WO2004010641A1

WO2004010641A1 - A method for small-feature-based hyperbolic digital signature

Info

Publication number: WO2004010641A1
Application number: PCT/CN2002/000749
Authority: WO
Inventors: Zhenhua Wang; Zhijie Chen
Original assignee: Shanghai Chlor-Alkali Chemical Co., Ltd.; Shanghai Yantuo Computer Co., Ltd.
Priority date: 2002-07-24
Filing date: 2002-10-29
Publication date: 2004-01-29
Also published as: CN1391168A; AU2002344027A1; CN1220959C; AU2002344027A8

Abstract

The invention disclosed a method for small-feature-based hyperbolic digital signature. It comprises the steps as follows: supposed the sender is A, the receiver is B, the clear text is m, 1) sender A that utilizes hardware performs functions as: randomly generates private key pair (X1, X2), generates public key pair (Y1, Y2), generates signature pair (r, s) and sends above described pairs to receiver B, 2) receiver B that utilizes hardware performs functions as: receives public key pair, signature pair and clear text sended from A, then extracts digest pair from the received clear text, finally verify the equation. The method can ensure that greatly reduces basic key bits used on the basis of equal security level, thereby reduce development expense and run cost, decrease occupancy to computer resource, improve the operation speed of generating related prime, shorten the authentication time of signature.

Description

Hyperbolic digital signature method based on small features

The invention belongs to a digital signature method for computer information security, in particular to a hyperbolic digital signature method based on small features.

technical background

In the modern information society, the demand for global computer and network security is becoming increasingly urgent. In various fields, such as e-commerce, corporate security, and national security, etc., the integrity of electronic information is protected, especially to protect The integrity of important information has become a general concern of the international community. The digital signature method is a public key system that guarantees the unchangeability of electronic data. It not only authenticates the identity of the sender of the information, but also verifies the consistency and integrity of the information sent.

Existing digital signature methods, such as the famous RSA digital signature method, are based on the difficulty of factoring large numbers in mathematics. Suppose there are two prime numbers? , Q, ^^? 0, when N is large enough, it is mathematically difficult to obtain P and Q from N; but with the development of science and technology, the research on the fast decomposition method of large numbers has been obtained Many new achievements, coupled with the development of computing technology and computers, the difficulty of factoring large numbers continues to decrease. In order to meet the corresponding level of security performance requirements, the number of mathematical operations will gradually increase, from 512 in the 1980s. From 1024 bits in the 90's to 2048 bits now, an algorithm's key is too long, its related primes are difficult to generate, and it will take up huge computer resources. The operation process is too slow. When the hardware implementation is used to speed up the operation, the digital Too long will also make the cost extremely expensive. In addition, due to the immutability of the hardware implementation, the hardware development and service life will be greatly shortened, and the running cost will be extremely high.

Summary of the Invention

The technical problem to be solved by the present invention is to provide a hyperbolic digital signature method based on small features. This method can ensure that the number of basic key bits used is greatly reduced on the basis of equal security levels, thereby reducing development costs and operating costs. , Reduce the occupation of computer resources, improve the speed of generating related prime numbers, and shorten the signature verification time. To solve the above technical problems, the technical solutions adopted by the present invention are:

A hyperbolic digital signature method based on small features includes the following steps.

Suppose the sender is A, the recipient is B, the plaintext is m, the small feature is P, and α is the zero point of the polynomial χ ^ρ -χ-1 on the Galois Field F _P with P elements, and the parameter is c , The test parameters are Ql, Q2,

① The operation performed by sender A using hardware is

a: Randomly generate the private key X ^ Πχ ₂ , and take the number pair (X χ ₂ ) as the private key

Including

Ρ-1 Ρ -ι

∑ a, <ρ ∑ b _t <Ρ

/ = 0 ί = 0

b: A security check is performed on the generated private key. The security check is to determine whether Q1 can divide X] or Q2 can divide X _2. If one of the judgments is negative, you need to regenerate the private key χ ^ πχ ₂ .

c: Generate the public key (ca) ^X1 , Y ₂ = (ca) take (Υ Υ ₂ ) as the public key corresponding to the private key (χ χ ₂ ), Υ _η Υ _{2 is} represented as a Gal with P elements Polynomial of a on tile field;

d: Take the digest number pair (^, d ₂ ) for the plaintext m and form the signature number pair (r, s), first randomly take k and k- ¹ in the non-negative integer domain, and satisfy the condition k k- ^! ≡l (mod P ^p -1), get a component r of the signature number pair, r is r 0 ≤ R _t <Ρ (θ <<-l)

The resulting R is then obtained. , ···, ^ are sequentially added to the plaintext m to generate a new plaintext, denoted as (R _Q ,…, R _p-1 ), and the plaintexts are digested by the digest functions MD5 and SHA1! ^ Perform operations to obtain the corresponding abstract number pairs (^, d ₂ ), where dj = Md5 Cm ₁ (R ₀ , ···, R _p —),

d ₂ = SHA1 (m, (R ₀ , ···, R _p —)),

Let s ≡k " ^! (X! D! + X ^) (mod P ^p -l), and obtain the number of signatures against another component s, from which the number of signatures (r, s) is formed; where r is between A polynomial on a Galois field containing P elements, with coefficients R.,... R _P-1J and s being an integer;

e: Send the number of public key pairs, the number of signature pairs, and the plaintext to B.

