Selective Digital Signature Revocation via Hash-Based Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital signature revocation methods do not allow for selective revocation of specific uses of a private key on a document, even when the document and key are valid, leading to unnecessary restrictions on the key's usage.
Innovation Solution
A signature revocation list is created and periodically published, using a signature hash as an identifier, which includes a revocation time and reason, allowing for selective revocation of specific instances of digital signatures based on signing time, thereby distinguishing between different uses of the same private key on the same document.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate is revoked to ensure security, then the reliability of the system is improved, but the private key cannot be used for any document even when the document and key are valid, reducing the versatility of the key
Solution Approach 1:
The patent segments the revocation mechanism from the certificate level to the signature level. Instead of revoking the entire certificate and all its associated private key uses, the system creates individual signature revocation entries that target only specific signature instances. This allows the private key to remain valid for other documents and future signings while selectively revoking only the compromised or problematic signature uses.
2Object-affected harmful factors
If certificate revocation is implemented to prevent unauthorized use, then the harmful factors are reduced, but all uses of the private key on all documents are affected, causing loss of information about selective validity
Solution Approach 1:
The patent applies local quality by making revocation status specific to each signature instance rather than applying it globally to the entire certificate. Each signature in the signature revocation list has its own revocation status, reason, and timestamp, allowing the system to maintain fine-grained control over which specific uses of the private key are invalidated while preserving the validity information for other uses.
3Measurement precision
If a signature revocation list is created with signature hash identifiers, then the precision of revocation tracking is improved, but the complexity of the system increases
Solution Approach 1:
The patent uses cryptographic hashing to create a compact representation (signature hash) of each signature. This hash serves as a unique identifier that can be stored and compared efficiently in the signature revocation list. Instead of storing and comparing entire signature data structures, the system works with these condensed hash copies, maintaining precise identification capability while reducing the computational and storage complexity of the revocation system.
Data Source
AI summary
A method and apparatus for revoking a digital signature using a signature revocation list. In one embodiment, the method includes generating the signature revocation list to indicate revocation status of a signature. The signature is created from an encryption key and a document. The method also includes computing an identifier of the signature in the signature revocation list based on contents of the signature. The method further includes publishing the signature revocation list for access by users of the document.