WO2003063410A1

WO2003063410A1 - Cryptosystem

Info

Publication number: WO2003063410A1
Application number: PCT/GB2003/000202
Authority: WO
Inventors: Hyun Ku Dr Yeun
Original assignee: Hogg, Jeffery, Keith
Priority date: 2002-01-21
Filing date: 2003-01-21
Publication date: 2003-07-31
Also published as: GB0201282D0; GB2384406B; GB2384406A

Abstract

Users (A, B) send and receive messages in a cryptosystem with the help of a trusted third party (TTP) making use of private keys (X) and public parameters (P) which encapsulate said private keys (X), each user (A, B) and the trusted third party (TTP) being entrusted with a private key (XA1, XB1), (xA2, XB2). The trusted third party (TTP) is adapted so that it is responsive to a challenge (CHA) from a user (A, B) by issuing a response (RES) which encapsulates the corresponding private key (XA2, XB2) so that the user can use the response (RES) in combination with the private key (XA1, XB1) already held by the user to decrypt or sign a message. Preferably, the encryption process and the challenge make use of public parameters (P) and private parameters (r1, r2) generated by the transmitting user. A signature Sig(M) comprises one part (S1) generated by the transmitting user to encapsulate the private key (XA1) held by the transmitting user, and another part (S2) encapsulating the response (RES) from the trusted third party (TTP).

Description

CRYPTOSYSTEM

Field of the Invention

This invention relates to cryptosystems and methods for encrypting/decrypting and signing messages.

Background of the Invention

In 1976 Diffie and Hellman introduced the public key exchange that is based on the Diffie Hellman Problem (DHP) that is closely related to the well known Discrete Logarithm Problem (DLP). The intractability of DLP is equivalent to the security of the ElGamal public key scheme. The RSA public key cryptosystem was introduced in 1978, and may be used for both secrecy and digital signatures. The RSA cryptosystem works in Z_n, where n is the product of two large primes p and q, and its security is based on the difficulty of factoring n, that is, the integer factorization problem. Since then, various ElGamal and RSA type cryptosystems have been proposed to enhance existing defences against "chosen ciphertext attacks".

In 1984 Shamir proposed identity-based cryptosystems and signature schemes that enable simple key management in email systems. For example, when Alice sends an email to Bob at bob@cipherdoctor.com, she simply encrypts her message using the public key string bob@cipherdoctor.com. There is no need for Alice to obtain Bob's public key certificate. When Bob receives the encrypted email he contacts a Trusted Third Party (TTP). Bob authenticates himself to the TTP and obtains his private key from the TTP. Bob can then read his email. This system does not require a Public Key Infrastructure (PKI) so Alice can send encrypted email to Bob even if Bob has not set up his public key certificate. However, this system employs key escrow since the TTP knows Bob's private key.

Summary of the Invention

An object of the invention is to provide an improved cryptosystem which has equivalent functionality to ID based public key cryptosystems, but which avoids the need for key escrow/PKI. The invention consists in a cryptosystem in which users send and receive messages with the help of a trusted third party for security purposes making use of private keys and public parameters which encapsulate said private keys, each user holding a private key and the trusted third party being entrusted with a corresponding private key for each user, and the trusted third party being adapted so that it is responsive to a challenge from a user by issuing a response which encapsulates the corresponding private key so that the user can use the response in combination with the private key already held by the user to decrypt or sign a message.

When the cryptosystem operates to encrypt/decrypt a message, the transmitting user encrypts the message to a recipient user using the public parameters which encapsulate the private keys of the recipient user. One of these private keys is held by the recipient user, but the other is held by the trusted third party, and thus the recipient user issues a challenge to the trusted third party so as to obtain a response in which the other private key is encapsulated. The private key held by the trusted third party is therefore kept secret, but it can be accessed by the recipient in its encapsulated form and used to decrypt the message.

Preferably, the encryption process also makes use of private parameters generated by the transmitting user, and these are transmitted to the recipient user for use in the challenge and response so that the decryption process is suitably enabled. These private parameters, as well as increasing encryption security, also serve to encapsulate the private key in the response.

When the cryptosystem operates to sign a message, the transmitting user creates a multi-part signature which is transmitted with the message so that a recipient user can check the signature against the signed message. The signature comprises one part generated directly by the transmitting user so as to encapsulate the private key held by the transmitting user, and another part encapsulating the response from the trusted third party following a challenge by the transmitting user, so that it incorporates the private key of the transmitting user held in trust by the trusted third party. Preferably, the signature also includes a private parameter generated by the transmitting user which is used in generating the other two parts of the signature and which is transmitted with said other two parts to the recipient user for checking the signed message. This serves to increase signature security.

