1、BSI Standards Publication BS ISO/IEC 14888-3:2016 Information technology Security techniques Digital signatures with appendix Part 3: Discrete logarithm based mechanismsBS ISO/IEC 14888-3:2016 BRITISH STANDARD National foreword This British Standard is the UK implementation of ISO/IEC 14888-3:2016.
2、It supersedes BS ISO/IEC 14888-3:2006+A2:2012 which is withdrawn. The UK participation in its preparation was entrusted to Technical Committee IST/33/2, Cryptography and Security Mechanisms. A list of organizations represented on this committee can be obtained on request to its secretary. This publi
3、cation does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2016. Published by BSI Standards Limited 2016 ISBN 978 0 580 83706 7 ICS 35.040 Compliance with a British Standard cannot confer immunit
4、y from legal obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 March 2016. Amendments issued since publication Date Text affectedBS ISO/IEC 14888-3:2016 Information technology Security techniques Digital signatures with appendix
5、 Part 3: Discrete logarithm based mechanisms Technologies de linformation Techniques de scurit Signatures numriques avec appendice Partie 3: Mcanismes bass sur un logarithme discret INTERNATIONAL STANDARD ISO/IEC 14888-3 Reference number ISO/IEC 14888-3:2016(E) Third edition 2016-03-15 ISO/IEC 2016
6、BS ISO/IEC 14888-3:2016ii ISO/IEC 2016 All rights reserved COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2016, Published in Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, i
7、ncluding photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8 CP 401 CH-1214 Vernier, Geneva, Switzerla
8、nd Tel. +41 22 749 01 11 Fax +41 22 749 09 47 copyrightiso.org www.iso.org ISO/IEC 14888-3:2016(E)BS ISO/IEC 14888-3:2016ISO/IEC 14888-3:2016(E)Foreword vi Introduction vii 1 Scope . 1 2 Normative references 1 3 T erms and definitions . 1 4 Symbols and abbreviated terms . 3 5 General model . 5 5.1 P
9、arameter generation process 5 5.1.1 Certificate-based mechanisms . 5 5.1.2 Identity-based mechanisms . 5 5.1.3 Parameter selection 6 5.1.4 Validity of domain parameters and verification key . 7 5.2 Signature process . 7 5.2.1 General 7 5.2.2 Producing the randomizer. 8 5.2.3 Producing the pre-signat
10、ure 8 5.2.4 Preparing the message for signing . 8 5.2.5 Computing the witness (the first part of the signature) 8 5.2.6 Computing the assignment . 8 5.2.7 Computing the second part of the signature . 9 5.2.8 Constructing the appendix 9 5.2.9 Constructing the signed message 9 5.3 Verification process
11、 .10 5.3.1 General.10 5.3.2 Retrieving the witness .10 5.3.3 Preparing message for verification .11 5.3.4 Retrieving the assignment 11 5.3.5 Recomputing the pre-signature .11 5.3.6 Recomputing the witness 11 5.3.7 Verifying the witness .11 6 C ertificat e-based mechanisms 12 6.1 General 12 6.2 DSA .
12、13 6.2.1 General.13 6.2.2 Parameters .13 6.2.3 Generation of signature key and verification key .14 6.2.4 Signature process .14 6.2.5 Verification process 15 6.3 KCDSA 16 6.3.1 General.16 6.3.2 Parameters .16 6.3.3 Generation of signature key and verification key .17 6.3.4 Signature process .17 6.3.
