Electronic information storage medium, IC chip, signature verification processing method, and program

Abstract

To provide an electronic information storage medium, an IC chip, a signature verification processing method, and a program that are capable of verifying a signature added to a hybrid certificate and performing secure processing according to the verification results.SOLUTION: When a secure device 1 receives a command including a hybrid certificate from an external terminal 2, it verifies at least one of signatures attached to the hybrid certificate using at least one of a non-PQC public key and a PQC public key, and performs different settings depending on whether both the verification of signature A using the non-PQC public key and the verification of signature B using the PQC public key are successful or whether either the verification of the signature A using the non-PQC public key or the verification of the signature B using the PQC public key is successful.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to the technical field of secure devices capable of performing signature verification. [Background technology]

[0002] In recent years, post-quantum cryptography (hereinafter referred to as "PQC (Post-Quantum Cryptography)") has been known as a cryptography that can maintain security even when a sufficiently large quantum computer is put into practical use (i.e., a cryptography that is resistant to quantum computers). However, a cryptographic algorithm using PQC requires a large amount of resources for calculation. Therefore, in a system that requires a signature (digital signature) and signature verification, a cryptographic algorithm using PQC (e.g., CRYSTALS-Dilithium) and a cryptographic algorithm using non-PQC (e.g., RSA (Rivest-Shamir-Adleman cryptosystem)) may be used (operated) in parallel. As a related technology, Patent Document 1 discloses a technology that allows the use of a hybrid digital certificate of a quantum-vulnerable cryptosystem and a quantum-resistant cryptosystem during the transition from a quantum-vulnerable cryptosystem to a quantum-resistant cryptosystem. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6644894 Summary of the Invention [Problem to be solved by the invention]

[0004] As mentioned above, considering that cryptographic algorithms using PQC and cryptographic algorithms not using PQC are used in parallel, it is expected that hybrid certificates to which signatures by each cryptographic algorithm are attached will be used by secure devices (security devices).

[0005] Therefore, the present invention has been made in consideration of these points and the like, and an example of an objective of the present invention is to provide an electronic information storage medium, an IC chip, a signature verification processing method, and a program that are capable of verifying a signature attached to a hybrid certificate and performing secure processing based on the verification results. [Means for solving the problem]

[0006] In order to solve the above problems, the invention described in claim 1 is an electronic information storage medium capable of performing cryptographic calculations using a plurality of types of cryptographic algorithms with different cryptographic strengths, comprising: a storage means for storing at least one of a first public key used in a first cryptographic algorithm and a second public key used in a second cryptographic algorithm having a higher cryptographic strength than the first cryptographic algorithm; and a storage means for storing a first signature by a first private key used in the first cryptographic algorithm and a second signature by a second private key used in the second cryptographic algorithm. the authentication information storing unit includes a verification means for verifying at least one of the signatures added to the certificate data using at least one of the first public key and the second public key when a command including the certificate data added to the certificate data is received from an external terminal, and a setting means for making different settings depending on whether both the verification of the first signature using the first public key and the verification of the second signature using the second public key are successful or whether either the verification of the first signature using the first public key or the verification of the second signature using the second public key is successful.

[0007] The invention described in claim 2 is characterized in that, in the electronic information storage medium described in claim 1, the setting means further performs different settings when verification of the first signature using the first public key is successful and when verification of the second signature using the second public key is successful.

[0008] The invention described in claim 3 is characterized in that, in the electronic information storage medium described in claim 1 or 2, when the first public key and the second public key are stored in the storage means, the verification means verifies the second signature added to the certificate data using the second public key, and if verification of the second signature fails, verifies the first signature added to the certificate data using the first public key.

[0009] The invention described in claim 4 is characterized in that, in the electronic information storage medium described in claim 1 or 2, when the first public key and the second public key are stored in the storage means, the verification means verifies the second signature added to the certificate data using the second public key, and when the verification of the second signature is successful and it is determined that signature verification using the first public key is necessary, verifies the first signature added to the certificate data using the first public key.

