Conceptio › Archive › Google Patents

Google Patentsopen access

Certificateless public key encryption using pairings — Secure-Ic Sas (US11870891B2)

Secure-Ic Sas · Google Patents

Google Patents · Patents · License: Open Access

Open Source ↗

icsas secure

patent, google patents, intellectual property, US11870891B2, Secure-Ic Sas, Margaux DUGARDIN, en, 2024

ABSTRACT

Abstract

A transmitter device for sending an encrypted message to a receiver device in an identity-based cryptosystem, the transmitter device being associated with a transmitter identifier. The transmitter device is configured to receive a transmitter partial private key from a trusted center, the transmitter device being configured to: send a request for two public session keys to the receiver device; receive from the receiver device a first ciphertext set, the first ciphertext set being derived from an encryption and authentication of two public session keys; decrypt and authenticate the two public session keys from the first ciphertext set using a receiver identifier and the transmitter partial private key; determine a second ciphertext set from the transmitter partial private key, from the receiver identifier, and from the two public session keys, the second ciphertext comprising an encrypted message; send the second ciphertext set to the receiver device.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a National Stage of International patent application PCT/EP2019/083943, filed on Dec. 6, 2019, which claims priority to foreign European patent application No. EP 18306629.9, filed on Dec. 6, 2018, the disclosures of which are incorporated by reference in their entirety.

TECHNICAL FIELD

The invention generally relates to cryptosystems and in particular to the security of identity-based encryption systems.

BACKGROUND

Cryptographic mechanisms are used in many fields to protect stored, processed, and transferred information against interceptors or eavesdroppers. Several keyed cryptographic algorithms exist. They rely on the use of secret/private information to protect data and provide confidentiality, integrity, authenticity, and non-repudiation services.

In key-based cryptographic systems, cryptographic keys are used to generate ciphertext data from original data through an encryption mechanism and to recover the original data through a decryption mechanism. The encryption mechanism uses an encryption key, while the decryption mechanism uses a decryption key. The encryption key and the decryption key may be either similar or different.

In symmetric-key cryptosystems, the encryption key and the decryption key are the same, the same cryptographic key being used for encryption of original data and decryption of plaintext. The encryption and decryption keys in symmetric-key cryptosystems represent a shared secret between the users that is used to maintain a private information link. Exemplary symmetric-key cryptosystems comprise the Diffie-Hellman key exchange method, and the AES (Advanced Encryption Standard) cryptosystems.

In public-key cryptosystems, the encryption key and the decryption key are different. More specifically, in a public-key cryptosystem, each user of the cryptosystem generates a pair of encryption key/decryption key. The encryption key, also referred to as a public key, is a public value that the user publishes/disseminates to the remaining users of the cryptosystem. The decryption key, also referred to as a private key, is secret and kept known only by the owner. Any user of a public-key cryptosystem can encrypt a message using the public key of the recipient. The encrypted message can only be decrypted with the private key of the recipient. Public-key cryptosystems allow public key encryption, ensure confidentiality, and allow digital signatures in which a message can be signed with a user's private key and verified with the user's public key. Exemplary public-key cryptosystems comprise the RSA (Rivest-Shamir-Adleman) cryptosystems.

A major challenge of public-key cryptosystems is to ensure the authenticity of public keys, which involves ensuring that a particular public key is correct, belongs to the claimed user, and has not been tampered or replaced by a malicious third party. In order to guarantee the authenticity of public keys, existing public-key cryptosystems use a public key infrastructure in which one or more certificate authorities certify ownership of public/private keys.

In âA. Shamir, Identity-Based Cryptosystems and Signature Schemes, In: Blakley G. R., Chaum D. (eds) Advances in Cryptology, CRYPTO 1984â, Shamir proposed a novel type of public cryptographic schemes, referred to as âidentity-based cryptosystemsâ. The identity-based cryptosystems and signature schemes enable a secure communication of message and verification of signatures between the users of a cryptosystem without exchanging private or public keys. Such cryptosystems comprise a center referred to as a âtrusted centerâ or a âpublic-key generation centerâ and rely on the use of an identity information that uniquely identifies each user in the cryptosystem to generate a public/private key common to each user. The role of the trusted center is to give to each user a private key when the user first joins the system. During a setup step, the trusted center determines, from a given security parameter, global system parameters and a secret master key. The global system parameters are then made public to all the users. Then, during a key generation step, the trusted center receives the identity information of each user, computes a private key in association with the identity information, and sends to each user his private key. The trusted computes the private keys of all the users in the system using the global system parameters and the secret master key it previously determined from the security parameter. Messages are encrypted by the users using the global system parameters and the identity information of the receiver of the encrypted message, used as a public key. Encrypted messages are decrypted using the global system parameters and the private key associated with the identity information that was used in the encryption step as encryption key.

Several identity-based cryptographic schemes have been developed, including:

âD. Boneh and M. K. Franklin, Identity-Based Encryption from the Weil Pairing, In: Kilian J. (eds) Advances in Cryptology, CRYPTO 2001â; âC. Cocks, An Identity-Based Encryption Scheme Based on Quadratic Residues, In: Honary B. (eds) Cryptography and Coding. Cryptography and Coding 2001â; âS. S. Al-Riyami and K. G. Paterson, Certificateless Public Key Cryptography, In: Laih CS. (eds) Advances in CryptologyâASIACRYPT 2003â; Patent application No. EP1519530A1 that describes a method for establishing an encrypted communication by means of keys; U.S. Pat. No. 7,239,701 B1; US Patent No. US 2005/0089173 A1; and Patent No. WO2013116928A1 that describes the Verifiable Identity Based Encryption Protocol in which a method for sending encrypted messages over possible unsecured channels is developed.

