Implicit certificate

This article includes a list of references, but its sources remain unclear because it has insufficient inline citations. Please help to improve this article by introducing more precise citations. (December 2015) (Learn how and when to remove this template message)

|

In cryptography, implicit certificates are a variant of public key certificate. A subject's public key is reconstructed from the data in an implicit certificate, and is then said to be "implicitly" verified. Tampering with the certificate will result in the reconstructed public key being invalid, in the sense that it is infeasible to find the matching private key value, as would be required to make use of the tampered certificate.

By comparison, traditional public-key certificates include a copy of the subject's public key, and a digital signature made by the issuing certificate authority (CA). The public key must be explicitly validated, by verifying the signature using the CA's public key. For the purposes of this article, such certificates will be called "explicit" certificates.

Elliptic Curve Qu-Vanstone (ECQV) is one kind of implicit certificate scheme. It is described in the document Standards for Efficient Cryptography 4 (SEC4).[1]
This article will use ECQV as a concrete example to illustrate implicit certificates.

## Contents

* 1 Comparison of ECQV with explicit certificates
* 2 Comparison with ID-based cryptography
* 3 Description of the ECQV scheme
* 3.1 Certificate request protocol
* 3.2 Using the certificate
* 3.3 Proof of equivalence of private and public keys
* 4 Security
* 5 See also
* 6 References
* 7 External links

## Comparison of ECQV with explicit certificates

Conventional explicit certificates are made up of three parts: subject identification data, a public key and a digital signature which binds the public key to the user's identification data (ID). These are distinct data elements within the certificate, and contribute to the size of the certificate: for example, a standard X.509 certificate is on the order of 1KB in size (~8000 bits).

An ECQV implicit certificate consists of identification data, and a single cryptographic value. This value, an elliptic curve point, combines the function of public key data and CA signature. ECQV implicit certificates can therefore be considerably smaller than explicit certificates, and so are useful in highly constrained environments such as Radio-frequency Identification RFID tags, where not a lot of memory or bandwidth is available.

ECQV certificates are useful for any ECC scheme where the private and public keys are of the form ( d, dG ). This includes key agreement protocols such as ECDH and ECMQV, or signing algorithms such as ECDSA. The operation will fail if the certificate has been altered, as the reconstructed public key will be invalid. Reconstructing the public key is fast (a single point multiplication operation) compared to ECDSA signature verification.

## Comparison with ID-based cryptography

Implicit certificates are not to be confused with identity-based cryptography. In ID-based schemes, the subject's identity itself is used to derive their public key; there is no 'certificate' as such. The corresponding private key is calculated and issued to the subject by a trusted third party.

In an implicit certificate scheme, the subject has a private key which is not revealed to the CA during the certificate-issuing process. The CA is trusted to issue certificates correctly, but not to hold individual user's private keys. Wrongly issued certificates can be revoked, whereas there is no comparable mechanism for misuse of private keys in an identity-based scheme.

## Description of the ECQV scheme

Initially the scheme parameters must be agreed upon. These are:

* The elliptic curve parameters, including a generating point Gof order n.
* An encoding function Encode(γ,ID) with a public key reconstruction data γ and an identifying information ID encodes its arguments as a byte-block, and a corresponding Decodeγ(⋅) which extracts the γ value from an encoding.
* A hash function Hn(⋅) which accepts a byte-block and yields a hash value as an integer in the range [0,n−1]

The certificate authority CA will have private key c and public key QCA=cG

### Certificate request protocol

Here, Alice will be the user who requests the implicit certificate from the CA. She has identifying information IDA.

1. Alice generates a random integer α
2. Alice computes A=αG and sends A and IDA to the CA.
3. CA selects a random integer k from [1,n−1] and computes kG.
4. CA computes γ=A+kG (this is the public key reconstruction data)
5. CA computes Cert=Encode(γ,IDA)
6. CA computes e=Hn(Cert)
7. CA computes s=ek+c(modn) (s is the private key reconstruction data)
8. CA sends (s,Cert) to Alice
9. Alice computes e′=Hn(Cert) and her private key a=e′α+s(modn)
10. Alice computes γ′=Decodeγ(Cert) and her public key QA=e′γ′+QCA
11. Alice verifies that the certificate is valid, i.e. that QA=aG

### Using the certificate

Here, Alice wants to prove her identity to Bob, who trusts the CA.