② The operation performed by recipient B using hardware is

a: Receive the public key pairs (Y * !, Y * ₂ ), the signature number pairs (r *, s *), and the plaintext m * from A _.;

b: Add the coefficient R _Q in r * of the received signature number pair to the plaintext m * received by B to generate a new plaintext, denoted as in *, (R ₀ , ···, Rp.,), Use the digest functions MD5 and SHA1 to operate on the plaintext to obtain the corresponding digest number pair (, d * ₂ ), where

d *! = Md5 (m * j (R ₀ ,…, R _p-1 )),

d * ₂ = SHA1 (m *! (R ₀ , ···, R _p-1 ));

c: verify the equation, take

verL (r *, s *) = r * ^s * e F _P [a], ver (m *, r *, Y * _1; Y * ₂ ) = γ * ^ * ^ * ^^ If verL (r *, s *) = verR (m *, r *, Y * j, Y * ₂ ), which indicates that the verification is passed, and the plaintext m * received is the plaintext m sent by A. The sender A may make the public key number pair (Y ,, Υ ₂ ) into an X.509 certificate, and then send it to the receiver Λ B. Since the above-mentioned solution is adopted, the advantages of the present invention compared with the prior art are:

1. This scheme uses two digest functions to extract randomized plaintext abstract number pairs, and the signature is formed by the hyperbolic effect of the private key on the abstract number pairs, so that there is an index between the number of small features and the security performance. The proportion increases, so it not only guarantees a fairly high level of security, but also reduces the occupation of computer resources, improves the speed of generating related prime numbers, and shortens the time for signature verification, thereby reducing development costs and operating costs;

2. Since this method performs security processing on the number of private key pairs, it can prevent "birthday attacks". BRIEF DESCRIPTION OF THE DRAWINGS

The following further describes the present invention in detail with reference to the accompanying drawings and specific embodiments. FIG. 1 is a main flow chart of the steps of the hyperbolic digital signature method based on small features of the present invention. FIG. 2 is a view of the hyperbolic digital signature method based on small features of the present invention. Sub-flow diagram for generating keys;

3 is a sub-flow diagram for generating signatures and digests in a hyperbolic digital signature method based on small features of the present invention;

4 is a sub-flow diagram for verifying a signature in a hyperbolic digital signature method based on small features of the present invention;

5 is a schematic diagram of a circuit of a private key generation module in a hyperbolic digital signature method based on small features of the present invention;

FIG. 6 is a schematic diagram of a public key generation module circuit in a hyperbolic digital signature method based on small features of the present invention; ■

7 is a circuit principle of a verification module in a hyperbolic digital signature method based on small features of the present invention Illustration.

detailed description

Since the present invention will involve a series of mathematical principles, the mathematical background of the present invention will now be described as follows:

Let P be a prime number, F _P be a Galois field with P elements, and the U polynomial X ^p -X-1 is irreducible on the field F _P ; let α be this irreducible polynomial χP-χ- l at a certain zero point of F _P , then the extended field F _P [oc] is the split field of the above irreducible polynomial, it is a Galois field containing P ^p elements, and the elements in F _P [ot] can be uniquely A polynomial expressed as a degree not exceeding P-1. Assume

Therefore, the order M _{Q of} α must be a factor of M. M = yp ≡ 1 (mod P-I) so M and p-1 are coprime, so M. The factor as M is also prime with p-1. If one original root c of F _P is taken, then the order of c is equal to P−1, so the order of CCC is equal to the least common multiple of P−1 and M, which is (P−1) M. Especially when the order of α is equal to M, ca is the original root of Galois domain F _P [ct]. As shown in FIG. 1, the small feature-based hyperbolic digital signature method of the present invention is composed of the following steps: key generation, signature generation, digest, and verification signature. As shown in FIG. 2, the process of key generation is divided into In order to generate a private key and a public key, the public key can be a polynomial number pair, and an X.509 certificate can be generated from the polynomial number pair. As shown in FIG. 3, the signature generation and digest are obtained by taking out the private key and randomly The number of signatures is composed of the first component, the number of generated digests and the second component of the generated signature. As shown in FIG. 4, the verification signature has two parts: compatibility verification and anti-forgery verification.

