CN1801702A - Distributed network interactive identity authentication method based on zero-knowledge - Google Patents

Abstract

The invention provides a distributed network interactive ID identification method based on zero knowledge, which comprises: selecting a conic curve of finite field with a random point on public path by both communication sides; with a selected random number as private key, calculating the product of random point and number, sending the public key of said curve, random point and said product to another side; when transferring information, embedding another side as the point of conic curve; when enciphering, selecting a random positive integer to calculate key by public key from another side and transfer the key to opposite; when deciphering, calculating plaintext with private key. This invention is more fit to new P2P, Grid and other environments.

Description

A kind of distributed network interactive identity authentication method based on zero knowledge

Technical field

The present invention relates to a kind of method that is suitable for carrying out in the distributed network interactive identity authentication, discriminating.Belong to computer network security field.

Background technology

Mainly be by authentication public key PKI system about the method for in network, carrying out authentication at present.PKI is a PKIX, the infrastructure that the information security service is provided of utilizing the PKI theory and technology to set up exactly.PKI authenticates by certificate, and the other side knows that you are exactly you during authentication, but can't know why you are you.Here, certificate is that a believable third party proves, by it, communicating pair can authenticate mutually safely, and does not worry that the other side palms off.Public key system is widely used for fields such as ca authentication, digital signature and cipher key change.But PKI not only relates to the problem of technological layer, also relates to the stage construction problems such as overall development strategy of E-Government, ecommerce and national information.Authentication public key need consider that CA (authentication center) sends out the credibility of the CA certificate of awarding, and at first will consider to set up traditional public key encryption certification chain.The authentication of this mode does not just become very difficult when not having a fixing credible third party in the environment.

Zero Knowledge Authentication is to utilize the identity person's of being proved to be private key as its " identity " function at first, and by using zero-knowledge proof, the certifier can prove the private key that it knows oneself, and proves out the identity of oneself thus.The fail safe of this proof of identification is based on difficulty that the big several factor decomposes, so but because too big unsatisfactory with the mutual amount of external information.

The ElGamal algorithm can be used for data encryption also can be used for digital signature, and its fail safe depends on calculates this difficult problem of discrete logarithm on the finite field.At first select a prime number p, two random number g and x, g wherein, x＜p calculates

y＝g ^x(mod?p) (1)

The x mod p here is meant the remainder of x divided by the p gained.Then its PKI is y, and g and p, private key are x.G and p can be shared by one group of user.ElGamal is used for digital signature, is M by label information, at first selects a random number k, and k and p-1 are relatively prime, calculates

a＝g ^k(mod?p) (2)

Again with expansion Europe utmost point Li De algorithm to following equation solution b:

M＝xa+kb(mod?p-1) (3)

Signature is exactly that (a, b), random number k must abandon.To verify following formula during checking:

y ^a*a ^b(mod?p)＝g ^M(mod?p) (4)

The ElGamal algorithm is used for encrypting.Encrypted information is M, at first selects a random number k, and k and p-1 are relatively prime, calculates

a＝g ^k(mod?p) (5)

b＝y ^kM(mod?p) (6)

(a b) is ciphertext, is two double-lengths expressly.Calculate during deciphering

M＝b/a ^x(mod?p) (7)

Utilizing the ElGamal algorithm to realize that identity is differentiated to have generally needs the identity of CA identification strategy same disadvantages, and promptly the authentication of this mode just becomes very difficult when not having a fixing credible third party in the environment.

Summary of the invention

The invention provides a kind of identity authentication schemes that on conic section, utilizes the ElGamal cryptographic algorithm to realize zero knowledge.

The realization Fundamentals of Mathematics of conic section cryptographic system: F _pFor p unit finite field (p is an odd prime), consider affine plane A ²(F _p) on conic section C

C：y ²＝(ax ²-bx)mod?p a，b∈F _p，a，b≠0 (8)

Initial point O (0,0) if x ≠ 0 makes y=xt, is got by formula (8) on conic section C

x(a-t ²)＝bmod?p a≠t ² (9)

Get x=b (a-t by formula (9) ²) ^-1, with the y=xt substitution wherein, y=bt (a-t then ²) ^-1, x wherein ^-1Be meant the inverse element of x on the finite field.