The challenge preferably makes use of the ID of the user issuing the challenge, and this ID is also incorporated in the encryption process or signing process. However, it is a feature of the invention that, although the encryption and signing processes involve private keys, the challenge does not use a private key and thus the private keys held by users are kept secret from the trusted third party.

The invention is further defined in the appended claims and consists in user terminal means for a cryptosystem and trusted third party means for a cryptosystem, as well as the combination of these means in a cryptosystem and a method of enabling users to send and receive encrypted messages and to sign messages using a trusted third party. The user terminal means and trusted third party means may comprise hardware and/or software.

Brief Description of the Drawings

The invention will now be described by way of example with reference to the accompanying drawings in which:

Figure 1 is a schematic drawing showing encryption and decryption of a message, and;

Figure 2 is a schematic drawing showing signing a message.

Description of Embodiments of the Invention

A trusted third party or key center TTP is established and publishes the public system parameters required by users of the cryptosystem to encrypt and sign messages. The cryptosystem is based on the Diffie-Hellman scheme over multiplicative group Zp, which is cyclic. The public system parameters consist of:

p - a large prime, q - a large prime divisor of p - 1, g! and g₂ - integers of order q where (1 <gι, g₂ <q), h - a one-way collision-resistance hash-function.

Also, each user has two private keys %, one being held by and being secret to the user, and the other being held by and being secret to the TTP. For example, a typical user Alice has a private key XA_X , and the TTP holds a corresponding private XA₂, where (1 <%A A₂ <q); and a typical user Bob has a private key g, , and the TTP holds a corresponding private key X_Aχ, where (1 <XB XB₂ <q).

Based on these private keys ^A A₂, XB XB₁ corresponding public parameters P are published as follows:

P_A2 =g₂ ^Λ2 moά p P_Bl =g ^B" mod p

Thus the public system parameters consist of p, q, h, gi, g₂, P fh, where i = A, B, I.

In a typical implementation of the invention, the trusted third party TTP comprises a computer TTPM set up as a server with server software so as to be accessible over a network, such as the Internet, to users A, B, I. As illustrated in Figures 1 and 2, the server holds the public parameters and makes them available to users A, B, and holds the user keys XA₂, XB₂ private in a secure memory for use as described below. Each user A, B, accesses the server TTPM via a user terminal TA, TB which comprises a computer such as a laptop or hand held device. Each user terminal has user software installed, which may be downloaded from the server TTPM when the user A first registers with the cryptosystem. Registration involves the user software running an algorithm that generates each of the private keys X _X , XA₂ from an input variable selected by the user. One private key X_AX is held in a secure memory in the user terminal TA and the other private key X_A2 is sent to the server TTPM, which holds it in its secure memory. Registration of user A is then complete and they can use the cryptosystem to send messages to and receive messages from other registered users such as B.

In order to encrypt a message m e Z_p, a user A, such as Alice who wants to send a message to user B, such as Bob, randomly chooses two integers ki and k₂, where 1 <kι, k₂ <q, and computes the following:

π = g_l ^kl mod p, = g₂ ^h mod p,

where ID_B is the binary string for the email address of Bob, for example, bob@cipherdoctor.com or a more complex form of identification for additional security. The encrypted message e is then generated as follows:

Alice sends the encrypted message e and the parameters ri and r₂ to Bob.

In order to decrypt the encrypted message e, Bob first computes CHA = (ri, r₂, ED_B) and sends this as a challenge to TTP. TTP then computes H = h(CHA) = h(rι, r₂, ID_B) and

HXJI₂ , sends Bob a response RES = ^rι ^moa P.

Bob then uses the response RES together with his private key ._ to decrypt the message as follows:

m = e(r_λ ^{' Bχ}RES) ^l mod p.

It can be shown by simple substitution that this decryption formulation for m is the inverse function of the encryption formulation of e quoted above, and thus decryption is effective. In order to sign a message m ^e Z_p, Alice randomly chooses two integers ki and k₂, where 1 <kι, k₂ <q, and computes the following:

H= h(r,m,IDA) and sι = kι — HXA mod q,

where JD_A is the binary string for the email address of Alice.

Alice then computes CHA = (r, m, IDA) and sends this as a challenge to TTP.

-HX ₂

TTP then computes H = h(CHA) and sends Alice a response RES = §2

Alice then computes

^s2 = g RES mod q = g₂ ^{2 Λ} mod q.

