A Digital Signature with Threshold Generation and Verification

Transcription

1 Digial ignare wih Threshold Generaion and Verificaion nder Lal * and Manoj mar * *!"# $# bsrac - This paper proposes a signare scheme where he signares are generaed b he cooperaion of a nmber of people from a gien grop of senders and he signares are erified b a cerain nmber of people from he grop of recipiens. hamir s hreshold scheme and chnorr s signare scheme are sed o realize he proposed scheme. e words - Threshold signare scheme, Lagrange inerpolaion, ElGamal Pblic ke 1. Inrodcion Crpossem and Threshold erificaion. Phsical signare is a naral ool o ahenicae he commnicaion, b i is seless in elecronic messages; one has o rel on oher mehods like digial signare. Digial signare is a crpographic ool o sole his problem of ahenici in elecronic commnicaions. Basicall digial signare has a proper ha anone haing a cop of he signare can check is alidi b sing some pblicinformaion, b no one else can forge he signare on anoher docmen. This proper of digial signare is called self-ahenicaion. In mos siaions, he signer and he erifier is generall a single person. Howeer when he message is sen b one organizaion o anoher organizaion, a alid message ma reqire he approal or consen of seeral people. In his case, he signare generaion and erificaion is done b more han one consening raher han b a single person. common eample of his polic is a large bank ransacion, which reqires he signare of more han one person. ch a polic cold be implemened b haing a separae digial signare for eer reqired signer, b his solion increases he effor o erif he message linearl wih he nmber of signer. Threshold signare is an answer o his problem. The (, n) hreshold signare schemes [1,2,3,5,6,8] are sed o sole hese problems. Threshold signares are closel relaed o he concep of hreshold crpograph, firs inrodced b Desmed [1,2]. In 1991 Desmed and Frankel [1] proposed he firs (, n) hreshold digial signare scheme based on he assmpion. 1

2 This paper proposes a Threshold signare scheme wih hreshold erificaion based on hamir s hreshold signare scheme [10] and chnorr s signare scheme [9]. These basic ools are briefl described in he ne secion. The secion-2 presens some basic ools. In ecion-3 we presen a Threshold ignare cheme wih hreshold erificaion. ecion-4 discsses he secri of he cheme. n illsraion o he scheme is discssed in secion-5. emarks are in secion Preliminaries Throgho his paper we will se he following ssem seing. prime modlos p, where < p < ; prime modlos q, where < q < and q is a diisor of p 1; nmber g, where g k (p 1) /q mod p, k is random ineger wih 1 k p 1 sch ha g >1; (g is a generaor of order q in Zp * ). collision free one-wa hash fncion h [12]; The parameers p, q, g and h are common o all sers. Eer ser has wo kes one priae and one pblic. We assme ha a ser chooses a random Zq and compes = Α g mod p. He keeps as his priae ke and pblishes as his pblic ke. In chnorr s signare scheme he signare of he ser on he message m is gien b ( r, ), where, r = h (g k mod p, m), and = k. r mod p. The signare are erified b checking he eqali r = h ( g r mod p, m ). (, n) hreshold secre sharing scheme is a scheme o disribe a secre ke ino n sers in sch a wa ha an sers can cooperae o reconsrc b a collsion of 1 or less sers reeal nohing abo he secre. There are man realizaion of his scheme, we shall se hamir s scheme. This scheme is based on Lagrange inerpolaion in a field. To implemen i, a polnomial f of degree 1 is randoml chosen in Zq sch ha f (0) =. Each ser i is gien a pblic ideni i and a secre share f ( i ). Now an sbse of shareholders o of n shareholders can reconsrc he secre = f (0), b pooling heir shares and sing j f (0) = f ( i ) mod q i= 1 j= 1, j i i j Here for simplici he ahorized sbse of sers consiss of shareholders i for i =1,2,3. 2

