Methods and devices for authenticating data

Abstract

The present invention relates to methods and devices (MST, ISR, USR, VRF) for authenticating data. In particular, a method implemented by a user device (USR) is proposed for authenticating a subset (MSG) of a dataset to a verifying device (VRF), wherein: the user device (USR) has a secret key enabling it to authenticate all or part of the dataset, the secret key comprising at least one certificate (CERT) provided by an issuing device (ISR) and certifying the authenticity of the dataset; and the method includes generating an authentication token (TOKU) of the data subset (MSG), this authentication token (TOKU) being obtained from public parameters defined by a master device (MST) and the secret key of the user device (USR). Figure for the abstract: Fig. 1

Description

Title of the invention: Methods and devices for authenticating data Technical field

[0001] The present invention relates to the general field of authentication. More particularly, the present invention relates to methods and devices for authenticating data. The present invention finds a particularly advantageous, although in no way limiting, application for the implementation of authentication systems in the field of digital identity. Prior art

[0002] Generally speaking, it is known to use electronic signature mechanisms to authenticate data exchanged between communication devices. Electronic signatures use cryptographic schemes to prove and verify the authenticity of data. To do this, an issuer (e.g. a trusted authority) provides a user with a certificate allowing them to prove the validity of their data to a verifier.

[0003] However, standard electronic signature mechanisms require revealing all of the certified data, even to prove the authenticity of only part of it, and allow users to be tracked. Take the example of a transport card: to prove the validity of the card to a verifier (e.g. an access gate), the user must provide all the certified information, including their first and last name, which allows their movements to be tracked.

[0004] To overcome these drawbacks, so-called anonymous electronic signature mechanisms have been developed. These mechanisms are said to be anonymous in that they allow the user to control the information revealed during authentication. They are now the subject of several standards (e.g. ISO 18370 and ISO 20008) and are deployed on a large scale, particularly in electronic chips, such as TPM (Trusted Platform Modules) type chips, or certain processors.

[0005] It is important to note, however, that anonymous signature mechanisms focus on the anonymity of users, not issuers. However, the identity of the issuer can reveal a lot of information about the user. For example, a certificate issued by a municipality will reveal that the user resides in that municipality. More specifically, a certificate indicates the issuer's public key. To reduce security concerns in the event of a malicious attack, an issuer typically uses multiple public keys. The user is therefore not anonymous among all users associated with this issuer, but only among a restricted set of users associated with the same public key.

[0006] In view of these problems, several electronic signature mechanisms have recently been proposed to allow users to authenticate data without having to reveal the identity of the issuer. We can notably mention the solution proposed in the document: Bobolz et al., “Issuer-Hiding Attribute-Based Credentials”, Cryptology and Network Security, 2021. The advantages of this solution are nevertheless offset by a certain number of disadvantages. Indeed, this solution is complex to implement. It requires a large number of calculations to generate an authentication token, and the size of the tokens is particularly large. In addition, this solution has no system supervision mechanism. The anonymity of an issuer cannot be lifted, even if this is necessary for security reasons.

[0007] Ultimately, existing solutions allowing a user to authenticate data with a verifier are not fully satisfactory. There is a need for an authentication solution that allows both the anonymity of users and that of senders to be preserved, and which does not have the drawbacks of existing solutions. Statement of the invention

[0008] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above.

[0009] For this purpose, and according to one aspect of the invention, a method is proposed implemented by a user device to authenticate a subset of a data set with a verifier device, the user device having: - a secret key making it possible to authenticate all or part of the data set, this key comprising at least: • an H element calculated from elements belonging to public parameters defined by a master device, and from the data set; and • a certificate provided by an issuing device and certifying the authenticity of the data set, the certificate comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key of the issuing device; and the method comprising: - a provision of an authentication token of the data subset, this token comprising at least: • a set of authentication elements calculated from the public parameters, the secret key of the user device, and random values ​​r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on part of a public key of the master device for a label t specific to the transmitting device, the signature S* belonging to a public key of the transmitting device; and • a proof of knowledge ir associated with the authentication elements, the signature Z, and an element H' calculated from the elements belonging to the public parameters and the data subset.

[0010] It is proposed here to use an authentication system comprising four types of devices. The master device defines the public parameters, and authorizes the transmitter devices to certify data. Once authorized by the master device, a transmitter device can certify a set of data of a user device. The user device can then provide an authentication token to prove the authenticity (i.e. the validity) of all or part of the set of data. This authentication token is verified by a verifier device.

[0011] The proposed solution allows the user to prove the validity of all or part of his data to a verifier. It does not require the user to provide the verifier with all of the certified data to prove the validity of only part of it. In this sense, the proposed solution allows the anonymity of the user to be preserved.

[0012] Furthermore, the proposed solution allows the anonymity of the issuer who certifies the user's data to be preserved. The user can authenticate his data to the verifier without having to reveal the identity of the issuer. The verifier is able to verify the validity of the data without using the issuer's public key. To do this, it uses the public parameters defined by the master device, the data, and the elements included in the authentication token.

[0013] Compared with the aforementioned solution of Boboz et al., the proposed solution has the following advantages. First, it requires significantly less computation. The proposed solution also allows for shorter authentication tokens, and thus reduces the amount of data exchanged between the user and the verifier. It thus reduces the time required to perform authentication, which is essential for users.

[0014] Second, the proposed solution allows the anonymity of the issuer to be lifted if necessary. For security reasons, for example at the request of the authorities, it is possible for the master device to identify the issuer associated with a token authentication.

[0015] Thus, the proposed authentication solution makes it possible to preserve the anonymity of both users and senders. It also has minimal implementation complexity and makes it possible to lift the anonymity of a sender if necessary.

[0016] According to one embodiment, the set of authentication elements of the token comprises the elements: Cj=gjk; C2 = gir • pkek; P'i = (gix)r; P'2 = (g2x)r; Dj=Av; and D2 = Hrv- Di r\ where gi and g2 belong to the public parameters, gp and g2x belong to the public key of the issuing device, v is a random number, and pke belongs to the public key of the master device.

[0017] Furthermore, according to this embodiment, the signature Su is a signature on {gb gp] and the signature S* is a signature on {pke, 1} for the label t, these signatures belonging to the public key of the transmitting device.

[0018] According to one embodiment, the set of authentication elements of the token includes the elements: Ci=gik; C2= Ar- pkek; and P'i=(Ax)r, where gi belongs to the public parameters, Ax is included in the certificate provided by the issuing device, and pke belongs to the public key of the master device.

