RFC 6507

Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI)

📅 published February 2012, from ietf

RFC 6507: ECCSI, Elliptic Curve-Based Certificateless Signatures ✨

Who: M. Groves from CESG, writing as part of the IETF 🎀 Category: Informational, so this is not a Standards Track spec, just published for info 📚 Date: February 2012 🗓️ ISSN: 2070-1721 Obsoletes/Updates: The title block doesn't list anything it obsoletes or updates 🙌

Abstract

okay so lots of signature schemes rely on certificates to prove who you are, and in identity-based crypto that's basically extra overhead and admin you don't need 🙄 ECCSI (Elliptic Curve-based Certificateless Signatures for Identity-based Encryption) is the scheme in this doc, and it's certificateless! 🦋 It's also low-bandwidth and light on computation, so it's giving efficiency 💅

Status of This Memo

this doc is not an Internet Standards Track spec, it's just published for info 💖

it's a product of the IETF 🎀, and the IESG approved it for publication 👑. Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 for that 💅

for the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc6507 🌸

Copyright Notice

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as of the publication date 📜 Please actually read them, bestie, they spell out your rights and restrictions for this doc 🫶 Any Code Components pulled out of this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License ⚠️

   1. Introduction ....................................................2
      1.1. Requirements Terminology ...................................3
   2. Architecture ....................................................3
   3. Notation ........................................................5
      3.1. Arithmetic .................................................5
      3.2. Representations ............................................6
      3.3. Format of Material .........................................6
   4. Parameters ......................................................7
      4.1. Static Parameters ..........................................7
      4.2. Community Parameters .......................................8
   5. Algorithms ......................................................8
      5.1. User Key Material ..........................................8
           5.1.1. Algorithm for Constructing (SSK,PVT) Pair ...........8
           5.1.2. Algorithm for Validating a Received SSK .............9
      5.2. Signatures .................................................9
           5.2.1. Algorithm for Signing ...............................9
           5.2.2. Algorithm for Verifying ............................10
   6. Security Considerations ........................................11
   7. References .....................................................13
      7.1. Normative References ......................................13
      7.2. Informative References ....................................13
   Appendix A. Test Data..............................................14

1. Introduction 🧚

digital signatures do authentication across tons of apps 💕 Usually the chain of trust comes from certificates, but in low-bandwidth or other resource-constrained places, certificates can be a hard no 🙅‍♀️ This doc describes ECCSI, an efficient elliptic curve-based certificateless signature scheme, mainly meant for Identity-Based Encryption (IBE) schemes like the one in [RFC6508] 🦋 Since there are no certificates, you don't have to send or store them to authenticate each message, which is honestly iconic ✨ The algorithm draws on ideas from Arazi [BA] and is originally based on the Elliptic Curve Digital Signature Algorithm [ECDSA], one of the most-used signature algorithms out there 💅

the algorithm is for this setup 👑

there are two parties, a Signer and a Verifier 🎀
each party has a short, unambiguous Identifier string that's naturally tied to them 🪪
a message gets signed and then verified (like authenticating the initiating party during an Identity-based key establishment) 💌
a common Key Management Service (KMS) is the root of trust for both parties 🌳

the scheme doesn't rely on any web of trust between users, no vibes-based trust here 🙅‍♀️

authentication happens in one simplex transmission, with no per-session check-in with any third party 🚀 So it's perfect when the receiver doesn't need to be online (or even enrolled) when the message gets sent, or when you want to keep the number of transmissions low for efficiency 🍓

instead of a certificate, the Signer has an Identifier, and the KMS binds their Secret Signing Key (SSK) (see Section 2) to it using a Public Validation Token (PVT) (see Section 2) ✨ Unlike a traditional public key, the PVT doesn't need any more explicit certification, which is so unbothered of it 💖

the verification primitive here can be built using projective representation of elliptic curve points 🦋 It skips arithmetic field divisions and doesn't explicitly use the size of the underlying cryptographic group, which is seriously clever 🧠