[0010] The invention described in claim 5 is an IC chip capable of performing cryptographic calculations using multiple types of cryptographic algorithms with different cryptographic strengths, comprising: a storage means for storing at least one of a first public key used in a first cryptographic algorithm and a second public key used in a second cryptographic algorithm having cryptographic strength higher than that of the first cryptographic algorithm; a verification means for, when receiving from an external terminal a command including certificate data to which a first signature by a first private key used in the first cryptographic algorithm and a second signature by a second private key used in the second cryptographic algorithm are attached, verifying at least one of the first public key and the second public key, the first signature attached to the certificate data; and a setting means for performing different settings depending on whether both the verification of the first signature by the first public key and the verification of the second signature by the second public key are successful or whether either the verification of the first signature by the first public key or the verification of the second signature by the second public key is successful.

[0011] The invention described in claim 6 is a signature verification processing method executed by an electronic information storage medium capable of performing cryptographic calculations using a plurality of types of cryptographic algorithms with different cryptographic strengths, the method including the steps of storing in a storage means at least one of a first public key used in a first cryptographic algorithm and a second public key used in a second cryptographic algorithm having a cryptographic strength higher than that of the first cryptographic algorithm, generating a first signature using a first private key used in the first cryptographic algorithm, and a second signature using a second private key used in the second cryptographic algorithm. the step of verifying at least one of the signatures attached to the certificate data using at least one of the first public key and the second public key when a command including certificate data to which a name and a signature are attached are received from an external terminal; and the step of making different settings depending on whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful or whether verification of the first signature using the first public key and verification of the second signature using the second public key are successful.

[0012] The invention described in claim 7 is a method for storing at least one of a first public key used in a first encryption algorithm and a second public key used in a second encryption algorithm having encryption strength higher than that of the first encryption algorithm in a storage means of a computer included in an electronic information storage medium capable of performing encryption calculations using each of a plurality of types of encryption algorithms having different encryption strengths, and adding a first signature by a first private key used in the first encryption algorithm and a second signature by a second private key used in the second encryption algorithm. the step of verifying at least one of the signatures added to the certificate data by at least one of the first public key and the second public key when a command including the certificate data added to the certificate data is received from an external terminal; and the step of making different settings depending on whether the verification of the first signature by the first public key and the verification of the second signature by the second public key are both successful or whether either the verification of the first signature by the first public key and the verification of the second signature by the second public key are successful. Effect of the Invention

[0013] According to the present invention, the signature added to the hybrid certificate is verified, and safe processing can be performed according to the verification result. [Brief description of the drawings]

[0014] [Figure 1] 2 is a diagram illustrating an example of a hardware configuration of a secure device 1. FIG. [Diagram 2] 2 is a sequence diagram showing communication between a secure device 1 and an external terminal 2. FIG. [Diagram 3] 13 is a flowchart showing an example of a signature verification process executed by the secure device 1. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0016] [1. Configuration and functions of secure device 1] First, the configuration and functions of a secure device (security device) 1 according to this embodiment will be described with reference to FIG. 1. The secure device 1 is an example of an electronic information storage medium of the present invention. Examples of the secure device 1 include an integrated circuit (IC chip) and a hardware security module (HSM). The IC chip is mounted on an IC card such as a credit card, a cash card, or a personal number card, or on a mobile device such as a smartphone. In the case of a mobile device such as a smartphone, the IC chip may be mounted on a small IC card that is detachable from the mobile device, or may be mounted on an embedded board as an embedded universal integrated circuit card (eUICC) so that it cannot be easily removed or replaced from the mobile device. The eUICC is a type of embedded secure element (eSE).

