A Fair Non-repudiation Protocol without TTP on Conic Curve over Ring

Transcription

1 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z 1 L Zhahu, Fa Ka, 3 L Hu, 4 Zheg Ya 1State Key Laboratory of Itegrated Servce Networs,Xda Uversty,X'a710071, Shaax, Cha, Xa Yag Noral Uversty, Xa Yag Cha lzhahu75@16co State Key Laboratory of Itegrated Servce Networs,Xda Uversty,X'a710071, Shaax, Cha, fa@alxdaeduc 3State Key Laboratory of Itegrated Servce Networs,Xda Uversty,X'a710071, Shaax, Cha, fa@alxdaeduc 4Xa Yag Noral Uversty, Xa Yag Cha, zhegya005@16co bstract I vew of the shortcog of coutato -robablstc o-reudato rotocol wthout trusted thrd arty (TTP), a ew far o-reudato rotocol wthout TTP o coc curve s ut foreword ths aer I ths rotocol, we ot oly solved the usafe ad ufar robles for the strog coutg ower of ooste art, but also reduce the forato exchage agreeets fro +1 tes to 3 tes Thus t has a hgh effcecy I addto, t s coletely free fro deedece o the TTP, ad the rorty of ay arty ot exsts, whch achevetruly faress ad abusefree ad ore securty Keywords: Keywords; Coc Curve; buse Free; Far No-Reudato; Trusted Thrd Party 1 Itroducto Wth the extesve alcato of e-coerce, eole have bee able to carry out a varety of tradg actvtes through the etwor However, artes volved the trasacto the vrtual etwor are hardly to ow each other, let aloe utual trust Therefore, how to have a secure electroc trasacto uder ths dstrust evroet o the teret s a dffcult ad sgfcace roble of the reset study But the tradtoal etwor securty servces such as essage ecryto ad authetcato ca ot fully satsfy ts securty eeds, a ew etwor securty far o-reudato of forato trasfer rotocol gradually atteto has bee ad, ad t has a rad develoet recet years The so-called far o-reudato rotocol eas that the seder ust receve the evdece of the recet to receve ths forato ad the recever ca also have the evdece of the seder to sed ths forato at the ed of the agreeet That s both sdes ca ot be deed to artcate ths forato exchage I geeral, far ad o-reudato rotocol s to establsh based o the ublc ey ad dgtal sgature techology There are aly two tyes [ 1] : TTP (trusted thrd arty) rotocol ad wthout TTP rotocol og TTP rotocols, there are followg categores: (1)Ile TTP [ ] That s the trusted thrd arty artcates each trassso of forato the agreeet, whch wll brg a greater burde to the etwor,ad affect the effcecy of the leetato of the agreeet; [3,4] ()Ole TTP lthough TTP artcates each agreeet, t does ot artcate each [5,6] trassso order to allevate soe of the etwor load (3)Offle TTP : TTP usually does ot [7,8] artcate a agreeet oly whe there s a dsute (4)Trasaret TTP :It ca ot see whether the TTP artcate ths agreeet fro the forato obtaed ad evdece receved Obvously, fro above we ca see whether agreeet ca roceed soothly or ot rely o TTP Therefore, oce TTP s attaced, the safety of the agreeet wll be threateed So the wthout dvaces forato Sceces ad Servce Sceces(ISS) Volue4, Nuber18, Oct 01 do: /ISSvol4ssue