3 3. The proposed scheme. The signer of he conenional digial signare schemes is sall a single person. B when he message is ransmied b an organizaion o anoher organizaion and ma reqire he approal of more han one person hen he responsibili of signing he messages needs o be shared b a sbse H of or more signer from a designaed grop G of n sers belongs o he organizaion. On he oher hand, he signing grop wans o generae he signare on a message m in sch a wa ha he signare can be erified b an sbse H of k or more sers from a designaed grop G of l sers belongs o he organizaion, hen hreshold erificaion schemes sere or prpose. This paper proposes a hreshold signare scheme wih hreshold erificaion. We assme ha he secre ke of he organizaion s mod p wih Zq. imilarl he organizaion possesses a pair ( and he pblic ke is, where ) of priae ke = g and pblic ke = g mod p. lso eer ser in boh he organizaions possesses a pair (, ) wih secre and = Α g mod p pblic. We frher assme ha boh he organizaion and hae a common rsed cener (CTC) for deermining he grop secre parameers of he wo grops and also he secre shares all members. This scheme consiss of he following seps: Grop ecre e and ecre hares Generaion for he organizaion. (a). CTC selecs he grop pblic parameers p, q, g and a collision free one wa hash fncion h. CTC also selecs for he grop G a polnomial f () = a 0 + a 1 +.a -1-1 mod q, wih a 0 = = f (0). (b). CTC compes he grop pblic ke,, as, = g f (0) mod p. (c). CTC randoml selecs Zq and compes a pblic ale W = g mod p. (d). CTC compes a pblic ale for each member of he grop G, as, Here, is pblic ke and = f ( ). mod p. is he pblic ale associaed wih each ser i in he grop G. (e). CTC sends {, W } o each ser i in he grop G hrogh a pblic channel Grop ecre e and ecre hares Generaion for he organizaion (a). CTC selecs for he grop G a polnomial f () = b 0 + b 1 +.b k -1 k -1 mod q wih b 0 = = f (0). (b). CTC compes he grop pblic ke,, as, = g f (0) mod p. 3

4 (c). CTC compes a pblic ale for each member of he grop G, as, Here, is pblic ke and = f ( ). mod p. is he pblic ale associaed wih each ser i in he grop G. (d). CTC sends {, W} o each ser i in he grop G hrogh a pblic channel ignare generaion b an sers If a H s sbse of members of he organizaion o of n members who agree o sign a message m o be sen o he organizaion, hen he signare generaion has he following seps. (a). Each ser i H randoml selecs i = g i 2 and i 2 Zq and compes mod p, i = g mod p and wi = g i2 mod p. (b). Each ser i broadcass i, w i pblicl and i secrel o eer oher ser in H. Once all i, i and w i are aailable, each member i,i H compes he prodc U, V,W and a hash ale,as, U = mod i q, V = mod i q, i H W = w mod i q and = h (V,m) mod q. i H i H (c). Each ser i H recoers his/her secre share f ( ), as, f ( ) = W mod p. (d). Each ser i H modifies his/her shadow, as, (e). B sing his/her modified shadow M M = f ( j ). mod q. j= 1, j i i, each ser i H compes his/her parial signare j s i,as, s i = + M. mod q. (f). Each ser i H sends his/her parial signare o he CTC, who prodce a grop signare, as, = i = 1, s i mod q. (g). CTC sends {, U,W, m} o he designaed combiner DC of organizaion as signare of he grop for he message m ignare erificaion b he organizaion n sbse H of k sers from a designaed grop G can erif he signare. We assme ha here is designaed combiner DC (can be an member among he members of he grop G, or 4

5 he head of he organizaion ), who collecs parial compaions from each ser in H and deermines he alidi of signare. The erifing process is as follows. (a) Each ser i H recoers his/her secre share, as, f ( (b) Each ser i H modifies his/her shadow, as, (c) Each ser i H sends his modified shadow ) = M = f ( M W mod p. k i ). mod q. j= 1, j i i j o he DC. DC compes, as, = k M. i = mod q and recoers = h (, m) mod q. W U 1 (d). DC checks he following congrence g?. mod p for a alid signare. If hold hen {, U, W, m} is a alid signare on he message m. 4. ecri discssions. In his sb-secion, we shall discss he secri aspecs of proposed Threshold ignare cheme wih hreshold erificaion. Here we shall discss seeral possible aacks. B none of hese can sccessfll break or ssem. (a). Can an one reriee he organizaion s secre kes and grop pblic ke and respeciel? = f (0) and = f (0),from he This is as difficl as soling discree logarihm problem. No one can ge he secre ke, since f and f are he randoml and secrel seleced polnomials b he CTC. On he oher hand, b sing he pblic kes and no one also ge he secre kes and becase his is as difficl as soling discree logarihm problem. (b). Can one reriee he secre shares, f ( = f ( ). ) of members of G, from he eqaion mod p? No becase f s a randoml and secrel seleced polnomial and is also a randoml and secrel seleced ineger b he CTC. imilarl no one can ge he secre shares f ( ) of members of G, from he eqaion = f ( ). mod p. (c). Can one reriee he secre shares, f ( ) of members of G, from he eqaion f ( ) = i W mod p? 5

