A CONFERENCE KEY DISTRIBUTION-SYSTEM BASED ON CROSS-PRODUCT

(1)

A C O N F E R E N C E K E Y D I S T R I B U T I O N S Y S T E M B A S E D O N C R O S S - P R O D U C T

T Z O N G - C H E N W u AND Y I - S H I U N G Y E H I n s t i t u t e of C o m p u t e r Science a n d Information Engineering, National Chiao Tung University, Hsinchu 300, Taiwan, R.O.C.

(Received November 1991)

A t m t r a c t - - E x t e n d e d from the Ditiie-Hellman public key distribution system (PKDS), we pmpo6e & c o n f e r ~ c e key distribution system (CKDS) based on t h e c r o ~ - p r o d u c t operations on row vectore over a Galois field G F ( P ) , where P is a prime number. In our CKDS, the clmirperaon computes a conference key CK a n d t h e n embeds it to some public interpolating polynomials to let only the legal i n t e n d e d p r i n c i p a ~ recover CK, while the illegal inte~ided principals can not. From the public parameters, a n i n t r u d e r or any intended principal in t h e network does not know how m a n y a n d who are t h e legal inteztded principals in the conference. Fttrthe~nore, since the construction of the CK does n o t interfere w i t h the secret keys of the intended principals, any inte~ded principals i n t h e network has n o useful information for revealing any o t h e r principals' secret keys. Besides, our CKDS can h e i m p l e m e n t e d practically.

1. I N T R O D U C T I O N

In a computer system, we usually apply encryption techniques to safeguard transmitted information from anyone other than the legal receiver(s), for achieving privacy and secrecy. The so-called key distribution problem concerns how to secretly distribute an encryption/decryption key shared among a sender and the legal receiver(s) in advance. In 1979, Dime and HeUman [1] first introduced the concept of public key distribution system (PKDS) for achieving such purpose. The Diffie-Hellman PKDS is described in the following.

Let zi and zj be two secret keys possessed by two communicating principals Ui and Uj, respectively. Let P be a large prime number and let a be a primitive element, mod P. Both P and a are known to Ui and Uj. For distributing a common secret key shared between principals Ui and Uj, U~ computes his public key Yi as

Yi = a z' (mod P),

and publishes it to Uj. Similarly, U~ computes his public key yj as y j = a x j (mod P),

and publishes it to Ui. Thereafter, a common secret key Kij shared between Ui and Uj is computed as

K i j = a ~'zj ( m o d P ) = yi z~ ( m o d P ) -- yj~' (mod P).

That is, U~ can use his secret key zi and Ujs public key yj to recompute K~j, and Uj can use his secret key zj and Uis public key Yi to reobtain K 0. Once the common secret key K 0 has been distributed between U~ and Uj, they can communicate with each other secretly by sending the Typeset by -4J~+q-TF~ 39

(2)

40 T . - C . W u , Y.-S. Y~.H

messages enciphered by an available symmetric cryptosystem, such as DES, with the encryption key Kij.

The Difl~e-Hellman PKDS only allows two communicating principals to share a common secret key. With the progress in computer networks, we frequently want to admit any group of communicating principals to share a common conference key so that a secure multi-destination communication or holding a secure electronic conference can be achieved [2,3]. The key distribution system concerned with distributing a secret conference key shared among a group of communicating principals is referred to as the conference key distribution system (CKDS). In 1982 Ingemarson, Tang and Wong [4] generalized the Diffie-Hellman PKDS to a CKDS. Lately, Koyarna and Ohta [5], and Okamoto and Tanaka [6] also proposed two identity-based CKDSs. However, these systems involve large computation for generating the conference key. Recently, Laih, Lee and Ham [7] proposed a threshold scheme and its application in designing a CKDS. The Laih- Lee-Ham scheme is based on the property of cross-product operations on row vectors. However, their proposed CKDS exhibits two potential problems:

(1) an illegal intended principal may fortuitously compute the conference key, and

(2) the amount of required storage used for public parameters grows with the square of the number of legal intended principals in the conference.

