1、BRITISH STANDARDBS ISO/IEC 14888-2:2008Information technology Security techniques Digital signatures with appendix Part 2: Integer factorization based mechanismsICS 35.040g49g50g3g38g50g51g60g44g49g42g3g58g44g55g43g50g56g55g3g37g54g44g3g51g40g53g48g44g54g54g44g50g49g3g40g59g38g40g51g55g3g36g54g3g51g
2、40g53g48g44g55g55g40g39g3g37g60g3g38g50g51g60g53g44g42g43g55g3g47g36g58BS ISO/IEC Incorporating corrigendum October 2015BS ISO/IEC 14888-2:2008ISBN 978 0 580 90344 1Amendments/corrigenda issued since publicationDate Comments31 October 2015 Implementation of ISO/IEC corrigendum October 2015This Briti
3、sh Standard was published under the authority of the Standards Policy and Strategy Committee on 30 May 2008 The British Standards Institution 2015. Published by BSI Standards Limited 2015National forewordThis British Standard is the UK implementation of ISO/IEC 14888-2:2008, incorporating corrigendu
4、m October 2015. It supersedes BS ISO/IEC 14888-2:1999 which is withdrawn.The start and finish of text introduced or altered by corrigendum is indicated in the text by tags. Text altered by ISO/IEC corrigendum October 2015 is indicated in the text by .The UK participation in its preparation was entru
5、sted to Technical Committee IST/33, IT Security techniques.A list of organizations represented on this committee can be obtained on request to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.Comp
6、liance with a British Standard cannot confer immunity from legal obligations.Reference numberISO/IEC 14888-2:2008(E)INTERNATIONAL STANDARD ISO/IEC14888-2Second edition2008-04-15Information technology Security techniques Digital signatures with appendix Part 2: Integer factorization based mechanisms
7、Technologies de linformation Techniques de scurit Signatures numriques avec appendice Partie 2: Mcanismes bass sur une factorisation entire BS ISO/IEC 14888-2:2008ii iiiContents Page Foreword iv Introduction v 1 Scope . 1 2 Normative references . 1 3 Terms and definitions. 1 4 Symbols and abbreviate
8、d terms . 2 5 General. 4 6 RSA and RW schemes 7 7 GQ1 scheme (identity-based scheme) 11 8 GQ2 scheme 15 9 GPS1 scheme 18 10 GPS2 scheme 21 11 ESIGN scheme 23 Annex A (normative) Object identifiers 27 Annex B (informative) Guidance on parameter choice and comparison of signature schemes . 33 Annex C
9、(informative) Numerical examples 41 Annex D (informative) Two other format mechanisms for RSA/RW schemes. 56 Annex E (informative) Products allowing message recovery for RSA/RW verification mechanisms. 59 Annex F (informative) Products allowing two-pass authentication for GQ/GPS schemes 61 Bibliogra
10、phy . 65 BS ISO/IEC 14888-2:2008iv Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of Int
11、ernational Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liais
12、on with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint techn
13、ical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. ISO/IEC 14888-
14、2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. This second edition cancels and replaces the first edition (ISO/IEC 14888-2:1999), which has been technically revised. ISO/IEC 14888 consists of the following parts, under t
15、he general title Information technology Security techniques Digital signatures with appendix: Part 1: General Part 2: Integer factorization based mechanisms Part 3: Discrete logarithm based mechanisms BS ISO/IEC 14888-2:2008vIntroduction Digital signatures can be used to provide services such as ent
16、ity authentication, data origin authentication, non-repudiation, and data integrity. NOTE There are two series of International Standards specifying digital signatures. In both series, Part 2 specifies integer factorization based mechanisms and Part 3 specifies discrete logarithm based mechanisms. I
17、SO/IEC 9796 28 specifies signatures giving message recovery. As all or part of the message is recovered from the signature, the recoverable part of the message is not empty. The signed message consists of either the signature only (when the non-recoverable part of the message is empty), or both the
18、signature and the non-recoverable part. ISO/IEC 14888 specifies signatures with appendix. As no part of the message is recovered from the signature, the recoverable part of the message is empty. The signed message consists of the signature and the whole message. Most digital signature schemes involv
19、e three basic operations. An operation that produces key pairs. Each pair consists of a private signature key and a public verification key. An operation that makes use of a private signature key to produce signatures. When, for a given message and private signature key, the probability of obtaining
