Method and system for generation and management of secret key of public key cryptosystem

• US 5,768,389 A
• Filed: 06/20/1996
• Issued: 06/16/1998
• Est. Priority Date: 06/21/1995
• Status: Expired due to Term

• Current Assignee: Nippon Telegraph and Telephone Corporation
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: Ishii, Shinji
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/666,905
• Time in Patent Office: 726 Days
• Field of Search: 380/21, 380/23, 380/25, 380/49, 380/51, 380/30
• US Class Current: 380/30
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method and a system for generating and managing a secret key of a public key cryptosystem, in which the secret key is generated inside a tamper resistant device, and stored into a storage region in a personal portable device from which the secret key cannot be read out of the personal portable device, while the personal portable device is inside the tamper resistant device. Here, the secret key can be reproduced by collecting the partial secret keys from those arbitrators who judge that the secret key reproduction is appropriate. Also, the secret key is generated inside a tamper resistant personal portable device, and stored into a storage region in the tamper resistant personal portable device from which the secret key cannot be read out of the tamper resistant personal portable device. Here, the secret key can be reproduced by using the partial secret keys for constituting the secret key from all entities sharing interests with a user of the tamper resistant personal portable device.

Claims

1. A method for generating and managing a secret key of a public key cryptosystem, comprising the steps of:

(a) generating a secret key inside a tamper resistant device; and

(b) storing the secret key generated at the step (a) into a storage region in a personal portable device from which the secret key cannot be read outside of the personal portable device, while the personal portable device is inside the tamper resistant device.

2. The method of claim 1, further comprising the step of:

(c) using the secret key stored at the step (b) for deciphering processing and signing processing only within the personal portable device.

3. The method of claim 1, wherein the step (a) includes the steps of:

(a1) generating a random number from a user'"'"'s personal data;

(a2) generating a public key of the public key cryptosystem from the random number generated at the step (a1); and

(a3) generating the secret key from the public key generated at the step (a2).

4. The method of claim 1, further comprising the steps of:

(d) generating a public key of the public key cryptosystem inside the tamper resistant device in correspondence to the secret key generated at the step (a);

(e) storing public keys generated at the step (d) in past inside the tamper resistant device;

(f) checking whether a new public key generated at the step (d) overlaps with any previously generated public key stored at the step (e) inside the tamper resistant device; and

(g) producing a certification by signing the new public key generated at the step (d) inside the tamper resistant device when the step (f) indicates that the new public key is not overlapping with any previously generated public key.

5. The method of claim 4, further comprising the step of:

(h) storing the certification produced at the step (g) into another storage region in the personal portable device from which the certification can be read outside of the personal portable device, while the personal portable device is inside the tamper resistant device.

6. The method of claim 5, wherein at the step (h), said another storage region has a writing protection to prevent any writing into said another storage region while the personal portable device is outside the tamper resistant device.

7. A tamper resistant system for generating and managing a secret key of a public key cryptosystem, comprising:

first means for generating the secret key inside the tamper resistant system; and

second means for storing the secret key generated by the first means into a storage region in a personal portable device from which the secret key cannot be read outside of the personal portable device, while the personal portable device is inside the tamper resistant system.

8. The system of claim 7, wherein the second means stores the secret key in the personal portable device which has a processor for carrying out deciphering processing and signing processing by using the secret key stored in the storage region only within the personal portable device.

9. The system of claim 7, wherein the first means includes:

means for generating a random number from a user'"'"'s personal data;

means for generating a public key of the public key cryptosystem from the random number; and

means for generating the secret key from the public key.

10. The system of claim 7, further comprising:

third means for generating a public key of the public key cryptosystem inside the tamper resistant system in correspondence to the secret key generated by the first means;

fourth means for storing public keys generated by the third means in past inside the tamper resistant system;

fifth means for checking whether a new public key generated by the third means overlaps with any previously generated public key stored by the fourth means inside the tamper resistant system; and

sixth means for producing a certification by signing the new public key generated by the third means inside the tamper resistant system when the fifth means indicates that the new public key is not overlapping with any previously generated public key.