Alice then sends Bob a signature message Sig(m) = (r, Si, s₂) which Bob can use to verify the message m by substitution in the formulation:

Thus if the signatory follows the above signature protocol, the recipient can be certain as to the true identity of the signatory.

In order to add message recovery to a digital signature scheme, a public redundancy function R and its inverse R^"1 are introduced, the selection of R being critical to the security of the system.

To sign a message m e Z_p, Alice randomly chooses two integers ki and k₂, where 1 <kι, k₂ <q, and computes the following: m = R(m), r = m' g^"kχ g^~ ₂ ^k2 mod p, H= h(r,ID), and sι = k\ - HX_Aχ mod q.

Alice then computes a challenge CHA = (r, ID) and sends it to TTP. TTP then computes

-HXA₂

H = h(CHA) and sends the response RES = £2 to Alice. Alice then computes:

∑ = - g, -HX

S' ₂ ²RES mod q = g₂ ² mod q

Alice then sends the signature message Sig(m) = (r, si, s₂) to Bob. After receiving Sig(m), the message is verified by Bob using the formulation:

After checking the validity of m' the message is recovered by computing

m = R^"l(m').

Whilst the invention has been described above with reference to a cryptosystem having just one trusted third party TTP, it will be appreciated that two or more TTPs may be provided, each being entrusted with a corresponding unique private key X_a„ for each user, so that a user is required to perform a challenge and response routine with each TTP before the user has all of the encapsulated private keys required for decrypting or signing a message.

Also, whilst the pairs of public parameters P PA₂ and B B₂ involve system parameters gi and g₂, which take different values, gi and g₂ could be set at the same value to simplify the system. Also, where there are two or more TTPs, the values of two or more of the system parameters gi, g₂, ... g„ could be the same. The security of the proposed scheme is based on the security of Diffie-Hellman problem and one-way collision resistance hash-functions. Given the fact that there is no known method for "breaking" DHP or for finding collisions on one-way colUsion-resistance hash-functions, it is computationally infeasible to break the proposed scheme.

It will be appreciated that the use of two or more private keys per user, one held by the user and one by each TTP, and the challenge and response technique with each TTP, enables a computationally secure cryptosystem to be set up without embedding key escrow and without any PKI requirement so all users enjoy secure communication with each other without possessing verified certificates. The invention therefore provides an implicitly authenticated public key cryptosystem which avoids disclosing user's private keys even to the TTP.

Claims

1. User terminal means for a cryptosystem in which users (A, B) send and receive messages (m) with the help of a trusted third party (TTP) for security purposes making use of private keys (X) and public parameters (P) which encapsulate said private keys (X), each user (A, B) holding a private key (XA_: , XB ) and the trusted third party (TTP) being entrusted with a corresponding private key (XA₂, XB₂) for each user (A, B), the user terminal means (TA, TB) being adapted to hold a user's private key (XA X_BX) and to issue a challenge (CHA) to the trusted third party (TTP) and to receive a response (RES) from the trusted third party (TTP) which is responsive to said challenge (CHA) and which encapsulates the corresponding private key (XA₂,XB₂), the user terminal means (TA, TB) using the response (RES) in combination with the private key (X _BI already held by the user (A, B) to decrypt a received encrypted message (e) or sign a message (m) to be transmitted.

2. User terminal means as claimed in claim 1 which, for a user (A) wishing to transit a message (m), is adapted to make user parameter selections (ki, k₂) and to generate private parameters (r; ri, r₂) which encapsulate said user parameter selections

k₂), the user terminal means (TA) incorporating said user parameter selections (ki, k₂) in the challenge (CHA), and the trusted third party (TTP) incorporating said user parameter selections (ki, k₂) in the response (RES).

3. User terminal means as claimed in claim 2 which, for a transmitting user (A), encrypts a message (m) to a recipient user (B) using the public parameters (P_B P_B2) which encapsulate the private keys (XB_X XB₂) of that recipient user (B), and private parameters (t_\, r₂) generated for the transmitting user (A), the private parameters (n, r₂) being transmitted to the recipient user (B) to decrypt the encrypted message (e).

4. User terminal means as claimed in claim 3 which, for a transmitting user (A) selects integer user parameter selections (ki, k₂) and uses each in a public generator function to generate a respective one of the private parameters (ri, r₂).

5. User terminal means as claimed in claim 4 in which the message (m) is encrypted according to the general formulation

mPβ ^P_B^ dp,

where H is an exponent function that incorporates the private parameters (ri, r₂) and p is a public system parameter in the form of a large prime integer.

