signature=35acbbc22d8329429967120a125263a4,Cryptographic communication system

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a zero knowledge interactive protocol wherein the prover convinces the verifier of a statement without revealing it, using the mismatch between discrete logarithms employed in undeniable signatures which the prover cannot deny their validity if they were produced by the prover himself.

2. Description of the Related Art

Undeniable signatures are electronic signatures proposed by D. Chaum. This cryptographic technique employs a number system having a group G of order q of mod p (where p and q are prime numbers and the relation q|(p−1) holds, i.e., (p−1) is divisible by q. The signer uses y=gx(i.e., an element of the group G) and the primitive element g as a public key and uses x as a private key. A signature SIG on a message m is performed by the signer computing SIG=mx. If it can be shown that, for a signature (m, SIG), the discrete log x′ to the base m of SIG=mx′ equals the discrete log x to the base g of a relation y=gx, the signature is said to be verified. If SIG′≠mxis shown for a signature (m, SIG′), it can be the that the signature is a fake. In general terms, the undeniable signature system requires that the prover must show equality/inequality between the discrete log of an input value y to the base g and the discrete log of an input value SIG to the base m and that the verifier must confirm this relation.

A prior art undeniable signature protocol is disclosed in the literature by D. Chaum “Zero-Knowledge Undeniable Signatures, Advance in Cryptology, Proceedings of Eurocrypt '00, LNCS 473, Springer-Verlag, pp. 458-464, 1991. As shown in FIG. 1, a typical example of a cryptographic communication system based on the zero-knowledge undesirable signature protocol is comprised of a prover 500 and a verifier 550, interconnected by a communications channel. Prover 500 is connected to a private key memory 501, a public key memory 502 and a random number generator 503. The element x of Z/qZ is stored in the private key memory 501. Prime numbers p and q of sufficiently large value having the relation q|(p−1), and elements g, m, z of a subgroup Gq of order q of (Z/pZ)* are stored in the public key memory 502 (note that z≠mxmod p). Verifier 550 is associated with a public key memory 551 and a random number generator 552. In the public key memory 551 the verifier 550 shares the same public key information as that of the prover 500. Prover 500 establishes a proof that z≠mxwithout revealing x to the verifier 550. Verifier 550 uses the random number generator 552 to generate a random value “x” smaller than “k” and a random value “a” as an element of Z/qZ, and computes c[1]=msgamod p and c[2]=zs(gx)amod p (block 553) and transmits a message 561 containing the results of the computations c[1] and c[2] to the prover 500. In response, the prover 500 makes a search through values 1 to k for detecting a value s′ that satisfies the relation c[1]x/c[2]=(mx/z)s′ mod p (block 504). As long as the verifier 550 behaves legitimately and the relation z≠mxholds, this search results in the finding of a unique value s′ which corresponds to a value the verifier 550 would find. Since the value s′ found by the prover 500 satisfies the relation z=mxmod p, the probability that the verifier 550 selects the value s′ is 1/k. Prover 500 uses the random number generator 503 to generate a random value “r” and uses it to generate a commitment of s′ (block 505) and transmits commit (r, s′) to the verifier 550. Verifier 550 responds to it by sending the random value “a” which was generated in the random number generator 55 (block 554). Using the transmitted random value, the prover 500 checks to see that if relations c[1]=ms′gamod p and c[2]=zs′(gx)amod p are established (block 506). If the prover 500 confirms that these relations hold, it replies with the random value “r”. In response to receipt of this random value, the verifier 550 determines whether s′ coincides with s (block 555). If s′=s, the verifier 550 accepts the response as a valid proof; otherwise, it denies the response, thus completing a round of interactions (block 556). This round of interactions is repeated so that the probability of prover 500 cheating the verifier 550 is sufficiently reduced.

In the Chaum's zero-knowledge signature system, the prover is required to make a search for s′ in the range of values 1 to k that satisfies the relation c[1]x/c[2]=(mx/z)s′ mod p. Since this search involves a sequence of determinations each using a different value of s′ on a trial-and-error basis, the system works at low efficiency. Furthermore, in each round of interactions, the verifier is required to generate a random value s and send it to the prover. Therefore, proof is impossible without sending messages from the verifier to the prover.

Another prior art undeniable signature is disclosed by M. Michels et al., in the literature “Efficient Convertible Undeniable Signature Schemes”, Proceedings of 4thAnnual Workshop on Selected Areas in Cryptography, SAC '97, August 1997. This prior art protocol allows the prover to prove his own signature without assistance from the verifier. However, the prover is required to transmit the parameter mxto the verifier, indicating that “no signature is made on the secret message”. Since the revealing of this information to the verifier implies that a signature has been unintentionally handed over to the verifier, the circumstance resulting from the transmission of mxcontradicts its intended purpose.