11. The system of claim 10, further comprising:

seventh means for storing the certification produced by the sixth means into another storage region in the personal portable device from which the certification can be read outside of the personal portable device, while the personal portable device is inside the tamper resistant system.

12. The system of claim 11, wherein the seventh means stores the certification in the personal portable device which has a writing protection to prevent any writing into said another storage region while the personal portable device is outside the tamper resistant system.

13. A method for generating and managing a secret key of a public key cryptosystem, comprising the steps of:

(a) generating a public key and a secret key inside a first tamper resistant device;

(b) storing the secret key generated at the step (a) into a first storage region in a personal portable device from which the secret key cannot be read outside of the personal portable device, while the personal portable device is inside the first tamper resistant device;

(c) producing a certification inside a second tamper resistant device from a user'"'"'s personal data and the public key generated at the step (a); and

(d) storing the certification produced at the step (c) into a second storage region in the personal portable device from which the certification can be read outside of the personal portable device, while the personal portable device is inside the first tamper resistant device.

14. The method of claim 13, wherein the step (a) includes the steps of:

(a1) generating a random number from the user'"'"'s personal data;

(a2) generating the public key from the random number generated at the step (a1); and

(a3) generating the secret key from the public key generated at the step (a2).

15. The method of claim 13, wherein at the step (d), the second storage region has a writing protection to prevent any writing into the second storage region while the personal portable device is outside the first tamper resistant device.

16. The method of claim 13, wherein the personal portable device comprises a first device containing the first storage region for storing the secret key and a second device containing the second storage region for storing the certification.

17. The method of claim 13, further comprising the steps of:

(e) producing a certification request inside the first tamper resistant device from the user'"'"'s personal data and the public key generated at the step (a);

(f) signing the certification request produced at the step (e) by the secret key generated at the step (a) to obtain a signed certification request inside the first tamper resistant device; and

(g) sending the certification request produced at the step (e) and the signed certification request obtained at the step (f) from the first tamper resistant device to the second tamper resistant device, so that the step (c) produces the certification by using the certification request and the signed certification request.

18. The method of claim 17, further comprising the step of:

(h) verifying the signed certification request inside the second tamper resistant device to judge whether the certification request has been tampered between the first tamper resistant device and the second tamper resistant device, such that the step (c) produces the certification only when the signed certification request is verified.

19. The method of claim 17, further comprising the step of:

(i) judging inside the second tamper resistant device whether the user'"'"'s personal data directly received from a user matches with the user'"'"'s personal data contained in the certification request, such that the step (c) produces the certification only when the user'"'"'s personal data directly received from a user matches with the user'"'"'s personal data contained in the certification request.

20. The method of claim 17, further comprising the step of:

(j) storing public keys used in past inside the second tamper resistant device; and

(k) checking inside the second tamper resistant device whether the public key contained in the certification request overlaps with any previously used public key stored at the step (j), such that the step (c) produces the certification only when the step (j) indicates that the public key contained in the certification request is not overlapping with any previously used public key.

21. The method of claim 13, further comprising the steps of:

(l) signing the certification produced at the step (c) by using a secret key of the second tamper resistant device to obtain a signed certification inside the second tamper resistant device; and

(m) sending the certification produced at the step (c) and the signed certification obtained at the step (l) from the second tamper resistant device to the first tamper resistant device, so that the step (d) stores the certification into the second storage region in the personal portable device by using the certification and the signed certification.

22. The method of claim 21, further comprising the step of:

(n) verifying the signed certification inside the first tamper resistant device to judge whether the certification has been tampered between the second tamper resistant device and the first tamper resistant device, such that the step (b) stores the secret key and the step (d) stores the certification only when the signed certification is verified.

23. The method of claim 13, further comprising the step of:

(o) using the secret key stored at the step (b) for deciphering processing and signing processing only within the personal portable device.

