Method for generating two large prime numbers by additive division without a trusted trader in a communication system with a number of participants.

Abstract

A method for generating two large prime numbers by additive division without a trusted trader in a communication system with a number n participants, comprising the following steps: a. For each attempt, party P chooses i random numbers p i and q i : (pi, qi) = {(r × ϱ) − 1, ifi ≡ 1 r × ϱ, ifi ≡ 1 b. ϱ is the product of the first T prime numbers, where T is defined as: T = max { t ∈ ℕ , ρ ∈ ℙ | log 2 ( ∏ i = 1 t ρ ) ≤ k × γ} c. For each trial, each party chooses a new random rational number Y between 0 and 1 and selects r ∈ R [ 2 k − 1 − log 2 ϱ ,2 k − log 2 ϱ − 1 ] . d. To obtain a value N, all parties use an n-out-of-n additive secret-sharing scheme to determine p. i and q i as p i ,x = p i (x) and qi,x = q i (x) to share jointly, which allows them to calculate N without disclosing p or q: N = ∑ i = 1 n ( ∑ i = 1 npj , i × ∑ i = 1 nqj , i ) e. Each party performs a biprimality test to confirm that N is the product of two prime numbers, repeating the steps from step (a) in the event of a negative test result.

Description

[0001] The invention relates to a method for generating the two large prime numbers by additive division without a trusted dealer in a communication system with several participants.

[0002] The parties can be any participant in a communications network, such as computers, apps, servers, etc.

[0003] Such methods are known from the state of the art. One method for generating a prime number, called "naive," is that each party P i selects a random number p i ∈ [2 k-1 , 2 k - 1] so that: pi={pi≡3(mod 4),ifα≡i(mod n)pi≡0(mod 4),ifα≢i(mod n)

[0004] Another method is the "composite" method. This method for generating secrets for a threshold cryptosystem was proposed by Boneh and Franklin as a way to improve the key generation phase (Dan Boneh and M. Franklin. Efficient generation of shared RSA keys. Journal of the ACM, 48 (4):702{722, July 2001. doi: 10.1145 / 502090.502094.).

[0005] It is assumed that each party P i M=∏ϱ∈ℙ\2ϱ calculated so that M ≤ 2 k The parties then choose a i ∈ R [3, M], a i ⊥ M and b i and receive: a = a1×a2×…anmod M b =b1+b2+⋯+bnmod M

[0006] The most interesting question is how to describe the multiplicative division of a over a1, ..., a n into an additive division over b1, ..., b n transforms without revealing a.

[0007] Another method is the so-called "Dubner's Sophie Germain primes" method. This approach is based on polynomials introduced by "Dubner" (Harvey Dubner, Large Sophie Germain primes. Mathematics of Computation, 65(213):393-396, January 1996. doi: 10.1090 / s0025-5718-96-00670-9). Each party P i selects a random number p i ∈ [2 k-1 , 2 k - 1] where p i is defined as: pi={(r×3003)−1,ifi≡1r×3003,ifi≢1

[0008] Patent US6330332B1 describes a method for generating prime numbers that increases the security of key generation through the use of proven primality tests, such as the Pocklington test. In comparison, the present application aims to optimize the generation of large prime numbers in a distributed environment without the need for a trusted broker.

[0009] Patent DE60001215T2 discloses a distributed cryptographic method for secure key generation in a communications network. The present application extends this approach by proposing a method for generating large prime numbers that also works in a distributed network, but without the need for a central trusted dealer. Patent DE69938624T2 deals with threshold cryptography, in which a secret key is distributed among multiple parties, requiring only a certain number of parties to reconstruct the key. The present application uses a similar concept of distributed computation but applies it specifically to the generation of prime numbers, enabling secure and efficient key generation.The main difference is that the application targets the specific generation of prime numbers, while DE69938624T2 describes a more general cryptographic method.

