Structural Properties of Cryptographic Sequences - Computational Intelligence in Security for Information Systems - page 145

2.1 Setup Phase

In this phase, generates its pre-key, the public key shared by the group, as

well as helps the members of G to generate their private keys [19].

T

Pre-key generation. T generates its pre-key as follows:

1. T chooses two large primes p and q , such that

p = u 1 · r · p 1 +1 ,

q = u 2 · r · q 1 +1 ,

where r, p 1 ,q 1 are prime numbers, u 1 ,u 2 ∈ Z with gcd( u 1 ,u 2 ) = 2, that is,

u 1 =2 v 1 , u 2 =2 v 2 ,andgcd( v 1 ,v 2 )=1.
In order to guarantee the security of the scheme, the bitlength of r is selected
so that the Subgroup Discrete Logarithm Problem (SDLP) of order r in Z n

be computationally infeasible.

2. T computes

n = p · q,

r 2 φ ( n )=( p − 1)( q − 1) = u 1 · u 2 · · p 1 · q 1 ,

φ ( n )

λ ( n )=lcm( p −

1 ,q

−

1) =2 v 1 ·

v 2 · r · p 1 · q 1 ,

1) =

gcd( p − 1 ,q −

where φ ( n ) is the Euler function, λ ( n ) is the Carmichael function, and lcm
represents the least common multiple.
Then, ∈ Z n

T selects an element α with multiplicative order r modulo n ,

such that

r 2

gcd( α, φ ( n )) = gcd( α, u 1 · u 2 · · p 1 · q 1 )=1 .

Note that this element, α , can be eciently computed as knows the fac-

torization of n and consequently it knows φ ( n )and λ ( n ) [19, Lemma 3.1].
We denote by S r

T

Z n generated by α . the subgroup of

∈ Z r

3. T generates a secret random number s and determines

β = α s

(mod n ) . (1)

4. T publishes the values ( α, r, β, n ); whereas it keeps secret the values of

( p, q, s ).

With the previous hypothesis, the security of 's secret, s , is based on the Integer

Factorization Problem (IFP) and on the Subgroup Discrete Logarithm Problem
(SDLP).

T

Key generation. In order to determine the private keys of the members of G ,
T computes its private key and the public key which will be shared by all the

signers of G .