METHOD AND DEVICE FOR INDEMNABLE DISCLOSURE

Abstract

A deniable zero-disclosure proof method (100), implemented by a computer system (10) comprising a first (10-1) and a second (10-2) electronic device, said two electronic devices each comprising a processing unit (11) cooperating with a data memory (12) and means of communication (15) with the outside world, the method (100) comprising a phase (110) of generating and publishing general parameters and public and private keys of a zero-disclosure proof protocol and a phase (120) of verifying the knowledge of sk by the first electronic device (10-1). [Fig 1]

Description

Title of the invention: Title of the invention METHOD AND DEVICE FOR NULL DENIABLE DISCLOSURE

[0001] The invention relates to the field of cryptology.

[0002] More specifically, the invention relates to zero-disclosure proof methods. The invention further relates to any computer system comprising a plurality of electronic devices each comprising a central processing unit controlling a memory by signals, as well as an input unit and an output unit, implementing any of said methods (1) for generating parameters and generating keys, (2) for deniable proof of knowledge of secret protocol. One of the preferred fields of application of such an invention relates to secure communications between electronic devices of such a computer system.

[0003] A clear description of the invention requires the introduction of notations and a reminder of concepts known to those skilled in the art, in particular the concept of "zero disclosure proof" ("ZDPs") and in particular S-protocols, which are a particular class of ZDPs. The Fiat-Shamir protocol will be used in a non-limiting manner as an example to illustrate the invention.

[0004] Other common and useful notations used in this document are given in the following table:

[0005] [Tables 1] Notation Meaning Mathematical identity: = Definition of relation <— Assignment of a value to a variable H(nï) A cryptographic hash function 2g Ring of integers modulo q > 0 2g Zq devoid of element 0 (^b The concatenation of the binary numbers cl and b. a® b Result of the “exclusive or” between the binary strings a and b

[0006] ZERO DISCLOSURE PROTOCOLS

[0007] The invention belongs to the broad category of asymmetric cryptographic methods also known as “public key cryptographic methods”.

[0008] These include protocols known as “zero disclosure proof protocols”. ("PDNs") allowing communication in which an entity, called "the prover", designated by the reference S (10-1), proves knowledge of a secret sk to an entity V (10-2) called "the verifier" which verifies knowledge of the secret sk by S (10-1). Said entities V (10-2) and S (10-1) do not share any common private key a priori.

[0009] A method for constructing PDNs uses what are called 27-protocols (so named because of the communication in three exchanges which is reminiscent of the Greek letter Sigma), ^-protocols is an interactive protocol between a prover and a verifier involving three exchanges: • A commitment (or the “pledge”) which is a first message x sent by the prover to verifier; • The challenge, which is a question sent by the verifier; • The response^', which is the last message sent by the prover. ? allows to answer question c in relation to commitmentx.

[0010] Multiple proofs without knowledge disclosure are based on this construction, for example the Fiat-Shamir, Schnorr, or Guillou-Quisquater protocols which will be discussed later.

[0011] Understanding the prior art and the invention requires recalling the concept of “commitment function” (the French term “de mise en gage” is also used to designate this concept).

[0012] In cryptology, pledge is a process that allows a person to "pledge" a value (or statement) while keeping it hidden from others, with the possibility of revealing this value later by proving that it was indeed the value that was pledged. The pledge is designed so that the person is bound to the pledged value.

[0013] In practice, pledging is done by calculating a pledge value from the value that one wants to hide and communicating this pledge value to a recipient. Subsequently, when the originally hidden value is communicated to the recipient, the latter will be able to verify that the value that was revealed to him is indeed the value that was used to calculate the pledge value. More formally, pledging transforms a value m into a pair (c, d) such that: • 1) c does not reveal any information about m, but that, • 2) together, c and d allow us to reveal m, and that • 3) it is impossible to find such that (c, dr) reveals m * m.

[0014] In practice, in many scenarios, it is possible simply to communicate a hash H(nï) as a commitment because revealing m subsequently allows anyone to recalculate H(mf This practice, however, suffers from a weakness: if the entropy of m is low, an attacker could find m by exhaustive search from H(m). For example, if m is a word in everyday French, a An exhaustive search of the 32,000 words of everyday French will reveal m. In order to protect against such an attack, it is usual to commit to where r is a large random number (for example, 160 bits) and then to reveal, when opening the commitment, the data m and r. The commitments used in the present invention are assumed to implicitly use this implementation, which is obvious to those skilled in the art. We will generically denote Eng(m) (without mentioning the random number r, the use of which is implicit) a commitment on a message m. The verification of Eng(m) will be generically denoted Opener?, Eng(m)) (still without mentioning the random number r, the use of which is implicit). The procedure Open returns a boolean depending on whether the opening was successful or not.

[0015] Asymmetric cryptography defines two keys: a public key pk known to all, including V (10-2) and a private key sk kept confidential by the prover 5 (10-1). This property is also true for PDNs.