24. A system for generating and managing a secret key of a public key cryptosystem, comprising:

a first tamper resistant device having;

first means for generating a public key and the secret key inside the first tamper resistant device;

second means for storing the secret key generated by the first means into a first storage region in a personal portable device from which the secret key cannot be read outside of the personal portable device, while the personal portable device is inside the first tamper resistant device; and

third means for storing the certification into a second storage region in the personal portable device from which the certification can be read outside of the personal portable device, while the personal portable device is inside the first tamper resistant device; and

a second tamper resistant device having;

fourth means for producing the certification inside the second tamper resistant device from a user'"'"'s personal data and the public key generated by the first means, such that the third means stores the certification produced by the fourth means.

25. The system of claim 24, wherein the first means includes:

means for generating a random number from the user'"'"'s personal data;

means for generating the public key from the random number; and

means for generating the secret key from the public key.

26. The system of claim 24, wherein the third means stores the certification in the personal portable device which has a writing protection to prevent any writing into the second storage region while the personal portable device is outside the first tamper resistant device.

27. The system of claim 24, wherein the personal portable device comprises a first device containing the first storage region for storing the secret key and a second device containing the second storage region for storing the certification, so that the second means stores the secret key into the first device while the third means stores the certification into the second device.

28. The system of claim 24, wherein the first tamper resistant device also has:

fifth means for producing a certification request inside the first tamper resistant device from the user'"'"'s personal data and the public key generated by the first means;

sixth means for signing the certification request produced by the fifth means by the secret key generated by the first means to obtain a signed certification request inside the first tamper resistant device; and

seventh means for sending the certification request produced by the fifth means and the signed certification request obtained by the sixth means from the first tamper resistant device to the second tamper resistant device, so that the fourth means produces the certification by using the certification request and the signed certification request.

29. The system of claim 28, wherein the second tamper resistant device also has:

means for verifying the signed certification request inside the second tamper resistant device to judge whether the certification request has been tampered between the first tamper resistant device and the second tamper resistant device, such that the fourth means produces the certification only when the signed certification request is verified.

30. The system of claim 28, wherein the second tamper resistant device also has:

means for judging inside the second tamper resistant device whether the user'"'"'s personal data directly received from a user matches with the user'"'"'s personal data contained in the certification request, such that the fourth means produces the certification only when the the user'"'"'s personal data directly received from a user matches with the user'"'"'s personal data contained in the certification request.

31. The system of claim 28, wherein the second tamper resistant device also has:

storing means for storing public keys used in past inside the second tamper resistant device; and

checking means for checking inside the second tamper resistant device whether the public key contained in the certification request overlaps with any previously used public key stored by the storing means, such that the fourth means produces the certification only when the checking means indicates that the public key contained in the certification request is not overlapping with any previously used public key.

32. The system of claim 24, wherein the second tamper resistant device also has:

signing means for signing the certification produced by the fourth means by using a secret key of the second tamper resistant device to obtain a signed certification inside the second tamper resistant device; and

sending means for sending the certification produced by the fourth means and the signed certification obtained by the signing means from the second tamper resistant device to the first tamper resistant device, so that the third means stores the certification into the second storage region in the personal portable device by using the certification and the signed certification.

33. The system of claim 32, wherein the first tamper resistant device also has:

means for verifying the signed certification inside the first tamper resistant device to judge whether the certification has been tampered between the second tamper resistant device and the first tamper resistant device, such that the second means stores the secret key and the third means stores the certification only when the signed certification is verified.

34. The system of claim 24, wherein the second means stores the secret key in the personal portable device which has a processor for carrying out deciphering processing and signing processing by using the secret key stored in the first storage region only within the personal portable device.

