Methods and devices for authenticating data

Abstract

The present invention relates to methods and devices (MST, ISR, USR, VRF) for authenticating data. In particular, it relates to a method used by a user device (USR) to authenticate a subset (MSG) of a dataset with a verifier device (VRF), wherein: - the user device (USR) has a secret key that allows all or part of the dataset to be authenticated, the secret key comprising at least one certificate (CERT) provided by a sender device (ISR) that certifies the authenticity of the dataset; and - the method comprises generating an authentication token (TOKo) for the subset of data (MSG), this authentication token (TOKo) being obtained from public parameters defined by a master device (MST) and from the secret key of the user device (USR).

Description

Methods and devices for authenticating data

[0001] The present invention relates to the general field of authentication. More particularly, the present invention relates to methods and devices for authenticating data. The present invention finds a particularly advantageous, although in no way limiting, application for the implementation of authentication systems in the field of digital identity.

[0002] Generally speaking, it is known to use electronic signature mechanisms to authenticate data exchanged between communication devices. Electronic signatures use cryptographic schemes to prove and verify the authenticity of data. To do this, an issuer (e.g., a trusted authority) provides a user with a certificate allowing them to prove the validity of their data to a verifier.

[0003] However, standard electronic signature mechanisms require revealing all of the certified data, even to prove the authenticity of only part of it, and allow users to be tracked. Take the example of a transport card: to prove the validity of the card to a verifier (e.g. an access gate), the user must provide all the certified information, including their first and last name, which allows their movements to be tracked.

[0004] To overcome these drawbacks, so-called anonymous electronic signature mechanisms have been developed. These mechanisms are called anonymous in that they allow the user to control the information revealed during authentication. They are now the subject of several standards (e.g. ISO 18370 and ISO 20008) and are deployed on a large scale, particularly in electronic chips, such as TPM (Trusted Platform Modules) type chips, or certain processors.

[0005] It is important to note, however, that anonymous signature mechanisms focus on user anonymity, not issuer anonymity. However, the identity of the issuer can reveal a lot of information about the user. For example, a certificate issued by a municipality will reveal that the user resides in that municipality. More specifically, a certificate indicates the issuer's public key. To reduce security concerns in the event of a malicious attack, an issuer typically uses multiple public keys. The user is therefore not anonymous among all users associated with that issuer, but only among a select set of users associated with the same public key.

[0006] In light of these issues, several electronic signature mechanisms have recently been proposed to allow users to authenticate data without having to reveal the identity of the issuer. We can notably mention the solution proposed in the document: Bobolz et al., “Issuer-Hiding Attribute-Based Credentials,” Cryptology and Network Security, 2021. The advantages of this solution are nevertheless offset by several disadvantages. Indeed, this solution is complex to implement. It requires a large number of calculations to generate an authentication token, and the size of the tokens is particularly large. In addition, this solution has no system supervision mechanism. An issuer's anonymity cannot be lifted, even if this is necessary for security reasons.

[0007] Ultimately, existing solutions that allow a user to authenticate data with a verifier are not fully satisfactory. There is a need for an authentication solution that preserves both the anonymity of users and that of issuers, and that does not have the disadvantages of existing solutions.

[0008] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above.

[0009] For this purpose, and according to one aspect of the invention, a method is proposed implemented by a user device to authenticate a subset of a data set with a verifier device, the user device having: a secret key making it possible to authenticate all or part of the data set, this key comprising at least: an element H calculated from elements belonging to public parameters defined by a master device, and the data set; and a certificate provided by an issuing device and certifying the authenticity of the data set, the certificate comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key of the issuing device;andthe method comprising: providing an authentication token for the subset of data, this token comprising at least: a set of authentication elements calculated from the public parameters, the secret key of the user device, and random values ​​r and k; a signature Z calculated from random values ​​r and k, a signature S; u , and a signature S* on a part of a public key of the master device for a label t specific to the issuing device, the signature S* belonging to a public key of the issuing device; and a proof of knowledge π associated with the authentication elements, the signature Z, and an element H' calculated from the elements belonging to the public parameters and the subset of data.

[0010] It is proposed here to use an authentication system comprising four types of devices. The master device defines the public parameters, and authorizes the issuing devices to certify data. Once authorized by the master device, an issuing device can certify a set of data of a user device. The user device can then provide an authentication token to prove the authenticity (i.e. the validity) of all or part of the set of data. This authentication token is verified by a verifier device.

[0011] The proposed solution allows the user to prove the validity of all or part of their data to a verifier. It does not require the user to provide the verifier with all of the certified data to prove the validity of only part of it. In this sense, the proposed solution allows the user to preserve anonymity.

[0012] In addition, the proposed solution allows for the anonymity of the issuer that certifies the user's data. The user can authenticate their data to the verifier without having to reveal the issuer's identity. The verifier is able to verify the validity of the data without using the issuer's public key. To do this, it uses the public parameters defined by the master device, the data, and the elements included in the authentication token.

[0013] Compared to the aforementioned solution by Boboz et al., the proposed solution has the following advantages. First, it requires significantly less computation. The proposed solution also allows for shorter authentication tokens, and thus reduces the amount of data exchanged between the user and the verifier. It thus reduces the time required to perform authentication, which is essential for users.

[0014] Second, the proposed solution allows the issuer's anonymity to be lifted if necessary. For security reasons, for example at the request of the authorities, it is possible for the master device to identify the issuer associated with an authentication token.

[0015] Thus, the proposed authentication solution allows for the preservation of both the anonymity of users and that of senders. It also presents minimal implementation complexity and allows the anonymity of a sender to be lifted if necessary.

[0016] According to one embodiment, the set of authentication elements of the token comprises the elements: C1=g1 k ; C2= g1 r ⋅ pk e k ; P'1= (g1 x ) r ; P'2= (g2 x ) r ; D1=A v ; and D2= H r ⋅ v ⋅ D1 -r ⋅ y , where g1 and g2 belong to the public parameters, g1 x and g2 x belong to the public key of the sending device, v is a random number, and pk e belongs to the public key of the master device.

[0017] Furthermore, according to this embodiment, the signature S u is a signature on {g1, g1 x} and the signature S* is a signature on {pk e , 1} for label t, these signatures belonging to the public key of the sending device.

[0018] According to one embodiment, the set of authentication elements of the token comprises the elements: C1=g1 k ; C2= A r ⋅ pk e k ; and P'1=(A x ) r , where g1 belongs to the public parameters, A x is included in the certificate provided by the issuing device, and pk e belongs to the public key of the master device.