6. User terminal means as claimed in claim 5 in which the public generator function for the private parameters (r_ls r₂) takes the form

and r₂ = g₂ mod p, and in which PB₂ =

mod p and PB_X = gi ^Xβl mod p, where gi and g₂ are public system parameters.

7. User terminal means as claimed in claim 6 in which gi = g₂.

8. User terminal means as claimed in any one of claims 5 to 7 in which the exponent function H incorporates the identity ( D_B of the receiving user (B).

9. User terminal means as claimed in any one of claims 5 to 8 in which the exponent function H comprises a one-way, collision-resistance hash function (h).

10. User terminal means as claimed in any one of claims 5 to 8 in which the response RES from the trusted third party (TTP) to a user (B) who wishes to decrypt an encrypted message (e) from a user (A) takes the general form

J,₂ HXB_{2 mo}d p.

11. User terminal means as claimed in claim 10 which, for a the recipient user (B), is adapted to decrypt the encrypted message (e) to recover the original message (m) using the formulation

12. User terminal means as claimed in claim 11 in which the challenge (CHA) incorporates the identity (IDB) of the recipient user (B).

13. User terminal means as claimed in claim 2 which, for a user (A) wishing to a transmit a signed message (m), is adapted to create a multi-part signature message Sig(m) and to transmit it with the message (m) so that a recipient user (B) can check the signature message Sig(m) against the message (m), the signature message comprising one part (si) generated directly by the user terminal means (TA) for the user (A) so as to encapsulate the user's private key (XA ), and another part (s₂) encapsulating the response (RES) received from the trusted third party (TTP) following a challenge (CHA) from the user terminal means (TA).

14. User terminal means as claimed in claim 13 in which the multi-part signature message Sig(m) includes the private parameter (r).

15. User terminal means as claimed in claim 14 in which the private parameter (r) is generated by a public generator function that takes the general form

where gi, g₂ and p are public system parameters and p is a large prime integer.

16. User terminal means as claimed in claim 15 in which gi = g₂.

17. User terminal means as claimed in any one of claims 13 to 16 in which the challenge (CHA) incorporates the private parameter (r), the identity (ID_A) of the transmitting user (A) and the message (m).

18. User terminal means as claimed in any one of claims 14 to 16 in which the response (RES) takes the form gl ^~HXH where H is an exponent function that incorporates the private parameter (r), the identity (ID_A) of the transmitting user (A) and the message (m).

19. User terminal means as claimed in claim 18 in which the exponent function H is a one-way, collision-resistance hash function (h).

20. User terminal means as claimed in any one of claims 13 to 19 in which the parts (si, s₂) of the signature message Sig(m) take the general form

s\ = k\ -HX A mod q and s₂ = g₂ ^~k2RES mod q

where q is a public system parameter in the form of a large prime division of p-1.

21. A cryptosystem comprising one or more user terminal means (TA, TB) as claimed in any one of the preceding claims, and trusted third party means (TTPM) adapted to hold a corresponding private key (XA₂, XB₂) for each user (A, B), and being responsive to a challenge (CHA) from a user (A, B) by issuing a response (RES) which encapsulates the corresponding private key (XA₂, X_B2) SO that the user (A, B) can use the response (RES) in combination with the private key (XA_X , XB_X) already held by the user (A, B) to decrypt or sign a message.

22. A cryptosystem as claimed in claim 21 in which the response RES to a user (B) who wishes to decrypt a message from a user terminal means (TA) takes the general form 7"₂ ^HXB2 mod p, where r₂ is a private parameter generated by the user terminal means (TA) and incorporated in the challenge (CHA) to which the trusted third party means responds, and H is an exponent function that incorporates the private parameter r₂, and p is a public system parameter in the form of a large primer integer .

23. A cryptosystem as claimed in claim 21 in which the response (RES) to a user terminal means (TA) that wishes to sign a message (m) to a user (B) takes the form

gi ^"^

where r is a private parameter generated by the user terminal means (TA) and incorporated in the challenge (CHA) to which the trusted third party means responds, and H is an exponent function that incorporates the private parameter (r), the identity (D_A) of the transmitting user terminal means (TA) and the message (m).

24. A cryptosystem as claimed in anyone of the preceding claims which comprise two or more trusted third parties means (TTPM), each of which is entrusted with a corresponding private key (X_a2 Xb₂ Xa₃,Xb₃) for each user (A, B), each being adapted to respond to a challenge (CHA) from a user terminal means (TA, TB) by issuing a response (RES) which encapsulates the corresponding private key (X_a2, Xb₂, X_a3, Xb₃).

