Blinding techniques for protection of private keys in message signing based on elliptic curve cryptography
Techniques are provided for protection of private keys in message signing based on elliptic curve cryptography. One method comprises obtaining a private key to generate a signature for a message; selecting a random integer as an internal private key in a predefined range based on an elliptic curve order; computing an internal public key as an elliptic curve point using a scalar multiply operation based on (i) the internal private key blinded using a random blinding value, (ii) an elliptic curve base point, and (iii) an inverse value for the random blinding value added to a result of the scalar multiply operation; generating a first signature portion based on the elliptic curve point; generating a second signature portion based on an inverse of the selected random integer generated from a message-dependent value and the first signature portion; and forming a signed message using the first and second signature portions.
1. A method, comprising:
obtaining a private key of a message signer to generate a signature for a message;
selecting a random integer as an internal private key in a predefined range based at least in part on an order of an elliptic curve;
computing an internal public key as a point on the elliptic curve using (a) a scalar multiply operation based at least in part on (i) the internal private key blinded using a random blinding value and (ii) a base point of the elliptic curve, and (b) a first inverse value for the random blinding value added to a result of the scalar multiply operation;
generating a first part of the signature for the message based at least in part on the point of the elliptic curve;
generating a second part of the signature for the message based at least in part on a second inverse value of the selected random integer generated from a message-dependent value of the message and the first part of the signature; and
forming a signed version of the message using the first part of the signature and the second part of the signature,
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the predefined range based on the order of the elliptic curve is a range between 0 and the order minus one.
3. The method of claim 1 , wherein the computing further comprises computing a next blinding value, i N , based on a doubling of a prior blinding value, i N−1 ;
and computing a next blinding inverse value, I N , for the next blinding value based on a doubling of a prior blinding inverse value, I N−1 .
4. The method of claim 3 , wherein the computing further comprises blinding the internal private key based on an addition of the next blinding value, i N , to the internal private key.
5. The method of claim 1 , wherein the generating the first part of the signature for the message based on the point of the elliptic curve applies an operation to an integer version of one coordinate of the point of the elliptic curve.
6. The method of claim 1 , wherein the generating the second part of the signature for the message further comprises multiplying the first part of the signature by a private key of the message signer and adding a result to the message-dependent value of the message.
7. The method of claim 1 , further comprising verifying the message by extracting one or more of the first part of the signature and the second part of the signature from the signed version of the message.
8. The method of claim 1 , wherein the message-dependent value comprises one or more of a digest of the message and a hash of the message.
9. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
obtaining a private key of a message signer to generate a signature for a message;
selecting a random integer as an internal private key in a predefined range based at least in part on an order of an elliptic curve;
computing an internal public key as a point on the elliptic curve using (a) a scalar multiply operation based at least in part on (i) the internal private key blinded using a random blinding value and (ii) a base point of the elliptic curve, and (b) a first inverse value for the random blinding value added to a result of the scalar multiply operation;
generating a first part of the signature for the message based at least in part on the point of the elliptic curve;
generating a second part of the signature for the message based at least in part on a second inverse value of the selected random integer generated from a message-dependent value of the message and the first part of the signature; and
forming a signed version of the message using the first part of the signature and the second part of the signature.
10. The computer program product of claim 9 , wherein the computing further comprises computing a next blinding value, i N , based on a doubling of a prior blinding value, i N−1 ; and computing a next blinding inverse value, I N , for the next blinding value based on a doubling of a prior blinding inverse value, I N−1 .
11. The computer program product of claim 10 , wherein the computing further comprises blinding the internal private key based on an addition of the next blinding value, i N , to the internal private key.
12. The computer program product of claim 9 , wherein the generating the first part of the signature for the message based on the point of the elliptic curve applies an operation to an integer version of one coordinate of the point of the elliptic curve.
13. The computer program product of claim 9 , wherein the generating the second part of the signature for the message further comprises multiplying the first part of the signature by a private key of the message signer and adding a result to the message-dependent value of the message.
14. The computer program product of claim 9 , wherein the message-dependent value comprises one or more of a digest of the message and a hash of the message.
15. An apparatus, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps:
obtaining a private key of a message signer to generate a signature for a message;
selecting a random integer as an internal private key in a predefined range based at least in part on an order of an elliptic curve;
computing an internal public key as a point on the elliptic curve using (a) a scalar multiply operation based at least in part on (i) the internal private key blinded using a random blinding value and (ii) a base point of the elliptic curve, and (b) a first inverse value for the random blinding value added to a result of the scalar multiply operation;
generating a first part of the signature for the message based at least in part on the point of the elliptic curve;
generating a second part of the signature for the message based at least in part on a second inverse value of the selected random integer generated from a message-dependent value of the message and the first part of the signature; and
forming a signed version of the message using the first part of the signature and the second part of the signature.
16. The apparatus of claim 15 , wherein the computing further comprises computing a next blinding value, i N , based on a doubling of a prior blinding value, i N−1 ; and computing a next blinding inverse value, I N , for the next blinding value based on a doubling of a prior blinding inverse value, I N−1 .
17. The apparatus of claim 16 , wherein the computing further comprises blinding the internal private key based on an addition of the next blinding value, i N , to the internal private key.
18. The apparatus of claim 15 , wherein the generating the first part of the signature for the message based on the point of the elliptic curve applies an operation to an integer version of one coordinate of the point of the elliptic curve.
19. The apparatus of claim 15 , wherein the generating the second part of the signature for the message further comprises multiplying the first part of the signature by a private key of the message signer and adding a result to the message-dependent value of the message.
20. The apparatus of claim 15 , wherein the message-dependent value comprises one or more of a digest of the message and a hash of the message.