Google Patentsopen access

… a message signature from a signature token encrypted by means of a homomorphic … — Idemia Identity & Security (US10326598B2)

ABSTRACT

Abstract

A method for generating a message signature intended to be validated by a verifier server. A client device is configured to hold a private key and a corresponding public key. The method includes offline pre-computation by a hardware security module of a signature token, a result of encryption using a homomorphic encryption function, storage of the signature token generation of the signature of the encrypted message by the homomorphic encryption function from the result of the encryption by the homomorphic encryption function of the private key stored by the client device, of the signature token and of the message. The signature is intended to be validated by the verifier server by the public key.

Description

FIELD OF THE INVENTION

The present invention relates in general to the generation of a digital signature of a message.

The invention relates more precisely to a method for signing with tokens based on a digital signature algorithm.

STATE OF THE ART

Many digital signature methods are currently used in cryptography to generate, for a digital message, a signature guaranteeing the identity of the sender of this message.

To guarantee a high level of security, these methods can comprise complex operations needing considerable computation capacity. Such computing power needs can turn out to be problematic during the execution of such signature methods for the signing of messages in real time, particularly when these methods are performed on systems having reduced resources, such as a smart card.

With the goal of reducing the number of computations to be performed during signing, signature methods for performing some of these computations in advance have been developed. In this category of signature methods, signatures with token or coupon provide for the computation, prior to the signing of a message, of a token independent of this message, the storage of this token and its reuse during signing of a message for computing said signature. Such signature methods deport upstream of the signature the most complex computations and restrict to a minimum the needs for computation power during generation of the signature itself. An example of such a signature method by token is explained in Benoît Chevallier—Mames, New signature schemes with coupons and tight reduction , Applied Cryptography and Network Security—ACNS 2005, volume 3531, Lecture Notes in Computer Science, pages 513-528. SpringerVerlag, 2005.

Of the many existing signature methods some methods needing to make substantial computations during signing are those methods based on the DSA algorithm (“Digital Signature Algorithm”) or the ECDSA algorithm (“Elliptic Curve Digital Signature Algorithm”) based on elliptic curves. At each signing of a message, the methods based on these algorithms include respectively computation of exponentiation g k with k random integer or coordinates of a point of an elliptic curve by multiplying a generator g of an elliptic curve by a random k as integer. Such computations are very costly operations, particularly for a light client such as a smart card.

Unfortunately, such a computation cannot be anticipated assuredly, as in the case of a signature with token. In fact, in case of pre-computation and storage of a couple (k, abscissa (k*g)) or (k, g k mod p), if a hacker succeeds in gaining knowledge of such values and a signature generated from the latter according to the DSA or ECDSA algorithm, he could obtain information on the private key of the signatory. This hacker could fraudulently sign messages in the name of said signatory.

There is therefore a need for a signature method for anticipating prior to signing of a message the costliest computations such as determination of a point of an elliptic curve, without endangering the security of the signature mechanism.

SUMMARY OF THE INVENTION

For this purpose, according to a first aspect, the present invention relates to a method for generating a signature of a message intended to be validated by a verifier server, the signature protocol implemented for generating the signature comprising public parameters (G r , n, g) such that g is an element of the group G r , of the order n with n a prime integer,

a client device being configured to hold a private key and a corresponding public key,

said method being characterized in that it comprises steps of:

offline precomputation by a hardware security module of a signature token comprising a first part of signature token φ(r) and a second part of signature token φ(1/k), wherein k is a random integer comprised between 1 and n−1, and r is an intermediate integer defined by r=f(g k ) where f is a function having values in

n , and the first part of signature token φ(r) is generated by encrypting the intermediate integer r by means of said homomorphic encryption function (φ) and the second part of signature token φ(1/k) is generated by encrypting the inverse of the random 1/k by means of said homomorphic encryption function (φ),

storage of said signature token;

generation of said signature of said encrypted message by means of said homomorphic encryption function from the result of the encryption by said homomorphic encryption function of the private key stored by the client device, of the signature token and of said message, said signature being intended to be validated by said verifier server by means of said public key.

The complex steps of computation of the signature can be conducted in advance without compromise of the security due to encryption of the token serving to store the result of these computations. Computation of the signature can also be delegated by the client device to another device without the latter needing to know either the message to be signed or the decrypted token, or the private key of the client so as not to endanger the security of the signature mechanism.

Advantageously, though optionally, the generation steps of the random k and computation of the intermediate integer are also implemented previously offline by the hardware security module.

In the case of execution according to the ECDSA protocol, the group G r , is the group comprising all the points of an elliptic curve provided with addition, the public key y and the private key d can verify y=d*g, g being a point of an elliptic curve of the order n, a prime integer, and the method for generating a signature according to the first aspect can also comprise prior offline execution by said hardware security module of steps of:

generation of a random k as integer belonging to [1;n−1];

computation of the intermediate integer abscissa of the point of the elliptic curve k*g modulo n;

said signature token comprising a first part of signature token generated by encrypting the computed intermediate integer by means of said homomorphic encryption function and a second part of signature token generated by encrypting the inverse of the random by means of said homomorphic encryption function.

In the case of execution according to the DSA protocol, the group G r is the set

p provided with multiplication, where p is a prime integer number such that (p−1) is a multiple of n, the public key y and the private key d such that 0<d<q verify y=g d mod p, n being a prime number, g=h ((p-1/n) mod p with h a random integer verifying 1<h<p−1 and g different to 1,

and the method for generating a signature according to the first aspect can also comprise previously offline execution by said hardware security module of steps of:

generation of a random k as integer belonging to [1;n−1];

computation of the intermediate integer r=(g k mod p) mod n;

said signature token comprising a first part of signature token generated by encrypting the computed intermediate integer by means of said homomorphic encryption function and a second part of signature token generated by encrypting the inverse of the random by means of said homomorphic encryption function.

In a first embodiment, the signature of the message m encrypted by means of said homomorphic encryption function (p can comprise a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ(1/k)*(z+d.r)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r), with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the computed intermediate integer and (p the homomorphic encryption function.

The client can delegate computation of the first part of signature directly in encrypted form solely from φ(d), the message and the encrypted token without decrypting the elements assisting its computation. The client device only has to compute φ(d) at a minimum, further reducing the cost of generation of the signature for the latter.

In a second embodiment, the signature token can further comprise the result of encryption by said homomorphic encryption function of the product of the computed intermediate integer with the inverse of the random.

In this second embodiment, the signature of the message m encrypted by means of said homomorphic encryption function can comprise a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k).z+d.(r.1/k)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r), with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the computed intermediate integer, r.1/k the product of the computed intermediate integer with the inverse of the random and φ the homomorphic encryption function.

The signature can be computed without having to compute homomorphic multiplication of the order 2, further reducing the cost for generating the signature.

The present invention according to a second aspect relates to a computer program product comprising program code instructions for executing the steps of the method according to the first aspect when said program is executed on a computer.

The present invention relates according to a third aspect to a system for generating a signature of a message intended to be validated by a verifier server, a client device being configured to hold a private key and a corresponding public key, said system comprising:

a hardware security module configured to precompute, offline, a signature token as a result of encryption by means of a homomorphic encryption function,

a storage device of said signature token,

an intermediate server or said hardware security module configured to generate said signature of said encrypted message by means of said homomorphic encryption function from the result of the encryption by said homomorphic encryption function of the private key stored by the client device, of the signature token and of said message,

a verifier server configured to validate said signature by means of said public key.