13、5 Verification process 18 6.4 Pointcheval/Vaudenay algorithm 19 6.4.1 General.19 6.4.2 Parameters .19 6.4.3 Generation of signature key and verification key .19 6.4.4 Signature process .19 6.4.5 Verification process 20 6.5 SDSA 21 6.5.1 General.21 ISO/IEC 2016 All rights reserved iii Contents PageBS
14、 ISO/IEC 14888-3:2016ISO/IEC 14888-3:2016(E)6.5.2 Parameters .22 6.5.3 Generation of signature key and verification key .22 6.5.4 Signature process .22 6.5.5 Verification process 23 6.6 EC-DSA 24 6.6.1 General.24 6.6.2 Parameters .24 6.6.3 Generation of signature key and verification key .25 6.6.4 S
15、ignature process .25 6.6.5 Verification process 26 6.7 EC-KCDSA27 6.7.1 General.27 6.7.2 Parameters .27 6.7.3 Generation of signature key and verification key .28 6.7.4 Signature process .28 6.7.5 Verification process 29 6.8 EC-GDSA .30 6.8.1 General.30 6.8.2 Parameters .30 6.8.3 Generation of signa
16、ture key and verification key .30 6.8.4 Signature process .30 6.8.5 Verification process 31 6.9 EC-RDSA .32 6.9.1 General.32 6.9.2 Parameters .33 6.9.3 Generation of signature key and verification key .33 6.9.4 Signature process .33 6.9.5 Verification process 34 6.10 EC-SDSA 35 6.10.1 General.35 6.1
17、0.2 Parameters .35 6.10.3 Generation of signature key and verification key .35 6.10.4 Signature process .36 6.10.5 Verification process 36 6.11 EC-FSDSA 37 6.11.1 General.37 6.11.2 Parameters .38 6.11.3 Generation of signature key and verification key .38 6.11.4 Signature process .38 6.11.5 Verifica
18、tion process 39 7 Identity-based mechanisms .40 7.1 General 40 7.2 IBS-1 40 7.2.1 General.40 7.2.2 Parameters .41 7.2.3 Generation of master key and signature/verification key 41 7.2.4 Signature process .41 7.2.5 Verification process 42 7.3 IBS-2 43 7.3.1 General.43 7.3.2 Parameters .43 7.3.3 Genera
19、tion of master key and signature/verification key 43 7.3.4 Signature process .43 7.3.5 Verification process 44 Annex A (normative) Object identifier 46 Annex B (normative) Conversion functions (I) .49 iv ISO/IEC 2016 All rights reservedBS ISO/IEC 14888-3:2016ISO/IEC 14888-3:2016(E)Annex C (informati
20、ve) Conversion functions (II) 54 Annex D (normative) Generation of DSA domain parameters .56 Annex E (informative) The Weil and Tate pairings .58 Annex F (informative) Numerical examples 61 Annex G (informative) Comparison of the signature schemes .126 Annex H (informative) Claimed features for choo
21、sing a mechanism 128 Bibliography .129 ISO/IEC 2016 All rights reserved vBS ISO/IEC 14888-3:2016ISO/IEC 14888-3:2016(E) Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization.
22、 National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual int
23、erest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. The procedures used to develop this document and thos
24、e intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see ww
25、w.iso.org/directives). Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the
26、document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents). Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement. For an explanation on the meaning of ISO specific term
27、s and expressions related to conformity assessment, as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information The committee responsible for this document is ISO/IEC JTC 1, Information technol
28、ogy, Subcommittee SC 27, IT Security techniques. This third edition cancels and replaces the second edition (ISO/IEC 14888-3:2006), which has been technically revised. It also incorporates the Amendments ISO/IEC 14888-3:2006/Amd 1:2010 and ISO/IEC 14888-3:2006/Amd 2:2012 and the Technical Corrigenda
29、 ISO/IEC 14888-3:2006/Cor 1:2007 and ISO/IEC 14888-3:2006/Cor 2:2009. ISO/IEC 14888 consists of the following parts, under the general title Information technology Security techniques Digital signatures with appendix: Part 1: General Part 2: Integer factorization based mechanisms Part 3: Discrete lo
30、garithm based mechanismsvi ISO/IEC 2016 All rights reservedBS ISO/IEC 14888-3:2016ISO/IEC 14888-3:2016(E) Introduction Digital signature mechanisms can be used to provide services such as entity authentication, data origin authentication, non-repudiation and data integrity. A digital signature mecha
31、nism satisfies the following requirements. Given either or both of the following two things: the verification key, but not the signature key; a set of signatures on a sequence of messages that an attacker has adaptively chosen; it should be computationally infeasible for the attacker to produce a va
32、lid signature on a new message, in some circumstances, to produce a new signature on a previously signed message, or to recover the signature key; it should be computationally infeasible, even for the signer, to find two different messages with the same signature. NOTE 1 Computational feasibility de
33、pends on the specific security requirements and environment. NOTE 2 In some applications, producing a new signature on a previously signed message without knowing the signature key is allowed. One example of such applications is a membership credential in an anonymous digital signature mechanism as