1.1. Requirements Terminology 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📖

2. Architecture 🏗️

a KMS sets up key material for a group of communicating devices (a "user community") 🌸 Each device in the community MUST have an Identifier (ID) that its peers can form 🪪 These Identifiers MUST be unique to devices (or users), and they MAY change over time 🔄 So every app using this signature scheme MUST define an unambiguous format for Identifiers, no exceptions 🙅‍♀️ We're looking at one device (the Signer) sending a message to another (the Verifier) 💌 Only the Signer's ID shows up in the signature scheme 💖

ahead of time, the KMS picks its KMS Secret Authentication Key (KSAK), which is the root of trust for all the other key material in the scheme 👑 From that, the KMS derives the KMS Public Authentication Key (KPAK), which every device needs in order to verify signatures 🔑 This becomes the root of trust for verification 🌳

before verifying any signatures, members of the user community get the KPAK 📬 The supply of the KPAK MUST be authenticated by the KMS, and each member of the user community MUST verify that authentication 🔐 Confidentiality protection MAY also be applied 🫶

the algorithms in this doc assume there's one KMS, one user community, and therefore one KPAK 💅 Apps MAY support multiple KPAKs, and some KPAKs could honestly be "private" to certain communities in certain situations 🤫 How to pick which KPAK to use (when more than one is available) is out of scope 🚫

the KMS generates and provisions key material for each device 🔑 It MUST supply an SSK along with a PVT to every device that's going to send signed messages 💌 The mechanism for providing these SSKs MUST be secure, because the security of the authentication from ECCSI signatures is no stronger than the security of this supply channel 🚨 Don't skip this one, bestie 😭

before using the supplied key material (SSK, KPAK) to form signatures, the Sender MUST verify the key material (SSK) against the root of trust (KPAK), and against its own ID and its PVT, using the algorithm in Section 5.1.2 🔍

during signing, once the Signer has formed its message, it signs the message with its SSK ✍️ It transmits the Signature (including the PVT), and it MAY also transmit the message (for when the Verifier doesn't already know it) 📨 Then the Verifier MUST use the message, Signature, and Sender ID in verification against the KPAK 🔎

this doc specifies

an algorithm for creating a KPAK from a KSAK, for a given elliptic curve 🌈
a format for transporting a KPAK 📦
an algorithm for creating an SSK and a PVT from a Signer's ID, using the KSAK 🔑
an algorithm for verifying an SSK and a PVT against a Signer's ID and KPAK ✅
an algorithm for creating a Signature from a message, using a Signer's ID with a matching SSK and PVT ✍️
a format for transporting a Signature 📮
an algorithm for verifying a Signature for a message, using a Signer's ID with the matching KPAK 💅

this doc does not specify (but it does comment on) 👀

how to choose a valid and secure elliptic curve 🌀
which hash function to use 🔐
how to format a Signer's ID 🪪
how to format a message for signing 📝
how to manage and install a KPAK 🛠️
how to transport or install an SSK 🚚

as used in [RFC6509], the elliptic curve and hash function are specified in Section 2.1.1 of [RFC6509], the format of Identifiers is specified in Section 3.2 of [RFC6509], and messages for signing are formatted as specified in [RFC3830] 📚

3. Notation 🎨

3.1. Arithmetic 🧮

ECCSI runs on elliptic curve arithmetic 🌙 If P and Q are two elliptic curve points, their addition is written P + Q ➕ Adding P to itself k times is written [k]P ✨

F_p is the finite field of p elements, where p is prime 🔢 All elliptic curve points are defined over F_p 🦋

the curve is defined by the equation y^2 = x^3 - 3*x + B modulo p, where B is an element of F_p 📐 Elliptic curve points, other than the group identity (0), are represented as P = (Px,Py), where Px and Py are the affine coordinates in F_p that satisfy the above equation 💖 A point P = (Px,Py) is said to lie on an elliptic curve if Py^2 - Px^3 + 3*Px - B = 0 modulo p 🫶 The identity point 0 needs no representation at all, which is honestly the least-drama thing ever 😌

3.2. Representations ✨

okay bestie, this is where things get strict 💅 every implementation has to write these values the exact same way, or nobody can agree on anything 🫶 The following representations MUST be used for input into hash functions and for transmission. Quick decoder ring: s || t means concatenating octet strings s and t, and lg(a) is the logarithm base 2 of a real number a 🤓

Integers           Integers MUST be represented as an octet string,
                   with bit length a multiple of 8.  To achieve this,
                   the integer is represented most significant bit
                   first, and padded with zero bits on the left until
                   an octet string of the necessary length is
                   obtained.  This is the octet string representation
                   described in Section 6 of [RFC6090].  There will
                   be no need to represent negative integers.  When
                   transmitted or hashed, such octet strings MUST
                   have length N = Ceiling(lg(p)/8).

F_p elements       Elements of F_p MUST be represented as integers in
                   the range 0 to p-1 using the octet string
                   representation defined above.  For use in ECCSI,
                   such octet strings MUST have length N =
                   Ceiling(lg(p)/8).