SUMMARY OF THE INVENTION

It is therefore an object of the present invention to provide a cryptographic system capable of efficiently establishing a mismatch between discrete logarithms.

A further object of the present invention is to provide a cryptographic system, which allows the prover to establish a proof without assistance from the verifier, while revealing no secret information to the verifier.

According to a first aspect of the present invention, there is provided a cryptographic communication system comprising a store for storing a plurality of elements a, b, c, d of a finite group as a public key and a parameter “x” as a private key, wherein “x” is equal to discrete logarithm of “b” to base “a”, and random values β, γ and δ are generated. The prover is connected through a communication channel to the verifier and accessible to the public key, the private key and the random values. The prover performs the functions of calculating e=aαbβ, g=cαdβ and h=cγdδ, where α=γ+x(δ−β), transmitting e, g and h to the channel, and showing to the communication channel that relations aα″bβ″=e, cα″dβ″=g, aγ″bδ″=e, and cγ″dδ″=h are established without transmitting α″, b″, γ″, δ″ to the channel (where α″, β″, γ″ and δ″ are random values). The verifier is accessible only to the public key for receiving the transmitted e, g, h, and determining whether the prover is capable of establishing the relations by using the public key and the received e, g, h, and determining whether there is a mismatch between g and h, whereby the prover establishes a proof that the parameter x is not equal to discrete logarithm of “d” to base “c” only if the verifier determines that the relations are established and detects the mismatch.

In a preferred embodiment, the prover is configured to generate a set of random values and a set of commitment values using the set of random values, and transmit the commitment values to the verifier. The verifier is configured to generate a pair of random values in response to the commitment values from the prover, transmit the pair of random values to the prover for challenging the commitment values. In response, the prover generates a set of response values using the public key, the set of random values and the received challenging random values, and transmits the response values to the verifier. In response, the verifier determines whether the prover is capable of establishing the relations aα″bβ″/=e, cα″dβ″=g, aγ″bδ″=e, and cγ″dδ″=h based on the received response values and the received commitment values and the transmitted challenging values.

According to a second aspect, the present invention provides a method for identification of a prover to a verifier, comprising the steps of (a) storing a plurality of elements a, b, c, d of a finite group as a public key and a parameter “x” as a private key, wherein “x” is equal to discrete logarithm of “b” to base “a”, wherein said prover is accessible to said public key and said private key and said verifier is only accessible to said public key, (b) generating random values β, γ and δ by the prover, (c) calculating e=aαbβ, g=cαdβ and h=cγdδ, where α=γ+x(δ−β) by the prover, (d) transmitting e, g and h to the verifier, (e) showing to the verifier that relations aα″bβ″=e, cα″dβ″=g, aγ″bδ″=e, and cγ″dδ″=h are established without transmitting α″, β″, γ″, γ″ (where α″, β″, γ″ and δ″ are random values), (f) receiving the transmitted e, g, and h at the verifier, (g) determining by the verifier whether said prover is capable of establishing said relations by using the public key and the received e, g and h, and (h) determining by the verifier whether there is a mismatch between g and h, whereby the prover establishes a proof that the parameter x is not equal to discrete logarithm of “d” to base “c” only if the verifier determines that said relations are established and detects said mismatch.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be described in detail further with reference to the following drawings, in which:

FIG. 1 is a block diagram of a prior art cryptographic communication system;

FIG. 2 is a block diagram of a cryptographic communication system according to a first embodiment of the present invention;

FIG. 3 is a block diagram of a first implementation of the first embodiment of the present invention;

FIG. 4 is a block diagram of a second implementation of the first embodiment of the present invention;

FIG. 5 is a block diagram of a third implementation of the first embodiment of the present invention; and

FIG. 6 is a block diagram of a cryptographic communication system according to a second embodiment of the present invention.

DETAILED DESCRIPTION

In the following description, parameters p and q are prime numbers which establish the relation q|(p−1), i.e., (p−1) is divisible by the prime number q. Parameters a, b, c and d are the elements of a finite group of order q of mod p, and these parameters satisfy the relations b=axmod p and d≠cxmodp.

Referring now to FIG. 2, there is shown a cryptographic communication system according to a first embodiment of the present invention, in which the prover 100 is connected to the verifier 150 via a communication channel 120. As described below, the prover 100 establishes a proof that the discrete logarithm of “b” to base “a” is not equal to the discrete logarithm of “d” to base “c”.

