Verifying implicit certificates and digital signatures

1. A computer implemented method for verifying a digital signature, the method comprising:

accessing a digital signature associated with an entity, wherein the digital signature includes a first signature element r and a second signature element s;

accessing a message m associated with the digital signature (r,s);

accessing an implicit certificate issued by a certificate authority and associated with the entity, the implicit certificate including a first elliptic curve point P representing a public key reconstruction value of the entity;

accessing a second elliptic curve point C 1 representing a pre-computed multiple of a public key C of the certificate authority;

accessing a third elliptic curve point G 1 representing a pre-computed multiple of a generator point G, the generator point G representing a generator of an elliptic curve group of order n;

obtaining a fourth elliptic curve point R based on the first signature element r;

computing a first integer u and a second integer v based on the digital signature, wherein the first integer u and the second integer v are each less than √{square root over (n)};

computing a hash h of the message m;

computing a third integer λ 0 and a fourth integer λ 1 such that λ=λ 0 +λ 1 2 ┌t/2┐ , where t=┌log 2 (n+1)┐, λ=hv/s;

computing a fifth integer γ 0 and a sixth integer γ 1 such that γ=γ 0 +γ 1 2 ┌t/2┐ , where γ=vr/s;

verifying that λ 0 G+λ 1 G 1 +γ 0 C+γ 1 C 1 +uP−vR= to verify the digital signature by data processing apparatus, where represents an identity element of the elliptic curve group.

2. The method of claim 1 , comprising:

generating a plurality of scalar multiples based on a plurality of half-length scalars and a plurality of elliptic curve points, wherein each of the scalar multiples is generated by multiplying one of the plurality of half-length scalars by one of the plurality of elliptic curve points, and the plurality of elliptic curve points includes the first elliptic curve point P and the second elliptic curve point C 1 ,

wherein verifying the digital signature includes combining the plurality of scalar multiples according to a digital signature verification equation.

3. The method of claim 2 , wherein each of the half-length scalars has a bit length less than or equal to ┌t/2┐.

4. The method of claim 1 , wherein verifying the digital signature provides verification that the implicit certificate is valid.

5. The method of claim 1 , further comprising, prior to accessing the digital signature associated with the entity:

computing the second elliptic curve point C 1 =2 ┌t/2┐ C;

computing the third elliptic curve point G 1 =2 ┌t/2┐ G; and

storing the second elliptic curve point C 1 and the third elliptic curve point G 1 for subsequent access.

6. A computing device comprising:

one or more hardware processors configured to:

access a digital signature associated with an entity, wherein the digital signature includes a first signature element r and a second signature element s;

access a message m associated with the digital signature (r,s);

access an implicit certificate issued by a certificate authority and associated with the entity, the implicit certificate including a first elliptic curve point P representing a public key reconstruction value of the entity;

access a second elliptic curve point C 1 representing a pre-computed multiple of a public key C of the certificate authority;

access a third elliptic curve point G 1 representing a pre-computed multiple of a generator point G, the generator point G representing a generator of an elliptic curve group of order n;

obtain a fourth elliptic curve point R based on the first signature element r;

compute a first integer u and a second integer v based on the digital signature, wherein the first integer u and the second integer v are each less than √{square root over (n)};

compute a hash h of the message m;

compute a third integer λ 0 and a fourth integer λ 1 such that λ=λ 0 +λ 1 2 ┌t/2┐ , where t=┌log 2 (n+1)┐, λ=hv/s;

compute a fifth integer γ 0 and a sixth integer γ 1 such that γ=γ 0 +γ 1 2 ┌t/2┐ , where γ=vr/s;

verify that λ 0 G+λ 1 G 1 +γ 0 C+γ 1 C 1 +uP−vR= to verify the digital signature, where represents an identity element of the elliptic curve group.

7. The computing device of claim 6 , further comprising one or more memory components, wherein the one or more processors are configured to access the second elliptic curve point from the one or more memory components.

8. The computing device of claim 6 , further comprising one or more communication interface components, wherein the implicit certificate and the digital signature are received by the one or more communication interface components from another computing device.

9. The computing device of claim 6 , wherein the one or more processors are configured to:

generate a plurality of scalar multiples based on a plurality of half-length scalars and a plurality of elliptic curve points, wherein each of the scalar multiples is generated by multiplying one of the plurality of half-length scalars by one of the plurality of elliptic curve points, and the plurality of elliptic curve points includes the first elliptic curve point P and the second elliptic curve point C 1 ,

wherein verifying the digital signature includes combining the plurality of scalar multiples according to a digital signature verification equation.

10. The computing device of claim 9 , wherein each of the half-length scalars has a bit length less than or equal to t/2.

11. The computing device of claim 6 , wherein verifying the digital signature provides verification that the implicit certificate is valid.

12. A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations for verifying a digital signature, the operations comprising:

accessing a digital signature associated with an entity, wherein the digital signature includes a first signature element r and a second signature element s;

accessing a message m associated with the digital signature (r,s);

accessing an implicit certificate issued by a certificate authority and associated with the entity, the implicit certificate including a first elliptic curve point P representing a public key reconstruction value of the entity;

accessing a second elliptic curve point C 1 representing a pre-computed multiple of a public key C of the certificate authority;

accessing a third elliptic curve point G 1 representing a pre-computed multiple of a generator point G, the generator point G representing a generator of an elliptic curve group of order n;

obtaining a fourth elliptic curve point R based on the first signature element r;

computing a first integer u and a second integer v based on the digital signature, wherein the first integer u and the second integer v are each less than √{square root over (n)};

computing a hash h of the message m; computing a third integer λ 0 and a fourth integer λ 1 such that λ=λ 0 +λ 1 2 ┌t/2┐ , where t=┌log 2 (n+1)┐, λ=hv/s;

computing a fifth integer γ 0 and a sixth integer γ 1 such that γ=γ 0 +γ 1 2 ┌t/2┐ , where γ=vr/s;

verifying that λ 0 G+λ 1 G 1 +γ 0 C+γ 1 C 1 +uP−vR= to verify the digital signature, where represents an identity element of the elliptic curve group.

13. The computer-readable medium of claim 12 , the operations comprising:

generating a plurality of scalar multiples based on a plurality of half-length scalars and a plurality of elliptic curve points, wherein each of the scalar multiples is generated by multiplying one of the plurality of half-length scalars by one of the plurality of elliptic curve points, and the plurality of elliptic curve points includes the first elliptic curve point and the second elliptic curve point,

wherein verifying the digital signature includes combining the plurality of scalar multiples according to a digital signature verification equation.

14. The computer-readable medium of claim 13 , wherein each of the half-length scalars has a bit length less than or equal to t/2.

15. The computer-readable medium of claim 12 , wherein verifying the digital signature provides verification that the implicit certificate is valid.

16. The computer-readable medium of claim 12 , the operations further comprising, prior to accessing the digital signature associated with the entity:

computing the second elliptic curve point; and

storing the second elliptic curve point for subsequent access.

17. The method of claim 1 , wherein verifying the digital signature includes combining the second elliptic curve point C 1 with a first half-length scalar, and combining the public key C of the certificate authority with a second half-length scalar, and the first and second half-length scalars are computed based on the digital signature.