[0019] Furthermore, according to this embodiment, the signature Su is a signature on {A, Ax] for the label t and is included in the certificate provided by the issuing device, and the signature S* is a signature on {pke, 1} for the label t.

[0020] Here we present the advantages of the two embodiments described above, one over the other. On the one hand, the first embodiment is advantageous in that it allows the user device to obtain a certificate from an issuing device by implementing a low-complexity method. On the other hand, the second embodiment makes it possible to obtain authentication tokens of reduced size, and contributes to reducing the amount of data exchanged between a user and a verifier.

[0021] According to one aspect of the invention, there is provided a method implemented by a verifier device for verifying the authenticity of a subset of a data set of a user device, the method comprising: - a verification of an authentication token of the data subset, this token comprising at least: • a set of authentication elements calculated from public parameters defined by a master device, a secret key of the user device, and random values ​​r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on part of a public key of the master device for a label t specific to the transmitting device, the signature S* belonging to a public key of the transmitting device; and • a proof of knowledge ir associated with the authentication elements, the signature Z, and an element H' calculated from elements belonging to the public parameters, and the data subset; and in which: - the verification of the token includes at least: a verification of the validity of the proof of knowledge ir using the set of authentication elements, the signature Z, and the element H'.

[0022] According to one aspect of the invention, a method is proposed implemented by a transmitter device for certifying a set of data of a user device, the transmitter device having: - a public-private key pair comprising at least: • for the private key: a scalar x; and • for the public key: a label t specific to the issuing device; and a signature S* provided by a master device, S* being a signature on a part of a public key of the master device for label t; and the method comprising: - a provision to the user device of a certificate certifying the authenticity of the data set, this certificate comprising at least: • a random y; and • an element A calculated from an element H, the scalar x, and the random value y, the element H being calculated from elements belonging to public parameters defined by the master device and the data set.

[0023] According to one aspect of the invention, there is provided a method implemented by a master device to authorize a transmitter device to certify a set of data of at least one user device, the master device defining public parameters, and the method comprising: - a supply to the transmitting device of elements of a public key of the transmitting device, these elements comprising at least: • a label t specific to the transmitting device; and • a signature S* on part of a public key of the master device for label t and obtained using a private key of the master device.

[0024] According to one embodiment, the method comprises an identification of a transmitter device associated with an authentication token of a user device, the identification comprising: - decryption of encrypted authentication elements included in the token to obtain an element Br, where r is a random number used to generate the token, this decryption being carried out using a part of the private key of the master device; and - a check to determine whether the issuing device is associated with the authentication token using: the obtained Br element; a g2x element included in the issuing device's public key, x a scalar belonging to a private key of the issuing device; a P'i element included in the authentication token; and a g2 element belonging to the public parameters.

[0025] This embodiment allows the anonymity of the issuer to be lifted. More specifically, this embodiment allows the master device to identify the issuer device involved in an authentication token provided by a user device.

[0026] According to one embodiment, a bilinear environment is used, said environment designating a group Gl, a group G2 and a group GT of order p, and a bilinear coupling, and a said signature o on a set of elements {u0, ..., un] of Gl for a label r is obtained using the expression: o = (uobO • ... • unbn)1 / (a+T), where the scalars {a, b0, ..., bn] belong to a private key.

[0027] This embodiment proposes to use a linearly homomorphic signature mechanism. More particularly, the signature mechanism proposed here advantageously makes it possible to obtain authentication tokens of reduced size, in comparison with existing signature mechanisms. This embodiment thus contributes to reducing the quantity of data exchanged between the user and the verifier, as well as the time required to carry out authentication.

[0028] According to one aspect of the invention, there is provided a device, called a user device, configured to authenticate a subset of a set of data with a verifier device, the user device comprising: - a secret key enabling all or part of the data set to be authenticated, this key comprising at least: • an H element calculated from elements belonging to public parameters defined by a master device, and from the data set; and • a certificate provided by an issuing device and certifying the authenticity of the data set, the certificate comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key of the issuing device; and - a module for providing an authentication token for the data subset, this token comprising at least: • a set of authentication elements calculated from the public parameters, the secret key of the user device, and random values ​​r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on part of a public key of the master device for a label t specific to the transmitting device, the signature S* belonging to a public key of the transmitting device; and • a proof of knowledge ir associated with the authentication elements, the signature Z, and an element H' calculated from the elements belonging to the public parameters and the data subset.

[0029] According to one aspect of the invention, there is provided a device, called a verifier, configured to verify the authenticity of a subset of a set of data of a user device, the verifier device comprising: - a module for verifying an authentication token of the data subset, this token comprising at least: • a set of authentication elements calculated from public parameters defined by a master device, a secret key of the user device, and random values ​​r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on part of a public key of the master device for a label t specific to the transmitting device, the signature S* belonging to a public key of the transmitting device; and • a proof of knowledge ir associated with the authentication elements, the signature Z, and an element H' calculated from elements belonging to the public parameters, and the subset of data; and in which: - the verification module is configured at least to: verify the validity of the proof of knowledge ir using the set of authentication elements, the signature Z, and the element H'.

[0030] According to one aspect of the invention, there is provided a device, called transmitter, configured to certify a set of data of a user device, the transmitter device comprising: - a public-private key pair comprising at least: • for the private key: a scalar x; and • for the public key: a label t specific to the issuing device; and a signature S* provided by a master device, S* being a signature on a portion of a public key of the master device for label t; and - a module for providing the user device with a certificate certifying the authenticity of the data set, this certificate comprising at least: • a random number y; and • an element A calculated from an element H, the scalar x, and the random value y, the element H being calculated from elements belonging to public parameters defined by the master device and the data set.

[0031] According to one aspect of the invention, there is proposed a device, called master, configured to authorize a transmitter device to certify a set of data of at least one user device, the master device being configured to define public parameters and comprising: - a module for providing the transmitting device with elements of a public key of the transmitting device, these elements comprising at least: • a label t specific to the transmitting device; and • a signature S* on part of a public key of the master device for label t and obtained using a private key of the master device.

[0032] According to one aspect of the invention, a system is proposed comprising several devices among: - a user device in accordance with the invention; - a verification device in accordance with the invention; - a transmitter device according to the invention; and - a master device according to the invention.

[0033] The proposed system may also comprise a plurality of transmitter devices, user devices, and / or verifier devices.

[0034] According to one aspect of the invention, there is provided a computer program (or a set of computer programs) comprising instructions for implementing the steps of a method according to the invention, when the computer program is executed by at least one processor or computer.