Assume that the sender is A, the recipient is B, the plain text is m, the small feature is P, and α is the zero point of the polynomial X ^ρ -X-1 on the Galois Field F _P with P elements, and the parameter is c , The test parameters are Ql, Q2,

① The operation performed by sender A using hardware consisting of a private key generation module, a public key generation module, and a verification module is

a: The private key XBX _{2 is} randomly generated, and the number pair (XX ₂ ) is the private key

Including

∑ ^ <p ∑ b _t <P b: Perform a security check on the generated private key. The security check determines whether Q1 is divisible or Q2 is divisible by X _2. If one of the judgments is negative, the private key X ^ Π × needs to be regenerated. ₂ .

c: Generate the public key (ca) ^X1 , Y ₂ = (ca), take (Y Υ ₂ ) as the public key corresponding to the private key (χ ₁ X ₂ ), and Υ _{2 is} expressed as a Gal with P elements Polynomial of a on tile field;

d: Take the abstract number pairs ((^, d ₂ ) for plaintext m and form the signature number pair (r, s), first randomly take k and k- ¹ in the non-negative integer domain, and satisfy the condition kk ≡l (mod P ^p -1), to obtain a component r of the signature number pair,

r ^ (ca) ^K = J) / " ¹ e [J 0 <R _t <P (θ ≤ i≤ P-l) and then add the resulting R _Q , ···,! ^^ to the plaintext m in order Generate a new plaintext and record it as 11 ^ (1.,…, Rp.j), and use the digest function MD5 (Microsoft digest 5) and SHAl (Security Hash Algorithm 1) to operate on the plaintext to obtain the corresponding digest number pairs. (, D ₂ ), where dj = Md5 (m ₁ (R ₀ , ···, R _p .j)>, d ₂ = SHA1 (mj (R ₀ , ···, R _p-1 )), then Let s ≡k "'(X ^^ X ^) (mod p ^p -l), get the number of signatures to another component s, and form the number of signatures (r, s). E: Send the public key to B The number of pairs, the number of signatures and the number of digests. ② The operation performed by the recipient B using hardware is a: receiving the number of public key pairs (Y * j, Y * ₂ ) from A, and the number of signature pairs (r * , S *) and Plain text m * _;

b: Add the coefficients R _Q ,… in the received r * of signature number pairs to the plaintext m * received by B to generate a new plaintext, denoted as (R ₀ , ···, R ^), using The digest functions MD5 and SHA1 operate on the plaintext m * to obtain the corresponding digest number pairs (d ^, d * ₂ ), where d *! = Md5 (m *! (R., ···, R ^)) ,

d * ₂ = SHA1 (m * j (R., ···, R _p —); c: verify the equation, take verL (r *, s *) = r * ^s * s F _p [a], verR (m *, r *, Y * _1? Y * ₂ ) =

If verL (r *, s *) = verR (m *, r *, Y * _1? Y * ₂ ) in the above equation, it means that the verification is successful, and the plaintext m * received is the plaintext m sent by A.

The sender A can make the public key number pair (Y Υ ₂ ) into an X.509 certificate, and then send it to the recipient B. The steps and verification equations of the recipient B are unchanged.

The second component s of the signature number pair is the hyperbolic effect of the digest number pair on the private key number pair and the product of the random factor 1 ¹ , the hyperbolic effect of the private key number pair on the digest number pair (χ ,, χ ₂ ) ο d ₂ ) can be defined as

The abstracts in this solution are also random, which can be seen from the formation of the above abstract number pairs.

Compared with RSA, the number of modulo bits and the security performance have a polynomial proportional growth relationship. The biggest advantage of our solution is the exponential growth ratio between the number of modulo bits and the security performance. This is the practice in cryptographic engineering. It is very important. To illustrate this feature of our scheme, compare it with RSA: suppose The modulus of RSA is 1024 bits, and the maximum possible calculation amount for a successful attack is 2 ^1024. As long as the modulus of this solution is 8 bits, the corresponding security of RSA can be achieved, because in our solution, the implementation is successful The formula for the maximum possible calculation amount of an attack is (2 ^η ) ^Λ {2 ^η }, where η is the number of digits of the modulus.

The realization of the present invention requires a physical entity. The entity may be a computer or a dedicated chip. It should include at least a circuit of a private key module, a hardware circuit of a public key generation module, a generation module of a signature number pair, and a verification module. Hardware circuit.

