Pseudonym Signing Method for Low-Power Chip Cards
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity document systems face challenges in providing secure pseudonymous signatures with low calculation power, as they require complex computations that are not feasible on low-power electronic chips used in identity documents, and there is a risk of key management authority misuse if signature keys are stored or pooled.
Innovation Solution
A pseudonym signing method using modular integers and bilinear pairings, where a user device generates a pseudonym and signature with reduced computational load, and a zero-knowledge proof is used to verify knowledge of the secret management key without revealing it, ensuring security and preventing key authority misuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex pseudonymous signature protocols are implemented, then security level is improved, but computational power requirement increases beyond what low-power chips can provide
Solution Approach 1:
The signature key is segmented into multiple parts (first key part generated by user device, second key part generated by key managing authority). This segmentation allows the user device to perform only lightweight operations locally while the authority handles more complex key generation, reducing the computational burden on low-power chips while maintaining security.
Solution Approach 2:
A key managing authority is introduced as an intermediary between users and the signature system. The authority generates the second key part and provides zero-knowledge proofs to verify user knowledge of the first key part without revealing it. This intermediary approach enables secure pseudonymous signatures with reduced computational requirements at the user device level.
2Ease of operation
If signature keys are stored by key managing authority, then key distribution is simplified, but risk of unauthorized key usage increases
Solution Approach 1:
The critical secret information (first key part) is extracted from the key managing authority and generated locally by the user device. The authority only stores and manages the second key part, which alone is insufficient to create valid signatures. This extraction eliminates the risk of unauthorized key usage by the authority while maintaining simplified key distribution for the second key part.
Solution Approach 2:
The user device performs preliminary action by generating the first key part and proving knowledge of it through zero-knowledge proof before receiving the second key part from the authority. This preliminary action ensures that even if the authority stores key material, it cannot misuse it without the user's consent and presence, as the authority lacks the first key part needed for signature generation.
3Adaptability or versatility
If multiple users pool their signature keys, then collective signing capability is enabled, but security is compromised as authorities can be identified
Solution Approach 1:
Each user maintains local quality of their own first key part that is unique to them and never shared. When multiple users participate in collective signing, each contributes their local secret without revealing it. The system verifies each user's local knowledge through zero-knowledge proofs, enabling collective capability while preserving individual anonymity and preventing identification of participating authorities.
Data Source
AI summary
The invention relates to a method of signature with pseudonym σ of a message m by a user device storing a secret signature key sk dependent at least on a first part of key f, on a second part of key x and on a third part of key A equal to (g1hf)1/(x+y) and comprising the following steps: —generation of a pseudonym nym equal to hf dpkx, with dpk a public domain parameter, —determination of random numbers a, r_a, r_f, r_x, r_b, r_d, —calculation of signature coefficients R1 equal to hr_Jdpkr_x, R2 equal to nymr_ah−r_ddpk−r_b, R3 equal to Zr_x Va−r_x−r_f−r_b W−r_a, with Z, V and W respectively equal to e(A, g2), e(h, g2) and e(h,w), —obtaining of a first signature parameter T equal to Aha, —calculation of a second signature parameter c by applying a cryptographic hash function H, to the public domain parameter dpk, to the pseudonym nym, to the first signature parameter T, to the signature coefficients R1, R2, R3 and to the message m, —calculation of signature parameters s_f, s_x, s_a, s_b, s_d, respectively equal to r_f+c.f, r_x+c.x, r_a+c.a, r_b+c.a.x and r_d+c.a.f, —generation of said signature with pseudonym σ of said message m on the basis of said signature parameters.