Proxy signature scheme based on McEliece public key ...secmeeting.ihep.ac.cn/paper/Slides_Zhao_Chengcheng_ICDFI2012.pdf · 1. Introduction Computer forensics is the technology of

Zhao Cheng-cheng, Li Zi-chen , Yang Ya-tao

Beijing Electronic Science and Technology Institute

Proxy signature scheme based on McEliece public key cryptosystem

Context Introduction 1

Main idea 2

Detail of scheme 3

Analysis 4

Conclusion 5

Context Introduction 1

Main idea 2

Detail of scheme 3

Analysis 4

Conclusion 5

1. Introduction Computer forensics is the technology of applyi

ng computer technology to access, investigate and analyze the evidence of computer crimes.

It mainly includes the processes of determining and obtaining digital evidence, analyzing and

taking data, filing and submitting result. Hence, digital signature is very useful for computer

forensics.

1. Introduction As we all know, the security of digital signature base

on difficult problem, eg. RSA-PSS(R) base on Factorization Problem, DSA and ECDSA base on Discrete Logarithm Problem. However, Peter Shor proposed a Quantum Algorithm, which can solve Factorization Problem and Discrete Logarithm Problem within polynomial time.

1. Introduction With quantum computer, Peter Shor algorithm can br

eak all digital signature schemes that based on Factorization Problem or Discrete Logarithm Problem. Therefore, the security of digital signature is faced with serious threat. The so-called post-quantum public key cryptosystem has became the focus of research. McEliece public key cryptosystem is one of it.

Context Introduction 1

Main idea 2

Detail of scheme 3

Analysis 4

Conclusion 5

2. Main idea 2.1 McEliece public key cryptosystem Key generation: The Public Keys The public key is given by the public generator matrix over binary field , where is a generator ma

trix of the secret code . The Private Keys The McEliece secret key consists of the Goppa polynomial of degree t defining the secret code , an perm

utation matrix P and a non-singular matrix S over binary field .

n k×p sG SG P= 2F

sGΓ

( )g Y Γ n n×k k×

2F

2. Main idea The Encryption Process To encrypt a message , where is binary field, the us

er choose a random vector with hamming weight , and compute that , where e is a ran

dom error vector, then obtain the ciphertext c. The Decryption Process First, we calculate that , then we use the rapid Goppa code decoding algorithm to

the . Since the hamming weight of and are equal that is = = t, we can get mS by decoding.

Finally, the plaintext m can be recovered from calculating .

2m F∈ 2F

2e F∈( )wH e t= pc mG e= +

' T T T T T Tc cP H mSGPP H eP H= = +

T TeP H TeP e( )T

HW eP ( )HW e

1mSS −

Context Introduction 1

Main idea 2

Detail of scheme 3

Analysis 4

Conclusion 5

3. Detail of scheme Parameter Selection Original signer A choose a error-correcting binary Goppa codes . As for , there exists a generator matrix and a parity check matrix . Then choose an permut

ation matrix P and a non-singular matrix S over . Our main task is looking for the matrix to make be established, where is a unit matrix.

Let , and . Suppose original signer A is honest, choose another correspondi

ng generator matrix for code and generate a non-singular matrix to make satisfied. We keep

and secret as private key and give it to proxy signer B.

AC AC nk × AG

nkn ×− )( AH n n×k k× 2F

*AG kAA IGG =*

kI1*1 −−= AAAA SGPJ 1* −= AAA SGW T

AAA HPT 1−=

nk × BG ACk k× BS AABB GSGS =

BS BG

3. Detail of scheme

Public key

Private key

Original Signer A

and （where are

integers less than ）

Proxy Signer B The same as A

List 1. Parameter List of Proxy Signature

AAAAA tHTWJ ,,,,

AAA PGS ,,'tAt

't

ABB PGS ,,

3. Detail of scheme 3.2 Signature Process Proxy signer B sign message as follows: 1) Randomly select a binary vector with the length of n, and

hamming weight is ; 2) Signature calculate by 3.3 Verification Process Because the whole signature process may be disturbed by nois

e, thus signature may make a mistake. Therefore let received signature be , then the verification process is as follows:

First, we compute

jm

je')( teW j =

jc ABBjjj PGSmec )( +=

'jc

Ajj TccD ''1 )( =

TAAABBjj HPPGSme 1'])[( −+=

TABBj

TAj HGSmHe += '

3. Detail of scheme From the above, we will get through Berlekamp-Ma

ssey algorithm. Compare the hamming weight of and , if or generate decoding error, the recei

ver will request retransmit the signature. If , then go on the next step. Let , then receiver calculate and verify

whether the value of is equal to . The signature is effective if the answer is yes, or it is invalid.

'je

'je

je '' )( teW j ≠

'' )()( teWeW jj ==

Ajjj JccDcD == )()( 2'

2

AjAjAjjjj WeJcWecDcDcD +=+== )()()( 23'

3)( '

3 jcD jm

Context Introduction 1

Main idea 2

Detail of scheme 3

Analysis 4

Conclusion 5

4. Analysis 4.1 Correctness Analysis Let , substitute and

for and respectively, we get And then we compute that

Ajjj JccDcD == )()( 2'

2 BBjj GSme + 1*1 −−AAA SGP

jc AJ

)()( 2'

2 jj cDcD =

Aj Jc=1*1])[( −−+= AAAABBjj SGPPGSme

1*1* −− += AABBjAAj SGGSmSGe

)()( 3'

3 jj cDcD =

Ajj WecD += )(21*1*1* −−− ++= AAjAABBjAAj SGeSGGSmSGe

1*1*1* −−− ++= AAjAAAAjAAj SGeSGGSmSGe

jm=

4. Analysis Receiver verify by public key to see whether it

is equal to . The sign is effective if it is, otherwise the sign is invalid. 4.2 Security Analysis 1) Verifiability All the needed parameters for verification are open. Such as identity authentication, message m, public ke

ys, etc. Therefore any verifier can verify the effectiveness of proxy signature.

2) Distinguishability Since the private keys of original signer and proxy sig

ner are different, verifier can verify the validity of signature easily.

)( '3 jcD

jm

4. Analysis 3) Non-repudiation Once there is a dispute, verifier could judge by equation . If , it is proxy signature, or it is original signature. 4) Non-forgeability It is equivalent to the matrix decomposition NPC problem. Att

acker can’t obtain private key, neither can he forge proxy signature. At the beginning, we suppose the original signer is honest, so he couldn’t forge proxy signature, either.

5) Prevent the abuse of signature Every time, original signer select private key and give it to pro

xy signer secretly, i.e., original signer authorize to proxy signer. Therefore, proxy signer not allowed signing unauthorized document. Of course, the original signer not permit to transfer signature right illegally.

1*1*1*'3 )( −−− ++= AAjAABBjAAjj SGeSGGSmSGecD jj mcD =)( '

3

4. Analysis 4.2 Efficiency Analysis We choose different length of plaintexts and sign the

m respectively. Plaintexts are 128bytes, 256bytes, 512bytes and 1024bits.

Graph 1. Comparison signature time of RSA and McEliece

Context Introduction 1

Main idea 2

Detail of scheme 3

Analysis 4

Conclusion 5

5.Conclusion From the graph1 above we can find that McEliece pro

xy signature is much faster than RSA proxy signature. So McEliece proxy signature is superior to RSA proxy signature in efficiency.

According to security analysis, to solve private keys is equivalent to matrix decomposition NPC problem. Therefore, it is impossible to decipher private keys. Neither can he decipher ciphertext.

Acknowledgment This work is supported by the National Natural Scien

ce Foundation of China under Grants No. 61070219.