CAN CSA-ISO IEC 14888-3B-2013 Information technology - Security techniques - Digital signatures with appendix - Part 3 Discrete logarithm based mechanisms AMENDMENT 2 Optimizing ha.pdf

1、Information technology Security techniques Digital signatures with appendix Part 3: Discrete logarithm based mechanisms AMENDMENT 2: Optimizing hash inputs Amendment 2:2013 (IDT) toNational Standard of CanadaCAN/CSA-ISO/IEC 14888-3-07(ISO/IEC 14888-3:2006, IDT)NOT FOR RESALE. / PUBLICATION NON DESTI

2、NE LA REVENTE.Standards Update ServiceAmendment 2:2013 toCAN/CSA-ISO/IEC 14888-3-07January 2013Title:Information technology Secu rity techniques Digital si gnatures with appendix Part 3: Discrete logarithm based mechanisms AMENDMENT 2: Optimizing hash inputsPagination:7 pages (iii preliminary and 4

3、text)To register for e-mail notification about any updates to this publicationgo to shop.csa.caclick on CSA Update ServiceThe List ID that you will need to register for updates to this publication is 2422257.If you require assistance, please e-mail techsupportcsagroup.org or call 416-747-2233.Visit

4、CSA Groups policy on privacy at csagroup.org/legal to find out how we protect your personal information.Reference numberISO/IEC 14888-3:2006/Amd.2:2012(E)ISO/IEC 2012INTERNATIONAL STANDARD ISO/IEC14888-3First edition2006-11-15AMENDMENT 22012-07-01Information technology Security techniques Digital si

5、gnatures with appendix Part 3: Discrete logarithm based mechanisms AMENDMENT 2: Optimizing hash inputs Technologies de linformation Techniques de scurit Signatures numriques avec appendice Partie 3: Mcanismes bass sur un logarithme discret AMENDEMENT 2: Optimisation des entres pour la fonction de ha

6、chage ISO/IEC 14888-3:2006/Amd.2:2012(E) COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2012 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permissio

7、n in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org ii ISO/IEC 2012 All rights reservedAmendment 2:2013 to CA

8、N/CSA-ISO/IEC 14888-3-07ISO/IEC 14888-3:2006/Amd.2:2012(E) ISO/IEC 2012 All rights reserved iiiForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are

9、 members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other internationa

10、l organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the

11、ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at leas

12、t 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Amendment 2 to ISO/IEC 14888-3:2006 was prepare

13、d by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. It introduces an optimization for the Schnorr Elliptic Curve Digital Signature Algorithms specified in ISO/IEC 14888-3:2006/Amd.1:2010. Whereas this optimization is described in an infor

14、mative (only) note of ISO/IEC 14888-3:2006/Amd.1:2010, Amendment 2 makes the optimization a normative option. It also corrects various errata in Annexes E and F and updates the date of a reference in the Bibliography. Amendment 2:2013 to CAN/CSA-ISO/IEC 14888-3-07Amendment 2:2013 to CAN/CSA-ISO/IEC

15、14888-3-07ISO/IEC 14888-3:2006/Amd.2:2012(E) ISO/IEC 2012 All rights reserved 1Information technology Security techniques Digital signatures with appendix Part 3: Discrete logarithm based mechanisms AMENDMENT 2: Optimizing hash inputs Subclause 6.9.1, Introduction to EC-SDSA Replace the text in 6.9.

16、1 with the following: EC-SDSA (Elliptic Curve Schnorr Digital Signature Algorithm) is a signature mechanism with verification key Y = XG; that is, the parameter D is equal to 1. The message is prepared such that M2 is empty and M1 = M the message to be signed. The witness R is computed as a hash-cod

17、e of the message M and a random pre-signature = KG, by one of two methods, either normal R = h(FE2BS(X) | FE2BS(Y) | M) or optimized R = h(FE2BS(X) | M). The first method generates the witness by hashing the concatenation of the x-coordinate of , the y-coordinate of and the message M. The second met

18、hod omits the y-coordinate from the hash calculation and thereby improves performance. The second method is an optimized variant of EC-SDSA (see 40). Subclause 6.9.4.4, Computing the witness Replace the text in 6.9.4.4 with the following: The signing entity computes R = h(FE2BS(X)|FE2BS(Y)|M). For t

19、he optimized variant of EC-SDSA, the signing entity instead computes R = h(FE2BS(X)|M). Annex A, ASN.1 Module Add the following entries at the appropriate places in the OID assignments section. id-dswa-dl-EC-SDSA-opt OID := id-dswa-dl ec-sdsa-opt(13) dswa-dl EC-SDSA-opt dswa-dl-EC-SDSA-opt ALGORITHM

20、 := OID id-dswa-dl-EC-SDSA-opt PARMS HashFunctions Amendment 2:2013 to CAN/CSA-ISO/IEC 14888-3-07ISO/IEC 14888-3:2006/Amd.2:2012(E) 2 ISO/IEC 2012 All rights reservedF.11.2.3, Per message data Append the following text to F.11.2.3: For the optimized variant of EC-SDSA, R = h(FE2BS(X) | M) = D7FB8135

21、 D8EA45E8 FB3C9059 F146E263 0EF4BD51 C4006A92 EDB4C8B0 849963FB F.11.2.4, Signature Append the following text to F.11.2.4: For the optimized variant of EC-SDSA, R = D7FB8135 D8EA45E8 FB3C9059 F146E263 0EF4BD51 C4006A92 EDB4C8B0 849963FB S = B46D1525 379E02E2 32D97928 265B7254 EA2ED978 13454388 C1A08