[0019] Furthermore, according to this embodiment, the signature S u is a signature on {A, A x} for label t and is included in the certificate provided by the issuing device, and the signature S* is a signature on {pk e , 1} for label t.

[0020] Here we present the advantages of the two embodiments described above, one over the other. On the one hand, the first embodiment is advantageous in that it allows the user device to obtain a certificate from an issuing device by implementing a low-complexity method. On the other hand, the second embodiment makes it possible to obtain authentication tokens of reduced size, and helps to reduce the amount of data exchanged between a user and a verifier.

[0021] According to one aspect of the invention, a method is proposed implemented by a verifier device for verifying the authenticity of a subset of a data set of a user device, the method comprising: a verification of an authentication token of the data subset, this token comprising at least: a set of authentication elements calculated from public parameters defined by a master device, a secret key of the user device, and random values ​​r and k; a signature Z calculated from random values ​​r and k, a signature S u, and a signature S* on a part of a public key of the master device for a label t specific to the issuing device, the signature S* belonging to a public key of the issuing device; anda proof of knowledge π associated with the authentication elements, the signature Z, and an element H' calculated from elements belonging to the public parameters, and the subset of data; andin which:the verification of the token comprises at least: a verification of the validity of the proof of knowledge π using the set of authentication elements, the signature Z, and the element H'.

[0022] According to one aspect of the invention, a method is proposed implemented by a transmitter device for certifying a data set of a user device, the transmitter device having: a public-private key pair comprising at least: for the private key: a scalar x; and for the public key: a label t specific to the transmitter device; and a signature S* provided by a master device, S* being a signature on a part of a public key of the master device for the label t; and the method comprising: a supply to the user device of a certificate certifying the authenticity of the data set, this certificate comprising at least: a random number y; and an element A calculated from an element H, the scalar x, and the random number y, the element H being calculated from elements belonging to public parameters defined by the master device and the data set.

[0023] According to one aspect of the invention, there is provided a method implemented by a master device to authorize a transmitter device to certify a set of data of at least one user device, the master device defining public parameters, and the method comprising: providing the transmitter device with elements of a public key of the transmitter device, these elements comprising at least: a label t specific to the transmitter device; and a signature S* on a part of a public key of the master device for the label t and obtained using a private key of the master device.

[0024] According to one embodiment, the method comprises an identification of an issuing device associated with an authentication token of a user device, the identification comprising: a decryption of encrypted authentication elements included in the token to obtain an element B r, where r is a random number used to generate the token, this decryption being carried out using a part of the private key of the master device; anda check to determine whether the issuing device is associated with the authentication token using: element B r obtained; a g2 element x included in the public key of the sending device, x a scalar belonging to a private key of the sending device; an element P'1 included in the authentication token; and an element g2 belonging to the public parameters.

[0025] This embodiment allows the anonymity of the issuer to be lifted. More specifically, this embodiment allows the master device to identify the issuer device involved in an authentication token provided by a user device.

[0026] According to one embodiment, a bilinear environment is used, said environment designating a group G1, a group G2 and a group GT of order p, and a bilinear coupling, and a said signature σ on a set of elements {u0, …, u n} of G1 for a label τ is obtained using the expression: σ = (u0 b 0 ⋅ … ⋅ u n bn ) 1 / ( a+τ ) , where the scalars {a, b0, …, b n} belong to a private key.

[0027] This embodiment proposes to use a linearly homomorphic signature mechanism. More particularly, the signature mechanism proposed here advantageously makes it possible to obtain authentication tokens of reduced size, in comparison with existing signature mechanisms. This embodiment thus contributes to reducing the quantity of data exchanged between the user and the verifier, as well as the time required to perform authentication.

[0028] According to one aspect of the invention, a device, called a user device, is provided, configured to authenticate a subset of a data set with a verifier device, the user device comprising: a secret key for authenticating all or part of the data set, this key comprising at least: an element H calculated from elements belonging to public parameters defined by a master device, and the data set; and a certificate provided by an issuing device and certifying the authenticity of the data set, the certificate comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key of the issuing device;anda module for providing an authentication token for the data subset, this token comprising at least: a set of authentication elements calculated from the public parameters, the secret key of the user device, and random values ​​r and k; a signature Z calculated from random values ​​r and k, a signature S; u , and a signature S* on a part of a public key of the master device for a label t specific to the issuing device, the signature S* belonging to a public key of the issuing device; and a proof of knowledge π associated with the authentication elements, the signature Z, and an element H' calculated from the elements belonging to the public parameters and the subset of data.

[0029] According to one aspect of the invention, a device is proposed, called a verifier, configured to verify the authenticity of a subset of a set of data of a user device, the verifier device comprising: a module for verifying an authentication token of the subset of data, this token comprising at least: a set of authentication elements calculated from public parameters defined by a master device, a secret key of the user device, and random values ​​r and k; a signature Z calculated from random values ​​r and k, a signature S u, and a signature S* on a part of a public key of the master device for a label t specific to the issuing device, the signature S* belonging to a public key of the issuing device; anda proof of knowledge π associated with the authentication elements, the signature Z, and an element H' calculated from elements belonging to the public parameters, and the subset of data;and in which:the verification module is configured at least to: verify the validity of the proof of knowledge π using the set of authentication elements, the signature Z, and the element H'.

[0030] According to one aspect of the invention, a device, called an issuer, is proposed, configured to certify a set of data of a user device, the issuer device comprising:a public-private key pair comprising at least:for the private key: a scalar x; andfor the public key: a label t specific to the issuer device; and a signature S* provided by a master device, S* being a signature on a part of a public key of the master device for the label t; anda module for providing the user device with a certificate certifying the authenticity of the set of data, this certificate comprising at least: a random number y; andan element A calculated from an element H, the scalar x, and the random number y, the element H being calculated from elements belonging to public parameters defined by the master device and the set of data.

[0031] According to one aspect of the invention, a device, called a master, is proposed, configured to authorize a transmitter device to certify a set of data of at least one user device, the master device being configured to define public parameters and comprising: a module for providing the transmitter device with elements of a public key of the transmitter device, these elements comprising at least: a label t specific to the transmitter device; and a signature S* on a part of a public key of the master device for the label t and obtained using a private key of the master device.

[0032] According to one aspect of the invention, there is provided a system comprising several devices among: a user device according to the invention; a verifier device according to the invention; a transmitter device according to the invention; and a master device according to the invention.

[0033] The proposed system may also include a plurality of transmitter devices, user devices, and / or verifier devices.

[0034] According to one aspect of the invention, there is provided a computer program (or a set of computer programs) comprising instructions for implementing the steps of a method according to the invention, when the computer program is executed by at least one processor or computer.