Prover 100 is connected to a pseudorandom number generator 101, a public key memory 102 and a private key memory 103, and the verifier 150 is connected to a public key memory 151.

The parameters p, q, a, b, c, d are stored in each of the public key memories 102 and 151. A private key “x” that satisfies the relation b=axmod p is stored in the private key memory 103.

Prover 100 activates the pseudorandom number generator 101 to generate a set of random values β, γ and δ∈Z/qZ. In conversion process, the prover 100 reads public key parameters p, q, a, b, c, d from the public key memory 102 and private key parameter x from the private key memory 103 and performs the following calculations using the generated random values β, γ and δ (block 104):

α=γ+x(δ−β) mod q (1a)

e=aαbβ mod p (1b)

g=cαdβ mod p (1c)

h=cγdδ mod p (1d)

Prover 100 transmits the calculated parameters e, g and h to the verifier 150 which receives the transmitted parameters e, g and h and stores them along with the public key parameters p, q, a, b, c, d (block 153).

A first round of interactions proceeds between the prover 100 and the verifier 150. In the first round of interactions, the prover 100 uses a first set of parameters p, q, a, b, c, d, e, g, α, β, and the verifier 150 uses a second set of parameters p, q, a, b, c, d, e, g.

The prover and the verifier interact with each other so that the prover 100 establishes a proof that it can produce parameters α″ and β″ of the following equations:

aα″bβ″=e mod p (2a)

cα″dβ″=g mod p (2b)

without transmitting these parameters from the prover 100 to the verifier 150 (where α″ and β″ are random values).

This is done as follows. Initially, the prover 100 causes the PN generator to select random values α′ and β′ from a finite group of order q of mod p and calculates the following equations (block 105):

e1′=aα′bβ′ mod p (3a)

g′=cα′dβ′ mod p (3b)

and then transmits e1′ and g′ to the verifier 150. In response, the verifier 150 randomly selects an integer S1in a range of values from 0 to q−1 and transmits the selected integer S1to the prover 100 and waits for a response (block 154). On receiving the random value S1(block 106), the prover 100 calculates the following equations:

R1=S1α+α′ mod q (4a)

R2=S1β+β′ mod q (4b)

and sends R1and R2to the verifier 150.

In response to receipt of R1and R2, the verifier 150 determines whether the following equations can be established (block 154):

eS1e1′=aR1bR2mod p (5a)

gS1g′=cR1dR2mod p (5b)

If Equations (11-1) and (12-1) are established, the verifier 150 determines that the prover 100 is in possession of the knowledge of parameters α″ and β″ (block 155). Otherwise, it proceeds to deny the identification of the prover 100 (block 161).

In a similar manner, a second round of interactions proceeds between the proverbO and the verifier 150. In this case, the prover 100 uses a third set of parameters p, q, a, b, c, d, e, h, γ, δ and the verifier 150 uses a fourth set of parameters p, q, a, b, c, d, e, h. They interact with each other so that the prover 100 proves that it can produce parameters γ″ and δ″ of Equations (6a) and (6b):

aγ″bδ″=e mod p (6a)

cγ″dδ″=h mod p (6b)

without revealing γ″ and δ″ to the verifier 150 (where γ and δ are random values). In this case, the prover 100 causes the PN generator to select random values γ′ and δ′ from a group of order q of mod p and calculates the following equations (block 107):

e2′=aγ′bδ′ mod p (7a)

h′=cγ′dδ′ mod p (7b)

and then transmits e2′ and h′ to the verifier 150. In response, the verifier 150 randomly selects an integer S2in a range of values from 0 to q−1 and transmits the selected integer S2to the prover 100 and waits for a response (block 156). Then, the prover 100 calculates the following equations,

R3=S2γ+γ′ mod q (8a)

R4=S2δ+δ′ mod q (8b)

and sends R3and R4to the verifier 150 (block 108). In response, the verifier 150 determines whether the following equations can be established (block 156):

eS2e2′=aR3bR4mod p (9a)

hS2h′=cR3dR4mod p (9b)

If Equations (9a) and (9b) are established, the verifier 150 determines that the prover 100 is in possession of the knowledge of parameters γ″ and δ″ (block 157) and proceeds to block 158 to determine whether the following relation holds:

g≠h mod p (10)

If Equation (13) is established (block 159), Verifier 150 accepts the identification of the prover (block 160), verifying that the electronic signature provided by the prover 100 is authentic. Otherwise, the verifier 150 proceeds to block 161.