2 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya TTP far agreeet s eeded to be ut foreword to solve ths roble, t's advatage s that both ca avod etwor cogesto, ad also avod the agreeet deedet o the credblty of TTP I 1999, arowtch ad Roggea roosed a relatvely erfect -robablstc o-reudato rotocol wthout TTP [ 9] Whe the agreeet eds, the robablty ether arty recevg the evdece of other arty volved the exchage of forato or ot s 1 However, the artes volved the forato exchage s ueual ths rotocol Recever have ore oortutes (deedg o the coutg ower of the recet)to deceve the seder That s the recever obtaed the evdece of seder rather tha retur hs havg receved forato ad evdece, thereby uderg the faress of the agreeet We call t rorty recever o-reudato rotocol The author of [10] [9] referece has ade soe roveets for the rotocol roosed referece ad ut foreword a rorty seder o-reudato rotocol, whch s seder have ore oortutes(deedg o the coutg ower of the seder)to deceve the recever He roosed a cosultato wthout TTP far o-reudato of forato exchage rotocol uder the ters of coutg ower However, the above two rotocol are also ufar for hoest arty The dshoest arty has a chace to cheat the ooste arty usg hs strog coutg ower I vew of the defect of the coutg ower, a ew far o-reudato rotocol wthout TTP o coc curve s roosed ths aer, whch overcoes the shortcog etoed above, ad ths rotocol, the agreeet eed oly three tes forato exchage, therefore, coared wth the rotocol referece, ths schee has hgh coutg effcecy [9,10] Itroducto ad aalyss of rotocols referece 1)Protocol -Probablstc o-reudato rotocol wthout TTP [ 9] Suose wats to sed a essage to B, She frst selects a rado uber as her rvate ey, ad uses to ecryt ad get the cher text c E(, ), the she radoly selects a uber (ths ca be chose accordg to the geoetrc dstrbuto, ad ee t cofdetalty for B ) ad 1 detcally dstrbuted deedet rado varables r, where r ust be the sae order of agtude wth t the begg of agreeet, seds the cher text c ad corresodg evdece EOO to B t the sae te, B ust retur the evdece EOR to deotg that he has receved c The ssues 1 rado varables r ad corresodg evdece EOO(, ) evdece EOR (, ) to B a certa orderfter B receves the uber r, he has to retur the to deotg that he has receved r Else, wll ot sed ext r to B ad terrut the rotocol Fally, seds the ad evdece EOO (, ) to B B ca ot dstgush betwee ad r as he do't ow, so he stll returs the evdece EOR (, ) fter receves the EOR (, ), she eds the trassso of forato Whle B wats for a erod of te ad coutes D(, c) Thus, at the ed of the agreeet, both sdes get the ecessary evdece So ths rotocol satsfes o-reudato reureets [10] ) Protocol-Far ad o-reudato of forato exchage agreeet Whe eed to sed a essage to B, She frst selects a rado uber as her rvate ey, ad uses to ecryt ad get the cher text c, c E(, ), the she seds the c ad the sgature for c to B B returs the evdece deotg that he has receved c after he receves the forato fro The seds the to B Whle B receves the, he coutes EOR as the evdece he has receved, ad radoly chooses 1ubers r, where r should be the sae order of agtude wth EOR The he seds these 1 rado ubers r to a certa order fter receves the r, she coutes H ( r, ), where H () s a crytograhy hash fucto, 90

3 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya ad she seds the sgature for r ad H ( r, ) to B If B dd ot receve the above-etoed resose a erod of te, he wll sto the later sedg Fally, B sed the EOR to Whle ca't dstgush betwee EOR ad r, so he stll sed the sgature for EOR ad H ( EOR, ) fter B receves the sgature, he eds ths agreeet 3) Securty aalyss of rotocol of above rotocols I rotocol [ 9], although B dd't ow the value of, he ca guess t Suose he guess that the value of s ' Thus oce he receves the r ', he would ot sed the receve evdece EOR ' ssue the robablty that B guesses out the value of s, the the robablty of B havg receved the ad corresodg evdece fro whle dd't receve the evdece of B havg receved s That s the robablty that faress of agreeet s udered s, ad oce the faress of agreeet s udered, t ay be oly the seder to have a loss I addto, f B have a strog coutg ower, he ca also use ore drect ad effectve attac He ca use r set by to decryt the cher text c If the decryto s successful( r ), B would ot sed hs accetace evdece to Of course, order to revet ths, ca set a deadletherefore, the securty of agreeet s based o the assuto f B ca coleted the decryto calculato the deadle So the recever has a hgher rorty the securty of agreeet [10] Slarly, the seder rotocol also has chace to cheat B through guessg the value of or decrytg the chertext, whch ca acheve to deceve other art ad uderg the faress of agreeet lthough B ca ae a better choce of for that s a sall uber, t s stll ossble to threat the faress for the agreeet ars Furtherore, the larger the value of s, the ore securty the rotocol s, but t eas that eed ore forato teracto for both artes To solve the above robles, a ew far o-reudato rotocol wthout TTP s roosed ths aer, whch overcoes the defects o the coutg ower, ad the uber of rotocol teracto ca be coleted for oly three tes So coared to the above two rotocol ad t has a hgh effcecy roveets 3The Coc Curve over Rg Z Let Z be a odular rg, the defto of coc curve C over rg Z s defed as the [11] set of all solutos of the followg cogruece euato referece :, Where curve over rg y ax bx(od ) (1), are two large dfferet re ubers, ( a, ) ( b, ) 1, that s the coc Z ca be deoted as the followg set: C {( x, y) y ax bx(od )} [11] Obvously ( 0,0) C The author of referece has defed the addto rule betwee ots of C, ad roved that ( C, ) s a fte bela grou Ths aes t ossble to establsh the ublc-ey crytograhc rotocols ad dgtal sgatures over the coc curve Fro the [1] addto oerato rule, the author of referece has roved that there are certa coutatoal advatages for addto oerato betwee ot ad ot ultlcato o coc curve coared wth the corresodg oerato o elltc curve So t s very coveet to acheve the sgature rotocol establshed o coc curve I recet years, the alcato of coc curve crytograhy has 91

