Masked digital signatures
View Patent ↗A method for creating and authenticating a digital signature is provided, including selecting a first session parameter k and generating a first short term public key derived from the session parameter k, computing a first signature component r derived from a first mathematical function using the short term public key, selecting a second session parameter t and computing a second signature component s derived from a second mathematical function using the second session parameter t and without using an inverse operation, computing a third signature component using the first and second session parameters and sending the signature components (s, r, c) as a masked digital signature to a receiver computer system. In the receiver computer system, a recovered second signature component s′ is computed by combining a third signature component with the second signature component to derive signature components (s′, r) as an unmasked digital signature.
1. A method of avoiding performing an inversion operation of a digital signature protocol in a secure boundary of a sender device, the method comprising:
the sender device generating a first short term private key k and a second short term private key t in the secure boundary;
the sender device computing a first signature component r and a second signature component s using the second short term private key t to avoid the inversion operation of the digital signature protocol;
the sender device computing a third signature component c by masking the first short term private key k using the second short term private key t; and
the sender device forwarding the first signature component r, the second signature component s and the third signature component c as a masked digital signature (r, s, c) to a receiver device outside the secure boundary.
2. The method of claim 1 further comprising the receiver device computing a regular signature component s by performing an inversion operation on the third signature component c, and using the regular signature component s and the first signature component r as a regular digital signature corresponding to the digital signature protocol.
3. The method of claim 2 further comprising the receiver device verifying said regular digital signature.
4. The method of claim 2 further comprising the receiver device sending said regular digital signature to a verifier device for verification of said regular digital signature.
5. The method of claim 1 , wherein said first short term private key k is an integer and said first signature component r is computed using a first short term public key, wherein said first short term public key is computed by calculating the value kP=(x 1 ,y 1 ), wherein P is a point of prime order n in E(F q ), and wherein E is an elliptic curve defined over F q .
6. The method of claim 5 , wherein said first signature component r is of the form r= x (mod n), wherein x is derived by converting said coordinate x 1 to an integer.
7. The method of claim 5 , wherein said second short term private key is an integer selected such that 2≦t≦(n−2), and said second signature component is defined as s=t(e+dr)(mod n), wherein e is a hash of a message m.
8. The method of claim 2 , wherein said third signature component is defined as c=tk(mod n).
9. The method of claim 2 , wherein said regular signature component s is defined as s =c −1 s (mod n) and wherein said first short term private key k is an integer and said first signature component r is computed using a first short term public key, wherein said first short term public key is computed by calculating the value kP=(x 1 ,y 1 ), wherein P is a point of prime order n in E(F q ), and wherein E is an elliptic curve defined over F q .
10. A non-transitory computer-readable storage medium configured to be accessed by a processor for avoiding performing an inversion operation of a digital signature protocol in a secure boundary of a sender device, said computer-readable storage medium storing computer executable instructions for:
generating a first short term private key k and a second short term private key t in the secure boundary;
computing a first signature component r and a second signature component s using the second short term private key t to avoid the inversion operation of the digital signature protocol;
computing a third signature component c by masking the first short term private key k using the second short term private key t; and
forwarding the first signature component r, the second signature component s and the third signature component c as a masked digital signature (r, s, c) to a receiver device outside the secure boundary.
11. A device for avoiding performing an inversion operation of a digital signature protocol in a secure boundary of the device, the device comprising a processor configured to:
generate a first short term private key k and a second short term private key t in the secure boundary;
compute a first signature component r and a second signature component s using the second short term private key t to avoid the inversion operation of the digital signature protocol;
compute a third signature component c by masking the first short term private key k using the second short term private key t; and
forward the first signature component r, the second signature component s and the third signature component c as a masked digital signature (r, s, c) to a receiver device outside the secure boundary.
12. The device of claim 11 , wherein said first short term private key k is an integer and said first short term public key is computed by calculating the value kP=(x 1 ,y 1 ), wherein P is a point of prime order n in E(F q ), and wherein E is an elliptic curve defined over F q .
13. The device of claim 12 , wherein said first signature component r is of the form r= x (mod n), wherein x is derived by converting said coordinate x 1 to an integer.
14. The device of claim 12 , wherein said second short term private key is an integer selected such that 2≦t≦(n−2), and said second signature component is defined as s=t(e+dr)(mod n), wherein e is a hash of a message m.
15. The device of claim 11 , wherein said third signature component is defined as c=tk(mod n).
16. A non-transitory computer-readable storage medium configured to be accessed by a processor for avoiding performing an inversion operation of a digital signature protocol in a secure boundary of a sender device, said computer-readable storage medium storing computer executable instructions for:
receiving a masked digital signature from the sender device, the masked signature having a first signature component r, a second signature component s computed using a second short term private key t to avoid the inversion operation of the digital signature protocol, and a third signature component c computed by masking a first short term private key k using the second short term private key t; and
computing a regular signature component s by performing an inversion operation on the third signature component c, and using the regular signature component s and the first signature component r as a regular digital signature corresponding to the digital signature protocol.
17. A device for avoiding performing an inversion operation of a digital signature protocol in a secure boundary of a sender device, the device comprising a processor configured to:
receive a masked digital signature from the sender device, the masked signature having a first signature component r, a second signature component s computed using a second short term private key t to avoid the inversion operation of the digital signature protocol, and a third signature component c computed by masking a first short term private key k using the second short term private key t; and
compute a regular signature component s by performing an inversion operation on the third signature component c, and using the regular signature component s and the first signature component r as a regular digital signature corresponding to the digital signature protocol.
18. The device of claim 17 , wherein the processor is further configured to verify said regular digital signature.
19. The device of claim 17 , wherein the processor is further configured to send said regular digital signature to a verifier device for verification of said regular digital signature.
20. The device of claim 17 , wherein said regular signature component s is defined as s =c −1 s (mod n) and wherein said first short term private key k is an integer and said first signature component r is computed using a first short term public key, wherein said first short term public key is computed by calculating the value kP=(x 1 ,y 1 ), wherein P is a point of prime order n in E(F q ), and wherein E is an elliptic curve defined over F q .