Auto-recoverable and auto-certifiable cryptosystem with unescrowed signing keys

• US 6,122,742 A
• Filed: 06/18/1997
• Issued: 09/19/2000
• Est. Priority Date: 06/18/1997
• Status: Expired due to Fees

• Current Assignee: Adam Lucas Young, Marcel Mordechay Yung
• Original Assignee: Adam Lucas Young, Marcel Mordechay Yung
• Inventors: Yung, Marcel Mordechay, Young, Adam Lucas
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US08/878,189
• Time in Patent Office: 1,189 Days
• Field of Search: 380/278, 380/281, 380/283, 380/44, 380/47, 380/28, 713/171, 713/176, 713/182, 713/201
• US Class Current: 726/10
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method is provided for an escrow cryptosystem combined with an unescrowed digital signature scheme that uses a single public key per user. This system is overhead-free, does not require a cryptographic tamper-proof hardware implementation (i.e., can be done in software), and is publicly verifiable. The system cannot be used subliminally to enable a shadow public key system. Namely, an unescrowed public key system that is publicly displayed in a covert fashion. The cryptosystem contains a key generation mechanism that outputs a key triplet, and a certificate of proof that the keys were generated according to the algorithm. The key triplet consists of a public key, a private decryption key, and a private signing key. Using the public key and the certificate, the triplet can be verified efficiently by anyone to have the following properties: (1) the private signing key is known to the user, and (2) the private decryption key is recoverable by the escrow authorities. The system assures that the escrow authorities are not able to forge signatures or get the private signing key. The system is designed so that its internals can be made publicly scrutinizable (e.g., it can be distributed in source code form).

Claims

1. A method and apparatus for generating a public key for encryption and signature verification and a proof that the keys were generated by a specific algorithm comprising the steps of:

A) the user'"'"'s system generating a random string of bits based on system parameters;

B) the user running a key generation algorithm to get a private signing key, private decryption key, and a public key using the random string and public parameters;

C) the user constructing a proof which does not compromise the private keys but at the same time provides confidence to other verifying entities that said keys were generated properly by the specified algorithm.

2. A method for users in a cryptosystem wherein each user has one public key, a corresponding private decryption key, and a corresponding different private signing key comprising of the following set of operations:

A) an encryption operation where user A encrypts a message intended for user B using the public key of said user B;

B) a decryption operation where user B decrypts a message sent from user A using the private decryption key of user B;

C) a signature operation where user A signs a message intended for user B using the private signing key of said user A;

D) a signature verification operation where user B verifies a message allegedly sent from user A using said public key of said user A.

3. A method, using a cryptosystem, for a user to digitaly sign a message m such that the other users can verify the resulting signature using said users public key, where the public key, private decryption key, and private signing key of said user are drawn from at least three different domains, F1, F2, and F3, where the signing operation comprises the steps of:

choosing at least one value uniformly at random from one of said domains;

using said random value to compute a digital signature s, where s consists of at least two values drawn from said set of domains;

outputing s to the user;

and the signature verification operation performed by said other users comprises of using said users public key, system parameters, said user'"'"'s said digital signature s, and said user'"'"'s message m to check validity conditions derived from said signing operation.

4. A cryptosystem with encryption, decryption, signing, and signature verification operations whereby said operations are performed in any of three domains, F1, F2, and F3 such that F1 is the exponent domain of F2 and F2 is the exponent domain of F3.

5. A method for public key cryptosystem including a subset of the operations of encryption, decryption, key exchange, signing, signature verification, and authentication, involving a public key function based on nested trapdoors functions.

6. A method for generating a public key and a private key, for signing messages, and for verifying messages, where said private key can be used to electronically sign documents but which cannot be used in whole or in part to decrypt data which is encrypted using said public key.

7. A method comprised of the generation of a public key for encryption and signature verification according to a specified algorithm and for the correctness validation of said generation, wherein said public key is generated based on system parameters together with a corresponding decryption private key and signing private key which remains secure, and where said correctness validation is based on a validation proof which comprises additional strings of information which do not compromise the security of said private keys and at the same time enables other entities with access to said public key and said additional strings to execute a validation procedure which assures said other entities that said public key was generated properly according to said specified algorithm.

8. A method as in claim 7 where said proof provides confidence that said user is in possession of said private decryption and said private signing key.