In this paper, we first extend the definitions of cross-product operations presented in the same paper [7] to be suitable over a Galois field GF(P), where P is a prime number. Based on some properties of cross-product operations on row vectors over GF(P), we shall propose another CKDS that can overcome the disadvantages stated above. In our CKDS, the required storage for public parameters is fixed proportionally to the number of intended principals in the networks. From the public parameters, an intruder or any intended principal does not know how many and who are the legal intended principals participating in the conference. In Section 2, some mathematical backgrounds are introduced. Our CKDS is presented in Section 3. In Section 4, the security analysis and computational complexity of our CKDS are discussed. Finally, conclusions are given in Section 5.

2. M A T H E M A T I C A L B A C K G R O U N D S

In this section, we introduce some properties of cross-product operations on row vectors over a Galois field GF(P), where P is a prime number.

DEFINITION 2.1. Let Vi = (vii, vi2,..., Vin) be a n-dimensional vector. We define the vector Vi

over the Galois field GF( P) as

Vi (mod P ) = (vit mod P, vi2 mod P , . . . , vi, mod P).

D E F I N I T I O N 2 . 2 .

V 1 , V 2 , . . . ,Vn-1 over GF(P) is deflned as

The cross-product of n - 1 as//nearly independent n-dimensional row vectors

I t)12 '013 (rood

P)

= v2~ _• v23 ~n-1,2 I)n-1,3 V l X V 2 X ' ' . X V n - 1 V l l ~13 - . . Vln V21 V23 . . - V2n ; : : ~n-1,1 ~ n - l , 3 . . - V n - l , n "Uln 1~2n "On-- l ,n 1~21 tJ22 • • • 1~2,n- 1 7 - - . , . . . I I / n - 1 , 1 ~ n - - 1 , 2 • • • ' O n - - l , n - - 1 (mod P),

where [M[ means the determinant of the matrix M.

From the above definitions, consider n = 3 and let V 1 and V2 be two linearly independent three-dimensional row vectors. The cross-product operations on row vectors Vl and V2 have the following properties:

(3)

Conference key distribution system 41 PROPOSITION 2.1. Let A be an m x 2 matrix, rn >_ 2, such that any two row vectors of A form a full rank square matrix. I f

K~ V1 (mod P),

: = A V2

then Ki x W = c ( V 1 X 7 2 ) (mod P), for i = 1,2,... ,m, where c is a constant and W is either

V l o r V 2 .

PROOF. Let V l = (vii, v12, via), V2 = (V2h v2~, v~3) and a l l

a12 I

A = a21 a22

am1 am2 /

Then we have Ki - ( a i l vii + ai~ v21, ail v12 + aiz v~2, ail via + ai2 v~a) (rood P). Without loss

of generality, let W -- V l . We have

Ki x W ( m o d P) = ( a i l vl! + ai2 v21, all 1~12 "1- ai2 I?22, ail V13 .~L ai2 v~3) × (VII, V12, V13) (mod P)

= (via (ail + a,2 v 2) - v12(ai1 via +

v13(ai1

~11 "~"

ai2 v21) -- vii(all

v13 +

ai2

v23),

v12(ail Vll q- ai~ V~l) -- Vll(ail

V12 "b ai2

T)22)) (mod P)

= (ai~(Vla v2~ - Vl~ v~3), ai~(Vl3 v21 - vii v2a), ai~(Vl2 V~l - vii v~z)) (mod P)

= ( - a i ~ ) ( v ~ vz~ - via v~, v~z v~a - v~3 V~l, V~l v~ - Vl~ v~) (mod P) = (-ai~)(Vl x V2) ( m o d P )

= e(V~ x V2) (mod P), for c = (-a/z). |

PROPOSITION 2.2. Let V l x V~ (mod P) = (dl,d2, da) and dl ~ O. Let Ki x W ( m o d P ) = (el, e2, e3) and Kj x W (mod P) - (fl, f2, fa) for i ~ j, where W is either V l o r V 2. If the inverse o f dl, i.e., d'~ 1, over G F ( P ) exists, then

(1) the inverse o f el, i.e., e'~ 1, and the inverse o f f 1 , i.e., f ~ l , over G F ( P ) exist;

(2) (d2 d~'l 1, dad~ "1) = (e2el 1, e 3 e l 1) - - ( f 2 f ~ 1, f a l l 1) (mod P). PROOF. (1): From Proposition 2.1, we know

Similarly, we have

Ki × W (mod P) = ei (V1 x V2) (mod P) = ci (dl, d2, d3) (mod P)

= (ci dl, ci d2, ci da) (mod P)

= (el, ea).