Points on E        Elliptic curve points MUST be represented in
                   uncompressed form ("affine coordinates") as
                   defined in Section 2.2 of [RFC5480].  For an
                   elliptic curve point (x,y) with x and y in F_p,
                   this representation is given by 0x04 || x' || y',
                   where x' is the N-octet string representing x and
                   y' is the N-octet string representing y.

So for integers, you write the most significant bit first and pad with zeros on the left until you hit a multiple of 8 bits 🌸 That's the octet string thing from [RFC6090], Section 6. Negative integers aren't a thing here, so don't even 🙈 And when you send or hash these, the length MUST be N = Ceiling(lg(p)/8).

For F_p elements, they're just integers from 0 to p-1, written with the same octet string method, and again the length MUST be N = Ceiling(lg(p)/8) for ECCSI ✨

Points on E get written in uncompressed "affine coordinates", the way [RFC5480] Section 2.2 describes. A point (x,y) becomes 0x04 || x' || y', where x' and y' are the N-octet strings for x and y 🦋

3.3. Format of Material 🎀

This section is all about the subfields inside the different objects the protocol uses, so you know what goes where 💖

Signature = r || s || PVT   where r and s are octet strings of length
                            N = Ceiling(lg(p)/8) representing
                            integers, and PVT is an octet string of
                            length 2N+1 representing an elliptic
                            curve point, yielding a total signature
                            length of 4N+1 octets.  (Note that r and
                            s represent integers rather than elements
                            of F_p, and therefore it is possible that
                            either or both of them could equal or
                            exceed p.)

A signature is r || s || PVT. Both r and s are N-octet integers, and PVT is a 2N+1 octet point, so the whole thing comes out to 4N+1 octets 😭 Also, r and s are integers, NOT elements of F_p, which means either one (or both) could be equal to or bigger than p. Wild, right? 👑

4. Parameters 🧚

4.1. Static Parameters 💜

These static parameters get fixed for each implementation. They aren't meant to change often, and each user community MUST specify them. Also, these parameters MAY be shared across multiple KMSs 🌈

n — A security parameter; the size in bits of the prime p over which elliptic curve cryptography is to be performed.
N = Ceiling(n/8) — The number of octets used to represent fields r and s in a Signature. Also the number of octets output by the hash function (see below).
p — A prime number of size n bits. The finite field with p elements is denoted F_p.
E — An elliptic curve defined over F_p, having a subgroup of prime order q.
B — An element of F_p, where E is defined by the formula y^2 = x^3 - 3*x + B modulo p.
G — A point on the elliptic curve E that generates the subgroup of order q.
q — The prime q is defined to be the order of G in E over F_p.
Hash — A cryptographic hash function mapping arbitrary strings to strings of N octets. If a, b, c, ... are strings, then hash( a || b || c || ...) denotes the result obtained by hashing the concatenation of these strings.
Identifiers — The method for deriving user Identifiers. The format of Identifiers MUST be specified by each implementation. It MUST be possible for each device to derive the Identifier for every device with which it needs to communicate. In this document, ID will denote the correctly formatted Identifier string of the Signer. ECCSI makes use of the Signer Identifier only, though an implementation MAY make use of other Identifiers when constructing the message to be signed. Identifier formats MAY include a timestamp to allow for automatic expiration of key material.

It is RECOMMENDED that p, E, and G are chosen to be standardized values. Specifically, it is RECOMMENDED that the curves and base points defined in [FIPS186-3] be used ✨

4.2. Community Parameters 🫧

One community parameter MUST be supplied to devices every time the root of trust changes 🔁

KPAK — The KMS Public Authentication Key (KPAK) is the root of trust for authentication. It is derived from the KSAK in the KMS. This value MUST be provisioned in a trusted fashion, so that each device that receives it has assurance that it is the genuine KPAK belonging to its KMS. Before use, each device MUST check that the supplied KPAK lies on the elliptic curve E.

The KMS MUST fix the KPAK to be KPAK = [KSAK]G, where the KSAK MUST be chosen to be a random secret non-zero integer modulo q. The KSAK MUST be kept secret to the KMS, no exceptions 🔒

5. Algorithms 🔥

5.1. User Key Material 🗝️

To create signatures, each Signer needs a Secret Signing Key (SSK) and a Public Validation Token (PVT). The SSK is an integer and the PVT is an elliptic curve point. The SSK MUST be kept secret (to the Signer and KMS), but the PVT doesn't need to be secret. You'll need a different (SSK,PVT) pair for each Signer ID 💖

5.1.1. Algorithm for Constructing (SSK,PVT) Pair 🛠️

The KMS builds an (SSK,PVT) pair from the Signer's ID, the KMS secret (KSAK), and the root of trust (KPAK). To do this, the KMS MUST perform the following procedure:

Choose v, a random (ephemeral) non-zero element of F_q;
Compute PVT = [v]G (this MUST be represented canonically -- see Section 3.2);
Compute a hash value HS = hash( G || KPAK || ID || PVT ), an N-octet integer;
Compute SSK = ( KSAK + HS * v ) modulo q;
If either the SSK or HS is zero modulo q, the KMS MUST erase the SSK and abort or restart the procedure with a fresh value of v;
Output the (SSK,PVT) pair. The KMS MUST then erase the value v.

