A method for computing a shared cryptographic key and a system using related computation

Abstract

The present invention relates to a method for computing a secret key that enables common use with the data provided by more than one user, and to a system for granting access using such common (shared) secret keys.

Description

[0001] DESCRIPTION

[0002] A METHOD FOR COMPUTING A SHARED CRYPTOGRAPHIC KEY AND A SYSTEM USING RELATED COMPUTATION

[0003] Technical Field of the Invention

[0004] The present invention relates to a method for computing a secret key that enables common use with the data provided by more than one user, and to a system for granting access using such common (shared) secret keys.

[0005] State of the Art Regarding the Invention

[0006] The concept of digital signature is a method that has been used since the early 1980s and gained importance with the spread of the Internet. After the first emergence of the digital signature protocol, in the early 1980s T. El Gamal introduced the first digital signature algorithm using the multiplicative group of finite fields. One of the most important reasons for using the multiplicative group is that the discrete logarithm problem is difficult for these groups. However, again in the 1980s, due to the efficiency of the method developed for the discrete logarithm problem in the multiplicative group of finite fields, it was proposed to use elliptic curve groups as a new mathematical group. With the widespread use of the Internet, the use of digital signatures has also become widespread. Even the TLS protocol for the transport layer in a computer network uses the ECDSA algorithm developed by ElGamal and later standardized by NIST for authentication and key sharing.

[0007] Digital signature, ECDSA, before decentralized digital asset implementations, was done by a single device. With the proliferation of digital assets, the use of digital signatures has become more widespread and has brought different requests. Especially the use of digital signatures in the commercial field is still one of the most important issues for researchers to develop methods to meet the requirements of users’ policies and secure use. Although there are many different ways to use a digital signature, almost all of them can be defined as different variations of the example we will give. The appearance of a digital signature of any organization may require the consent of many people. For example, it may be desirable that the signature can be obtained with the consent of at least 3 out of 10 people in management positions, or in an organization with 2 separate management units, it may be expected that the signature can be obtained with the consent of at least 3 out of 10 people in each unit. In order to transfer these and similar policies to the digital environment, the secure secret sharing algorithm (Secret Sharing Scheme), which has reached a certain maturity with the studies carried out since the 1970s, is used. Although many researchers have proposed secret sharing algorithms, the most widely used algorithm today is the method in A. Shamir’s article in 1979 “How to Share a Secret” [1], This method works as follows:

[0008] Suppose there is a situation where the consent of any t or more users is required in an environment with n users. Let’s denote users by If. The key distributor assumes that there is a trusted party and this party is called the CA.

[0009] 1. Let’s assume that the data that the CA wants to allocate to the users is D. The digital data D can be easily converted to an integer, so we consider the data D as an integer.

[0010] 2. CA randomly selectsJ“ numbers, let these be

[0011]

[0012] > ~i.

[0013] 3. It generates the following function using the random numbers it selects

[0014]

[0015] / (x) ~ Sj... < -t 4- -t 4- P

[0016] 4. It finds the value of f(uf) by substituting any number, say u, for x in this function. It forwards this pair to itself as secret information of user [4. Therefore, the data held by user U1is the pair (ttp

[0017]

[0018] This pair denotes a point on the graph of the function f(x) in Euclidean space.

[0019] 5. What it does for U1, it also does for subsequent users, and so on:

[0020] the user has the point

[0021]

[0022] the user has the point

[0023]

[0024] Aws)),

[0025] the user -4 has the data (A< A )). Verification: Once users have been provided with their own information, the consent mechanism requires the data of t or of more users. Thus, obtaining any t or more pairs yields the function (%), and substituting 0 for x in this function yields the required number D.

[0026] The verification mechanism enforces the existence of t or more pairs. Since there are uncountably many points on any function and uncountably many functions, there is no way that a random pair can be on the graph of a predetermined function. In other words, for the verification step, having t — 1 pairs is the same as having only 1 pair. That is, the probability of generating the function from t — 1 pair is the same as the probability of generating the function from 1 pair and this is taken as 0.