[0035] The computer program may consist of one or more subparts stored in the same memory or in separate memories. The program may use any programming language, and may be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0036] According to one aspect of the invention, there is provided a computer-readable information medium comprising a computer program according to the invention.

[0037] The information carrier may be any device capable of storing a program. For example, the carrier may comprise a storage means, such as a non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard disk. Furthermore, the storage medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by a telecommunications network or by a computer network or by other means. The program according to the invention may in particular be downloaded onto a computer network. Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0038] The methods, devices, system, computer program and information medium proposed have the advantages described above in connection with the method implemented by a user device to authenticate a subset of a data set.

[0039] Other features and advantages of the present invention will become apparent from the description provided below, illustrating embodiments of the invention given by way of example, with reference to the attached drawings:

[0040] Laet larepresent respectively a system and an authentication method according to an embodiment of the invention;

[0041] Larepresents a method implemented by a master device for defining public parameters according to an embodiment of the invention;

[0042] The method represents a method implemented by a master device and a transmitter device to authorize the transmitter device to certify data of a user device according to an embodiment of the invention;

[0043] Larepresents a method implemented by a transmitter device and a user device for certifying data of the user device according to an embodiment of the invention;

[0044] Larepresents a method implemented by a user device to authenticate data to a verifier device according to an embodiment of the invention;

[0045] Larepresents a method implemented by a verifier device to verify the authenticity of data of a user device according to an embodiment of the invention;

[0046] Larepresents a method implemented by a master device to identify an issuing device associated with an authentication token according to an embodiment of the invention; and

[0047] The represents an example of hardware architecture of a device according to an embodiment of the invention.

[0048] Laet larepresent respectively a system and an authentication method according to an embodiment of the invention.

[0049] The proposed solution aims to allow a user to authenticate data with a verifier, while preserving the anonymity of the user and that of the issuer certifying the authenticity (i.e. the validity) of this data.

[0050] For this purpose, a SYS system is proposed here, comprising devices of four types. The architecture of this system is illustrated by the, and its operation by the.

[0051] Among these four types of devices, the first one to mention is the master device MST. This device defines the public parameters of the system SYS (step M100), obtains a public-private key pair (step M200), and authorizes the transmitting devices ISR to certify data (steps M300 and I300).

[0052] Once authorized by the MST master device, an ISR issuer device can certify MSG data from a USR user device by providing it with a CERT certificate (steps I400 and U400). The USR user device can then use this CERT certificate to generate a TOK authentication token. U to prove the authenticity of the MSG data (step U500).

[0053] The TOK authentication token Uis then verified by a VRF verifier device using the public parameters (step V600). It should be emphasized that the user device USR proves the authenticity of the MSG data to the VRF verifier device without revealing the identity of the sender device ISR.

[0054] If necessary, for example for security reasons, the MST master device can identify the ISR issuing device associated with a TOK authentication token U (step M700). Note that only the master device MST is capable of lifting the anonymity of the ISR transmitter device.

[0055] Of course, the above-described functions of the various MST, ISR, USR, and VRF devices are not mutually exclusive. For example, an ISR transmitter device may also perform the function of a VRF verifier device. Similarly, only four devices are shown in the, but the SYS system may include a plurality of ISR transmitter devices, USR user devices, and VRF verifier devices.

[0056] We use: reference signs starting with M to designate the steps performed by the master device MST; reference signs starting with I for the transmitter device ISR; reference signs starting with U for the user device USR; and reference signs starting with V for the verifier device VRF.

[0057] Below, we describe in particular two embodiments of the proposed solution. We refer to these as the first embodiment and the second embodiment. These two embodiments have many steps in common. Therefore, we explicitly mention when a step is performed only in one embodiment. Such a step is shown in dotted lines in the figures, with an index specifying the corresponding embodiment.

[0058] However, before describing in more detail the different stages of the authentication process, we present the signature mechanism used by the SYS system.

[0059] The linearly homomorphic signature mechanism used by the SYS authentication system is defined by the four algorithms described below.

[0060] The signature mechanism proposed here allows minimizing the size of authentication tokens, and therefore the amount of data exchanged between a user and a verifier. However, the proposed solution is not limited to the mechanism presented below; other signature mechanisms can be used.

[0061] In particular, the proposed signature mechanism uses a bilinear environment. This bilinear environment denotes a set of three groups G1, G2 and GT of order p, and a bilinear coupling e: G1 x G2 → GT. The roles of G1 and G2 are interchangeable.

[0062] Below we describe the proposed solution using notations that correspond to the so-called BBS+ standard: Looker et al., “The BBS Signature Scheme”, Internet Engineering Task Force, March 2023. These notations are used because the proposed solution is notably compatible with this standard.

[0063] The Keygen algorithm returns a public key pk and a private key sk. Specifically, an element g1 from G1 and an element g2 from G2 are selected. Also selected are the integers {a, b0, …, b n} whose values ​​are between 0 and p-1. The public key pk is defined by the elements {g1, g2} and {g2 a , g2 b 0 , …, g2 b n}, while the private key sk is defined by the integers {a, b0, …, b n}.

[0064] The algorithm Sign allows to obtain a signature σ on a data set M for a label t. This algorithm takes as input: the private key sk; the data set M = {m0,…,m n} (i.e. a vector of n+1 elements of G1); and the label t. According to the implementation proposed here, the signature σ is obtained using the expression: σ = (m0 b 0 ⋅ … ⋅ m n b n ) 1 / ( a+t ) .

[0065] The Eval algorithm is used to generate a signature for all linear combinations of multiple datasets. It takes as input signatures {σ0, …, σ k} relating respectively to the data sets {M0, …, M k} for the same label t, as well as coefficients {w0, …, w k}. It outputs a signature S on M0 W 0 ⋅ … ⋅ M k W k for the label t. This signature S is calculated as follows: S=σ0 w 0 ⋅ … ⋅ σ k w k .

[0066] The Verify algorithm allows to verify the validity of a signature σ on a data set M for a label t. According to the implementation proposed here, the algorithm checks if the following equation is satisfied: e(σ, g2 a ⋅ g2 t ) = e(m0, g2 b 0 ) ⋅ … ⋅ e(m n , g2 b n ).

[0067] As mentioned above, other mechanisms could be used within the scope of the invention. We can, for example, cite the signature mechanisms proposed in the following documents (or the references mentioned therein): Libert et al. “Linearly Homomorphic Structure-Preserving Signatures and Their Applications”, Advances in Cryptology – Crypto 2013; and Fuchsbauer et al., “Structure-Preserving Signatures on Equivalence Classes and Constant-Size Anonymous Credentials”, Journal of Cryptology, 2019.

