1、BRITISH STANDARD BS ISO/IEC 14888-2:2008 Information technology Security techniques Digital signatures with appendix Part 2: Integer factorization based mechanisms ICS 35.040 BS ISO/IEC 14888-2:2008 Incorporating corrigendum October 2015BS ISO/IEC 14888-2:2008 ISBN 978 0 580 90344 1 Amendments/corri
2、genda issued since publication Date Comments 31 October 2015 Implementation of ISO/IEC corrigendum October 2015 This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 May 2008 The British Standards Institution 2015. Published by BSI Standards Lim
3、ited 2015 National foreword This British Standard is the UK implementation of ISO/IEC 14888-2:2008, incorporating corrigendum October 2015. It supersedes BS ISO/IEC 14888-2:1999 which is withdrawn. The start and finish of text introduced or altered by corrigendum is indicated in the text by tags. Te
4、xt altered by ISO/IEC corrigendum October 2015 is indicated in the text by . The UK participation in its preparation was entrusted to Technical Committee IST/33, IT Security techniques. A list of organizations represented on this committee can be obtained on request to its secretary. This publicatio
5、n does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Compliance with a British Standard cannot confer immunity from legal obligations. Reference number ISO/IEC 14888-2:2008(E)INTERNATIONAL STANDARD ISO/IEC 14888-2 Second edition
6、 2008-04-15 Information technology Security techniques Digital signatures with appendix Part 2: Integer factorization based mechanisms Technologies de linformation Techniques de scurit Signatures numriques avec appendice Partie 2: Mcanismes bass sur une factorisation entire BS ISO/IEC 14888-2:2008ii
7、 iii Contents Page Foreword iv Introduction v 1 Scope. 1 2 Normative references . 1 3 Terms and definitions. 1 4 Symbols and abbreviated terms . 2 5 General. 4 6 RSA and RW schemes 7 7 GQ1 scheme (identity-based scheme) 11 8 GQ2 scheme 15 9 GPS1 scheme 18 10 GPS2 scheme 21 11 ESIGN scheme 23 Annex A
8、 (normative) Object identifiers 27 Annex B (informative) Guidance on parameter choice and comparison of signature schemes . 33 Annex C (informative) Numerical examples 41 Annex D (informative) Two other format mechanisms for RSA/RW schemes. 56 Annex E (informative) Products allowing message recovery
9、 for RSA/RW verification mechanisms. 59 Annex F (informative) Products allowing two-pass authentication for GQ/GPS schemes 61 Bibliography . 65 BS ISO/IEC 14888-2:2008iv Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the
10、 specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC techni
11、cal committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. Int
12、ernational Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for vo
13、ting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. ISO/IEC 14888-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. This second edition cancels and replac
14、es the first edition (ISO/IEC 14888-2:1999), which has been technically revised. ISO/IEC 14888 consists of the following parts, under the general title Information technology Security techniques Digital signatures with appendix: Part 1: General Part 2: Integer factorization based mechanisms Part 3:
15、Discrete logarithm based mechanisms BS ISO/IEC 14888-2:2008v Introduction Digital signatures can be used to provide services such as entity authentication, data origin authentication, non-repudiation, and data integrity. NOTE There are two series of International Standards specifying digital signatu
16、res. In both series, Part 2 specifies integer factorization based mechanisms and Part 3 specifies discrete logarithm based mechanisms. ISO/IEC 9796 28 specifies signatures giving message recovery. As all or part of the message is recovered from the signature, the recoverable part of the message is n
17、ot empty. The signed message consists of either the signature only (when the non-recoverable part of the message is empty), or both the signature and the non-recoverable part. ISO/IEC 14888 specifies signatures with appendix. As no part of the message is recovered from the signature, the recoverable
18、 part of the message is empty. The signed message consists of the signature and the whole message. Most digital signature schemes involve three basic operations. An operation that produces key pairs. Each pair consists of a private signature key and a public verification key. An operation that makes
