Patent Grant
7149763
The present invention relates to the generation of electronic keys for use in public key cryptography, and more particularly to the generation of a random number, for use in constructing such keys, that is particularly well suited for an environment having limited processing resources such as portable electronic device.
A variety of public key cryptography protocols are known for encoding information, authenticating entities to one another, and electronically signing messages. Examples of such protocols include RSA, El Gamal, Schnorr and Fiat Schamir. A common feature of public key cryptography protocols is the fact that they employ large prime numbers, with typical lengths in the range of 512–2048 bits, to form one or more keys of the protocol. Some of these cryptosystems, such as RSA for example, require the random generation of several distinct prime numbers. Thus, generating prime numbers is an essential tool in public key cryptography.
When efficiency is not a concern, one of the simplest ways to generate a random prime number is to select a random number q and test it for primality. If the test is unsuccessful, the value for q is incremented by one, and the test is rerun. Since all prime numbers except two are odd, a straightforward improvement on this technique is to choose q as an odd value, and to update it in increments of two for each successive iteration of the test. However, this technique can become computationally intensive and is therefore not practical in a number of situations when large-sized numbers are employed.
To facilitate the random number selection process, several techniques have been developed that make it possible to more efficiently calculate the greatest common denominator of two numbers, and thereby determine whether they are co-prime. Examples of those techniques include Binary GCD, Extended GCD and the Lehmer formula. While these techniques exhibit excellent asymptotic complexity for numbers of extremely large size, they are difficult to program in an environment having limited processing resources, such as a smart card or other portable electronic device. In addition, they provide relatively poor performance for operations involving numbers of the size typically employed in the smart card environment, e.g. in the range of 512 to 1024 bits. To increase the performance, it is possible to equip the card with an arithmetic coprocessor to carry out some of the operations of the primality test. However, other operations that are performed as part of the test, such as parity checking and binary shifts, are not compatible with the functionality typically offered in an arithmetic coprocessor. As a result, the overall performance still suffers.
To address these issues, one technique for generating a random prime number is disclosed in published PCT Application WO 02/05483, the contents of which are incorporated herein by reference. This application discloses a method for generating an electronic key from a prime number q contained in a specific interval of positive integers [qmin, qmax]. In this method, a positive integer x is chosen with x being the product of k prime numbers, where k is a maximum so that there exist two positive integers εm and εM, such that εm is the higher roundoff of qmin/x, and εM is the lower roundoff of (qmax−qmin)/x. The values π=εM·x and ρ=εm·x are calculated, and two positive integers a and c belonging to the multiplicative group Zπ* of integers (modulo π) are selected. Once these precalculations have been made, a candidate value q=c+ρ is calculated, and the primality of q is tested. If q is a prime number, it is returned, or stored, as the random prime number of interest. Otherwise, c is updated by calculating ac (modulo π) and repeating the preceding operation with the new value q=c+ρ.
A limitation associated with this approach can arise from the fact that the precalculated data approximates the interval [qmin, qmax] only when the value for ρ is close to qmin and the value for ρ+π is close to qmax. The values for π and ρ are therefore a function of the desired interval. A different interval requires a different set of precalculated values. The need to store all of these values may be undesirable in an environment having limited storage capacity, such as a portable electronic device.
It is an objective of the present invention to reduce the number of precalculated values, and thereby achieve an economy of storage. It is a further objective to provide a finer approximation of the interval [qmin, qmax] of interest, while utilizing a value for π that can be applied over a number of different intervals.
The present invention generates a random prime number within a predetermined interval by precalculating and storing a single value that functions as a universal parameter for generating prime numbers of any desired size. In accordance with the invention, a number π is chosen that is the product of k prime numbers. This number is chosen such that (a) k is a maximum and (b) the ratio (qmax−qmin−π)/(qmax−qmin)) is lower than a desired limit. A number a is also chosen such that the greatest common denominator of a and π is equal to 1, i.e. a is co-prime with π. Once the values for π and a have been determined they can be stored, for example in a ROM or EEPROM, and used for all subsequent iterations of the prime number generating algorithm.
The algorithm for generating a random prime number within an interval [qmin, qmax] then comprises the following steps:
Since a single value, namely π, needs to be precalculated, economies of storage are achieved. In addition, the interval of interest is approximated with a higher degree of resolution. Moreover, it is possible to utilize the same value of π for a number of different intervals.
Further features of the invention are explained in detail hereinafter, with reference to exemplary embodiments illustrated in the accompanying drawings.
To facilitate an understanding of the invention, it is described hereinafter with reference to its implementation in a smart card having a microprocessor. It will be appreciated, however, that the smart card is exemplary of a variety of different types of portable electronic devices for which the invention is particularly suited, and therefore this illustrative description should not be construed as limiting the invention in any manner.
