WO2000064097A1 - Procede de verification de signature ou d'authentification - Google Patents
Procede de verification de signature ou d'authentification Download PDFInfo
- Publication number
- WO2000064097A1 WO2000064097A1 PCT/FR2000/001047 FR0001047W WO0064097A1 WO 2000064097 A1 WO2000064097 A1 WO 2000064097A1 FR 0001047 W FR0001047 W FR 0001047W WO 0064097 A1 WO0064097 A1 WO 0064097A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- value
- modulo
- entity
- public
- function
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
- G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/409—Device specific authentication in transaction processing
- G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
- G06Q20/40975—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
Definitions
- the present invention relates to a method making it possible to make more efficient, in computation time, in necessary RAM and ROM, the verification of an asymmetrical signature or authentication requiring some modulo n multiplications or large numbers.
- the RSA and Rabin signature or authentication algorithms are examples allowing the implementation of this process.
- the method is more particularly suitable for implementation in the case of a computer, for example a personal computer designated by PC, which generates a signature or an authentication by means of a secret key which must then be verified. by a microcomputer card.
- the microcomputer performs this verification using a public key. It has relatively little power compared to the PC.
- microcomputer card is meant a standard monolithic microcontroller with incorporated memory.
- large numbers we mean positive integers and at least 320 bits.
- the scientific community even currently recommends using numbers of at least 512 bits, or even 1024 bits for most algorithms, for example for RSA or Rabin algorithms.
- microcomputer cards are brought into dialogue with computers having far greater computational capabilities than themselves.
- microcomputer cards are often used without an arithmetic coprocessor, and with very limited memory resources (ROM, RAM and EEPROM).
- ROM read only memory
- RAM random access memory
- EEPROM electrically erasable programmable read-only memory
- modulo calculations of large numbers are often very long, even impossible for lack of sufficient memory, if the traditional descriptions of cryptographic algorithms.
- prover the entity which wants to be authenticated, or which produces a signature. To do this, it performs calculations involving the secret key of the asymmetric algorithm used. It will for example be a PC type computer.
- verifier the entity which verifies authentication, or which verifies the validity of a signature. For this, it performs calculations involving only the public key of the asymmetric cryptographic algorithm used. It will, for example, be a microcomputer card.
- the subject of the present invention is the implementation of a signature verification and authentication method making it possible to remedy the aforementioned drawbacks inherent in the more limited computational capacity of a verifier entity, constituted by a microcomputer card, screw vis-à-vis a proving entity, such as a personal computer or other provided with a card reader device.
- Another object of the present invention is therefore a simplification of the calculation operations of certain modular reductions of the verifier thanks to the implementation of additional calculations of the prover, the task of the verifier being thus simplified in the absence of any weakening of the theoretical safety of the assembly.
- the authentication signature verification method respectively by means of an asymmetric cryptographic calculation process with private key and public key, object of the present invention, this method being carried out between a "prover" entity and a “verifier” entity , the proving entity performing cryptographic calculations using the private key with a view to performing a signature calculation, respectively an authentication value, and the verifying entity using this transmitted value performing cryptographic calculations using this public key with a view to carrying out this signature verification, respectively to this authentication, the cryptographic calculation operations implementing the calculation of modulo n multiplications or large numbers, is remarkable in that, for a cryptographic calculation process putting using a public key, consisting of a public exponent e and a public modulo n, and a private key constituted by a private exponent, d, this process consists in calculating, at the level of the proving entity, at least one prevalidation value and of transmitting from the proving entity to the entity verifying this at least one prevalidation value , allowing the verifying entity to carry out at least one modular reduction in
- the process which is the subject of the present invention applies in the context of any dialogue or protocol exchange of messages between a proving entity such as a personal computer and a verifying entity such as a microcomputer card, in particular in the context of banking transactions, access control or the like.