4 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya [14,15,16,17] ade a great roveet It s clear that fro the Chese reader theory we ca get the soluto set of cogruece euato s eual to the oe of followg cogruece euatos: y y ax ax bx(od ) bx(od ) So every soluto ot ( x, y) C ca be uuely rereseted as, ], where [ [, ] [( x, y ),( x, y )], C, C x x (od ), y y (od ), x x (od ), y y (od ) Fro ths relato, we ca defe the order of That s the followg result: Theory: Let C, defe the lest teger uber such that 0(od ) as the order of, ad deote t as O ( ) For ay ot C,there s a uuely ot C [, ] corresodece to C C So t's order s Lc [ O( ), O( )] Corollary: Let, where, are two large dfferet re ubers such that a a 1, ad 1 r, 1 s, where r, s are also odd re ubers So the order of C s N rs Pc a ot G C, whch order s N rs Such ot s defed as the basc ot of Thus the set C S { 0, G,G, ( N 1) G} s a subgrou of C Dscrete roble S : Gve two dfferet ots, N S, t s hard to coute a teger Z such that N a a The ebeddg algorth of latext : Let, 1, For a latext, 0 ad ( a, ) 1 Let x b b (od ), y (od ), a a The ot P ) ( x, y ) s the ebeddg ot of coc curve Decryto algorth s y x ( (od ) RS sgature schee o coc curve over rg Z : Select teger 1 e N ad ( e, ) 1, ad calculate ed (od N ), The oe, a, b, e, ad ee, N 1, d, N secret Let be a la text, ad P () be the ebeddg ot coc 9

5 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya curve Coute Q ( s, t) dp( ) the the sgature s ( P ( ), Q) Verfcato algorth: Verfy(P(), Q) acceto, P() Verfy(P(), Q) = rejecto, else = eq 4 Far No-Reudato Protocol wthout TTP o Coc Curve over Rg Z 41 Setu of syste araeter (1)ssue that ad B are the artcats of the exchage of forato Frst, select a fx coc curve C over rg Z, where, are two large dfferet re ubers such that a a 1, ad 1 r, 1 s, where r, s are also odd re ubers Let G * be a basc ot of C H () : C a, s a crytograhc hash fucto radoly selects a teger uber ( Z N d, ( d, ) 1, ad coutes Q d G ; She oes N, a, b, G, H, Q, ad ees,, d, N secret B also selects a teger uber 0 d B satsfed QB d BG 0(od ), the he taes d B as hs rvate ey,ad QB as hs ublc ey 4 Far No-Reudato Protocol Suose eeds to have a forato exchage agreeet wth B frst ebeds her essage to C, ad get a ot,ad geerates a testa T The she coutes T ' TG, Secod, she selects a teger uber adt such that (, N ) ( t, N ) 1 at rado ad coutes l 1(od N) Fally, use to ecryt as followg:, ( T t) G, ( d t) H ( ) The seds (,,, T ) to B The rocess of agreeet s show as table below: B (,,, T ) B ' 对 (,, ) T 的 签 名 B l, T B t, s B ' t B r The detaled forato exchage agreeet s descrbed as follows: 1) B :,,, T ; ) fter B receves,,, T, he frst checs whether G H ( ) H ( ) Q T ' Reject t ad terrut the agreeet or as to resed f t s't eual Otherwse, he also selects a rado uber t " ad coutes h t" G ( x h, y h ), h1 xh, h H ( ) d B xh ) G T ', ad seds h, ) to ( h 1 93