In order to verify the validity of the present invention, assume that the private key “x” should satisfy relations b=axmod p and d=cxmod p, then the following relations will be established:

e=aαbβ mod p=aα+βxmod p

g=cαdβ mod p=cα+βxmod p

e=aγbδ mod p=aγ+δxmod p

h=cγdδ mod p=cγ+δxmod p

As a result, relations α+βx=γ+δx will be established. This indicates that the undesired relation g=h mod p holds. In addition, the present invention proves the presence of a mismatch between the discrete logarithm of b to base a and the discrete logarithm of d to base c by simultaneously showing the presence of a mismatch between g and h and the presence of α, β, γ and δ which satisfy e=aαbβ mod p, g=cαdβ mod p, e=aγbδ mod p, and h=cγd67 mod p.

Since the present invention eliminates the need to perform successive search for finding a predetermined value, the processing speed is much higher than the Chaum's prior art. Additionally, the present invention guarantees no possibility of the secrete information being revealed to the verifier.

FIG. 3 is a block diagram of a first practical implementation of the present invention in which parts corresponding to those of FIG. 2 are marked with the same numerals and the description thereof are omitted for simplicity.

Following block 104, the prover 100 proceeds to block 201 to generate random values α′, β′, γ′, δ′ and calculates the following equations:

e1′=aα′bβ′ mod p (11a)

g′=cα′dβ′ mod p (11b)

e2′=aγ′bδ′ mod p (11c)

h′=cγ′dδ′ mod p (11d)

and transmits e1′, g′, e2′, h′ as commitment values to the verifier 150.

In response to the commitment values, the verifier 150 activates a pseudorandom number generator 153 (block 251) to produce random values S1, S2∈field Z/qZ and transmits the random values to the prover 100 as challenge values to the prover 100 and waits for a response.

Using the transmitted challenge values S1, S2, the prover 100 calculates the following equations (block 202):

R1=S1α+α′ mod q (12a)

R2=S1β+β′ mod q (12b)

R3=S2γ+γ′ mod q (12c)

R4=S2δ+δ′ mod q (12d)

and sends R1, R2, R3, R4to the verifier 150 as response values.

On receiving the response values from the prover 100, the verifier 150 determines whether the following equations can be established (block 252):

eS1e1′=aR1bR2mod p (13a)

gS1g′=cR1dR2mod p (13b)

eS1e2′=aR3bR4mod p (13c)

hS2h′=cR3dR4mod p (13d)

If the verifier determines that all Equations (13a), (13b), (13c) and (13d) are established (block 253), it proceeds to decision block 153 to detect for a mismatch between g and h. Otherwise, the verifier 150 proceeds to denial block 161.

FIG. 4 is a second practical implementation of the present invention.

Following block 104, the prover 100 proceeds to block 301 to generate random values G, H and transmits them to the verifier 150. Using the transmitted random values G and H, the verifier 150 generates random values S1and S2and calculates the following equation (block 351):

S″=GS1HS2mod p (14)

and transmits the calculated value S″ as a challenging value to the prover 100.

Prover 100 responds to the challenging value S″ by activating the pseudorandom number generator 101 to generate random values α′, β′, γ′, and δ′ and calculates the following equations (block 302):

e1′=aα′bβ′ mod p (15a)

g′=cα′dβ′ mod p (15b)

e2′=aγ′bδ′ mod p (15c)

h′=cγ′dδ′ mod p (15c)

and transmits e1′, g′, e2′, h′ as commitment values to the verifier 150.

In response to the commitment values, the verifier 150 transmits the random values S1and S2to the prover 100 (block 352).

In block 302, the prover 100 determines if the relation S″=GS1HS2mod p holds. If the decision in block 304 is negative, the prover 100 terminates its routine. If the decision is affirmative in block 304, the verifier 150 proceeds to block 305 to calculate the following equations:

R1=S1α+α′ mod q (16a)

R2=S1β+β′ mod q (16b)

R3=S2γ+γ′ mod q (16c)

R4=S2δ+δ′ mod q (16d)

and transmits the calculated values R1through R4as response values to the verifier 150.

Using the transmitted response values, the verifier 150 determines whether the following equations are established (blocks 353, 354):

eS1e1′=aR1bR2mod p (17a)

gS1g′=cR1dR2mod p (17b)

eS1e2′=aR3bR4mod p (17c)

hS2h′=cR3dR4mod p (17d)

If all of these equations are established, the decision in block 354 is affirmative and the verifier proceeds to block 158, otherwise to block 161.

FIG. 5 is a block diagram of a third practical implementation of the present invention.