[0017] FIG. 1 is a diagram showing an example of a hardware configuration of a secure device 1. The secure device 1 is tamper-resistant, and includes an I / O circuit 11, a random access memory (RAM) 12, a nonvolatile memory (NVM) 13, a read only memory (ROM) 14, and a central processing unit (CPU) 15 (an example of a computer) as shown in FIG. 1. The tamper-resistant property of the secure device 1 protects the confidentiality and integrity of a key from an external attack, and can prevent the key from being illegally leaked or tampered with. The secure device 1 may include a coprocessor that receives an instruction from the CPU 15 and executes a cryptographic operation. The I / O circuit 11 serves as an interface with an external terminal 2. The communication between the secure device 1 and the external terminal 2 may be contactless communication or contact communication. In the case of contactless communication, the communication between the secure device 1 and the external terminal 2 is performed via an antenna (not shown) mounted on, for example, an IC card or a mobile device. The external terminal 2 is, for example, a terminal having an authentication function (for example, a payment terminal). Other examples of the external terminal 2 include a mobile device such as a smartphone, a terminal installed at the door of a building or vehicle, a terminal installed at a gate such as a facility or a ticket barrier, an ETC terminal used in an ETC (Electronic Toll Collection System), etc. The external terminal 2 may be a controller (control unit) mounted in the same mobile device as the secure device 1.

[0018] For example, a flash memory is applied to the NVM 13 (an example of a storage means). The NVM 13 may be an "Electrically Erasable Programmable Read-Only Memory". The NVM 13 is provided with a plurality of record areas. The record areas of the NVM 13 store files (e.g., EF (Elementary File)) including data that can be read by an application. Examples of such data include communication parameters, setting data used in encrypted communication, keys and PINs used in authentication, personal information, and other data. Each file is assigned a unique identifier (e.g., SFI (Short File Identifier)).

[0019] In addition, the NVM 13 or the ROM 14 stores various programs such as an OS (Operating System) and applications (including the program of the present invention). The applications include, for example, a payment application and an authentication application. Furthermore, the applications include an encryption calculation application that specifies an encryption algorithm using a non-PQC (e.g., RSA) (an example of a first encryption algorithm, hereinafter referred to as a "non-PQC algorithm") and an encryption calculation application that specifies an encryption algorithm using a PQC (an example of a second encryption algorithm, hereinafter referred to as a "PQC algorithm").

[0020] Here, the PQC algorithm has higher encryption strength than the non-PQC algorithm. The PQC algorithm is an algorithm that utilizes a lattice problem (based on the difficulty of detecting a short vector in a lattice) that is difficult to solve even with a quantum computer, unlike the prime factorization problem used by RSA, for example. In addition, the record area of ​​the NVM 13 stores a file that includes at least one of a public key (an example of a first public key, hereinafter referred to as a "non-PQC public key") used in a non-PQC algorithm (for example, RSA) and a public key (an example of a second public key, hereinafter referred to as a "PQC public key") used in a PQC algorithm (for example, CRYSTALS-Dilithium). Note that the non-PQC public key and the PQC public key are each a public key unique to, for example, the external terminal 2.

[0021] The CPU 15 functions as a verification means and a setting means in the present invention according to the program of the present invention. The CPU 15 receives a command including a hybrid certificate from the external terminal 2 via the I / O circuit 11. Such a command is, for example, a VERIFY HYBRID command, and is configured by a command APDU (Application Protocol Data Unit) including a header portion including CLA, INS, P1, and P2, and a body portion including Lc, Data, and Le. Here, the hybrid certificate and the like are set in Data. The hybrid certificate is certificate data to which (in other words, attached) a signature A (an example of a first signature) by a private key used in a non-PQC algorithm (an example of a first private key, hereinafter referred to as a "non-PQC private key") and a signature B (an example of a second signature) by a private key used in a PQC algorithm (an example of a second private key, hereinafter referred to as a "PQC private key") are added. Here, a signature is data that is generated (e.g., encrypted) using a private key, for example, where the data to be signed (e.g., plain text or random numbers) is the data, and the signature can be extracted (e.g., decrypted) using a public key that forms a key pair with the private key.