6 Onl he ser i can recoers his secre shares, f ( ), becase f s a randoml and secrel seleced polnomial and is secre ke of he ser i G. imilarl no one can ge he secre shares f ( ) of members of G, from he eqaion f ( ) = W mod p. (d). Can one reriee he modified shadow M, ineger, he hash ale and parial signare s i,i G from he eqaion s i = + M. mod q? he M The all are secre parameers and i is compaionall infeasible for a forger o collec, ineger, he hash ale and parial signare s i,i G. (e). Can he designaed CTC reriee an parial informaion from he eqaion, = i = 1, s i mod q? Obiosl, i wold be compaionall infeasible for CTC o derie an informaion from s i. (f). Can one impersonae a member i,i H? forger ma r o impersonae a shareholder i,i H, b randoml selecing wo inegers and Zq and broadcasing i, i and w i.. B wiho knowing he secre shares, f ( i 2 ), i is difficl o generae a alid parial signare s i o saisf he erificaion eqaion, = i = 1, s i mod q and g?. mod p. (g). Can one forge a signare {,U,W,m} b he following eqaion, g. mod p? forger ma randoml selecs an ineger and hen compes he hash ale sch ha = h (, m) mod q. Obiosl, o compes he ineger s eqialen o soling he discree logarihm problem. On he oher hand, he forger can randoml selec and deermine a ale, ha saisf he eqaion g. mod p. firs and hen r o Howeer, according o he one-wa proper of he hash fncion h, i is qie impossible. Ths, his aack will no be sccessfl. (h). Can or more shareholders ac in collsion o reconsrc he polnomial f ()? 6

7 5. Illsraion j ccording o he eqaion f () = f ( ) modq i,he secre i= 1 j= 1, j i i polnomial f () can be reconsrced wih he knowledge of an secre shares, f ( j ), i G. o if in an organizaion he shareholders are known o each oher, an of hem ma collde and find he secre polnomial f. This aack, howeer, does no weaken he secri of or scheme in he sense ha he nmber of sers ha hae o collde in order o forge he signare is no smaller han he hreshold ale. We now gie an illsraion in sppor of or scheme. ppose G = 7, H = 4, G = H = 5. We ake he parameers p = 47, q = 23 and g = Grop ecre e and ecre hares Generaion for he organizaion (a). CTC selecs for he grop G,a polnomial f () = mod 23. Here = 11 and = 2 11 mod 47 = 27. (b). CTC randoml selecs = 8 and compes W = 2-8 mod 47 = 9. 6 and (c). CTC compes he secre ke, pblic ke, secre share and pblic ale for each member of he grop G, as shown b he following able. UE VLUE 5.2.Grop ecre e and ecre hares Generaion for he organizaion (a). CTC selecs for he grop G a polnomial f () = mod 23. Here = 7 and = 2 7 mod 47 = 34. (b). CTC compes he secre ke, pblic ke, secre share and pblic ale for each member of he grop G, as shown b he ne able. f ( ) User User User User User User User

8 UE VLUE f ( ) User User User User User User ignare generaion b an sers If 2, 4, 6 and 7 are agree o sign a message m for he organizaion, hen (a). 2 selecs = 5, = 7 and compes 2 = 18, 2 = 32 and w 2 = (b). 4 selecs (c). 6 selecs (d). 7 selecs = 4, = 3 and compes 4 = 6, 4 = 16 and w 4 = = 12, = 18 and compes 6 = 32, 6 = 7 and w 6 = = 21, = 11 and compes 7 = 7, 7 = 12 and w 7 = (e). Each sers compes U = 34, V = 3, W = 18 and = h ( 3, m ) = 8 (le). (f). 2 recoers f ( 2 ) = 3 and compes M 2 = 5 and s 2 = 22. (g). 4 recoers f ( ) = 4 and compes M 4 = 21 and s 4 4 = 11. (i). 6 recoers f ( 6 ) = 16 and compes M 6 = 12 and s 6 = 16. (j). 7 recoers f ( 7 ) = 19 and compes M 7 = 19 and s 7 = 12. (k). CTC prodces a grop signare = 15 and sends { 15, 34, 18, m} o he designaed combiner DC of organizaion as signare of he grop for he message m ignare erificaion b he organizaion ppose fie sers 1, 3, 4, 5 and 6 wan o erif he signare, hen (a). 1 recoers f ( 1 ) = 21 and compes M 1 = 19. (b). 3 recoers f ( 3 ) = 21 and compes M 3 = 4. (c). 4 recoers f ( (d). 5 recoers f ( (e). 6 recoers f ( 4 ) = 15 and compes 5 ) = 12 and compes 6 ) = 18 and compes M 4 = 11. M 5 = 9. M 6 = 10. 8

