초록 ▼

Proactive robust threshold schemes are presented for general "homomorphic-type" public key systems, as well as optimized systems for the RSA function. Proactive security employs dynamic memory refreshing and enables us to tolerate a "mobile adversary" that dynamically corrupts the components of the

Proactive robust threshold schemes are presented for general "homomorphic-type" public key systems, as well as optimized systems for the RSA function. Proactive security employs dynamic memory refreshing and enables us to tolerate a "mobile adversary" that dynamically corrupts the components of the systems (perhaps all of them) as long as the number of corruptions (faults) is bounded within a time period. The systems are optimal-resilience. Namely they withstand any corruption of minority of servers at any time-period by an active (malicious) adversary (i.e., any subset less than half. Also disclosed are general optimal-resilience public key systems which are "robust threshold" schemes (against stationary adversary), and are extended to "proactive" systems (against the mobile one). The added advantage of proactivization in practical situations is the fact that, in a long-lived threshold system, an adversary has a long time (e.g., years) to break into any t out of the l servers. In contrast, the adversary in a proactive systems has only a short period of time (e.g., a week) to break into any t servers. The model of mobile adversary seems to be crucial to such "long-lived" systems that are expected to span the secure network and electronic commerce infrastructure.

대표청구항 ▼

[ We claim:] [1.] A method of providing a cryptographic service comprising the steps of:selecting a first function having properties useful for providing the cryptographic service;re-expressing the first function as a first plurality of alternate functions;distributing the first plurality of alterna

[ We claim:] [1.] A method of providing a cryptographic service comprising the steps of:selecting a first function having properties useful for providing the cryptographic service;re-expressing the first function as a first plurality of alternate functions;distributing the first plurality of alternate functions to a plurality of distinct, electronic, cryptographic processing apparatus;during a first operational period, (i) at each of a selected set of cryptographic processing apparatus, electronically applying at least one of the first plurality of alternate functions to a first input message to obtain first partial results, and (ii) combining first partial results to obtain a first final electronic output associated with the input message, said output-being identical to the output that would have been obtained by applying the first function to the input message;during an update period, (i) generating a second plurality of alternate functions that re-express the first function, and (ii) distributing the second plurality of alternate functions to distinct cryptographic processing apparatus; andduring a second operational period, (i) at each of a selected set of cryptographic processing apparatus, electronically applying at least one of the second plurality of alternate functions to a second input message to obtain second partial results, and (ii) combining second partial results to obtain a second final electronic output associated with the input message, said second output being identical to the output that would have been obtained by applying the first function to the second input message.