In an embodiment, the invention relates to a method for generating a signature of a message intended to be validated by a verifier server, wherein the protocol conducted for generating the signature is DSA or ECDSA protocol,

a client device being configured to hold a private key d and a corresponding public key y, where, in the case of ECDSA protocol, the public key and the private key verify y=d*g where g is a point of an elliptic curve of the prime order n, and in the case of DSA protocol the private key d is such that 0<d<n and verifies with the public key y=g d mod p, n being a prime number, p being a prime number verifying (p−1) is a multiple of n, g=h ((p-1)/n) mod p with h a random integer verifying 1<h<p−1 and g different to 1,

said method being characterized in that it comprises steps of:

generation of a random k as integer belonging to [1;n−1] computation of an intermediate integer r, where r is the abscissa of the point of the elliptic curve k*g modulo n in the case of ECDSA protocol and equal to (g k mod p) mod n in the case of DSA protocol, offline precomputation by a hardware security module of a signature token φ(r), φ(1/k)) comprising a first part of signature token φ(r) generated by encrypting the computed intermediate integer r and a second part of signature token φ(1/k), generated by encrypting the inverse of the random 1/k by means of said homomorphic encryption function, storage of said signature token (φ(r), φ(1/k)); generation of said signature (r,s) of said message (m) encrypted by means of said homomorphic encryption function (φ(r), φ(s)) from the result (φ(d)) of the encryption by said homomorphic encryption function of the private key stored by the client device d, of the signature token (φ(r), φ(1/k)) and of said message, said signature being intended to be validated by said verifier server by means of said public key y.

Such computer program product and system for generating signature have the same advantages as those mentioned for the method according to the first aspect.

DESCRIPTION OF FIGURES

Other characteristics and advantages will emerge from the following description which is purely illustrative and nonlimiting and must be considered relative to the appended figures, wherein:

FIG. 1 schematically illustrates hardware means in a system for generating signature according to an embodiment of the invention;

FIG. 2 illustrates a flowchart representing execution of a method for generating a signature of a message according to the invention.

DETAILED DESCRIPTION OF AT LEAST ONE EMBODIMENT

An embodiment relates to a method for generating a signature of a message m executed by a system for generating signature 1 illustrated in FIG. 1 . Such a system for generating signature can comprise a client device 2 requiring generation of the signature for a message m to be signed and a verifier server 3 intended to validate the signature of said message m.

Such a system for generating signature further comprises a <figure-callout id="4" label="hardware security module" filenames="US10326598-201

FIELD OF THE INVENTION

The present invention relates in general to the generation of a digital signature of a message.

The invention relates more precisely to a method for signing with tokens based on a digital signature algorithm.

STATE OF THE ART

Many digital signature methods are currently used in cryptography to generate, for a digital message, a signature guaranteeing the identity of the sender of this message.

To guarantee a high level of security, these methods can comprise complex operations needing considerable computation capacity. Such computing power needs can turn out to be problematic during the execution of such signature methods for the signing of messages in real time, particularly when these methods are performed on systems having reduced resources, such as a smart card.

With the goal of reducing the number of computations to be performed during signing, signature methods for performing some of these computations in advance have been developed. In this category of signature methods, signatures with token or coupon provide for the computation, prior to the signing of a message, of a token independent of this message, the storage of this token and its reuse during signing of a message for computing said signature. Such signature methods deport upstream of the signature the most complex computations and restrict to a minimum the needs for computation power during generation of the signature itself. An example of such a signature method by token is explained in Benoît Chevallier—Mames, New signature schemes with coupons and tight reduction , Applied Cryptography and Network Security—ACNS 2005, volume 3531, Lecture Notes in Computer Science, pages 513-528. SpringerVerlag, 2005.

Of the many existing signature methods some methods needing to make substantial computations during signing are those methods based on the DSA algorithm (“Digital Signature Algorithm”) or the ECDSA algorithm (“Elliptic Curve Digital Signature Algorithm”) based on elliptic curves. At each signing of a message, the methods based on these algorithms include respectively computation of exponentiation g k with k random integer or coordinates of a point of an elliptic curve by multiplying a generator g of an elliptic curve by a random k as integer. Such computations are very costly operations, particularly for a light client such as a smart card.

Unfortunately, such a computation cannot be anticipated assuredly, as in the case of a signature with token. In fact, in case of pre-computation and storage of a couple (k, abscissa (k*g)) or (k, g k mod p), if a hacker succeeds in gaining knowledge of such values and a signature generated from the latter according to the DSA or ECDSA algorithm, he could obtain information on the private key of the signatory. This hacker could fraudulently sign messages in the name of said signatory.

There is therefore a need for a signature method for anticipating prior to signing of a message the costliest computations such as determination of a point of an elliptic curve, without endangering the security of the signature mechanism.

SUMMARY OF THE INVENTION

For this purpose, according to a first aspect, the present invention relates to a method for generating a signature of a message intended to be validated by a verifier server, the signature protocol implemented for generating the signature comprising public parameters (G r , n, g) such that g is an element of the group G r , of the order n with n a prime integer,

a client device being configured to hold a private key and a corresponding public key,

said method being characterized in that it comprises steps of:

offline precomputation by a hardware security module of a signature token comprising a first part of signature token φ(r) and a second part of signature token φ(1/k), wherein k is a random integer comprised between 1 and n−1, and r is an intermediate integer defined by r=f(g k ) where f is a function having values in

n , and the first part of signature token φ(r) is generated by encrypting the intermediate integer r by means of said homomorphic encryption function (φ) and the second part of signature token φ(1/k) is generated by encrypting the inverse of the random 1/k by means of said homomorphic encryption function (φ),

storage of said signature token;

generation of said signature of said encrypted message by means of said homomorphic encryption function from the result of the encryption by said homomorphic encryption function of the private key stored by the client device, of the signature token and of said message, said signature being intended to be validated by said verifier server by means of said public key.

The complex steps of computation of the signature can be conducted in advance without compromise of the security due to encryption of the token serving to store the result of these computations. Computation of the signature can also be delegated by the client device to another device without the latter needing to know either the message to be signed or the decrypted token, or the private key of the client so as not to endanger the security of the signature mechanism.

Advantageously, though optionally, the generation steps of the random k and computation of the intermediate integer are also implemented previously offline by the hardware security module.

In the case of execution according to the ECDSA protocol, the group G r , is the group comprising all the points of an elliptic curve provided with addition, the public key y and the private key d can verify y=d*g, g being a point of an elliptic curve of the order n, a prime integer, and the method for generating a signature according to the first aspect can also comprise prior offline execution by said hardware security module of steps of:

generation of a random k as integer belonging to [1;n−1];

computation of the intermediate integer abscissa of the point of the elliptic curve k*g modulo n;

said signature token comprising a first part of signature token generated by encrypting the computed intermediate integer by means of said homomorphic encryption function and a second part of signature token generated by encrypting the inverse of the random by means of said homomorphic encryption function.

In the case of execution according to the DSA protocol, the group G r is the set

p provided with multiplication, where p is a prime integer number such that (p−1) is a multiple of n, the public key y and the private key d such that 0&lt;d&lt;q verify y=g d mod p, n being a prime number, g=h ((p-1/n) mod p with h a random integer verifying 1&lt;h&lt;p−1 and g different to 1,

and the method for generating a signature according to the first aspect can also comprise previously offline execution by said hardware security module of steps of:

generation of a random k as integer belonging to [1;n−1];

computation of the intermediate integer r=(g k mod p) mod n;

said signature token comprising a first part of signature token generated by encrypting the computed intermediate integer by means of said homomorphic encryption function and a second part of signature token generated by encrypting the inverse of the random by means of said homomorphic encryption function.

