Method for determining the correctness of the application of part of a participant's secret key by modular exponentiation using a zero-knowledge proof in a communication system

Abstract

Method for determining the correctness of the application of a part of a party's secret key by modular exponentiation using a zero-knowledge proof in a communication system, comprising the following steps: (a) Each party applies a part of the secret key x i by modular exponentiation to a message M as M xi modN and uses a cryptographically secure hash function HASH, which has a length of k' bits and chooses a large random number v ∈ R ℤ b , where b = 2 k'+log xi+1 applies, where the value of M x i is referred to as generator g and is used to calculate the obligations t1 and t2: { t 1 = gvmod N t 2 = 2 vmod N (b) Each party calculates the challenge c = HASH(g, y1, y2, t1, t2), where y1 and y2 are defined for each party as follows: { y 1 = gximod N y 2 = 2 ximod N (c) Each party calculates the answer r: r = v − ( c × xi ) (d) Each party includes in its part the zero-knowledge proof (c, y1, y2, r). (e) The correctness of the application of the parties' secret key can be verified using the verification function with the same hash function HASH: c ≡ ? HASH ( g , y 1 , y 2 , t 1 , t 2 ) (f) A third party receives a public key modulo N as well as a list of known y2 for parties P i includes those who possess the secret, via an existing public key infrastructure or by another method, and the third party uses y2 of the parties to reconstruct the commitments t1 and t2: { t 1 = gr × y 1 cmod N t 2 = 2 r × y 2 c modN .

Description

[0001] The invention relates to a method for determining the correctness of the application of a part of a secret key by modular exponentiation using a zero-knowledge proof (ZKP) in a communication system.

[0002] In cryptography, a ZKP is a method by which one party (the prover) can prove to another party (the verifier) ​​that they know a value as part of a secret key, without communicating any information other than the fact that they know the value. The essence of zero-knowledge proofs is that it is trivial to prove knowledge of some information simply by revealing it; the challenge is to prove this possession without revealing the information itself or any additional information.

[0003] If the proof of a statement requires that a party possesses part of a secret key, then the verifier cannot prove the statement to another person without possessing part of a secret key. The statement to be proven must contain the claim that the verifier possesses this knowledge, but not the knowledge itself. Otherwise, the statement would not be proven with zero knowledge, because it provides the verifier with additional information about the statement at the end of the protocol. A zero-knowledge proof of knowledge is a special case when the statement consists only of the fact that the party possesses part of a secret key.

[0004] Procedures that use a ZKP offer an ideal way to authenticate parties because they can be proven to keep the necessary secrets secret. Such procedures can be used as pure authentication systems in chip cards or online systems, or as building blocks in more complex applications such as credential systems, eVoting, or eCash. They are typically used to prove the protocol-compliant behavior of participants or the system. In credential and cash applications, zero-knowledge protocols can also be used to prove ownership of credentials or digital cash without requiring them to be presented.

[0005] A well-known method for a ZKP is the “Fiat and Shamir” identification scheme (Amos Fiat and Adi Shamir. How to prove yourself: Practical solutions to identification and signature problems. In Conference on the theory and application of cryptographic techniques, pages 186.194. Springer, 1986. doi: 10.1007 / 3-540-47721-7_12.) A disadvantage of the ZKP known from this state of the art is that a trusted dealer is required.

[0006] The cryptosystem of "Damgard and Jurik" (Ivan Damgard and Mads J. Jurik. A generalization, a simplification and some applications of Paillier's probabilistic public key system. BRICS Report Series, 7(45), June 2000. doi:10.7146 / brics.v7i45.20212.) offers another way to implement a ZKP. Because it must be performed interactively or with a logarithm, it is very difficult to compute, which is a disadvantage of this method.

[0007] Patent specification DE 600 01 215 T2 describes a method that provides an efficient proof-of-knowledge protocol for proving the Monte Carlo test, i.e. that a number n is the product of two odd prime numbers of approximately the same size.

[0008] From the patent specification EP 1 898 382 B1 a method for calculating a pseudorandom function for use in an anonymous authentication system is known, wherein the authentication system is limited in number.

[0009] The aim of the invention is to overcome these disadvantages and to provide a method that uses a ZKP without a trusted dealer, that uses less computing power and that can be used in a non-interactive manner.

[0010] To overcome this disadvantage, the invention proposes a method for determining the correctness of the application of a part of a party's secret key by modular exponentiation using a ZKP in a communication system, comprising the steps according to claim 1.