K i × W (mod P) = cj (V1 x V2) (mod P) = cj (dl, d2, d3) (mod P)

= (cj dl, cj d2, cj d3) (mod P) = ( f l , f 2 , f s ) .

However, ci ~ 0 and ej ~ 0, because 7 1 a n d 7 2 are linearly independent. Note that P is a prime number. Again, d~'l 1 exists over GF(P) since dl ~ 0. Thus, e~ "1 - (ci dl) -1 ( m o d P ) and f/-1 = (ey dl) -1 (mod P) also exist, because c~ dl ~ 0 and cy dl ~ 0.

(4)

42 T.-C. Wu, Y.-S. Y Z H

(2): By normalizing the row vector (dl, d~, d3) over GF(P), we have the normalized row vector D = (1,

d2dl 1, dad'~ 1)

( m o d P ) .

Again, by normalizing the row vector (el, e2, e3) over GF(P), we have

E : (1, e2 e l 1, e3 e l 1) (mod P) -(1,- ci

d2 (ci

dl)-I ,

ci d3 (ci

dl) -1 ) = (1,

d2d'~ 1,

d3d~ "1) (modP),

(mod P)

since ci c~ "I = 1 (mod P). Similarly, we have

F = (1,

f 2 f l 1,

f3fl 1) ( m o d P ) = (1,

cj

d2 (cj dl) -1, cj d3 (cj dl) -1)

-- (1,

d2d'~ 1,

dad11) ( m o d P ) ,

(mod P)

since cjcj "1 - 1 (modP). Therefore, D = E = F. That is,

(d2dl 1,

d3dl 1)

- (e2el 1, e3e~ "1) -- ( f 2 f ~ 1, f3f~ "1)

(rood P).

|

The following example illustrates Proposition 2.1 and Proposition 2.2.

E X A M P L E 2 . 1 . L e t P = 3 1 , V 1 = ( 2 , 3 , 5 ) , V 2 = ( l , 2 , 4 ) a n d A = 2 . Then we have 4 K 1 2 3 2 3 5 (rood31)= 13 K 2 - 1 2 4 K3 11 21 Thus, we have V l x V2 K1 x V l (mod 31) = (2, 3, 1), and (mod 31) = ( - 6 , - 9 , - 3 ) (mod 31) -- (-3) (2,3, 1) (mod 31) = 28 (2,3, 1) (mod31) = 2 8 ( V l x V 2 ) (mod31) = (25, 22, 28).

The reader may verify that

K 2 × V l (mod31) = 29(Vi × V2) (mod31), and K s x V l (mod31) -" 27(V1 × V2) (mod31),

from which Proposition 2.1 follows. Since P is prime, the inverse of 25 over GF(31) exists, and 25 -1 = 5 (mod 31). Thus, (22.25 -1, 28.25 -1) (mod31) = (17, 16 I. Again, 2 -1 = 16 (rood31). We have ( 3 . 2 -1, 1 . 2 -1) (rood31) = (17,16) = ( 2 2 . 2 5 -1, 2 8 . 2 5 -1) (mod31), from which Proposition 2.2 follows. Based upon the above properties, we shall propose a CKDS in the next section.

(5)

Confcs~nce key dlstributicm system 43 3. O U R CKDS

Let there be n + 1 intended principals U0, U1,...,

Un

in a network system. Let P be a large prime number and a be a primitive element, mod P. Both P and a are known to all intended principals. When the network is set up, each principal Hi is initially assigned an identification number IDi, a distinct secret key zi and a public key

Yi,

where zi and Yi are derived from the Diflie-Hellman public key system. Without loss of generality, let [To be the chairperson who wants to originate a secure conference. Let Ul, U2,... ,Urn be legal intended principals, and let

Um+l,U,n+a,..., Un

be illegal intended principals. For holding a secure conference, U0 computes a common conference key CK to let only the legal intended principals recover it; while the illegal intended principals cannot. Once the conference key CK is retained by all participating members of the conference, they can broadcast the conference messages enciphered by CK. Thereafter, a secure conference is achieved. The algorithm for originating a secure conference by the chairperson U0 is stated as follows.