- FIG. 1 shows an illustrative diagram of the method, object of the present invention, implemented between a proving entity and a verifying entity;
- FIG. 2a shows an illustrative diagram of the method, object of the present invention, implemented from a Rabin algorithm in authentication verification
- - Figure 2b shows an illustrative diagram of the method, object of the present invention, implemented from a Rabin algorithm in signature verification
- - Figure 3a shows an illustrative diagram of the method, object of the present invention, implemented from an RSA algorithm in authentication verification
- FIG. 3b shows an illustrative diagram of the method, object of the present invention, implemented from an RSA algorithm in signature verification.
- the method which is the subject of the invention implements, at the level of the verifying entity, public key algorithms requiring modulo n multiplications, or large numbers, and modifies them slightly by causing the calculation of one or more quotients q outside, that is to say at the level of the proving entity, and by providing this or these quotients to the verifier.
- the verifier can more easily and quickly calculate certain modular multiplications: instead of calculating a * b modulo n, he will just have to calculate a * b, q * n, and a * bq * n, a, b denoting values signature verification or authentication calculations.
- the quotient (s) q constitute one or more prevalidation values transmitted to the verifying entity in order to allow the verifying entity to carry out at least one modular reduction in the absence of any division operation for this modular reduction.
- a right arrow represents the transmission of the aforementioned values between verifier and prover or vice versa and an arrow loop at the level of the prover or verifier represents the implementation of an internal calculation at the level of the prover or of the auditor.
- the RSA algorithm is the most famous of the asymmetric cryptographic algorithms. It was invented by RIVEST, SHAMIR and ADLEMAN in 1978. It can be found described in: RL RIVEST, A. SHAMIR, LM ADLEMAN: A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, Communications of the ACM, 21, n ° 2, 1978, pp. 120-126. or in the following documents: • ISO / IEC 9594-8 / ITU-T X.509, Information Technology - Open Systems Interconnection - The Directory: Authentication Framework;
- the RSA algorithm uses an integer n which is the product of two large prime numbers p and r, and an integer e, prime with ppcm (pl, r-1), and such that e ⁇ ⁇ 1 modulo ppcm (p -1, r-1).
- the integers n and e constitute the public key.
- e 2
- the function x e is not bijective modulo n
- n is the product of two prime numbers > 2
- the verifier generates a random number A modulo n, and sends it, (reference 0 in the figure), to the prover. This then calculates a number B (reference 1), and returns this value B to the verifier. This then accepts authentication if and only if: B * B modulo n is equal to one of the following four possible values: A, or nA, or C * A modulo n, or -C * A modulo n.
- the prover does not send (reference 2) the value B alone: it sends B and Q, where Q is the quotient of B * B by the public modulo n.
- M the message whose verifier wishes to verify the signature S.
- S is a Rabin signature of M
- f is the identity function, or else is described in a signature standard; for example one can use the operations of paddage or concatenation of the standard PKCS # 1, established for RSA normally, confer the descriptive elements of this standard below in the description.
- the prover does not send (reference 2) the value S only: it sends S and Q, where Q is the quotient of S * S by the public module n.
- the checker does not have any more any division to calculate.
- the prover does not send (reference 2) the value B alone: it sends B, Ql and Q2 , where Ql is the quotient of B * B by the public modulo n, and where Q2 is the quotient of B * (B * B - Ql * n) by n.
- S is an RSA signature of M
- f is the identity function, or else is described in an RSA signature standard, such as for example the PKCS # 1 standard.
- the normalized public service can consist in applying to the message M a function of condensation SHA-1 to obtain a digest of message CM, then in concatenating with this digest of message a constant value.
- the prover does not send (reference 2), the value S only: it sends S, Ql and Q2, where Ql is the quotient of S * S by the public modulo n, and where Q2 is the quotient of S * (S * S - Ql * n) by n.
- the SHA-1 condensing function is a public "condensing" function. It takes as input a message whose size can range from 0 bytes to several Giga bytes, and gives as output a "digest" of the 160 bit message. This function is often used in standards or with signature algorithms, because it is reputed to be resistant to collisions, that is to say that we cannot concretely find two distinct messages which have the same digest (it exist but we do not know how to find such a couple of messages). This allows you to sign the digest of messages rather than the messages themselves.