In a first embodiment, the signature of the message m encrypted by means of said homomorphic encryption function (p can comprise a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ(1/k)*(z+d.r)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r), with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the computed intermediate integer and (p the homomorphic encryption function.

The client can delegate computation of the first part of signature directly in encrypted form solely from φ(d), the message and the encrypted token without decrypting the elements assisting its computation. The client device only has to compute φ(d) at a minimum, further reducing the cost of generation of the signature for the latter.

In a second embodiment, the signature token can further comprise the result of encryption by said homomorphic encryption function of the product of the computed intermediate integer with the inverse of the random.

In this second embodiment, the signature of the message m encrypted by means of said homomorphic encryption function can comprise a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k).z+d.(r.1/k)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r), with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the computed intermediate integer, r.1/k the product of the computed intermediate integer with the inverse of the random and φ the homomorphic encryption function.

The signature can be computed without having to compute homomorphic multiplication of the order 2, further reducing the cost for generating the signature.

The present invention according to a second aspect relates to a computer program product comprising program code instructions for executing the steps of the method according to the first aspect when said program is executed on a computer.

The present invention relates according to a third aspect to a system for generating a signature of a message intended to be validated by a verifier server, a client device being configured to hold a private key and a corresponding public key, said system comprising:

a hardware security module configured to precompute, offline, a signature token as a result of encryption by means of a homomorphic encryption function,

a storage device of said signature token,

an intermediate server or said hardware security module configured to generate said signature of said encrypted message by means of said homomorphic encryption function from the result of the encryption by said homomorphic encryption function of the private key stored by the client device, of the signature token and of said message,

a verifier server configured to validate said signature by means of said public key.

In an embodiment, the invention relates to a method for generating a signature of a message intended to be validated by a verifier server, wherein the protocol conducted for generating the signature is DSA or ECDSA protocol,

a client device being configured to hold a private key d and a corresponding public key y, where, in the case of ECDSA protocol, the public key and the private key verify y=d*g where g is a point of an elliptic curve of the prime order n, and in the case of DSA protocol the private key d is such that 0&lt;d&lt;n and verifies with the public key y=g d mod p, n being a prime number, p being a prime number verifying (p−1) is a multiple of n, g=h ((p-1)/n) mod p with h a random integer verifying 1&lt;h&lt;p−1 and g different to 1,

said method being characterized in that it comprises steps of:

generation of a random k as integer belonging to [1;n−1] computation of an intermediate integer r, where r is the abscissa of the point of the elliptic curve k*g modulo n in the case of ECDSA protocol and equal to (g k mod p) mod n in the case of DSA protocol, offline precomputation by a hardware security module of a signature token φ(r), φ(1/k)) comprising a first part of signature token φ(r) generated by encrypting the computed intermediate integer r and a second part of signature token φ(1/k), generated by encrypting the inverse of the random 1/k by means of said homomorphic encryption function, storage of said signature token (φ(r), φ(1/k)); generation of said signature (r,s) of said message (m) encrypted by means of said homomorphic encryption function (φ(r), φ(s)) from the result (φ(d)) of the encryption by said homomorphic encryption function of the private key stored by the client device d, of the signature token (φ(r), φ(1/k)) and of said message, said signature being intended to be validated by said verifier server by means of said public key y.

Such computer program product and system for generating signature have the same advantages as those mentioned for the method according to the first aspect.

DESCRIPTION OF FIGURES

Other characteristics and advantages will emerge from the following description which is purely illustrative and nonlimiting and must be considered relative to the appended figures, wherein:

FIG. 1 schematically illustrates hardware means in a system for generating signature according to an embodiment of the invention;

FIG. 2 illustrates a flowchart representing execution of a method for generating a signature of a message according to the invention.

DETAILED DESCRIPTION OF AT LEAST ONE EMBODIMENT

An embodiment relates to a method for generating a signature of a message m executed by a system for generating signature 1 illustrated in FIG. 1 . Such a system for generating signature can comprise a client device 2 requiring generation of the signature for a message m to be signed and a verifier server 3 intended to validate the signature of said message m.

Such a system for generating signature further comprises a hardware security module 4 intended to securely perform steps of computation of the signature, especially the costly steps which can be implemented independently of the message m. These computations can be made in advance, upstream of generation of the signature for the client device.

Such a hardware security module can be a HSM (Hardware Security Module) or a smart card or any other secure device fitted with processing means such as a secure computer, for example a computer isolated from the outside world. Such a hardware security module 4 can comprise a random number generator 5 and a computer 6 and can be configured to be connected to the client device.

The client device 2 does not necessarily comprise substantial computation means for implementing the steps of generation of the signature which are not implemented on the hardware security module 4 . The system for generating signature can also comprise an intermediate server 7 configured to be connected to the hardware security module 4 , and to which the latter can delegate computation steps. Such a connection can be local or remote, by way of a communications network such as an Ethernet network or the Internet.

The client device 2 is configured to hold a private key and the corresponding public key.

The method proposes taking on the hardware security module the costly steps which can be implemented independently of the message m in advance, i.e, before it is known (offline) and the result of these computations is stored in the form of a token. To ensure the security of the signature mechanism during reuse of this token for computing a signature for the message m, the invention proposes keeping this token in encrypted form. To prevent a hacker finding out this token, without as such needing costly decryption computations during computation of the signature, the token can be encrypted by means of a homomorphic function. Such a function computes on the fly (online) an encrypted signature from the encrypted token without having to decrypt the latter. Computation of such a signature can also be delegated by the client device to another device without compromising the security of the signature method.

The system for generating signature can also comprise a storage device 8 for the storage of the token. Such a storage device can be integrated into the hardware security module or else be independent and connected to the other elements of the system for generating signature by means of a communications network.

Carrying out the method for generating a signature of a message m can comprise as illustrated in FIG. 2 steps of:

offline beforehand computation 103 by the hardware security module 4 of a signature token (φ(r), φ(1/k)) result of encryption by means of a homomorphic encryption function φ,

storage 104 of said signature token φ(r), φ(1/k);

generation 105 of said signature (r,S) of said message m encrypted by means of said homomorphic encryption function φ(r), φ(s)) from the result of the encryption by said homomorphic encryption function of the private key stored by the client device, of the signature token (φ(r), φ(1/k)) and of said message m, said signature being intended to be validated by said verifier server 3 by means of said public key.

This step for generating signature can be conducted by the hardware security module 4 or the intermediate server 7 . The signature computation is delegated to the hardware security module or to this intermediate server, which reduces costs of computations made by the client device.

Also, due to the homomorphism property of homomorphic encryption the intermediate server can compute the signature without performing decryption and therefore there is no need to be sure to not endanger the security of the signature.

As a reminder, such a homomorphic function φ is a function such that, for a masking operation M such as multiplication by a mask datum a, there is an operation O, such as exponentiation by a, such as O(φ(x))=φ(M(x)), i.e, (φ(x))^a=φ(x*a). Such a function can also be homomorphic between two operations Op 1 and Op 2 if performing the operation Op 2 on (φ(x), φ(y)) produces φ (x Op 1 y). Hereinbelow “homomorphic multiplication of the order 1” means multiplication performed between two ciphertexts which have not undergone any prior multiplication and “homomorphic multiplication of the order 2” means multiplication performed between a ciphertext having already undergone multiplication and a ciphertext having already undergone more than one multiplication.