6 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya 3) fter receves h, ), she also checs whether h Q h Q H ( ) G T ' ( h 1 1 B B ( l, T to B Reject t ad terrut the agreeet f t s't eual Otherwse, she seds ) 4) fter B receves l, T ), he coutes T " T G If T ' T", he radoly selects a teger ( uber r, ad coutes s ( r l) G t d B H (s) The he seds ( t, s) to 5)fter receves ( t, s), she checs whether tg QBH (s),if so, she coutes ( d l) G s t', ad seds t ' to B 6)fter B receves t ', he checs whether rg Q t' If so, he seds r to 7)Oce receves the r, she coutes ( r l) G s' ad checs f s s' (od ) If so, she eds the agreeet Else, she ass B to resed B wats for a whle, he uses l to decryt through coutg decryto algorth over coc curve to obta the essage 5 Securty alyss of greeet l The he uses I ths secto, we aly aalyze the securty ad effcecy of ths agreeet Fro above agreeet, we ca see that there are roertes of u-forgeablty,faress, o-reudato ths agreeet 51 Ths agreeet s o-reudato I ste1, uses the rado uber teger to ecryt the essage by her rvate ey d So oce B receves the sgature, he ca use the ublc ey, ad sg the chertext Q of to covce that the sgature he receved s deed set by Thus ca't dey t I ste, B gves a resose to sgature set by So ca also verfy that B has deed receved the chertext accordg to ths resose Therefore B ca't dey that he has receved the chertext as well I ste4, order to obta the evdece of sedg decryto ey l fro, B uses a rado teger uber to sg decryto ey l Because ca't covce whether B has receved l by usg the verfcato fucto ste4, she ust gve a resose to ths sgature Whe B s sure that l s deed the decryto ey set by, he taes the rado uber r as hs resose to I ste7, ca use r to covce that B has deed receve the decryto ey Therefore, at the ed of agreeet, both sdes obta the corresodg evdece, whch deotes ether art s o-reudato ths agreeet 5 Ths agreeet s far to both sdes B ust retur hs sgature for the chertext, else ca't sed the decryto ey to h t the sae te, ust resod to a sgature for l, else B also ca ot sed r to her as well Of cause, there s aother case that B dd't sed r or sed aother uber r ' to I frst case, although ca ot covce whether B has receved the decryto ey, B wats to use the verfcato fucto ste4-ste6 to affr that l s deed set by he ust rovde rado uber r to arbtrator The subts ( t, s) to the arbtrator receved the ste5 Therefore the arbtrator ca use the ublc ey of B ad r to covce that ( t, s) s set by B by checg S rg lg If so, the arbtrator ca deduce that B has receve the decryto ey l Else, B also has o evdece that the l s set by So, t s that ether both art ca get the corresodg evdece or ca't obta t For secod case, ca chec whether the uber r ' s the exact oe ste7 Slarly, ca't dey he has receved the uber r as the ( t, s) s the evdece of recet of decryto ey l of B Thus for the above t does't destroy the faress to both sdes ay case 94