As shown in Figure 5, the circuit of the private key module consists of modules such as a random number generator, a remainder circuit, a coefficient generation circuit, a sigma circuit, a MUX, and a buffer. When the module works, first input the prime number P to the random number generating circuit. This circuit generates a random number nl '; nl' calculates the remainder with the input ql and determines whether the remainder is 0. When the remainder is 0, the coefficient generation circuit starts to work nl 'is decomposed into polynomials, and the coefficients are generated and sent to the summation circuit to determine whether the constraint 2 is satisfied. If it is satisfied, the MUX is gated, and the private key nl is output from the buffer.

As shown in Fig. 6, the public key generation hardware circuit is composed of cyclic FFT (Fast Fourier Transform) operation core, RAM (random memory), operation circuit, output buffer, control circuit and other modules. The generated private key is multiplied by a polynomial by the FFT operation kernel, and the intermediate value of the operation is temporarily stored in RAM, and the calculation of the coefficient is assisted by the operation circuit. Finally, the coefficient (public key) is sent to the buffer and serially output. The generation module of r in the signature number pair is the same as the public key generation hardware circuit.

As shown in FIG. 7, the hardware circuit of the verification module is composed of an input buffer, an Md5 operation core, a SHA operation core, a signature number pair S generation module, a cyclic FFT operation core 1, 2, a memory A, B, a comparator, and a control circuit. Firstly, after r through Md5 and SHA operation kernel, the digest number pair dl, d2 is generated, and then one of the signature number pair S is generated. Then, the two cyclic FFT operation cores respectively operate on the digest number pair, the signature number pair, and the private key, and compare the results generated by the comparator with the comparison result output by the flag bit.

Claims

Rights request

1. A hyperbolic digital signature method based on small features, which is characterized in that it includes the following steps,

① The operation performed by sender A using hardware is

a: Randomly generate the private key X ^ Πχ ₂ , and take the number pair (, χ ₂ ) as the private key

Including

P -1 P -1

∑ a _t <P ∑ <P

= 0 ί = 0

b: Perform a security check on the generated private key. The security check is to determine whether Q1 is divisible by ^ or Q2 is divisible by X _2. If one of the judgments is negative, then the private key X BX needs to be regenerated. _2;

c: Generate the public key Y (ca) ^X1 , Y ₂ = (ca), take (Y ^ Υ ₂ ) as the public key corresponding to the private key (× χ ₂ ), and Υρ Υ _{2 is} expressed as Polynomial of a over the Galois field;

d: Take the digest number pair (^, d ₂ ) of the plaintext m and form the signature number pair (r, s), first randomly take k and k in the non-negative integer domain and satisfy the condition k k- ^ l (mod P ^p -1), to obtain a component r of the signature number pair, r is r 0 ≤ R _t <P (θ <z <-l)

The resulting R is then obtained. , ···, R _p .J is added to the plaintext m in order to generate a new plaintext, denoted as (R., ···, R _p-1 ), and the digest functions MD5 and SHA1 are used to clarify the plaintext. Paper 1¾ performs operations to obtain the corresponding abstract number pairs (d ,, d ₂ ), where

d! = Md5 (m (R ₀ , ···, R _p-1 )), d ₂ = SHA1 (m (R ₀ , ···, R _p-1 )),

Let s ≡ ^A

(mod p ^p -l), to obtain the number of signatures against another component s, from which the number of signatures (r, s) is formed, where r is a polynomial of α on the Galois Field with P elements, coefficient Is R _Q ,…, Rp. ,, and s is an integer; e: sends the public key number pair, the signature number pair, and the plaintext to B;

② The operations performed by recipient B using hardware are:

a: Receive the number of public key pairs (Y * Y * ₂ ), number of signatures (r *, s *) and plaintext m * from A _;

b: The coefficient R in the first component r * of the signature number pair will be received. ,…, ^ Is added to the plaintext m * received by B to generate a new plaintext, denoted as (Ro,…, the plaintext is calculated using the digest function MD5 and SHA1, and the corresponding digest number pair (a * ,, d * ₂ ), where

d *! = Md5 (m *! (R ₀ , ···, R _p-1 )),

d * ₂ = SHA1 (m *! (R ₀ , ···, R _p-1 ));

c: verify the equation, take verL (r *, s *) = r * ^s * GF _P [a], verR (m *, r *, Y * ₁₅ Y * ₂ ) = γ * ΐγ *, 2

If verL (r *, s *) = verR (m *, r *, Y *], Y * ₂ ) in the above equation, the verification is successful, and the plaintext m * received is the plaintext m sent by A.

2. The hyperbolic digital signature method based on small features according to claim 1, characterized in that: the sender A can make a public key number pair (Υ Υ ₂ ) into an X.509 certificate, and then send it To the recipient: 8.