[0035] The computer program may be formed of one or more sub-parts stored in the same memory or in separate memories. The program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0036] According to one aspect of the invention, there is provided a computer-readable information medium comprising a computer program according to the invention.

[0037] The information carrier may be any device capable of storing a program. For example, the carrier may comprise a storage means, such as a non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard disk. Furthermore, the storage medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by a telecommunications network or by a computer network or by other means. The program according to the invention may in particular be downloaded onto a computer network. Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0038] The methods, devices, system, computer program and information medium proposed have the advantages described above in connection with the method implemented by a user device to authenticate a subset of a data set. Brief description of the drawings

[0039] Other characteristics and advantages of the present invention will emerge from the description provided below, illustrating embodiments of the invention given by way of example, with reference to the attached drawings:

[0040] [Fig. 1] and [Fig. 2] respectively represent an authentication system and method according to an embodiment of the invention;

[0041] [Fig.3] represents a method implemented by a master device for defining public parameters according to an embodiment of the invention;

[0042] [Fig.4] represents a method implemented by a master device and a transmitter device to authorize the transmitter device to certify data of a user device according to an embodiment of the invention;

[0043] [Fig.5] represents a method implemented by a transmitter device and a user device for certifying data of the user device according to an embodiment of the invention;

[0044] [Fig.6] represents a method implemented by a user device to authenticate data with a verifier device according to an embodiment of the invention;

[0045] [Fig.7] represents a method implemented by a verifier device for verifying the authenticity of data of a user device according to an embodiment of the invention;

[0046] [Fig.8] represents a method implemented by a master device to identify an issuing device associated with an authentication token according to one embodiment of the invention; and

[0047] [Fig.9] represents an example of hardware architecture of a device according to an embodiment of the invention. Description of the embodiments

[0048] [Fig.l] and [Fig.2] respectively represent an authentication system and method according to an embodiment of the invention.

[0049] The proposed solution aims to allow a user to authenticate data with a verifier, while preserving the anonymity of the user and that of the issuer certifying the authenticity (i.e. the validity) of this data.

[0050] For this purpose, a system SYS is proposed here comprising devices of four types. The architecture of this system is illustrated by [Fig.l], and its operation by [Fig.2].

[0051] Among these four types of devices, the master device MST should first be mentioned. This device defines the public parameters of the system SYS (step M100), obtains a public-private key pair (step M200), and authorizes the transmitting devices ISR to certify data (steps M300 and M300).

[0052] Once authorized by the master device MST, an ISR transmitter device can certify MSG data of a USR user device, by providing it with a CERT certificate (steps 1400 and U400). The USR user device can then use this CERT certificate to generate an authentication token TOKu making it possible to prove the authenticity of the MSG data (step U500).

[0053] The authentication token TOKu is then verified by a VRF verifier device using the public parameters (step V600). It should be emphasized that the user device USR proves the authenticity of the MSG data to the VRF verifier device without revealing the identity of the transmitter device ISR.

[0054] If necessary, for example for security reasons, the master device MST can identify the ISR transmitter device associated with an authentication token TOKu (step M700). Note that only the master device MST is capable of lifting the anonymity of the ISR transmitter device.

[0055] Obviously, the functions described above of the various MST, ISR, USR and VRF devices are not exclusive. For example, an ISR transmitter device can also perform the function of a VRF verifier device. Similarly, only four devices are shown in [Fig.l], but the SYS system can comprise a plurality of ISR transmitter devices, USR user devices, and VRF verifier devices.

[0056] We use: reference signs beginning with M to designate the steps performed by the master device MST; reference signs starting with I for the transmitter device ISR; reference signs starting with U for the user device USR; and reference signs starting with V for the verifier device VRF.

[0057] Below, we describe in particular two embodiments of the proposed solution. We refer to these as the first embodiment and the second embodiment. These two embodiments have many steps in common. Therefore, we explicitly mention when a step is performed only in one embodiment. Such a step is shown in dotted lines in the figures, with an index specifying the corresponding embodiment.

[0058] However, before describing in more detail the different stages of the authentication process, we present the signature mechanism used by the SYS system.

[0059] The linearly homomorphic signature mechanism, used by the SYS authentication system, is defined by the four algorithms described below.

[0060] The signature mechanism proposed here makes it possible to minimize the size of authentication tokens, and therefore the quantity of data exchanged between a user and a verifier. However, the proposed solution is not limited to the mechanism presented below, other signature mechanisms can be used.

[0061] In particular, the proposed signature mechanism uses a bilinear environment. This bilinear environment designates a set of three groups Gl, G2 and GT of order p, and a bilinear coupling e: Gl x G2 —> GT. The roles of Gl and G2 are interchangeable.

[0062] We describe below the proposed solution using notations which correspond to the so-called BBS+ standard: Looker et al., “The BBS Signature Scheme”, Internet Engineering Task Force, Tuesday 2023. These notations are used because the proposed solution is notably compatible with this standard.

[0063] The Keygen algorithm returns a public key pk and a private key sk. More precisely, a gide element Gl and an element g2 of G2 are selected. Also selected are the integers {a, b0, ..., bn] whose values ​​are between 0 and p-1. The public key pk is defined by the elements {gi, g2] and {g2a, g2b0, ..., g2bn], while the private key sk is defined by the integers {a, b0, ..., bn}.

[0064] The Sign algorithm makes it possible to obtain a signature o on a data set M for a label t. This algorithm takes as input: the private key sk; the data set M={m0,...,mn] (i.e. a vector of n+1 elements of Gl); and the label t. According to the implementation proposed here, the signature o is obtained using the expression: o = (mobO • ... • mnbn)1 / (a+t).

[0065] The Eval algorithm is used to generate a signature for all linear combinations of several data sets. It takes as input signatures {o0, • • - , ok] relating respectively to the data sets {Mo, ..Mk] for the same label t, as well as coefficients {w0, ..., wk}. It provides as output a signature S on w o'Mo + ... + wk-Mk for the label t. This signature S is calculated as follows: S=o0w0 • ... • okwk.

[0066] The VeriE algorithm makes it possible to verify the validity of a signature o on a data set M for a label t. According to the implementation proposed here, the algorithm verifies whether the following equation is satisfied: e(o, g2a • g2') = e(mo, g2b0) • • e(mn, g2bn).