[0016] A PDN has two phases: a key and parameter generation algorithm Gen and the identification protocol Pro.

[0017] The key and parameter generation algorithm Gen allows said prover 5 (10-1) to generate the keys pk and sk and the parameters necessary for the operation of the PDN (these parameters being subsequently noted “P*11”). Gen is assumed to be accessible to all and public.

[0018] Phase Pro allows said prover 5 (10-1) to prove knowledge of the secret sk. Pro is also assumed to be accessible to all and public.

[0019] A computer program whose program instructions cause the implementation of the Gen and Pro algorithms may be implemented by any computer or electronic device arranged to record said computer program in a memory. Programs encoding the Gen and Pro algorithms may be published without any concern for the security of said communication.

[0020] Thus, the prover entity S (10-1) can prove its knowledge of sk to any verifier entity V (10-2). The verifier V (10-2) uses the public key pk of the prover 5 (10-1) to ensure that S (10-1) knows sk in a way that does not allow V (10-2) to learn any information about sk. Only the prover S (10-1) will be able to prove knowledge of sk with respect to the public key pk.

[0021] In a PDN, the prover 5 (10-1) uses a random SS when participating in the protocol Pro. The verifier V (10-2) also uses a random SS' when participating in the protocol Pro.

[0022] In order not to make the notations cumbersome, we do not note the implicit fact that the prover 5 (10-1) and the verifier V (10-2) have access to Pai and use the data Par during their interactions.

[0023] Similarly, we assume that the drawing of PP random numbers necessary for the production of {pk, sk} by Gen is an internal detail of the Gen algorithm and is thus implicitly included in the Gen notation.

[0024] Said public key pk and private key sk are generated using a probabilistic algorithm Gen called "parameter generation algorithm" and a probabilistic algorithm called "key generation algorithm" which will be discussed later. Often, the parameter generation and key generation algorithms are merged into a single algorithm. In the context of the present invention, the separation of Gen into two phases has no relevance, thus, for the sake of clarity, the two phases will subsequently be merged into a single algorithm denoted Gen.

[0025] For example, a famous PDN is the so-called Fiat-Shamir algorithm described in the US patent US4748668A by A. Fiat and A. Shamir, entitled "Method, apparatus and article for identification and signature" and in the article published by U. Feige, A. Fiat and A. Shamir and entitled "Zero-knowledge proofs of identity", Journal of Cryptology,^ 1988 and in the article published by A. Fiat and A. Shamir entitled "How To Prove Yourself: Practical Solutions to Identification and Signature Problems", Crypto 1986,❖ 1986.

[0026] A second example of PDN is the Guillou-Quisquater algorithm described in US patent US 7680271B2 by L. Guillou and J.-J. Quisquater entitled “Zero-knowledge proof cryptography methods and devices” published by L. Guillou and J.-J. Quisquater, in the article entitled “A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory”, Eurocrypt,^ 1988.

[0027] A third example of PDN is the Schnorr algorithm, described in US patent US 4995082A by C.-P. Schnorr entitled “Method for identifying subscribers and for generating and verifying electronic signatures in a data exchange System” published by C.-P. Schnorr, in the article entitled “Efficient Identification and Signature for Smart Cards”, Theory and Application of Cryptology, Springer,❖ 1989.

[0028] Most current PDNs are based on algorithms that integrate difficult problems from number theory, such as factorization or discrete logarithm computation. Designed in 1987, the Fiat-Shamir protocol mentioned above is the precursor to almost all modern PDNs. According to the Fiat-Shamir PDN, each prover S(10-1) has a public key pk:={n, e, v3, ..., vk} and a private key sk^^q, ..., ^}. The number n ■ ~ PC1 is the product of two large prime numbers. The private key sk:={5q, ..., .¾} is defined by the relation Yp-'i — 1 niod n and is derived from the prime factors of n. The random variables used to generate these parameters and keys are provided by PP.

[0029] During the Pro phase, to prove its knowledge of sk, S (10-1) generates from SS a random number r and sends to V (10-2) a commitment x = re mod n.

[0030] V (10-2) replies with a random challenge 6 composed of k digits c := C]|cj... |q in base e (in other words 0 < < e- 1). c is generated from SS'.

[0031] S (10-1) replies with the answer _ rice c,

[0032] The verifier V (10-2) verifies the knowledge of the secret sk by 5 (10-1) thanks to the test x = mod n '

[0033] Indeed, if the S (10-1) and V (10-2) follow the specifications we have:

[0034] All the data used in these calculations are presented in the form of large numbers.

[0035] Often the value taken for e is 2 but other integer values ​​of e can be used.

[0036] The Fiat-Shamir PDN gives rise to numerous variants and optimizations known to those skilled in the art. These variants make it possible in particular to reduce the size of x or of the vt or to reduce k by repeating the protocol once in order to achieve a security level of 2"rk- The security level expresses the probability that an entity not knowing sk can still pass the protocol and convince E (10-2) that it holds sk.

