Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
  • H04L9/3255—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using group based signatures, e.g. ring or threshold signatures

Definitions

• the present invention relates to the field of telecommunications and more particularly to the securing of transmissions, in particular for services, which uses cryptography.
• the individual signing the message must first obtain certification from the trusted authority by communicating at least their public key and identity.
• the signature process calculates an electronic signature of the message by taking into account on the one hand the content of the message and on the other hand the private key of the individual.
• the signatory transmits the message, the signature and his certificate to the recipient.
• the recipient of the message verifies the electronic signature of the message using at least the public key and the content of the message.
• An anonymous electronic signature has the same characteristics as an electronic signature except that the recipient cannot determine the identity of the signatory; the signatory remains anonymous.
• the addressee can address himself to the trusted authority which has, via the certificate, a means to lift anonymity.
• anonymous group signature An anonymous group signature process allows each member of a group to produce an electronic signature that is characteristic of the group. The recipient of a message accompanied by an anonymous group signature can verify that the signature was produced by one of the group members. However, he cannot determine, among the various members of the group, the member in question.
• a group is a set of individuals who declare themselves to an authority as belonging to the same group. During this declaration, each individual interacts with the trusted authority according to a determined protocol at the end of which the individual obtains a private key, associated with a group public key previously determined by the trusted authority, and the authority and the individual obtain an identifier of the individual associated with this private key. Each of these individuals is in the continuation of the request designated by the term of member.
• An example of such a protocol is described in the article by J. Camenisch and M. Michels which has for reference "Efficient group signature signature schemes for large groups", In B.
• Kaliski editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS, pages 410 to 424, Springer-Verlag, 1997.
• the same interaction occurs when a new member arrives.
• the existence of a group translates on the side of the authority of trust by the attribution to the group of a public key known as of group and by the attribution to each member of a private key associated with the public key, different for each member, and an identifier.
• a member can produce an anonymous group signature of a message of their choice. Any recipient can verify that this signature has been produced by one of the members of the group, provided that the group public key is used.
• the recipient is certain that the signature has been produced, or not, by a member of the group, but he does not obtain any information on the identifier of this member, the signatory communicates to the recipient only its identifier encrypted using a public key of the trusted authority; the signature is anonymous.
• the recipient has the option of contacting the trusted authority, which can determine the identity of the signatory from the encrypted identifier accompanying the anonymous group signature.
• the trusted authority can therefore lift anonymity at any time.
• a group can evolve. According to a first type of evolution, new individuals can become members of the group.
• the method encrypts, with an encryption algorithm, each of the results of these divisions and transmits to the recipient these encrypted results accompanied by determined elements.
• the recipient uses the determined elements and the quantified results to verify on the one hand that the divisions were correctly carried out and on the other hand that all the results are different from 1; that is, to ensure that the signature was produced by an unrevoked member.
• This process consists in using three additional keys in addition to the keys necessary for the success of the group signature: a private property key for each member, a public property key to allow each member to check the validity of his key and a public renewal key allowing each member to modify his private ownership key each time a member joins or leaves the group.
• the trusted authority modifies the public ownership key and the renewal key.
• Each remaining member of the group modifies their own private ownership key using the renewal key and checks its validity using the public ownership key.
• signing a message electronically the signatory member uses their private property key.
• the recipient can verify the electronic signature using the public ownership key.
• One of the objectives of the invention is to remedy the drawbacks of the known and previously described methods.
• the subject of the invention is a cryptographic method of anonymous signature of a message intended to be implemented by a member of a group, this group being composed of n members each equipped with a means of calculation and an associated storage means.
• This process comprises initial steps which consist in the constitution of the group: in a first step, to calculate by a first means of calculation of a trusted authority, a pair of asymmetric keys common to the members of the group, this pair of keys consisting of a public key and a common private key, in a second step, to be calculated by the first means of calculation a group public key associated with the group, in a third step, for each member, during an interaction between the means of calculating the trusted authority and the means of calculating the member, calculating a private group key and storing this private group key in the member memorizing means, each group private key being associated with the group public key and being different for each member of the group,
• a fourth step to determine by the first means of calculation as many symmetric secret keys as there are members of the group, in a fifth step, to encrypt by the first means of calculation the common private key with each of the secret keys to obtain as many of encrypted forms of the common private key than of unrevoked members.