The security of identity-based cryptosystems depends on the security of the cryptographic functions implemented to determine the private keys, on the secrecy of the information stored at the trusted center (e.g. the master key, the private keys of the users), the identity checks performed by the trusted center before delivering private keys to the users based on their identity information, and on the actions taken by the users to safely hold their private keys and prevent their loss, duplication, or unauthorized access/use.

In existing identity-based encryption schemes, the trusted center knows all the private keys of all the users since it determined the private keys from each identity information associated with each user. The knowledge of the private keys allows the trusted center to completely decrypt any encrypted message. This problem is known as the key escrow problem. If an attacker recovers the master key that the trusted center uses to determine the private keys from the identity information associated with each user, the attacker can have access to each sent message. If a corruption of the master key occurs, then the trusted center must generate another master key and must re-compute and re-distribute all the private keys for all the users in the system.

There is accordingly a need for securing identity-based cryptosystems against the key escrow problem and more generally, there is a need for developing secured identity-based cryptosystems.

SUMMARY

In order to address these and other problems, there is provided a transmitter device for sending an encrypted message to a receiver device in an identity-based cryptosystem, the transmitter device being associated with a transmitter identifier. The transmitter device may be configured to receive a transmitter partial private key from a trusted center, the transmitter device being configured to:

send a request for two public session keys to the receiver device;

receive from the receiver device a first ciphertext set, the first ciphertext set being derived from an encryption and authentication of two public session keys;

decrypt and authenticate the two public session keys from the first ciphertext set using a receiver identifier and the transmitter partial private key;

determine a second ciphertext set from the transmitter partial private key, from the receiver identifier, and from the two public session keys, the second ciphertext comprising an encrypted message;

send the second ciphertext set to the receiver device.

According to some embodiments, the transmitter partial private key may depend on the transmitter identifier associated with the transmitter device.

According to some embodiments, the identity-based cryptosystem may be associated with system parameters comprising an admissible bilinear map, a first cryptographic hash function, a second cryptographic hash function, a third cryptographic hash function, and a trusted center public key associated with the trusted center, the first ciphertext set comprising a first ciphertext, a second ciphertext, a third ciphertext, a fourth ciphertext, and a fifth ciphertext. The transmitter device may be configured to:

apply the first cryptographic hash function to the receiver identifier, which provides a receiver public key;

apply a subtraction operation between (i) the second ciphertext, and (ii) the output of the second cryptographic hash function applied to the bilinear map applied to the transmitter partial private key and to the first ciphertext, which provides a secret key;

apply a decipher to the third ciphertext, which provides a recovered first public session key, the decipher using the secret key as a decryption key;

apply the decipher to the fourth ciphertext, which provides a recovered second public session key;

apply the third cryptographic hash function to the secret key, to the recovered first public session key, and to the recovered second public session key, which provides a recovered intermediate value;

check if the fifth ciphertext is equal to the output of the second cryptographic hash function applied to an input value, the input value being the output of the bilinear map applied to (iii) the transmitter partial private key, and (iv) to the receiver public key to the power the recovered intermediate value.

According to some embodiments, the transmitter device may be configured to check whether a trusted center identity verification condition and/or a public session keys verification condition are verified, the trusted center identity verification condition being satisfied if the output of the bilinear map applied to the transmitter partial private key and to the trusted center public key is equal to the output of the bilinear map applied to:

the result of the first cryptographic hash function applied to the transmitter identifier, and

the result of the first cryptographic hash function applied to the trusted center identifier,

the public session keys comprising a first public session key and a second public session key, the public session keys verification condition being satisfied if the output of the bilinear map applied to the first public session key and to the result of the first cryptographic hash function applied to the transmitter identifier is equal to the output of the bilinear map applied to the second public session key and to the transmitter partial private key.

According to some embodiments, the second ciphertext set may further comprise a first component, a second component, and a third component, the transmitter device being configured to:

generate a random secret key;

apply the first cryptographic hash function to the receiver identifier, which provides a receiver public key;

apply a third cryptographic hash function to the random secret key and to a given message, which provides an auxiliary value;

apply an exponentiation function of a base equal to a trusted center public key and an exponent equal to the auxiliary value, which provides the first component;

add the random secret key to the output of the second cryptographic hash function applied to the result of the bilinear map applied to the first public session key to the power the auxiliary value and to the receiver device public key, which provides the second component;

apply a cipher to a given message using the random secret key, which provides an encrypted message;

apply a second cryptographic hash function to the result of the bilinear map to the power the auxiliary value, the bilinear map being applied to the transmitter partial private key and to the receiver public key, which provides the third component.

There is also provided a receiver device for receiving an encrypted message from a transmitter device, the transmitter device being associated with a transmitter identifier, the receiver device being configured to determine two public session keys from a receiver partial private key associated with the receiver device and from system parameters, the receiver device being configured to send a first ciphertext set to the transmitter device, the receiver device being configured to determine the first ciphertext set from an encryption of the two public session keys, the receiver device being configured to receive a second ciphertext set from the transmitter device comprising the encrypted message, the second ciphertext set depending on a transmitter partial private key received from a trusted center, a receiver identifier associated with the receiver device, and the two public session keys, the receiver device being configured to recover the original message by decrypting the encrypted message and authenticating the transmitter device.