[0037] Most PDNs rely on a similar three-pass exchange protocol consisting of successively exchanging data A' C 3' between the parties. The definition of these G 3' varies depending on the underlying hard problem of PDN security but the three-pass communication scheme remains the same. As mentioned before, this family of PDNs is usually referred to by the generic term "E-protocols".

[0038] There are PDNs with more than three passes but the techniques described in the present invention extend trivially and obviously to these protocols as well.

[0039] THE RSA SIGNATURE ALGORITHM

[0040] For example, a famous digital signature algorithm is the so-called RSA algorithm described in US patent US 4,405,829 and in the associated publication RL Rivest, A. Shamir, and LM Adleman, “A Method for Obtaining Digital Signatures and Public-key CryptoSystems”, Communications of the ACM, volume 21, no. 2, pages 120 to 126, 1978.

[0041] Most current digital signature techniques rely on algorithms that incorporate difficult problems from number theory, such as factorization or discrete logarithm calculation. Designed in 1976, the previously mentioned RSA signature is the precursor to almost all modern signature schemes, according to which each signer S(10-1) has a public key pk:= {n, E} and a private key sk: — D. The number n • = PQ is the product of two large prime numbers. To sign a message m from this signer S (10-1), the data m of said message are encoded in the form of a large integer and mathematically mixed using the private key sk: —D corresponding to the public key pk := {n, E} belonging to said signer 5 (10-1) this mixing is carried out by the relation .S' : = mod n. The verifier V (10-2) which receives said message m and its signature 5 can then verify the signature 5 using the public key pk. This verification is carried out by comparing m to the value sE mod n. In the RSA signature, the public key pk is therefore presented in the form of a large composite number n, and an exponent E, often equal to three. The private key sk : = D, equal to the modular inverse of E modulo (p - 1X<7 - 1), is derived from the prime factors of n.

[0042] DISADVANTAGES OF THE STATE OF THE ART

[0043] E-protocols have a major drawback: if V(10-2) behaves dishonestly, it can keep track of its interaction with S(10-1) and thus no longer allow 5(10-1) to deny the interaction. Such deniability is particularly desirable in many scenarios.

[0044] Consider for example the doctor's card reader V (10-2) interacting with a patient's contactless card 3' (10-1) to obtain an anonymous prescription for methadone (methadone is a substitute for the drug heroin). The cardholder has the right to obtain methadone, however, for reasons of medical confidentiality, he does not want to leave any evidence of the interaction with doctor V (10-2) and to be able to deny such interactions in the future. A PDN meets, at first glance, this need perfectly: doctor V (10-2) obtains the assurance that patient S (10-1) is entitled to care while patient 5 (10-1) leaves no trace after the consultation. Note that the card given to the patient does not need to be anonymous: it could identify the patient visually or electronically (for example with a PIN code, a photo or a fingerprint) but leaves no trace with the doctor.

[0045] Unfortunately, a doctor wishing to collect proof of interaction with the patient's card could do so if k is sufficiently long. To do this, he simply needs to take any hash function H and derive from it an artificially slowed hash function H. To slow down the function H, the doctor could, for example, iterate H over its input u times, for a sufficiently large value of u. In other words, H '(%) = ... ). The computation time for H ' is is thus slowed down by a factor of 11.

[0046] During the PDN, the patient-prover 5 (10-1) sends x. The doctor-verifier V (10-2) can then derive the challenge c from H '(x), for example by drawing the digits c> constituting c in H\x). The answer 3' produced by 5 (10-1) would then be undeniable because it demonstrates the participation of the prover S(10-1) in the PDN.

[0047] The reason for this flaw is the probability P^W) that a V (10-2) investing a workload wu can falsely claim that S (10-1) participated in the session (while 5 (10-1) did not). A calculation obvious to those skilled in the art demonstrates that this probability is worth p / • ) — ] ( ] 1 \ n • k V / I qA j

[0048] As a numerical application, let M = 240 and k = 40. A V (10-2) wishing to falsely claim, with a success probability of 1 / 2, that 5 (10-1) participated in a session would have to perform w = 7.6 x 1011u — 239'5u = 279'5 hash operations. Since this effort is impractical, this clearly links the S (10-1) to the PDN trace.

[0049] With u — 245 and k — 20. A V (10-2) wishing to falsely claim, with a success probability of 1 / 2, that 5 (10-1) participated in a session would have to perform w = 726817m — 219'3 xu — 264'3 hash operations which, again, is an inordinate effort clearly linking 5 (10-1) to the PDN trace.

[0050] If k is large (for example k = 80) there is no longer any need to slow down H. Indeed - in this configuration we obtain a certainty of 280 that 5 (10-1) participated in the PDN.

[0051] DESCRIPTION OF THE INVENTION

[0052] The invention addresses the drawbacks raised by the state of the art which have just been explained.