In the implementation of public key cryptography protocols, such as the RSA algorithm, for example, it is necessary to select a pair of integers p,q of given length that are co-prime with each other, for use in generating electronic keys for the protocol. To ensure that the selected numbers are co-prime with each other, a step of verifying co-primeness is performed. In the case of a portable electronic device with a microprocessor, such as a smart card, the test is performed within the card. Examples of tests for verifying the co-primeness are set forth, for example, in IEEE 1363 standard for public-key cryptography, and in ISO/IEC WD 18032 working draft of Apr. 18, 2001.
In practice, in the RSA protocol, confidentiality of the keys is ensured when the two integer numbers p and q are prime with each other and have a fixed length, for example, 512 or 1024 bits each. Typically, one of the two numbers p is an integer number that is selected in advance from amongst a set of numbers stored in the microprocessor card. The other number q is generated in a random fashion by the microprocessor card when the protocol is to be executed. For this purpose, the microprocessor card has a random number generator that is capable of supplying an integer number of the requisite size.
The present invention generates a prime number q within the interval [qmin, qmax] In a preferred embodiment of the invention, the generated prime number complies with the ISO/IEC standard described previously. In a typical case, qmax=2n−1, and qmin=2n−1+1, to generate n-bit primes. Alternatively, qmin=√{right arrow over ( )}(22n−1+1), to generate 2n-bit RSA moduli of the form N=pq, with p and q being prime numbers. A general approach to the generation of prime numbers is described hereinafter, followed by a more refined approach in accordance with a preferred embodiment of the invention.
The generation of a prime number in accordance with the present invention comprises a setup phase and an implementation phase. For the setup phase, let 0<ε≦1 denote a quality parameter, wherein a typical value for ε is 10−3. The setup phase calculates a product of primes π=Πlpi such that there exist integers t, v and w that satisfy the following properties:
vπ+t≧q
min (P2)
(v+w)π+t−1≦qmax; and (P3)
the ratio φ(π)/π is as small as possible. (P4)
where φ(x) is Euler's totient function defined for any number x with prime factorization x=Πplel(ei≧1) as φ(x)=Πplei−1(pi−1).
Referring to
The general algorithm is represented in the flow chart of
It is worth noting that if both a and x are elements of the set of units Zm*, their product ax is likewise an element of this set, since it is a multiplicative group. Thus, for each implementation of the algorithm, x remains co-prime to m and thus to π. This, in turn, implies that q is co-prime to π since q=[(x−t)mod m]+t+l=x (mod π), and x is an element of multiplicative group Zπ*. Consequently, the probability that a candidate q is a prime number at step 30 is high.
This algorithm can be refined to increase the speed with which it is performed. The optimal value for t is t=0. Furthermore, it is advantageous to select a so that multiplication by a modulo π does not require significant computational resources. The best value is a=2. However, 2 must belong to Zπ* and, due to the fourth property (P4) described previously, 2 is a factor of π, which is a contradiction. The next best approach, therefore, is to select an odd value for π, so that 2 belongs to Zπ*, and to revise the algorithm so that q is always odd. This means that π=πi pi with pi≠2, and integers v and w are odd to satisfy the properties:
vπ+1≧qmin (P2′)
(v+w)π−1≦qmax (P3′)
The modified algorithm is illustrated in the flow chart of
At step 30, q is checked for primality. If it is not prime, then x is set to 2x(mod m) at step 41, and the process returns to step 21. Once q is determined to be prime, it is returned at step 50, to generate the cryptographic key.
From the foregoing, it can be seen that the present invention provides a method for generating a random prime number within a predetermined interval, that only requires the precalculation of a single value, π. Furthermore, the properties of this value enable it to be used for multiple different intervals. For instance, if the value of π is precalculated for a corresponding interval [qmin, qmax], it is possible to generate a prime number within the interval [2kqmin, 2kqmax] by setting π=2kπ as a parameter of the prime number generating algorithm, since the properties of the pre-calculation phase are preserved. Hence, a single precalculated value for π can be used to generate prime numbers of any size which need not be pre-specified. As an added advantage, the algorithm is very easy to implement with a coprocessor, since it only requires modular calculation.
It will be appreciated by those of ordinary skill in the art that the present invention can be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The presently disclosed embodiments are therefore considered in all respects to be illustrative, and not restrictive. The scope of the invention is indicated by the appended claims, rather than the foregoing description, and all changes that come within the meaning and range of equivalents thereof are intended to be embraced therein.
| Number | Name | Date | Kind |
|---|---|---|---|
| 6141668 | Shimada | Oct 2000 | A |
| 6718536 | Dupaquis | Apr 2004 | B1 |
| Number | Date | Country |
|---|---|---|
| 0205483 | Jan 2002 | WO |
| Number | Date | Country | |
|---|---|---|---|
| 20040049526 A1 | Mar 2004 | US |