According to some embodiments, the system parameters may comprise a prime number, two algebraic groups of order equal to the prime number, an admissible bilinear map, a first cryptographic hash function, a second cryptographic hash function, a third cryptographic hash function, and a trusted center public key associated with a trusted center identifier.

According to some embodiments, the receiver partial private key may depend on a receiver identifier associated with the receiver device.

According to some embodiments, the receiver device may be configured to verify a trusted center public key associated with the trusted center using the receiver partial private key and to determine a private session key, two public session keys comprising a first public session key and a second public session key, and a first ciphertext set if a verification condition is satisfied, the verification condition being satisfied if the receiver device determines that a first value is equal to a second value, the first value being determined by applying the bilinear map to the receiver device partial private key and to the trusted center public key, the second value being determined by applying the bilinear map to the output of the first cryptographic hash function applied to the receiver identifier and to the output of the first cryptographic hash function applied to the trusted center identifier.

CROSS-REFERENCE TO RELATED APPLICATIONS

TECHNICAL FIELD

The invention generally relates to cryptosystems and in particular to the security of identity-based encryption systems.

BACKGROUND

Several identity-based cryptographic schemes have been developed, including:

There is accordingly a need for securing identity-based cryptosystems against the key escrow problem and more generally, there is a need for developing secured identity-based cryptosystems.

SUMMARY

send a request for two public session keys to the receiver device;

receive from the receiver device a first ciphertext set, the first ciphertext set being derived from an encryption and authentication of two public session keys;

decrypt and authenticate the two public session keys from the first ciphertext set using a receiver identifier and the transmitter partial private key;

determine a second ciphertext set from the transmitter partial private key, from the receiver identifier, and from the two public session keys, the second ciphertext comprising an encrypted message;

send the second ciphertext set to the receiver device.

According to some embodiments, the transmitter partial private key may depend on the transmitter identifier associated with the transmitter device.

apply the first cryptographic hash function to the receiver identifier, which provides a receiver public key;

apply a decipher to the third ciphertext, which provides a recovered first public session key, the decipher using the secret key as a decryption key;

apply the decipher to the fourth ciphertext, which provides a recovered second public session key;

the result of the first cryptographic hash function applied to the transmitter identifier, and

the result of the first cryptographic hash function applied to the trusted center identifier,

According to some embodiments, the second ciphertext set may further comprise a first component, a second component, and a third component, the transmitter device being configured to:

generate a random secret key;

apply the first cryptographic hash function to the receiver identifier, which provides a receiver public key;

apply a third cryptographic hash function to the random secret key and to a given message, which provides an auxiliary value;

apply an exponentiation function of a base equal to a trusted center public key and an exponent equal to the auxiliary value, which provides the first component;

apply a cipher to a given message using the random secret key, which provides an encrypted message;

According to some embodiments, the receiver partial private key may depend on a receiver identifier associated with the receiver device.

According to some embodiments, the receiver device may be configured to determine a random value and to determine the private session key by applying an exponentiation function of a base equal to the receiver partial private key and an exponent equal to the random value, the two public session keys comprising a first public session key and a second public session key, the receiver device being configured to determine the first public session key by applying an exponentiation function of a base equal to the output of the application of the first cryptographic hash function to a trusted center identifier and an exponent equal to said random value, and to determine the second public session key by applying an exponentiation function of a base equal to the trusted center public key and an exponent equal to the random value.

According to some embodiments, the first ciphertext set may comprise a first ciphertext, a second ciphertext, a third ciphertext, a fourth ciphertext, and a fifth ciphertext, the receiver device being configured to randomly generate a random secret key, the receiver device being configured to determine a transmitter public key by applying the first cryptographic hash function to the transmitter device identifier, and to determine a first intermediate value by applying the third cryptographic hash function to the random secret key, to the first public session key, and to the second public session key, the receiver device being further configured to:

determine the first ciphertext by applying an exponentiation function of a basis equal to the trusted user public key and an exponent equal to the first intermediate value;

add the random secret key to a value, which provides the second ciphertext, the value being the result the second cryptographic hash function applied to the output of the bilinear map applied to a first input and a second input, the first input being the result of an exponentiation function having a basis given by the transmitter device public key and an exponent given by said intermediate value, the second input being of the result of the first cryptographic hash function to applied to the trusted center identifier;

determine the third ciphertext by applying a cipher algorithm to the first public session key, the cipher algorithm using the random secret key as encryption key;

determine the fourth ciphertext by applying a cipher algorithm to the second public session key; and

determine the fifth ciphertext by applying a second cryptographic hash function to the output of the application of the bilinear map exponent the first intermediate value, the output being obtained by applying the bilinear map to the receiver partial private key and the transmitter public key.

According to some embodiments, the second ciphertext set further comprises a first component, a second component, and a third component, the first component, the receiver device being configured to:

determine a transmitter public key by applying the first cryptographic hash function to the transmitter identifier;

determine a secret key by applying a subtraction operation to the second component comprised in the second ciphertext set and to the output of the application of the second cryptographic hash function to the result of the application of the bilinear map to the first component comprised in the second ciphertext set and to the private session key;

determine the original message by decrypting the encrypted message using a decipher that uses the secret key as a decryption key;

determine an auxiliary value by applying the third cryptographic hash function to the secret key and the original message; and

verify the identity of the transmitter device by checking if a transmitter identity verification condition is satisfied, the transmitter identity verification condition being satisfied if the receiver device determines that the third component comprised in the second ciphertext set is equal to the output of the second cryptographic hash function applied to an output result to the power of the auxiliary value, the output result being determined by the application of the bilinear map to the transmitter device public key and the receiver device partial private key.

