Key distribution method.

BACKGROUND OF THE INVENTION

0001The invention relates to a method of distributing a key for enciphering an unenciphered or plaintext message and for deciphering the enciphered message.

0002A public key distribution method used in a public key cryptosystem as a well-known key distribution method is disclosed in a paper entitled "New Directions in Cryptography" by W. Diffie and M.E. Hellman, published in the IEEE Transactions on Information Theory, Vol. IT-22, No. 6, pp. 644 to 654, November issue, 1976. The key distribution method disclosed in the paper memorizes public information for each of conversers. In the system, before a converser A sends an enciphered message to a converser B, the converser A prepares an enciphering key (which represents a number obtained by calculating Y_B^XA (mod ₂ )) generated from public information Y_B of the converser B and secret information X_A which is kept secret by the converser A. The number ₂is a large prime number of about 256 bits in binary representation, which is publicly known. a (mod b) means a remainder of division of the number a by the number b. The converser B also prepares the key wk in accordance to Y_AX_B (mod p) in a similar manner. Y_A and Y_B are selected so as to be equal to _a^X_A (mod p) and αX_B (mod ₂), respectively. As a result, Y_B^xA (mod p ) becomes equal to Y_AX_B (mod ₂). It is known that even if Y_A, a and p are known, it is infeasible for anybody except the converser A to obtain X_A which satisfies Y_A = a^xA (mod p).

0003The prior art key distribution system of the type described, however, has disadvantages in that since the system needs a large amount of public information corresponding to respective conversers, the amount of the public information increases as the number of conversers increases. Further, strict control of such information becomes necessary to prevent the information from being tampered.

SUMMARY OF THE INVENTION

0004An object of the invention is, therefore, to provide a key distribution method free from the above-mentioned disadvantages of the prior art system.

0005According to an aspect of the invention, there is provided a method which comprises the following steps: generating a first random number in a first system; generating first key distribution information in the first system by applying a predetermined first transformation to the first random number on the basis of first secret information known only by the first system; transmitting the first key distribution information to a second system via a communication channel; receiving the first key distribution information in the second system; generating a second random number in the second system; generating second key distribution information by applying the predetermined first transformation to the second random number on the basis of second secret information known only by the second system; transmitting the second key distribution information to the first system via the channel; receiving the second key distribution information in the first system; and generating an enciphering key in the first system by applying a predetermined second transformation to the second key distribution information on the basis of the first random number and identification information of the second system which is. not secret.

0006According to another aspect of the invention, there is provided a method which comprises the following steps: generating a first random number in the first system; generating first key distribution information by applying a predetermined first transformation to the first random number on the basis of public information in the first system and generating first identification information by applying a predetermined second transformation to the first random number on the basis of first secret information known only by the first system; transmitting the first key distribution information and the first identification information to a second system via a communication channel; receiving the first key distribution information and the first identification information in the second system; examining whether or not the result obtained by applying a predetermined third transformation to the first key distribution information on the basis of the first identification information satisfies a first predetermined condition, and, if it does not satisfy, suspending key distribution processing; generating a second random number if said condition is satisfied in the preceding step; generating second key distribution information by applying the predetermined first transformation to the second random number on the basis of the public information, and generating second identification information by applying the predetermined second transformation to the second random number on the basis of second secret information known only by the second system; transmitting the second key distribution information and the second identification information to the first system via the communication channel; and examining whether or not the result obtained by applying a third predetermined transformation to the second key distribution information on the basis of the second identification information in the first system satisfies a predetermined second condition, and if the result does not satisfy the second condition, suspending the key distribution processing, or if it satisfies the second condition, generating an enciphering key by applying a fourth predetermined transformation to the first random number on the basis of the second key distribution information.

BRIEF DESCRIPTION OF THE DRAWINGS

0007Other features and advantages of the invention will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which: <ul id="ul0001" list-style="none"><li>FIG. 1 is a block diagram of a first embodiment of the invention;</li><li>FIG. 2 is a block diagram of a second embodiment of the invention; and</li><li>FIG. 3 is a block diagram of an example of systems 101, 102, 201 and 202.</li></ul>

0008In the drawings, the same reference numerals represent the same structural elements.