[0010] Patent DE69938624T2 deals with threshold cryptography, in which a secret key is distributed among multiple parties, with only a certain number of parties required to reconstruct the key. The present application uses a similar concept of distributed computation, but applies it specifically to the generation of prime numbers, enabling secure and efficient key generation. The main difference is that the application focuses on the specific generation of prime numbers, while DE69938624T2 describes a more general cryptographic method.

[0011] The methods known from the state of the art are not suitable for generating two large prime numbers in an acceptable time with generally available, common computing power.

[0012] The aim of the invention is to generate two large prime numbers in a cryptosystem by reducing the required computing power so that the generation time is acceptable (< 1 minute).

[0013] A cryptosystem requires a way to generate distributed prime numbers p and q without revealing them. To achieve this, the inventive method uses the additive distribution of each prime number. Each party selects a random number, which is distributed over the integers using a secret partition scheme, which is a variant of the Shamir partition scheme. Each party P i selects two numbers from p i and q i and creates two polynomials p i (x) and q i (x) . Then each party receives P jfrom any other party P i the values ​​of p i (j) and q i (j) over a secure channel. The only reason for using a secure channel here is to avoid the need to generate the values ​​p and q. Each party should only send the i -th element to party P. i This allows party P i the value N i which is then sent. Using the BGW protocol, the n parties can obtain the value N = pq without disclosing p and q: N=pq=∑i=1N(∑j=1npj(i)×∑j=1nqj(i))

[0014] This method makes it possible to avoid a trusted dealer, but it cannot be used with a standard sieving technique. Furthermore, a way had to be found to generate distributed primes that are secure primes. These are referred to as T-primes in the context of the invention. They are the key element of the invention.

[0015] They are based on the assumption that there are many large secure prime numbers of the form p=(r×ϱ)−1 where ϱ is the product of the first T -primes and r is an even random number. Using this method, one can calculate p ∈ [2 k-1 ,2 k - 1] if r∈R[2k−1−log2ϱ,2k−log2ϱ−1] is.

[0016] This assumption naturally supports additive division and allows us to define the prime number as p=∑i=1npi. Each P i defines a prime number p i : pi={(r×ϱ)−1,ifi≡1r×ϱ,ifi≢1

[0017] The subject of the invention is the question of how to determine the best T. The inventive method uses a dynamic value that depends on k over Υ: T=max{t∈ℕ,ρ∈ℙ|log2(∏i=1tρ)≤k×Y}

[0018] During the key generation phase, the parties may need to perform several iterations, called trials, to generate a value N that passes the biprimality test, which confirms that it is the product of two unknown prime numbers. A simple way to satisfy this condition and increase the entropy of this phase is the following condition α ≡ i(mod n) for the i-th party, where α is the number of trials.

[0019] Boneh and Franklin (Dan Boneh and M. Franklin. Efficient generation of shared RSA keys. Journal of the ACM, 48 (4):702{722, July 2001. doi: 10.1145 / 502090.502094.) showed how the parties can use the Miller-Rabin primality test to verify that the value N is the product of two prime numbers p and q, without revealing them.

[0020] It is assumed that a party δ ∈ R No. * Nsuch that δ is relatively prime to N and the Jacobi symbol δN=1 Then they calculate Q i as: Qi={δ(N+1−pi−qi) / 4,ifα≡i(mod n)δ(−pi−qi) / 4,ifα≢i(mod n)

[0021] This allows the party to perform the biprimality test: ∏i=1nQi≡? ±1(mod N)

[0022] It is therefore clear that this test is based on the assumption that p ≡ q ≡ 3(mod 4). This is also naturally supported by the method according to the invention.

