Security Token Signature Generation via Sequential Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Smart card signature generation is often hindered by limited computing capacity and memory resources, leading to increased time consumption and potential security reductions in time-critical applications.
Innovation Solution
A method where a security token processes message parts sequentially, applying intermediate and termination functions of a hash function to calculate a first hash value, freeing memory after each part is processed, and using this value to generate a signature, reducing memory requirements and processing load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire message is stored in memory before signature generation, then the signature can be generated correctly, but the memory consumption increases significantly
Solution Approach 1:
The message is divided into multiple parts that are processed sequentially. The hash function is applied to each part individually, and the results are combined to produce the final hash value. This segmentation allows the system to process the message without loading the entire message into memory simultaneously, thus reducing memory consumption while maintaining signature generation correctness.
Solution Approach 2:
The hash function is applied to each message part as it becomes available, rather than waiting for the entire message to be loaded. This preliminary processing of individual parts allows the system to start generating the signature early in the message transmission process, reducing both memory requirements and overall processing time.
2Device complexity
If the hash function is applied to the entire message at once, then the signature generation is straightforward, but the processing time increases for large messages
Solution Approach 1:
The message processing is segmented into multiple smaller operations, each handling a portion of the message. The hash function is applied to each segment individually, and the intermediate results are combined. This segmentation reduces the computational burden on the smart card processor at any given moment, thereby reducing processing time while maintaining the correctness of the signature generation process.
Solution Approach 2:
The signature generation process continues as the message is being transmitted, rather than waiting for the complete message. The hash function is continuously applied to incoming message parts, allowing overlapping of message transmission and processing operations. This continuous processing reduces the total time required for signature generation.
3Reliability
If all message parts are kept in memory until signature completion, then the signature can be verified correctly, but the memory resources are exhausted
Solution Approach 1:
Each message part is discarded from memory immediately after the hash function has been applied to it, rather than being retained for the duration of the entire signature generation process. The intermediate hash results are retained only until they are combined with other intermediate results. This discarding and recovering approach maintains the necessary data for correct signature verification while minimizing memory resource consumption.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The invention relates to a method for generating a signature (214) for a message (M) by a processor (116) of a security token (102), the method comprising: - sequential provision (302) of parts (T1-T7) of the message (M); - during the sequential provision, applying (304) an intermediate value function (ZWF) or a completion function (AF) of a hash function (110) to each of the parts of the message immediately after the provision of said part to stepwise compute a first hash value (#H1), wherein the first hash value (#H1) is identical to a value that would have been obtained by applying the hash function (110) to the entire message (M); - provision (306) of one or more data values (D1-D4);- after calculating the first hash value (#H1), generating (308) a concatenated value (K) by concatenating the one or more data values (D1-D4) and the calculated first hash value (#H1), excluding the message from the concatenation; - applying (310) the hash function (110) to the concatenated value (K) to calculate a second hash value (#H2); - outputting (312) the second hash value (#H2) for use as the signature (214) or as a part of that signature.;