35. A method for reproducing a secret key of a public key cryptosystem, comprising the steps of:

(a) designating a plurality of arbitrators for separately judging an appropriateness of a secret key reproduction;

(b) distributing partial secret keys dividing an information necessary in reproducing the secret key among the arbitrators;

(c) collecting the partial secret keys from those arbitrators who judge that the secret key reproduction is appropriate when the secret key reproduction is requested; and

(d) reproducing the secret key from the partial secret keys collected at the step (c) when the partial secret keys collected at the step (c) satisfy a prescribed secret key reproduction necessary condition.

36. The method of claim 35, wherein at the step (b), the partial secret keys divide the information necessary in reproducing the secret key such that the secret key can be reproduced from at least a predetermined number of the partial secret keys.

37. The method of claim 35, wherein at the step (d), the prescribed secret key reproduction necessary condition includes a secret key reproduction indispensable condition which specifies a selected arbitrator whose approval of the secret key reproduction is required for satisfying the secret key reproduction necessary condition.

38. The method of claim 35, wherein at the step (d), the prescribed secret key reproduction necessary condition includes a secret key reproduction threshold condition which specifies at least k arbitrators out of j arbitrators (j>

k>

0) whose approval of the secret key reproduction is required for satisfying the secret key reproduction necessary condition.

39. The method of claim 35, wherein at the step (d), the prescribed secret key reproduction necessary condition includes a secret key reproduction order condition which specifies an order for obtaining approval of the secret key reproduction from the arbitrators which is required in satisfying the secret key reproduction necessary condition.

40. The method of claim 35, wherein the secret key is generated inside a tamper resistant device, and stored in a personal portable device while the personal portable device is inside the tamper resistant device, into a storage region in the personal portable device from which the secret key cannot be read outside of the personal portable device, and the secret key is reproduced at the step (d) inside the tamper resistant device, and stored in the personal portable device while the personal portable device is inside the tamper resistant device, into the storage region in the personal portable device.

41. The method of claim 40, further comprising the steps of:

making a back-up of enciphered information to be deciphered by the secret key which is stored inside the personal portable device, before the secret key reproduction becomes necessary; and

restoring the enciphered information from the back-up to the personal portable device after the secret key is reproduced.

42. A system for reproducing a secret key of a public key cryptosystem, comprising:

distributing means for distributing partial secret keys which divide an information necessary in reproducing the secret key among a plurality of arbitrators for separately judging an appropriateness of a secret key reproduction;

collecting means for collecting the partial secret keys from those arbitrators who judge that the secret key reproduction is appropriate when the secret key reproduction is requested; and

reproducing means for reproducing the secret key from the partial secret keys collected by the collecting means when the partial secret keys collected by the collecting means satisfy a prescribed secret key reproduction necessary condition.

43. The system of claim 42, wherein the partial secret keys divide the information necessary in reproducing the secret key such that the secret key can be reproduced from at least a predetermined number of the partial secret keys.

44. The system of claim 42, wherein the prescribed secret key reproduction necessary condition includes a secret key reproduction indispensable condition which specifies a selected arbitrator whose approval of the secret key reproduction is required for satisfying the secret key reproduction necessary condition.

45. The system of claim 42, wherein the prescribed secret key reproduction necessary condition includes a secret key reproduction threshold condition which specifies at least k arbitrators out of j arbitrators (j>

k>

0) whose approval of the secret key reproduction is required for satisfying the secret key reproduction necessary condition.

46. The system of claim 42, wherein the prescribed secret key reproduction necessary condition includes a secret key reproduction order condition which specifies an order for obtaining approval of the secret key reproduction from the arbitrators which is required in satisfying the secret key reproduction necessary condition.

47. The system of claim 42, wherein the secret key is generated inside a tamper resistant device, and stored in a personal portable device while the personal portable device is inside the tamper resistant device, into a storage region in the personal portable device from which the secret key cannot be read outside of the personal portable device, and the reproducing means reproduces the secret key inside the tamper resistant device, and stores the secret key in the personal portable device while the personal portable device is inside the tamper resistant device, into the storage region in the personal portable device.