To this conic section territory C (F _p) the last addition that puts.Initial point O is designated as a P (∞).Make H={t ∈ Fp, t ²≠ a}U{ ∞ }, to arbitrfary point P (t) ∈ C (F _p), wherein parametric t ∈ H defines

P(t)P(∞)＝P(∞)P(t)＝P(t)；

If 2 P (t on the conic section ₁), P (t ₂) ∈ C (F _p), parametric t wherein ₁, t ₂∈ H, t ₁, t ₂≠ ∞

P(t ₁)P(t ₂)＝P(t ₃)

$t_3=\left\{\begin{array}{cc}{(t_1{t}_2+a)(t_1+t_2)}^{-1}& (t_1+t_2)\≠0\\ \∞& (t_1+t_2)=0\end{array}\right.---\left(11\right)$

(C (F _p), , P (∞)) this tlv triple formation finitely Abelian group.

For reaching the object of the invention, the present invention adopts ElGamal public key encryption, the decryption mechanisms based on conic section, and its technical scheme is as follows,

A kind of distributed network interactive identity authentication method based on zero knowledge:

At first first and second are in advance at a conic section of selecting on the disclosed passage on the finite field, and random point belongs to this conic section, this point is wanted to generate a very big subgroup, and this subgroup is preferably the same big or more approaching with the group that conic section itself is constituted;

First is selected the private key of a random number as it, and calculates the long-pending of random point and random number, and with above-mentioned curve, random point and its amass the PKI as first, and it is transferred to second;

Second is selected the private key of a random number as second, and calculates the long-pending of random point and random number, and with above-mentioned curve, random point and its amass the PKI as second, and it is transferred to first;

Suppose that first will transmit information to second, at first it is embedded as the form of putting on the conic section;

The selected positive integer that produces at random of first is utilized the PKI of second to calculate password, and it is transferred to second during encryption;

Second is calculated during deciphering, utilizes private cipher key to calculate from ciphertext expressly.

The present invention adopts the fail safe of agreement to be based on the calculating of discrete logarithm on the conic section, compare with the authentication of traditional PKI architecture, this method does not need regularly CA center unified in gamut, more is applicable to emerging P2P, Grid distributed system environments.Compare the conic section password with elliptic curve at the radix of determining algebraic curve, thereby make it to contain big prime factor, expressly slip into the coding and decoding of algebraic curve, three aspects of encrypting and decrypting are more simple, convenient.

Embodiment

Further specify the present invention below in conjunction with embodiment.

A conic section on the selected finite field, and the random point that belongs to conic section.First is selected the private key of a random number as first, and calculates the long-pending of random point and random number, with above-mentioned curve, and random point and its long-pending PKI as first.

As shown in Figure 1, simple identity authentication protocol carries out as follows:

(a) first is chosen a positive integer k at random, and according to formula (10), (11) calculate k (aP), and send to second.

(b) second produces a random order b.According to formula (10), (11) calculate ip according to this random parameter, and i is the random number that second produces.With (b M) sends to first.

(c) nail root is according to receiving that b value determines to issue the return value of second or for k or be a (M).

(d) second is verified according to the difference of random order b value, and the confirmation first is known a.

Above this is that the single-wheel of agreement identifies that first and second repeat agreement t time, till second be sure of that first is known key a or denied that this asserts.

(p) is relevant with p to suppose that function phi is arranged, and the probability P r that requires first deception second is during less than 1/ φ (p), and second receives the identity of first.

Pr＝2 ^-t＜1/φ(p) (12)

Release t＞log ₂φ (p) (13)

Get Satisfy condition.At this moment, the operation times that first will be done on C is made as fp, so

kt≤f _p≤(a+k)t (14)

Wherein k is the random number that first is chosen, and t is the agreement number of run, and a is the private key of first, and the operation times that second will be done on C is made as f _V, so

tmin(2i，k)≤f _V≤tmax(2i，k) (15)

T wherein, k value cotype (14), i are the random number that second produces.