[0053] In order to adopt a concise and clear notation, we note:

[0054] [Tables2] Notation Meaning by The PDN system parameters pk The public key of said prover 5 (10-1) sk The private key of said prover S (10-1) r A random value generated by said prover 5 (10-1) X A commitment generated by said prover S (10-1) c A challenge generated by said verifier V (10-2) y The response to challenge c generated by said prover S (10-1)

[0055] [Tables3] Notation Meaning S (10- 1) The prover Goal of 5 (10-1): prove to V (10-2) that he knows sk. V(10-2) The verifier Goal of V (10-2): verify that 5 (10-1) knows sk.

[0056] The invention further defines a security level parameter k. This parameter will typically be in the range 20 < k < 80.

[0057] We consider the following inventive scenario named PDNN (for "Proof of Denialable Zero Disclosure") in which a prover 5 (10-1) proves its knowledge of a secret sk to a verifier V (10-2). A PDNN comprises two successive processes, respectively:

[0058] (1) the Gen' process of generating general parameters and generating keys private and public of prover 5 (10-1), the latter being published. This Gen' process is identical to the prior art Gen process.

[0059] (2) the process Pro' of proof of knowledge of sk by the prover 5 (10-1) to the attention of the auditor V (10-2). This process Pro' differs from the prior art process Pro.

[0060] These two successive processes, which will be described later in the form of methods 110, 120, in connection with FIGS. 2 and 3, respectively implement two algorithms previously designated by the terms Gen' and Pro'. These algorithms consist of the following sequence of steps: - Gen' ; Said prover S (10-1) sets the security level k, generates general parameters, denoted P31, necessary for the operation of the PDNN. Then said prover 5 (10-1) generates a private key sk kept confidential and a public key pk published, as summarized by the relation {par, sk, pk] *- Gen' ; Said verifier V (10-2) receives and records the data {par, pk] necessary for the operation of the PDNN; As explained before, this process does not differ in any way from a standard key and parameter generation method of a classic PDN. Pro' ; • The said prover 5 (10-1), wishing to prove his knowledge of the secret sk begins by requesting from V (10-2) a commitment Eng( <j sur le défi c que v (10-2) souhaite utiliser plus tard. • The verifier P (10-2) generates a random challenge c, computes a commitment Eng(c) and communicates Eng(c) to the prover S (10-1). • It is only after receiving Eng(c) that the prover S (10-1) generates its own commitment of the E-protocol (denoted x) and sends x to the verifier V (10-2). • Verifier V (10-2) reveals to prover the challenge c. • The prover S (10-1) verifies the commitment Eng(c) by the process Open(c, Eng(c)) and conditions the continuation of the exchanges by the success of the Open algorithm. • If the previous step did not cause an interruption of the PDNN, the prover S (10-1) replies with the response y that the verifier V (10-2) verifies in order to accept (or not) prover S (10-1). Thus it appears that the PDNN process differs from a PDN in two essential characteristics:

[0061] 1. A commitment Eng(c) at the start of the protocol by the verifier V (10-2) on the challenge c which will be used later.

[0062] 2. A verification in the middle of the protocol by the prover 5 (10-1) of the correctness of the commitment Eng(c) of the verifier V (10-2) on the challenge c and the conditioning of the sending of the response y by the correctness of the commitment Engfcj of the verifier V (10-2) on the challenge c.

[0063] In the specific case of Fiat-Shamir, this protocol becomes:

[0064] The generation of keys in the case of a Fiat-Shamir PDNN is identical to the classic Fiat-Shamir, so we will not detail it again.

[0065] During the Pro phase: • V (10-2) generates from SS' a random challenge c composed of k digits C := cjcj ... in base e (in other words 0 < q < e - 1). V (10-2) prepares a commitment on c denoted Eng(c) and communicates Eng(c) to the prover S (10-1). • S (10-1) generates from SS a random number r and communicates to V (10-2) a commitment x = re mod n. • V (10-2) replies with c • S(10-1) checks the consistency between c and Eng(c). If Eng(c) is not a valid commitment on c, S(10-1) interrupts the protocol. If Eng(c) is a valid commitment on c, S(10-1) communicates to V(10-2) the response r P e , y == rl 1 ,57 mod n • V (10-2) checks the knowledge of the secret sk by 5 (10-1) using the test x = yTl*^7 modfl '