[0023] Since it is a Miller-Rabin primality test, the inventive method uses its property that if the biprimality test holds, then the value N is the product of two strong primes to base δ with a probability of at most 1 / 4. If the biprimality test is performed l times each time with a new δ and the value N still passes the test, then the value N is the product of two strong primes with a probability of 4 -l . Relaxing the condition for safe prime numbers

[0024] The classical RSA modulus is N = pq, where p and q are secure primes. This means that p = 2p' + 1 and q = 2q' + 1, where p' and q' are also primes and gcd(N, ϕ (N)) = 1. The Paillier cryptosystem has adopted this requirement, but following "Rivest and Silverman" (Ronald L. Rivest and Robert Silverman. Are "strong" primes required for RSA? In 1997 RSA Laboratories Seminar Series. Citeseer, 1999.), "Damgard and Koprowski" [Ivan Damgard and Maciej Koprowski. Practical threshold RSA signatures without a trusted dealer. In International Conference on the Theory and Applications of Cryptographic Techniques, pages 152-165. Springer, 2001) and “Nishide and Sakurai” (Takashi Nishide and Kouichi Sakurai. Distributed Paillier cryptosystem without trusted dealer. In International Workshop on Information Security Applications, pages 44-60. Springer, 2010. doi: 10.1007 / 978-3-642-17955-6 4), a prime number p can be used that satisfies the condition that (p - 1) / 2 is not divisible by a prime number less than or equal to n. Therefore, the prime number p does not necessarily have to be a sure prime number.

[0025] Each party P i chooses R a,i ∈ R [0, Kx] and R b,p',i , R b,q',i ∈ R [0, K 2 x 2 ], where m=∏ρ∈ℙnρ,x=n×(3×2k / 2−1) / m,m≤2k / 4−1 and K = 2 k / 2-1 . p' i and q' i can then be calculated as follows: p′ i={(pi−1)×Ra,i+mRb,p′,iifα≡i(mod n)(pi)×Ra,,i+mRb,p′,iifα≢i(mod n) q′ i={(qi−1)×Ra,i+mRb,q′,iifα≡i(mod n)(qi)×Ra,i+mRb,q′,iifα≢i(mod n)

[0026] As soon as yp,∑i=1np′ i and yq,=∑i=1nq′ i obtained, it is easy to prove that γ p' and γ q'are not divisible by any prime number smaller than n: gcd(yp,,m) ≡?1 gcd(yq,,m) ≡?1

[0027] It is clear that (p - 1) / 2 and (q - 1) / 2 are not divisible by a prime number less than n. As shown, this can be done without revealing p and q if p′>(2×n2×(3×2k−1))2

[0028] However, a good value N can be discarded.

[0029] If so, this leads to: m|∑i=1nRa,i

[0030] The method according to the invention and its impact on the computing time for generating the two large prime numbers are explained in more detail using the figures. These show: Fig. : Performance for generating T-primes using a method according to the invention Fig. : Benchmark of the impact of reusing p and q

[0031] Within the scope of this invention, a benchmark was carried out on the methods known from the state of the art for generating two large prime numbers.

[0032] This section supports the decision to use the random value Y ∈ R Use [0.2,0.4] for the constant Y to define the T in the T-prime number.

[0033] For benchmarking, the true (hardware) random number generator SwiftRNG Pro was used in each benchmark test. Each participant P i creates a prime number p i which are used to calculate p=∑1npi is used.

[0034] Several attempts were made until a p was obtained that is a probably prime number and also satisfies the condition that (p - 1) / 2 is not divisible by a prime number less than or equal to n. The Miller-Rabin and Lucas-Lehmer primality tests were used to determine whether p is probably prime. In the tests, each technique was used to generate 123 prime numbers that satisfy the requirements for each n ∈ {1, 2, 3, 4, 7, 11, 18, 29, 47, 76, 123} and k ∈ {1024, 2048, 4096, 8192}. The results for Υ ∈ [0.00, 0.99] with step 0.01 and for Υ ∈ R [0.2,0.4] are in the Fig. 1a-1d. It was assumed that Υ ∈ R [0.2,0.4] can be used as the optimal value, as it does not reduce the entropy of the prime numbers. Furthermore, it reduces the number of trials to an acceptable level.