PREFERRED EMBODIMENTS

0009Referring now to FIG. 1, a first embodiment of the invention comprises a first system 101, a second system 102 and an insecure communication channel 103 such as a telephone line which transmits communication signals between the systems 101 and 102. It is assumed herein that the systems 101 and 102 are used by users or conversers A and B, respectively. The user A has or knows a secret integer number S_A and public integer numbers e, c, α and n which are not necessarily secret while the user B has or knows a secret integer number S_sand the public integer numbers. These integer numbers are designated and distributed in advance by a reliable person or organization. The method to designate the integer numbers will be described later.

0010An operation of the embodiment will next be described on a case in which the user A starts communication. The system 101 of the user A generates a random number γ (Step A1 in FIG. 1) and sends a first key distribution code X A representative of a number obtained by computing SA αγ (mod n) (Step A2) to the system 102 of the user B (step A3). Next, when the system 102 receives the code X_A(Step B1), it generates a random number t (Step B2), calculates (X_A^e/ID_A)^t (mod n) (Step B5), and keeps the resulting number as a enciphering key wk for enciphering a message into storage means (not shown). The identification code ID_A represents herein a number obtained by considering as a numeric value a code obtained by encoding the address, the name and so on of the user A. The encoding is, for instance, performed on the basis of the American National Standard Code for Information Interchange. Then, the system 102 transmits to the system 101 of the user A a second key distribution code X_B representative of a number obtained by calculating S_B •α^t (mod n) (Steps B3 and B4).

0011The system 101, on the other hand, receives the code X_B (Step A4), calculates (X_B^e/ID_B)^γ (mod n) (Step A5), and keeps the resulting number as the key wk for enciphering a message. The identification code ID_B represents the numbers obtained by considering as a numeric value a code obtained by encoding the name, address, and so on of the user B.

0012Subsequently, communication between the users A and B will be conducted by transmitting messages enciphered with the enciphering key wk via the channel 103.

0013The integer numbers S_A, S_B, e, c, α and n are determined as follows. n is assumed to be a product of two sufficiently large prime numbers ₂ and g. For instance, ₂ and q may be 2²⁵⁶ or so. e and c are prime numbers which are equal to or less than n, while α is a positive integer number which is equal to or less than n. Further, d is defined as an integer number which satisfies e.d (mod (p-1)•(q-1)) = 1. S A and S_B are defined as numbers obtainable from ID_A^d (mod n) and ID_B^d (mod n), respectively.

0014If S_A, S_B, e, c, α, and n are defined as above, ID_A and ID ε become equal to S_A⁸ (mod n) and S_B^e(mod n), respectively. This can be proved from a paper entitled "A Method for Obtaining Digital Signatures and Publick-Key Cryptosystems" by R.L. Rivest et al., published in the Communication of the ACM, Vol. 21, No. 2, pp. 120 to 126. Since the key obtained by (X_B^e/ID_B)^r (mod n) on the side of the user A becomes equal to α^ert (mod n) and the key obtained by (X_A^e/ID_A)^t (mod n ) on the side of the user B becomes equal to α^ert(mod n), they can prepare the same enciphering key. Even if a third party tries to assume the identity of the user A, he cannot prepare the key wk since he cannot find out z which meets ID A = Z^e (mod n).

0015Referring now to FIG. 2, a second embodiment of the invention comprises a first system 201, a second system 202 and an insecure communication channel 203. It is assumed herein that the systems 201 and 202 are used by users A and B, respectively. The user A has or knows a secret integer number S_A and public integer numbers e, c, a, and n, which are not necessarily secret while the user B has or knows a secret integer number S_Band the public integer numbers. These integer numbers are designated and distributed by a reliable person or organization in advance. The method to designate the integer numbers will be described later.

0016An operation of the embodiment will next be described on a case where the user A starts communication. The system 201 of the user A generates a random number γ (Step AA1 in FIG. 2) and determines a first key distribution code X_A representative of a number obtained by computing α^er (mod n) as well as a first identification code Y_Aindicative of a number obtained by computing S_A •α^cr(mod n) (AA2). The system 201 then transmits a first pair of X_A and Y_A to the system 202 of the user B (Step AA3). Thereafter, the system 202 receives the first pair (X_A, Y_A) (Step BB1), calculates Y_A^e /X_A^c (mod n, and examines whether or not the number obtained by the calculation is identical to the number indicated by an identification code ID_A obtained by the address, the name and so on of the user A in a similar manner to in the first embodiment (Step BB2). If they are not identical to each other, the system suspends processing of the key distribution (Step BB7). On the other hand, if they are identical to each other, the system 202 generates a random number t (Step BB3) and determines a second key distribution code X _B representative of a number obtained by calculating α^e.t (mod n) and a second identification code Y_B obtained by calculating S_B •α^c.t (mod n) (Step BB4). The system 202 then transmits a second pair of X_B and Y_B to the system 201 of the user A (Step BB5). The system 202 calculates X_A^t (mod n) and keeps the number thus obtained as a enciphering key wk (Step BB6).