A pair of asymmetric encryption keys (pkφ, skφ) dedicated to executing the homomorphic encryption algorithm φ can be generated earlier, for example by the hardware security module, by another hardware security module, by the client device or by the verifier server which then has the private key skφ. The public key pkφ is shared with the other elements of the system for generating signature 1 . Such an algorithm can for example be the Paillier algorithm according to the following reference: Pascal Paillier, Public - key cryptosystems based on composite degree residuosity classes , EUROCRYPT 1999, 223-238. This reference proposes a additively homomorphic scheme. The latter can be transformed into a homomorphic scheme capable of evaluating polynomials of degree 2 by application of a method such as the method by Catalano and Fiore presented in the article Boosting linearly homomorphic encryption to evaluate degree -2 functions on encrypted data , Cryptology ePrint Archive, 2014, p813. Such a homomorphic encryption algorithm can also be an algorithm for performing a limited number of additions and multiplications on the ciphertext, specifically an algorithm so-called “Somewhat homomorphic encryption” (SHE). Such algorithms are presented in the article by Zvika Brakerski and Vinod Vaikuntanathan called “Fully Homomorphic Encryption from RingLWE and Security for KeyDependent Messages” and the article by Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan called “(Leveled) fully homomorphic encryption without bootstrapping” In ITCS, pages 309-325, 2012.

The hardware security module 4 can have the private key of said pair of asymmetric encryption keys skci so as to decrypt the signature tokens. It can also generate the private key skci, transmit it to the verifier server 3 and not keep it after this transmission. But the intermediate server does not have this private key, as it is not considered secure.

The signature can by way of example be a signature generated according to DSA protocol (“Digital Signature Algorithm”) or ECDSA protocol (“Elliptic Curve Digital Signature Algorithm”) detailed hereinbelow.

The execution of the method for generating signature according to the invention can comprise in more detail the steps described in the paragraphs hereinbelow in reference to FIG. 2 .

In all cases computations are performed in a group G r , provided with an internal composition law noted o. With a noted as an element of this group, the following notation is adopted:

a m =a∘ . . . ∘a

Where the operation o is applied m times, and m is a strictly positive integer.

It is also noted hereinbelow that g is an element of the group of the order n, where n is a prime number. G r , g and n are the public parameters of the signature protocol.

In the case of execution according to DSA protocol, the public key y and the private key d such as 0&lt;d&lt;n can verify y=g d mod p with n a prime number, p a prime number verifying (p−1) is a multiple of n, g=h ((p-1)/n) mod p, h being a random integer verifying 1&lt;h&lt;p−1 and g being different to 1. Constructed in this way, g is an element of the order n of the group

p . The elements (p, n, g), are the parameters of the DSA protocol.

In the case of execution according to ECDSA protocol, the public key y and the private key d randomly selected in [1; n−1] with n a prime integer, can verify y=d*g, g being a point of an elliptic curve of the order n. By way of example n can be equal to 256 bits for security of 128 bits.

During a generation step of random 101 , the random number generator 5 of the hardware security module 4 can previously generate, offline, a random k as integer belonging to [1;n−1], whether in an embodiment according to ECDSA protocol or according to DSA protocol.

Next, during step 102 , the computer 6 of the hardware security module computes the intermediate integer r=f(g k ), where f is a function taking as input an element of the group G r , and having values in

n , i.e, f transforms an element of the group into an element of

n .

In the case of DSA protocol, the group G r , corresponds to the multiplication group

p , i.e, the operation o is multiplication, and p is the prime number introduced hereinbelow, and the function f is such that f(x)=x mod n.

In the case of ECDSA protocol, the group G r , corresponds to all the points of the elliptic curve provided with addition, i.e, the operation o is the addition. In this case the function f is a function which at a point x of the curve associates its abscissa modulo n.

So in the case of execution according to DSA or ECDSA protocol, the computer 6 of the hardware security module 4 can respectively compute, during a computation step of integer 102 , the intermediate integer r=(g k mod p) mod n or more simply r=g k mod n since g k is computed in the multiplication group Z p or else a point of the elliptic curve by computing k*g (multiplication of the point g of the elliptic curve by the scalar k), then the intermediate integer r corresponding to the abscissa of this point modulo n.

A signature token is then computed offline, i.e, well before the computer 6 of the hardware security module 4 knowing the message m during a computation step of signature token 103 and stored in the storage device 8 during a storage step of signature token 104 . Such a token can be the result of encryption by means of the homomorphic encryption function φ. Such a signature token is stored securely and enables later online generation of the signature of the message m intended to be validated by the verifier server by means of the public key y. Delegation of these computation steps to the hardware security module during a previous offline step noticeably reduces the cost of generating a signature for the client device, and therefore computes a signature for a particular message much faster.

The steps for generating random 101 , computation of point 102 and computation of signature token 103 can be repeated so as to generate in advance and store a multitude of encrypted tokens, ready for use for computing a signature.

The signature token stored is then transmitted if needed to the device to which the client device delegates generation of the signature for the message m, i.e, to the intermediate server 7 or the hardware security module 4

The client device 2 sends to the intermediate server 7 or the hardware security module 4 the result φ(d) of encryption by said homomorphic encryption function φ of the stored private key d. The client device can also transmit the result φ(z) of encryption by said homomorphic encryption function φ of an element z function of the message m.

The element z function of the message m used for computation of the signature can be the result of the application of a hashing function to the message m such as SHA-2, especially so as to obtain for the signature a message datum z of selected fixed size, irrespective of the length of the message m.

Alternatively, the client device can transmit the message m directly. The intermediate server or the hardware security module can compute from the latter the element z and the ciphertext φ(z).

Alternatively, the client device cannot hold the message m. The intermediate server or the hardware security module can obtain by itself the message m from an external entity and compute from the latter the element z and the ciphertext φ(z).

The intermediate server 7 or the hardware security module 4 generates during a step for generating signature 105 said signature (r,s) of said message m encrypted by means of said homomorphic encryption function (φ(r),φ(s)) from the result φ(d) of the encryption by said homomorphic encryption function of the private key d stored by the client device, of the signature token (φ(r), φ(1/k)) and of the result φ(z) of encryption by said homomorphic encryption function φ of the element z function of the received message m.

The element s is an element of

n and is conventionally expressed:

s

=

(

1

k

)

·

(

z

+

d

·

r

)

⁢

mod

⁢

⁢

n

In a first embodiment, this signature token can comprise a first part of signature token. Such a first part of signature token noted φ(r) can be generated by encrypting the computed intermediate integer (r) by means of said homomorphic encryption function φ. It can also comprise a second part of signature token φ(1/k) generated by encrypting the inverse of the random 1/k by means of said homomorphic encryption function φ.

In this embodiment, the signature of the message m encrypted by means of said homomorphic encryption function can comprise a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k)*(z+d.r)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r) with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the computed intermediate integer and φ the homomorphic encryption function.

By way of the homomorphic property of the function φ, the first part of encrypted signature φ(s) can be computed from the encrypted token φ(1/k),φ(r), of the encrypted private key φ(d) and of the encrypted message φ(z) without having to decrypt any of these elements.

In a second embodiment, the signature token further comprises the result φ(r.1/k) of the encryption by said homomorphic encryption function of the product of the computed intermediate integer with the inverse of the random 1/k. During the step for generating signature 105 the first part of encrypted signature φ(s) can therefore be generated by means of the formula:

φ( s )=φ((1/ k ). z+d .( r. 1/ k ))

The only homomorphic operations on the multiplication to be computed are computation of φ((1/k).z) from φ(1/k) and φ(z) and computation of φ(d.(r.1/k)) from φ(d) and φ(r.1/k). The computation of the signature therefore needs homomorphic multiplications of the order 1 only and is lighter than in the preceding embodiment wherein it is necessary to compute a first multiplication of the order 1, for example φ(d.r) from φ(d) and φ(r), then multiplication of second order, for example φ(1/k.d.r) from φ(1/k) and of the result of the computation of φ(d.r).

