WO2007138182A1

WO2007138182A1 - Process of generation of a private key and coding/decoding processes of a message

Info

Publication number: WO2007138182A1
Application number: PCT/FR2007/000881
Authority: WO
Inventors: Jean-Sébastien CORON
Original assignee: Oberthur Technologies
Priority date: 2006-05-31
Filing date: 2007-05-25
Publication date: 2007-12-06
Also published as: FR2901940A1; FR2901940B1

Abstract

A process to generate a private key at the heart of an electronic unit, via a master key and data representing an identity, includes the following steps: - generation of a number at the heart of the electronic unit; - determination of the initial element of the private key equivalent to the result of the application of a one-way function incorporating the master key in the combination of said number and of the result of the application of an initial function involving scrambling of the data; - utilization of said number as the second element of the private key. Both coding and decoding processes are presented at the same time.

Description

Method for generating a private key and methods for encrypting and decrypting a message

The invention relates to a method for generating a private key, as well as methods for encrypting and decrypting a message.

In particular, it proposes an identity-based encryption system with an improved security level, for example using a point-to-elliptic curve coupling operation. According to the principle of identity-based encryption, a user can send a message (represented in electronic form) encrypted to a recipient using the identity of the said recipient (also represented in electronic form) as the public encryption key, the private key said recipient being provided by a centralized key server. Following this principle, if a user named Alice wants to send an encrypted message to a user named Bob, the user Alice uses the following method in three steps:

- Alice encrypts her message using Bob's e-mail address as the public encryption key, for example "bob@b.com";

- Bob authenticates to the centralized key server and receives the private key corresponding to his e-mail address;

- Bob uses his private key to decipher the message.

He can then decrypt any message sent by Alice or any other user using this private key (at least during its validity).

An advantage of the principle of identity-based encryption over conventional public key encryption methods is that it does not require the use of certificates. Another advantage is that a user can send an encrypted message to another user even if the latter has not yet registered in the system. The first efficient method of identity-based encryption was proposed by Boneh and Franklin in the article "Identity-based encryption from the Weil pairing", published at the Crypto 2001 conference. This process is also described in patent application WO 03/017559. This latter method is based on the use of a so-called point coupling operation performed on a particular elliptic curve, said elliptic curve being a set of points verifying a certain mathematical equation.

The Boneh-Franklin identity-based encryption system operates as follows, being divided into four subprocesses. The first sub-method concerns the selection of system parameters. We define a mathematical set G with a group structure (multiplicative in the following) and having a finite number of elements denoted q. In an exemplary embodiment, this set G can be a set of points belonging to an elliptic curve. We also consider a function e taking as input two elements of G and returning as output an element of a group G1, also consisting of a number of elements equal to q, said function e having a property called bilinearity. In an exemplary embodiment, the group G1 can be a subset of the set of integer pairs of the form (a, b), where a and b are defined modulo a prime integer p, and the function e can be constructed by means of a Weil or Tate coupling operation defined on an elliptic curve. We define a generator element g for group G. We also define four hash functions H1, H2, H3 and H4. We generate an integer a between 0 and q-1, and we calculate the element h = g ^Λ a, (this last operation is the calculation of g exponent a, performed in the previously defined multiplicative group G). The public parameters of the system are then the pair (g, h), while the master key of the system is the integer a; this master key is stored at the key server and must be kept confidential.

The second sub-method of the Boneh-Franklin encryption scheme concerns the generation of a private key for a particular identity denoted by v, said identity possibly being an arbitrary string of characters. The generation of said private key is performed by calculating the element dv = H1 (v) ^Λ a, the operation being performed in group G.

The third sub-method of the Boneh-Franklin encryption system relates to the operation of encrypting a message m for a certain identity v (that is, intended for the bearer of the identity v). In a first step, a random string s is generated. In a second step, an integer r = H3 (s, m) is generated. The encrypted message, noted C, is then defined as follows:

C = (g ^Λ r, s xor H2 (e (H1 (v), h) ^Λ r), m xor H4 (s)) The fourth sub-method of the Boneh-

Franklin relates to the operation of decrypting an encrypted message C, denoted C = (c1, c2, c3). The first step is to calculate s = c2 xor H2 (e (dv, d)). The second step is to compute m = c3 xor H4 (s). The third step is to calculate r = H3 (s, m), and to perform the test: c1 = g ^Λ r. If the test is not verified, the encrypted message is rejected. If the test is verified, the message m is returned.