[0068] Now that the signature mechanism has been introduced, we present how it is used by the authentication system. We detail the implementation of the different stages of the proposed authentication process.

[0069] The figure represents a method implemented by a master device to define public parameters according to an embodiment of the invention. This figure details the implementation of steps M100 and M200 previously introduced with reference to the.

[0070] Step M100 allows the MST master device to define the public parameters PP. These PP parameters can be provided to all devices in the SYS system without compromising its security. The MST master device then generates, during step M200, a public key pk M and a private key sk M We detail the implementation of these steps below.

[0071] During step M100, the master device MST determines the public parameters PP. Specifically, it implements at least steps M110 and M120.

[0072] During step M110, the master device MST selects elements {g, h0, …, h n} of G1. It also selects an element g1 from G1 and an element g2 from G2. All these elements belong to the public PP parameters of the SYS authentication system.

[0073] During step M120, the master device MST selects a signature mechanism Σ. This can advantageously be the linearly homomorphic mechanism presented above, but other mechanisms could be used. Hereinafter, to designate one of the algorithms of the signature mechanism Σ, for example the Keygen algorithm, we use the notation Σ.Keygen.

[0074] During step M200, the master device MST obtains a public key pk M and a private key sk M To do this, it implements steps M210 and M220.

[0075] In step M210, the master device MST obtains a public key pk and a private key sk using the Σ.Keygen algorithm. The public key pk includes in particular the elements g1 and g2 belonging to the public parameters PP.

[0076] During step M220, the master device MST obtains a pair of El Gamal keys. More precisely, it obtains: a private key sk e formed by an integer between 0 and p-1; and a public key pk e = g1 sk e Alternatively, it could be considered to use a pair of keys for a so-called double El Gamal system.

[0077] The MST master device thus obtains the key pair (pk M , sk M ). The public key pk M includes: the public key pk including in particular the elements g1 and g2; and the public key pk e . The private key sk M includes: the private key sk; and the private key sk e .

[0078] Once these steps have been completed, any device intended to perform a transmitter function must register with the MST master device (steps M300 and I300). We detail such a registration with reference to the following figure.

[0079] The method represents a method implemented by a master device and a transmitter device to authorize the transmitter device to certify data of a user device according to an embodiment of the invention.

[0080] In steps I300 and M300, the ISR transmitter device communicates with the MST master device to register with it. It thus obtains a public key pk I and a private key sk I , allowing it to certify data from USR user devices. Registering the ISR transmitter device with the MST master device includes at least the steps below.

[0081] In step I310, the sending device ISR selects an integer x. This integer is included in the private key sk I of the ISR transmitting device. It is therefore secret.

[0082] During step I320, the transmitting device ISR calculates one or more elements of the form B x , with B belonging to the public parameters PP. It then sends the element(s) of the form B x to the MST master device.

[0083] In the first embodiment, the ISR transmitter device sends the element g1 x to the device master MST. In contrast, in the second embodiment, the ISR transmitter device sends the elements {g x , h0 x , …, h n x} to the device MST master.

[0084] During step M330, the master device MST selects a label t specific to the ISR transmitter device. This may, for example, be an identifier of the ISR transmitter device.

[0085] During step M340, the master device MST determines a signature S for each element B x received from the ISR transmitting device. It uses the expression: S = Σ.Sign(sk, (B, B x ), t).

[0086] For the first embodiment, the master device MST obtains during this step: a single signature S on (g1, g1x). En revanche, pour le deuxième mode de réalisation, le dispositif maître MST obtient : une signature S’ sur (g, gx) ; et une pluralité de signatures Siportant respectivement sur (hi, hix) avec 0≤i≤n.

[0087] During step M350, the master device MST determines a signature S* = Σ.Sign(sk, (pk e , 1), t). In other words, the signature S* is a signature on the public key pk e of the MST master device. The MST master device provides the label t and the signatures S and S* to the ISR transmitter device.

[0088] In step I360, the ISR sending device obtains the public-private key pair (pk I , sk I ), allowing it to certify data. As previously stated, the private key sk I includes the secret integer x. The public key pk I includes: the label t; the element g2 x ; the element(s) B x ; and the signatures S and S*.

[0089] Once registered with the MST master device, the ISR transmitter device is able to certify data from a USR user device by providing it with a CERT certificate (steps I400 and U400). We now describe the exchanges between the USR user device and the ISR transmitter device to obtain such a CERT certificate.

[0090] The figure represents a method implemented by a transmitter device and a user device for certifying data of the user device according to an embodiment of the invention. This figure illustrates the implementation of steps U400 and I400.

[0091] In these steps, the user device USR communicates with the issuer device ISR to obtain a CERT certificate on a data set {m0, …, m n} (i.e. a set of attributes). More precisely, the user device USR thus obtains a secret key sk u allowing to authenticate all or part of the data set {m0, …, m n}.

[0092] As illustrated in the, the user device USR and the sender device ISR implement at least the steps below.

[0093] In step U410, the user device USR calculates an element H defined by the expression H = g ⋅ h0 m 0⋅ … ⋅ h n m n . We recall that the elements {g, h0, …, h n} belong to the public PP parameters.

[0094] During step U420, implemented only in the second embodiment, the user device USR calculates the element H x using the public key pk I of the ISR transmitter device and the data set {m0, …, m n}. Note that the user device USR can calculate H x without knowing the integer x included in the private key sk I of the ISR emitting device. We have in fact: H x = (g ⋅ h0 m 0 ⋅ … ⋅ h n m n ) x = (g x ) ⋅ (h0 x ) m 0 ⋅ … ⋅ (h n x ) m n , with {g x , h0 x , …, h n x} belonging to the public key pk Iof the ISR transmitting device.

[0095] During this same step U420, the user device USR also obtains a signature S on the elements (H, H x ). This signature S is obtained using the expression: S = Σ.Eval(pk, t, S', S0, …, S n , (1, m0, …, m n )). As previously stated, S' is a signature on (g, g x ) and S i is a signature on (h i , h i x ) (see step M340).

[0096] The user device USR then sends the element H to the sender device ISR. In the second embodiment, it also sends the element H x and the signature S.

[0097] In step I430, the transmitter device ISR selects an integer y. It then calculates an element A = H 1 / ( x+y ) using the element H received from the user device USR and the integer x included in its private key sk I.

