Implicit certificate

In cryptography, implicit certificates are a variant of public key certificate. A subject's public key is reconstructed from the data in an implicit certificate, and is then said to be "implicitly" verified. Tampering with the certificate will result in the reconstructed public key being invalid, in the sense that it is infeasible to find the matching private key value, as would be required to make use of the tampered certificate. By comparison, traditional public-key certificates include a copy of the subject's public key, and a digital signature made by the issuing certificate authority (CA). The public key must be explicitly validated, by verifying the signature using the CA's public key. For the purposes of this article, such certificates will be called "explicit" certificates. Elliptic Curve Qu-Vanstone (ECQV) is one kind of implicit certificate scheme. It is described in the document Standards for Efficient Cryptography 4 (SEC4). This article will use ECQV as a concrete example to illustrate implicit certificates.

In cryptography, implicit certificates are a variant of public key certificate. A subject's public key is reconstructed from the data in an implicit certificate, and is then said to be "implicitly" verified. Tampering with the certificate will result in the reconstructed public key being invalid, in the sense that it is infeasible to find the matching private key value, as would be required to make use of the tampered certificate. By comparison, traditional public-key certificates include a copy of the subject's public key, and a digital signature made by the issuing certificate authority (CA). The public key must be explicitly validated, by verifying the signature using the CA's public key. For the purposes of this article, such certificates will be called "explicit" certificates. Elliptic Curve Qu-Vanstone (ECQV) is one kind of implicit certificate scheme. It is described in the document Standards for Efficient Cryptography 4 (SEC4). This article will use ECQV as a concrete example to illustrate implicit certificates. ==Comparison with ID-based cryptography== Implicit certificates are not to be confused with identity-based cryptography. In ID-based schemes, the subject's identity itself is used to derive their public key; there is no 'certificate' as such. The corresponding private key is calculated and issued to the subject by a trusted third party. In an implicit certificate scheme, the subject has a private key which is not revealed to the CA during the certificate-issuing process. The CA is trusted to issue certificates correctly, but not to hold individual user's private keys. Wrongly issued certificates can be revoked, whereas there is no comparable mechanism for misuse of private keys in an identity-based scheme. ==Description of the ECQV scheme== Initially the scheme parameters must be agreed upon. These are: The elliptic curve parameters, including a generating point G \, of order n \, . An encoding function \textrm{Encode}(\gamma, ID) with a public key reconstruction data \gamma and an identifying information ID encodes its arguments as a byte-block, and a corresponding \textrm{Decode}_{\gamma}( \sdot ) which extracts the \gamma value from an encoding. A hash function H_n( \sdot ) which accepts a byte-block and yields a hash value as an integer in the range [0, n-1] The certificate authority CA will have private key c \, and public key Q_{CA} = cG Alice computes A = \alpha\,G \, and sends A and ID_A to the CA. CA selects a random integer k \, from [1, n-1] \, and computes kG \, . CA computes \gamma = A + kG \, (this is the public key reconstruction data) CA computes Cert= \textrm{Encode} ( \gamma , \textrm{ID}_A ) \, CA computes e = H_n( Cert ) CA computes s = ek + c \pmod{n} \, ( s \, is the private key reconstruction data) CA sends (s, Cert) \, to Alice Alice computes e' = H_n (Cert) and her private key a = e'\alpha + s \pmod{n} \, Alice computes \gamma' = \textrm{Decode}_{\gamma} (Cert) and her public key Q_A = e'\gamma' + Q_{CA} \, Alice verifies that the certificate is valid, i.e. that Q_A = aG Bob computes \gamma = \textrm{Decode}_{\gamma} (Cert) and e = H_n (Cert) . Bob computes Alice's alleged public key Q_A' = e\gamma + Q_{CA} Bob validates ciphertext C using Q_A' . If this validation is successful, he can trust that the key Q_A' is owned by the user whose identity information is contained in Cert . Alice's private key is a = e'\alpha + s = e\alpha + ek + c \pmod{n} The public key reconstruction value \gamma = A + kG = (\alpha + k)G Alice's public key is Q_A = e\gamma + Q_{CA} = e(\alpha + k)G + cG = (e\alpha + ek + c)G Therefore, Q_A = aG , which completes the proof. ==Security== A security proof for ECQV has been published by Brown et al. ==See also== Elliptic curve cryptography ==References== certicom.com, Explaining Implicit Certificates, Code and Cipher Vol. 2, no. 2 Leon Pintsov and Scott Vanstone, Postal Revenue Collection in the Digital Age, Financial Cryptography 2000, Lecture Notes in Computer Science 1962, pp. 105–120, Springer, February 2000. ==External links== Standards for Efficient Cryptography Group Blackberry supports ECQV Blackberry's Certicom Corp. uses ECQV for Zigbee Smart Energy Standards for ISO/IEC 27001:2022 Certifications

Text derived from https://en.wikipedia.org/w/index.php?oldid=1374515128 under CC BY-SA 4.0; modifications have been made.