In the two embodiments, the signature is obtained in encrypted form φ(r), φ(s). It can be transmitted to the client device 2 and/or to the hardware security module 4 and stored by the latter in encrypted form. Alternatively the signature can be decrypted prior to storage, provided the device performing this decryption knows the private key of the homomorphic encryption skci for decrypting the encrypted elements.

In the event of storage in encrypted form, the signature can be decrypted during its verification only, for example prior to its transmission to the verifier server. In the case of execution according to the DSA or ECDSA algorithm, such verification can be conducted by the verifier server as per the standard DSA or EDCSA algorithm of the state of the art.

In all the embodiments, once the token is generated, the elements having contributed to its generation (k, 1/k, g k , r, r.1/k) can be deleted to limit risk of hacking. For security reasons the token generated can also be used only once for generating a signature.

The computations constituting the heaviest steps of the computation of a signature can be made offline in advance, without endangering the security of the signature mechanism by way of encryption of the token. The use of a homomorphic function limits the cost of computation of a signature by a client device by delegating computations in encrypted form.

Claims ( 11 )

The invention claimed is:

1. A method for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), the signature protocol implemented for generating the signature comprising public parameters (Gr, n, g) such that g is an element of the group Gr of the order n with n a prime integer,

a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y), said method being characterized in that it comprises steps of:

offline beforehand computation ( 103 ) by a hardware security module ( 4 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) and a second part of signature token φ(1/k), wherein k is a random integer comprised between 1 and n−1, and r is an intermediate integer defined by r=f(g k ) where f is a function having values in

n , and the first part of signature token φ(r) is generated by encrypting the intermediate integer r by means of a homomorphic encryption function (φ) and the second part of signature token φ(1/k) is generated by encrypting the inverse of the random 1/k by means of a homomorphic encryption function (φ),

storage ( 104 ) of said signature token (φ(r), φ(1/k));

generation ( 105 ) of said signature (r,s) of said message (m) encrypted by means of a homomorphic encryption function (φ(r), φ(s)) from the result (φ(d)) of the encryption by a homomorphic encryption function of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m), said signature being intended to be validated by said verifier server ( 3 ) by means of said public key (y).

2. The method for generating a signature according to claim 1 , wherein said hardware security module also previously offline implements steps of:

generation ( 101 ) of the random k as integer belonging to [1;n−1]; and

computation ( 102 ) of the intermediate integer r.

3. The method for generating a signature according to claim 1 wherein the signature protocol is the ECDSA protocol, the group Gr is the group comprising all the points of an elliptic curve provided with addition, the public key y and the private key d verify y=d*g, g being a point of the elliptic curve of the order n, the function f associates with a point of the elliptic curve the abscissa modulo n of said point, and the intermediate integer r is the abscissa of the point of the elliptic curve k*g modulo n.

4. The method for generating a signature according to claim 1 , wherein the signature protocol is the DSA protocol, the group G r is the set

p provided with multiplication, where p is a prime integer number such that (p−1) is a multiple of n, the public key y and the private key d such that 0&lt;d&lt;n verify y=g d mod p, g=h ((p-1)/n) mod p with h a random integer verifying 1&lt;h&lt;p−1 and g different to 1, the function f is defined by f(x)=x mod n, and the intermediate integer r is r=(g k mod p) mod n.

5. The method for generating a signature according to claim 1 , wherein the signature of the message m encrypted by means of said homomorphic encryption function comprises a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k)*(z+d.r)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r), with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the intermediate integer and φ the homomorphic encryption function.

6. The method for generating a signature according to claim 1 , wherein the signature token further comprises the result φ(r.1/k) of the encryption by said homomorphic encryption function of the product of the intermediate integer r with the inverse of the random 1/k.

7. The method for generating a signature according to claim 1 , wherein the signature of the message m encrypted by means of said homomorphic encryption function comprises a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k).z+d.(r.1/k)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r),

with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the intermediate integer, r.1/k the product of the intermediate integer with the inverse of the random and φ the homomorphic encryption function.

8. A method for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y) wherein the public key y and the private key d verify y=d*g, g being a point of an elliptic curve of the order n, a prime integer,

said method being characterized in that it comprises steps implemented previously offline by a hardware security module ( 4 ) of:

generation ( 101 ) of a random k as integer belonging to [1, n−1],

computation ( 102 ) of an intermediate integer r as abscissa of the point of the elliptic curve k*g modulo n;

computation ( 103 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) generated by encrypting the intermediate integer r by means of a homomorphic encryption function (φ), and a second part of signature token φ(1/k), generated by encrypting the inverse of the random 1/k by means of a homomorphic encryption function (φ),

the method further comprising implementing the steps of:

storage ( 104 ) of said signature token (φ(r), φ(1/k));

generation ( 105 ) of said signature (r,s) of said message (m) encrypted by means of a homomorphic encryption function (φ(r), (φ(s)) from the result (φ(d)) of the encryption by a homomorphic encryption function of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m), said signature being intended to be validated by said verifier server ( 3 ) by means of said public key (y).

9. A method for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y), wherein the public key (y) and the private key d such that 0&lt;d&lt;n verify y=g d mod p, n being a prime number, p being a prime number verifying (p−1) is a multiple of n, g=h ((p-1)/n) mod p with h a random integer verifying 1&lt;h&lt;p−1 and g different to 1, said method being characterized in that it comprises steps implemented previously offline by a hardware security module ( 4 ) of:

generation ( 101 ) of a random k as integer belonging to [1, n−1],

computation ( 102 ) of an intermediate integer r=(g k mod p) mod n;

computation ( 103 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) generated by encrypting the intermediate integer r by

CLAIMS

Claims ( 11 )

The invention claimed is:

1. A method for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), the signature protocol implemented for generating the signature comprising public parameters (Gr, n, g) such that g is an element of the group Gr of the order n with n a prime integer,

a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y), said method being characterized in that it comprises steps of:

offline beforehand computation ( 103 ) by a hardware security module ( 4 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) and a second part of signature token φ(1/k), wherein k is a random integer comprised between 1 and n−1, and r is an intermediate integer defined by r=f(g k ) where f is a function having values in

n , and the first part of signature token φ(r) is generated by encrypting the intermediate integer r by means of a homomorphic encryption function (φ) and the second part of signature token φ(1/k) is generated by encrypting the inverse of the random 1/k by means of a homomorphic encryption function (φ),

storage ( 104 ) of said signature token (φ(r), φ(1/k));

generation ( 105 ) of said signature (r,s) of said message (m) encrypted by means of a homomorphic encryption function (φ(r), φ(s)) from the result (φ(d)) of the encryption by a homomorphic encryption function of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m), said signature being intended to be validated by said verifier server ( 3 ) by means of said public key (y).

2. The method for generating a signature according to claim 1 , wherein said hardware security module also previously offline implements steps of:

generation ( 101 ) of the random k as integer belonging to [1;n−1]; and

computation ( 102 ) of the intermediate integer r.

3. The method for generating a signature according to claim 1 wherein the signature protocol is the ECDSA protocol, the group Gr is the group comprising all the points of an elliptic curve provided with addition, the public key y and the private key d verify y=d*g, g being a point of the elliptic curve of the order n, the function f associates with a point of the elliptic curve the abscissa modulo n of said point, and the intermediate integer r is the abscissa of the point of the elliptic curve k*g modulo n.