[0098] During step I440, implemented only in the second embodiment, the transmitting device ISR calculates the element A x = (H x ) 1 / ( x+y ) and an S signature u = Σ.Eval(pk, t, S, 1 / (x+y)). This signature S u is, by construction, a signature on the elements (H 1 / ( x+y ) , (H x ) 1 / ( x+y ) ).

[0099] The ISR sending device provides the USR user device with a CERT certificate certifying the authenticity of the data set {m0, …, m n}. This CERT certificate comprises at least the integer y and the element A. For the second embodiment, it further comprises the element A x and the signature S u .

[0100] In step U450, the user device USR obtains a secret key sk uallowing to prove the authenticity of all or part of the data set {m0, …, m n}. This secret key sk u comprises: the element H; the integer y; and the element A. For the second embodiment, it also comprises: the element A x and the signature S u .

[0101] The user device USR can use this secret key sk u to authenticate all or part of the data set {m0, …, m n} (step U500). For this purpose, it generates an authentication token TOK U , which we are now detailing.

[0102] The figure represents a method implemented by a user device for authenticating data to a verifier device according to an embodiment of the invention. This figure shows the implementation of step U500 of the proposed method.

[0103] Here we consider that the user device USR proves the authenticity of a subset MSG of the dataset {m0, ..., m n}. It is important to note that this MSG subset can correspond to all or part of the set {m0, ..., m n}.

[0104] More specifically, we describe below the proposed solution considering that the MSG subset is {m0, ..., m m} with m ≤ n. However, the proposed solution of course applies to any MSG subset of the dataset.

[0105] As illustrated by the, the user device USR implements at least steps U510 to U550 below.

[0106] During step U510, the user device USR selects two integer random values ​​r and k. It then calculates a set of so-called authentication elements from the public parameters PP, the secret key sk U , and random variables r and k.

[0107] In the first embodiment, the user device USR calculates a ciphertext C1= g1 k etc 2 = g1 r ⋅ pk e k . It further calculates the elements P'1= (g1 x ) r and P'2= (g2 x ) r , raised to the power r⋅x.

[0108] In the second embodiment, the user device USR calculates a ciphertext C1= g1 k etc 2 = A r ⋅ pk e k . It further calculates the element P'1= (A x ) r , raised to the power r⋅x.

[0109] In step U520, the user device USR calculates a signature Z from the signatures S u and S*, and random variables r and k. More precisely, the user device USR obtains the signature Z using the expression: Z = ∑.Eval(pk, t, S u , S*, (r, k)).

[0110] In the first embodiment, S ucorresponds to the signature S on (g1, g1 x ), and S* is a signature on (pk e , 1). It follows that the signature Z is a signature on (g1 r ⋅ pk e k , g1 r ⋅ x ) = (C2, P'1). The signatures S and S* are both obtained for the same label t specific to the ISR transmitting device and are included in the public key pk I of this one.

[0111] In the second embodiment, S u is a signature on (A, A x ) and S* is a signature on (pk e , 1) for the label t. Also, the signature Z is a signature on (A r ⋅ pk e k , HAS r ⋅ x ) = (C2, P'1). The signature S u is included in the secret key sk u , while the signature S* is included in the public key pk I of the ISR transmitting device.

[0112] During step U530, implemented only in the first embodiment, the user device USR selects an integer random number v. It then calculates elements D1= A v and D2= H r ⋅ v ⋅ D1 -r ⋅ y . It should be noted that D2= A r ⋅ v ⋅ x .

[0113] During step U540, the user device USR produces a proof of knowledge π associated with the elements C1 and C2, the signature Z, and an element H'=g ⋅ h0 m 0 ⋅ … ⋅ h m m m where m≤n.

[0114] The knowledge proof π proves that the elements C1 and C2 are well-formed. It also proves that the signature Z is valid on (C2, P'1) for the label t.

[0115] The proof of knowledge π is also associated with the element H'. It is appropriate to distinguish two cases depending on whether the user device USR authenticates all or part of the data set {m0, …, m n}. We recall that the element H=g ⋅ h0 m 0 ⋅ … ⋅ h n m n .

[0116] Let us first consider that the user device USR authenticates the entire data set {m0, …, m n}. In this case we have m=n and H'=H. In the first embodiment, the proof π proves that there exist α and β such that: D2 D1 β = H α . In the second embodiment, the proof π proves that there exist α and β such that: C2 pk e -k P' 1β= Hα.

[0117] Now consider that the USR device authenticates only part of the data set {m0, …, m n}. In this case we have m <n et H’ ⋅ (h m+1 m m+1 ⋅ … ⋅ h n m n ) = H. In the first embodiment, the proof π proves that there exist α, β, and {m m+1 , …, m n} such that: D2⋅ D1 β = H' α ⋅ (h m+1 m m+1 ⋅ … ⋅ h n m n ) α . In the second embodiment, the proof π proves that there exist α, β, and {m m+1 , …, m n} such that: C2⋅ pk e -k ⋅ P'1 β = H' α ⋅ (h m+1 m m+1 ⋅ … ⋅ h n m n ) α .

[0118] The π-proof of knowledge is, according to one embodiment, a zero-knowledge proof. The π-proof of knowledge can notably be obtained by using the Schnorr protocol proposed in the document: Schnorr, “Efficient Identification and Signatures for Smart Cards”, Proceedings of Crypto 1989. It could also be envisaged to use the protocol proposed in the document: Groth and Sahai, “Efficient Non-interactive Proof Systems for Bilinear Groups”, Advances in Cryptology – Eurocrypt 2008.

[0119] The TOK authentication token U then comprises: C1, C2, Z, P'1, and π. In the first embodiment, it further comprises: P'2, D1, D2.

[0120] During step U550, the user device USR provides a VRF verifier device with the MSG data subset and the associated authentication token TOK U. It thus proves the authenticity of the MSG data subset to the VRF verifier device.

[0121] The proposed solution ensures that authentication tokens are unforgeable. In other words, a user device cannot prove the validity of data that has not been certified by an issuing device.

[0122] We describe, with reference to the following figure, the steps implemented by the VRF verifier device to verify the TOK authentication token U .

[0123] Larepresents a method implemented by a verifier device to verify the authenticity of data of a user device according to an embodiment of the invention.

[0124] This figure details the implementation of step V600 introduced with reference to the. To check the validity of the TOK authentication token U, and thus the authenticity of the MSG data subset, the VRF verifier device implements at least the steps below.

[0125] In step V610, the VRF verifier device obtains the MSG data subset and the TOK authentication token U provided by the user device USR. Of course, the VRF verifier device has the public parameters PP and the public key pk M of the MST master device.