A disadvantage of Boneh-Franklin's encryption scheme is that there is a significant loss of security between the security level of this scheme and the level of security provided by the underlying elliptic curve. Indeed, for standard parameters, this loss of security reaches about 151 bits. To compensate for this loss, it is therefore necessary to use much larger parameter sizes, which slows down the execution time of the four subprocesses described above, and thus decreases the practical efficiency of this encryption scheme. The object of the invention is to provide a new identity-based encryption scheme that eliminates this loss of security, thereby reducing the size of the system parameters and thereby improving the practical efficiency of the encryption scheme. When using an elliptic curve for the coupling operation, the new scheme has for example a level of security identical to that offered by the underlying elliptic curve. The invention thus proposes a method for generating a private key within an electronic entity, from a master key and data representing an identity, characterized by the following steps:

- generation of a number within the electronic entity; determining a first element of the private key equal to the result of the application of a one-way function involving the master key to the combination of said number and the result of the application of a first hash function to data;

- use of said number as second element of the private key. The combination achieved improves the security of the system, which helps to reduce or eliminate the loss of security mentioned above.

We can notice here that, according to the terminology frequently used in cryptography, a function f is said to be one-way when the computation of an image f (x) by this function is relatively simple compared to the computations necessary to find x while not knowing that f (x), which make this last operation impossible in practice.

Note also that we use the concepts of first element and second element (or even third and fourth elements in some cases) to distinguish them in a set (for example a private key or encrypted or decrypted message), but that it is not a question of being limited to the formation of the whole in this precise order.

According to a particularly practical embodiment, said one-way function is exponentiation to the value of the master key in a finite cardinal multiplicative group, a second public parameter is the image of a first public parameter by said function , the first public parameter being a generator element of the group, and said combination comprises multiplying the result of the application of the first hash function and the second high public parameter to a power equal to the opposite of said number. This solution makes it possible to implement the encryption and decryption methods associated in a particularly simple manner, as described below.

The first element of the private key is for example (H1 (v) * h ^Λ (- y)) ^Λ a, where v corresponds to the data, H1 is the first hash function, h is a public parameter and y is the said number.

According to a first solution, the number is generated within the electronic entity by random or pseudo-random draw.

Alternatively, the number may be generated per application to the data of a hash function involving a cryptographic key.

The invention also proposes a method of encrypting an encrypted message message by means of a first and a second public parameter within an electronic entity, characterized in that it comprises the following steps: - exponentiation the first public parameter by a number determined by the electronic entity to obtain a first element of the encrypted message;

exponentiation by means of said number of the result of the application of a coupling function to the second public parameter in order to obtain a second element of the encrypted message.

These elements of the encrypted message allow the relatively easy implementation of the decryption in the context of the private key system mentioned above.

It can further be provided that the result of the application of the coupling function to the second element is stored in the electronic entity.

According to an embodiment in which the security is further improved, said number is the result of the application of a hash function to the message and to a determined string of characters within the electronic entity by random or pseudo-random draw. random. In this case, s being said string of characters, r said number, g the first public parameter, h the second public parameter and e the coupling function, the first element of the encrypted message being equal to g ^Λ r, the second the element of the encrypted message being equal to e (h, h) ^Λ r, the method may in practice comprise a step of determining a third element of the encrypted message equal to s xor H2 (e (H1 (v), h) ^Λ r), where H1 and H2 are hash functions and v is the public key, generally representative of the identity of the private key holder.

A step of determining a fourth element of the encrypted message can then consist in encrypting the message itself by the operation m xor H4 (s).

The invention further proposes a method of decrypting an encrypted message into a message decrypted by means of a private key, characterized in that it comprises the following steps:

applying a coupling function to a first element of the private key and to a first element of the encrypted message to obtain a first term; exponentiation of a second element of the encrypted message by means of a second element of the private key to obtain a second term;

- multiplication of the first term by the second term;

determining the decrypted message on the basis of the result of said multiplication. This decryption solution makes it possible to integrate in a simple and practical manner the private key obtained as mentioned above.

