CA2111572C - Digital signature algorithm - Google Patents

Abstract

A method is provided for generating and verifying a digital signature of a message m. This method requires a pair of corresponding public and secret keys (y and x) for each signer, as well as a pair of public and secret values (r and k) generated for each message by the signer. The public value r is calculated according to the rule r = (g k mod p) mod q. A value s is then selected according to the rule s = k-1(H(m) + xr) mod q where H is a known conventional hashing function. The message m, along with the signature (r, s) is then transmitted. When the transmitted signal is received a verification process is provided. The received values of r and s are tested to determine whether they are congruent to 0 mod q. Additionnally, r is tested to determine whether it is equal to v mod q, where v is computed from r, s, m and y. For legitimately executed signatures, v = g k mod p.

Description

- WO 93/035~2 PCI~US92/06184 DIGITA~ 8IGNATURE ALGORIT~M

r~k~JrOuna of the Invention ~ :
1~ Field of the Invention.

~ The field of;this invention is data integrity, ; :~and in particular~ geDerating and verifying a digital signature for a message or data file.~:

2-) ~ Back~o~ Art.: :

When a~message is~ transmitted from one party to ~:
another,~ the~receiving party~may desire to determine whether:the~me~A~e:has~been~altered:in:transit. Further-:more, the receiv~ng~party~may wish~to be certain of theorigin of~the message:. It is known ~in the prior art to provide both of these~functions using digital signaturé
algorithms. Several~known~digital signature algorithms are available~or~verifying the integrity of a me~sage.
These known digital:~signature algorithms-may also be used to prove to a third: party that the message was signed by : :~:: : :
~he actual originator. ~
:

:SUBSlTll~rE SltEET

W093/03562 PCT/USg2/06184 21115'7~ 2 The use of public key cryptography to achieve instantiations of these digital signature algorithms is also known in the art. For example, Diffie and Hellman teach using public key cryptography to derive a digital signature algorithm in "New Directions in Cryptography,"
IEEE Transactions on Information Theory, Vol. IT-22 pp. 472-492, 1976. See also U.S. Patent No. 4,200,770.
Since then, several attempts have been made to find practical public key signature~techniques which depend on the difficulty of solving certain mathematical problems to make message alteration or forgery by unauthorized parties difficult. For example,~the Rivest-Shamir-Adleman system d~r~n~ on the difficulty of:factoring large integers.

:
Seé~R. Rivest, A. Shamir,~and L. Adléman, "A Method ~or Obt~ini~g Digital~Signatures and~Public Key Crypto-systems,"~Com~unications~of~the~ACM,:~Feb. 1978, Vol. 21, No.~2~,'pp.~ l2:0-l26~ and~U.S.~:Patent~No. 4,405,829.

Taher~ElGamal~teaches:~a~signature scheme in "A
Pub}ic Key Cryptosystem~and~a~SignatUre Scheme R~ on Discretè~ Logarithms"~ in~IEEE Transactions on~Information Theory,~ Vol. IT-31,~No. 4,~July 198S. It is believed that this:system relies on~the difficulty~of~computing discrete logarithms:over finite~fields.~In;the system taught by ElGamal:m:denotes~a~document~to be~signed, where O < m S p-l where ~ p ~ is ~ a~large prime and ~ is a primitive SUBSTITUTE SHEET

W093~03562 PCT/US92/06184 3 ~ 2 element mod p, both known. In any of the cryptographic systems h~s~ on discrete logarithms, p must be chosen such that p-1 has at least one large prime factor. If p-1 has only small prime factors, then computing the discrete logarithms is easy. The public file consists of a public key y - ax mod p for each user~where each user has a secret x, a large prime p, and a primitive element a. To sign a document, user A uses a secret key x~ to find a ,. ~
signature for m in such a~way~that all users can verify the authenticity of the~signature by using the public key ~: YA together with a and p~, and no one can forge a signature without knowing the secret x~.~

The signature~ for mt is~the pair (r,s), 0 S r,s ; < p-l, chosen such that ~
o~ yrr~mod p ~ Equation (1) -is satisfi d . ~

In;many~appllcàtions~it is convenient or neces-sary~ to sign~the message~on~ ine. ~However,~the Rivest-~Shamir-Adle~an~system~is~expensive to sign on-line. The sy~stem of~ElGamal,~however,~ allows~much of the computation to~be done~prior to going on-line since use is made o~
values~which are not~dependent upon message m. Thus, on-~ ~: SUB~ JTE SHEET

W093~03562 PCT/US92/06184 2 '~ 7 2 line signature generation is very simple in the system ofElGamal The signing procedure in the method taught by ElGamal includes three steps In the first step, a random number k is chosen such that k is uniformly between 0 and p-l, and gcd(k,p~ 1 Next, r is determined by the relationship ~r ~ ak mod p Equation (2) . ~
~; ~ In ~iew of Equation (2~, the~relationship which must be satisfied for determining the signature for message m, as set forth in Equation (~ may~be~written as : ~ :
o~ =~o~ od p ~ Equation (3) Equation (~3) may be~solved ~or J~by =sing m S~xr +~ks mod(p -~1) Equation (4) Equation~4) has~a solution~ for s;provided k is chosen such that;gcd(k, p~

In the method;~taught by ElGamal it is easy to verify~the~authenticity~of~the signature (r,sJ by comput-ing~both~sides of~Egu~tion ~ and determining that they are~equal ;The c-~ocen~value~of k should never be used ;more than once This~can~be guaranteed, for example, by :
'SUBSmUTE SHEET

S 21~1572 using a Data Encryption StA~Ard chip in the counter mode as a stream cipher to generate values of k.