[0066] Among the numerous advantages provided by the present invention, we can mention that: - The verifier V (10-2) acquires the certainty that S (10-1) does indeed have the secret sk but cannot collect any proof of its interaction with S (10-1); - A PDNN according to the invention is particularly optimized and efficient since the algorithms implemented within the framework of the invention require few operations to memorize and execute the two algorithms Gen', Pro', thus combining high execution performance and preservation of the storage capacity of the equipment implementing the PDNN. In addition, the number of code instructions necessary to implement the invention in software or the number of logic gates necessary to implement the invention in hardware are very low; - The RAM required for the execution of said algorithms constituting PDNN is also low compared to the prior art, thus preserving the resources of said equipment implementing a PDNN according to the invention; - The bandwidth required for exchanges between equipment implementing a PDNN according to the invention is also low. - Finally, the embodiment of the PDNN proposed in the present invention makes the PDNN perfectly compatible with standard PDNs and is added as a high layer on top of them. In the specific case of RSA, this protocol becomes: - Gen' ; Said prover S (10-1) generates a published RSA public key pk = {n, E} and a confidential RSA private key sk : = D, as summarized by the relation {par, sk, pk} Gen ; Said verifier V (10-2) receives and records the data pk necessary for the verification of signatures generated by 5 (10-1); As explained before, this process does not differ in any way from a standard key and parameter generation method of a classic PDN. - During the Pro phase; • V (10-2) generates from SS' a random challenge c. V (10-2) prepares a commitment on c noted Eng(c) and communicates Eng(c) to the prover 5 (10-1). • 5 (10-1) generates from SS a random ? and communicates to V (10-2) an in pledge x = Eng(r). • V (10-2) replies with c • 5 (10-1) checks the consistency between c and Eng(c). If Eng(c) is not an en valid commitment on c, 5 (10-1) interrupts the protocol. If Eng(c) is a valid commitment on c, S (10-1) communicates to V (10-2) the response y := b' r yj := (u ( r ® c )D mod n} • • V (10-2) verifies knowledge of the secret sk by 5 (10-1) using the test y = mod n-

[0067] Obviously Exclusive Fool (operator ® ) can be replaced by a variety of other functions allowing to combine r and (.

[0068] From a theoretical and practical point of view, a great advantage of the invention lies in the fact that unlike a classic zero-disclosure proof in which (if k is large or if an artificial slowdown of the hashing takes place) the verifier V(10-2) can collect a proof of interaction. With the PDNN this threat disappears.

[0069] To this end, the invention firstly provides a PDNN method, said method being implemented by a computer system comprising first and second electronic devices, said first and second electronic devices each comprising a processing unit cooperating with a data memory and means of communication with the outside world, said first electronic device 5 (10-1) being designed to prove that it contains a secret sk to said second electronic device, V (10-2) said PDNN method (100) comprising: • A step Gen' of generating and publishing general parameters and generating a pair {sk, pk] of private and public keys, as well as publishing said public key pk and the data Pai. This step is implemented by said first electronic device 5 (10-1); Said general parameters P*11 and said public key pk being possibly produced from random data PP produced by a random number generator (13) of said first electronic device S (10-1); • A Pro' signature step consisting of the following steps: - Said prover S (10-1), wishing to prove his knowledge of the secret sk, begins by requiring from V (10-2) a commitment Eng(c) on the challenge c that V (10-2) wishes to use later. - The verifier generates a random challenge c, computes a commitment Eng(c) and communicates Eng(c) to the prover 5 ( 10-1 ). - It is only after receiving Eng(cj that the prover S (10-1) generates its own commitment of the E-protocol (denoted x) and sends x to the verifier V (10-2). - The verifier V (10-2) reveals to the prover S (10-1) the challenge c. - The prover S (10-1) verifies the commitment Eng(c) by the process Open(c, Eng(c)) and conditions the continuation of the exchanges by the success of the Open algorithm. - If the previous step did not cause an interruption of the PDNN, the prover 5 (10-1) replies with k which the verifier V (10-2) verifies.

[0070] EMBODIMENT

[0071] According to the embodiment of a PDNN according to the invention: • The Gen' algorithm for generating and publishing general P&1 parameters is strictly compliant with that of the underlying PDN chosen (for example Fiat-Shamir); In this embodiment this substep will make use of the random data PP of the device 5 (10-1). This substep also includes (for the device S (10-1)) the generation of a pair {sk, pk] of private and public keys. • The Pro' algorithm for proof of knowledge of the secret sk includes the following steps: - Said prover 5 (10-1), wishing to prove his knowledge of the secret sk, begins by requiring from V (10-2) a commitment Eng(c) on the challenge c that V (10-2) wishes to use later. - The verifier generates a random challenge c, computes a commitment Eng(c) and communicates Eng(c) to the prover 5 (10-1). - Only after receiving Eng(c) does prover 5 (10-1) generate its own commitment of the E-protocol (denoted x) and send x to verifier V (10-2). - Verifier V (10-2) reveals to prover 5 (10-1) the challenge c. - The prover S (10-1) verifies the commitment Eng(c) by the process Open(c, Eng(c)) and conditions the continuation of the exchanges by the success of the Open algorithm. - If the previous step did not cause an interruption of the PDNN, the prover 5(10-1) replies with y which the verifier V(10-2) verifies. Advantageously, we will typically take for k a value between 10 and 80 bits. The security level is then 2'*.