• the method comprises steps which consist: in a sixth step, by modifying by the first means of calculation the pair of common asymmetric keys to determine a public key and a private key up to date common, in a seventh step, to encrypt by the first means of calculation the common private key with each of the secret keys to obtain as many encrypted forms of the common private key as non-revoked members.
• the method comprises steps which consist:
• a so-called additional signature of the set composed of the message and the anonymous signature using the member's common private key.
• the method according to the invention consists in supplementing the anonymous signature of a message made by a member with an additional signature.
• This additional signature is calculated using a copy, held by the member, of a private signature key identical for all the members authorized to sign and unknown to all the dismissed members.
• This so-called common private key is updated by the trusted authority each time a member of the group is dismissed. The update of the copy held by the member is triggered only during an anonymous signature phase of a message by this member and the update is only possible for an unrevoked member.
• a method according to the invention is such that the group is set up on a date that is such that the steps also consist of:
• the steps also consist of:
• a method according to the invention is such that the steps also consist of:
• a method according to the invention is such that the steps also consist of:
• the method further comprises the step which consists in: deleting the secret key of the revoked member, from the storage means connected to the first calculation means, and is such as for updating the common private key stored by the member storage means, the method further comprises the steps which consist:
• the subject of the invention is also a cryptographic device for anonymous signature of a digital message which comprises:
• a first calculation means for calculating on the one hand at least one pair of asymmetric keys common to the members of the group composed of n members and on the other hand a public group key associated with the group, to calculate for each member, during '' an interaction with the member's calculation means, a group private key, each group private key being associated with the group public key and being different for each member of the group, to determine as many symmetric secret keys as members of the group group and to encrypt the common private key with each of the symmetric secret keys to obtain as many encrypted forms of the common private key as there are unrevoked members.
• a device further comprises: - a storage means connected to the first calculation means via a communication network for storing at least the symmetric secret key of each member of the group, the group public key , the public key common to the members of the group and each of the different encrypted forms of the common private key.
• the invention further relates to a smart card intended for a member of a group consisting of n members and intended to interact with a previous device. This card includes:
• a calculation means for calculating an anonymous signature of a message using its private group key and for calculating an additional signature of the set composed of the message and the anonymous signature using the private key common of the member.
• a card according to the invention is such that the updating means comprises a decryption means for decrypting one of the encrypted values of the common private key, calculated by the first calculation means of the device, at the using the common private key memorized by the member memorization means.
• Figure 1 is a flow diagram of a method according to the invention.
• FIG. 2 is a flow diagram of a particular embodiment of a method according to the invention.
• Figure 3 is a diagram of a particular embodiment of a method according to the invention.
• FIG. 1 represents a flow diagram of a cryptographic method of anonymous signature of a message according to the invention.
• the method is intended to be implemented by a member of a group composed of n members. Each member has a means of calculation associated with a means of memorization. The process takes place in different steps which include initial steps and non-initial steps. The initial stages occur during the creation of the group and are listed below.
• a first step consists in calculating 1 by a first means of calculating a trusted authority, a pair of asymmetric keys common to the members of the group; this key pair consists of a common public key and a common private key.
• the algorithm used for the first step is a public key signature algorithm which may be the RSA algorithm, for R.L. Rivest, Shamir and L. Adleman who are the authors.
• a second step consists in calculating 2 by the first means of calculating a group public key associated with the group.
• the calculation is performed using a particular algorithm.
• This algorithm can be that described in the article by J. Camemsch and M. Michels which has for reference "Efficient group signature signature schemes for large groups", In B. Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS , pages 410 to 424, Springer-Verlag, 1997.
• a third step consists in calculating 3 during an interaction between the trusted authority and each member of the group taken successively, a group private key associated with the group public key, each group private key being different for each member of the group. group.
• the member's private group key is stored 4 by the member's storage means, the trusted authority is not aware of this key.
• the calculation is performed using a particular algorithm. This algorithm can be that described in the article by J.Camenisch and M. Michels which has for reference "Efficient group signature signature schemes for large groups", In B.Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS , pages 410 to 424, Springer-Verlag, 1997.
• a fourth step consists in determining 5 by the first means of calculation as many symmetric secret keys as there are members of the group. This determination may consist of randomly drawing numbers and letters to form a key. Alternatively, the symmetric secret keys can verify a certain distribution. Such a distribution is described in the article by CKWong, MGGouda and SSLam entitled "Secure Group Communications Using Key Graph” - Technical Report TR-97-23, July 28, 1997.