Following block 104, the prover 100 proceeds to block 401 to generate random values α′, β′, γ′ and δ′ and calculates the following equations to generate commitment values e1′, g′, e2′ and h′:

e1′=aα′bβ′ mod p (18a)

g′=cα′dβ′ mod p (18b)

e2′=aγ′bδ′ mod p (18c)

h′=cγ′dδ′ mod p (18d)

In block 402, the prover 100 uses the public key a, b, c, d and the generated commitment values to calculate the following Hash functions to produce auto-challenge values S1and S2:

S1=H(p, q, a, b, c, d, e, g, e, g, e1′, g′) (19a)

S2=H(p, q, a, b, c, d, e, g, e, h, e2′, h′) (19b)

In block 403, the prover 100 calculates the following equations using the auto-challenge values S1and S2to produce response values R1, R2, R3and R4:

R1=S1α+α′ mod q (20a)

R2=S1β+β′ mod q (20b)

R3=S2γ+γ′ mod q (20c)

R4=S2δ+δ′ mod q (20d)

and transmits the commitment values and the response values to the verifier 150.

Using the transmitted commitment values and the response values, and the public key a, b, c, d, the verifier 150 calculates the following Hash functions to generate challenge-recovery values S1′ and S2′ (block 451):

S1′=H(p, q, a, b, c, d, e, g, e, g, e1′, g′) (21a)

S2′=H(p, q, a, b, c, d, e, g, e, h, e2′, h′) (21b)

In block 452, the verifier 150 determines whether the following relations are established:

eS1e1′=aR1bR2mod p (22a)

gS1g′=cR1dR2mod p (22b)

eS1e2′=aR3bR4mod p (22c)

hS2h′=cR3dR4mod p (22d)

If these relations are established (in block 453), the verifier 150 proceeds to decision block 158, otherwise to block 161. Since this implementation eliminates communication from the verifier to the prover, the processing speed is higher than those described above.

The present invention can be implemented in a manner as shown in FIG. 6. In this implementation, a parameter P represents an elliptic curve of order q and parameters A, B, C and D are elements of the elliptic curve P, where the relations B=[x]A and D≠[x]B are satisfied. Note that [x]A represents a multiple x of point A on the elliptic curve P.

Both of the prover 600 and the verifier 650 share the public key represented by P, q, A, B, C and D in their respective memories 602 and 651. Private key “x” is stored in the private key memory 603 of the prover. Prover uses a PN generator 601 to generate random values β, γ and δ, and the verifier 150 uses a PN generator 652 to generate random values S1and S2.

In block 604, the prover 600 calculates the following equations to generate parameters E, G and H:

α=γ+x(δ−β) mod q (23a)

E=[α]A[β]B (23b)

G=[α]C[β]D (23c)

H=[γ]C[δ]D (23d)

and transmits the parameters E, G and H to the verifier 650 (block 604).

Verifier 650 receives the transmitted parameters and store P, A, B, C, D, E, G and H in memory (block 653).

Following block 604, the prover 600 and the verifier 650 interact with each other to establish the following relations:

[α″]A+[β″]B=E (24a)

[α″]C+[β″]D=G (24b)

[γ″]A+[γ″]B=E (24c)

[γ″]C+[γΔ]D=H (24d)

This is achieved as follows:

Prover 600 first calculates the following equations to produce commitment values E1′, G′, E2′ and H′:

E1+=[α′]A[β′]B (25a)

G′=[α′]C[β′]D (25b)

E2′=[γ′]A[β′]B (25c)

H′=[γ′]C[δ′]D (25d)

and transmits the commitment values to the verifier 650 (block 605).

On receiving the commitment values, the verifier 650 generates random values S1and S2as challenging values and sends them to the prover 600 (block 654).

Prover 600 then calculates the following equations to produce response values R1˜R4:

R1=S1α+α′ mod q (26a)

R2=S1β+β′ mod q (26b)

R3=S2γ+γ′ mod q (26c)

R4=S2δ+δ′ mod q (26d)

and transmits the response values to the verifier 650 (block 606).

In response, the verifier 650 calculates the following equations (block 655) and determines if they are established (block 656):

[S1]EE1′=[R1]A+[R2]B (27a)

[S1]GG′=[R1]C+[R2]D (27b)

[S2]EE2′=[R3]A+[R4]B (27c)

[S2]HH′=[R3]C+[R4]D (27d)

If the decision in block 656 is affirmative, the verifier 650 determines whether the following relation holds (block 657):

G≠H mod P (28)

If this relation holds (block 658), the verifier identifies the prover as authentic (block 1600). If the decision in block 656 or 658 is negative, the verifier denies the authenticity of the prover (block 161).