It is possible to attempt two types of attacks on the signature scheme of ElGamal. The first type of attack includes attacks designed~to recover the secret key x. m e second type of~attack includes attacks designed to forge signatures without recoverinq x. Some of these attempted attacks are easily shown to ~e equivalent to computing discrete logarithms over GF(p).

In the first type~of attack attempt an intruder may try~to solve t equations of;the~form of Equation (4) when given lm~ :1, 2, ..:~.~, tl;~docuDents, together with the corresponding~signa~u~e~~(ri,s1): i = 1, 2, ..., t~.

However, there are;t ~l unknowns in this system of equa-tions since~each~signàture~uses a different value of k.
Thus, this~system~of~equations is~underdetermined and the number~:of soIutions.is~larg~e.~The~reason is that each value of x~yields a~solution~for~the~kf since a system of linear equations with~a:~diagonal matrix o~ coefficients results. Since p-l:is:chosen to have at least one large prime factor q, potential Le_u~ery o~x mod g would re-quire an eYronential'~number~of message-signature pairs.

If any value of k~ is~uséd twice in the signing, then the system of equations:is~uniquely~determined and x may be SUBS I I ~ UTE SHEEl WOg3/0356~ PCT/US92/oC184 2 1 1~ '7 2 recoverable. Thus, for the system o~ ElGamal to be se-cure, no value of k should be used more than once, as previously described.

In another attack attempt of this first type an intruder may try to solve equations o~ the form of Equa-tion (3). This is always eguivalent to computing discrete logarithms over GF(p), since both unknowns x and k appear in the exponent. ;In still another attack of this type an intruder may attempt to develop~some linear dependencies among the unknowns { ki = 1, 2, ..., t }. ~Thi~s is also equivalent to computing discrate logarithms~since i$ kf e~Ck~ mod ~p-1), then rl ;~ r~c mod p, ~ and~if c~can~be computed then computing discrete logarithms~is~easy.

In the~second~type~of~attack attempt, trying to forge;~signatures~without~knowledge o~f x, a ~orger may try~
to~ find~ r ~and s~ such~that;~Equation~(l) is satisfied for a rl~ment~m.~ If~r~ ai~mod~p~is fixed~for some ~ chosen at ;random, then computing;s is equivalent to solvin~ a dis-crete logaritkm problem over GF~p). ~

If the ~forger~fixes s first, then r may be computed as follows~

.
:: ::
: ~ ~

r~l Inc~T~Tl tTC ~UC~T

2ill~72 r 8y r - A mod p Equation (5) ..

Solving Equation (5) for r may not be as hard as computing discrete logarithms. However, it is believed that solving Equation (5) in polynomial time is not feasible. In another possible attack of the second type, a forger may try to solve Equation (l) for both r and s simultaneously.
However, it is believed:that an efficient algorithm for doing so is not known.~

: The signature~scheme of:ElGamal also permits an ~attack:attempt wherein~the~intruder,~knowing one legiti-mate signature ~(r~s)~for:one~message m~ may generate other legitimate signatures~(r,sJ~ and~messages m. However, this sttack~attempt,~aLthough~imple ntable,~does not allow the intruder to~sign~an~rbitrary~message~m and therefore does not~;break:the~system.;~ This :l~imited:ability to create ac~ able~message-si~nature~pairs can~be avoided by reguiring~;m~to~haYe~a~ certain;~structure.~ Alternatively this can be~avoided~ ffl~applying~a~one-'way function H to message'm~ before~s~ ng.~it.~ This~causes a~::potential forger to be unable to~determine:a value of m which cor-to the~(m)~ which~:was~.signed using the method shown bel~w.~ The~forger~must~;;be~ab~le:tQ transmit such an m~to;~the~verifier,~ if:~:~the~forgery;is to be considered suc~c~ful.

; SUBS ~ JTE SHEET

W093/03562 PCT/US92/061~

2111~72 8 Given a signature ~r,s) for the legitimately signed message m, then aJ ~ yrr g mod p.

Integers A, B, and C are selected by the forger arbi-trarily such that (Ar - Cs) is relatively prime to p - 1.
The values of r', s', m' are selected such that :

r = ~AaByC mod p, s' = sr';/(Ar-Cs) mod(p - 1), m' = r'(Am ~ ~Bs) /(Ar - Csjmod(p - 1) .

~Then it is claimed~that ~(r'~,s') signs;the message m': The : verification equation~will be~satisf~ied, since yr'r~ e ~yr'~ (r~AaB~y~9 g~ C

( y r ~ -~ ~cs ~ ~cg~ a~ ~a Bs~ C

( (yrr ~ aBsr~ c8) ~ ~ Bs~ Cs):

~ wherein~all~calculations~are~performed;~mod p.

..
,. ~ .

As~:a~e~ case,~setting A = 0, verifiable signaLu~s~(r',s')~ may~be~generated with corresron~in~
ssages~m' with ue~ ~-t~ eo a~ny signature:

:~

:
~: :
SUBSmUrE SHEET
:

9 ~ 1 1 1'3'~~ 2 = a8yCmod p, s' = -r'/C mod (p-l ), m' = -r'B/C mod (p-l ) .
Thus it will be understood by those skilled in the art that applying a one-way function H to message m, prior to signing, thwarts the general and special-case attack .
attempts. It will also be understood ~hat function ~ may be used to form a digest of long messages so that the signature function does not have to be iteratively applied to segments of the full message m. This results in fur-ther efficiency.