- the PKCS # 1 standard is an RSA signing standard. It describes a public service f. This function f is applied to the message M to be signed with RSA before launching the RSA modular exponentiation operation proper: the RSA signature of M will therefore
- PKCS # 1 RSA Encryption Standard, version 2, 1998, available at the following address: ftp://ftp.rsa.com/pub/pkcs/doc/pkcs-lv2.doc whose edited version is introduced herein ask for reference.
- the invention thus consists in providing additional data to the verifier in order to facilitate the calculations.
- quotients constituting the pre-validation value (s)
- these data are completely redundant compared to the values transmitted to the card in a "classic" use of the asymmetric algorithm.
- the card can find these quotients itself. There is therefore no additional information supplied to the card, within the meaning of information theory, when the method, object of the present invention as described above, is implemented. This shows that the security of the whole is in no way weakened compared to the "classic" implementation of the algorithm.
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- Computer Security & Cryptography (AREA)
- General Physics & Mathematics (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Finance (AREA)
- Microelectronics & Electronic Packaging (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
Abstract
Description
Claims
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2000613117A JP2002542716A (ja) | 1999-04-20 | 2000-04-20 | 署名または認証の検証方法 |
BR0006073-9A BR0006073A (pt) | 1999-04-20 | 2000-04-20 | Método de verificação de assinatura ou de autenticação |
EP00922700A EP1090479A1 (fr) | 1999-04-20 | 2000-04-20 | Procede de verification de signature ou d'authentification |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
FR9904975A FR2792789B1 (fr) | 1999-04-20 | 1999-04-20 | Procede de verification de signature ou d'authentification |
FR99/04975 | 1999-04-20 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2000064097A1 true WO2000064097A1 (fr) | 2000-10-26 |
Family
ID=9544643
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/FR2000/001047 WO2000064097A1 (fr) | 1999-04-20 | 2000-04-20 | Procede de verification de signature ou d'authentification |
Country Status (6)
Country | Link |
---|---|
EP (1) | EP1090479A1 (fr) |
JP (1) | JP2002542716A (fr) |
CN (1) | CN1306713A (fr) |
BR (1) | BR0006073A (fr) |
FR (1) | FR2792789B1 (fr) |
WO (1) | WO2000064097A1 (fr) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7440571B2 (en) * | 2002-12-03 | 2008-10-21 | Nagravision S.A. | Method for securing software updates |
FR2877453A1 (fr) * | 2004-11-04 | 2006-05-05 | France Telecom | Procede de delegation securisee de calcul d'une application bilineaire |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0522473A2 (fr) * | 1991-07-08 | 1993-01-13 | Mitsubishi Denki Kabushiki Kaisha | Procédé et dispositif cryptographique de vérification d'identité |
EP0791877A1 (fr) * | 1996-02-26 | 1997-08-27 | France Telecom | Dispositif électronique délivrant une référence temporelle sûre pour la protection d'un logiciel |
-
1999
- 1999-04-20 FR FR9904975A patent/FR2792789B1/fr not_active Expired - Fee Related
-
2000
- 2000-04-20 WO PCT/FR2000/001047 patent/WO2000064097A1/fr not_active Application Discontinuation
- 2000-04-20 JP JP2000613117A patent/JP2002542716A/ja active Pending
- 2000-04-20 CN CN 00800922 patent/CN1306713A/zh active Pending
- 2000-04-20 EP EP00922700A patent/EP1090479A1/fr not_active Withdrawn
- 2000-04-20 BR BR0006073-9A patent/BR0006073A/pt not_active Application Discontinuation
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0522473A2 (fr) * | 1991-07-08 | 1993-01-13 | Mitsubishi Denki Kabushiki Kaisha | Procédé et dispositif cryptographique de vérification d'identité |