4. The method for generating a signature according to claim 1 , wherein the signature protocol is the DSA protocol, the group G r is the set

p provided with multiplication, where p is a prime integer number such that (p−1) is a multiple of n, the public key y and the private key d such that 0&lt;d&lt;n verify y=g d mod p, g=h ((p-1)/n) mod p with h a random integer verifying 1&lt;h&lt;p−1 and g different to 1, the function f is defined by f(x)=x mod n, and the intermediate integer r is r=(g k mod p) mod n.

5. The method for generating a signature according to claim 1 , wherein the signature of the message m encrypted by means of said homomorphic encryption function comprises a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k)*(z+d.r)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r), with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the intermediate integer and φ the homomorphic encryption function.

6. The method for generating a signature according to claim 1 , wherein the signature token further comprises the result φ(r.1/k) of the encryption by said homomorphic encryption function of the product of the intermediate integer r with the inverse of the random 1/k.

7. The method for generating a signature according to claim 1 , wherein the signature of the message m encrypted by means of said homomorphic encryption function comprises a first part of signature encrypted by means of said homomorphic encryption function and generated by means of the formula: φ(s)=φ((1/k).z+d.(r.1/k)) and a second part of signature encrypted by means of said homomorphic encryption function equal to φ(r),

with 1/k the inverse of the random, z function of the message m, d the private key stored by the client device, r the intermediate integer, r.1/k the product of the intermediate integer with the inverse of the random and φ the homomorphic encryption function.

8. A method for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y) wherein the public key y and the private key d verify y=d*g, g being a point of an elliptic curve of the order n, a prime integer,

said method being characterized in that it comprises steps implemented previously offline by a hardware security module ( 4 ) of:

generation ( 101 ) of a random k as integer belonging to [1, n−1],

computation ( 102 ) of an intermediate integer r as abscissa of the point of the elliptic curve k*g modulo n;

computation ( 103 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) generated by encrypting the intermediate integer r by means of a homomorphic encryption function (φ), and a second part of signature token φ(1/k), generated by encrypting the inverse of the random 1/k by means of a homomorphic encryption function (φ),

the method further comprising implementing the steps of:

storage ( 104 ) of said signature token (φ(r), φ(1/k));

generation ( 105 ) of said signature (r,s) of said message (m) encrypted by means of a homomorphic encryption function (φ(r), (φ(s)) from the result (φ(d)) of the encryption by a homomorphic encryption function of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m), said signature being intended to be validated by said verifier server ( 3 ) by means of said public key (y).

9. A method for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y), wherein the public key (y) and the private key d such that 0&lt;d&lt;n verify y=g d mod p, n being a prime number, p being a prime number verifying (p−1) is a multiple of n, g=h ((p-1)/n) mod p with h a random integer verifying 1&lt;h&lt;p−1 and g different to 1, said method being characterized in that it comprises steps implemented previously offline by a hardware security module ( 4 ) of:

generation ( 101 ) of a random k as integer belonging to [1, n−1],

computation ( 102 ) of an intermediate integer r=(g k mod p) mod n;

computation ( 103 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) generated by encrypting the intermediate integer r by means of a homomorphic encryption function (φ), and a second part of signature token φ(1/k), generated by encrypting the inverse of the random 1/k by means of a homomorphic encryption function (φ),

the method further comprising implementing the steps of:

storage ( 104 ) of said signature token (φ(r), φ(1/k));

generation ( 105 ) of said signature (r,s) of said message (m) encrypted by means of a homomorphic encryption function (φ(r), (φ(s)) from the result (φ(d)) of the encryption by a homomorphic encryption function of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m), said signature being intended to be validated by said verifier server ( 3 ) by means of said public key (y).

10. A non-transitory computer-readable medium storing program code instructions, wherein the program code instructions cause a computer to execute a method for generating a signature of a message, the method comprising steps of:

offline beforehand computation ( 103 ) of a signature token (φ(r), φ(1/k)) comprising a first part of signature token φ(r) and a second part of signature token φ(1/k), wherein k is a random integer comprised between 1 and n−1, and r is an intermediate integer defined by r=f(g k ) where f is a function having values in

n , and the first part of signature token φ(r) is generated by encrypting the intermediate integer r by means of a homomorphic encryption function (φ) and the second part of signature token φ(1/k) is generated by encrypting the inverse of the random 1/k by means of a homomorphic encryption function (φ);

storage ( 104 ) of said signature token (φ(r), φ(1/k));

generation ( 105 ) of said signature (r,s) of said message (m) encrypted by means of a homomorphic encryption function (φ(r), φ(s)) from the result (φ(d)) of the encryption by a homomorphic encryption function of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m), said signature being intended to be validated by means of said public key (y).

11. A system ( 1 ) for generating a signature of a message (m) intended to be validated by a verifier server ( 3 ), the signature protocol implemented for generating the signature comprising public parameters (Gr, n, g) such that g is an element of the group Gr of the order n with n a prime integer,

a client device ( 2 ) being configured to hold a private key (d) and a corresponding public key (y), said system comprising:

a hardware security module ( 4 ) configured to compute beforehand, offline, a signature token (φ(r),φ(1/k)) comprising a first part φ(r) of signature token and a second part φ(1/k) of signature token, wherein k is a random integer comprised between 1 and n−1, and r is an intermediate integer defined by r=f(g k ) where f is a function having values in

n , and the first part of signature token φ(r) is generated by encrypting the intermediate integer r by means of said homomorphic encryption function (φ) and the second part of signature token φ(1/k) generated by encrypting the inverse of the random 1/k by means of said homomorphic encryption function (φ),

a storage device ( 8 ) of said signature token (φ(r),φ(1/k)),

an intermediate server ( 7 ) or said hardware security module ( 4 ) configured to generate said signature (r,s) of said message (m) encrypted by means of said homomorphic encryption function (φ(r), φ(s)) from the result (φ(d)) of the encryption by said homomorphic encryption function (φ) of the private key stored by the client device (d), of the signature token (φ(r), φ(1/k)) and of said message (m),

a verifier server ( 3 ) configured to validate said signature by means of said public key (y).

US15/144,636

2015-05-06

2016-05-02

Method for generating a message signature from a signature token encrypted by means of a homomorphic encryption function

Active

2037-01-22

US10326598B2

( en )

Applications Claiming Priority (2)

Application Number

Priority Date

Filing Date

Title

FR1554077

2015-05-06

FR1554077A

FR3035986B1

( en )

2015-05-06

2015-05-06

METHOD FOR GENERATING A MESSAGE SIGNATURE FROM A DIGITAL SIGNATURE TOKEN USING A HOMOMORPHIC ENCRYPTION FUNCTION

Publications (2)

Publication Number

Publication Date

US20160344557A1

US20160344557A1 ( en )

2016-11-24

US10326598B2

true

US10326598B2 ( en )

2019-06-18

Family

ID=53879623

Family Applications (1)

Application Number

Title

Priority Date

Filing Date

US15/144,636

Active

2037-01-22

US10326598B2

( en )

2015-05-06

2016-05-02

Method for generating a message signature from a signature token encrypted by means of a homomorphic encryption function

Country Status (3)

Country

Link

US

( 1 )

US10326598B2

( en )

EP

( 1 )

EP3091689B1

( en )

FR

( 1 )

FR3035986B1

( en )

Cited By (1)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US12113909B2

( en )

2022-04-28

2024-10-08

Nxp B.V.

Method and electronic device for decrypting homomorphically encrypted data

Families Citing this family (36)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US10700870B2

( en )

*

2015-09-22

2020-06-30

Veridify Security Inc.