0017The system 201, on the other hand, receives the second pair (X_B, Y_B) (Step AA4), calculates Y B^e/X_B^c (mod n), and examines whether or not the number thus obtained is identical to the number indicated by an identification code ID_B obtained by the address, the name and so on of the user B in a similar manner to in the first embodiment (Step AA5). If they are not identical to each other, the system suspends the key distribution processing (Step AA7). If they are identical to each other, the system 201 calculates X_B^r mod n), and stores the number thus obtained as a enciphering key wk (Step AA6). Although the codes ID_A and ID _Bare widely known, they may be informed by the user A to the user B.

0018The integer numbers S_A, S_B, e, c, α and n are determined in the same manner as in the first embodiment. As a result, ID A and ID_B becomes equal to Y_A^e/X_A^c (mod n) (= S<img file="EP0257585A2_D0001.tif" /> •α^erc/α^erc (mo_d n)) and Y_B^e/X_B^c (mod n) (= S<img file="EP0257585A2_D0002.tif" /> •α^etc/α^etc (mod n)), respectively. If we presuppose that the above-mentioned reliable person or organization who prepared S_A and S_B do not act illegally, since S_A is possessed only by the user A while S_B is possessed only by the user B, the first pair (x A, y_A) which satisfies y_A^e /x_A° (mod n) = ID_A can be prepared only by the user A while the second pair (x_B, y_B) which satisfies y_B^e/x_B^c (mod n) = ID_B can be prepared only by the user B. It is impossible to find out a number x which satisfies x^f (mod n) = b on the basis of f, band n since finding out X is equivalent to breaking the RSA public key cryptogram system disclosed in the above-mentioned the Communication of the ACM. It is described in the above-referenced IEEE Transactions on Information Theory that the key wk cannot be calculated from the codes x_A or x_B and n. The key distribution may be implemented similarly by making the integer number C variable and sending it from a user to another.

0019An example of the systems 101, 102, 201 and 202 to be used in the first and second embodiments will next be described referring to FIG. 3.

0020Referring now to FIG. 3, a system comprises a terminal unit (TMU) 301 such as a personal computer equipped with communication processing functions, a read only memory unit (ROM) 302, a random access memory unit (RAM) 303, a random number generator (RNG) 304, a signal processor (SP) 306, and a common bus 305 which interconnects the TMU 301, the ROM 302, the RAM 303, the RNG 304 and the SP 306.

0021The RNG 304 may be a key source 25 disclosed in U.S. Patent No. 4,200,700. The SP 306 may be a processor available from CYLINK Corporation under the trade name CY 1024 KEY MANAGEMENT PROCESSOR.

0022The RNG 304 generates random numbers r or t by a command given from the SP 306. The ROM 407 stores the public integer numbers e , c, a, n and the secret integer number S_A (if the ROM 407 is used in the system 101 or 201) or the secret integer number S_B (if the ROM 407 is used in the system 102 or 202). The numbers S_A and S_B may be stored in the RAM 303 from the TMU 301 everytime users communicates. According to a program stored in the ROM 407, the SP 306 executes the above-mentioned steps A2, A5, AA2, AA5, AA6 and AA7 (if the SP 306 is used in the system 101 or 201), or the steps B3, B5, BB2, BB4, BB6 and BB7 (if the SP 306 is used in the system 102 or 202). The RAM 303 is used to temporarily store calculation results in these steps.

0023Each of the systems 101, 102, 201 and 202 may be a data processing unit such as a general purpose computer and an IC (integrated circuit) card.

0024As described in detail hereinabove, this invention enables users to effectively implement key distribution simply with a secret piece of information and several public pieces of information.

0025While this invention has thus been described in conjunction with the preferred embodiments thereof, it will now readily be possible for those skilled in the art to put this invention into practice in various other manners.