IdentityBased Cryptosystems and Signature Schemes

1
Identity-Based Cryptosystems and Signature Schemes

• Adi Shamir
• Presenter An Liu

2
Adi Shamir (from Wikipedia)

• Education
• BS, Mathematics, Tel Aviv University (1973)
• MSc, Computer Science, Weizmann Institute (1975)
• PhD, Computer Science, Weizmann Institute (1977)
• Did research at MIT from 19771980
• faculty of Mathematics and Computer Science of
  the Weizmann Institute

3
Adi Shamir

• Research
• RSA (2002 ACM Turing Award)
• Feige-Fiat-Shamir Identification Scheme
• Shamir secret sharing scheme
• the breaking of the Merkle-Hellman cryptosystem
• visual cryptography
• TWIRL and TWINKLE factoring devices
• differential cryptanalysis (already known and
  kept secret by IBM and NSA)

4
Basic Idea

• Use identity as the key for encryption and
  signature verification.
• No key directory needed.
• Trusted key generation center (KGC)
• Give each user a smart card when user first joins
  the network.
• Each user uses the secrete key in smart card for
  decryption and signature verification.
• KGC can be closed after all cards are issued.

5
Basic Idea (Contd)
6
Basic Idea (Contd)
7
Security

• The security of underlying cryptographic
  functions.
• The secrecy at KGC.
• Identity check before issuing cards to users.
• The loss, duplication and unauthorized use of
  cards.

8
Implementation of Signature Scheme

• KGC chooses three public parameters. The
  factorization of n is only known by KGC.
• npq, p and q are large primes
• e, which is relatively prime to f(n)
• f, which is one way function
• The secrete key corresponding identity i is g
• ge i (mod n)
• KGC can compute g easily. Why?
• ed 1 (mod f(n))
• id (ge)d (mod n) g

9
Signature Generation and Verification

• Signature generation
• Choose random number r
• t re (mod n)
• s g r f(t,m) (mod n)
• Signature is (t, s)
• Signature verification
• se i t f(t,m) (mod n)
• se ge r e f(t,m) (mod n)

10
Misc

• Multiplicative relationship between the
  identities will introduce same relationship
  between secret key.
• Expand identity to pseudo-random string
• r can not be reused or revealed