• a fifth step consists in encrypting 6 by the first means of calculating the common private key with each of the secret keys to obtain as many encrypted forms of the common private key as there are non-revoked members. The encryption is performed using an encryption algorithm such as the AES algorithm.
• the symmetric secret keys verify a certain distribution which makes it possible not to encrypt the common private key with each of the secret keys but with only some of them.
• composition of the group can change. 7.
• a modification consists either of a dismissal within the group, or of the entry of a new member in the group. At each dismissal within the group and optionally upon the arrival of a new member, the process includes the following steps.
• a sixth step consists in modifying 8 by the first means of calculation the pair of common asymmetric keys to determine a public key and a common private key up to date with the composition of the group. This modification is carried out using typically the same algorithm as that used during the first step.
• a seventh step consists in encrypting 9 by the first means of calculating the common private key with each of the secret keys to obtain as many encrypted forms of the common private key as there are non-revoked members. This encryption is performed using typically the same algorithm as that used during the fifth step.
• a group member can undertake to sign a message before forwarding it to a recipient.
• the process comprises the following steps.
• An eighth step consists in updating 11 the common private key memorized by the member memorization means only if one of the encrypted values of the common private key is decipherable using the symmetric secret key memorized by the memorization means. member.
• the decryption is carried out using the same algorithm as that used during the seventh step, that is to say during the encryption.
• the update is performed if the decryption algorithm makes it possible to decrypt one of the encrypted values of the common private key.
• a ninth step consists in calculating 12 by the calculation means associated with the member memorization means, a so-called anonymous signature of the message using his group private key.
• the calculation is performed using an anonymous signature algorithm.
• Such an algorithm is described in the article by J. Camenisch and M.Stadler who has for reference "Efficient group signature signature schemes for large groups", In B. Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS, pages 410 to 424, Springer-Verlag, 1997. Another description is given in the article by J.Camenisch and M.Michels which has for reference "A group signature scheme with improved efficiency. In K.Ohta and D.Pei, editors, Advances in cryptology- ASIACRYPT'98, volume 1514 of LNCS , pages 160-174, Springer-Verlag, 1998.
• a tenth step consists in calculating 13 by the member calculation means a so-called additional signature of the set composed of the message and the anonymous signature, using the member's private common key.
• the algorithm used for the tenth step is a public key signature algorithm which may be the RSA algorithm.
• FIG. 2 is a flow diagram of a particular embodiment of the method according to the invention.
• the elements already described with reference to FIG. 1 are not re-described. The specific elements are described below.
• the first step further consists in associating 14 an update date equal to tl with the common private key, by considering that tl is the date of constitution of the group.
• the third step further consists in storing 15 by the storing means of each member the date of updating of the common private key.
• the method furthermore consists in modifying 16 by the first means of calculating the update date to determine an update date equal to the date t2.
• the eighth step consists in updating the common private key memorized by the means of memorization of the member if, in addition, the date update date stored by the member storage means is different from the update date of the common private key updated by the first calculation means.
• the date memorized by the member memorization means is equal to the date of updating of the updated group private key, there is no update by the member memorization means .
• the member's calculation means does not update his common private key, he uses the private key common which is stored in the member storage means for calculating the additional signature.
• FIG. 3 is a diagram of an embodiment of a method according to the invention by means of a system.
• the system includes at least one calculation means and as many smart cards 211 as there are members in the group.
• a trusted authority such as a natural person, a legal person, a national or international administration, has a computing means 20 represented by a server in FIG. 3.
• This computing means 20 is connected by a first communication link 22 to a communication network 23 which may as well be a public network such as the Internet, as a private network such as a LAN network, short for Anglo-Saxon terms Local Area Network.
• Each member of a group has a 21 card! a chip which comprises in the chip a means 24 for storage and a means 25 for calculation. Each member also holds, or has access to, a reader 26 of this card rehé by a second communication link 27 to a personal computer 28, or any equivalent computer.
• the personal computer 28 is rehé by a third communication link 29 to the communication network 23.
• the constitution of the group with the trusted authority results in an interaction between the trusted authority and each member of the group.
• the server 20 of the trusted authority calculates a pair of asymmetric keys 30, 31 common to the members of the group and a group public key 32 associated with the group.
• the server 20 of the trusted authority and the means 25 for calculating the member calculate a key 33 ! private group.
• the group private key 33 ⁇ is stored in the means 24 for storing the member's smart card.
• the member has his own group private key which is different from the group private key of all the other members.