48. The system of claim 47, further comprising:

means for making a back-up of enciphered information to be deciphered by the secret key which is stored inside the personal portable device, before the secret key reproduction becomes necessary; and

means for restoring the enciphered information from the back-up to the personal portable device after the secret key is reproduced.

49. A method for generating and managing a secret key of a public key cryptosystem, comprising the steps of:

(a) generating a secret key inside a tamper resistant personal portable device; and

(b) storing the secret key generated at the step (a) into a storage region in the tamper resistant personal portable device from which the secret key cannot be read outside of the tamper resistant personal portable device.

50. The method of claim 49, further comprising the step of:

(c) using the secret key stored at the step (b) for deciphering processing and signing processing only within the tamper resistant personal portable device.

51. The method of claim 49, wherein the step (a) includes the steps of:

(a1) generating a random number; and

(a2) generating a public key of the public key cryptosystem and the secret key from the random number generated at the step (a1).

52. The method of claim 49, further comprising the steps of:

(d) detecting an opening of a cover of the tamper resistant personal portable device; and

(e) deleting the secret key from the storage region when the opening of the cover of the tamper resistant personal portable device is detected at the step (d).

53. The method of claim 52, further comprising the step of:

(f) destroying elements implemented inside the tamper resistant personal portable device so as to make the tamper resistant personal portable device unusable when the opening of the cover of the tamper resistant personal portable device is detected at the step (d).

54. A tamper resistant personal portable device for generating and managing a secret key of a public key cryptosystem, comprising:

first means for generating a secret key inside the tamper resistant personal portable device; and

second means for storing the secret key generated by the first means into a storage region from which the secret key cannot be read outside of the tamper resistant personal portable device.

55. The device of claim 54, further comprising:

a processor for carrying out deciphering processing and signing processing by using the secret key stored in the storage region only within the tamper resistant personal portable device.

56. The device of claim 54, wherein the first means includes:

means for generating a random number; and

means for generating a public key of the public key cryptosystem and the secret key from the random number.

57. The device of claim 54, further comprising:

opening detection means for detecting an opening of a cover of the tamper resistant personal portable device; and

means for deleting the secret key from the storage region when the opening of the cover of the tamper resistant personal portable device is detected by the opening detection means.

58. The device of claim 57, further comprising:

means for destroying elements implemented inside the tamper resistant personal portable device so as to make the tamper resistant personal portable device unusable when the opening of the cover of the tamper resistant personal portable device is detected by the opening detection means.

59. A method for generating and managing a secret key of a public key cryptosystem, comprising the steps of:

(a) separately entering each one of partial secret keys for constituting the secret key from all entities sharing interests with a user of a tamper resistant personal portable device, into the tamper resistant personal portable device, each partial secret key being secretly managed by each entity;

(b) generating a secret key inside the tamper resistant personal portable device from the partial secret keys entered at the step (a); and

(c) storing the secret key generated at the step (a) into a storage region in the tamper resistant personal portable device from which the secret key cannot be read outside of the tamper resistant personal portable device.

60. The method of claim 59, further comprising the step of:

(d) using the secret key stored at the step (b) for deciphering processing and signing processing only within the tamper resistant personal portable device.

61. The method of claim 59, further comprising the steps of:

(e) detecting an opening of a cover of the tamper resistant personal portable device; and

(f) deleting the secret key from the storage region when the opening of the cover of the tamper resistant personal portable device is detected at the step (e).

62. The method of claim 61, further comprising the step of:

(g) destroying elements implemented inside the tamper resistant personal portable device so as to make the tamper resistant personal portable device unusable when the opening of the cover of the tamper resistant personal portable device is detected at the step (e).

63. The method of claim 59, further comprising the steps of:

(h) when a secret key reproduction due to a loss of the secret key in the tamper resistant personal portable device is requested by the user, separately entering each one of the partial secret keys from all the entities sharing interests with the user into the tamper resistant personal portable device again;

(i) generating the secret key inside the tamper resistant personal portable device from the partial secret keys entered at the step (k) again; and

(j) storing the secret key generated at the step (i) into the storage region again.