Algorithm ORIGINATE

Input: 1. the secret key z0 of U0;

2. all public keys yis of Ui, for i = 1, 2 , . . . , n. Output: 1. a conference key CK;

2. a three-dimensionM row vector Vl, and interpolating polynomials FI(X), F2(X) and F3(X).

Step 1: Randomly choose two linear independent three-dimensional row vectors Vl = (v11, v12, v13) and V~ = (v21, v22, v2a),

such that v12 v2s ~ v13 v22.

Step 2: Compute a row vector (dl, d2, ds) = Vl × V2 (mod P).

Step 3: Set the conference key CK = (d2 d~ "1,

dsd~ 1)

(mod P), where d~ "1 is the inverse of dl over GF(P).

Step 4: Randomly choose an m × 2 matrix A, such that any two row vectors in A form a full rank square matrix and then compute

Ks = A Vl

• V2

m

(mod P),

where Ki = (kil, ki2, kia).

Step 5: Using an interpolation method [8], do the following:

(5.1): Construct the polynomial

FI(X)

over GF(P) by interpolating on points (IDi, y~o. hi1 (mod P))s and (IDj, 0)s, for i = 1, 2 , . . . , m and j = m + 1, m + 2 , . . . , n. (5.2): Construct the polynomial

F2(X)

over GF(P) by interpolating on points (IDi, y~O.

hi2 (mod P ) ) s and (IDj, 0)s, for i = 1, 2 , . . . , rn and j = m + 1, m + 2, . . . . n. (5.3): Construct the polynomial

Fs(X)

over GF(P) by interpolating on points (IDi, y~°-

kis (mod P))s and (IDj, 0)s, for i = 1, 2 , . . . , m and j = m + 1, m + 2 , . . . , n. Step 6: Publish V1, FI(X), F2(X), and Fs(X).

When the public parameters V1, FI(X), F2(X), and Fs(X) are retained, each intended principal Ui performs the following algorithm to recover the conference key CK.

Algorithm RECO VER-CK

Input: 1. secret key zi of Ui;

2. public key Y0 of U0;

3. public parameters V l , FI(X),

F2(X), and Fs(X).

Output: the conference key CK.

(6)

44 T.-C. Wu, Y.-S. YEH Step 1: Compute

wil = Ft(IDi) (mod P), wi~ = F2(IDi) (mod P), wl3 = F3(IDi) (mod P).

and

Step 2: If wll = w~2 = w~3 = 0, then stop, because Hi is an illegal intended principal to the conference.

Step 3: Compute z~ = y~' (rood P). Step 4: Compute

~il = UJil" Z~ 1 ( m o d P ) ,

ki~ = wi~" z~ "1 ( m o d P ) , ki3 = wi3" z~-I (mod P),

and

where z~ -1 is the inverse of

zl

over GF(P). Let Ki =

(kil, ki2,

kia).

Step 5: Compute

(eil,ei2,eia)

= Ki X Vl ( m o d P ) . Step 6: Recompute the conference key CK as

CK = (e,2. e~ 1, ei3. e~ 1) (mod P), where e~ 1 is the inverse of eil.

In Step 3 of algorithm ORIGINATE, the inverse of dl exists, since v12 v2s ~ v13 v22 and P is prime. Similarly, the inverse of el exists in Step 6 of algorithm I~ECOVER-CK. It is to see that if anyone is able to determine the vector

(kil,ki2,ki3),

then he can recover the conference key CK computed by the chairperson U0. Further, by the Diflie-Hellman PKDS, we have

y~,-y~o

(mod P).

Consequently, each legal intended principal Ui can use his secret key zi and U0s public key y0, associated with the public parameters FI(X), F2(X), and F3(X), to recover CK. From Propo- sition 2.1 and Proposition 2.2, we see that the conference key CK chosen by the chairperson and the CK recovered by the legal intended principals are the same. When all the participating members of the conference have recovered the conference key CK, they can transmit conference messages enciphered by CK along with the broadcast links of the network. We will give examples to show how the algorithms ORIGINATE and RECOVER-CK work.