[0027] In terms of digital signature ownership, the secret key of the closed key that identifies this signature is the sole authority on the signature. The digital signature is identified by a secret key selected by the first user or by the digital signature service provider for the first user. An integer pair is created for each user of the digital signature. The first component of this pair should only be known to the user. In existing digital signature applications, it is recommended that these numbers to be created for each user should be at least 78 digits. This randomly selected number for the user is defined as

[0028] k

[0029] . The digital signature is completely managed by this k value. The user of the digital signature is described by a data generated with k. In other words, let G be a group for which the discrete logarithm problem is hard and let P element in this group have the same order as G.

[0030] Q = kP

[0031] is calculated and this value becomes the public key that identifies the owner of the digital signature. In other words, the pair of the digital signature owner is now Q data. Data k is sufficient for the signature operation on behalf of the user identified with Q. So far, different variants of the method shown below have been used to generate data k confidentially among stakeholders. Let E be an elliptic curve defined over a finite field Fpand let the number of the elements be a prime number q. Since the order E is a prime number q, the order of any point on E is also q. It is defined as the explicit information selected for the signature operation. Let A be one partner and B be another partner who wants to create a public key to manage any signature. The organization A selects a special number krfor itself and calculates the value

[0032] Q1= k1P

[0033] . It then sends the value

[0034]

[0035] to the organization B using the predefined cryptographic hash function h.

[0036] The organization B does the same as above, i.e. B selects its own secret number k2, calculates the value

[0037] Q2=k2P

[0038] and shares the value Q2with A along with h(Q2)- Party A sends point Q1to B.

[0039] Parties A and B add the point Qtwith the value they have. As a result of the sum, two parties reach the point

[0040] Q = Q1+ Q2= (k1+ k2)P

[0041] . The identity of the signature or the owner of the signature is now a Q value. All disposition rights for this signature belong to those who know the value of k1+ k2.

[0042] In the method briefly described above, if there will be multi-party authorization in one of the organizations, the value kiselected specifically for them is shared to these people or organizations with any privacy sharing algorithm. This method is used by signature management service providers with their customers for each signature, and for each signature service providers and users have to set private keys separately. In fact, if a user wants to use the same key for two signatures, the service provider can easily detect the secret key. As presented in the technical description above, the biggest problem with current privacy sharing methods is the need for separate key selection for each digital signature for all parties.

[0043] Besides these methods, a method for creating a group key is described in TR2021 / 004081. Here, an a priori key vector that is shared with the relevant group in the vector space but outside the relevant subspace and a group key that is the orthogonal projection of this vector in the relevant subspace is created, and methods are described for group member devices to generate the group key by determining the orthogonal projection of the a priori key vector into the subspace.

[0044] In elikta§’s thesis [2], a key management for hierarchical access is described. In the method mentioned here, the Gram-Schmidt orthogonalization procedure is applied on a subspace determined on an inner product space. It detects the projection on the subspace of a vector f that is an element of the inner product space but not in the subspace. The resulting projection vector is used to generate the secret key.

[0045] The transfer of corporate policies on digital signature management to the digital environment can only be realized with existing cryptographic components. There are aspects of digital signature management where secret sharing algorithms fall short.

[0046] First of all, for any existing digital signature, the users are identified by the public key they create with the private key that they set themselves. As such, any device with this secret key has every right to dispose of the digital signature. This creates a security vulnerability.

[0047] In addition, organizations may not use digital signatures for only one type of business at a time. As such, they can contain different signature components for the approval of different policies. In such a case, i.e. for the implementation of many different policies, it is necessary to create the same number of signature components and store them securely in order to realize the digital signature on behalf of the organization. For example, in the crypto-asset system, where digital signatures are most commonly used, the companies that host many different wallets in the same virtual unit would have to keep separate keys for each account, both for themselves and for their service provider (bank or exchange), if they want to benefit from banking applications, using the current secret sharing algorithm or multi-party computation methods. In other words, for each digital signature, the users must have their own secret key. Such a requirement, i.e. the need to keep and manage different data for each signature in a confidential manner, imposes an unmanageable workload on users.

