Generation of a digital signature

• US 9,306,752 B2
• Filed: 09/19/2014
• Issued: 04/05/2016
• Est. Priority Date: 12/21/2002
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Owlett, John, Thompson, George M., Walton, Keith A.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Woldemariam, Nega
• Application Number:
  US14/491,206
• Publication Number:
  US 20150058636A1
• Time in Patent Office: 564 Days
• Field of Search: 713/176, 713/168, 713/169, 713/170, 713/180
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method and system for generating a digital signature of a data item. A unique condition digest of at least two condition digests is iteratively processed in each iteration of a loop for a sufficient number of iterations to process all of the condition digests. Each iteration includes concatenating a reference digest with the unique condition digest of the iteration to generate a concatenand and hashing the concatenand to generate a hashed concatenand serving as the reference digest for the next iteration. Each unique condition digest is a different condition digest in each iteration. The regenerated reference digest of the last iteration is a last digest which is encrypted to generate a digital signature block that represents the data item and at least two conditions specified for the digital signature. The digital signature block includes the digital signature. The encrypting includes signing the last digest with the digital signature.

Claims

1. A method for generating a digital signature of a data item, said method comprising:

a computer iteratively processing a unique condition digest of a plurality of condition digests in each iteration of a loop for a sufficient number of iterations to process all condition digests of the plurality of condition digests, said processing in each iteration comprising concatenating a reference digest with the unique condition digest of the iteration to generate a concatenand and hashing the concatenand to generate a hashed concatenand that serves as the reference digest for the next iteration if the next iteration is performed, each unique condition digest being a different condition digest in each iteration of the loop, the regenerated reference digest of the last iteration of the loop being a last digest; and

said computer encrypting the last digest to generate a digital signature block that represents the data item and a plurality of conditions specified for the digital signature, said digital signature block comprising the digital signature and enabling cryptographic verification of both the data item and the plurality of conditions, said encrypting comprising signing the last digest with the digital signature.

2. The method of claim 1, wherein the reference digest is equal to a digest of the data item, and wherein the digest of the data item is formed from a hashing of the data item.

3. The method of claim 1, said method further comprising:

said computer hashing each condition of the plurality of conditions separately from each other and separately from the data item to generate the plurality of condition digests respectively corresponding to the plurality of conditions.

4. The method of claim 1, said method further comprising:

said computer generating a communication, wherein the communication comprises the digital signature block, the data item, and the plurality of conditions; and

said computer sending the communication across a network to a recipient.

5. The method of claim 1, said method further comprising:

said computer generating a communication, wherein the communication comprises the digital signature block and does not comprise the data item and does not comprise the plurality of conditions; and

said computer sending the communication across a network to a recipient.

6. The method of claim 1, wherein the method further comprises:

said computer hashing a new condition to generate a digest of the new condition;

said computer concatenating the digital signature block with the digest of the new condition to generate a new digest;

said computer hashing the new digest to generate a hashed new digest; and

said computer encrypting the hashed new digest to generate a new digital signature block that represents the data item, the plurality of conditions, and the new condition and enables cryptographic verification of the data item, the plurality of conditions, and the new condition.

7. The method of claim 1, wherein said signing is performed by a signer and represents acceptance of the data item by the signer subject to the plurality of conditions.

8. The method of claim 1, wherein said signing is performed by a signer and represents acceptance of the data item by the signer, and wherein said acceptance is not subject to the plurality of conditions.

9. A computer program product, comprising a machine-readable recording medium having program code recorded thereon, said program code upon being executed by a computer performs a method for generating a digital signature of a data item, said method comprising:

said computer iteratively processing a unique condition digest of a plurality of condition digests in each iteration of a loop for a sufficient number of iterations to process all condition digests of the plurality of condition digests, said processing in each iteration comprising concatenating a reference digest with the unique condition digest of the iteration to generate a concatenand and hashing the concatenand to generate a hashed concatenand that serves as the reference digest for the next iteration if the next iteration is performed, each unique condition digest being a different condition digest in each iteration of the loop, the regenerated reference digest of the last iteration of the loop being a last digest; and

said computer encrypting the last digest to generate a digital signature block that represents the data item and a plurality of conditions specified for the digital signature, said digital signature block comprising the digital signature and enabling cryptographic verification of both the data item and the plurality of conditions, said encrypting comprising signing the last digest with the digital signature.