EXAMPLE 3.1 [ORIGINATE]. Let there be five principals U0, U1, U2, U3, and U4 in the network. Let P - 31 and ~ - 7. Initially, the identification numbers, secret keys and public keys are as (ID0, z0, Y0) - (0, 3, 2), (IV1, zl, Yl) - (1, 7, 28), (IV2, z2, y2) - (2, 6, 4), (IDa, z3, y3) - (3, 4, 14), and (ID4, z4, Y4) - (4, 10, 25), respectively. Suppose that U0 wants to originate a secure conference, and U1 and U2 are legal intended principals, while U3, U4 are illegal intended principals. First, U0 randomly chooses two row vectors, say Vl - (2, 3, 5) and V~ - (1, 2, 4), and computes

Vl × V2 ( m o d P ) - (2,3,5) x (1,2,4) ( m o d 3 1 ) - (2,3,1). Then, U0 computes the conference key CK as

C K - ( 3 . 2 - 1 , 1 . 2 -1 ) (mod 31) = (17,16).

By performing Step 4 of ORIGINATE, let A = ( 2 32 ~ And the row vectors for the legal 1 J

intended principals U1 and U2 are

(7)

Conference key distribution s y s t e m 45 respectively. After that, three interpolating polynomials can be constructed by applying the

secret key of U0 and all intended principals' identification numbers IDis and public keys yis, as F I ( X ) = 2 0 X 3 + 10X 2 + 2 7 X + 2 (mod31),

F2(X)

= 3 0 X 3 + 16X 2 + 1 8 X + 15 (mod31), Fa(X) = 19 X 3 + 28 X 2 + 10 (mod 31). and we have Wll = Ft(ID1) w12 = F2(ID1) w13 = F3(ID1) (rood P) = FI(1) ( m o d P) = F~(1) (rood P) = F3(1) Since Wll ~ 0, w12 ¢ 0, and w13 # 0,

Step 3 of algorithm RECOVER-CK, U1 computes Zl --. y ~ l

and then retains Ki = (k11, kl~, k13)

kll -- 28 kl~ = 17

k13 ---- 26 Next, U1 computes

(e11, e12, els) = K1 × V l Thus, U1 recovers CK as (mod P ) = 2 ~ a s • 4 -1 (mod31) = 7, • 4 -I (mod31) = 12, • 4 -1 (mod31) = 22. ( m o d P) = (7, 12, 22) x (2, 3, 5) C K = (22-25 -1, 28.25 -1 ) (mod31) = (17, 16), which is identical to the C K generated by the chairperson U0.

As to the illegal intended principal, say U3, he computes

Wal = FI(ID3) w32 = F2(ID3) w33 = F3(ID3) (mod P) = F1(3) (mod P) = F2(3) (mod P) = Fa(3) (rood 31) = 0, (mod 31) = 0, (mod 31) = 0.

Thus, U3 cannot recompute the CK from the public parameters V l , FI(X), F~(X), and

Fs(X).

The reader may verify the performing of algorithm RECOVER-CK for Us and U4.

4. S E C U R I T Y ANALYSIS AND D I S C U S S I O N S

From algorithm RECOVER-CK, it is easy to see that anyone who knows the secret key zi can retain the row vector Ki. And then he can recover CK by computing Ki x V l . However, the

difficulty of computing xi from

yl

is based on the difficulty of computing a discrete logarithm over G F ( P ) [1]. Suppose the prime number P is represented as 200 bits, then taking logs mod P for determining xi requires approximately 10 s° operations. For a sufficiently large value of zi, say 664 bits, the fast algorithms for computing the discrete logarithm function are intractable [9]. U1 can confirm that he is a legal intended principal. From

(mod 31) = 4, and (mod 31) = (25, 22, 28). and (rood31) = 28, (mod31) = 17, (mod31) = 26. and

In order to let the legal intended principals have the ability to recover CK, Uo broadcasts V l , FI(X), F2(X), and Fs(X) in the network.

EXAMPLZ 3.2 [ R E C O V E R - K E Y ] . Reconsider Example 3.1. We will show how the legal intended principal, say U1, recovers the conference key CK. By Step 1 of algorithm RECOVER-CK,

(8)

46 T.-C. Wu, Y.-S. YEH

Further, Pholig and HeRman [10] pointed out that if P - 1 has at least one large prime factor, then it is very difficult to compute discrete logarithms on m o d P .