20、 the same signature twice is negligible, the operation is probabilistic. When, for a given message and private signature key, all the signatures are identical, the operation is deterministic. A deterministic operation that makes use of a public verification key to verify signed messages. For each sc
21、heme, given the public verification key (but not the private signature key) and any set of signed messages (each message having been chosen by the attacker), the attacker should have a negligible probability of producing: a new signature for a previously signed message; a signature for a new message
22、; the private signature key. The title of ISO/IEC 14888-2 has changed, from Identity-based mechanisms (first edition) to Integer factorization based mechanisms (second edition). a) The second edition includes the identity-based scheme specified in ISO/IEC 14888-2:1999, namely the GQ1 scheme. This sc
23、heme has been revised due to the withdrawal of ISO/IEC 9796:1991 in 1999. b) Among the certificate-based schemes specified in ISO/IEC 14888-3:1998, it includes all the schemes based on the difficulty of factoring the modulus in use, namely, the RSA, RW and ESIGN schemes. These schemes have been revi
24、sed due to the withdrawal of ISO/IEC 9796:1991 in 1999. c) It takes into account ISO/IEC 14888-3:1998/Cor.1:2001, technical corrigendum to the ESIGN scheme. d) It includes a format mechanism, namely the PSS mechanism, already specified in ISO/IEC 9796-2:2002, and details of how to use it in each of
25、the RSA, RW, GQ1 and ESIGN schemes. NOTE Similar format mechanisms have proofs of security 2, even without a salt. e) It includes new certificate-based schemes that use no format mechanism, namely, the GQ2, GPS1 and GPS2 schemes. f) For each scheme and its options, as needed, it provides an object i
26、dentifier. BS ISO/IEC 14888-2:2008vi ISO and IEC draw attention to the fact that it is claimed that compliance with this document may involve the use of patents. ISO and IEC take no position concerning the evidence, validity and scope of these patent rights. The holders of these patent rights have a
27、ssured ISO and IEC that they are willing to negotiate licenses under reasonable and non-discriminatory terms and conditions with applicants throughout the world. In this respect, the statements of the holders of these patent rights are registered with ISO and IEC. Information may be obtained from th
28、e companies listed below: Patent holder Patent number(s) Subject NTT 20-2 Nishi-shinjuku 3-Chome Shinjuku-ku Tokyo 163-1419, Japan US 4 625 076 ESIGN (see Clause 11) France Telecom R b) a signature mechanism, i.e., how to produce a signature of a message with the data elements required for signing;
29、c) a verification mechanism, i.e., how to verify a signature of a message with the data elements required for verifying. The production of key pairs requires random bits and prime numbers. The production of signatures often requires random bits. Techniques for producing random bits and prime numbers
30、 are outside the scope of this part of ISO/IEC 14888. For further information, see ISO/IEC 18031 33 and ISO/IEC 18032 34. Various means are available to obtain a reliable copy of the public verification key, e.g., a public key certificate. Techniques for managing keys and certificates are outside th
31、e scope of this part of ISO/IEC 14888. For further information, see ISO/IEC 9594-8 27, ISO/IEC 11770 31 and ISO/IEC 15945 32. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For un
32、dated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 10118 (all parts), Information technology Security techniques Hash-functions ISO/IEC 14888-1, Information technology Security techniques Digital signatures with appendix Part 1: General 3 Term
33、s and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 14888-1 and the following apply. 3.1 modulus integer whose factorization shall be kept secret and whose factors shall be infeasible to compute BS ISO/IEC 14888-2:20082 3.2 representative bit string produc
34、ed by a format mechanism 3.3 salt optional bit string for producing a representative 3.4 signature exponent secret exponent for producing signatures 3.5 trailer optional bit string on the right of a representative 3.6 verification exponent public exponent for verifying signed messages and sometimes