[0067] As mentioned above, other mechanisms could be used within the framework of the invention. We can, for example, cite the signature mechanisms proposed in the following documents (or the references mentioned therein): Libert et al. “Linearly Homomorphic Structure-Preserving Signatures and Their Applications”, Advances in Cryptology - Crypto 2013; and Fuchsbauer et al., “Structure-Preserving Signatures on Equivalence Classes and Constant-Size Anonymous Credentials”, Journal of Cryptology, 2019.

[0068] Now that the signature mechanism has been introduced, we present how it is used by the authentication system. We detail the implementation of the different stages of the proposed authentication process.

[0069] [Fig. 3] represents a method implemented by a master device for defining public parameters according to an embodiment of the invention. This figure details the implementation of steps M100 and M200 previously introduced with reference to [Fig. 2].

[0070] Step M100 allows the master device MST to define the public parameters PP. These PP parameters can be provided to all devices of the system SYS without compromising the security of the latter. The master device MST then generates, during step M200, a public key pkM and a private key skM. We detail below the implementation of these steps.

[0071] During step M100, the master device MST determines the public parameters PP. Specifically, it implements at least steps M110 and M120.

[0072] During step M1 10, the master device MST selects elements {g, h0, ..., hn] from Gl. It also selects an element gi from G1 and an element g2 from G2. All these elements belong to the public parameters PP of the authentication system SYS.

[0073] During step M120, the master device MST selects a signature mechanism S. This can advantageously be the linearly homomorphic mechanism presented above, but other mechanisms could be used. Hereinafter, to designate one of the algorithms of the signature mechanism S, for example the algorithm Keygen, we use S.Keygen notation.

[0074] During step M200, the master device MST obtains a public key pkM and a private key skM. To do this, it implements steps M210 and M220.

[0075] During step M210, the master device MST obtains a public key pk and a private key sk using the algorithm S.Keygen. The public key pk includes in particular the elements gi and g2 belonging to the public parameters PP.

[0076] During step M220, the master device MST obtains a pair of El Gamal keys. More precisely, it obtains: a private key ske formed by an integer between 0 and p-1; and a public key pke = giske. It could alternatively be envisaged to use a pair of keys for a so-called double El Gamal system.

[0077] The master device MST thus obtains the key pair (pkM, skM). The public key pk M includes: the public key pk including in particular the elements gi and g2; and the public key pke. The private key skM includes: the private key sk; and the private key ske.

[0078] Once these steps have been completed, any device intended to provide a transmitter function must register with the master device MST (steps M300 and 1300). We detail such a registration with reference to the following figure.

[0079] [Fig.4] represents a method implemented by a master device and a transmitter device to authorize the transmitter device to certify data of a user device according to an embodiment of the invention.

[0080] During steps 1300 and M300, the ISR transmitter device communicates with the MST master device to register with it. It thus obtains a public key and a private key skb allowing it to certify data of USR user devices. The registration of the ISR transmitter device with the MST master device comprises at least the steps below.

[0081] During step 1310, the ISR transmitter device selects an integer x. This integer is included in the private key sk of the ISR transmitter device. It is therefore secret.

[0082] During step 1320, the transmitter device ISR calculates one or more elements of the form Bx, with B belonging to the public parameters PP. It then sends the element(s) of the form Bx to the master device MST.

[0083] In the first embodiment, the ISR transmitter device sends the element gix to the master device MST. On the other hand, in the second embodiment, the ISR transmitter device sends the elements {gx, hox, ..., hnx] to the master device MST.

[0084] During step M330, the master device MST selects a label t specific to the ISR transmitter device. This may, for example, be an identifier of the ISR transmitter device.

[0085] During step M340, the master device MST determines a signature S for each element Bx received from the transmitter device ISR. It uses the expression: S = S.Sign(sk, (B, Bx), t).

[0086] For the first embodiment, the master device MST obtains during this step: a single signature S on (gi,gp). On the other hand, for the second embodiment, the master device MST obtains: a signature S' on (g, gx); and a plurality of signatures Si relating respectively to (h;, h;x) with 0 <i<n.

[0087] During step M350, the master device MST determines a signature S* = S.Sign(sk, (pke, 1), t). In other words, the signature S* is a signature on the public key pke of the master device MST. The master device MST provides the label t and the signatures S and S* to the transmitter device ISR.

[0088] During step 1360, the ISR transmitter device obtains the public-private key pair (pkb skO, allowing it to certify data. As indicated previously, the private key ski comprises the secret integer x. The public key pk, itself comprises: the label t; the element g2x; the element(s) Bx; and the signatures S and S*.

[0089] Once registered with the master device MST, the transmitter device ISR is able to certify data from a user device USR, by providing it with a CERT certificate (steps 1400 and U400). We now describe the exchanges between the user device USR and the transmitter device ISR to obtain such a CERT certificate.

[0090] [Fig.5] represents a method implemented by a transmitter device and a user device for certifying data of the user device according to an embodiment of the invention. This figure illustrates the implementation of steps U400 and 1400.

[0091] During these steps, the user device USR communicates with the transmitter device ISR to obtain a certificate CERT on a data set {m0, ..., mn} (i.e. a set of attributes). More precisely, the user device USR thus obtains a secret key sku allowing all or part of the data set {m0, ..., mn} to be authenticated.

[0092] As illustrated in [Fig.5], the user device USR and the transmitter device ISR implement at least the steps below.

[0093] During step U410, the user device USR calculates an element H defined by the expression H = g • homO • ... • hnmn. We recall that the elements {g, h0, ..., hn] belong to the public parameters PP.

[0094] During step U420, implemented only in the second embodiment, the user device USR calculates the element Hx using the public key pk! of the transmitter device ISR and the data set {m0, ..., mn}. Note that the user device USR can calculate Hx without knowing the integer x included in the private key ski of the transmitter device ISR. We have in fact: Hx = (g • homO • ... • hnmn)x = (gx) • (hox)mO • ... • (hnx)mn, with {gx, hox, ..., hnx] belonging to the public key pki of the transmitter device ISR.

[0095] During this same step U420, the user device USR also obtains a signature S on the elements (H, Hx). This signature S is obtained using the expression: S = S.Eval(pk, t, S', So, ..., Sn, (1, me, mn)). As previously indicated, S' is a signature on (g, gx) and Si is a signature on (h;, h;x) (see step M340).

[0096] The user device USR then sends the element H to the transmitter device ISR. In the second embodiment, it also sends the element Hx and the signature S.