U.S. Patent No. 4,995,082, issued to Schnorr, ~n : : February l9, l99l, entitled "Method for Identifying Sub-scribers:and for:Generating and ~erifying Electronic Signatures in a Data Exchange~System,i' provides a system wherein co~munication~and:verifiaation is more efficient relative to ElGamal~.~ Additionally,~tb~ system of Schnorr maintains the extremely efficient on-line signing capabil-ity.~ However, some~of~'the desirable~features of ElGamal, as~w~ as the extensive~body~of~ëxpérience and literature a~sociated with the ElGamal model, are not applicable to the:~Schnorr:model.~

: Thus, it~is~desirable to provide a system having efficiencies~of~on-line~signing,:;communication, and ver-ificat~ion which are comparable to the~system of Schnorr :

' ~ ' SUBs~ TEsHE~T

;' W093/03562 Pcr/us92/~

while still ~aintaining compatibility with the ElGamal model and its analytical tools ~n particular, it is desirable to retain the complexity of the ElGamal ~igna-ture equation which enables secure use of the straight-forward expression N(mJ, rather than simplifying the signature equation at the expense of replacing H(m) by Schnorr's H(~k mod p,m), 8nMNARY OF~T~E l~.V~ ON

A method~is provided for generating and verify-ing a digital signature of~a~message m This method requ~ires a pair;;of~ corresponding public and secret keys (y and x) for~each signer, as well~as a pair of public and seCret values (r and~ :k~): generated for;each message by the sign-r The publlC ~alue~r~is~calculated according to the rule r~ g~mod p)~ mod~ A ~va:lue s ~is then selected according~to the rule s~ k~~tn~+~;xr) mod~q where ~ is a~known~conventional~'h~shi~ function The~message m, along~with the s ~ (r,s~)~is~th n tr~ne~itted When the transmitted signal~is~received a verification process is proYided~ The~recelved~values of r and s are tested to determine~whether~ ey~are congruent to ~ mod q Addi-tionally, r is tésted~to~determine whether it is egual to mod g, where v~is~compùtéd~from~r, s, m and y For legitimately executed~signatures, v = gk mod p.

SUBSTITUTE SHEET

W093/03S62 PCT/US92/061~

ll 2111S72 BRIEF DESCRIPTION OF THE DR~WINGS

Figs. 1, 2 show the digital signature algorithm of the present invention, Fîg. 3 shows a h~ching algorithm suitable for use within the digital signature algorithm of Pigs. l, 2.

DET~TT~ DESCRIPTION OF ~HE lNV~:N-~ION

Referring now to Figs. 1, 2, there is shown digital signature algorithm 10. In digital signature algorithm 10, the two keys in a pair of private and public keys are used respectively to~generate~and verify digital signatures (r,s), each of which corresponds to a trans-mitted message m. Using digital signature algorithm 10 the holder of a private key~ nay generate a digital signa-ture f or message m where message m may contain any amount of data. ~A holder of the~co~responding~public key may then~receive message m~and verify the signature [r,s). An intruder~who does not~know~the~private~key cannot generate the~signature~(r,s)~;of the holder of~the private key for any ~essage m and therefore signatures (r,s) cannot be forged.- ~An intruder;also~cannot alter any signed message m without invalidating the signature ~(r,s).

If digital~signature algorithm 10 is to be used effectively, a means of associating à public and private .

SUB~ UTE SHEEr WO 93/03562 PCr/US92/06184 2 1 i i - r~ 2 key pair With each signer is required. There mUst be a binding of information identifying the signer with the corresponding public key. In order to insure that each private key or secret key i5 held by the individual whose identity is bound to the correspondîng public key, this bin~in~ must be certified by a mutually trusted third party. For example, a certifying authority may sign credentials containing the public key of a user of digital signature algorithm 10 and the identity of the user to form a certificate. ~ ~

Executîon of~digital signature algorithm 10 of the pl Fent invention begins~at~start~terminal S. A user of digital signature~algorithm~10 first selects a secret value of k as shown in block l5. The selected k is a secret~integer generated~by the signer~for each message m.
The~value of k is chosen~such that O<k~g. The k of digi-'tal signature~algorithm~lO~ y be~generated in a random or ps~llAo-random fashion.~It~will be~understood by those ;skille~in the art~ that~the~pseudo-random generation of integer k may be performëd in any conventional manner~

:~
In block~2~0~of~digital signature algorithm lO a determina~tion is made of~ g-~ mod p.~ It is known în the art ;to~determine the quantlty~of block 20~and~transmit this ~ quantity. However, this~quantity can be quite long.

: :
SU~STITUTE SHE~T

Therefore, in block 25, the quantity of block 20 is re-duced to a one hundred sixty bit image by reducing it mod g as follows r = (g~ mod p) mod ~. Equation (6) In order to generate r as set forth in Equation (6), the value g is determined as follows:
: g = h/p-aJ/q mod p, Equation (7) where h is any non-zero integer mod p such that h (p-lJ/q is not congruent to l~;mod p.~ The value~g may be common to all users of digital~signature algorithm~10. In Equation (63, p~is a~prime:modulus,~where 25ll<p~25l2.~: The prime modulus p may be co ~ n~to~all~users of digital signature ;algorithm lO.~: The~value~q~is a~prime divisor of (p-l), where:~2~59<q<2l60. ~q~may~also~be::co., on to all users of gital~signatore algorithm~10~

erlttion~of~digital~ signature algorithm lO then p ~ to block~3~0~where~the:~quantity k~l mod q.is determinéd~ This~va;lue~will be~useful in the determina-tion of the signature for transmission within the system of'~digital si~-t~re algorithm~lO..~It will be understood y~those~skil~led~in~the:art that all;of the operations performed~within~digitaI signature algorithm 10 up to and including~the computation~of~block:30 are independent of ~essage m. Thus, these;computations may be made off-line, .