• the pair 30, 31 of common asymmetric keys consists of a common public key 30 and a common private key 31. This pair 30, 31 can be associated with an update date D which is initialized on the date tl of calculation of this pair.
• the group private keys are different for each member of the group and are associated with the group public key 32.
• the server 20 of the trusted authority determines a key 34 ! symmetrical secret.
• the server 20 then encrypts the common private key 31 with each of the secret keys 34i to obtain as many encrypted forms of the common private key 31 as of non-revoked members.
• the server 20 of the trusted authority and the means 25 for calculating the member also calculate an identifier 35i of the member.
• the chip card 211 stores in its storage means 24 the common private key 31, the member's private group key 33 1 and the secret key 341 assigned to the member.
• the keys are transferred to a smart card during interaction using conventional methods.
• the trusted authority keeps a copy of each of the symmetrical and identifying secret keys 34j 35i of each member in a memory space which can be a memory zone of the server 20 or an associated storage means 36.
• the different public keys and the encrypted values of the common private key 31 are stored in a directory which is stored in a public part of the memory space 20, 36; that is to say directly accessible, in particular, by each member of the group or, in particular, by each recipient of a message and this via the network 23.
• the group can evolve, either by the entry of a new member in the group, or by the dismissal of a member of the group.
• the server 20 modifies the pair of common asymmetric keys 30, 31 to determine a pair of asymmetric keys up to date with the composition of the group. This update is performed on a given date known as the update. It can also be carried out when a new member enters the group.
• the server 20 After determining this pair of up-to-date common asymmetric keys, the server 20 makes available in encrypted form the private key 31 of this pair of asymmetric keys for each of the smart cards 211 of the non-revoked members of the group.
• the server 20 calculates as many encrypted forms as there are non-revoked members by using the key 34; personal secret to each of these members.
• the server 20 encrypts the private key 31 of the pair of up-to-date common asymmetric keys 30, 31.
• Each of the personal secret keys 34 ⁇ introduced as an input argument of the encryption algorithm used corresponds to a result which is the value encrypted of the common private key 31 of the pair of asymmetric keys up to date.
• the different results and, generally, the date of update are stored in the directory.
• the means 25 for calculating the card 21 ! smart connects to the memory space 20, 36 in which the directory is stored, via the personal computer 28 and the network 23.
• the smart card 21 ⁇ reads in the directory the date D to update the common private key.
• the means 25 for calculating the chip card 211 compares this update date D with that O ⁇ which it holds in its storage means 24. Either these dates are different, or these dates are identical.
• card 21! chip can, for example, copy into its storage means 24 the various encrypted forms of the common private key 31.
• the means 25 for calculating the smart card 21. r can then undertake to decrypt each of the encrypted forms of the common private key 31 using the decryption algorithm which is associated with the encryption algorithm previously used.
• the input arguments include on the one hand, the personal secret key 341 stored in the card 21 ! on the other hand, taken successively, the encrypted forms of the common private key 31. At the first correct decryption result, card 21!
• Another method consists in placing before each encrypted form of the common private key 31 an identifier of the member concerned.
• the means 25 for calculating the smart card 21 i can then undertake to test each of the encrypted forms of the common private key 31 using the identifier. When it arrives at a valid test, it then undertakes to decrypt the encrypted form of the common private key 31 which corresponds to it using the decryption algorithm which is associated with the previously used encryption algorithm.
• the input arguments include on the one hand, the personal secret key 34 ⁇ stored in the card 21 ! on the other hand, the encrypted form of the common private key 31.
• the smart card does not make a copy in its means 24 of memorizing the different encrypted forms of the common private key 31. This situation arises when no change in the group has taken place since the member's entry into the group; card 21 ! chip holds the latest update of the common private key 31.
• the means 25 for calculating the smart card 21 1 retrieves the message stored in the computer 28.
• the means 25 for calculating the smart card 21 1 calculates an anonymous signature of this message to using the signature algorithm.
• the input arguments comprise on the one hand the message and on the other hand the group private key 33 1 stored in the chip storage means 24.
• the means 25 for calculating the chip card 211 calculates a second so-called additional signature of the assembly formed of the message and the anonymous signature using the previous signature algorithm.
• the input arguments comprise on the one hand the assembly formed of the anonymous message and signature and on the other hand the common private key 31 stored in the member storage means.
• card 21 ! smart transmits to the recipient chosen by the member, the additional signature, the anonymous signature and the message.