34、specified in ISO/IEC 20008. Digital signature mechanisms are based on asymmetric cryptographic techniques and involve the following three basic operations: a process for generating pairs of keys, where each pair consists of a private signature key and the corresponding public verification key; a pro
35、cess that uses the signature key, called the signature process; a process that uses the verification key, called the verification process. The following are the two types of digital signature mechanisms: when, for a given signature key, any two signatures produced for the same message are always ide
36、ntical, the mechanism is said to be deterministic (or non-randomized) (see ISO/IEC 14888-1 for further details); when, for a given message and signature key, any two applications of the signature process produce (with high probability) two distinct signatures, the mechanism is said to be randomized
37、(or non- deterministic). The mechanisms specified in this part of ISO/IEC 14888 are all randomized. Digital signature mechanisms can also be divided into the following two categories: when the whole message has to be stored and/or transmitted along with the signature, the mechanism is termed a “sign
38、ature mechanism with appendix” (such mechanisms are the subject of ISO/IEC 14888); when the whole message, or part of it, can be recovered from the signature, the mechanism is termed a “signature mechanism giving message recovery” (ISO/IEC 9796 specifies mechanisms in this category). The verificatio
39、n of a digital signature requires access to the signing entitys verification key. It is, thus, essential for a verifier to be able to associate the correct verification key with the signing entity, or more ISO/IEC 2016 All rights reserved viiBS ISO/IEC 14888-3:2016ISO/IEC 14888-3:2016(E) precisely,
40、with (parts of) the signing entitys identification data. This association between the signers identification data and the signers public verification key can either be guaranteed by an outside entity or mechanism, or the association can be somehow inherent in the verification key itself. In the form
41、er case, the scheme is said to be “certificate-based.” In the latter case, the scheme is said to be “identity based.” Typically, in an identity-based scheme, the verifier can calculate the signers public verification key from the signers identification data. The digital signature mechanisms specifie
42、d in this part of ISO/IEC 14888 are classified into certificate-based and identity-based mechanisms. NOTE 3 For certificate-based mechanisms, various PKI standards can be used as the basis of key management. For further information, see ISO/IEC 9594-8 (also known as X.509), ISO/IEC 11770-3 and ISO/I
43、EC 15945. The security of a signature mechanism is based on an intractable computational problem, i.e. a problem for which, given current knowledge, finding a solution is computationally infeasible, such as the factorization problem and the discrete logarithm problem. This part of ISO/IEC 14888 spec
44、ifies digital signature mechanisms with appendix based on the discrete logarithm problem, and ISO/IEC 14888-2 specifies digital signature mechanisms with appendix based on the factorization problem. NOTE 4 The first edition of ISO/IEC 14888 grouped identity-based mechanisms into ISO/IEC 14888-2 and
45、certificate-based mechanisms into ISO/IEC 14888-3, with both parts covering mechanisms based on both the discrete logarithm and the factorization problems. Since the second edition was published, the mechanisms have been reorganized. ISO/IEC 14888-2 now contains integer factoring-based mechanisms, a
46、nd this part of ISO/IEC 14888 now contains discrete logarithm based mechanisms. This part of ISO/IEC 14888 includes 12 mechanisms, two of which were in ISO/IEC 14888-3:1998, three of which were from ISO/IEC 15946-2:2002 and three of which were added in ISO/IEC 14888-3:2006. The Elliptic Curve Russia
47、n Digital Signature Algorithm (EC-RDSA) and three mechanisms based on Schnorr digital signature are added in ISO/IEC 14888-3:2006/Amd.1:2010. The mechanisms specified in this part of ISO/IEC 14888 use a collision resistant hash-function to hash the message being signed (possibly in more than one par
48、t). ISO/IEC 10118 specifies hash-functions. The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) draw attention to the fact that it is claimed that compliance with this part of ISO/IEC 14888 may involve the use of patents. The ISO and IEC take
49、no position concerning the evidence, validity and scope of these patent rights. The holder of these patent rights has assured the ISO and IEC that he is willing to negotiate licences under reasonable and non-discriminatory terms and conditions with applicants throughout the world. In this respect, the statement of the holder of this patent right is registered with the ISO and IEC. Information regarding relevant patents is given in the following: Certicom C