[0097] During step 1430, the sending device ISR selects an integer y. It then calculates an element A = using the element H received from the user device USR and the integer x included in its private key skb

[0098] During step 1440, implemented only in the second embodiment, the transmitter device ISR calculates the element Ax = (lUU'w' and a signature Su = S.Eval(pk, t, S, l / (x+y)). This signature Su is, by construction, a signature on the elements (H1 / (x+y), (Hx)1 / (x+y))-

[0099] The transmitter device ISR provides the user device USR with a CERT certificate certifying the authenticity of the data set {m0, ..., mn}. This CERT certificate comprises at least the integer y and the element A. For the second embodiment, it further comprises the element Ax and the signature Su.

[0100] During step U450, the user device USR obtains a secret key sku making it possible to prove the authenticity of all or part of the data set {m0, ..., mn}. This secret key sku comprises: the element H; the integer y; and the element A. For the second embodiment, it also comprises: the element Ax and the signature Su.

[0101] The user device USR can use this secret key sku to authenticate all or part of the data set {m0, ..., mn] (step U500). For this purpose, it generates an authentication token TOKu, which we now detail.

[0102] [Fig.6] represents a method implemented by a user device for authenticating data to a verifier device according to an embodiment of the invention. This figure presents the implementation of step U500 of the proposed method.

[0103] Here we consider that the user device USR proves the authenticity of a subset MSG of the data set {m0,...,mn}. It is important to note that this subset MSG can correspond to all or part of the set {m0,...,mn}.

[0104] More particularly, we describe below the proposed solution considering that the MSG subset is {mo,..., rnm] with m < n. Nevertheless, the proposed solution applies of course to any MSG subset of the data set.

[0105] As illustrated by [Fig.6], the user device USR implements at least the steps U510 to U550 below.

[0106] During step U510, the user device USR selects two integer random values ​​r and k. It then calculates a set of so-called authentication elements from the public parameters PP, the secret key skG, and the random values ​​r and k.

[0107] In the first embodiment, the user device USR calculates a ciphertext C i= gik and C2= gf • pkek. It further calculates the elements P\ = (gix)r and P'2 = (g2x)r, raised to the power rx.

[0108] In the second embodiment, the user device USR calculates a cipher Ci = gik and C2 = Ar • pkek. It further calculates the element P = (Ax)r, raised to the power rx.

[0109] During step U520, the user device USR calculates a signature Z from the signatures Su and S*, and the random variables r and k. More precisely, the user device USR obtains the signature Z using the expression: Z = E.Eval(pk, t, Su, S*, (r, k)).

[0110] In the first embodiment, Su corresponds to the signature S on (gi, gix), and S* is a signature on (pke, 1). It follows that the signature Z is a signature on (gir • pkek, girx) = (C2, P'i). The signatures S and S* are both obtained for the same label t specific to the ISR transmitter device and are included in the public key pL of the latter.

[0111] In the second embodiment, Su is a signature on (A, Ax) and S* is a signature on (pke, 1) for the label t. Also, the signature Z is a signature on (Ar- pkek , Arx) = (C2, P'i). The signature Su is included in the secret key sku, while the signature S* is included in the public key pk, of the transmitting device ISR.

[0112] During step U530. implemented only in the first embodiment, the user device USR selects an integer random number v. It then calculates elements Di = Av and D2= Hrv • Di. It should be noted that D2 = Arvx.

[0113] During step U540, the user device USR produces a proof of knowledge ir associated with the elements Cl and C2, the signature Z, and an element H'=g ■ homO ■ ... ■ hmmmoù m <n.

[0114] The proof of knowledge ir proves that the elements Ci and C2 are well formed. It also proves that the signature Z is valid on (C2, P' i) for the label t.

[0115] The proof of knowledge ir is also associated with the element H'. It is appropriate to distinguish two cases depending on whether the user device USR authenticates all or part of the data set {m0, ..., mn}. We recall that the element H=g • homO • h mn ... lln

[0116] Let us first consider that the user device USR authenticates the entire data set {m0, ..., mn}. In this case we have m=n and H'=H. In the first embodiment, the proof ir proves that there exist a and [3 such that: D2' D^3 = H“. In the second embodiment, the proof ir proves that there exist a and [3 such that: C2 pkek ' P'!P = H“.

[0117] Let us now consider that the USR device authenticates only a part of the data set {m0, mn}. In this case we have m <n et H’ • (hm+imm+1 • ... • hnmn) = H. Dans le premier mode de réalisation, la preuve ir prouve qu’il existe a, [3, et {rnm+i, ..., mn] tels que : D2 • DiP = H’“ • (hm+imm+1 • ... • hnmn)“. Dans le deuxième mode de réalisation, la preuve ir prouve qu’il existe a, [3, et {rnm+i, ..., mn] tels que : C2 • pkek ■ py = H’“ • (hm+imm+1 • ... • hnmn)“.

[0118] The proof of knowledge ir can in particular be obtained by using the Schnorr protocol proposed in the document: Schnorr, “Efficient Identification and Signatures for Smart Cards”, Proceedings of Crypto 1989. It could also be envisaged to use the protocol proposed in the document: Groth and Sahai, “Efficient Non-interactive Proof Systems for Bilinear Groups”, Advances in Cryptology -Eurocrypt 2008.

[0119] The authentication token TOKu then comprises: Ci, C2, Z, P' b and ji. In the first embodiment, it further comprises: P'2, Db D2.

[0120] During step U550, the user device USR provides a VRF verifier device with the MSG data subset and the associated authentication token TOKu. It thus proves the authenticity of the MSG data subset to the VRF verifier device.

[0121] The proposed solution ensures that authentication tokens are unforgeable. In other words, a user device cannot prove the validity of data that has not been certified by an issuing device.

[0122] We describe, with reference to the following figure, the steps implemented by the VRF verifier device to verify the TOKu authentication token.

[0123] [Fig.7] represents a method implemented by a verifier device to verify the authenticity of data of a user device according to an embodiment of the invention.

[0124] This figure details the implementation of step V600 introduced with reference to [Fig.2]. To verify the validity of the authentication token TOKG, and therefore the authenticity of the MSG data subset, the VRF verifier device implements at least the steps below.

[0125] During step V610, the VRF verifier device obtains the MSG data subset and the TOKu authentication token provided by the USR user device. Obviously, the VRF verifier device has the public parameters PP and the public key pkM of the MST master device.

[0126] During step V620, the VRF verification device calculates the element H'=g • homO • ... • hmmm. We recall that the elements {g, h0, ..., hm] belong to the pa public PP parameters, and that {m0, mm} denotes the MSG data subset with m <n.