64. The method of claim 59, further comprising the steps of:

(k) when a secret key reproduction due to a destruction of the tamper resistant personal portable device is requested by the user, separately entering each one of the partial secret keys from all the entities sharing interests with the user into a new tamper resistant personal portable device;

(l) generating the secret key inside the new tamper resistant personal portable device from the partial secret keys entered at the step (k); and

(m) storing the secret key generated at the step (l) into a storage region in the new tamper resistant personal portable device from which the secret key cannot be read outside of the new tamper resistant personal portable device.

65. The method of claim 59, further comprising the steps of:

(n) separately entering each one of new partial secret keys for constituting a new secret key from all the entities sharing interests with the user, into the tamper resistant personal portable device, each new partial secret key being secretly managed by each entity;

(o) generating the new secret key inside the tamper resistant personal portable device from the new partial secret keys entered at the step (n); and

(p) storing the new secret key generated at the step (o) into the storage region by overwriting an original secret key.

66. The method of claim 59, further comprising the steps of:

making a back-up of enciphered information to be deciphered by the secret key stored in the storage region, before a secret key reproduction becomes necessary; and

restoring the enciphered information from the back-up to the tamper resistant personal portable device after the secret key is reproduced.

67. The method of claim 59, further comprising the steps of:

making a back-up of enciphered information to be deciphered by an original secret key stored in the storage regions before a secret key reproduction and updating becomes necessary;

restoring the enciphered information from the back-up to the tamper resistant personal portable device after the secret key is reproduced but before the secret key is updated;

deciphering the enciphered information inside the tamper resistant personal portable device by using a reproduced secret key after the secret key is reproduced but before the secret key is updated; and

enciphering the information deciphered at the deciphering step inside the tamper resistant personal portable device by using an updated secret key after the secret key is reproduced and updated.

68. The method of claim 59, further comprising the steps of:

(q) generating two prime numbers p and q, and setting a least common denominator of (p-1) and (q-1) as L;

(r) setting a product of p and q as a public key modulo n, and a positive integer which is less than L and relatively prime with respect to L as a public key exponent e;

(s) selecting (k-1) pieces of positive integers each of which is less than L and relatively prime with respect to L as the partial secret keys d₁, d₂, . . . , d_k-1, where k-1 is a number of the entities;

(t) generating a user'"'"'s partial secret key d₀ which satisfies;

space="preserve" listing-type="equation">e·

d.sub.0 ·

d.sub.1 ·

d.sub.2 ·

. . . ·

d.sub.k-1 ≡

1 (mod L)

such that the step (b) generates the secret key d which satisfies;

space="preserve" listing-type="equation">x.sup.d ≡

x.sup.d.sbsp.0.sup.·

d.sbsp.1.sup.·

d.sbsp.2.sup..multidot. . . . ·

d.sbsp.k-1 (mod n)

where x is an arbitrary positive integer less than n.

69. The method of claim 59, further comprising the steps of:

distributing a random number to all the entities;

sequentially signing the random number by using the partial secret keys of all the entities; and

verifying the sequentially signed random number by using a public key at each entity, and confirming that the secret key is generated without any illegality at each entity when the sequentially signed random number is successfully verified.

70. The method of claim 59, further comprising the steps of:

distributing a secret key reproduction request to all the entities;

sequentially signing the secret key reproduction request by using the partial secret keys of all the entities; and

verifying the sequentially signed secret key reproduction request by using a public key at each entity, and issuing a permission for a secret key reproduction from each entity when the sequentially signed secret key reproduction request is successfully verified.

71. A tamper resistant personal portable device for generating and managing a secret key of a public key cryptosystem, comprising:

first means for separately entering each one of partial secret keys for constituting the secret key from all entities sharing interests with a user of the tamper resistant personal portable device, into the tamper resistant personal portable device, each partial secret key being secretly managed by each entity;

second means for generating a secret key inside the tamper resistant personal portable device from the partial secret keys entered by the first means; and

third means for storing the secret key generated by the second means into a storage region from which the secret key cannot be read outside of the tamper resistant personal portable device.