2 1 11 3r~2 14 thereby permitting a greatly ~hortened on-line signing pro~e~re. ~

Execution of digital signature algorithm lO then proceeds to block 35 whexein message m is h~Fh~A. This hAshi~g of message~ m performed in~block 35 provides an output of one hundred sixty bits or less, denoted ~y H(m).
Many conventional h~hing algorithms, suitable ~or hashing ; message m as shown in block~35 of algorithm lO, are known in the prior art. Additionally, it will be understood that the message to~which~the~hashing algorithm is applied may be in an unencrypted form.

When r and k~l mod g are determined as set forth in Equations (6) and ~7~ the value~of s for message m may be~determined~ as shown in~block-~40 of digital signature algorieh~;~0~

s=k~l(H(mJ+xr)mod ~q. Equation (8) ~he~so}ution of Eguation~(8~) of block 40 of digital signa-ture~a1gorithm~10~also~re~ults ~in~ a~one hu~-dLed sixty bit integer. The values r~:and. s thus determined respectively in~bIocks~2~5,~40, constitute the signature (r,s) of mes-;sage m. ~They are~transmitted along with message m to the reCipient~as shown~in~block~45. It Will be understood ; ;~ that m may be transmitted in~an unencrypted form. Execu-: ~
~ : : SUBSmUTE SHEET

WOg3/03562 PCT/US92/06184 2 ~ 7 2 ., . . ~ . .

tion of algorithm 10 then proceeds by way of off-page connector 50 Within digital signature algorithm 10, each signer is provided with~a secret key x, where 0 < x < q A secret key x is fixed for all messages m transmitted by an individual user of algorithm lO Additionally, public key y is provided to the user holding the secret key x or secret value x, where y = gx mod p ~ Prior to verifying a signature (r,s), the public key y and the identity of the signer who possesses the corresponding secret key x must ~be available to the~recipient in an~authenticated manner~
where~the ultimate~purpose of~verification is to prove that (r,s) was originally created~by;one who had knowledge of~the~value of x which~corresponds~to th~ particular value of~ y If x~has~not~been compromised, this signer is known to~ be the one ~ ose identity is linked to the par-ticular y~in ~an~authenticated mann-r ~ Additionally, the recipient must;know~the~global values~g, p, and q Execution~of-algorithm~lO then proceeds by way of on-page connector~55~to~start terminal 60 After receiving message~m~as~shown ~in~block~65, along with its ;purported~signature~(r~,s)~ the~recipient within the system ~of the present invention~must~verify both the received r and the received~s~ ~It~will be understood therefore that ~ SUBSTlTUrE SltEET

wo s3~03s62 Pcr/uss2to6ls4 and the received s. It will be understood therefore that within digital signature algorithm 10 the prior art kernel gk mod p is reduced mod q and transmitted. gk mod p is then recovered and verified within algorithm 10. ThUs, using the system of the present invention, the prior art gk mod p may be reconstructed at~ the receiving end rather than transmitted by~the~cend~r~

Therefore, a determination is made at decision diamond 70 of algorithm 10 whether either s or r is con-gruent to 0 mod q. :If~either~:r or s~ is congruent to 0 mod :
then execution:pr~oceeds~to:block l~5 and the received' signature~ ~r,s) is rejeGted~by~dlgital signature algorithm lO. :If r and s are:~not~ol-~L~ent~to 0 mod g, then the recip~ent pro~ee~q~vit~verification~of the received signature (r,:s) as~shown~in ~h~ verification box 75.

Digital~signature~algorithm~10, upon entering ch~ verifi~ation~bloek 75~ rec~overs: gk mod p as shown in~d~ch~A ~ vvery block~80.~ is~ known in the art to recover g:~ mod p after;receiving a transmltted message because many prior~a:rt~methods~transmitted gk modp with-out~any~;reducing prior~to~transmission. Within recovery block 80, the values~of~u~ and~u2~are determined as shown , in block 85. The :values~ of; block 85 are determined as ~ ~:
' ~ Ul = (H(mJ ) (5) -I mod:q, and u2 =~(rJ~sJ~l mod q. Determina-~: : gUBSTlTllTE: SHEE~-W093/03562 PCT/USg2/06184 17 2 ~ 7 ~

tion of the values ul and u2 permits a determination of gk mod p from u1, u2, and y as set forth in Equation t9).
This determination is shown in block 90. It will be understood by those ski:lled in the art that it is not known at this point whether the quantity recovered in blocX 90 is a legitimate g~k mod p. .However, ~Yec~tion of digital signature algorithm 10 proceeds on the assumption th'at it is legitimate and checks this assumption.