[0035] The same benchmarks were run for the three other methods described above (Naive, Composite and Dubners) and T -primes with Υ ∈ R [0.2,0.4] were performed. However, tests for values ​​of k greater than 2048 bits were not performed, as the test results with smaller k were already unacceptable. The results are presented in Table 1 below. It is clear that the inventive method requires significantly fewer attempts to obtain a good prime number. Table 1: Number of attempts by T-primes (T ∈R [0.2, 0.4]) and other methods, plus Tukey's whiskers k T-primes Dubner's Composite Naive 1024 2048 4096 8192 1024 2048 4096 1024 2048 1024 2048 Upper whisker 225 433 781 1409 750 1424 2733 3820 11633 3827 7665 3rd quartile 104 198 354 652 339 649 1251 1597 5072 1691 3374 Median 51 98 172 337 155 324 624 407 1997 740 1375 1st quartile 23 41 69 147 65 132 263 115 698 267 513 Lower whisker 1 1 1 1 1 1 1 2 9 1 1 Mean 75 139 247 468 249 487 949 1422 3809 1277 2509 Skewness 2.45 1.78 1.77 2.11 2.15 2.35 2.19 3.39 2.53 3.18 2.69 Kurtosis 12.91 3.90 4.06 6.70 6.31 8.17 6.86 15.87 8.76 16.94 10.67 Benchmarking the impacts of reuse p and q

[0036] This section supports the decision not to reuse p or q when both components of N = pq are prime, but only one of them has satisfied the safe prime condition described above.

[0037] The same technique and environment were used for benchmarking, using for each benchmark test a pseudorandom number generator based on the Yarrow and Fortuna algorithms with the BLAKE3 hash function used above to generate 123 different values ​​of N, each of which meets all requirements. Fig. 2 shows a summary statistic of the number of trials for Υ ∈ R [0.2,0.4]. Different values ​​of k ∈ {1024, 2048, 4096, 8192} and n ∈ [1, 123] were used, where p or q may have been reused in subsequent trials to obtain N. It is clear that reusing p or q has no significant effect on the number of trials required to obtain N. Furthermore, the number of trials does not depend on n or the pseudorandom number generator used. Benchmarking key generation with different n

[0038] This section describes the results of a series of benchmarks—using the same pseudorandom number generator as before—performed with an implementation of the described cryptosystem.

[0039] For benchmarking, 13 random keys were generated with t = 1, n ∈ {1, 2, 3, 4, 7, 11, 18, 29, 47, 76, 123}, and k ∈ {1024, 2048}. For each benchmark, the application created n independent parties. Each generated key was also used to generate n digital signatures from n parts, which were then verified n times. Zero-knowledge proof was also applied to each of these tests.

[0040] All benchmarks were performed on standard, currently and commonly available hardware. An example of such hardware is the Apple Mac Mini with an M1 CPU and 8 GB of RAM. For our cryptosystem, the dynamic binary translator Rosetta was used to run the OpenJDK 64-bit server VM (version 16-ea+24). No network communication was used, forcing the cryptosystem to perform all computations in a single thread. A redundant environment was used to degrade the performance of the inventive implementation, which makes the results even more significant.

[0041] The results are presented in Table 2 below. It is clear that the inventive method can be used on currently available hardware with an acceptable level of security, which is sufficient for the foreseeable future (i.e., until the availability of quantum computers). Table 2: Average times in seconds to generate a random key pair. Confidence interval 99.9% k n RUN TIME CI k n RUN TIME CI 1024 1 0.6 0.48 1024 1 0.56 0.47 1024 2 0.45 0.41 1024 2 0.56 0.62 1024 3 1.45 1.44 1024 3 0.65 0.4 1024 4 2.33 1.41 1024 4 0.55 0.51 1024 7 3.58 2.64 1024 7 0.95 0.55 1024 11 6.86 6.51 1024 11 1.8 0.84 1024 18 11.41 10.08 1024 18 3.86 1.55 1024 29 16.75 13.29 1024 29 9.5 4.15 1024 47 30.35 22.99 1024 47 24.16 9.89 1024 76 89.89 83.6 1024 76 61.24 16.85 1024 123 188.23 85.95 1024 123 142.75 22.37 2048 1 6.35 7.17 2048 1 10.04 8.86 2048 2 6.62 6.33 2048 2 5.74 6.16 2048 3 19.37 22.84 2048 3 3.95 2.54 2048 4 20.92 21.62 2048 4 4.78 4.81 2048 7 50.23 53.75 2048 7 13.08 13.93 2048 11 61.06 58.35 2048 11 18.31 14.73 2048 18 128.01 104.38 2048 18 30.97 16.85 2048 29 215.12 232.7 2048 29 52.48 38.6 2048 47 270.78 254.34 2048 47 161.83 77.63 2048 76 602.28 585.96 2048 76 286.1 31.72 2048 123 2,135.56 1,609.16 2048 123 741.35 287.99 (a) Single thread (b) Eight threads