[0022] When the CPU 15 receives a command including the hybrid certificate from the external terminal 2, the CPU 15 verifies at least one of the signatures added to the hybrid certificate by at least one of the non-PQC public key and the PQC public key. For example, when the non-PQC public key and the PQC public key are stored in the NVM 13, the CPU 15 verifies the signature B added to the hybrid certificate by the PQC public key, and when the verification of the signature B fails, the CPU 15 verifies the signature A added to the hybrid certificate by the non-PQC public key. Here, when the verification fails, it corresponds to, for example, a case where extraction (e.g., decryption) of the generated signature target data fails, or a case where the extracted data does not match the signature target data. Alternatively, when a non-PQC public key and a PQC public key are stored in NVM 13, CPU 15 verifies signature B added to the hybrid certificate by the PQC public key, and when the verification of signature B is successful and it is determined that signature verification by a non-PQC public key is necessary, CPU 15 verifies signature A added to the hybrid certificate by the non-PQC public key. Alternatively, when only a non-PQC public key is stored in NVM 13, CPU 15 verifies signature A added to the hybrid certificate by the non-PQC public key. Alternatively, when only a PQC public key is stored in NVM 13, CPU 15 verifies signature B added to the hybrid certificate by the PQC public key.

[0023] The CPU 15 performs different settings depending on whether the verification of signature A using a non-PQC public key and the verification of signature B using a PQC public key are both successful (verification of signatures A and B is successful) or whether the verification of signature A using a non-PQC public key and the verification of signature B using a PQC public key are both successful (verification of only signatures A or B is successful). The CPU 15 may further perform different settings depending on whether the verification of signature A using a non-PQC public key is successful or whether the verification of signature B using a PQC public key is successful. Examples of settings that may be different include access rights to files after successful verification and communication encryption level after successful verification.

[0024] The access authority to a file indicates the range of files that are permitted to be accessed (e.g., permitted to read data) among multiple files stored in the record area of ​​NVM 13 in subsequent communications (communication between secure device 1 and external terminal 2), for example. For example, if verification of signatures A and B is successful, the access authority is set to "1," indicating that the range of files permitted to be accessed in subsequent communications is files 01, 02, and 03 (i.e., three files). On the other hand, if verification of only signature B is successful, the access authority is set to "2," indicating that access to files 01 and 02 (i.e., two files) is permitted in subsequent communications. On the other hand, if verification of only signature A is successful, the access authority is set to "3," indicating that access to only file 01 is permitted in subsequent communications.

[0025] The communication encryption level indicates, for example, security strength. The security strength indicates, for example, an index of the amount of calculation required for decryption when the most effective attack against the encryption algorithm is given. For example, when the verification of signatures A and B is successful, the security strength is set to "128", which indicates "AES-128bit" as the common key encryption method used in the subsequent encrypted communication. As a result, when the verification of signatures A and B is successful, the security strength is lowered compared to when only signature A or only signature B is successful, thereby shortening the time required for encryption processing and realizing faster communication than when only signature A or only signature B is successful. On the other hand, when only signature B is successful, the security strength is set to "192", which indicates "AES-192bit" as the common key encryption method used in the subsequent encrypted communication. As a result, when the verification of signature B is successful, the security strength is lowered compared to when only signature A is successful, thereby shortening the time required for encryption processing and realizing faster communication than when only signature A is successful. On the other hand, if only signature A is successfully verified, the security strength is set to "256", which indicates that the common key cryptosystem used in subsequent encrypted communications will be "AES-256bit". As a result, if only signature A is successfully verified, the encryption process will take longer and communication will be slower than if both signatures A and B are successfully verified, but a certain level of security can be guaranteed.

[0026] The communication encryption level may indicate whether or not encrypted communication using a common session key between the secure device 1 and the external terminal 2 is required. For example, if verification of signatures A and B is successful, or if verification of only signature B is successful, the encryption communication is set to not be required. On the other hand, if verification of only signature A is successful, the encryption communication is set to be required, and a common session key is generated by, for example, key exchange using ECDH (Elliptic curve Diffie-Hellman key exchange) and signature generation and signature verification using ECDSA (Elliptic Curve Digital Signature Algorithm) in the subsequent mutual authentication sequence. If verification of only signature A or signature B is successful, the same setting as that when verification of signatures A and B is successful may be made according to the required security level.