Signature generation and verification system

US10523440B2

( en )

2015-09-22

2019-12-31

Securerf Corporation

Signature generation and verification system

NL1041549B1

( en )

*

2015-10-28

2017-05-24

Quiver B V

A method, system, server, client and application for sharing digital content between communication devices within an internet network.

US10333715B2

( en )

*

2016-11-14

2019-06-25

International Business Machines Corporation

Providing computation services with privacy

US11507683B2

( en )

2017-01-20

2022-11-22

Enveil, Inc.

Query processing with adaptive risk decisioning

US10972251B2

( en )

2017-01-20

2021-04-06

Enveil, Inc.

Secure web browsing via homomorphic encryption

US11777729B2

( en )

2017-01-20

2023-10-03

Enveil, Inc.

Secure analytics using term generation and homomorphic encryption

US10873568B2

( en )

2017-01-20

2020-12-22

Enveil, Inc.

Secure analytics using homomorphic and injective format-preserving encryption and an encrypted analytics matrix

US11196541B2

( en )

2017-01-20

2021-12-07

Enveil, Inc.

Secure machine learning analytics using homomorphic encryption

US10903976B2

( en )

2017-01-20

2021-01-26

Enveil, Inc.

End-to-end secure operations using a query matrix

US10341098B2

( en )

*

2017-01-24

2019-07-02

Nxp B.V.

Method of generating cryptographic key pairs

SG10201701044SA

( en )

*

2017-02-09

2018-09-27

Huawei Int Pte Ltd

System and method for computing private keys for self certified identity based signature schemes

GB201707168D0

( en )

*

2017-05-05

2017-06-21

Nchain Holdings Ltd

Computer-implemented system and method

US10530585B2

( en )

*

2017-06-07

2020-01-07

Bar-Ilan University

Digital signing by utilizing multiple distinct signing keys, distributed between two parties

CN107911217B

( en )

*

2017-10-30

2021-02-26

陈彦丰

Method and device for cooperatively generating signature based on ECDSA algorithm and data processing system

US11032061B2

( en )

*

2018-04-27

2021-06-08

Microsoft Technology Licensing, Llc

Enabling constant plaintext space in bootstrapping in fully homomorphic encryption

CN110661610B

( en )

*

2018-06-29

2020-11-03

创新先进技术有限公司

Input acquisition method and device of secure multi-party computing protocol

CN109639409B

( en )

*

2018-09-20

2021-05-04

创新先进技术有限公司

Key initialization method, apparatus, electronic device, and computer-readable storage medium

US10902133B2

( en )

2018-10-25

2021-01-26

Enveil, Inc.

Computational operations in enclave computing environments

US10817262B2

( en )

2018-11-08

2020-10-27

Enveil, Inc.

Reduced and pipelined hardware architecture for Montgomery Modular Multiplication

US11108567B2

( en )

*

2019-02-15

2021-08-31

International Business Machines Corporation

Compute digital signature authentication verify instruction

US11075763B2

( en )

*

2019-02-15

2021-07-27

International Business Machines Corporation

Compute digital signature authentication sign with encrypted key instruction

US11184149B2

( en )

*

2019-02-19

2021-11-23

International Business Machines Corporation

Computing range queries over encrypted data

CN109818730B

( en )

*

2019-03-06

2022-09-30

矩阵元技术（深圳）有限公司

Blind signature acquisition method and device and server

US10985904B2

( en )

2019-06-18

2021-04-20

International Business Machines Corporation

Compressible (F)HE with applications to PIR

CN113132315B

( en )

*

2019-12-31

2023-07-11

中国移动通信集团山西有限公司

Online conference authentication method, device, equipment, medium and system

US12099997B1

( en )

2020-01-31

2024-09-24

Steven Mark Hoffberg

Tokenized fungible liabilities

US11601258B2

( en )

2020-10-08

2023-03-07

Enveil, Inc.

Selector derived encryption systems and methods

CN113114451B

( en )

*

2021-03-04

2023-04-07

西安交通大学

Data statistical analysis method and system for enterprise cloud ERP system based on homomorphic encryption

US12598079B2

( en )

2021-09-30

2026-04-07

DFINITY Stiftung

Digital signatures with key-derivation

CN114095214B

( en )

*

2021-10-29

2023-12-12

上海热线信息网络有限公司

Encryption and decryption method, device, equipment and medium based on block chain NFT technology

CN114117392A

( en )

*

2021-11-30

2022-03-01

杭州趣链科技有限公司

Security verification code obtaining method based on paillier encryption

EP4228197B1

( en )

*

2022-02-10

2024-10-23

Seoul National University R &amp; DB Foundation

Key management system for homomorphic encryption operation and method of operating the same

CN114978549B

( en )

*

2022-05-25

2024-03-22

北京天威诚信电子商务服务有限公司

SM2 digital signature generation method and system for signer to control signature making data

CN115865356B

( en )

*

2022-10-25

2024-12-10

北京天威诚信电子商务服务有限公司

A secure and controllable use method and system of ECDSA signature private key

CN119583212B

( en )

*

2025-01-20

2026-03-13

郑州轻工业大学

A lightweight security authentication method and system for online/offline V2G systems

Citations (4)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP0807908A2

( en )

1996-04-16

1997-11-19

Certicom Corp.

Digital signatures on a smartcard

US20130326224A1

( en )

*

2012-05-29

2013-12-05

Robert Bosch Gmbh

System and Method for Message Verification in Broadcast and Multicast Networks

US20160191252A1

( en )

*

2013-08-16

2016-06-30

China Iwncomm Co., Ltd.

Method and device for generating digital signature

US20160269174A1

( en )

*

2015-03-10

2016-09-15

Fujitsu Limited

Cryptographic processing device and cryptographic processing method

2015

2015-05-06

FR

FR1554077A

patent/FR3035986B1/en

not_active

Expired - Fee Related

2016

2016-05-02

US

US15/144,636

patent/US10326598B2/en

active

Active

2016-05-04

EP

EP16168407.1A

patent/EP3091689B1/en

active

Active

Patent Citations (4)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP0807908A2

( en )

1996-04-16

1997-11-19

Certicom Corp.

Digital signatures on a smartcard

US20130326224A1

( en )

*

2012-05-29

2013-12-05

Robert Bosch Gmbh

System and Method for Message Verification in Broadcast and Multicast Networks

US20160191252A1

( en )

*

2013-08-16

2016-06-30

China Iwncomm Co., Ltd.

Method and device for generating digital signature

US20160269174A1

( en )

*

2015-03-10

2016-09-15

Fujitsu Limited

Cryptographic processing device and cryptographic processing method

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party

Title

Gennaro et al. " Non-Interactive Verifiable Computing: Outsourcing Computation to Untrusted Workers. " CRYPTO 2010, LNCS 6223 (2010). pp. 465-482. 18 pages.

Hankerson et al. " Guide to Elliptic Curve Cryptography. " Springer-Verlag New York, Inc. (2004). pp. 1-332. 332 pages.

Paillier. " Public-Key Cryptosystems Based on Composite Degree Residuosity Classes. " EUROCRYPT '99, LNCS 1592 (1999). pp. 223-238. 16 pages.

Cited By (1)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US12113909B2

( en )

2022-04-28

2024-10-08

Nxp B.V.