1. Alice sends Cert to Bob, and a ciphertext C created using her private key a. The ciphertext can be a digital signature, or part of an Authenticated Key Exchange protocol.
2. Bob computes γ″=Decodeγ(Cert) and e″=Hn(Cert).
3. Bob computes Alice's alleged public key QA′=e″γ″+QCA
4. Bob validates ciphertext C using QA′. If this validation is successful, he can trust that the key QA′ is owned by the user whose identity information is contained in Cert.

### Proof of equivalence of private and public keys

Alice's private key is a=e′α+s=eα+ek+c(modn)

The public key reconstruction value γ=A+kG=(α+k)G

Alice's public key is QA=eγ+QCA=e(α+k)G+cG=(eα+ek+c)G

Therefore, QA=aG, which completes the proof.

## Security

A security proof for ECQV has been published by Brown et al.[2]

## See also

* Elliptic curve cryptography

## References

1. ↑ "Standards for efficient cryptography, SEC 4: Elliptic Curve Qu-Vanstone Implicit Certificate Scheme (ECQV)". www.secg.org. 2013-01-24. http://www.secg.org/sec4-1.0.pdf.
2. ↑ Brown, Daniel R. L.; Gallant, Robert P.; Vanstone, Scott A. (2001). "Provably Secure Implicit Certificate Schemes". Financial Cryptography. Lecture Notes in Computer Science. 2339. 156–165. doi:10.1007/3-540-46088-8_15. ISBN 978-3-540-44079-6. http://www.cacr.math.uwaterloo.ca/techreports/2000/corr2000-55.ps. Retrieved 27 December 2015.

* Hankerson, D.; Vanstone, S.; Menezes, A. (2004). Guide to Elliptic Curve Cryptography. Springer Professional Computing. New York: Springer. doi:10.1007/b97644. ISBN 978-0-387-95273-4.
* certicom.com, Explaining Implicit Certificates, Code and Cipher Vol. 2, no. 2
* Leon Pintsov and Scott Vanstone, Postal Revenue Collection in the Digital Age, Financial Cryptography 2000, Lecture Notes in Computer Science 1962, pp. 105–120, Springer, February 2000.

## External links

* Standards for Efficient Cryptography Group
* Blackberry Crypto API supports ECQV
* Blackberry's Certicom Corp. uses ECQV for Zigbee Smart Energy
* Standards for ISO/IEC 27001:2022 Certifications

* v
* t
* e

Public-key cryptography

Algorithms|

| Integer factorization|

* Benaloh
* Blum–Goldwasser
* Cayley–Purser
* Damgård–Jurik
* GMR
* Goldwasser–Micali
* Naccache–Stern
* Paillier
* Rabin
* RSA
* Okamoto–Uchiyama
* Schmidt–Samoa

|

Discrete logarithm|

* BLS
* Cramer–Shoup
* DH
* DSA
* ECDH
* ECDSA
* EdDSA
* EKE
* ElGamal
* signature scheme
* MQV
* Schnorr
* SPEKE
* SRP
* STS

Lattice/SVP/CVP/LWE/SIS|

* NTRUEncrypt
* NTRUSign
* RLWE-KEX
* RLWE-SIG
* BLISS

Others|

* AE
* CEILIDH
* EPOC
* HFE
* IES
* Lamport
* McEliece
* Merkle–Hellman
* Naccache–Stern knapsack cryptosystem
* Three-pass protocol
* XTR

Theory|

* Discrete logarithm
* Elliptic-curve cryptography
* Non-commutative cryptography
* RSA problem
* Trapdoor function

Standardization|

* CRYPTREC
* IEEE P1363
* NESSIE
* NSA Suite B
* Post-Quantum Cryptography Standardization

Topics|

* Digital signature
* OAEP
* Fingerprint
* PKI
* Web of trust
* Key size
* Post-quantum cryptography

* v
* t
* e

Cryptography

* History of cryptography
* Cryptanalysis
* Outline of cryptography

* Symmetric-key algorithm
* Block cipher
* Stream cipher
* Public-key cryptography
* Cryptographic hash function
* Message authentication code
* Random numbers
* Steganography

* Category

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Implicit certificate. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Implicit_certificate&oldid=4151122"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template