[0127] During step V630, the VRF verifier device verifies the validity of the proof of knowledge ir included in the authentication token TOKu.

[0128] To confirm that the proposed solution works correctly, let us show that the proof ir is valid when the token TOK, is obtained according to the proposed method.

[0129] First, proof ir proves that signature Z is valid on (C2, P'i) for label t. We have previously demonstrated that Z is indeed a signature on (C2, P'i) (see step U520).

[0130] Second, in the first embodiment, the proof ir proves that there exist a and [3 such that: D2' DiP = H“. This is verified for a = rv and [3 = ry by construction of D2. In the second embodiment, the proof of knowledge ir proves that there exist a and [3 such that: C2' pke k P'ip = H“. This equation is verified for a = r / y and [3 = 1 / y. By taking up the definitions of C2, P'i and A, we can show that C2' pke k p'p / y =Ar • Arx / y = A(ry+rx) / y = Hr / y.

[0131] During step V640. implemented only in the first embodiment, the ISR transmitter device checks whether the following two equations are satisfied: a) e(gb P'2) = e(P'j, g2); and b) e(D2, g2) = e(Dj, P'2).

[0132] Also, to confirm the correct functioning of the proposed solution, let us show that these two equations are satisfied when the TOKu token is obtained in accordance with the proposed method.

[0133] On the one hand, P\ and P'2 correspond to the elements gi and g2 raised to the power r ' x (see step U510), which guarantees that equation a) is satisfied. On the other hand, for equation b), we have e(Db P'2) = e(Db g2rx) = e(Arvx, g2) = e(D2, g2), since DI = Av and D2 = Arv x (see step U530).

[0134] If the result of the verification in step V630 is positive, and also that of the verification in step V640 for the first embodiment, then the authentication token TOKu is valid. Otherwise, the authentication token TOKu is considered invalid.

[0135] It should be noted that the VRF verifier device verifies the authenticity of the MSG data subset without using the public key of the ISR transmitter device. It also does not need to know the entire certified data {m0,...,mn] to verify the MSG subset.

[0136] In other words, the user device USR can authenticate only part of the data {mo,..., mn], and this without having to reveal either all of the certified data or the identity of the sending device ISR. The proposed solution makes it possible to preserve the anonymity of the user devices USR and that of the devices SRI issuers.

[0137] The proposed solution applies in particular to the implementation of authentication systems in the field of digital identity. It allows a user to obtain a certificate of his identity from an issuer. He can then prove his identity to a verifier while retaining control over his personal data and without having to reveal the identity of the issuer.

[0138] However, the proposed solution allows the master device MST to lift the anonymity of an ISR transmitter device. We detail below how the master device MST identifies the ISR transmitter device associated with a TOKu authentication token (step M700).

[0139] [Fig.8] represents a method implemented by a master device to identify a transmitter device associated with an authentication token according to an embodiment of the invention.

[0140] For security reasons, for example at the request of the authorities, it may be necessary to find the ISR transmitter device associated with a TOKu authentication token. This can be done by the master device MST, and only this device. To do this, it uses the public keys of the registered ISR transmitter devices, and implements steps M710 and M720.

[0141] During step M710, the master device MST decrypts the elements Ci and C2 included in the token TOKu, using its private key ske. It obtains an element of the form Br, where r is the random number used during the generation of the token TOKu (see step U510).

[0142] Note that only the MST master device can implement this step, since it requires knowledge of the private key ske of the MST master device.

[0143] During step M720, the master device MST performs a test for each of the registered ISR transmitter devices. This test makes it possible to determine whether the ISR device in question is the one associated with the TOKG token. The test uses: the element Br obtained, the element g2 belonging to the public parameters PP, the element P'i included in the TOKu token, and the element g2x included in the public key pk, of the ISR transmitter device in question.

[0144] More precisely, for each ISR transmitter device, the master device MST checks whether the following equation is satisfied: e(Br, g2x) = e(P'i, g2). If the result of this check is positive, the ISR transmitter device including the element g2x in its public key pk, is the one involved in the authentication token TOKu.

[0145] For example, the MST master device may be a server of a national authority. In particular, it could lift the anonymity of certain authentication tokens to ensure that no fraudulent certificates are used.

[0146] The proposed solution having been described in its various aspects, we now evaluate its complexity.

[0147] Tables 1 and 2 are presented below to evaluate the size of an authentication token in different embodiments of the invention. We assume here that the user device USR authenticates the entire data set {m0, ..mn].

[0148] An authentication token TOKG comprises a fixed-size part and a variable-size part. The fixed-size part comprises at least the elements Ci, C2, P'i, i.e., three elements of Gl. For the first embodiment only, the fixed-size part further comprises the elements P'2, Db D2, i.e., two elements of Gl and one element of G2. The variable-size part corresponds to the signature Z and the proof ji, the size of which varies depending on the signature mechanism E used.

[0149] Table 1 describes the number of elements in Z and ir for different embodiments: [Tables 1] S mechanism of Fuchsbauer et al. proposed S mechanism first embodiment 2 Gl, 1 G2 and 5 scalars 1 Gl and 6 scalars second embodiment 2 Gl, 1 G2 and 4 scalars 1 Gl and 5 scalars

[0150] Here we consider that the signature mechanism S corresponds: either to the mechanism described in the document Fuchsbauer et al. (column 1); or to the linearly homomorphic signature mechanism proposed and described above (column 2). Also, the number of elements included in Z and ir is presented by considering the first embodiment (line 1) and the second embodiment of the proposed solution (line 2).

[0151] This table confirms that the proposed linearly homomorphic signature mechanism (column 2) advantageously allows the size of authentication tokens to be reduced.

[0152] Table 2 shows the size in bytes of a TOKu authentication token for the different embodiments considered: [Tables 2] S mechanism of Fuchsbauer et al. proposed S mechanism first embodiment 688 bytes 576 bytes second embodiment 464 bytes 352 bytes

[0153] The different token sizes presented in this table are obtained in the following manner. The bilinear environment is implemented using an elliptic curve, and more precisely the elliptic curve called BLS12-381 and described in the following document: Bowe, “BLS 12-381: New zk-SNARK elliptic curve construction”, 2017, https: / / electriccoin.co / blog / new-snark-curve / . The points of this curve are then compressed using standard techniques known to those skilled in the art.

