Elgamal signature schemes
AssigneeCerticom Corp.
InventorDaniel Richard L. Brown
Life of this patent
Estimating the term…
Abstract
There is disclosed a method of generating a digital signature of a message m. A signature component s of the digital signature is calculated by first masking the long-term private key d using a single additive operation to combine the key d with a first value. The masked value is then multiplied by a second value to obtain component s. The first value is calculated using the message m and another component of the digital signature, and the second value is derived using the inverse of a component of the first value. In this way, the signature component s is generated using a method that counters the effectiveness of side channel attacks, such as differential side channel analysis, by avoiding a direct multiplication using long-term private key d.
Claims14
A method of generating a digital signature of a message in a cryptographic data communication system based on an underlying group, the method being performed by a correspondent in the data communication system, the correspondent having a processing unit and having stored in memory a long-term private key, the method comprising:
- (a) the processing unit obtaining an ephemeral private key and deriving a first signature component using said ephemeral private key;
- and
- (b) the processing unit generating a second signature component by performing operations comprising:
- (i) calculating a first value using said first signature component and said message;
- (ii) obtaining said long-term private key from the memory and performing a single additive operation on said long-term private key to combine said long-term private key with said first value to obtain a masked value, thereby inhibiting exposure of said long-term private key in subsequent operations;
- (iii) deriving a second value using an inverse of a component of said first value;
- and
- (iv) multiplying said masked value with said second value to obtain said second signature component.
Dependencies are inferred from the claim text.