It can be predicted in practice that, e being the coupling function, d and c2 respectively the first element and the second element of the encrypted message, d and y respectively the first element and the second element of the private key, the result of the multiplication e (d, c1) * (c2 ^Λ y), the step of determining the decrypted message comprises the following steps:

applying a hash function H2 to the result of the multiplication, then an operation of exclusive or with a third element c3 of the encrypted message in order to obtain a string of characters s; - Applying a hash function H4 to the string s, then an exclusive or operation with a fourth element c4 of the encrypted message to obtain the decrypted message. The method may further include a decryption verification step by means of the equality test c1 = g ^Λ r where g is a first public parameter and r is obtained by applying a hash function H3 to the characters and the decrypted message and / or a decryption verification step by means of the equality test c2 = e (h, h) ^Λ r where h is a second public parameter and r is obtained by applying a function H3 hash to the character string and decrypted message.

The coupling function is, for example, Tate coupling and / or Weil coupling. It can also be a coupling of Eta or Ate. For the practical implementation of these various methods, an electronic entity (for example a microcircuit card, or alternatively a personal computer or a server, such as the key server) is able to implement the methods mentioned above. above and to do this to manipulate the processed digital data (which represent the different elements, such as messages, keys, numbers and strings), for example by means of a microprocessor.

We now describe a first embodiment of an identity-based encryption system according to the invention, based on the following four sub-processes. The first sub-method is similar to the first sub-method of the Boneh-Franklin encryption scheme and relates to the selection of system parameters. In this first sub-method, a mathematical set G is defined with a group structure and having a number of elements denoted q. This set G is for example a set of points of an elliptic curve. These points can be represented in digital form by appropriate means, for example by their coordinates.

We also consider a function e taking as input two elements of G and returning as output an element of a group G1, also consisting of a number of elements equal to q, said function e having a property called bilinearity. In an exemplary embodiment, the group G1 may be a subset of the set of integer pairs of the form (a, b), where a and b are defined modulo a prime integer p, and the function e can be constructed by means of the so-called Weil or Tate coupling operation defined on an elliptic curve.

Alternatively, one could choose a function e whose two inputs are in different groups. Similarly, when the function e is constructed by means of a coupling, other couplings than those of Weil and Tate can be used.

We define a generator element g for group G. Here we define two hash functions H1, H2. An integer a is generated between 0 and q-1, and the element h = g ^Λ a is calculated, this operation being carried out in the previously defined group G. The public parameters of the system are then the pair (g, h) , while the master key of the system is the integer a, said master key to be kept confidential (usually at the key server). The second sub-method of the encryption system relates to the generation of a private key for a particular identity denoted v, said identity being an arbitrary string of characters.

This sub-method is generally implemented within the key server based on the identity of an authenticated user, the character string being represented as digital data. The first step of this second sub-method consists in generating an integer y between 0 and q-1. The private key dv is then computed in the following manner dv = ((H1 (v) * h ^Λ (-y)) ^Λ a, y), the first element of dv being an element of group G.

According to a first implementation possibility, the integer is generated randomly, for example by means of a random number generation algorithm (sometimes referred to in practice as pseudo-random). In this case, the calculation of the private key dv is done only once (for example, at the first request of the user concerned) and the private key is stored in case the user does not request again the private key associated with his identity.

According to a second implementation possibility, the integer is obtained by applying to the identity v a hash function involving a cryptographic key that can only implement the holder of this cryptographic key (namely here the key server). The storage of the obtained private key is not necessary.

The third sub-method provided in this first embodiment concerns the operation of encrypting a message m for a certain identity v (that is to say intended for the user having this identity, which alone can decipher it. thanks to the private key associated with the identity). To do this, first generates according to this first embodiment a random integer r. The ciphered message, denoted C, is then defined as follows: C = (g ^Λ r, e (h, h) ^Λ r, m xor H2 (e (H1 (v), h) ^Λ r)).

It may be noted that the element e (h, h) can be pre-calculated and stored by the system performing this third sub-method.

