends on the factorization of n - 1 It is known that random values of n generally have a factor f that is approximately n 1/3 Given a factor of this size, the algorithm can determine d in a constant multiple of f steps This is considerably faster than the gene ⁇ c algorithms for finding d given dG
• the group E(F) has order n such that n - 1 does not have a factor f near to n 1/3
• An alternative to choosing n in this way is simply to choose n slightly larger, so that cost of an attack of n 1/3 is out of reach for the adversaries under consideration
• n could be chosen so that n is approximately 2 240
• n could be chosen so that n is 2005/001720
• the first entity 12 sets x to the plaintext and x' to the ciphertext by application of the public key function [z]
• Known sophisticated approaches to public key encryption generally apply some randomized padding to the plaintext x, so that, among other things, repeated encryption of the same plaintext give different ciphertexts
• the second entity 14 decrypts the ciphertext x 1 using the private key function to obtain plaintext x
• the second entity 14 sets x' to be the message to be signed, and computes x as the signature by application of the private key function Generally some hashing is used to create x' from a longer message, which is a standard technique for digital signatures
• the size of the cryptographic group can be smaller than the group used for the RSA TOWF
• a 3072 bit RSA modulus is consider to be roughly as secure as an elliptic curve defined over a 256-bit field
• the security level of both these objects is considered to be 128 bits, which is a commercial grade secu ⁇ ty level now most widely used across the Internet, such as for online banking
• the elliptic curve trapdoor one-way function [z] the size of signature x or basic ciphertext x' is 256 bits, whereas for RSA the size is 3072
• the TOWF is applied to the aggregation of signatures or ciphertexts.
• signatures or ciphertexts
• details for ciphertexts are quite similar
• Aggregation of signatures means a single signature represents a multiplicity of messages signed by a single signer, or a single message signed by a multiplicity of signers, or a multiplicity of messages signed by a multiplicity of signers
• a signer e g first entity 12
• Verification by another entity e g second entity 14
• Verification by another entity e g second entity 14
• consists then of hashing the messages, converting each hash to a point, summing to a total P, and then applying the pubhc key 18 operation e to S by checking if e(S) P
• the advantage of doing this over simply concatenating the messages is to achieve greater flexibility for the signer wishing to change parts of the message, because the signing is additive
• Verification (e g by the second entity 14) consists of applying each of the corresponding public key 18 operations, in reverse order, and checking whether the resulting point P corresponds to the hash value of the signed message m

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Mathematical Physics (AREA)
• Pure & Applied Mathematics (AREA)
• Mathematical Optimization (AREA)
• Mathematical Analysis (AREA)
• Algebra (AREA)
• General Health & Medical Sciences (AREA)
• Bioethics (AREA)
• Health & Medical Sciences (AREA)
• Software Systems (AREA)
• Complex Calculations (AREA)
• Storage Device Security (AREA)
• Devices For Executing Special Programs (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Remote Monitoring And Control Of Power-Distribution Networks (AREA)
• Facsimile Transmission Control (AREA)

Priority Applications (5)

Applications Claiming Priority (4)

Publications (1)

Family

ID=36336180

Family Applications (1)

Country Status (7)

Families Citing this family (27)

Citations (4)

Family Cites Families (12)

• 2005
  • 2005-11-14 JP JP2007540466A patent/JP4842276B2/ja not_active Expired - Lifetime
  • 2005-11-14 AT AT05803301T patent/ATE546909T1/de active
  • 2005-11-14 CA CA2587474A patent/CA2587474C/en not_active Expired - Lifetime
  • 2005-11-14 US US11/272,152 patent/US7844051B2/en active Active
  • 2005-11-14 CN CN 200580046426 patent/CN101099329B/zh not_active Expired - Lifetime
  • 2005-11-14 EP EP05803301A patent/EP1815636B1/en not_active Expired - Lifetime
  • 2005-11-14 WO PCT/CA2005/001720 patent/WO2006050605A1/en not_active Ceased
• 2010
  • 2010-11-12 US US12/945,234 patent/US8213605B2/en not_active Expired - Lifetime
• 2011
  • 2011-08-18 JP JP2011179245A patent/JP5190142B2/ja not_active Expired - Lifetime
• 2012
  • 2012-06-13 US US13/495,307 patent/US8782400B2/en not_active Expired - Lifetime

Patent Citations (4)

Also Published As

Similar Documents

Legal Events