[0154] We can see that the second embodiment makes it possible to obtain shorter authentication tokens compared to the first embodiment. On the other hand, the first embodiment allows the user device to obtain a certificate by implementing a less complex method (see steps U400 and 1400).

[0155] Compared to the solution of Boboz et al., the proposed solution has minimal implementation complexity. It requires significantly less computation and allows for shorter authentication tokens. The proposed solution thus reduces the amount of data exchanged between a user and a verifier, and the time required to perform authentication. In addition, the proposed solution allows for the anonymity of the issuer to be lifted.

[0156] It should also be mentioned that the proposed solution is advantageously compatible with the aforementioned BBS+ standard.

[0157] [Fig.9] represents an example of hardware architecture of a device according to an embodiment of the invention.

[0158] Here we describe the hardware architecture of an APP device. This description is common to the MST master, ISR transmitter, USR user, and VRF verifier devices. In fact, each of these devices can have this hardware architecture.

[0159] The APP device comprises, according to the embodiment of [Fig.9], at least one processor PROC and at least one memory MEM.

[0160] More particularly, the APP device has, according to one embodiment, the hardware architecture of a computer. The memory MEM constitutes an information medium in accordance with the invention, that is to say readable by the processor PROC and on which is recorded a computer program PROG in accordance with the invention. The program PROG comprises instructions for carrying out steps of a method in accordance with the invention, when the program PROG is executed by the processor PROC. The program PROG defines in particular the functional modules of the APP device, which control the hardware elements of the latter.

[0161] As illustrated in [Fig.9], the APP device comprises a COM communication device configured to communicate with all or part of the other devices of the SYS system. No limitation is attached to the nature of the communication interfaces communication between these devices, which can implement any protocol known to those skilled in the art.

[0162] Generally speaking, for each step (or operation) of a method according to the invention, an MST, ISR, USR, VRF device may comprise a module or a corresponding element configured to carry out said step.

[0163] In particular, the master device MST comprises: a module for determining public parameters PP (step M100); a module for obtaining a public-private key pair (pkM, skM) (step M200); a module for authorizing a transmitter device to certify data (step M300); and a module for identifying a transmitter device ISR associated with an authentication token TOKu (step M700).

[0164] The ISR transmitter device comprises in particular: a module for obtaining a public-private key pair (pkb skO (step 1300); and a module for providing a CERT certificate to a user device (step 1400).

[0165] Also, the user device USR comprises: a module for obtaining a secret key sku, this key sku including in particular a certificate CERT provided by the transmitter device ISR (step U400); and a module for providing an authentication token TOKu (step U500). The verifier device VRF comprises: a module for verifying an authentication token TOKu (step V600).

Claims

Claims

1. Method implemented by a user device (USR) for authenticating a subset (MSG) of a data set ({m0, mn}) with a verifier device (VRF), the user device (USR) having: a secret key (sku) allowing to authenticate all or part of the data set ({m0, mn}), this key (sku) including at least: • an element H calculated from elements ({g, h0, ..hn}) belonging to public parameters (PP) defined by a master device (MST), and from the data set ({mo, mn}); and • a certificate (CERT) provided by an issuing device (ISR) and certifying the authenticity of the data set ({mo, ..., mn}), the certificate (CERT) comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key (8¼) of the issuing device (ISR); and the method comprising: - a provision (U500) of an authentication token (TOKu) of the data subset (MSG), this token (TOKu) comprising at least: • a set of authentication elements (Ci, C2, P' i, P'2, Di, D2) calculated from the public parameters (PP), the secret key (sku) of the user device (USR), and random values ​​r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on a part (pke) of a public key (pkM) of the master device (MST) for a label t specific to the transmitting device (ISR), the signature S* belonging to a public key (pki) of the transmitting device (ISR); and • a proof of knowledge ir associated with the authentication elements (Ci, C2), the signature Z, and a element H' calculated from the elements ({g, h0, ..., hn}) belonging to the public parameters (PP) and the data subset (MSG).

2. Method according to claim 1, wherein: - the set of token authentication elements (TOKu) comprises the elements: Ci=gik; C2 = gir • pkek; P'i = (gix)r; P'2 = (g2x)r; Di=Av; and D2= Hrv- Diry, where gi and g2 belong to the public parameters (PP), gix and g2x belong to the public key (pk^ of the issuing device (ISR), v is a random number, and pk e belongs to the public key (pkM) of the master device (MST); and - the signature Su is a signature on {gi, gp} and the signature S* is a signature on {pke, 1} for the label t, these signatures belonging to the public key (pk^ of the issuing device (ISR).

3. Method according to claim 1, wherein: - the set of authentication elements of the token (TOKu) comprises the elements: Ci=gik; C2= Ar- pkek; and P'i=(Ax)r, where gi belongs to the public parameters (PP), Ax is included in the certificate (CERT) provided by the issuing device (ISR), and pke belongs to the public key (pkM) of the master device (MST); and - the signature Su is a signature on {A, Ax} for the label t and is included in the certificate (CERT) provided by the issuing device (ISR), and the signature S* is a signature on {pke, 1} for the label t.

4. Method implemented by a verifier device (VRF) for verifying the authenticity of a subset (MSG) of a data set ({m0, ..., mn}) of a user device (USR), the method comprising: - a verification (V600) of an authentication token (TOKu) of the data subset (MSG), this token (TOKu) comprising at least: a set of authentication elements (Ci, C2, P' i, P'2, Db D2) calculated from public parameters (PP) defined by a master device (MST), a secret key (sku) of the user device (USR), and random values ​​r and k; a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on a part (pke) of a public key (pkM) of the master device (MST) for a label t specific to the issuing device (ISR), the signature S* belonging to a public key (pk^ of the issuing device (ISR); and a proof of knowledge ir associated with the authentication elements (Ci, C2), the signature Z, and an element H' calculated from elements ({g, h0, ..., hm}) belonging to the public parameters (PP), and the data subset (MSG); and in which: - the verification (V600) of the token (TOKu) comprises at least: a verification (V630) of the validity of the proof of knowledge ir using the set of authentication elements (Cb C2, P'b P'2, Db D2), the signature Z, and the element H'.

5. Method implemented by a transmitter device (ISR) for certifying a set of data ({mo, ..., mn}) of a user device (USR), the transmitter device (ISR) having: - a public-private key pair (pkb sk^ including at least: • for the private key (sk^: a scalar x; and • for the public key (pk^: a label t specific to the issuing device (ISR); and a signature S* provided by a master device (MST), S* being a signature on a part (pke) of a public key (pkM) of the master device (MST) for the label t; and the method comprising: - a supply (1400) to the user device (USR) of a certificate (CERT) certifying the authenticity of the data set ({m0, mn}), this certificate (CERT) comprising at least less : • a random y; and • an element A calculated from an element H, the scalar x, and the random number y, the element H being calculated from elements ({g, h0, ..hn}) belonging to public parameters (PP) defined by the master device (MST) and the data set ({m0, • mn}).