Method and electronic device for decrypting homomorphically encrypted data

Also Published As

Publication number

Publication date

EP3091689A1

( en )

2016-11-09

US20160344557A1

( en )

2016-11-24

EP3091689B1

( en )

2018-03-21

FR3035986A1

( en )

2016-11-11

FR3035986B1

( en )

2018-07-27

Similar Documents

Publication

Publication Date

Title

US20160344557A1

( en )

2016-11-24

Method for generating a message signature from a signature token encrypted by means of a homomorphic encryption function

US20220376894A1

( en )

2022-11-24

Adaptive attack resistant distributed symmetric encryption

US9191214B2

( en )

2015-11-17

Procedure for a multiple digital signature

US8464060B2

( en )

2013-06-11

Method and structure for self-sealed joint proof-of-knowledge and diffie-hellman key-exchange protocols

US20170374033A1

( en )

2017-12-28

Authentication via revocable signatures

CN108667625B

( en )

2021-09-24

Digital signature method of cooperative SM2

EP3462667A1

( en )

2019-04-03

Blockchain based joint blind key escrow

CN108667626A

( en )

2018-10-16

A Secure Two-Party Collaborative SM2 Signature Method

US9800418B2

( en )

2017-10-24

Signature protocol

US20040139029A1

( en )

2004-07-15

Apparatus and method for generating and verifying ID-based blind signature by using bilinear parings

WO1998007253A1

( en )

1998-02-19

Accelerating public-key cryptography by precomputing randomly generated pairs

EP2792098B1

( en )

2015-12-09

Group encryption methods and devices

US20090171878A1

( en )

2009-07-02

Provable data integrity verifying method, apparatuses and system

WO2006024042A2

( en )

2006-03-02

Provisional signature schemes

Chia et al.

2021

Digital signature schemes with strong existential unforgeability

US20150006900A1

( en )

2015-01-01

Signature protocol

CN103997409A

( en )

2014-08-20

Encryption device and method for generating and verifying linear homomorphic structure-preserving signature

Saho et al.

2019

Securing document by digital signature through RSA and elliptic curve cryptosystems

Wang et al.

2022

Dpp: Data privacy-preserving for cloud computing based on homomorphic encryption

Heninger

2022

RSA, DH, and DSA in the Wild.

Chande et al.

2016

An improvement of a elliptic curve digital signature algorithm

CN111092720A

( en )

2020-05-01

Certificate-based encryption method capable of resisting leakage of master key and decryption key

EP1025674A1

( en )

2000-08-09

Signature verification for elgamal schemes

Meshram et al.

2016

An UF-IBSS-CMA protected online/offline identity-based short signature technique using PDL

Wu et al.

2012

A publicly verifiable PCAE scheme for confidential applications with proxy delegation

Legal Events

Date

Code

Title

Description

2016-08-08

AS

Assignment

Owner name : MORPHO, FRANCE

Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHABANNE, HERVE;MOREL, CONSTANCE;CLEMOT, OLIVIER;AND OTHERS;SIGNING DATES FROM 20160610 TO 20160626;REEL/FRAME:039373/0553

2018-08-30

AS

Assignment

Owner name : IDEMIA IDENTITY &amp; SECURITY, FRANCE

Free format text : CHANGE OF NAME;ASSIGNOR:SAFRAN IDENTITY &amp; SECURITY;REEL/FRAME:047529/0948

Effective date : 20171002

2019-01-09

AS

Assignment

Owner name : SAFRAN IDENTITY &amp; SECURITY, FRANCE

Free format text : CHANGE OF NAME;ASSIGNOR:MORPHO;REEL/FRAME:048039/0605

Effective date : 20160613

2019-02-04

STPP

Information on status: patent application and granting procedure in general

Free format text : NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

2019-05-29

STCF

Information on status: patent grant

Free format text : PATENTED CASE

2020-05-01

AS

Assignment

Owner name : IDEMIA IDENTITY &amp; SECURITY FRANCE, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE CORRECT THE ASSIGNEE NAME PREVIOUSLY RECORDED AT REEL: 047529 FRAME: 0949. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:SAFRAN IDENTITY &amp; SECURITY;REEL/FRAME:052551/0082

Effective date : 20171002

2020-10-29

AS

Assignment

Owner name : IDEMIA IDENTITY &amp; SECURITY FRANCE, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE THE RECEIVING PARTY DATA PREVIOUSLY RECORDED ON REEL 047529 FRAME 0948. ASSIGNOR(S) HEREBY CONFIRMS THE CHANGE OF NAME;ASSIGNOR:SAFRAN IDENTITY AND SECURITY;REEL/FRAME:055108/0009

Effective date : 20171002

2021-02-17

AS

Assignment

Owner name : IDEMIA IDENTITY &amp; SECURITY FRANCE, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE APPLICATION NUMBER PREVIOUSLY RECORDED AT REEL: 055108 FRAME: 0009. ASSIGNOR(S) HEREBY CONFIRMS THE CHANGE OF NAME;ASSIGNOR:SAFRAN IDENTITY AND SECURITY;REEL/FRAME:055314/0930

Effective date : 20171002

2022-11-17

MAFP

Maintenance fee payment

Free format text : PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment : 4

2024-01-17

AS

Assignment

Owner name : IDEMIA IDENTITY &amp; SECURITY FRANCE, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE THE REMOVE PROPERTY NUMBER 15001534 PREVIOUSLY RECORDED AT REEL: 055314 FRAME: 0930. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:SAFRAN IDENTITY &amp; SECURITY;REEL/FRAME:066629/0638

Effective date : 20171002

Owner name : IDEMIA IDENTITY &amp; SECURITY, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE ERRONEOUSLY NAMED PROPERTIES 14/366,087 AND 15/001,534 PREVIOUSLY RECORDED ON REEL 047529 FRAME 0948. ASSIGNOR(S) HEREBY CONFIRMS THE CHANGE OF NAME;ASSIGNOR:SAFRAN IDENTITY &amp; SECURITY;REEL/FRAME:066343/0232

Effective date : 20171002

Owner name : SAFRAN IDENTITY &amp; SECURITY, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE ERRONEOUSLY NAMED PROPERTIES 14/366,087 AND 15/001,534 PREVIOUSLY RECORDED ON REEL 048039 FRAME 0605. ASSIGNOR(S) HEREBY CONFIRMS THE CHANGE OF NAME;ASSIGNOR:MORPHO;REEL/FRAME:066343/0143

Effective date : 20160613

Owner name : IDEMIA IDENTITY &amp; SECURITY FRANCE, FRANCE

Free format text : CORRECTIVE ASSIGNMENT TO CORRECT THE REMOVE ERRONEOUSLY NAME PROPERTIES/APPLICATION NUMBERS PREVIOUSLY RECORDED AT REEL: 055108 FRAME: 0009. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:SAFRAN IDENTITY &amp; SECURITY;REEL/FRAME:066365/0151

Effective date : 20171002

2025-07-14

AS

Assignment

Owner name : IDEMIA PUBLIC SECURITY FRANCE, FRANCE

Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:IDEMIA IDENTITY &amp; SECURITY FRANCE;REEL/FRAME:071930/0625

Effective date : 20241231

Related documents

• Generating augmented reality experiences utilizing physical objects to … — Meta Platforms Technologies, Llc (US20260037214A1)#653960
• Virtual reality system using multiple force arrays for a solver — DeepMotion, Inc. (US10657696B2)#653961
• Tracking position of device inside-out for virtual reality interactivity — Sony Interactive Entertainment America Llc (US10535153B2)#653962
• Augmented reality system with spatialized audio tied to user manipulated … — Magic Leap, Inc. (US11231770B2)#653963
• Big data-based autonomous flight drone system and autonomous flight method … — Rgblab Co., Ltd. (US20210390867A1)#653964