[0072] According to a second object, the invention relates to a storage medium readable by a computer comprising the instructions of such a computer program product.

[0073] According to a third object, the invention relates to a computer system comprising a plurality of electronic devices each comprising a processing unit and a memory, said memory of each of said electronic devices comprising the program instructions of a computer program product in accordance with the invention.

[0074] Other characteristics and advantages will appear more clearly on reading the description which follows and on examining the figures which accompany it, among which:

[0075] [Fig.l] illustrates an example of a computer system comprising a plurality of electronic devices implementing a PDNN method according to the invention;

[0076] [Fig.2] illustrates an example of a functional method Gen' for producing general parameters and generating public and private keys implemented by any electronic device of a computer system in accordance with the invention;

[0077] [Fig.3] illustrates an example of a functional method Pro' for proof of knowledge of a private key sk implemented by any electronic device of an in- computer software in accordance with the invention;

[0078] According to particular characteristics, it will be possible to carry out any of the precedents (1) Gen' of parameter generation and key generation, (2) Pro' of proof of knowledge of secret sk succinctly set out above in the context of an electronic circuit.

[0079] Such an electronic circuit could, for example, be made up of a microprocessor, a programmed circuit (called FPGA “Field Programmable Gate Array”) or a hard-wired logic chip (called ASIC “Application Specified Integrated Circuit”)•

[0080] The invention also relates to an irremovable, or partially or totally removable, data storage means comprising computer program code instructions for executing the steps of any of the methods (1) Gen' of parameter generation and key generation, (2) Pro' of proof of knowledge of secret sk, in accordance with the invention. The invention also relates to a computer program downloadable from a communication network and / or stored on a computer-readable medium and / or executable by a microprocessor comprising the program instructions which, when executed by the computer or the microprocessor, cause the implementation of a PDNN in accordance with the invention.

[0081] This computer program is remarkable in that it comprises instructions for executing the steps of any of the methods (1) Gen' of generating parameters and generating keys, (2) Pro' of proving knowledge of secret sk, set out above, when executed on a computer or in a microprocessor. Other aspects and advantages of the invention will become apparent upon reading the detailed description below of particular embodiments, given as non-limiting examples.

[0082] We will now illustrate the concept of constructing a PDNN system according to the invention.

[0083] In other words, we will show how to construct the PDNN algorithm that will be used to prove knowledge of a secret sk according to the invention. It will be noted that the choice of functions or numerical values ​​in the examples included is essentially aimed at simplicity of the presentation, and does not claim to reflect advantageous values ​​in terms of a practical implementation of the invention.

[0084] As indicated above, the present invention also relates to a computer system comprising a plurality of communicating electronic devices implementing any one of the methods (1) Gen' of parameter generation and key generation, (2) Pro' of proof of knowledge of secret sk, described above.

[0085] As indicated in [Fig.l], this computer system 1 comprises a plurality of electronic devices of which only two are shown for the sake of clarity: 10-1 (the prover) and 10-2 (the verifier). Conventionally, each electronic device consists of an instance of an electronic device 10 comprising a central processing unit 11 controlling, by signals conveyed by a communication bus symbolized in [Fig.l] by double arrows in single lines, electronic elements including a data memory 12 and a program memory 14, said memories 12 and 14 possibly forming a single physical entity. Such an electronic device 10 may comprise a random number generator 13, the latter possibly forming a single physical entity with said processing unit 11.

[0086] The term "memory" means any computer memory, whether volatile or not. A non-volatile memory is a computer memory whose technology retains its data in the absence of an electrical power supply. It may contain data resulting from inputs, calculations, measurements and / or program instructions. The main non-volatile memories currently available are electrically writable such as EPROM technology ("Erasable Programmable Read-Only Memory") or electrically writable and erasable such as EEPROM technology ("Electrically-Erasable Programmable Read-Only Memory"), flash, SSD ("Solid-State Drive"), etc. Non-volatile memories are distinguished from so-called "volatile" memories whose data is lost in the absence of an electrical power supply.The main volatile memories currently available use RAM (Random Access Memory), DRAM (dynamic RAM, requiring regular updating), SRAM (static RAM requiring such updating when there is a power shortage), DPRAM or VRAM (particularly suitable for video), etc.

[0087] An electronic device 10 further comprises means 15 for communication with the outside world in the form of an input unit and an output unit. Said communication means 15 cooperate with the processing unit 11 and provide wireless or wired proximity communication with any other electronic device of said computer system 1. In order to operate, i.e. for the processing unit 11 to implement a method according to the invention, an electronic device 10 generally comprises a source of electrical energy 16 in the form of one or more batteries for example. Such a source of electrical energy 16 may be internal or external to said electronic device 10. The processing unit 11 may also comprise means 17 for controlling an input and / or output human-machine interface 20. Throughout the document, the term “Output human-machine interface” means any device, used alone or in combination, for outputting or delivering a graphic, haptic, audio or, more generally, human-perceptible representation. Such an output human-machine interface may consist, but is not limited to, of one or more screens, speakers or other suitable alternative means. “Input human-machine interface” means a computer keyboard, a pointing device, a touchscreen, a microphone or, more generally, any interface designed to translate gestures or instructions issued by a human into control or configuration data. Advantageously, the input and output human-machine interfaces may constitute a single physical entity.