The fourth sub-method of the encryption method of the invention relates to the decryption operation of an encrypted message C, denoted C = (c1, c2, c3). We note as above the private key dv = (d, y).

To do this, we calculate c3 xor H2 (e (d, c1) * (c2 ^Λ y)).

Replacing c2 with its value (from the cipher), we have: e (d, c1) * (c2 ^Λ y) = e (d, c1) * e (h, h) ^Λ ry = e (d, c1) ^* e (H, g ^Λ a) ^Λ ry.

By bilinearity, and replacing d by its value, we have: e (d, c1) ^* (c2 ^Λ y) = e (d, g ^Λ r) ^* e (h ^Λ ya, g ^Λ r) = e ( d ^* h ^Λ ya, g ^Λ r).

By replacing the element d of the private key with its value (from the private key calculation mode described above) and using the bilinearity property again, we obtain: e (d, c1) ^* (c2 ^Λ y) = e ((H1 (v)) ^Λ a, g ^Λ r) = e (H1 (v), g ^Λ a) ^Λ r = e (H1 (v), h) ^Λ r. Thus the computation of c3 xor H2 (e (d, d) * (c2 ^Λ y)) makes it possible to obtain: c3 xor H2 (e (H1 (v), h) ^Λ r) = m.

Thus, the encrypted message C was deciphered and the deciphered message m obtained.

We will now describe a second embodiment of an identity-based encryption method according to the invention, which is a variant of the first embodiment described above. This other example is thus also based on four subprocesses as follows. The first sub-method is similar to the first subprocess of the Boneh-Franklin encryption scheme described in the introduction and relates to the determination of the system parameters.

It will be recalled that in this first sub-method, a mathematical set G with a group structure and having a number of elements denoted q is defined. In an exemplary embodiment, this set G can be a set of points of an elliptic curve. We also consider a function e taking as input two elements of G and returning as output an element of a group G1, also consisting of a number of elements equal to q, said function e having a property called bilinearity. In an exemplary embodiment, the group G1 can be a subset of the set of integer pairs of the form (a, b), where a and b are defined modulo a prime integer p, and the function e can to be constructed by means of the so-called Weil or Tate coupling operation defined on an elliptic curve. We define a generator element g for group G. We also define four hash functions H1, H2, H3 and H4. An integer a is generated between 0 and q-1, and the element h = g ^Λ a is calculated, this operation being carried out in the previously defined group G. The public parameters of the system are then the pair (g, h) , while the master key of the system is the integer a, said master key to be kept confidential.

The second sub-method is identical to that of the first embodiment and relates to the generation of a private key for a particular identity denoted v, said identity being an arbitrary string of characters. The first step is to generate an integer y randomly between 0 and q-1. The private key dv is then computed in the following manner dv = ((H1 (v) ^* h ^Λ (-y)) ^Λ a, y), the first element of dv being an element of group G.

This second sub-process being identical to that of the first embodiment, the remarks made with regard to the latter also apply here. The third sub-method of the method of the invention relates to the operation of encrypting a message m for a certain identity v. In a first step, a random string s is generated. In a second step, we generate an integer r = H3 (s, m). The encrypted message, noted C, is then defined as follows:

C = (g ^Λ r, e (h, h) ^Λ r, s xor H2 (e (H1 (v), h) ^Λ r), m xor H4 (s)).

It may be noted that the element e (h, h) may be pre-calculated by the system implementing this third sub-method.

The fourth sub-method of the encryption method of the invention relates to the decryption operation of an encrypted message C, denoted C ⁼ (c1, c2, c3, c4). We note the private key dv = (d, y). The first step is to compute s = c3 xor H2 (e (d, d) ^* (c2 ^Λ y)). The second step is to compute m = c4 xor H4 (s). The third step is to calculate r = H3 (s, m), and to perform the test: c1 = g ^Λ r and c2 = e (h, h) ^Λ r. If the test is not verified, the encrypted message is rejected. If the test is verified, the message m is returned.

The advantage of the new identity-based encryption method described above is that it achieves a security level at least as high as that provided by the underlying elliptic curve. The size of the parameters used can therefore be much smaller than that used for the Boneh-Franklin scheme, which improves the practical efficiency of the identity-based encryption method.