19、 use of a private signature key to produce signatures. When, for a given message and private signature key, the probability of obtaining the same signature twice is negligible, the operation is probabilistic. When, for a given message and private signature key, all the signatures are identical, the
20、operation is deterministic. A deterministic operation that makes use of a public verification key to verify signed messages. For each scheme, given the public verification key (but not the private signature key) and any set of signed messages (each message having been chosen by the attacker), the at
21、tacker should have a negligible probability of producing: a new signature for a previously signed message; a signature for a new message; the private signature key. The title of ISO/IEC 14888-2 has changed, from Identity-based mechanisms (first edition) to Integer factorization based mechanisms (sec
22、ond edition). a) The second edition includes the identity-based scheme specified in ISO/IEC 14888-2:1999, namely the GQ1 scheme. This scheme has been revised due to the withdrawal of ISO/IEC 9796:1991 in 1999. b) Among the certificate-based schemes specified in ISO/IEC 14888-3:1998, it includes all
23、the schemes based on the difficulty of factoring the modulus in use, namely, the RSA, RW and ESIGN schemes. These schemes have been revised due to the withdrawal of ISO/IEC 9796:1991 in 1999. c) It takes into account ISO/IEC 14888-3:1998/Cor.1:2001, technical corrigendum to the ESIGN scheme. d) It i
24、ncludes a format mechanism, namely the PSS mechanism, already specified in ISO/IEC 9796-2:2002, and details of how to use it in each of the RSA, RW, GQ1 and ESIGN schemes. NOTE Similar format mechanisms have proofs of security 2, even without a salt. e) It includes new certificate-based schemes that
25、 use no format mechanism, namely, the GQ2, GPS1 and GPS2 schemes. f) For each scheme and its options, as needed, it provides an object identifier. BS ISO/IEC 14888-2:2008vi ISO and IEC draw attention to the fact that it is claimed that compliance with this document may involve the use of patents. IS
26、O and IEC take no position concerning the evidence, validity and scope of these patent rights. The holders of these patent rights have assured ISO and IEC that they are willing to negotiate licenses under reasonable and non-discriminatory terms and conditions with applicants throughout the world. In
27、 this respect, the statements of the holders of these patent rights are registered with ISO and IEC. Information may be obtained from the companies listed below: Patent holder Patent number(s) Subject NTT 20-2 Nishi-shinjuku 3-Chome Shinjuku-ku Tokyo 163-1419, Japan US 4 625 076 ESIGN (see Clause 11
28、) France Telecom R b) a signature mechanism, i.e., how to produce a signature of a message with the data elements required for signing; c) a verification mechanism, i.e., how to verify a signature of a message with the data elements required for verifying. The production of key pairs requires random
29、 bits and prime numbers. The production of signatures often requires random bits. Techniques for producing random bits and prime numbers are outside the scope of this part of ISO/IEC 14888. For further information, see ISO/IEC 18031 33 and ISO/IEC 18032 34. Various means are available to obtain a re
30、liable copy of the public verification key, e.g., a public key certificate. Techniques for managing keys and certificates are outside the scope of this part of ISO/IEC 14888. For further information, see ISO/IEC 9594-8 27, ISO/IEC 11770 31 and ISO/IEC 15945 32. 2 Normative references The following r
31、eferenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 10118 (all parts), Information technology Security techn
32、iques Hash-functions ISO/IEC 14888-1, Information technology Security techniques Digital signatures with appendix Part 1: General 3 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 14888-1 and the following apply. 3.1 modulus integer whose factoriza
33、tion shall be kept secret and whose factors shall be infeasible to compute BS ISO/IEC 14888-2:20082 3.2 representative bit string produced by a format mechanism 3.3 salt optional bit string for producing a representative 3.4 signature exponent secret exponent for producing signatures 3.5 trailer opt
34、ional bit string on the right of a representative 3.6 verification exponent public exponent for verifying signed messages and sometimes also for producing signatures 4 Symbols and abbreviated terms For the purposes of this document, the following symbols and abbreviated terms apply. A | B bit string