[0088] Such a computer system 1 can be adapted by loading into the program memory 14 of each electronic device 10-1, 10-2 a computer program P comprising instructions for causing, during their execution, the implementation of a method (1) Gen' for generating parameters and generating keys, (2) Pro' for proving knowledge of secret sk, according to the invention. This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in an interpreted, partially or fully compiled form, or in any other desirable form.

[0089] As indicated previously, in order to be able to prove knowledge of a secret sk via the communication channel between said devices, one of the electronic devices of the computer system 1 described in connection with FIG. 1, for example the electronic device S (10-1), implements a method Gen' 110 for generating parameters Par and keys {sk, pk] via the execution of an algorithm Gen' mentioned previously. The device S (10-1) may be the future prover S (10-1) of said computer system 1 or consist of any other electronic device of said system 1.

[0090] Figure 2 thus describes a functional flowchart of such a method Gen' 110 implemented by an electronic device of a computer system 1, such as the electronic device 5 (10-1).

[0091] Let us describe the embodiment of a PDNN in accordance with the invention through one of the respective arrangements of the methods 110, 120 mentioned previously in connection with figures 2 and 3.

[0092] Such a method Gen' 110 comprises a step 112 of generating the parameters P*11 and the public and private keys pk and sk necessary for implementing a PDNN according to the invention. Such a method may comprise a prior step 111 of producing random or pseudo-random data PP by the random or pseudo-random number generator 13, all or part of said parameters P*11 that can be produced from said random or pseudo-random data PP. Said method Gen' 110 may comprise a step 113 for causing the transmission, by the communication means 15, of a message MPK to one or more electronic devices 10-2 of the computer system 1. The message MPK conveying said parameters P**1 and said public key pk. Upon receipt of such a message MPK, said electronic devices 10-2 record the values ​​of said parameters par, pk in their respective data memories 12. Advantageously, the data {pk, par} belonging to the different provers are recorded by the devices 10-2 in a data structure KR associating the latter with identifiers characterizing the electronic devices having published their parameters and keys. Said electronic device 10-1 records the private key sk in its own memory.

[0093] Figure 3 describes a functional flowchart of a PDNN method Pro' 120 implemented by any pair of electronic devices of a computer system 1, such as the electronic device 5 (10-1) and the electronic device V (10-2), via the execution of the algorithm Pro' mentioned above.

[0094] Such a method Pro' 120 comprises a step 121 of producing random or pseudo-random data SS' by the random or pseudo-random number generator 13 of the electronic device V (10-2) from which the challenge c is derived which will be used subsequently.

[0095] The method Pro' also comprises a step 122 of producing random or pseudo-random data SS by the random or pseudo-random number generator 13 of the electronic device S (10-1) from which the commitmentx is derived which will be used subsequently.

[0096] Said method 120 also comprises a step 123 for causing the transmission of an MME message by V (10-2) to the device S (10-1). Said MME message containing the commitment of V (10-2) on c denoted Eng(c). MME is therefore sent by the device V (10-2) to the device S (10-1).

[0097] Said method 120 also comprises a step 124 of recording, in the data memory 12 of the electronic device S (10-1) implementing said method 120, the value Eng(c) extracted from the MME message.

[0098] Said method 120 also comprises a step 125 for causing the transmission of an MMX message by S (10-1) to device V (10-2). Said MMX message conveying a value x. x being the value of the prover's commitment in the underlying protocol E. MMX is therefore sent by device 5 (10-1) to device V (10-2).

[0099] Said method 120 also comprises a step 126 for causing the transmission of an MMC message by V (10-2) to device S (10-1). Said message MMC carrying said value 6. c being the value of the challenge launched by the verifier in an underlying protocol E. MMC is therefore sent by device V (10-2) to device 5 (10-1).

[0100] Said method 120 also comprises a step 127 to cause by the device 5 (10-1) that the commitment Eng(c) already present in the memory of the device 5 (10-1) is correct with respect to said challenge 6 extracted from MMC. If 6 does not match the commitment Eng(c), device 5 (10-1) stops the protocol. If c corresponds to the commitment Eng(c), the device 5 (10-1) proceeds to step 128.

[0101] Said method 120 also comprises a step 128 for causing the transmission of an MMY message by 5 (10-1) to device V (10-2). Said MMY message carrying a value Z 3' being the value of the response of the prover in the underlying protocol E. MMY is therefore sent by device 5 (10-1) to device V (10-2).