Claims

A method for generating a private key within an electronic entity, from a master key and data representing an identity, characterized by the following steps:

- generation of a number within the electronic entity;

determining a first element of the private key equal to the result of the application of a one-way function involving the master key to the combination of said number and the result of the application of a first hash function to data;

- use of said number as second element of the private key.

2. Method according to claim 1, characterized in that said one-way function is exponentiation to the value of the master key in a multiplicative group of finite cardinal, in that a second public parameter is the image of a first public parameter by said function, the first public parameter being a generator element of the group, and in that said combination comprises multiplying the result of the application of the first hash function and the second high public parameter to a power equal to the opposite of said number.

3. Method according to claim 1, characterized in that the first element of the private key is (H1 (v) * h ^Λ (-y)) ^Λ a, where v corresponds to the data, H1 is the first hash function, h a public parameter and y said number.

4. Method according to one of claims 1 to 3, characterized in that the number is generated in the electronic entity by random or pseudo-random draw.

5. Method according to one of claims 1 to 3, characterized in that the number is generated by application to the data of a hash function involving a cryptographic key.

6. A method of encrypting a message in encrypted message by means of a first and a second public parameters within an electronic entity, characterized in that it comprises the following steps:

exponentiation of the first public parameter by means of a number determined by the electronic entity in order to obtain a first element of the encrypted message;

exponentiation by means of said number of the result of the application of a coupling function to a second public parameter in order to obtain a second element of the encrypted message.

7. Method according to claim 6, characterized in that the result of the application of the coupling function to the second element is stored in the electronic entity.

8. Method according to claim 6 or 7, characterized in that said number is the result of the application of a hash function to a string of characters determined within the electronic entity by random or pseudo-random draw.

9. Method according to claim 8, characterized in that, s being said string of characters, r said number, g the first public parameter, h the second public parameter and e the coupling function, the first element of the encrypted message is equal. to g r ^Λ, the second component of the encrypted message is equal to e (h, h) ^Λ r, and in that method comprises a step of determining a third component of the encrypted message equal to s xor h 2 (e (H1 (v), h) ^Λ r), where H1 and

H2 are hash functions and v is the public key.

10. The method of claim 9, characterized in that the public key is representative of the identity of the holder of the private key.

11. The method of claim 9 or 10, characterized in that it comprises a step of determining a fourth element of the encrypted message equal to m xor H4 (s), where m is the message.

12. A method for decrypting an encrypted message into a message decrypted by means of a private key, characterized in that it comprises the following steps:

applying a coupling function to a first element of the private key and to a first element of the encrypted message to obtain a first term;

exponentiation of a second element of the encrypted message by means of a second element of the private key to obtain a second term;

- multiplication of the first term by the second term;

determining the decrypted message on the basis of the result of said multiplication.

13. The method of claim 12, wherein, e being the coupling function, d and c2 respectively the first element and the second element of the encrypted message, d and y respectively the first element and the second element of the private key. the result of the multiplication e (d, c1) * (c2 ^Λ y), the step of determining the decrypted message comprises the following steps:

applying a hash function H2 to the result of the multiplication, then an operation of exclusive or with a third element c3 of the encrypted message in order to obtain a string of characters s;

applying a hash function H4 to the string s, and then executing an exclusive operation with a fourth element c4 of the encrypted message in order to obtain the decrypted message.

14. The method of claim 13, characterized by a step of verification of the decryption by means of the equality test c1 = g ^Λ r where g is a first public parameter and r is obtained by applying a hash function H3 to the string and the decrypted message.

15. Method according to claim 13 or 14, characterized by a step of checking the decryption by means of the equality test c2 = e (h, h) ^Λ r where h is a second public parameter and where r is obtained by application a hash function H3 to the character string and the decrypted message.

16. Method according to one of claims 12 to 15, characterized in that the private key is obtained from data representative of an identity.

17. Method according to one of claims 7 to 16, characterized in that the coupling function is a Tate coupling.

18. Method according to one of claims 7 to 16, characterized in that the coupling function is a Weil coupling.

19. Method according to one of claims 1 to 18, characterized in that it is implemented within a microcircuit card.