25. A cryptosystem comprising two or more trusted third parties means (TTPM) as claimed in claim 7 or 16, each of which is entrusted with a corresponding private key(Z) for each user (A, B), each being adapted to respond to a challenge (CHA) from a user terminal means (TA, TB) by issuing a response (RES) which encapsulates the corresponding private key (X), and the values of two or more of the system parameters (g_n) are the same.

26. Trusted third party means for use by a trusted third party in a cryptosystem in which users (A, B) send and receive messages (m) with the help of the trusted third party (TTP) for security purposes making use of private keys (X) and public parameters (P) which encapsulate said private keys (X), each user (A, B) holding a private key (XA_X , XB_X), the trusted third party means (TTPM) being adapted to hold a corresponding private key (XA₂, XB₂) for each user (A, B), and being responsive to a challenge (CHA) from a user (A, B) by issuing a response (RES) which encapsulates the corresponding private key (X_A2, XB₂) SO that the user (A, B) can use the response (RES) in combination with the private key (X_AX, X_BX) already held by the user (A, B) to decrypt or sign a message.

27. Trusted third party means as claimed in claim 26 in which the response RES to a user (B) who wishes to decrypt a message from a user (A) takes the general form ^₂ ^HXB2 mod p, where r₂ is a private parameter generated by the user (A) and incorporated in the challenge (CHA) to which the trusted third party responds, and H is an exponent function that incorporates the private parameter r₂, and p is a public system parameter in the form of a large primer integer.

28. Trusted third party means as claimed in claim 27 in which the response (RES) to a user (A) who wishes to sign a message (m) to a user (B) takes the form

-W Λ₂ gi

where r is a private parameter generated by the user (A) and incorporated in the challenge (CHA) to which the trusted third party means responds, and H is an exponent function that incorporates the private parameter (r), the identity (ID_A) of the transmitting user (A) and the message (m).

29. A method of enabling users (A, B) to send and receive messages (m) with the help of a trusted third party (TTP) for security purposes making use of private keys (X) and public parameters (P) which encapsulate said private keys (X), in which each user (A, B) holds a private key (X_AX X_BX) and the trusted third party (TTP) is entrusted with a corresponding private key (XA₂,XB₂) for each user (A, B), the trusted third party (TTP) is adapted so that it is responsive to a challenge (CHA) from a user (A, B) by issuing a response (RES) which encapsulates the corresponding private key (XA₂ XB₂), and in which the user (A, B) uses the response (RES) in combination with the private key (X_AX XB ) already held by the user (A, B) to decrypt or sign a message.

30. A cryptosystem in which users (A, B) send and receive messages (m) with the help of a trusted third party (TTP) for security purposes making use of private keys (X) and public parameters (?) which encapsulate said private keys (X), each user (A, B) holding a private key (XA_X ,XB_X ) and the trusted third party (TTP) being entrusted with a corresponding private key (XA₂,XB ) for each user (A, B), and the trusted third party (TTP) being adapted so that it is responsive to a challenge (CHA) from a user (A, B) by issuing a response (RES) which encapsulates the corresponding private key (X_A2,X_B2) SO that the user (A, B) can use the response (RES) in combination with the private key (X_AI ,X_BX ) already held by the user (A, B) to decrypt a received encrypted message (e) or sign a message (m) to be transmitted.

31. A cryptosystem for encrypting messages to be transmitted from a transmitting user (A) to a recipient user (B) and for decrypting received messages with the help of a trusted third-party (TTP), the system making use of at least two private keys for each user, one private key (XB ) being held by the user and the other private key (X_B2) being held by the trusted third-party (TTP), each message (m) being encrypted by the transmitting user (A) in accordance with public user parameters (PB_X,PB₂) that incorporate the private keys (X_BX , X_B2) of an intended recipient user (B) so that said recipient user (B) can only decrypt the message after a challenge (CHA) to the trusted third party (TTP) and a response (RES) from the trusted third party (TTP) in which the said other private key (X_B2) is encapsulated.

32. A signature system for authenticating a message as originating from a user (A) by the user (A) encrypting the message (m) using one or more user encryption parameters (ki, k ) selected by the user (A), and using said user encryption parameters (ki, k₂) to generate encapsulated signed messages (si, S2) which are transmitted with the encrypted message (r) to a user (B) to allow authentication of the encrypted message (r) by the user (B) successfully decrypting it, the encapsulated signed messages (si, s₂) each incorporating a private key, one private key (X_A ) being held by the user (A) and the other private key (X_A2) being held by a trusted third-party (TTP) and only being released by the trusted third-party (TTP) in an encapsulated form (RES) when it receives a challenge (CHA) from the user (A).