[0102] Said method 120 finally comprises a step 129 to cause the verification by the device V (10-2) of the consistency of said data x, c, y, pk according to the rules of the underlying protocol E. If the verification relation linking the data x, c, y, pk fails (according to the rules of the underlying protocol E), the device V (10-2) rejects the device S (10-1). If the verification relation linking the data x, c, y, pk succeeds (according to the rules of the underlying protocol E), the device V(10-2) accepts the device 5(10-1).

[0103] The invention has been described through an example illustrated by [Fig.l] according to which a first electronic device 5 (10-1) proves knowledge of a secret sk to a second electronic device V (10-2) and this without said second electronic device V (10-2) being able to extract and keep a trace of its interaction with the first electronic device 5 (10-1).< / j>

Claims

1. Claims A method of proof with deniable zero disclosure (100), said method being implemented by a computer system (10) comprising a first S (10-1), a second V (10-2) electronic devices, said two electronic devices each comprising a processing unit (11) cooperating with a data memory (12) and means of communication (15) with the outside world. Said first electronic device 5 (10-1) being designed to prove knowledge of a secret sk to the second electronic device V (10-2). Said second device being designed to verify knowledge of the secret sk by the device S (10-1). Said method of proof with deniable zero disclosure (100) comprising: - a phase (110) of generating and publishing general parameters and public and private keys {par, pk, sk} of a zero-disclosure proof protocol. The generation of {par, pk, sk} being implemented by the first electronic device S (10-1); Said general parameters and public and private signature keys being produced from a first random data PP produced by a random number generator (13) of said first electronic device S (10-1); - a phase (120) of verifying the knowledge of sk by the first electronic device 5 (10-1) comprising the following steps: • a step 121 of producing random or pseudo-random data SS' by the random or pseudo-random number generator 13 of the electronic device V (10-2) from which the challenge 6 of an underlying protocol S is derived. • a step 122 of producing random or pseudo-random data SS by the random or pseudo-random number generator 13 of the electronic device S (10-1) from which the commitments of said underlying protocol E are derived. • A step 123 to cause the transmission of an MME message by V (10-2) to device S (10-1). Said MME message containing a commitment of V (10-2) on 6 noted Eng(c). MME is therefore sent by device V (10-2) to device 5 (10-1). a step 124 of recording, in the data memory 12 of the electronic device 5 (10-1) implementing said method 120, the value Eng(c) extracted from the MME message. a step 125 for causing the transmission of an MMX message by S (10-1) to the device V (10-2). Said MMX message conveying a value x. x being the value of the prover's commitment to said underlying protocol E. MMX is therefore sent by the device S (10-1) to the device V (10-2). a step 126 to cause the transmission of an MMC message by V (10-2) to device S (10-1). Said MMC message carrying said value cc MMC is therefore sent by device V (10-2) to device S (10-1). a step 127 to cause by the device S (10-1) that the commitment Eng(c) already present in the memory of the device 5 (10-1) is correct with respect to said challenge c extracted from MMC. If c does not correspond to the commitment Eng(c), the device S (10-1) stops the protocol. If c corresponds to the commitment Eng(c), the device S (10-1) proceeds to step 128. a step 128 to cause the transmission of an MMY message by 5 (10-1) to device V (10-2). Said MMY message conveying a value 2. 2 being the value of the prover's response in the underlying protocol E. MMY is therefore sent by device S (10-1) to device V (10-2). a step 129 to cause the device V (10-2) to verify the consistency of said data x, c, y, pk according to the rules of the underlying protocol E. • If the verification relationship linking the data x. c, y, pk fails (according to the rules of the underlying E protocol), device V (10-2) rejects device S (10-1). • If the verification relationship linking the data x, c, y, pk succeeds (according to the rules of the underlying E protocol), device V (10-2) accepts device 5 (10-1).

2. A method (100) according to claim 1 wherein said underlying protocol is the Fiat-Shamir protocol]

3. Method (100) according to claim 1 wherein said underlying protocol is the Guillou-Quisqauter protocol]

4. A method (100) according to claim 1 wherein said underlying protocol is the Schnorr protocol]

5. The method (100) of claim 1 wherein said underlying protocol is the Schnorr protocol implemented on an elliptic curve.

6. A method (100) according to claim 1 wherein said underlying protocol is the protocol is replaced by an RSA signature]

7. A method (100) according to any one of claims 1 to 6, wherein the size of the challenge k has a value between 10 and 160.

8. Computer program product comprising one or more program instructions (P) executable by the processing unit (11) of a computer, said program instructions (P) being loadable into a memory (14) of said computer and the execution of which by said processing unit (11) causes the implementation of a method (100) according to any one of the preceding claims.

9. A computer-readable storage medium comprising the instructions of a computer program product according to the preceding claim.

10. Computer system (1) comprising at least two electronic devices (10-1, 10-2) each comprising a processing unit (11) and a memory (14), said memory (14) of each of said electronic devices (10-1, 10-2) comprising the program instructions (P) of a computer program product according to the preceding claim.

Images