V~= ~(g)Ul(y)4 ~ d p ~ (gN(~)(yr))~S~'~mod p = (gff(m)~x~)*~N(mi~xr) mod p ~ = gk~mod~p].~ Equation (9) .
Within dashed~checking~bloaX 95, the recovered ;quantity yk mod~p~of~;Equation (~9) is checked:by first determining *he;value~of,w:~as shown:in block lO0. The value~of~blocX~lOO~is determined~:as~w:~= v mod g. In ::deoision diamond lOS'~a,~determ;n~tion~is made:as to whether the~Fecèived~value~of::r~is~equal:~to~the:mod~q''r~educed value~of g~mocl p,~where~m,k,r and s satisfy the relation-s~ip~:~set~fo~th in~Eguation:~8),~ for;'the given value of y.
I~~the~determination~of~decision lO5~is~affirmative, execution ~.ieed~;to~verify~:blocX llO:where the signature (r~sJ~received ~in~block~65:is considered verified by : : : ~ ~ :

SUBS I l I UTE :SHEET
:: ~

W093/03562 PCT/US92/061~

j 7 2 18 digital signature algorithm lO. I~ the determination of decision diamond 105 is negative, execution proceeds to reject box 115 where ~he received signature (r~sJ is rejected.

The security of digital signature algorithm 10 is dependent upon maintaining the secrecy of private keys.
Users of digital signature algorithm 10 must therefore guard against the unauthorized disclosure of their private keys. In addition, the hash function H of block 35 used to determine the value :of s must be selected such that it is computationally infeasible to find any message m which has a given hash value.: Likewise, it should be computa-:tionally infeasible to find any pair of distinct messages m which hash to the same value~

Referring now:to Fig. 3, there is shown hashing algorithm 150. A conventional algorithm such as algorithm - : :
150 may be found:, for example, in R~L. Rivest, "The MD4 ~ge~Digest Algorithm,"~Abstracts Crypto '90, pp.. 281-291:. ~As previously~de-cribed~, the~signature and verifica-~tion processes within digital signature algorithm lO

: re~uire a secure hash~algorithm which takes an arbitrary I
length message as~input and o~L~-s a hash value of length one hilnAred sixty bits;or:~less. ~h;~g algorithm lS0 is :: suitable for performing the hashing function of digital signature algorithm 10 as set forth in block 35. It will ~' sussmuTE SHEET

19 2ill~72 ~e understood by those skilled in the art that conven-tional hashing functions other than hashing algorithm 150 may also be used to perform the hashing function of block 35 within digital signature algorithm 10.

Execution of hashing algorithm 150 proceeds from block 30 of digital signature algorithm 10 and begins at start terminal 152. Hashing algorithm 150 then receives as its input a b-bit message m to ~e hashed as shown in block 153 and operates to provide a message digest A, B, C, D as its output. The:number of bits b in the message m received in block 153 is an arbitrary non-negative in-teger. The value of:b may be zero and it need not be a multiple of eight. Furthermore, b may ~e arbitrarily large. The bits of message m ~ay~be described as follows:

mOm~ mb-l The next step of hAQhi~g algorithm 150 is pad-di~g or extending message m~so that its length in bits is : congruent to~4;48, modulo 512~, as~shown in dashed padding block 155. Thus, message~m is extended so that it is just ~sixty-four bits short of~being a multiple of five hundred :twelve bits long. ~Padding of mc~s~ge m must always be performed within hashing algorithm 150, even if the length of message m is already congruent to 448, modulo 512. In the case where the length~of message m is already con-: su8smuT~ SHEET

~''b 2~ 2 20 gruent to 448, modulo 512, five hundred twelve bits ofpadding are A~e~ in dashed padding block 155~

In the padding of message m set forth in padding block 155, a single bit having a value of one is appended to message m as shown in block 160 within padding block 155. Then enough zero bits are appended to message m to c~lls~ the length in bits of padded message m to become ~o~ ent~to 448, modul~o 512~as shown in block 165. The r~Aing operation of padding block 155 is thus invertible :so that different inputs yield different ou~ s. The r~Aing operation of~dashèd padding block 155 would not be ,invertible if it were done only with zeros.

~ c~ltion of;~h~shi;ng algorithm 150 then proceeds to block 170, where a:sixty-four bit representation of b s~appenA~d to the:re~sult~o~f~the appending operations of blocks 160,~165. It~will~be understood that b is the length:of~message~m~before~the~padding:bits are added as set~forth in~bloc;ks~l60,~165.~;This sixty-four bit repre-sentation i6:~rr~nA~ as two,thirty-two bit words, low-,order word first. In the unlikely event that b is greater than 2~', then only~the l~o~ oIder;sixty four bits are rr~n~A in ~l:ock 170.~ At~this stage:in the exec~tion of h~chi~n~ algorithm l50,~the resulting padded message has a ~length that is an exact~multiple of five hundred twelve .

: ~ S'JBSTIJUTESHEET

WOg3/03562 PCT/US92/o61~

21 ~lllj'7~

bits. Equivalently, this padded message has a length that is an exact multiple of sixteen words where each word is understood to be thirty-two bits. Let M ~ u ], O < u < N-l, denote the word~ of the message resulting from processing in block 170, where N is a multiple of sixteen.
:
~ Yer~ltion of~h~hlng algorithm lS0 then proceeds to dashed message digest;block~175 where a four word buffer is used to compute the message digest A, B, C, ~.
Each of the four words::of the message digest A, B, C, D is a thirty-two bit register.~ In block 180 of message digest block 175 these registers are initialized to the hexadeci-mal values shown in~Table I,~low-order bytes first.