22、F62 DCCD70B3 F.11.2.5, Verification Append the following text to F.11.2.5: For the optimized variant of EC-SDSA, R = h(FE2BS(X) | M) = D7FB8135 D8EA45E8 FB3C9059 F146E263 0EF4BD51 C4006A92 EDB4C8B0 849963FB F.11.3.3, Per message data Append the following text to clause F.11.3.3: For the optimized va

23、riant of EC-SDSA, R = h(FE2BS(X) | M) = 27D2F5B9 62A3ACF6 390A4718 EA540DA7 9612A60E AA15BEBB 00B9E166 5783F7C7 91CCAC42 2CEE815A 9C5DA367 8AC8D1F0 F.11.3.4, Signature Append the following text to F.11.3.4: For the optimized variant of EC-SDSA, R = 27D2F5B9 62A3ACF6 390A4718 EA540DA7 9612A60E AA15BE

24、BB 00B9E166 5783F7C7 91CCAC42 2CEE815A 9C5DA367 8AC8D1F0 S = 22CC89CE B9E6BE84 15CC14B3 99BC66E6 F3A21E5B A38E09A6 DE8DE670 A145C0E4 74D5CC88 BE8878F0 123CC662 25A1BA12 Amendment 2:2013 to CAN/CSA-ISO/IEC 14888-3-07ISO/IEC 14888-3:2006/Amd.2:2012(E) ISO/IEC 2012 All rights reserved 3F.11.3.5, Verifi

25、cation Append the following text to F.11.3.5: For the optimized variant of EC-SDSA, R = h(FE2BS(X) | M) = 27D2F5B9 62A3ACF6 390A4718 EA540DA7 9612A60E AA15BEBB 00B9E166 5783F7C7 91CCAC42 2CEE815A 9C5DA367 8AC8D1F0 Annex E To provide a description of the reduced Tate pairing, which is used in example

26、s of Annex F, insert the following clause at the end of Annex E: E.4 The reduced Tate pairing Let l 2 be prime, and let P and Q be points on E with l P = O, the pairing can be computed in the following steps: choose some random point T on E, then compute = ( d(P, Q - T) / d(P, -T) ) (pk- 1) l. If du

27、ring the computation of the pairing, a division by zero is attempted, then the computation should be restarted with a new point T. NOTE 1 More detailed information of pairing implementation can be found in 2, 14. NOTE 2 The reduced Tate pairing is used in numerical examples of clauses F.7 and F.8. F

28、2.2, Signature key and verification key To correct a one-digit error in the value of Y, in the last line of the formula for Y change “48CDF8DE” to “48CBF8DE”. F.3, Pointcheval-Vaudenay mechanism To identify which hash-function is used in the example of F.3, insert the following at the beginning of

29、F.3: This example uses the Secure Hash Algorithm (SHA-1) as the hash-function h. The hash-code is simply the value of SHA-1. F.5.2.1, Parameters To correct a one-digit error in the value of GY, in the formula of GYchange “631011EC” to “631011ED”. F.5.3, Example 2: Field FPm, 32-bit P and m = 5 To co

30、rrect a minor typographical error in the title of F.5.3, change “Example 2” to “Example 3”. Amendment 2:2013 to CAN/CSA-ISO/IEC 14888-3-07ISO/IEC 14888-3:2006/Amd.2:2012(E) 4 ISO/IEC 2012 All rights reservedF.7.2.1, Parameters To correct the polynomial cited in F.7.2.1, change “Y2= X3+ 1” to “Y2= X3

31、 X ”. F.8.1.1, Parameters To correct a multiple-digit error in the value of q in F.8.1.1, in the formula of q change 80000000 00000000 00FFFFFF FFFFFFFF FFFFFFFF to 80000000 000FFFFF FFFFFFFF FFFFFFFF FFFFFFFF. Bibliography Update reference 3 (ISO/IEC 11770-3) by changing “1999” to “2008”. Amendmen

32、t 2:2013 to CAN/CSA-ISO/IEC 14888-3-07ISO/IEC 14888-3:2006/Amd.2:2012(E) ICS 35.040 ISO/IEC 2012 All rights reserved Copyright NoticeThis Amendment to the International Standard contains information copyright protected by t he International Organization for Standardization (ISO) and the Internationa

33、l Electrotechnical Commission (IEC). Except as permitted under the laws of Canada, no extract of this Amendment to the International Standard may be reproduced, stored in any retrieval system, or transmitted in any form or by any means, electronic, photocopying, recording, or otherwise, without prio

34、r permission from the Standards Council of Canada (SCC). Requests for permission to reproduce this Amendment to the International Standard or parts thereof should be addressed to Manager, Technical Document Centre Standards Council of Canada 270 Albert Street, Suite 200 Ottawa, Ontario K1P 6N7 The C

35、anadian adoption of this Amendment to the International Standard contains information copyright protected by CSA Group. All rights reserved. No part of this adopted Amendment may be reproduced in any form whatsoever without the prior permission of the publisher. ISO/IEC material is reprinted with pe

36、rmission. Requests for permission to reproduce this adopted Amendment or parts thereof should be addressed to Manager, Sales CSA Group 5060 Spectrum Way, Suite 100 Mississauga, Ontario L4W 5N6Copyright violators will be prosecuted to the full extent of the law.PRINTED IN CANADAIMPRIMEAU CANADA100%CSA Group prints its publications on Rolland Enviro100, which contains 100%recycled post-consumer fibre, is EcoLogo and Processed Chlorine Free certified, and was manufactured using biogas energy.