[0042] The workflow of key generation using secure large prime numbers is now explained in more detail:

[0043] The key is generated through an iterative process that may require one or more attempts to obtain a key N that can pass the biprimality test:

[0044] All n=∑h=0lnl−parties, which generate new key pairs, with k as the modulus length in bits, with threshold parameters t=∑h=0ltl (t=max(tl),∀tl) and conjunctive (disjunctive) ranks 0, ..., l should agree on two odd prime numbers P' and P'', called bootstrap and secret moduli. These should satisfy at least the following requirements: P′ >(2×n2×(3×2k−1))2

[0045] Each party chooses a unique i ∈ [1, n], and defines t' = max(0, n - 1), t'' = max(0, n / 2 - 1) and t''' = max(0, n / 3 - 1). m is the product of all prime numbers less than or equal to n. Later, it is used that M l = Π p∈ℙ\2 ρ, where ρ > M l-1 , M0 = 3 and M l ≤ 2 k / 2-1 , and ϱ, which is the product of the first few T -primes, where T is defined by equation [eq:T] with Υ ∈ R [0.2,0.4]. Each party also defines Δ = n! and λ i : λi=Δ×∏i,∈S∖{i}−i′∏i,∈S∖{i}i−i′

[0046] Where S ∈ [1, n].

[0047] For each trial α, each party calculates P i p i and q i : pi,qi={(r×ϱ)−1,ifα≡i(mod n)r×ϱ,ifα≢i(mod n) where r∈R[2k / 2−1−log2ϱ,2k / 2−log2ϱ−1] is even. In addition, the party calculates p' i and q' i : p′ i,q′ i={(pi−1,qi−1),ifα≡i(mod n)(pi,qi),ifα≢i(mod n)

[0048] The output value of Party K = 2 k / 2-1 , R a ∈ R [0, Kx] and Rb∈Rℤ∗k2x2, women x=n×(3×2k−1) / m,m=∏ρ∈ℙnρ,m≤2k / 4−1, and Sufficiently efficient a, a', b, b', c, d, e ∈ R ℤ P' . Ten Greens in the Polynomial for ∀j,l ∈ [1,n] are: pi(x) =pi+a1x+a2x2+⋯+at″xt″(mod P′) qi(x) =qi+b1x+b2x2+⋯+bt″xt″(mod P′) p′ i(x) =p′ i+a′ 1x+a′ 2x2+⋯+a′ t″xt″(mod P′) q′ i(x) =q′ i+b′ 1x+b′ 2x2+⋯+b′ t″xt″(mod P′) hi(x) =0+c1x+c2x2+⋯+ct,xt,(mod P′) Ra,i,l(x) =Ra,i,l+di,p,,l,1x+ei,p,,l,2x2+⋯+ei,p,,l,t″xt″(mode P′) mRb,p,,i(x) mRb,p,,i+ei,p,,1x+ei,p,,2x2+⋯+ei,p,,t,xt′(mode P′) mRb,p,,i(x) mRb,p,,i+ei,q,,1x+ei,q,,2x2+⋯+ei,q,,t,xt′(mode P′)