10. The computer program product of claim 9, wherein the reference digest is equal to a digest of the data item, and wherein the digest of the data item is formed from a hashing of the data item.

11. The computer program product of claim 9, said method further comprising:

said computer hashing each condition of the plurality of conditions separately from each other and separately from the data item to generate the plurality of condition digests respectively corresponding to the plurality of conditions.

12. The computer program product of claim 9, said method further comprising:

said computer generating a communication, wherein the communication comprises the digital signature block, the data item, and the plurality of conditions; and

said computer sending the communication across a network to a recipient.

13. The computer program product of claim 9, said method further comprising:

said computer generating a communication, wherein the communication comprises the digital signature block and does not comprise the data item and does not comprise the plurality of conditions; and

said computer sending the communication across a network to a recipient.

14. The computer program product of claim 9, wherein the method further comprises:

said computer hashing a new condition to generate a digest of the new condition;

said computer concatenating the digital signature block with the digest of the new condition to generate a new digest;

said computer hashing the new digest to generate a hashed new digest; and

said computer encrypting the hashed new digest to generate a new digital signature block that represents the data item, the plurality of conditions, and the new condition and enables cryptographic verification of the data item, the plurality of conditions, and the new condition.

15. A data processing apparatus comprising a computer and a machine-readable recording medium coupled to the computer, said recording medium storing program code that when executed by the computer performs a method for generating a digital signature of a data item, said method comprising:

said computer iteratively processing a unique condition digest of a plurality of condition digests in each iteration of a loop for a sufficient number of iterations to process all condition digests of the plurality of condition digests, said processing in each iteration comprising concatenating a reference digest with the unique condition digest of the iteration to generate a concatenand and hashing the concatenand to generate a hashed concatenand that serves as the reference digest for the next iteration if the next iteration is performed, each unique condition digest being a different condition digest in each iteration of the loop, the regenerated reference digest of the last iteration of the loop being a last digest; and

said computer encrypting the last digest to generate a digital signature block that represents the data item and a plurality of conditions specified for the digital signature, said digital signature block comprising the digital signature and enabling cryptographic verification of both the data item and the plurality of conditions, said encrypting comprising signing the last digest with the digital signature.

16. The data processing apparatus of claim 15, wherein the reference digest is equal to a digest of the data item, and wherein the digest of the data item is formed from a hashing of the data item.

17. The data processing apparatus of claim 15, said method further comprising:

said computer hashing each condition of the plurality of conditions separately from each other and separately from the data item to generate the plurality of condition digests respectively corresponding to the plurality of conditions.

18. The data processing apparatus of claim 15, said method further comprising:

said computer generating a communication, wherein the communication comprises the digital signature block, the data item, and the plurality of conditions; and

said computer sending the communication across a network to a recipient.

19. The data processing apparatus of claim 15, said method further comprising:

said computer generating a communication, wherein the communication comprises the digital signature block and does not comprise the data item and does not comprise the plurality of conditions; and

said computer sending the communication across a network to a recipient.

20. The data processing apparatus of claim 15, wherein the method further comprises:

said computer hashing a new condition to generate a digest of the new condition;

said computer concatenating the digital signature block with the digest of the new condition to generate a new digest;

said computer hashing the new digest to generate a hashed new digest; and

said computer encrypting the hashed new digest to generate a new digital signature block that represents the data item, the plurality of conditions, and the new condition and enables cryptographic verification of the data item, the plurality of conditions, and the new condition.