There is also provided an identity-based cryptosystem comprising a trusted center, the trusted center being configured to determine system parameters and a master private key from a trusted center security parameter and a trusted center identifier, the system parameters comprising a prime number, two algebraic groups of order equal to the prime number, an admissible bilinear map, a first cryptographic hash function, a second cryptographic hash function, a third cryptographic hash function, and a trusted center public key associated with the trusted center identifier, the trusted center being configured to:

generate the prime number, the two algebraic groups and the admissible bilinear map by running a Bilinear Diffie-Hellman parameter generator that takes as input the trusted center security parameter;

select a first cryptographic hash function, a second cryptographic hash function, and a third cryptographic hash function from a predefined set of cryptographic hash functions;

determine a first value by applying the first cryptographic hash function to the trusted center identifier;

randomly select a master secret key; and

determine the trusted center public key by applying an exponentiation function defined by a base and an exponent, the base being equal to the first value, and the exponent being equal to the master private key.

According to some embodiments, the trusted center may be configured to determine a transmitter partial private key and a receiver partial private key from the master secret key, the system parameters, a transmitter identifier and a receiver identifier, the trusted center being configured to determine a transmitter public key by applying the first hash function to a transmitter device identifier and to determine the transmitter partial private key by applying an exponentiation function defined by a base and an exponent, the base being equal to the transmitter public key, and the exponent being equal to the inverse of the master secret key, the trusted center being configured to determine a receiver public key by applying the first hash function to the receiver identifier and to determine the receiver partial private key by applying an exponentiation function defined by a base and an exponent, the base being equal to the receiver public key, and the exponent being equal to the inverse of the master secret key.

Advantageously, the embodiments of the invention enable resolving the key escrow problem, the trusted center having no access to the messages sent between the users and having only access to partial private keys of the users.

Advantageously, the embodiments of the invention enable assuring the forward secrecy between the users and the protection of the messages sent and to be sent between the users against any corruption occurring on the master key hold by the trusted center.

Advantageously, the identity-based cryptosystem according to the embodiments of the invention provide and guarantee data confidentiality between the users and authentication of the users that the identity of each sender and each recipient can be verified.

Further advantages of the present invention will become clear to the skilled person upon examination of the drawings and detailed description. It is intended that any additional advantages be incorporated herein.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various embodiments of the invention and, together with the general description of the invention given above, and the detailed description of the embodiments given below, serve to explain the embodiments of the invention.

FIG. 1 is a schematic diagram of an exemplary implementation of the invention in a cryptosystem 100 ;

FIG. 2 is a flowchart depicting a method of encrypting and sending a message from a sender to a recipient in a cryptosystem 100 , according to some embodiments of the invention;

FIG. 3 is a flowchart depicting a method for determining at the trusted center 101 system parameters and a master private key s according to a setup algorithm in accordance with some embodiments of the invention;

FIG. 4 is a flowchart depicting a method for determining at the trusted center 101 a sender partial private key and a recipient partial private key according to the KeyGen1 algorithm in accordance with some embodiments of the invention;

FIG. 5 is a flowchart depicting a method for determining at the recipient 105 a private session key and two public session keys according to the KenGen2 algorithm in accordance with some embodiments of the invention;

FIG. 6 is a flowchart depicting a method for determining at the recipient 105 a first ciphertext set according to the Encrypt1 algorithm in accordance with some embodiments of the invention;

FIG. 7 is a flowchart depicting a method for decrypting and authenticating the two public session keys at the sender 103 according to the Decrypt1 algorithm in accordance with some embodiments of the invention;

FIG. 8 is a flowchart depicting a method for computing a second ciphertext set at the sender 103 according to the Encrypt2 algorithm in accordance with some embodiments of the invention;

FIG. 9 is a flowchart depicting a method for recovering an original message at the recipient 105 according to the Decrypt2 algorithm in accordance with some embodiments of the invention; and

FIG. 10 is a block diagram representing an exemplary hardware/software architecture of a device 1000 operating in the cryptosystem 100 such as the trusted center 101 , the sender 103 , or the recipient 105 , according to some embodiments of the invention.

DETAILED DESCRIPTION

Embodiments of the invention provide devices and methods for secured, confidential, and authenticated exchange of messages between a pair of users, comprising a sender (also referred to herein as a âtransmitterâ, a âsender deviceâ or a âtransmitter deviceâ) and a recipient (also referred to hereinafter as a âreceiverâ, a ârecipient deviceâ or a âreceiver deviceâ), in an identity-based encryption cryptosystem (also referred to as a âcryptographic systemâ).

Referring to FIG. 1 , there is shown a cryptosystem 100 in which the embodiments of the invention may be applied. The cryptosystem 100 may comprise a sender 103 and a recipient 105 connected via a link 107 and a trusted center 101 .

The sender 103 and the recipient 105 may be any user, user device, equipment, object, entity, configured to operate in the cryptosystem 100 . More specifically, the sender 103 may be any user device, user equipment, user object, or user apparatus configured or configurable to determine an encrypted message from original data and to transmit the encrypted message to the recipient 105 . The recipient 105 may be any user device, user equipment, user object, or user apparatus configured or configurable to receive the encrypted message transmitted over the link 107 and to decrypt the encrypted message to recover original data. It should be noted that in the figures, the sender 103 and the recipient 105 are labeled according to the direction of transmission and reception of encrypted messages. However, in practice, the sender 103 and the recipient 105 may be any transceivers devices capable of transmitting and receiving data in any cryptosystem 100 .