[0126] During step V620, the VRF verification device calculates the element H'=g ⋅ h0 m 0 ⋅ … ⋅ h m m m . We recall that the elements {g, h0, …, h m} belong to the public PP parameters, and that {m0, …, m m} denotes the subset of MSG data with m≤n.

[0127] During step V630, the VRF verifier device verifies the validity of the proof of knowledge π included in the authentication token TOK U .

[0128] To confirm that the proposed solution works correctly, let us show that the proof π is valid when the token TOK U is obtained in accordance with the proposed method.

[0129] First, the proof π proves that the signature Z is valid on (C2, P'1) for the label t. We previously demonstrated that Z is indeed a signature on (C2, P'1) (see step U520).

[0130] Second, in the first embodiment, the proof π proves that there exist α and β such that: D2 D1 β = H α . This is verified for α = r⋅v and β = r⋅y by construction of D2. In the second embodiment, the proof of knowledge π proves that there exist α and β such that: C2 pk e -k P'1β= Hα. Cette équation est vérifiée pour α = r / y et β = 1 / y. En reprenant les définitions de C2, P’1et A, nous pouvons montrer que C2 pke-k P’11 / y=Ar⋅ Ar.x / y= A(ry+rx) / y= Hr / y.

[0131] During step V640, implemented only in the first embodiment, the VRF verifier device verifies whether the following two equations are satisfied: a) e(g1, P'2) = e(P'1, g2); and b) e(D2, g2) = e(D1, P'2).

[0132] Also, to confirm the correct functioning of the proposed solution, let us show that these two equations are satisfied when the TOK token U is obtained in accordance with the proposed method.

[0133] On the one hand, P'1 and P'2 correspond to the elements g1 and g2 raised to the power r x (see step U510), which ensures that equation a) is satisfied. On the other hand, for equation b), we have e(D1, P'2) = e(D1, g2 r.x ) = e(A r.v.x , g2) = e(D2, g2), since D1 = A v and D2= A r ⋅ v ⋅ x (see step U530).

[0134] If the result of the verification in step V630 is positive, and also that of the verification in step V640 for the first embodiment, then the authentication token TOK U is valid. Otherwise, the TOK authentication token U is considered invalid.

[0135] It should be noted that the VRF verifier device verifies the authenticity of the MSG data subset without using the public key of the ISR transmitter device. It also does not need to know the entire certified data {m0, ..., m n} to check the MSG subset.

[0136] In other words, the user device USR can authenticate only part of the data {m0, ..., m n}, and this without having to reveal either all the certified data or the identity of the ISR transmitting device. The proposed solution makes it possible to preserve the anonymity of USR user devices and that of ISR transmitting devices.

[0137] The proposed solution applies in particular to the implementation of authentication systems in the field of digital identity. It allows a user to obtain a certificate of their identity from an issuer. They can then prove their identity to a verifier while retaining control over their personal data and without having to reveal the identity of the issuer.

[0138] However, the proposed solution allows the MST master device to lift the anonymity of an ISR issuing device. We detail below how the MST master device identifies the ISR issuing device associated with a TOK authentication token U (step M700).

[0139] Larepresents a method implemented by a master device to identify an issuing device associated with an authentication token according to an embodiment of the invention.

[0140] For security reasons, for example at the request of authorities, it may be necessary to trace the ISR issuing device associated with a TOK authentication token U This can be done by the master MST device, and only that device. It does this by using the public keys of the registered ISR transmitter devices, and by implementing steps M710 and M720.

[0141] During step M710, the master device MST decrypts the elements C1 and C2 included in the token TOK U , and this using his private key sk e . He obtains an element of the form B r , where r is the random number used when generating the TOK token U (see step U510).

[0142] Note that only the MST master device can implement this step, since it requires knowledge of the private key sk e of the MST master device.

[0143] During step M720, the master device MST performs a test for each of the registered ISR transmitter devices. This test determines whether the ISR device in question is the one associated with the TOK token. U . The test uses: element B r obtained, the element g2 belonging to the public parameters PP, the element P'1 included in the token TOK U , and the element g2 x included in the public key pk I of the ISR emitting device considered.

[0144] More precisely, for each ISR transmitter device, the master MST device checks whether the following equation is satisfied: e(B r , g2 x ) = e(P'1, g2). If the result of this check is positive, the ISR emitting device comprising the element g2 xin his public key pk I is the one involved in the TOK authentication token U .

[0145] For example, the MST master device could be a server of a national authority. In particular, it could lift the anonymity of certain authentication tokens to ensure that no fraudulent certificates are used.

[0146] The proposed solution having been described in its various aspects, we now evaluate its complexity.

[0147] Tables 1 and 2 are presented below to evaluate the size of an authentication token in different embodiments of the invention. Here we assume that the user device USR authenticates the data set {m0, …, m n} in its entirety.

[0148] A TOK authentication token Ucomprises a fixed-size portion and a variable-size portion. The fixed-size portion comprises at least the elements C1, C2, P'1, i.e., three elements of G1. For the first embodiment only, the fixed-size portion further comprises the elements P' 2, D1, D2,c’est-à-dire deux éléments de G1 et un élément de G2. La partie de taille variable correspond à la signature Z et à la preuve π, dont la taille varie en fonction du mécanisme de signature utilisé.

[0149] Table 1 describes the number of elements in Z and π for different embodiments:Σ mechanism of Fuchsbauer et al.proposed Σ mechanismfirst embodiment2 G1, 1 G2 and 5 scalars1 G1 and 6 scalarssecond embodiment2 G1, 1 G2 and 4 scalars1 G1 and 5 scalars

[0150] Here we consider that the signature mechanism Σ corresponds: either to the mechanism described in the Fuchsbauer et al. paper (column 1); or to the linearly homomorphic signature mechanism proposed and described above (column 2). Also, the number of elements included in Z and π is presented considering the first embodiment (row 1) and the second embodiment of the proposed solution (row 2).

[0151] This table confirms that the proposed linearly homomorphic signature mechanism (column 2) advantageously allows reducing the size of authentication tokens.

[0152] Table 2 shows the size in bytes of a TOK authentication token U for the different embodiments considered: Σ mechanism of Fuchsbauer et al. Σ mechanism proposed first embodiment 688 bytes 576 bytes second embodiment 464 bytes 352 bytes

[0153] The different token sizes shown in this table are obtained in the following way. The bilinear environment is implemented using an elliptic curve, and more precisely the elliptic curve called BLS12-381 and described in the following document: Bowe, “BLS12-381: New zk-SNARK elliptic curve construction”, 2017, https: / electriccoin.co / blog / new-snark-curve / . The points of this curve are then compressed using standard techniques known to those skilled in the art.