[0011] It is assumed that there exists a cryptographically secure hash function h with length k bits. Each party chooses a large random number v ∈ R No. b , where b = 2 k+log2xi+1 The value of M xi referred to as generator g for calculating the obligations t1 and t2: {t2 = 2vmodNt1 = gvmodN which are used to calculate a challenge c = H(g, y1, y2, t1, t2', where y1 and y2 are defined for each party as follows: {y2 = 2ximodNy1 = gximodN

[0012] All this together allows the calculation of the answer r: r=v−(c×xi) , which allows constructing a zero-knowledge proof for knowledge (c, y1, y2, r). This can be used to prove that x1 has not been falsified. It can also be used to prove that one party uses the same values ​​of x1 to calculate r. To do this, the third party must reconstruct the commitments t1 and t2 as: {t1=gr×y1cmonNt2=2r×y2cmodN which can be used with a verification function that uses the same hash function H: c≡?H(g,y1,y2,t1,t2)

[0013] This method is based on “Camenisch and Stadler” (Jan Camenisch and Markus Stadler. Proof systems for general statements about discrete logarithms. Technical Report / ETH Zurich, Department of Computer Science, 260, 1997.), which is based on “Fiat and Shamir” with a non-interactive random oracle access model (Mihir Bellare and Phillip Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In Proceedings of the 1st ACM Conference on Computer and Communications Security, pages 62-73. ACM Press, 1993. doi: 10.1145 / 168588.168596).

[0014] It uses cyclic groups of order N, which are required for the use of modλ(N). This would only be known to a trusted dealer. Thus, the requirement that y2 be built up to 2 was inventively changed, since this constitutes almost the largest group. It also forces the use of a unique random number v, which should be larger than c × x.

[0015] The method according to the invention is explained in more detail with reference to the figure. It shows: Fig. 1: Schematic application of a method according to the invention.

[0016] A third party calculates and announces the known y2 for the secret x i the party.

[0017] Then the correctness of the application of a part of the secret key x i proven:

[0018] Therefore, a party chooses a large random number v to calculate the commitments t1 and t2: {t1 = gvmodNt2 = 2vmodN where {y1 = gximodNy1 = 2ximodN

[0019] The challenge c = HASH(g, y1, y2, t1, t2: is calculated.

[0020] In addition, the answer r is calculated: r=v−(c×xi)

[0021] Then the correctness of the application of a part of the secret key x ireviewed by a party: c≡?HASH(g,y1,y2,t1,t2)

[0022] The party includes in its share the zero-knowledge proof (c, y1, r).

[0023] The third party receives a public key modulo N as well as a list of known y2 for parties P1 that hold the secret, via an existing public key infrastructure or by some other method, and the third party uses y2 of the parties to reconstruct commitments t1 and t2: {t1=gr×y1cmodNt2=2r×y2cmodN

[0024] Finally, the correctness of the application of the parties’ secret key can be verified with the verification function using the same hash function

[0025] HASH. can be detected: c≡?HSASH(g,y1,y2,t1,t2)

[0026] The method according to the invention works with a group N, which is a product of two prime numbers p and q; almost all known methods based on the "Fiat and Shamir" heuristic use only the simple group p, which is a prime number.

[0027] This is because it was necessary to give a different answer that was not odA(N) is used because the required modulo of a used group can only be known to the trusted dealer. Instead, the inventive method uses a new large random number v for each proof.

[0028] For example, the public key contains a text string called metadata. Each public key contains the signature for this string, which is formed from all n partially signed messages during the key generation phase. All of these partially generated messages are stored and can be stored, for example, on a blockchain or disclosed via a public key infrastructure, so that they can be used by the party that created this zero-knowledge proof to prove the correctness of y2.

Claims

[1] A method for determining the correctness of the application of a part of a party's secret key by modular exponentiation using a zero-knowledge proof in a communication system, comprising the following steps: (a) Each party applies a portion of the secret key x i by modular exponentiation to a message M as M xi modN and uses a cryptographically secure hash function HASH, which has a length of k' bits and chooses a large random number v ∈ R No. b , where b = 2 k'+logxi+1 where the value of M xi called generator g and is used to calculate the obligations t1 and t2: {t1=gvmodNt2=2vmodN (b) Each party calculates the challenge c = HASH(g, y1, y2, t1, t2), where y1 and y2 are defined for each party as follows: {y1=gximodNy2=2ximodN (c) Each party calculates the response r: r=v−(c×xi) (d) Each party includes in its part the zero-knowledge proof (c, y1, y2, r). (e) The correctness of the application of the parties’ secret key can be proven with the verification function using the same hash function HASH: c≡?HASH(g,y1,y2,t1,t2) (f) A third party receives a public key modulo N and a list of known y2 for parties P i that hold the secret, through an existing public key infrastructure or by some other method, and the third party uses y2 of the parties to reconstruct the commitments t1 and t2: {t1=gr×y1cmodNt2=2r×y2cmodN.

Images