: Word;A:: 0l 23~45 67 Word;B~ 8~9~ab cd~ef Word C:~:fe~dc ba 98 Word~D~ ;7~6 54 32 10 :Table I ;

Three~auxiliary functions f~, f2, f3, are then defined~as~shown in~block~l85.~The auxiliary functions :fl,~ f2, f3,~are~set~forth~in~Table II.~ Each auxiliary ;function fl, f2, f3, of:Table II receives as input three thirty-two bit words~X,~Y, Z and~produces as ou~ one thirty-two:bit word~f~(X,Y,8~), f2(X,Y,Z), and f3(X,Y,Z) respectively.:

SUBS I 11 ~ITE S~EET

WO g3/03~62 P~r/USg2/06184 2111~2 22 fi (X, Y, Z~ = XY V ( ~X) Z
f2 ~X, Y, Z) - ~ V XZ V YZ
f3 (X, Y, Z) - X~$) Y~Z
Table II

In each bit position of the input words X, YJ Z
the auxiliary function fl acts as a conditional to imple-ment the condition: if X then ~ else Z. In each bit position the auxiliary function f2 acts as a ~ajority function: if a~ least two of X, Y, Z have a value of one, then f2 has a one in that bit position. The auxiliary function f3 applies the bit-wise:exclusive OR or parity function to each bit position.: If the bits of X, Y, and Z
are independent and unbiased, then each bit of f1(X,Y,Z) , i5 independent and;~unbiased. Similarly the auxiliary functions f2(X,Y,Z) and~f3(X,Y,Z) are independent and : :unbiased if~ tbe bits of~X, Y, and Z are independent and unbiased.

ng algorithm 150 initializes the loop :~
induction variab1e~n~to:zéro in blook 186, and then sets '~he current values of the array X~j] ~or O ~ j < 15 in : ~
~: blo k 187~and~performs~a~set of thre~ rounds of h~h;ng as :
show~ in blocks l90,~195, 197,~where array X~j] is updated and three ro~1n~ of ~Aphin9~ ~are performed a total of N/16 times. In rou1,~s two and three, hA5hing algorithm 150 -:

: SUBSTITUTE SHEET

23 ~ 2 uses constants. The round two constant is the square root of two and the round three constant is the square root of three. The values oP these constants, with high-order digits given first, are set forth in Table III.
Octal Hex Round 2 constant (¦~) 013240474631 5A82799~
Round 3 constant ~ 01S666365641 6E~9EBAl Table III

: Each of the N/16:sets of three rounds begins with execution of the instruction sequence in Table IV as occurs in block 187, where~the valùe of n denotes the set currently being processed.: ;The sets are indexed by 0:to (N/16)~

: Set Xt~j~3~to M~n*16~j]:,~:for j = 0, 1, ..., 15.
Save A as~AA~,;B~:as:~:BB,~C as CC, and D as DD.
Table lV

: When::execution ~of hAchi ng: algorithm 150 prO~ c :~
to~block~l90 and~round~one~of~the: :h~~~h;n~ occurs, tA B C D
t]~::denotes~the operation:A =~(A~ fl(B,C,D) + Xti]) <~<
t.: It~will be~understood:~by those skilled in the art that (A~<<<t)~denotes the~thirty-two~bit~value obtained by çir~ularly~shi~fting~or~ro.tating~A left t bit positions.
The~:operation denoted~above~generically by [A B C D i t]
:oc~L~, sixteen times~during round one, where the values :

:~ :

UBSl l l lJTE SHEET

2111~72 24 assumed consecutively by operands A, B, C, D, i, and t respectively a~e given in Table V.

D A B C l 7 C D A B 2 ll-B C D A 3 l9 tC D A B 6 ll rB C D A:7 I9 A B C D:8 3 : D A B C 9 7 : C D A B:lO:: ll;
B C D:~A ll l9:

D A:B C 13 7 - ~ ~ C:D~A~B~::14 ll .B C~D A~15~ 19~:
Table V
:

When execution~proceeds to block 195, round two of~the~h~ebing algorit ~ ~150 begins.~ In round two tA B C
D i:~t~denotes~the;~operation A =~A + f2(B,C,D) + X~i3 +
5A8279:99~) <~< t. ~The~operation~denoted immediately above by;~[A~B~C D~l t]:o~u.s~sixteen~times during~round two, where~;the values~assume~consecutively~by operands A, B, -D,~ and:~t~r -pectlv ly~are~given in Table~VI.

.

SUBSTITU~E SHEET

W093/03562 PCT/US92/~6184 2~i 2ill~j72 tA B C D 0 3]
~D A B C 4 5 ~B C D A 13 13.

: ~C D A B 11 9 ~able VI

.
When execution~proceeds to block 197, round ~three o~ the:h~ g algorithm 150 be~ins. In round three ~A B C D i t] denotes:~the operation A - (A + f3(B,C~D) +
X[i3 + 6ED9EBAl) <<< t. ;The operation denoted i~mediately above by ~[A B:C~D~i t];occurs sixteen~times during round : three, where~thé values~ assumed consecuti~ely by operands A, B,; C,~ D, i,: and~t~ respectively ~are given in Table VII.

,~ ~

:

: - .

:~

~ ~ SUBSrlT~JTESHEET

W093/0~562 PCT/US92~06~84 D A B C lO 9 : B C D A 13 15 : C D A B 7 11 B C D A~15 15 ~able VII
::
: ~ After round:three is complete, execution of : h~h;ng algorithm 150~within~block 35 of digital signature algorith~ lO proceed~ to block 199 where the following :additions a~e performed~

B~ B:*~:BB~
D:=:~D~ DD ~

Thus~, ea~ of th- rQur reglsters A, B, C, D
which~together uItimately~form~the~digest of~the recei~ed me~ssage is incremented by~;the~val~e it had-before the particular set was~started~

The~message~digest produced as the o~uL of h~ sh;~n~ algorithm 150~within;digital;signature algorithm 10 is thus the 4-tuple of:values of A, B, C, D obtained in block l99 after processing the last set. The loop induc-.