6. Method implemented by a master device (MST) for authorizing a transmitter device (ISR) to certify a data set ({m0, ..mn}) of at least one user device (USR), the master device (MST) defining public parameters (PP), and the method comprising: - a supply (M300) to the transmitting device (ISR) of elements (t, S, S*) of a public key (pkO of the transmitting device (ISR), these elements (t, S, S*) comprising at least: • a label t specific to the emitting device (ISR); and • a signature S* on a part (pke) of a public key (pkM) of the master device (MST) for the label t and obtained using a private key (skM) of the master device (MST).

7. Method according to claim 6, comprising an identification (M700) of a transmitter device (ISR) associated with an authentication token (TOKu) of a user device (USR), the identification (M700) comprising: - a decryption (M710) of encrypted authentication elements (Ci, C2) included in the token (TOKu) to obtain an element Br, where r is a random number used to generate the token (TOKu), this decryption (M710) being carried out using a part (ske) of the private key (skM) of the master device (MST); and - a check (M720) to determine whether the issuing device (ISR) is associated with the authentication token (TOKu) using: the obtained Br element; a g2x element included in the public key (pk^ of the issuing device (ISR), x a scalar belonging to a private key (sk^ of the issuing device (ISR); a P' i element included in the authentication token (TOKu); and a g2 element belonging to the public parameters (PP).

8. A method according to any one of claims 1 to 7, wherein a bilinear environment is used, said environment denoting a group Gl, a group G2 and a group GT of order p, and a bilinear coupling, and wherein a said signature o on a set of elements {u0, ..., un} of Gl for a label r is obtained using the expression: o = (uobO • • unbn)1 / (“+T', where the scalars {a, b0, ..., bn} belong to a private key.

9. A so-called user device (USR) configured to authenticate a subset (MSG) of a data set ({mo, ..., mn}) with a verifier device (VRF), the user device (USR) comprising: - a secret key (sku) allowing all or part of the data set ({m0, ..., mn}) to be authenticated, this key (sku) comprising at least: • an element H calculated from elements ({g, h0, ..., hn}) belonging to public parameters (PP) defined by a master device (MST), and from the data set ({mo, ..., mn}); and • a certificate (CERT) provided by an issuing device (ISR) and certifying the authenticity of the data set ({mo, ..., mn}), the certificate (CERT) comprising at least: a random number y; and an element A calculated from the element H, the random number y, and a scalar x belonging to a private key (8¼) of the issuing device (ISR); and - a module for providing an authentication token (TOKu) of the data subset (MSG), this token (TOKu) comprising at least: a set of authentication elements (Ci, C2, P'i, P'2, Di, D2) calculated from the public parameters (PP), the secret key (sku) of the user device (USR), and random numbers r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on a part (pke) of a public key (pkM) of the master device (MST) for a label t specific to the transmitting device (ISR), the signature S* belonging to a public key (pki) of the transmitting device (ISR); and • a proof of knowledge ir associated with the authentication elements (Ci, C2), the signature Z, and an element H' calculated from the elements ({g, h0, ..., hn}) belonging to the public parameters (PP) and the data subset (MSG).

10. A so-called verifier device (VRF) configured to verify the authenticity of a subset (MSG) of a data set ({m0, ..., mn}) of a user device (USR), the verifier device (VRF) comprising: - a module for verifying an authentication token (TOKu) of the data subset (MSG), this token (TOKu) comprising at least: • a set of authentication elements (Ci, C2, P' i, P'2, Di, D2) calculated from public parameters (PP) defined by a master device (MST), a secret key (sku) of the user device (USR), and random values ​​r and k; • a signature Z calculated from the random variables r and k, a signature Su, and a signature S* on a part (pke) of a public key (pkM) of the master device (MST) for a label t specific to the transmitting device (ISR), the signature S* belonging to a public key (pki) of the transmitting device (ISR); and • a proof of knowledge ir associated with the authentication elements (Ci, C2), the signature Z, and an element H' calculated from elements ({g, h0, ..., hm}) belonging to the public parameters (PP), and the data subset (MSG); and in which: - the verification module is configured at least to: verify (V630) the validity of the proof of knowledge ir using the set of authentication elements (Ci, C2, P'i, P'2, Di, D2), the signature Z, and the element H'.

11. Device called transmitter (ISR) configured to certify a set of data ({m0, mn}) of a user device (USR), the transmitter device (ISR) comprising: - a public-private key pair (pkb 8¼) comprising at least: • for the private key (8¼): a scalar x; and • for the public key (pk^: a label t specific to the issuing device (ISR); and a signature S* provided by a master device (MST), S* being a signature on a part (pke) of a public key (pkM) of the master device (MST) for the label t; and - a module for providing the user device (USR) with a certificate (CERT) certifying the authenticity of the data set ({m0, ..., mn}), this certificate (CERT) comprising at least: • a random number y; and • an element A calculated from an element H, the scalar x, and the random number y, the element H being calculated from elements ({g, h0, ..., hn}) belonging to public parameters (PP) defined by the master device (MST) and the data set ({m0, mn}).

12. So-called master device (MST) configured to authorize a transmitter device (ISR) to certify a set of data ({m0, ..., mn}) of at least one user device (USR), the master device (MST) being configured to define public parameters (PP) and comprising: a module for providing the transmitting device (ISR) with elements (t, S, S*) of a public key (pk^ of the device transmitter (ISR), these elements (t, S, S*) comprising at least: • a label t specific to the transmitter device (ISR); and • a signature S* on a part (pke) of a public key (pkM) of the master device (MST) for the label t and obtained using a private key (skM) of the master device (MST).

13. System (SYS) comprising several devices among: - a user device (USR) according to claim 9; - a verifier device (VRF) according to claim 10; - a transmitter device (ISR) according to claim 11; and - a master device (MST) according to claim 12.

14. Computer program (PROG) comprising instructions for implementing steps of a method according to any one of claims 1 to 8, when the computer program (PROG) is executed by at least one processor (PROC).

15. Computer-readable information medium (MEM) comprising a computer program (PROG) according to claim 14.

Images