In some embodiments, the sender 103 and the recipient 105 may be any cryptographic device that implement hardware and/or software cryptographic functions for ensuring data and/or signals security, encryption, authentication, protection, and privacy. As used herein, a âcryptographic deviceâ encompasses any device, computer, computing machine, or embedded system, programmed and/or programmable to perform cryptographic functions for the generation and the use of cryptographic keys. Exemplary cryptographic devices include, without limitation:

smartcards, tokens to store keys such as wallets, smartcards readers such as Automated Teller Machines (ATM) used for example in financial transactions, restricted access, telecommunications, military applications, secure communication equipments, and TV set-top boxes; electrical and digital electronic devices such as RFID tags and electronic keys; embedded secure elements; computers (e.g. desktop computers and laptops), tablets; routers, switches, printers; mobile phones such as smartphones, base stations, relay stations, satellites; Internet of Thing (IoT) devices, robots, drones; and recorders, multimedia players, mobile storage devices (e.g. memory cards and hard discs) with logon access monitored by cryptographic mechanisms.

The embodiments of the invention may be applied in any a cryptosystem 100 , which may be used in different applications in storage, information processing, or communication systems.

For example, in an application of the invention to storage systems, the cryptosystem 100 may represent a storage system, infrastructure, or network, the sender 103 and/or the recipient 105 being part of such cryptosystem and comprising one or more storage devices configured to store or use encrypted data (e.g. memory cards or hard discs).

In an application of the invention to information processing, the cryptosystem 100 may be for example a computer system (e.g. a small or large area wired or wireless access network), a database, an online sale system or a financial system comprising a sender 103 and a recipient 105 configured to secure the data used and/or stored in the system (such as personal financial or medical data).

In an application of the invention to communication systems, the cryptosystem 100 may be wired/wireless/optical/radio communication network in which at least one sender 103 is configured to transmit, over a medium 107 that can be unsecure, encrypted data to at least one recipient 105 .

Original data may correspond to text files, video, audio, or any other media data.

The sender 103 and/or the recipient 105 may be fixed such as a computer operating in a wired communication system, or mobile, such as a user terminal operating in a radio or wireless network.

The link 107 may correspond to a network (e.g. Internet-based network, computer network) or to any communication medium (wired, wireless, or optical).

The sender 103 and the recipient 105 may be configured to select the trusted center 101 in the cryptosystem 100 and to identify the trusted center by its identity information. The sender 103 may be further configured to select the recipient 105 among the users of the cryptosystem 100 .

The trusted center 101 may be connected to the sender 103 and the recipient 105 . The trusted center 101 may be a device, an entity, or a system such as an organization (e.g. a social public organization, headquarters of a corporation) configured or configurable to generate private keys associated with the identity information of the users when they join the cryptosystem 100 .

According to some embodiments, the trusted center 101 may be a system administrator, a dedicated server, or a server that is part of a distributed network.

Each user in the cryptosystem 100 may be associated with an identity information, also referred to as âan identifierâ, that uniquely identifies the user in the cryptosystem 100 . In some embodiments, an identifier may be one or a combination of two or more identifiers chosen in a group comprising an identity sequence, a name, a username, a network address, a social security number, a street address, an office number, a telephone number, an electronic mail address associated with a user, a date, an Internet Protocol address belonging to a network host. An identifier associated with each user may be any public, cryptographically unconstrained string that is used in conjunction with public data of the trusted center 101 to perform data encryption or signing.

In the following description of some embodiments, the identity information associated with the sender 103 will also be referred to the âsender identifierâ or âtransmitter identifierâ, the identity information associated with the recipient 105 will be referred to as the ârecipient identifierâ or âreceiver identifierâ, and the identity information associated with the trusted center will be also referred to as the âtrusted center identifierâ.

Each of the sender identifier, the recipient identifier, and the trusted center identifier may be strings that belong to the set {0,1}*.

In order to facilitate the understanding of the various embodiments of the invention, the following definitions are provided:

n â

designates a non-zero natural number; Î» â

+ is a positive value integer number designating a security parameter (also referred to a trusted center security parameter);

designates a prime number;

2 =

designates a Euclidean domain (also called a Euclidean ring) and

2 [x] designates the ring of polynomials having coefficients that belong to the Euclidean ring

2 ; G and G T designate two groups of order p; e: GÃGâG T designates a bilinear map; H 1 : {0,1} n âG designates a first cryptographic hash function; H 2 : G T â{0,1} n designates a second cryptographic hash function; H 3 : {0,1} n Ã{0,1} n â

p n designates a third cryptographic hash function;

={0,1} n represents a finite message space, i.e. the space to which belongs each message (also referred to as an âoriginal messageâ or a âplaintext messageâ, or a âplaintextâ); M â

designates a plaintext message;

=G*Ã{0,1} n represents a finite ciphertext space, i.e. the space to which belongs each encrypted message (also referred to as a âciphertextâ or a âciphertext messageâ); C(M) â

designates a ciphertext message computed by encrypting the plaintext message M; ID TC refers to the trusted center identifier; ID send refers to the sender identifier (also referred to as a âtransmitter identifierâ); ID reci refers to the recipient identifier (also referred to as a âreceiver identifierâ);

<img id="CUSTOM-CHARACTER-00015" he="3.22mm" wi="3.22mm" file="US11870891-20240109-P00015.TIF" alt

CLAIMS

Claims ( 9 )

The invention claimed is:

1. A transmitter device for sending an encrypted message to a receiver device in an identity-based cryptosystem, the transmitter device being associated with a transmitter identifier, wherein the transmitter device is configured to receive a transmitter partial private key from a trusted center, said transmitter partial private key depending on the transmitter identifier associated with said transmitter device, the transmitter device being configured to:

send a request for two public session keys to the receiver device;

receive from the receiver device a first ciphertext set, said first ciphertext set being derived from an encryption and authentication of two public session keys;

decrypt and authenticate the two public session keys from the first ciphertext set using a receiver identifier and the transmitter partial private key;

determine a second ciphertext set from the transmitter partial private key, from the receiver identifier, and from the two public session keys, said second ciphertext comprising an encrypted message;

send said second ciphertext set to the receiver device,

wherein the transmitter device is configured to check whether a trusted center identity verification condition and/or a public session keys verification condition are verified, the trusted center identity verification condition being satisfied if an output of a bilinear map applied to the transmitter partial private key and to a trusted center public key is equal to the output of the bilinear map applied to:

a result of a first cryptographic hash function applied to the transmitter identifier; and

the result of the first cryptographic hash function applied to a trusted center identifier; and

2. The transmitter device of claim 1 , wherein said identity-based cryptosystem is associated with system parameters comprising said bilinear map, said first cryptographic hash function, a second cryptographic hash function, a third cryptographic hash function, and said trusted center public key associated with the trusted center, said first ciphertext set comprising a first ciphertext, a second ciphertext, a third ciphertext, a fourth ciphertext, and a fifth ciphertext, and wherein said transmitter device is configured to:

apply the first cryptographic hash function to the receiver identifier, which provides a receiver public key;

decipher the third ciphertext, which provides a recovered first public session key, said decipher using said secret key as a decryption key;

decipher the fourth ciphertext, which provides a recovered second public session key;

apply the third cryptographic hash function to said secret key, to said recovered first public session key, and to said recovered second public session key, which provides a recovered intermediate value; and

check if the fifth ciphertext is equal to the output of the second cryptographic hash function applied to an input value, said input value being the output of the bilinear map applied to (iii) the transmitter partial private key, and (iv) to the receiver public key to power said recovered intermediate value.

3. The transmitter device of claim 1 , wherein the second ciphertext set further comprises a first component, a second component, and a third component, the transmitter device being configured to:

generate a random secret key;

apply the first cryptographic hash function to the receiver identifier, which provides a receiver public key;

apply a third cryptographic hash function to said random secret key and to a given message, which provides an auxiliary value;

apply an exponentiation function of a base equal to a trusted center public key and an exponent equal to said auxiliary value, which provides the first component;

add said random secret key to the output of a second cryptographic hash function applied to the result of the bilinear map applied to the first public session key to power the auxiliary value and to said receiver device public key, which provides the second component;

apply a cipher to a given message using said random secret key, which provides an encrypted message; and

apply a second cryptographic hash function to the result of the bilinear map to the power the auxiliary value, said bilinear map being applied to the transmitter partial private key and to the receiver public key, which provides the third component.

4. A receiver device for receiving an encrypted message from a transmitter device, the transmitter device being associated with a transmitter identifier, the receiver device being configured to determine two public session keys from a random value, the receiver being configured to determine a private session key by applying an exponentiation function of a base equal to a receiver partial private key and an exponent equal to said random value, the receiver device being configured to send a first ciphertext set to the transmitter device, the receiver device being configured to determine said first ciphertext set from an encryption of the two public session keys, the receiver device being configured to receive a second ciphertext set from the transmitter device comprising said encrypted message, the second ciphertext set depending on a transmitter partial private key received from a trusted center, a receiver identifier associated with said receiver device, and the two public session keys, the receiver device being configured to recover an original message by decrypting said encrypted message and authenticating the transmitter device,

wherein the receiver partial private key depends on a receiver identifier associated with the receiver device,

wherein the receiver device is configured to verify a trusted center public key associated with the trusted center using the receiver partial private key and to determine a private session key, two public session keys comprising a first public session key and a second public session key, and a first ciphertext set if a verification condition is satisfied, said verification condition being satisfied if the receiver device determines that a first value is equal to a second value, said first value being determined by applying a bilinear map to the receiver device partial private key and to a trusted center public key, said second value being determined by applying the bilinear map to output of a first cryptographic hash function applied to the receiver identifier and to the output of a first cryptographic hash function applied to the trusted center identifier.

5. The receiver device of claim 4 , wherein system parameters comprise a prime number, two algebraic groups of order equal to said prime number, said bilinear map, said first cryptographic hash function, a second cryptographic hash function, a third cryptographic hash function, and said trusted center public key associated with a trusted center identifier.

6. The receiver device of claim 4 , wherein the receiver device is configured to determine a random value and to determine said private session key by applying an exponentiation function of a base equal to the receiver partial private key and an exponent equal to said random value, said two public session keys comprising a first public session key and a second public session key, the receiver device being configured to determine said first public session key by applying an exponentiation function of a base equal to the output of an application of the first cryptographic hash function to a trusted center identifier and an exponent equal to said random value, and to determine said second public session key by applying an exponentiation function of a base equal to the trusted center public key and an exponent equal to said random value.