SllBSTITUTE- SHEET

W093/03562 PCT/USg2/06184 tion variable is incremented in block 201 and tested in decision diamond 202. If execution is not complete block 187 is performed again. Otherwise e~clltion of algorithm 50 ~oc~eA~ to exit terminal 203.

It will be understo d by those skilled in the art that more than one hundred twenty eight bits of~output may be required in some applications. This may be accom-plished, for example, by~providing two systems in parallel wherein each of the parallel systems executes hashing algorithm 150 with appropriately chosen constants and initialized registers, in order to~provide at most two Ared fifty six blts of final output.

:
Although~an~example mode, which includes specification of parameter range restrictions, for carry-ing out the~presènt invention has~been herein shown and described, it will~be~apparent~that~modification and variation may be made~'without~departing from what is ~ega:ae~to~be;the~subject-~matter of~this invention.
i~ I claim~

.
:

: ~ : : : :~ ' : ' ~ ~::

~ ~ SlIB~lllUTE S~ET

Claims (44)

1. A method for generating a digital signature (r,s) of a message m in a system wherein information is transmitted and received by users of said system, comprising the steps of:
(a) providing a secret value k unique to said message m;
(b) providing a public value g;
(c) calculating said value r proceeding from a prime modulus p and a value q selected to be a prime divisor of p-1 according to the rule r = (g k mod p) mod g;

(d) applying a hashing transform H only to said message m to generate a transformed message H(m);

(e) calculating said value s according to the rule s = f (H(m)) where said value s is a function of m only by way of said transformed message H (m); and, (f) generating a signal representative of said digital signature (r,s) in accordance with said value r and said value s and transmitting said generated signal.

2. The method for generating a digital signature (r,s) of Claim 1, wherein step (a) comprises the step of randomly selecting said secret value k.

3. The method for generating a digital signature (r,s) of Claim 1, wherein step (b) comprises the step of calculating said value g proceeding from a value h which may be any non-zero integer such that h(p-1)/q is not congruent to 1 mod p according to the rule g = h(p-1)/q mod p.

4. The method for generating a digital signature (r, s) of Claim 1, wherein step (d) comprises the step of transforming said message m by applying a one-way transform H to said message m.

5. The method for generating a digital signature (r,s) of Claim 1, wherein step (e) further comprises the step of calculating said value s according to the rule s = k-1 (H(m) + xr) mod q wherein said value x is a secret value.

6. The method for generating a digital signature (r,s) of Claim 1, wherein steps (a)-(c) are performed prior to knowledge of said message m.

7. The method for generating a digital signature (r,s) of Claim 1, comprising the further step of transmitting a signed message formed of said message m and said digital signature (r,s).

8. The method for generating a digital signature (r,s) of Claim 7, comprising the further steps of:
(g) receiving said transmitted signed message including a received digital signature (r,s) with a received value r and a received value s; and, (h) verifying said received digital signature (r,s).

9. The method for generating a digital signature (r,s) of Claim 8, wherein step (h) comprises the step of reconstructing said g k mod p of step (c) to provide a recovered g k mod p.

10. The method for generating a digital signature (r,s) of Claim 9, comprising the step of determining a value v proceeding from a value u1 = (H(m))(s)-1 mod q and a value u2 = (r)(s)-1 mod q according to the rule v= (g)u1(y)u2mod p wherein said value y is congruent to g x mod p and said value x is a secret value.

11. The method for generating a digital signature (r,s) of Claim 10, comprising the step of determining whether said determined value v after reduction mod q is the same as said received value r.

12. The method for generating a digital signature (r,s) of Claim 11, comprising the further step of determining that said received digital signature (r,s) is verified in response to determining that said determined value v after reduction mod q is the same as said received value r.

13. The method for generating a digital signature (r,s) of Claim 8, wherein step (h) further comprises the step of determining whether said received value r is congruent to 0 mod q.

14. The method for generating a digital signature (r,s) of Claim 8, wherein step (h) further comprises the step of determining whether said received value s is congruent to 0 mod q.

15. A system for generating a digital signature (r,s) of a message m wherein information is transmitted and received by users of said system, comprising:
a secret value k unique to said message m;
a public value g;
transform means for applying a hashing transform H
only to said message m to generate a transformed message H(m);
means for calculating said value r proceeding from a prime modulus p and a value q selected to be a prime divisor of p-1 according to the rule r = (g k mod p) mod q;
means for calculating said value s according to the rule s = f(H(m)) where said value s is a function of said message m only by way of H(m);
generating means for receiving said calculated values of r and s and generating a signed message formed of said message m and said digital signature (r,s); and, transmitting means for transmitting said generated signal.

16. The system for generating a digital signature (r,s) of Claim 15, wherein said secret value k is randomly selected.

17. The system for generating a digital signature (r,s) of Claim 15, wherein said public value g is calculated proceeding from a value h which may be any non-zero integer such that h(P-1)/q is not congruent to 1 mod p according to the rule g = h (p-1)/q mod p.

18. The system for generating a digital signature (r,s) of Claim 15, wherein said transform means comprises one-way transform means for transforming said message m by applying a one-way hashing transform H to said message m.

19. The system for generating a digital signature (r,s) of Claim 15, wherein a value x is a secret value and said value s is calculated according to the rule s = k-1 (H(m) + xr) mod q.