[0027] [2. Operation of Secure Device 1] Next, the operation of the secure device 1 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a sequence diagram showing communication between the secure device 1 and the external terminal 2. Fig. 3 is a flowchart showing an example of a signature verification process executed by the secure device 1. It is assumed that the external terminal 2 generates a signature A from the data to be signed using a non-PQC private key unique to the external terminal 2, generates a signature B from the data to be signed using a PQC private key unique to the external terminal 2, and generates a hybrid certificate in advance to which the generated signatures A and B are attached.

[0028] In Fig. 2, the external terminal 2 starts communication with the secure device 1, and after an initialization sequence is performed, transmits a VERIFY HYBRID command including data to be signed and a hybrid certificate to the secure device 1 (step S1). When the secure device 1 receives the VERIFY HYBRID command from the external terminal 2, it executes a signature verification process shown in Fig. 3 (step S2). In the signature verification process shown in Fig. 3, the secure device 1 determines whether or not a non-PQC public key and a PQC public key are stored in the NVM 13 (step S21). If it is determined that a non-PQC public key and a PQC public key are stored (step S21: YES), the process proceeds to step S22. On the other hand, if it is determined that a non-PQC public key and a PQC public key are not stored (step S21: NO), the process proceeds to step S32.

[0029] In step S22, the secure device 1 verifies the signature B added to the hybrid certificate included in the VERIFY HYBRID command by using the PQC public key. Next, the secure device 1 judges whether the verification of the signature B by the PQC public key is successful or not (step S23). For example, the CPU 15 (or the coprocessor) judges that the verification of the signature B is successful when the signature target data extracted by the PQC public key from the signature B added to the hybrid certificate included in the VERIFY HYBRID command matches the signature target data included in the VERIFY HYBRID command. If it is judged that the verification of the signature B by the PQC public key is successful (step S23: YES), the process proceeds to step S24. On the other hand, if it is judged that the verification of the signature B by the PQC public key is not successful (step S23: NO), the process proceeds to step S29.

[0030] In step S24, the secure device 1 determines whether or not signature verification using a non-PQC public key is necessary. For example, when information indicating that signature verification using a non-PQC public key is necessary for security improvement is included in the VERIFY HYBRID command, it is determined that signature verification using a non-PQC public key is necessary. Alternatively, when information indicating that signature verification is necessary for security improvement is set (stored) in the secure device 1, it is determined that signature verification using a non-PQC public key is necessary. When it is determined that signature verification using a non-PQC public key is necessary (step S24: YES), the process proceeds to step S25. On the other hand, when it is determined that signature verification using a non-PQC public key is not necessary (step S24: NO), the process proceeds to step S27.

[0031] In step S25, the secure device 1 verifies the signature A added to the hybrid certificate included in the VERIFY HYBRID command by using a non-PQC public key. Next, the secure device 1 determines whether or not the verification of the signature A by using the non-PQC public key is successful (step S26). For example, the CPU 15 (or the coprocessor) determines that the verification of the signature A is successful when the signature target data extracted from the signature A added to the hybrid certificate included in the VERIFY HYBRID command by using a non-PQC public key matches the signature target data included in the VERIFY HYBRID command. If it is determined that the verification of the signature A by using the non-PQC public key is successful (step S26: YES), the process proceeds to step S27. On the other hand, if it is determined that the verification of the signature A by using the non-PQC public key is not successful (step S26: NO), the process proceeds to step S28.