[0049] Each party now calculates the tuples for ∀j, l ∈ [1,n]: (pi,j=pi(j),qi,j =qi(j),hi,j=hi(j)) (p′i,j,l=p′i(j),q′i,j,l=q′i(j),Ra,i,l,j=Ra,i,l(j),) (mRb,p′,i,j=mRb,p′,i(j),mRb,q′,i,j=mRb,q′,i(j))

[0050] Via a secure channel, each party receives P i from any other party P j Tuple (i, j) for this experiment. This allows you to calculate N i and γ i,p',l and γ i,q'l , ∀l ∈ [1,n]: Ni=(∑j=1npj,i×∑j=1nqj,i×∑j=1nhj,i)×λi(mod P′) γi,p′,l=(∑j=1np′j,i,l×∑j=1nRa,j,l,i+∑j=1nmRb,p′,j,i)×λi(mod P′) γi,p′,l=(∑j=1np′j,i,l×∑j=1nRa,j,l,i+∑j=1nmRb,p′,j,i)×λi(mod P′)

[0051] This N i , γ i,p',l and γ i,p',l , ∀l ∈ [1, n] are passed on to all parties so that they N and γ p',l and γ p',l , ∀l ∈ [1, n]_ can be calculated: N=(∑i=1nNi)÷Δ(mod P′) γp′,l=(∑i=1nγi,p′,l)÷Δ(mod P′) γq′,l=(∑i=1nγi,q′,l)÷Δ(mod P′)

[0052] Each party shall ensure that N is not determined by a factor of any M l and that there exists at least value l for which γ p',l and γ p',l are not divisible by a factor of m: gcd(N,Ml)≡?1 ,∀l∈[0,(k)] gcd(γp′,l,m)≡?gcd(γq′,l,m)≡?1 ,∃l∈[1,n]

[0053] If one of the three tests of dualism fails, the parties must make a new attempt.

[0054] Now each party checks P i , whether N is a product of exactly two prime numbers. The party chooses δ ∈ R No. * N and δ ⊥ N such that the Jacobi symbol δN=1 on the definition of Q i : Qi={δ(N+1−pi−qi) / 4,ifα≡i(mod n)δ(−pi−qi) / 4,ifα≡i(mod n)

[0055] This allows the party to perform the biprimality test: ∏i=1nQi≡?±1(mod N) If the biprimality test fails, the parties must make a new attempt.

[0056] If N passes the biprimality test, the value is used to create the secret and public keys.

Claims

[1] Method for generating two large prime numbers by additive division without a trusted dealer in a communication system with a number of participants n comprising the following steps: a. For each attempt, party P chooses i random numbers p i and q i : (pi,qi)={(r×ϱ)−1,ifi≡1r×ϱ,ifi≡1 b. ϱ is the product of the first T prime numbers, where T is defined as: T=max{t∈ℕ,ρ∈ℙ|log2(∏i=1tρ)≤k×γ} c. For each trial, each party chooses a new random rational number Y between 0 and 1 and chooses r∈R[2k−1−log2ϱ,2k−log2ϱ−1]. d. To obtain a value N, all parties use an n-out-of-n additive secret sharing scheme to obtain p i and q i as p i ,x = p i (x) and q i,x = q i(x) jointly, which allows them to calculate N without revealing p or q: N=∑i=1n(∑i=1npj,i×∑i=1nqj,i) e. Each party shall perform a biprimality test to confirm that N is the product of two prime numbers, repeating the steps from step (a) in case of a negative test result. [2] The method of claim 1, wherein the biprimality test is performed as follows: a. a party chooses δ ∈ R No.* N such that δ is relatively prime to N, and the Jacobi symbol δN=1, then the parties calculate the value Q i as: Qi={δ(N+1−pi−qi) / 4,if α≡i(mod n)δ(−pi−qi) / 4,if α≡i(mod n) b. This allows the party to conduct the biprimality test with: ∏i=1nQi≡?±1(mod N).

Images