9. A method as in claim 8 where said proof also provides confidence that said private decryption key is recoverable by the predetermined entities.

10. A method as in claim 8 where said verifying entities are components of a certification authority, with the further step that after successful verification said user is registered into a public key infrastructure.

11. A method as in claim 7 wherein said generation of public key comprises the operations of:

choosing said private signing key k randomly in domain F3;

computing said private decryption key x in domain F2 based on k;

computing said public key y in domain F1 based on k and said system parameters;

and said correctness validation comprises the operation of the users system computing a zero-knowledge proof that establishes that x is recoverable by said predetermined entities given y and a transcript of said proof.

12. A method as in claim 7 where said system parameters are a large prime r, a large prime q=2r+1, and a large prime p=4r+3, an odd value g₁ where g₁ generates all values less than Z_2q and which are relatively prime to 2q, a value g which generates Z_p, and the public key Y of said predetermined entities, and where said generation of public key comprises the operations of:

choosing said private signing key k in z_2r uniformly at random;

computing said private decryption key x to be (g₁ /Y)^k mod 2q;

computing y=(g to the power x) mod p;

computing user'"'"'s said public key (y,g,p)

and where said correctness validation comprises the operations of;

computing C=(g₁ to the power k) mod 2q;

computing v=g raised to the ((Y to the power -k) mod 2q) power mod p;

computing a transcript for P1, which constitutes a zero-knowledge proof of knowledge of k in C;

computing a transcript for P2, which constitutes a zero-knowledge proof of knowledge of k in v;

computing a transcript for P3, which constitutes a zero-knowledge proof of knowledge of k in (v to the C power) mod p;

where said proof resulting from said correctness validation is the string (C,v) and the transcripts P1, P2, and P3.

13. A method for an entity to verify the recoverability of a private decryption key generated as in claim 7 comprising the steps of:

the entity obtaining said system parameters;

the entity obtaining said public key which was allegedly generated in said generation of public key of claim 7;

the entity obtaining said proof which is allegedly derived from said correctness validation of claim 7; and

the verification comprises the steps of;

A) checking that the proof is a valid proof of knowledge;

B) checking consistency conditions between and regarding the said alleged proof, said alleged public key, and said system parameters;

C) if all checks succeed output true, otherwise output false.

14. A method as in claim 13, where the input comprises the alleged public key (y,g,p) and the alleged proof which is the string (C,v) and transcripts P1, P2, and P3 and where step A consists of the following operations:

verifying that P1 is a valid proof of knowledge of k in C, verifying that P2 is a valid proof of knowledge of k in v, and verifying that P3 is a valid proof of knowledge of k in (v to the C power) mod p;

and where step B consists of the following operations;

verifying that the system parameters that are supplied as input agree with the predetermined system parameters;

verifying that y equals (v to the C power) mod p.

15. A method for a predetermined entity to recover the private decryption key of a user wherein the keys of said user were generated as in claim 7, comprising the steps of:

retrieving the public key of said user;

retrieving the proof of said user;

recovering said user'"'"'s private decryption key based on said system parameters, said public key, said proof, and private keys corresponding to public key which is part of said system parameters which is owned by said predetermined entities, or recovering information encrypted under said user'"'"'s public key.

16. A method as in claim 15 where said predetermined entity is able to monitor communications of users suspected of unlawful activity such that said predetermined entity is unable to forge signatures of or impersonate any users at any time.

17. A method as in claim 15 where the predetermined entity is a government body, local, state, national, or international law-enforcement agency, or officer of a corporation.

18. A method as in claim 7, with the additional step of using the generated keys to encrypt and digitally sign messages wherein the random parameters and the exponentiation operations involving said random parameters are chosen and computed, respectively, prior to obtaining said messages, and independent of said messages.

19. A method, using a crypto-system, where the keys are generated as in claim 7, wherein a user requesting a signature on message m submits a randomly modified message corresponding to said message m, to the signer, whereby said signer produces a signature on said modified message without being able to determine m and where upon receiving said signature on said modified message, said user requesting a signature recovers a valid signature on m by the signer such that said signer cannot compute said valid signature.

20. A method as in claim 7, with the additional step of using the generated keys to sign messages, wherein a user signs a message m to produce a signature s using said user'"'"'s private signing key such that said message m is recovered from said signature s during signature verification.