[0048] Finally, in all current secure multi-party methods, each party has to hold a separate key for any signature. For digital signature management or ownership, the user’s key must also be stored securely. This almost makes it pointless to delegate signature work to users. For example, even if a crypto-asset owners use a banking application for management, the users have to keep a different secret key for each signature, as in the case of self-management of the signature. The users should not lose each of their keys, keep them in a secure environment or not have them stolen.

[0049] As a result, all the above-mentioned problems have made it necessary to realize a novelty in the relevant field.

[0050] Objects of the Invention

[0051] The main object of the invention is to provide a method for generating and computing a key, which requires multiple data / keys for certain approvals and accordingly increases security by neutralizing single data, and a system for executing the same.

[0052] The object of the invention is to provide a method and system that will prevent organizations or persons who need to use many different signatures in the digital key method from having to host or use different keys for these signature operations and to provide secure management of accounts with a single data that they can use effectively in line with their capacities.

[0053] Definitions of Drawings Describing the Invention

[0054] In order to better describe the device developed with this invention, the drawings used and the related descriptions are as follows.

[0055] Fig- 1 Flow diagram showing the communication and operation of the method of the invention between users and service providers. Detailed Description of the Invention

[0056] The subject of the invention relates to a method for generating and computing a secret key that enables common use with the data provided by more than one user, and to a system for granting access using such common (shared) crypto keys.

[0057] The trigonometric functions will play an important role in the present invention. These functions are provided as follows

[0058] c^sin (QX) + bjcos (djX)

[0059]

[0060] 2 i=l

[0061] . The coefficients in these functions (Uj,

[0062]

[0063] are selected from any real numbers and (,

[0064]

[0065] from natural numbers. Since these functions are continuous in the set of real numbers, they are integrable in any real interval.

[0066] For the sake of illustration, let us select such functions as single trigonometric functions. Any organization A or user of a service from a service provider or trusted authority randomly selects a set of these simple functions:

[0067] S = {sin(c1x), sin(c2x),..., cos ^x), cos(d2x) ■■■ }■

[0068] Since the set S is selected by the users, the number of elements is designed according to the resource availability of the user. In other words, let’s assume that the user selects n functions. Instead of functions, it will be enough to store randomly selected values, c2,..., <1^ d2,....

[0069] Here, the elements of a set of trigonometric functions are distributed among multiple users, each user having at least one trigonometric function.

[0070] The service provider randomly selects two real or complex coefficient functions for an account of this user. These functions are provided as

[0071] h(x) and g(x) . Since these functions are selected randomly, the functions can preferably be selected as polynomial functions for ease of computation, thus reducing computational complexity. In other words,

[0072] h

[0073]

[0074] (x) = t0+ t1x + t2x2+ — I- tmxm

[0075] g(x) = z0+ z y + z2y2+ ••• + zryr

[0076] the function g(x) is selected in the same way. Here, the coefficients can be selected from real or complex numbers, but selecting integers will be more convenient for subsequent operations.

[0077] In the embodiment of the invention, the functions h(x) and g(x) can be selected as trigonometric.

[0078] The essential criterion here is that the functions h(x) and g(x) can be integrated in the interval [—n, TT].

[0079] The organization A designates the set S or any subset thereof for the digital signature / key. Here, by subset we mean a subset of the trigonometric functions owned by the users needed to generate the signature / key. The set for this signature / key is called Sr.

[0080] The vectors h(x) and g(x) defined by the service provider are securely received by organization A or users of organization A and the following computation is performed. Here, the computation can be performed entirely by organization A, or it can be performed partly by the users of organization A according to their own trigonometric function, and then the result can be summed.