72. The device of claim 71, further comprising:

a processor for carrying out deciphering processing and signing processing by using the secret key stored in the storage region only within the tamper resistant personal portable device.

73. The device of claim 71, further comprising:

opening detection means for detecting an opening of a cover of the tamper resistant personal portable device; and

means for deleting the secret key from the storage region when the opening of the cover of the tamper resistant personal portable device is detected by the opening detection means.

74. The device of claim 73, further comprising:

means for destroying elements implemented inside the tamper resistant personal portable device so as to make the tamper resistant personal portable device unusable when the opening of the cover of the tamper resistant personal portable device is detected by the opening detection means.

75. The device of claim 71, wherein when a secret key reproduction due to a loss of the secret key in the tamper resistant personal portable device is requested by the user, the first means separately enters each one of the partial secret keys from all the entities sharing interests with the user into the tamper resistant personal portable device again, the second means generates the secret key inside the tamper resistant personal portable device from the partial secret keys entered by the first means again, and the third means stores the secret key generated by the second means into the storage region again.

76. The device of claim 71, wherein the first means also separately enters each one of new partial secret keys for constituting a new secret key from all the entities sharing interests with the user, into the tamper resistant personal portable device, each new partial secret key being secretly managed by each entity, the second means also generates the new secret key inside the tamper resistant personal portable device from the new partial secret keys entered by the first means, and the third means also stores the new secret key generated by the second means into the storage region by overwriting an original secret key.

77. The device of claim 71, further comprising:

means for generating two prime numbers p and q, and setting a least common denominator of (p-1) and (q-1) as L;

means for setting a product of p and q as a public key modulo n;

means for setting a positive integer which is less than L and relatively prime with respect to L as a public key exponent e;

means for selecting (k-1) pieces of positive integers each of which is less than L and relatively prime with respect to L as the partial secret keys d₁, d₂, . . . , d_k-1, where k-1 is a number of the entities;

means for generating a user'"'"'s partial secret key d₀ which satisfies;

space="preserve" listing-type="equation">e·

d.sub.0 ·

d.sub.1 ·

d.sub.2 ·

. . . ·

d.sub.k-1 ≡

1(mod L)

such that the second means generates the secret key d which satisfies;

space="preserve" listing-type="equation">x.sup.d ≡

x.sup.d.sbsp.0.sup.·

d.sbsp.1.sup.·

d.sbsp.2.sup..multidot. . . . ·

d.sbsp.k-1 (mod n)

where x is an arbitrary positive integer less than n.

78. The device of claim 77, further comprising means for outputting the user'"'"'s partial secret key d₀ from the tamper resistive personal portable device only once.

79. A method for handling digital data using public key cryptosystems, comprising the steps of:

(a) generating at a user'"'"'s side a public key and a secret key of a first public key cryptosystem for signing;

(b) registering the public key of the first public key cryptosystem at a certification issuing center; and

(c) signing the public key of the first public key cryptosystem by using a secret key of the certification issuing center, and disclosing the signed public key as a user'"'"'s certification;

(d) generating at a copyright owner'"'"'s side a public key and a secret key of a second public key cryptosystem for deciphering digital data, and storing the secret key of the second public key cryptosystem into a storage region in a tamper resistant personal portable device from which the secret key of the second public key cryptosystem cannot be read outside of the tamper resistant personal portable device;

(e) providing the tamper resistant personal portable device and the public key of the second public key cryptosystem to the user'"'"'s side, such that the user'"'"'s side can utilize the digital data provided by the copyright owner'"'"'s side by carrying out deciphering processing using the secret key of the second public key cryptosystem and signing processing using the secret key of the first public key cryptosystem within the tamper resistant personal portable device.