[0154] We can see that the second embodiment allows shorter authentication tokens to be obtained compared to the first embodiment. On the other hand, the first embodiment allows the user device to obtain a certificate by implementing a less complex method (see steps U400 and I400).

[0155] Compared to Boboz et al.'s solution, the proposed solution has minimal implementation complexity. It requires significantly less computation and allows for shorter authentication tokens. The proposed solution thus reduces the amount of data exchanged between a user and a verifier, and the time required to perform authentication. In addition, the proposed solution allows for the anonymity of the issuer.

[0156] It is also worth mentioning that the proposed solution is advantageously compatible with the aforementioned BBS+ standard.

[0157] The represents an example of hardware architecture of a device according to an embodiment of the invention.

[0158] Here we describe the hardware architecture of an APP device. This description is common to the MST master, ISR transmitter, USR user, and VRF verifier devices. In fact, each of these devices can have this hardware architecture.

[0159] The APP device comprises, according to the embodiment of the, at least one processor PROC and at least one memory MEM.

[0160] More particularly, the APP device has, according to one embodiment, the hardware architecture of a computer. The memory MEM constitutes an information medium in accordance with the invention, i.e. readable by the processor PROC and on which a computer program PROG in accordance with the invention is recorded. The program PROG comprises instructions for carrying out steps of a method in accordance with the invention, when the program PROG is executed by the processor PROC. The program PROG defines in particular the functional modules of the APP device, which control the hardware elements of the latter.

[0161] As illustrated in the, the APP device comprises a COM communication device configured to communicate with all or part of the other devices of the SYS system. No limitation is attached to the nature of the communication interfaces between these devices, which can implement any protocol known to those skilled in the art.

[0162] Generally speaking, for each step (or operation) of a method according to the invention, an MST, ISR, USR, VRF device may comprise a module or a corresponding element configured to carry out said step.

[0163] In particular, the master device MST comprises: a module for determining public parameters PP (step M100); a module for obtaining a public-private key pair (pk M , sk M ) (step M200); a module for authorizing a transmitting device to certify data (step M300); and a module for identifying a transmitting device ISR associated with an authentication token TOK U (step M700).

[0164] The ISR transmitter device includes in particular: a module for obtaining a public-private key pair (pk I , sk I ) (step I300); and a module for providing a CERT certificate to a user device (step I400).

[0165] Also, the USR user device includes: a module for obtaining a secret key sk u , this key sk u including in particular a CERT certificate provided by the ISR issuing device (step U400); and a TOK authentication token provision module U (step U500). The VRF verifier device comprises: an authentication token verification module TOK U (step V600).