[0081] 1 / f71\

[0082] p(x) = — I I sin(cj1%) h(x) l sin(cj1%)

[0083] \ '-7t /

[0084] 1 / cn\ H — I I sin(cj2x) h(x) j sin(cj2%) + •••

[0085] n \J-n / 1 / rTt \

[0086] H — H h(x)) cos (djsx^ 1 cos (dj^.

[0087]

[0088] The above computations result in a trigonometric function p(x). Obtaining this function quickly depends on the selected function h(x). If polynomial is selected, the operations can be performed even more efficiently.

[0089] From this function p(x) and the randomly selected function $(%), the following value k is obtained

[0090] 171

[0091] k = - p(x) g(x)

[0092] nJ-n

[0093] Since the integral operation has the property of distributing over addition, the final value of k can also be found by including the function g(x) in each addition operation when calculating p(x). In other words, for each addition operation above, the function g(x) is integrated as follows.

[0094]

[0095] The computation of the aforementioned value k is obtained after the operations performed separately for each element in the set S. This observation is the main idea of the method on how to determine the value of k in a common way by the predetermined users. The following theorem allows us to work in a wider area. This theorem has also been one of the main ideas in Fourier expansion.

[0096] Theorem: Let the set S be as stated above-.

[0097] S = {sin(c1x), sin(c2x),..., cos ^x), cos(d2x)... }.

[0098] Let the set S' consist of functions with as many elements as the number of elements of the set S and each element is obtained by randomly chosen r-s written as ℓi= risin(c1x) + ri2sin(c2x) + ••• + ridicos(d1x).

[0099]

[0100] The k value mentioned in the previous section can be computed as follows.

[0101] 1 ( rn\ ( rn\ 1 / * rn\ ( rn\k =~\ f1g(x) j / ip1+ — <> / l(x) ) 1 / ^2 + •••71V-7T / V-7T / 71\J-n ) V-7T /

[0102] 1 / rlt \ / r7T \ + 23 h(xyd.stdjs^(x) / ^7s11\J-71 / \J-7t /

[0103] wherein

[0104]

[0105] The above theorem brings the following convenience. Let the set S consist of the functions sin(CjX) and cos(d7x) as stated above. The number of elements in any set S' to be selected is equal to the number of elements in set S:

[0106] 1. Each element in the set S' must be written in terms of a linear combination of functions in the set S.

[0107] 2. Any element in the set S' must not be written in terms of a linear combination of other elements.

[0108] The Fourier expansion of any function is unique only if the above conditions are met. The uniqueness of this expansion is the most important basis of the method we present.

[0109] This theorem allows to use the set S or a linear combination of elements in the set S to generate the value k. In the light of this information: the method of computing the k value will enable the organization to use the internal access policy as desired. In such a way that the authorities within the organization only have some functions in the set S and only perform the computation required of them for the key to any given account. For example, let’s assume that the function is given to person B in the organization. Let us call g(x) and h(x) the secret functions specified by the service provider for digital signature management. The value that person B needs to compute is the number

[0110] 1 / f77\ / c71

[0111] — MO) MO)

[0112]

[0113] 71V-7T / \J-7r

[0114] The information required for the digital signature will be the sum of the values from the user as well as the number of elements in the set S. The signatory organization may implement the generation of this value in accordance with any internal policy. It can give some users one f t and some users more than one. The value computed by each user will then be used to reveal the secret number required for the signature. There is no correlation between the number of users and the number of elements in the set S, only the number of functions in the set S for a value of k needs to be processed.

[0115] It is not possible to obtain any information about fteven if the value occurred after the users’ own computations is known.

[0116] The method comprises essentially the following steps:

[0117] The user A:

[0118] 1. creates the set S = {f fn] with randomly selected trigonometric functions.

[0119] The service provider:

[0120] 1. For the computation of A, it selects 2 random functions. Let us call these functions h(x) and &(*)■

[0121] The user A:

[0122] 1. distributes the elements of the set to the authorities within the organization in accordance with the policy determined in advance. 2. The authorities generate the secret key of this asset by performing the above-mentioned computations with the given functions and $(%), h(x).