35、also for producing signatures 4 Symbols and abbreviated terms For the purposes of this document, the following symbols and abbreviated terms apply. A | B bit string resulting from concatenating the two bit strings A and B in that order A B bit string resulting from exclusive-oring the two bit string
36、s A and B, of the same length b adaptation parameter (GQ2) Cr CRT coefficient CRT Chinese Remainder Theorem |D| bit length of D if D is a bit string, or bit size of D if D is a number (i.e., 0 if D = 0, or the unique integer i so that 2i1 D 0, e.g., |65 537 = 216+1| = 17) D the greatest integer less
37、 than or equal to D D the least integer greater than or equal to D E salt (RSA, RW, ESIGN) F representative (RSA, RW, GQ1, ESIGN) f number of prime factors G, Gipublic number g, gibase number (gn) Jacobi symbol of a positive integer g with respect to an odd composite integer n NOTE 1 By definition,
38、the Jacobi symbol of g with respect to n is the product of the Legendre symbols of g with respect to each prime factor of n (repeating the Legendre symbols for repeated prime factors). The Jacobi symbol 13, 15 can be efficiently computed without knowledge of the prime factors of n. BS ISO/IEC 14888-
39、2:20083(gp) Legendre symbol of a positive integer g with respect to an odd prime integer p NOTE 2 By definition, if p is prime, then (gp) = g(p1)/2mod p. This means that (gp) is zero if g is a multiple of p, and either +1 or 1 otherwise, depending on whether or not g is a square modulo p. gcd(a, b)
40、the greatest common divisor of the two positive integers a and b H, HH hash-codes h hash-function i mod n the unique integer j from 0 to n1 such that n divides i j Id sequence of identification data (GQ1) Indic indicator of a mechanism in use (hash-function, format mechanism, hash-variant) k securit
41、y parameter (GQ2) lcm(a, b) the least common multiple of the two positive integers a and b M message m number of base numbers (GQ2) n modulus piprime factor Q, Qiprivate number Qi,jprivate component (GQ2) R first part of signature (GQ1, GQ2, GPS1, GPS2) r, ri, ri,jrandom number (GQ1, GQ2, GPS1, GPS2
42、, ESIGN) S signature (RSA, RW, ESIGN) or second part of signature (GQ1, GQ2, GPS1, GPS2) s, sisignature exponent (RSA, RW, GQ1, GQ2) T coupon (GPS1, GPS2) t signature length parameter (GQ1, GQ2) u, uiexponent (GQ1, GQ2) v verification exponent (RSA, RW, GQ1, GPS2, ESIGN) W bit string (GQ1, GQ2, GPS1
43、, GPS2) XY notation using the hexadecimal digits 0 to 9 and A to F, equal to XY to the base 16 x, y, z integers bit size of the moduli bit length of the representatives (RSA, RW, GQ1, ESIGN) bit length of the salts (format mechanisms) bit length of the trailers (format mechanisms) BS ISO/IEC 14888-2
44、:20084 5 General 5.1 Security requirements The signature mechanism makes use of a set of data elements required for signing. This set includes the signers private signature key, which is referred to simply as the “signature key” in this document. Some data elements of the signature key shall be kept
45、 secret (there is at least one secret data element). NOTE Every secret data element should remain confined within a piece of hardware or software under the control of the signer, in such a way that it is infeasible for an attacker to extract it. Integrated circuit cards 24 may produce signatures. Pr
46、otection profiles for signature production devices are outside the scope of this document. The production of RSA and RW signatures is probabilistic when and only when every signature requires a fresh salt. The production of GQ1, GQ2, GPS1, GPS2 and ESIGN signatures is essentially probabilistic. When
47、 the production of signatures is probabilistic, every signer shall have the means to select random bits. The verification mechanism makes use of a set of data elements required for verifying, all of which shall be made public within the domain. Every public data element common to all signers is know
48、n as a domain parameter. Every public data element specific to a single signer shall be part of the signers public verification key, which is referred to simply as the “verification key” in this document. Within a given domain, every verifier shall know the set of domain parameters and shall obtain
49、a reliable copy of the signers verification key. The signer and the verifier shall have adequate assurance that the set of domain parameters is valid, i.e., that it satisfies the constraints specific to the scheme. Otherwise, there is no assurance of meeting the intended security even if the signed message is accepted. This assurance may be obtained in various ways, including one or more of: a) selection of a set of values from a trusted published source, e.g., an Inter