[0032] In step S27, the secure device 1 executes processing in response to successful verification of signatures A and B. In the processing in response to successful verification of signatures A and B, for example, the access authority to the file is set to "1" and a response APDU indicating normal completion (successful verification) is generated. This response APDU may include information indicating successful verification of signatures A and B. Meanwhile, in step S28, the secure device 1 executes processing in response to successful verification of only signature B. In the processing in response to successful verification of only signature B, for example, the access authority to the file is set to "2" and a response APDU indicating normal completion is generated. This response APDU may include information indicating successful verification of only signature B.

[0033] Meanwhile, in step S29, the secure device 1 verifies the signature A added to the hybrid certificate included in the VERIFY HYBRID command with a non-PQC public key. Next, the secure device 1 determines whether or not the verification of the signature A with the non-PQC public key is successful (step S30). If it is determined that the verification of the signature A with the non-PQC public key is successful (step S30: YES), the process proceeds to step S31. On the other hand, if it is determined that the verification of the signature A with the non-PQC public key is not successful (step S31: NO), the process proceeds to step S37.

[0034] In step S31, the secure device 1 executes a process corresponding to the successful verification of only signature A. In the process corresponding to the successful verification of only signature A, for example, the access authority to the file is set to "3" and a response APDU indicating normal completion is generated. Such a response APDU may include information indicating that only signature A has been successfully verified.

[0035] In step S32, the secure device 1 determines whether or not only a non-PQC public key is stored in the NVM 13. If it is determined that only a non-PQC public key is not stored in the NVM 13 (i.e., only a PQC public key is stored) (step S32: NO), the process proceeds to step S33. On the other hand, if it is determined that only a non-PQC public key is stored in the NVM 13 (step S32: YES), the process proceeds to step S35.

[0036] In step S33, the secure device 1 verifies the signature B added to the hybrid certificate included in the VERIFY HYBRID command using the PQC public key. Next, the secure device 1 determines whether or not the verification of the signature B using the PQC public key is successful (step S34). If it is determined that the verification of the signature B using the PQC public key is successful (step S34: YES), similarly to the above, a process corresponding to the successful verification of only the signature B is executed (step S28). On the other hand, if it is determined that the verification of the signature B using the PQC public key is not successful (step S34: NO), the process proceeds to step S37.

[0037] In step S35, the secure device 1 verifies the signature A added to the hybrid certificate included in the VERIFY HYBRID command using a non-PQC public key. Next, the secure device 1 determines whether or not the verification of the signature A using the non-PQC public key is successful (step S36). If it is determined that the verification of the signature A using the non-PQC public key is successful (step S36: YES), similarly to the above, a process corresponding to the successful verification of only the signature A is executed (step S31). On the other hand, if it is determined that the verification of the signature A using the non-PQC public key is not successful (step S36: NO), the process proceeds to step S37. In step S37, the secure device 1 generates a response APDU indicating an error (verification failure).

[0038] 2, the secure device 1 transmits the response APDU generated in the signature verification process to the external terminal 2 (step S3). If the response APDU from the secure device 1 indicates successful verification, the external terminal 2 transmits a predetermined command (e.g., a SELECT command, a READ RECORD command, etc.) to the secure device 1 (step S4). Then, upon receiving the command from the external terminal 2, the secure device 1 executes a process (e.g., a record read process) according to the settings in the signature verification process (e.g., the settings when the verification of signatures A and B is successful) (step S5).

[0039] As described above, according to the above embodiment, when the secure device 1 receives a command including a hybrid certificate from the external terminal 2, the secure device 1 verifies at least one of the signatures added to the hybrid certificate by at least one of the non-PQC public key and the PQC public key, and performs different settings when both the verification of the signature A by the non-PQC public key and the verification of the signature B by the PQC public key are successful and when either the verification of the signature A by the non-PQC public key and the verification of the signature B by the PQC public key are successful. This allows secure processing to be performed according to the result of the verification of the signature added to the hybrid certificate without outputting a key from the secure device 1 (because the signature verification is performed inside the secure device 1). Note that, in the above embodiment, the secure device 1 may perform settings so that specific data can be changed only when both the verification of the signature A by the non-PQC public key and the verification of the signature B by the PQC public key are successful. Furthermore, the secure device 1 may be configured to generate a signature for specific data only when both the verification of signature A with a non-PQC public key and the verification of signature B with a PQC public key are successful. Alternatively, the secure device 1 may be configured to change a specific function within the secure device 1 only when both the verification of signature A with a non-PQC public key and the verification of signature B with a PQC public key are successful. [Explanation of symbols]