35、 resulting from concatenating the two bit strings A and B in that order A B bit string resulting from exclusive-oring the two bit strings A and B, of the same length b adaptation parameter (GQ2) Cr CRT coefficient CRT Chinese Remainder Theorem |D| bit length of D if D is a bit string, or bit size of
36、 D if D is a number (i.e., 0 if D = 0, or the unique integer i so that 2i1 D 0, e.g., |65 537 = 2 16 +1| = 17) D the greatest integer less than or equal to D D the least integer greater than or equal to D E salt (RSA, RW, ESIGN) F representative (RSA, RW, GQ1, ESIGN) f number of prime factors G, G i
37、public number g, g ibase number (g n) Jacobi symbol of a positive integer g with respect to an odd composite integer n NOTE 1 By definition, the Jacobi symbol of g with respect to n is the product of the Legendre symbols of g with respect to each prime factor of n (repeating the Legendre symbols for
38、 repeated prime factors). The Jacobi symbol 13, 15 can be efficiently computed without knowledge of the prime factors of n. BS ISO/IEC 14888-2:20083 (g p) Legendre symbol of a positive integer g with respect to an odd prime integer p NOTE 2 By definition, if p is prime, then (g p) = g (p1)/2mod p. T
39、his means that (g p) is zero if g is a multiple of p, and either +1 or 1 otherwise, depending on whether or not g is a square modulo p. gcd(a, b) the greatest common divisor of the two positive integers a and b H, HH hash-codes h hash-function i mod n the unique integer j from 0 to n1 such that n di
40、vides i j Id sequence of identification data (GQ1) Indic indicator of a mechanism in use (hash-function, format mechanism, hash-variant) k security parameter (GQ2) lcm(a, b) the least common multiple of the two positive integers a and b M message m number of base numbers (GQ2) n modulus p iprime fac
41、tor Q, Q iprivate number Q i,jprivate component (GQ2) R first part of signature (GQ1, GQ2, GPS1, GPS2) r, r i , r i,jrandom number (GQ1, GQ2, GPS1, GPS2, ESIGN) S signature (RSA, RW, ESIGN) or second part of signature (GQ1, GQ2, GPS1, GPS2) s, s isignature exponent (RSA, RW, GQ1, GQ2) T coupon (GPS1
42、, GPS2) t signature length parameter (GQ1, GQ2) u, u iexponent (GQ1, GQ2) v verification exponent (RSA, RW, GQ1, GPS2, ESIGN) W bit string (GQ1, GQ2, GPS1, GPS2) XY notation using the hexadecimal digits 0 to 9 and A to F, equal to XY to the base 16 x, y, z integers bit size of the moduli bit length
43、of the representatives (RSA, RW, GQ1, ESIGN) bit length of the salts (format mechanisms) bit length of the trailers (format mechanisms) BS ISO/IEC 14888-2:20084 5 General 5.1 Security requirements The signature mechanism makes use of a set of data elements required for signing. This set includes the
44、 signers private signature key, which is referred to simply as the “signature key” in this document. Some data elements of the signature key shall be kept secret (there is at least one secret data element). NOTE Every secret data element should remain confined within a piece of hardware or software
45、under the control of the signer, in such a way that it is infeasible for an attacker to extract it. Integrated circuit cards 24 may produce signatures. Protection profiles for signature production devices are outside the scope of this document. The production of RSA and RW signatures is probabilisti
46、c when and only when every signature requires a fresh salt. The production of GQ1, GQ2, GPS1, GPS2 and ESIGN signatures is essentially probabilistic. When the production of signatures is probabilistic, every signer shall have the means to select random bits. The verification mechanism makes use of a
47、 set of data elements required for verifying, all of which shall be made public within the domain. Every public data element common to all signers is known as a domain parameter. Every public data element specific to a single signer shall be part of the signers public verification key, which is refe
48、rred to simply as the “verification key” in this document. Within a given domain, every verifier shall know the set of domain parameters and shall obtain a reliable copy of the signers verification key. The signer and the verifier shall have adequate assurance that the set of domain parameters is va
49、lid, i.e., that it satisfies the constraints specific to the scheme. Otherwise, there is no assurance of meeting the intended security even if the signed message is accepted. This assurance may be obtained in various ways, including one or more of: a) selection of a set of values from a trusted published source, e.g., an International Standard; b) production of a set of values by a trusted third p