In our scheme, the secret keys of participating members of a secure conference do not interfere with the construction of K i s , which can be used to recover the conference key CK. Thus, any intended principals in the network have no useful information for revealing any other principals' secret keys. Again, for the construction of the interpolating polynomials F I ( X ) , F2(X), and F a ( X ) , we exclude the illegal intended principals Ujs by interpolating on the points (IDj, 0)s. Therefore, our CKDS can prevent any illegal intended principals from fortuitously recomputing the conference key CK. T h e amount of storage for the public parameters V h F I ( X ) , F2(X), and F a ( X ) are 3(n .6 1) l o g r ( P + 1)1 bits, where 3n [log(P .6 1)1 bits are used for storing the coefficients of the F / ( X ) s and the 3 [log(P .6 1)1 bits are used for storing the row vector Vi.

Next, we discuss the computational complexity of our CKDS. Denning [9] presented an efficient algorithm for computing the inverse of a number z mod P . T h e average number of divisions performed by his algorithm is approximately (0.843 In P .6 1.47). For computing the matrix A used in Step 4, a straightforward algorithm can be performed by O ( m ) multiplications, where m is the number of legal intended principals. Thus, the complexity of our CKDS heavily depends on the construction of interpolating polynomials in Step 5 of algorithm O R I G I N A T E . By using the Lagrange formula, it requires n additions, 2n 2 .6 2 subtractions, 2n 2 -6 n - 1 multiplications, and n -6 1 divisions, plus one modular operation to compute an interpolating polynomial F ( X )

with degree of n [8]. As to evaluate the interpolating polynomial F ( X ) , we only require n multiplications, 2n additions, plus one modular operation by applying Hornet's rule [8]. Thus, our CKDS is practical to implement.

5. C O N C L U S I O N S

We have extended the Diffie-Hellman P K D S to a CKDS. Our proposed CKDS is based on the properties of cross-product operations on row vectors. We have also shown t h a t our CKDS is crypto-secure. T h e characteristics of our CKDS are:

(1) From the public parameters, an intruder or any intended principal in the network cannot know how m a n y and who are the legal intended principals in the conference.

(2) T h e construction of the conference key does not interfere with the secrets of the intended principals. Thus, any intended principal in the network has no useful information for revealing any other principals' secret keys.

(3) Due to the computational complexity discussed in the previous section, our CKDS can be implemented practically.

REFERENCES

1. W. Diffie and M.E. Hellman, New directions in cryptography, IEEE Trans. on Information Theory IT-22 (6), 644-654 (1976).

2. G.H. Chiou and W.T. Chen, Secure broadcasting using secure lock, IEEE Trans. on Software Engineering

SE-15 (8), 929-934 (1989).

3. C. Mitchell, Multi-destination secure electronic mail, The Computer Journal 32 (1), 13-15 (1989). 4. I. Ingemarson, D.T. Tang and C.K. Wong, A conference key distribution system, IEEE Trans. on ln]orma-

tion Theory IT-28 (5), 714-720 (1982).

5. K. Koyama and K. Ohta, Identity-based conference key distribution system in broadcasting networks,

Electronic Letters 28 (10), 647-649 (1987).

6. E. Okmnoto and K. Tanaks, Key distribution system based on identification information, IEEE Journal oJ

Selected Areas in Communications T (4), 481-485 (1989).

7. C.S. Laih, J.Y. Lee and L. Ham, A new threshold scheme and its application in designing the conferealce key distribution cryptosystem, Information Processing Letters 32 (3), 95-99 (1989).

8. D.E. Knuth, The Art o/ Computer Programming: Volume ~, Seminumerical Algorithms, 2 nd edition, Addison-Wesley, MA, (1981).

9. D.E. Denning, Cryptography and Data Security, Addison-Wesley, MA, (1982).

10. S. Pohlig and M.E. HeRman, An improved algorithm for computing logarithnm over GF(P) and its crypto- graphic significance, IEEE Trans. on ln/ormation Theory IT-24 (1), 106-110 (1978).