Parallel structure can increase every quantity of taking turns evaluation and can effectively reduce first and the mutual number of times of second.The parallel structure key of above-mentioned agreement is in second step, allows second produce the random binary string b of s position ₁, b ₂..., b _sReplacing b, is non-vanishing b simultaneously _tProduce positive integer i at random _t, with (b ₁, M ₁) ..., (b _s, M _s) send to first, work as b _tM when being zero _tBe zero, work as b _tM when non-vanishing _tBe i _tP.

Selected finite field F _pA conic section C on (being odd prime among its p), and random point P ∈ C.First is selected s random number a ₁, a ₂..., a _s∈ 1,2 ..., the private key of p-1} conduct oneself, and calculate a ₁P, a ₂P ..., a _sP is with (C, P, a ₁P, a ₂P ..., a _sP) as the PKI of first.

Parallel identity authentication protocol is as follows:

(1) first is chosen one positive integer k is according to formula (10) at random, and (11) calculate k (aP), wherein (a=a ₁+ a ₂+ ... + a _s), and X sent to second.

(2) second produces a random bit string b ₁, b ₂..., b _s

Be non-vanishing b _tProduce positive integer i at random _t, work as b _tM when being zero _tBe zero, work as b _tM when non-vanishing _tBe i _tP is with (b ₁, M ₁) ..., (b _s, M _s) send to first.

(3) first is calculated according to formula (10), (11) $\underset{t=1}{\overset{s}{\mathrm{\Σ}}}{a}_t{M}_t+\left(\underset{t=1}{\overset{s}{\mathrm{\Σ}}}{a}_t\right)\mathrm{kP}$ And send to second;

Whether what (4) the second checking was received equals $\underset{t=1}{\overset{s}{\mathrm{\Σ}}}{i}_t\left(b_t{a}_{t}P\right)+\mathrm{kaP}$ Value.

The fail safe about agreement that draws above has the condition of an acquiescence, and promptly all participants comprise that normal participant's first, second and attacker's first, second all strictly observe the regulation of agreement.If an assailant the third is arranged now, pass through in agreement, to increase an overtime restriction t in the present embodiment _TimeoutPrevent to attack.

Be example with the simple identity authentication schemes still below, it is as follows to revise agreement:

(1) first is chosen a positive integer k at random, and according to formula (10), (11) calculate k (aP), and with X, time stamp T ₁Send to second.

(2) whether second is at first overtime according to the timestamp checking of first, if then should the wheel agreement cancel, then produces a random order b if not.If b=0, M=0, if b=1, second produces positive integer i at random, M=iP; With (b M) sends to first with time stamp T 2.

(3) first is at first judged, overtime then this wheel agreement stops, b=0 else if, and first sends to second with k; If b=1, first is according to formula (10), and (11) calculate a (M), and Y is sent to second.

(4) second is at first judged, overtime then this wheel agreement stops, b=0 else if, and second checking X=k (aP) confirms that it knows the random normal number k that makes X=k (aP); If b=1, second checking Y=i (aP) confirms that it knows a.

Claims (2)

1, a kind of distributed network interactive identity authentication method based on zero knowledge may further comprise the steps:

Communicating pair is a conic section on selected finite field on the disclosed passage in advance, and belongs to the random point on this conic section,

Communication one side selectes a random number as its private key, and calculates the long-pending of random point and random number, amasss with it with described curve, random point and is transferred to the opposing party that communicates by letter as its PKI;

Communication the opposing party selectes a random number as its private key, and calculates the long-pending of random point and random number, amasss with it with above-mentioned curve, random point and as its PKI it is transferred to the side that communicates by letter;

When communication one side is transmitted information with the opposing party that communicates by letter, at first it is embedded as the form of putting on the conic section,

During encryption, the selected positive integer that produces at random of communication one side is utilized communication the opposing party's PKI to calculate password, and it is transferred to the other side,

During deciphering, communication the opposing party calculate, and utilizes private cipher key, calculates from ciphertext expressly.

2, the distributed network interactive identity authentication method based on zero knowledge according to claim 1 is characterized in that: comprise in the described transmission information process-overtime restriction.