9 (f). DC compes he ale = 3 and hen recoers = h ( 3, m ) = 8. (g). DC checks he following congrence for a alid signare 2? mod 45. This congrence holds so {15, 34,18, m} is a alid signare on he message m. 6.emarks In his paper, we hae proposed a hreshold signare scheme wih hreshold erificaion. To obain his consrcion, we hae sed he ElGamal pblic ke crpossem and chnorr s signare scheme. The secri of his crpossem is based on he discree log problem. The signare generaion is done b cerain designaed sb grops of signers and he erificaion is done b cerain designaed sb-grops of he grop of he receiers. Here designaed sb grops are characerized b hreshold ales. The hreshold ale can be differen for signare generaion and for signare erificaion. Unil (he hreshold ale of he grop of senders) indiidals ac in collsion he will ge no informaion abo he grop secre ke. imilarl, nil k (he hreshold ale of he grop of recipiens) indiidals ac in collsion he will ge no informaion abo he grop secre ke. The grop pblic parameers p, q, g and a collision free one-wa hash fncion h is same for boh he organizaions. In an case of dispe beween he grop and, he CTC keeps he records of signares and plas he role of a rsed jdge. ince he CTC can checks he alidi of he signare so when an hird par needs he signare erificaion, he CTC conince he hird par abo he facs. eferences 1. Desmed, Y. and Frankel Y. (1991). hared Generaion of henicaors and ignares. In dances in Crpolog Crpo -91, Proceedings, p.p New York: pringer Verlag. 2. Desmed, Y. (1988). ocie and grop oriened crpograph. In dances in Crpolog Crpo -87, Proceedings, p.p New York: pringer Verlag. 3. Desmed, Y. (1994). Threshold crpograph. Eropean Transacions on Telecommnicaions and elaed Technologies.Vol. 5, No. 4, p.p Diffie W. and Hellman M. (1976), New direcions in Crpograph, IEEE Trans. Info.Theor.31.pp Gennaro., Jarecki Hkrawczk., and abin T. (1996). obs hreshold D signare. dances in Crpolog Erocrpo - 96, Proceedings. p.p Berlin-Heidelberg: pringer Verlag. 6. Harn L. (1993). (, n) Threshold signare scheme and digial mlisignare. Workshop on crpograph and Daa secri, Proceedings. Jne 7-9: p.p Chng Cheng Insie of Technolog, OC. 7. Lim C.H. and P.J.Lee. (1996). ecri Proocol, In Proceedings of Inernaional Workshop, (Cambridge, Unied ingdom), pringer-verlag, LNC #

10 8. abin, T. (1998). simplified approach o hreshold and proacie. In dances in Crpolog Crpo -98, Proceedings, p.p New York: pringer Verlag. 9. chnorr C.P. (1994). Efficien signare generaion b smar cards, Jornal of Crpolog, 4(3), p.p hamir. (1979). How o share a secre, commnicaions of he CM, 22: p.p Yen.M. and Laih C.. (1993). New digial signare scheme based on Discree Logarihm, Elecronic leers, Vol. 29 No. 12 pp Zheng, Y., Masmmoo T. and Imai H. (1990). rcral properies of one wa hash fncions. dances in Crpolog Crpo, 90, Proceedings, p.p , pringer Verlag. Manoj mar receied he B.c. degree in mahemaics from Meer Uniersi Meer, in 1993; he M. c. in Mahemaics (Goldmedalis) from C.C..Uniersi Meer, in 1995; he M.Phil. (Goldmedalis) in Crpograph, from Dr. B... Uniersi gra, in 1996; sbmied he Ph.D. hesis in Crpograph, in He also agh applied Mahemaics a DV College, Mzaffarnagar, India from ep, 1999 o March, 2001; a.d. College of Engineering & Technolog, Mzaffarnagar, and U.P., India from March, 2001 o No, 2001; a Hindsan College of cience & Technolog, Farah, Mahra, conine since No, He also qalified he Naional Eligibili Tes (NET), condced b Concil of cienific and Indsrial esearch (CI), New Delhi- India, in He is a member of Indian Mahemaical ocie, Indian ocie of Mahemaics and Mahemaical cience, amanjan Mahemaical socie, and Crpograph esearch ocie of India. His crren research ineress inclde Crpograph, Nmerical analsis, Pre and pplied Mahemaics. 10