EP0791877A1 (fr) * | 1996-02-26 | 1997-08-27 | France Telecom | Dispositif électronique délivrant une référence temporelle sûre pour la protection d'un logiciel |
Non-Patent Citations (1)
Title |
---|
CHANG C C ET AL: "AN ID-BASED SIGNATURE SCHEME BASED UPON RABIN'S PUBLIC KEY CRYPTOSYSTEM", PROCEEDINGS OF THE ANNUAL INTERNATIONAL CARNAHAN CONFERENCE ON SECURITY TECHNOLOGY,US,NEW YORK, IEEE, vol. CONF. 25, 1991, pages 139 - 141, XP000300422, ISBN: 0-7803-0120-X * |
Also Published As
Publication number | Publication date |
---|---|
EP1090479A1 (fr) | 2001-04-11 |
BR0006073A (pt) | 2001-03-20 |
FR2792789A1 (fr) | 2000-10-27 |
CN1306713A (zh) | 2001-08-01 |
FR2792789B1 (fr) | 2001-08-31 |
JP2002542716A (ja) | 2002-12-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3506556B1 (fr) | Méthode d'échange de clés authentifié par chaine de blocs | |
EP2345202B1 (fr) | Procédé de signature numérique en deux étapes | |
FR2759226A1 (fr) | Protocole de verification d'une signature numerique | |
WO2003056750A2 (fr) | Systeme cryptographique de signature de groupe | |
EP1807967B1 (fr) | Procede de delegation securisee de calcul d'une application bilineaire | |
EP2891268B1 (fr) | Signature de groupe utilisant un pseudonyme | |
EP0878934B1 (fr) | Procédé d'identification à clé publique utilisant deux fonctions de hachage | |
FR3015080A1 (fr) | Verification d'integrite de paire de cles cryptographiques | |
WO2006070092A1 (fr) | Procede de traitement de donnees et dispositif associe | |
EP1145483B1 (fr) | Procede d'authentification ou de signature a nombre de calculs reduit | |
EP0963638B1 (fr) | Procede de signature numerique | |
WO2001028153A1 (fr) | Procede de contre-mesure dans un composant electronique mettant en oeuvre un algorithme de cryptographie a cle publique de type rsa | |
CA2257907A1 (fr) | Procede de cryptographie a cle publique | |
WO2003055134A1 (fr) | Procede cryptographique permettant de repartir la charge entre plusieurs entites et dispositifs pour mettre en oeuvre ce procede | |
EP1090479A1 (fr) | Procede de verification de signature ou d'authentification | |
EP0769768B1 (fr) | Procédé cryptographique de protection contre la fraude | |
EP1520370B1 (fr) | Procédé et dispositifs cryptographiques permettant d'alleger les calculs au cours de transactions | |
WO2007065468A1 (fr) | Procédé de génération de signature avec preuve de sécurité 'tight', procédé de vérification et schéma de signature associés basés sur le modèle de diffie-hellman | |
EP1407575B1 (fr) | Procede pour effectuer une tache cryptographique au moyen d'une cle publique | |
EP2587716A1 (fr) | Procédé de signature cryptographique de messages, procédé de vérification de signature et dispositifs de signature et de vérification correspondants | |
EP1344343B1 (fr) | Procede de chiffrement et d'identification | |
WO2003013053A1 (fr) | Procede de determination de la taille d'un alea pour un schema de signature electronique | |
FR2814616A1 (fr) | Procede cryptographique d'identification de supports homologues | |
FR2850502A1 (fr) | Procedes d'authentification numerique et de signature numerique a faible cout calculatoire et systeme signataire | |
FR2842968A1 (fr) | Procede d'obtention d'une signature electronique possedant une garantie sur sa securite |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 00800922.8 Country of ref document: CN |
|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): BR CN JP US |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2000922700 Country of ref document: EP |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 09720085 Country of ref document: US |
|
WWP | Wipo information: published in national office |
Ref document number: 2000922700 Country of ref document: EP |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: 2000922700 Country of ref document: EP |