7. The receiver device of claim 4 , wherein the first ciphertext set comprises a first ciphertext, a second ciphertext, a third ciphertext, a fourth ciphertext, and a fifth ciphertext, the receiver device being configured to randomly generate a random secret key, the receiver device being configured to determine a transmitter public key by applying the first cryptographic hash function to the transmitter device identifier, and to determine a first intermediate value by applying a third cryptographic hash function to said random secret key, to the first public session key, and to the second public session key, the receiver device being further configured to:

determine said first ciphertext by applying an exponentiation function of a basis equal to a trusted user public key and an exponent equal to said first intermediate value;

add said random secret key to a value, which provides said second ciphertext, said value being a result a second cryptographic hash function applied to the output of the bilinear map applied to a first input and a second input, said first input being the result of an exponentiation function having a basis given by a transmitter device public key and an exponent given by said intermediate value, said second input being of the result of the first cryptographic hash function to applied to the trusted center identifier;

determine said third ciphertext by applying a cipher algorithm to the first public session key, said cipher algorithm using said random secret key as encryption key;

determine said fourth ciphertext by applying a cipher algorithm to the second public session key; and

determine said fifth ciphertext by applying a second cryptographic hash function to the output of an application of a bilinear map exponent said first intermediate value, said output being obtained by applying said bilinear map to the receiver partial private key and the transmitter public key.

8. The receiver device of claim 4 , wherein the second ciphertext set further comprises a first component, a second component, and a third component, said first component, the receiver device being configured to:

determine a transmitter public key by applying the first cryptographic hash function to the transmitter identifier;

determine a secret key by applying a subtraction operation to the second component comprised in the second ciphertext set and to the output of an application of a second cryptographic hash function to a result of the application of the bilinear map to the first component comprised in the second ciphertext set and to the private session key;

determine said original message by decrypting said encrypted message, said decrypting of the encrypted message including deciphering said encrypted message using said secret key as a decryption key;

determine an auxiliary value by applying a third cryptographic hash function to said secret key and said original message; and

verify the identity of the transmitter device by checking if a transmitter identity verification condition is satisfied, said transmitter identity verification condition being satisfied if the receiver device determines that the third component comprised in the second ciphertext set is equal to the output of the second cryptographic hash function applied to an output result to a power of said auxiliary value, said output result being determined by the application of the bilinear map to a transmitter device public key and the receiver device partial private key.

9. An identity-based cryptosystem comprising a trusted center, said trusted center being configured to determine system parameters and a master private key from a trusted center security parameter and a trusted center identifier, said system parameters comprising a prime number, two algebraic groups of order equal to said prime number, an admissible bilinear map, a first cryptographic hash function, a second cryptographic hash function, a third cryptographic hash function, and a trusted center public key associated with said trusted center identifier, said trusted center being configured to:

generate said prime number, said two algebraic groups and said admissible bilinear map byrunning a Bilinear Diffie-Hellman parameter generator that takes as input said trusted center security parameter;

select a first cryptographic hash function, a second cryptographic hash function, and a third cryptographic hash function from a predefined set of cryptographic hash functions;

determine a first value by applying the first cryptographic hash function to said trusted center identifier;

randomly select a master secret key; and

determine said trusted center public key by applying an exponentiation function defined by a base and an exponent, said base being equal to said first value, and said exponent being equal to said master private key,

wherein the trusted center is configured to determine a transmitter partial private key and a receiver partial private key from said master secret key, said system parameters, a transmitter identifier and a receiver identifier, the trusted center being configured to determine a transmitter public key by applying the first hash function to a transmitter device identifier and to determine the transmitter partial private key by applying an exponentiation function defined by a base and an exponent, the base being equal to said transmitter public key, and the exponent being equal to an inverse of said master secret key, the trusted center being configured to determine a receiver public key by applying the first hash function to the receiver identifier and to determine the receiver partial private key by applying an exponentiation function defined by a base and an exponent, the base being equal to said receiver public key, and the exponent being equal to the inverse of said master secret key.

US17/299,772

2018-12-06

2019-12-06

Certificateless public key encryption using pairings

Active

2040-10-24

US11870891B2

( en )

Applications Claiming Priority (4)

Application Number

Priority Date

Filing Date

Title

EP18306629

2018-12-06

EP18306629.9

2018-12-06

EP18306629.9A

EP3664360B1

( en )

2018-12-06

Certificateless public key encryption using pairings

PCT/EP2019/083943

WO2020115265A1

( en )

2018-12-06

2019-12-06

Certificateless public key encryption using pairings

Publications (2)

Publication Number

Publication Date

US20220021526A1

US20220021526A1 ( en )

2022-01-20

US11870891B2

true

US11870891B2 ( en )

2024-01-09

Family

ID=65628489

Family Applications (1)

Application Number

Title

Priority Date

Filing Date

US17/299,772

Active

2040-10-24

US11870891B2

( en )

2018-12-06

2019-12-06

Certificateless public key encryption using pairings

Country Status (3)

Country

Link

( 1 )

US11870891B2

( en )

( 1 )

EP3664360B1

( en )

( 1 )

WO2020115265A1

( en )

Families Citing this family (15)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP4179695A1

( en )

2020-07-07

2023-05-17

Vibe Cybersecurity Inc.