20. The system for generating a digital signature (r,s) of Claim 15, wherein said values k, g, and r are determined independently of said message m.

21. The system for generating a digital signature (r,s) of Claim 15, further comprising:
means for receiving said transmitted signed message;
and, verifying means for verifying said digital signature (r,s).

22. The system for generating a digital signature (r,s) of Claim 21, wherein said verifying means further comprises means for reconstructing said g k mod p to provide a recovered g k mod p within said verifying means.

23. The system for generating a digital signature (r,s) of Claim 22, further comprising means for determining a value v proceeding from a value u l = (H(m))(s)-1 mod q and a value u2 = (r)(s)-1 mod q according to the rule v= (g) u2 (y) u2 mod p wherein said value y is congruent to g x mod p and said value x is a secret value.

24. The system for generating a digital signature (r,s) of Claim 23, further comprising means for determining whether said determined value of v after reduction mod q is the same as said received value r.

25. The system for generating a digital signature (r,s) of Claim 24, further comprising means for determining that said signature (r,s) is verified in response to determining that said value v after reduction mod q is the same as said received value r.

26. The system for generating a digital signature (r,s) of Claim 21, wherein said verifying means comprises means for determining whether said value r is congruent to 0 mod q.

27. The system for generating a digital signature (r,s) of Claim 21, wherein said verifying means comprises means for determining whether said value s is congruent to 0 mod q.

28. A method for generating and verifying a digital signature (r,s) of a message m in a system wherein information is transmitted and received by users of said system, comprising the steps of:
(a) providing a secret value k unique to said message m;
(b) providing a public value g;
(c) determining said value r proceeding from a prime modulus p according to the rule r = F(g k mod p) wherein F is a reduction function independent of said message m;
(d) receiving a signed message formed of said message m and said digital signature (r,s);
(e) recovering and isolating g k mod p in accordance with said message m;
(f) determining whether said isolated g k mod p after reduction according to said reduction function F is the same as said received value r;
(g) determining that said signature (r,s) is verified in accordance with the determination of step (f); and, (h) generating a verification signal in accordance with step (g) and transmitting said verification signal.

29. The method for generating and verifying a digital signature (r,s) of Claim 28, wherein step (b) comprises calculating said value g proceeding from a value h which may be any non-zero integer such that h(p-1)/q is not congruent to 1 mod p according to the rule g = h(p-1)/q mod p said value q being selected to be a prime divisor of p-1.

30. The method for generating and verifying a digital signature (r,s) of Claim 28, wherein step (a) comprises randomly selecting said secret value k.

31. The method for generating and verifying a digital signature (r,s) of Claim 29, wherein said reduction function F comprises reduction mod q.

32. The method for generating and verifying a digital signature (r,s) of Claim 29, further comprising the step of determining a value v proceeding from a value u1 =
(H(m))(s)-1 mod q and a value u2 = (r)(s)-1 mod q, according to the rule v = (g) u1 (y) u2 mod p where said value y is congruent to g x mod p and said value x is a secret value.

33. The method for generating and verifying a digital signature (r,s) of Claim 29, further comprising the step of calculating said value r proceeding from a prime modulus p, according to the rule r = (g k mod p) mod q prior to knowledge of said message m.

34. The method for generating and verifying a digital signature (r,s) of Claim 28, further comprising the step of calculating said value s according to the rule s = f(H(m)) where H is a hashing transform for producing a transformed message H(m) and said value s is a function of m only by way of said transformed message H(m).

35. The method for generating and verifying a digital signature (r,s) of Claim 34, comprising the step of transforming said message m by applying a one-way transform H to said message m.

36. The method for generating and verifying a digital signature (r,s) of Claim 29, further comprising the step of calculating said value s according to the rule s = k-1 ((H(m) + xr) mod q wherein said value x is a secret value.

37. The method for generating and verifying a digital signature (r,s) of Claim 36, comprising the step of determining k-1 prior to knowledge of message m.

38. The method for generating and verifying a digital signature (r,s) of Claim 28, wherein steps (a)-(c) are formed prior to knowledge of said message m.

39. The method for generating and verifying a digital signature of Claim 36, comprising the further step of transmitting a signed message formed of said message m and said digital signature (r,s) proceeding from said calculated value of s.

40. The method for generating and verifying a digital signature (r,s) of Claim 29, wherein step (g) further comprises the step of determining verification in accordance with a determination whether said received value r is congruent to 0 mod q.

41. The method for generating and verifying a digital signature (r,s) of Claim 29, wherein step (g) further comprises the step of determining verification in accordance with a determination whether said received value s is congruent to 0 mod q.

42. The method for generating a digital signature (r,s) of Claim 5, wherein k-1 is determined prior to knowledge of said message m.

43. The system for generating a digital signature (r,s) of Claim 19, wherein k-1 is determined prior to knowledge of said message m.

44. A system for generating and verifying a digital signature (r,s) of a message m wherein information is transmitted and received by users of said system, comprising:
a secret value k unique to said message m;
a public value g;
means for determining said value r proceeding from a prime modulus p according to the rule r = F(g k mod p) wherein F is a reduction function independent of said message m;
means for receiving a signed message formed of said message m and said digital signature (r,s);
means for recovering and isolating g k mod p in accordance with said message m;
comparison means for determining whether said isolated g k mod p after reduction according to said reduction function F is the same as said received value r;
verification means for determining that said signature (r,s) is verified in accordance with the determination of said comparison means;
means for generating a verification signal in accordance with the verification of said verification means; and, means for transmitting said verification signal.