7 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya 53 U-forgeablty Fro the above agreeet, we ca see that sgature,, T, ste1 cotas s ' rvate ey ad a rado uber t, ad ( h, h 1 ) s clude of B' s rvate ey ad a rado uber t ' ste ad ste4, so ayoe ca't forge a vald sgature whch satsfed the verfcato fucto uder the codto of uow of the I addto, by usg the te sta to bd wth the sged essage every agreeet ca resst the relay the essage attac Furtherore, f a adversary wats to dsguse as or B to ru the agreeet wth other arter though tercetg the sgature forato, he ust ow the ecryto ey of ad rvate ey of both sdes But t s hard to coute ecryto ey by use decryto ey l based o the dffcult roble of large uber factorzato Slly, t s also hard to coute d ad d B based o the dffcult roble of dscrete logarth over coc curve So ths agreeet s secure o these two dffcult robles 6 Edg I vew of the shortcog of coutg ower the robablstc o-reudato rotocol wthout TTP, a o-robablstc o-reudato rotocol wthout TTP over coc curve s roosed ths aer It s ot oly feasble to cheat ooste art through hs strog coutg ower for ay art but also acheved to reduce the tes of forato exchage to a u So t has hgher effcecy coarg wth the rotocols wth the oe of referece [9,10] cowledget: Ths wor was suorted by Natural Scece Foudato of Shaax Provce (009JQ1009) ad the Scece Research Foudato of Educato Deartet of Shaax Provce (09JK803) ad Scece Foudato of Xa Yag Noral Uversty(11XSY K305) 7 Refereces [1] Steve Kree, Olver arowtch, Jayg zhou, tesve survey of far o-reudato Protocols [J], Couter Coucato,00, 5(17): [13]Haso T ad Day J, aagg the Electroc Lbrary: a Practcal Gude for Iforato Professoals, 4 th ed Lodo: Bower-Saur, 51 55,1998 [] T Coffey, P Sadha, No- reudato wth adatory roof recet [J], Couter Coucato Revew, 6(1):6 17,1996 [3] N Zhag, Q Sh, chevg No- reudato of recet [J], The Couter Joural, 39(10): , 1996 [4] J Zhou, D Golla, far No- reudato rotocol [], IEEE Syosu o Securty ad Prvacy [C], Oalad, Calfoa, US: IEEE Couter Securty Press,55 61,1996 [5] oa Schuter, Wader, Otstc rotocols for far exchage [ ] T atsuot o( Ed ) C, Coferece o Couter ad Coucatos Securty [ C ], Zurch, Swtzerlad: C Press,8 17, 1997 [6] Scal, Certfed E alwth vsble ost offces [ ], RS 1997 coferece[ C ]Vacouver, BC, Caada, [7] J Zhou, D Golla, effcet o-reudato rotocol [], Proceedgs of Socety Press [C], Slver Srg, D, 16 13, 1997 [8] J Zhou, R Deg, F Bao, Evoluto of far o-reudato wth TTP [ ],CISP:Iforato Securty ad Prvacy: ustralasa Coferece, Lecture Notes Couter Scece[C], Srger, Berl, 58 69, 1999 [9] O arowtch, Y Roggea, Probablstc o-reudato wthout trusted thrd arty [ ], Secod Coferece o Securty Coucat o Net wors' 99 [C ], al, Italy, 5 36, 1999 [10] XIONG Ya, ZHNG Wechao,IO Fuyou,WNG Xgfu, Far No-Reudato Protocol wthout TTP Based o Etty's Coutg Power, Chese Joural of Electrocs Vol34No ,

8 Far No-reudato Protocol wthout TTP o Coc Curve over Rg Z L Zhahu, Fa Ka, 3L Hu, Zheg Ya [11] Su Q, Zhu We yu, Wag Bao, The Coc Curves over Z ad Publc-Key Crytosyste Protocol, Joural of Schua Uversty (Natural Scece Edto), 4(3): , 005 [1] L Hagyu, The Scalar ultlcato of Pots o a Coc over Fte Felds, Iforato Securty ad Coucatos Prvacy,8, 64 69, 007 [13] Wag Bao, Fag Yg jue, L Hoggag, QV Sgature Protocol o Coc Curve over Rg Z,Scece Cha, Vol 39, No : 1 17, 009 [14] L Zhahu, Fa Ka, L Hu, Cocurret Sgature Protocol o Coc Curve over Rg Z,011 Iteratoal Coferece o Electrocs Coucatos ad Cotrol, Vol 1, , 011 [15] Fa Wuyg, L Xagxue, Zhe Yafe, Dgtal Sgature d ultile Sgature Schee Based O Coc Curve, Couter lcatos ad Software, Vol17 No 7 5 7, 010 [16] LU Youl, DU Wezhag, ultle grade roxy ultbld sgature schee based o coc curves over Z, Couter Egeerg ad lcatos, 46(13),11 114, 010 [17] Pa Ru, WNG Lju, LI Xu, LI Duadua, Dgtal Sgature Based o Coc Curve over Eseste Rg, Couter Egeerg, Vol36 No6,169 17, 010 [18] a Ju, "Research of Electroc Busess Securty Based O Publc Key Ecryto ethods", IJCT, Vol 4, No, 50-57, 01 [19] Jahog Zhag, xu, Zhb Su, Xua Su, "O the Securty of Short IDbased Grou Sgature Schee", JDCT, Vol 5, No, 34-39,