Method and system for a verifiable identity based encryption (vibe) using certificate-less authentication encryption (clae)

CN112070492B

( en )

2020-08-20

2022-03-25

éå·ä¿¡å¤§æ·å®ä¿¡æ¯ææ¯è¡ä»½æéå¬å¸

Off-line POS machine transaction method and system

CN112070490B

( en )

2020-08-20

2022-03-25

éå·ä¿¡å¤§æ·å®ä¿¡æ¯ææ¯è¡ä»½æéå¬å¸

Off-line POS machine transaction method and system based on two-dimension code

GB2599634A

( en )

2020-09-30

2022-04-13

Nchain Holdings Ltd

Physically unclonable functions

GB2606709A

( en )

2021-05-12

2022-11-23

Nchain Licensing Ag

PUF device

CN113242554B

( en )

2021-07-12

2021-09-24

åäº¬çµä¿¡æéä¿¡æ¯ææ¯è¡ä»½æéå¬å¸

Mobile terminal authentication method and system based on certificate-free signature

US12047519B2

( en )

2021-07-15

2024-07-23

Nanyang Technological University

Physical unclonable function based mutual authentication and key exchange

CN113839786B

( en )

2021-10-29

2023-06-09

éå·ä¿¡å¤§æ·å®ä¿¡æ¯ææ¯è¡ä»½æéå¬å¸

Key distribution method and system based on SM9 key algorithm

EP4246880A1

( en )

2022-03-18

2023-09-20

Proton World International N.V.

Protecting a secret key

US11651694B1

( en )

2022-05-04

2023-05-16

Beta Air, Llc

Apparatus for encrypting external communication for an electric aircraft

CN116405295B

( en )

2023-04-13

2025-05-30

åäº¬èªç©ºèªå¤©å¤§å¦

Guardian-based data encryption method and system

CN117527225B

( en )

2023-12-08

2025-09-23

å´åéä¿¡ç§ææéå¬å¸

A backward secure certificateless authentication and key agreement method

CN117579272B

( en )

2023-12-29

2024-09-20

æ¨åå¤§å¦

Cross-institution financial privacy data sharing method and device and storage medium

CN119906995B

( en )

2025-01-21

2025-10-17

A scalable authentication key negotiation method for drone IoT

CN119788426B

( en )

2025-03-10

2025-05-09

ç¦å·å¸å¬å®å±

A distributed privacy computing network node management method and system

Citations (6)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP1519530A1

( en )

2003-09-29

2005-03-30

STMicroelectronics S.r.l.

Method for establishing an encrypted communication by means of keys

US20050089173A1

( en )

2002-07-05

2005-04-28

Harrison Keith A.

Trusted authority for identifier-based cryptography

US7239701B1

( en )

2000-05-02

2007-07-03

Murata Machinery Ltd.

Key sharing method, secret key generating method, common key generating method and cryptographic communication method in ID-NIKS cryptosystem

WO2013116928A1

( en )

2012-02-10

2013-08-15

Connect In Private Corp.

Method and system for a certificate-less authentication encryption (clae)

US20170034186A1

( en )

2015-07-28

2017-02-02

Qingji Zheng

Certificateless data verification with revocable signatures

US20220038267A1

( en )

2018-12-06

2022-02-03

Secure-Ic Sas

Methods and devices for secured identity-based encryption systems with two trusted centers

2018

2018-12-06

EP18306629.9A

patent/EP3664360B1/en

active

Active

2019

2019-12-06

PCT/EP2019/083943

patent/WO2020115265A1/en

not_active

Ceased

2019-12-06

US17/299,772

patent/US11870891B2/en

active

Active

Patent Citations (9)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US7239701B1

( en )

2000-05-02

2007-07-03

Murata Machinery Ltd.

Key sharing method, secret key generating method, common key generating method and cryptographic communication method in ID-NIKS cryptosystem

US20050089173A1

( en )

2002-07-05

2005-04-28

Harrison Keith A.

Trusted authority for identifier-based cryptography

EP1519530A1

( en )

2003-09-29

2005-03-30

STMicroelectronics S.r.l.

Method for establishing an encrypted communication by means of keys

WO2013116928A1

( en )

2012-02-10

2013-08-15

Connect In Private Corp.

Method and system for a certificate-less authentication encryption (clae)

US20130212377A1

( en )

2012-02-10

2013-08-15

Behzad Malek

Method and System for a Certificate-less Authenticated Encryption Scheme Using Identity-based Encryption

US8694771B2

( en )

2012-02-10

2014-04-08

Connect In Private Panama Corp.

Method and system for a certificate-less authenticated encryption scheme using identity-based encryption

US20170034186A1

( en )

2015-07-28

2017-02-02

Qingji Zheng

Certificateless data verification with revocable signatures

US9774610B2

( en )

2015-07-28

2017-09-26

Futurewei Technologies, Inc.

Certificateless data verification with revocable signatures

US20220038267A1

( en )

2018-12-06

2022-02-03

Secure-Ic Sas

Methods and devices for secured identity-based encryption systems with two trusted centers

Non-Patent Citations (4)

* Cited by examiner, â Cited by third party

Title

Al-Riyami, et al., " Certificateless Public Key Cryptography ", International Association for Cryptologic Research, vol. 20031021:122149, pp. 1-40, Oct. 21, 2003.

Boneh, et al., " Identity-Based Encryption from the Weil Pairing ", Advances in Cryptology, Crypto, 2001.

Cocks, " An Identity-Based Encryption Scheme Based on Quadratic Residues ", Cryptography and Coding, 2001.

Shamir, " Identity-Based Cryptosystems and Signature Schemes ", Advances in Cryptology, pp. 47-53, Crypto, 1984.

Also Published As

Publication number

Publication date

EP3664360B1

( en )

2024-09-04

US20220021526A1

( en )

2022-01-20

WO2020115265A1

( en )

2020-06-11

EP3664360A1

( en )

2020-06-10

Certificateless public key encryption using pairings — Secure-Ic Sas (US11870891B2)

Related documents