[0123] The key / digital signature obtained by the method described above is used to access data. Here, the service provider is a server. The users have a data processing device, and said data processing device can be a computer or a mobile device. Here, the data processing device is configured to carry out the steps c and / or d of claim 1. The server is configured to generate said random functions and transmit them to said user data processing devices and process the information from the data processing devices to generate the key / signature.

[0124] Here, a digital key / signature refers to a secure combination of characters that provides authorization to access a database or initiate an operation.

[0125] The present invention comprises a data processing system capable of carrying out said method, a computer program for executing the data processing system according to said method, and a carrier for storing said program. REFERENCES

[0126] [1] Communications of the ACM, Volume 22, Issue 11, Pages 612 - 613. https: / / doi.org / 10.1145 / 359168.359176

[0127] [2] https: / / polen.itu.edu.tr / items / 8c3dfca0-4f65-43c2-9504-352ff9f9d86e

Claims

CLAIMS1. A computer-implemented method for computing a digital secret key to provide access, characterized in that it comprises the steps ofa) providing said trigonometric functions from multiple users with at least one trigonometric function of a set of trigonometric functions,b) determining, by the service provider, two random functions with real or complex coefficients that can be integrated in the interval [— TT, TT], c) integrating each of the trigonometric functions provided by multiple users in the interval [— TT, TT] with one of said random functions and summing the obtained values and then dividing by TT,d) generating the secret key by integrating the value obtained in step c with the other one of the random functions in the interval [— TT, TT] and by summing the obtained values and then dividing by TT.

2. A method according to claim 1, characterized in that in step c, the operationPW =; (fZ sin(c£1x) h(x)) sin(c£1x) + (J^ sin(c£2x) h(x)) sin(c£2x) + "• +^(Ch(*)) cos (dJsx} ) cos (dJsx}.is provided, and wherein x is the trigonometric function variable, c and d are the trigonometric function coefficients, i and j are the index values, h(x) and g(x) are said random functions, and p(x) is the value obtained at step c.

3. A method according to claim 2, characterized in that in step d, the operation171k = - p(x) p(%)nJ-nis provided, and wherein k is a secret key.A method according to claim 1, characterized in that for the realization of steps c and d, the random function used in step d is included in each addition operation when computing the value obtained in step c.

5. A method according to claim 4, characterized in that for the realization of steps c and d, the operationg(*)is provided, and wherein x is the trigonometric function variable, c and d are the trigonometric function coefficients, i and j are the index values, h(x) and g(x) are said random functions, p(x) is the value obtained at step c, and k is a secret key.

6. A method according to claim 1, characterized in that the trigonometric functions are single trigonometric functions.

7. A method according to claim 1 or 6, characterized in that said set of trigonometric functions is given bynUiSin (QX) + bjcos (dji=land wherein the coefficientsand are selected from any real number and Cj and dtare selected from natural numbers.

8. A method according to claim 1, characterized in that the coefficients of said random functions are selected as integers.

9. A method according to claim 1, characterized in that said random functions are polynomial functions.

10. A method according to any one of the preceding claims, characterized in that each of the multiple users performs steps c and d with said random functions provided by the service provider and the values obtained from all users are summed to generate the secret key.

11. A method according to any one of the preceding claims, characterized in that the trigonometric functions provided by multiple users form a subset of said set.

12. A method according to claim 11, characterized in that it is provided that every element in said subset is a linear combination of functions in a set of said trigonometric functions and no element in the subset is a linear combination of any other element in the subset.

13. A data processing system comprising means for performing the steps of a method according to any one of claims 1-12.

14. A computer program comprising instructions that, when executed by a data processing system according to claim 13, cause the data processing system to perform the steps of the method according to any one of claims 1-12.

15. A computer-readable data carrier, in which a computer program according to claim 13 is stored.

Images