• the recipient can in these conditions verify that the member who signed the message is a non-revoked member. To this end, the recipient verifies each of the two signatures, the additional signature and the anonymous signature, using the common public key, respectively the group public key. To verify, the recipient uses a verification algorithm available for example on a personal computer.
• the input arguments comprise on the one hand the message and on the other hand the common public key, respectively the group public key.
• a first application of a method according to the invention is electronic voting.
• Electronic voting takes place in two phases:
• the voter obtains a private group key according to a method according to the invention.
• the anonymous signature that the voter can produce from his group private key is said to be "correlable”. This means that, in the event that the voter attempts to anonymously sign a second ballot by producing an anonymous signature, that ballot will be rejected by the ballot box. Indeed, the anonymous signature being correlable, the ballot box is able to verify that it is a second anonymous signature.
• a malicious voter cannot claim to have lost their group private key, receive another, and be able to vote twice. Indeed, the implementation of a method according to the invention makes it possible to prohibit the use of the first group private key; this group private key is updated when he declares having lost the first group private key. This loss is managed by the implementation of a process according to the invention such as a revocation of the member.
• a second application of a method according to the invention is an electronic auction service.
• the auctions involve three protagonists: an auction server, a trusted authority and a client. All of the clients form a group called the client group.
• a user wishing to register with the group of clients must contact the trusted authority which provides him with his group private key. He thus obtains the right to produce an anonymous group signature.
• the trusted authority which provides him with his group private key. He thus obtains the right to produce an anonymous group signature.
• he can sign each of his auctions anonymously.
• each member of the client group can bid by signing a message containing in particular the product put up for sale and the amount of their bid.
• the auction server can verify group membership and therefore the validity of the auction by verifying the anonymous group signature.
• the winner is the one who gives the last bid before the auction.
• the last message received by the auction server is therefore that of the winner.
• the server then addresses this message and the corresponding anonymous group signature to the trusted authority, which is the only one capable of lifting anonymity and
• the auctions involve dynamic groups: new people can join the group every day, a member can leave the group or be excluded for fraud at any time. It is therefore essential to set up a revocation system to prevent a revoked member from being able to use their signature fraudulently. Indeed, the revoked member could continue to use his private group key to participate in the auctions and distort the smooth running of the latter, for example by increasing the amount. And, if he takes care to withdraw early enough from the process so as not to win the auction in question, then this fraud is not detected since only the identity of the winner is finally revealed.
• the implementation of a method according to the invention makes it possible to solve the problem of revocation of one or of member (s) of the group.
• a third application of a method according to the invention is electronic payment. It involves four protagonists: a customer, a merchant, a bank and a trusted authority. Each client must be identified by the system and obtain a group private key before being able to make their first transaction. To make a payment, the customer must withdraw electronic documents from his bank. The pieces he removes are anonymous thanks to the use of a mechanism called blind signature.
• the expenditure of a C piece at a merchant is done as follows: the chent generates a group signature relating to C pieces and transmits the signature and C pieces set to the merchant. The merchant verifies the signature of the bank attached to each piece C and verifies the group signature. If each of the two signatures is valid, the merchant accepts the transaction.
• the merchant forwards to his bank the signatures and the documents received in payment for transfer to his account.
• the bank sends the group signature relating to the disputed document to the trusted authority so that it identifies the indelicate price and sanctions the offender.
• a reliable mechanism for revoking compromised group private keys is necessary in order to avoid fraud of the following type: a dishonest client reports the loss of his group private key to the trusted authority and therefore declines all responsibility for fraud that could be committed with s. The chent gives his key to his accomplice, who can then use s to sign the coins c he has legitimately withdrawn from the bank, and then spend them as many times as he wishes.
• a method according to the invention solves the problem of revoking group private keys.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=8871175

Family Applications (1)

Country Status (6)

Families Citing this family (41)

Family Cites Families (3)

• 2002
  • 2002-01-04 FR FR0200107A patent/FR2834598B1/fr not_active Expired - Fee Related
  • 2002-12-13 AU AU2002364839A patent/AU2002364839A1/en not_active Abandoned
  • 2002-12-13 EP EP02801132A patent/EP1461898A1/de not_active Withdrawn
  • 2002-12-13 JP JP2003561157A patent/JP4082717B2/ja not_active Expired - Fee Related
  • 2002-12-13 WO PCT/FR2002/004335 patent/WO2003061193A1/fr active Application Filing
  • 2002-12-13 US US10/500,792 patent/US7571324B2/en not_active Expired - Fee Related

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events