[0040] 1. Secure Device 2 External terminal 11 I / O circuit 12 RAM ( 13 NVM 14 ROM 15 CPU

Claims

1. An electronic information storage medium capable of performing cryptographic operations using a plurality of cryptographic algorithms each having a different cryptographic strength, comprising: a storage means for storing at least one of a first public key used in a first encryption algorithm and a second public key used in a second encryption algorithm having a higher encryption strength than the first encryption algorithm; a verification means for verifying, when receiving from an external terminal a command including certificate data to which a first signature created by a first private key used in the first encryption algorithm and a second signature created by a second private key used in the second encryption algorithm are added, at least one of the signatures added to the certificate data, using at least one of the first public key and the second public key; a setting means for setting different settings depending on whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful or whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful; An electronic information storage medium comprising:

2. The electronic information storage medium according to claim 1, characterized in that the setting means further performs different settings when verification of the first signature using the first public key is successful and when verification of the second signature using the second public key is successful.

3. The electronic information storage medium according to claim 1 or 2, characterized in that, when the first public key and the second public key are stored in the storage means, the verification means verifies the second signature added to the certificate data by the second public key, and if verification of the second signature fails, verifies the first signature added to the certificate data by the first public key.

4. 3. The electronic information storage medium according to claim 1, wherein when the first public key and the second public key are stored in the storage means, the verification means verifies the second signature added to the certificate data using the second public key, and when the verification of the second signature is successful and it is determined that signature verification using the first public key is necessary, verifies the first signature added to the certificate data using the first public key.

5. An IC chip capable of performing cryptographic calculations using a plurality of cryptographic algorithms each having a different cryptographic strength, a storage means for storing at least one of a first public key used in a first encryption algorithm and a second public key used in a second encryption algorithm having a higher encryption strength than the first encryption algorithm; a verification means for verifying, when receiving from an external terminal a command including certificate data to which a first signature created by a first private key used in the first encryption algorithm and a second signature created by a second private key used in the second encryption algorithm are added, at least one of the signatures added to the certificate data, using at least one of the first public key and the second public key; a setting means for setting different settings depending on whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful or whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful; An IC chip comprising:

6. A signature verification processing method executed by an electronic information storage medium capable of performing cryptographic calculations using a plurality of cryptographic algorithms having different cryptographic strengths, comprising: storing at least one of a first public key used in a first encryption algorithm and a second public key used in a second encryption algorithm having encryption strength higher than that of the first encryption algorithm in a storage means; when receiving, from an external terminal, a command including certificate data to which a first signature created by a first private key used in the first encryption algorithm and a second signature created by a second private key used in the second encryption algorithm are added, verifying at least one of the signatures added to the certificate data using at least one of the first public key and the second public key; setting different settings depending on whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful or whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful; A signature verification processing method comprising:

7. A computer included in an electronic information storage medium capable of performing cryptographic calculations using a plurality of cryptographic algorithms with different cryptographic strengths, storing at least one of a first public key used in a first encryption algorithm and a second public key used in a second encryption algorithm having encryption strength higher than that of the first encryption algorithm in a storage means; when receiving, from an external terminal, a command including certificate data to which a first signature created by a first private key used in the first encryption algorithm and a second signature created by a second private key used in the second encryption algorithm are added, verifying at least one of the signatures added to the certificate data using at least one of the first public key and the second public key; setting different settings depending on whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful or whether verification of the first signature using the first public key and verification of the second signature using the second public key are both successful; A program characterized by executing the above.

Images