Claims

Method implemented by a user device (USR) to authenticate a subset (MSG) of a data set ({m0, …, m n}) with a verifying device (VRF), the user device (USR) having: a secret key (sk U ) allowing to authenticate all or part of the data set ({m0, …, m n}), this key (sk U ) comprising at least: an element H calculated from elements ({g, h0, …, h n}) belonging to public parameters (PP) defined by a master device (MST), and the dataset ({m0, …, m n}); and a certificate (CERT) provided by an issuing device (ISR) and certifying the authenticity of the data set ({m0, …, m n}), the certificate (CERT) comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key (sk I) of the issuing device (ISR); andthe method comprising:a provision (U500) of an authentication token (TOK U ) of the data subset (MSG), this token (TOK U ) comprising at least: a set of authentication elements (C1, C2, P'1, P'2, D1, D2) calculated from the public parameters (PP), the secret key (sk U ) of the user device (USR), and random values r and k; a signature Z calculated from random values r and k, of a signature S u , and a signature S* on a part (pk e ) of a public key (pk M ) of the master device (MST) for a label t specific to the transmitter device (ISR), the signature S* belonging to a public key (pk I ) of the transmitting device (ISR); and a proof of knowledge π associated with the authentication elements (C1, C2), the signature Z, and an element H' calculated from the elements ({g, h0, …, h n}) belonging to the public parameters (PP) and the data subset (MSG). The method of claim 1, wherein:the set of token authentication elements (TOK U ) includes the elements: C1=g1 k ; C2= g1 r ⋅ pk e k ; P'1= (g1 x ) r ; P'2= (g2 x ) r ; D1=A v ; and D2= H r ⋅ v ⋅ D1 -r ⋅ y , where g1 and g2 belong to public parameters (PP), g1 x and g2 x belong to the public key (pk I ) of the transmitting device (ISR), v is a random number, and pk e belongs to the public key (pk M ) of the master device (MST); and the signature S u is a signature on {g1, g1 x} and the signature S* is a signature on {pk e , 1} for the label t, these signatures belonging to the public key (pk I) of the transmitting device (ISR). The method of claim 1, wherein:the set of token authentication elements (TOK U ) includes the elements: C1=g1 k ; C2= A r ⋅ pk e k ; and P'1=(A x ) r , where g1 belongs to the public parameters (PP), A x is included in the certificate (CERT) provided by the issuing device (ISR), and pk e belongs to the public key (pk M ) of the master device (MST); and the signature S u is a signature on {A, A x} for the label t and is included in the certificate (CERT) provided by the issuing device (ISR), and the signature S* is a signature on {pk e , 1} for label t. Method implemented by a verifier device (VRF) to verify the authenticity of a subset (MSG) of a data set ({m0, …, m n}) of a user device (USR), the method comprising: a verification (V600) of an authentication token (TOK U ) of the data subset (MSG), this token (TOK U ) comprising at least: a set of authentication elements (C1, C2, P'1, P'2, D1, D2) calculated from public parameters (PP) defined by a master device (MST), a secret key (sk U ) of the user device (USR), and random values r and k; a signature Z calculated from random values r and k, of a signature S u , and a signature S* on a part (pk e ) of a public key (pk M ) of the master device (MST) for a label t specific to the transmitter device (ISR), the signature S* belonging to a public key (pk I ) of the transmitting device (ISR); and a proof of knowledge π associated with the authentication elements (C1, C2), the signature Z, and an element H' calculated from elements ({g, h0, …, h m}) belonging to the public parameters (PP), and the data subset (MSG); and in which: the verification (V600) of the token (TOK U ) includes at least: a verification (V630) of the validity of the proof of knowledge π using the set of authentication elements (C1, C2, P'1, P'2, D1, D2), the signature Z, and the element H'. Method implemented by a transmitting device (ISR) to certify a set of data ({m0, …, m n}) of a user device (USR), the issuing device (ISR) having: a public-private key pair (pk I , sk I ) including at least: for the private key (sk I ): a scalar x; and for the public key (pk I ): a label t specific to the transmitting device (ISR); and a signature S* provided by a master device (MST), S* being a signature on a part (pk e ) of a public key (pk M) of the master device (MST) for the label t; andthe method comprising:a provision (I400) to the user device (USR) of a certificate (CERT) certifying the authenticity of the data set ({m0, …, m n}), this certificate (CERT) comprising at least: a random number y; and an element A calculated from an element H, the scalar x, and the random number y, the element H being calculated from elements ({g, h0, …, h n}) belonging to public parameters (PP) defined by the master device (MST) and the dataset ({m0, …, m n}). Method implemented by a master device (MST) to authorize a transmitter device (ISR) to certify a set of data ({m0, …, m n}) of at least one user device (USR), the master device (MST) defining public parameters (PP), and the method comprising:a provision (M300) to the transmitter device (ISR) of elements (t, S, S*) of a public key (pk I) of the transmitting device (ISR), these elements (t, S, S*) comprising at least: a label t specific to the transmitting device (ISR); and a signature S* on a part (pk e ) of a public key (pk M ) of the master device (MST) for label t and obtained using a private key (sk M ) of the master device (MST). Method according to claim 6, comprising an identification (M700) of a transmitting device (ISR) associated with an authentication token (TOK U ) of a user device (USR), the identification (M700) comprising: a decryption (M710) of encrypted authentication elements (C1, C2) included in the token (TOK U ) to obtain an element B r , where r is a random number used to generate the token (TOK U ), this decryption (M710) being carried out using a part (sk e ) of the private key (sk M) of the master device (MST); and a check (M720) to determine whether the issuing device (ISR) is associated with the authentication token (TOK U ) using: element B r obtained; a g2 element x included in the public key (pk I ) of the sending device (ISR), x a scalar belonging to a private key (sk I ) of the issuing device (ISR); an element P'1 included in the authentication token (TOK U ); and a g2 element belonging to the public parameters (PP). Method according to any one of claims 1 to 7, in which a bilinear environment is used, said environment designating a group G1, a group G2 and a group GT of order p, and a bilinear coupling, and in which a said signature σ on a set of elements {u0, …, u n} of G1 for a label τ is obtained using the expression: σ = (u0 b 0 ⋅ … ⋅ u n bn ) 1 / ( a+τ ) , where the scalars {a, b0, …, b n} belong to a private key. A so-called user device (USR) configured to authenticate a subset (MSG) of a data set ({m0, …, m n}) with a verifying device (VRF), the user device (USR) comprising: a secret key (sk U ) allowing to authenticate all or part of the data set ({m0, …, m n}), this key (sk U ) comprising at least: an element H calculated from elements ({g, h0, …, h n}) belonging to public parameters (PP) defined by a master device (MST), and the dataset ({m0, …, m n}); and a certificate (CERT) provided by an issuing device (ISR) and certifying the authenticity of the data set ({m0, …, m n}), the certificate (CERT) comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key (sk I ) of the issuing device (ISR); and a module for providing an authentication token (TOK U ) of the data subset (MSG), this token (TOK U ) comprising at least: a set of authentication elements (C1, C2, P'1, P'2, D1, D2) calculated from the public parameters (PP), the secret key (sk U ) of the user device (USR), and random values r and k; a signature Z calculated from random values r and k, of a signature S u , and a signature S* on a part (pk e ) of a public key (pk M ) of the master device (MST) for a label t specific to the transmitter device (ISR), the signature S* belonging to a public key (pk I) of the transmitting device (ISR); and a proof of knowledge π associated with the authentication elements (C1, C2), the signature Z, and an element H' calculated from the elements ({g, h0, …, h n}) belonging to the public parameters (PP) and the data subset (MSG). A so-called verifier device (VRF) configured to verify the authenticity of a subset (MSG) of a data set ({m0, …, m n}) of a user device (USR), the verifier device (VRF) comprising: a module for verifying an authentication token (TOK U ) of the data subset (MSG), this token (TOK U ) comprising at least: a set of authentication elements (C1, C2, P'1, P'2, D1, D2) calculated from public parameters (PP) defined by a master device (MST), a secret key (sk U ) of the user device (USR), and random values r and k; a signature Z calculated from random values r and k, of a signature Su , and a signature S* on a part (pk e ) of a public key (pk M ) of the master device (MST) for a label t specific to the transmitter device (ISR), the signature S* belonging to a public key (pk I ) of the transmitting device (ISR); and a proof of knowledge π associated with the authentication elements (C1, C2), the signature Z, and an element H' calculated from elements ({g, h0, …, h m}) belonging to the public parameters (PP), and the data subset (MSG); and in which: the verification module is configured at least to: verify (V630) the validity of the proof of knowledge π using the set of authentication elements (C1, C2, P'1, P'2, D1, D2), the signature Z, and the element H'. Device called transmitter (ISR) configured to certify a set of data ({m0, …, m n}) of a user device (USR), the issuing device (ISR) comprising:a public-private key pair (pk I , sk I ) including at least: for the private key (sk I ): a scalar x; and for the public key (pk I ): a label t specific to the transmitting device (ISR); and a signature S* provided by a master device (MST), S* being a signature on a part (pk e ) of a public key (pk M ) of the master device (MST) for the label t; and a module for providing the user device (USR) with a certificate (CERT) certifying the authenticity of the data set ({m0, …, m n}), this certificate (CERT) comprising at least: a random number y; and an element A calculated from an element H, the scalar x, and the random number y, the element H being calculated from elements ({g, h0, …, h n}) belonging to public parameters (PP) defined by the master device (MST) and the dataset ({m0, …, mn}). Master device (MST) configured to authorize a transmitter device (ISR) to certify a set of data ({m0, …, m n}) of at least one user device (USR), the master device (MST) being configured to define public parameters (PP) and comprising: a module for providing the transmitting device (ISR) with elements (t, S, S*) of a public key (pk I ) of the transmitting device (ISR), these elements (t, S, S*) comprising at least: a label t specific to the transmitting device (ISR); and a signature S* on a part (pk e ) of a public key (pk M ) of the master device (MST) for label t and obtained using a private key (sk M ) of the master device (MST). System (SYS) comprising several devices among: a user device (USR) according to claim 9; a verifier device (VRF) according to claim 10; a transmitter device (ISR) according to claim 11; and a master device (MST) according to claim 12. Computer program (PROG) comprising instructions for implementing steps of a method according to any one of claims 1 to 8, when the computer program (PROG) is executed by at least one processor (PROC). Computer-readable information medium (MEM) comprising a computer program (PROG) according to claim 14.

Images