How the SSK gets transported to the legit Signer device is out of scope for this document, but the SSK MUST be provisioned by the KMS using a method that protects its confidentiality 🔐 And if it's necessary, the KMS MAY create multiple (SSK,PVT) pairs for the same Identifier 🧩

5.1.2. Algorithm for Validating a Received SSK 🔍

Every SSK MUST be validated before it gets installed as a signing key, no shortcuts 🙅‍♀️ The Signer uses its ID and the KPAK to validate a received (SSK,PVT) pair. For that validation, the Signer MUST perform the following procedure, passing all checks:

Validate that the PVT lies on the elliptic curve E;
Compute HS = hash( G || KPAK || ID || PVT ), an N-octet integer. The integer HS SHOULD be stored with the SSK for later use;
Validate that KPAK = [SSK]G - [HS]PVT.

5.2. Signatures ✍️

5.2.1. Algorithm for Signing 💌

To sign a message (M), the Signer needs:

the KMS Public Authentication Key, KPAK;
the Signer's own Identifier, ID;
its Secret Signing Key, SSK;
its Public Validation Token, PVT = (PVTx,PVTy).

These values, except for ID, MUST have been provided by the KMS. The Signer works out the value of ID using the community-defined method for formatting Identifiers 🎀

The Signer MUST use the following procedure to compute the signature:

Choose a random (ephemeral) non-zero value j in F_q;
Compute J = [j]G (this MUST be represented canonically). Viewing J in affine coordinates J = (Jx,Jy), assign to r the N-octet integer representing Jx;
Recall (or recompute) HS, and use it to compute a hash value HE = hash( HS || r || M );
Verify that HE + r * SSK is non-zero modulo q; if this check fails, the Signer MUST abort or restart this procedure with a fresh value of j;
Compute s' = ( (( HE + r * SSK )^-1) * j ) modulo q; the Signer MUST then erase the value j;
If s' is too big to fit within an N-octet integer, then set the N-octet integer s = q - s'; otherwise, set the N-octet integer s = s' (note that since p is less than 2^n, by Hasse's theorem on elliptic curves, q < 2^n + 2^(n/2 + 1) + 1. Therefore, if s' > 2^n, we have q - s' < 2^(n/2 + 1) + 1. Thus, s is guaranteed to fit within an N-octet integer);
Output the signature as Signature = ( r || s || PVT ).

Step 6 is necessary because q (and so the elements of F_q) can be too big to fit within N octets 🧐 The Signer MAY instead elect to set s to be the least integer of s' and q - s', represented in N octets 🌟

5.2.2. Algorithm for Verifying ✅

This algorithm assumes that the Verifier computes points on elliptic curves using affine coordinates. However, the Verifier MAY perform elliptic curve operations using any appropriate representation of points that achieves the equivalent operations ✨

To verify a Signature ( r || s || PVT ) against a Signer's Identifier (ID), a message (M), and a pre-installed root of trust (KPAK), the Verifier MUST perform a procedure equivalent to the following:

The Verifier MUST check that the PVT lies on the elliptic curve E;
Compute HS = hash( G || KPAK || ID || PVT );
Compute HE = hash( HS || r || M );
Y = [HS]PVT + KPAK;
Compute J = [s]( [HE]G + [r]Y );
Viewing J in affine coordinates (Jx,Jy), the Verifier MUST check that Jx = r modulo p, and that Jx modulo p is non-zero, before accepting the Signature as valid.

It's expected that the ID, message (M), and KPAK will be implicitly understood from context, but any of these values MAY also be included in signaling 💬 And note that the parameter q isn't needed during verification 🦋

6. Security Considerations 🔐✨

Okay bestie, this is the serious part, so grab a snack 🍓. ECCSI's crypto is built on [ECDSA] 💅. Step 5) in the verification algorithm is literally the same as the verification stage in ECDSA 🫶. The only real difference is that in ECCSI the 'public key', Y, gets derived from the Signer ID by the Verifier, whereas in ECDSA the public key is fixed 🦋. So the security of ECCSI depends entirely on the secrecy of the secret keys 🤫. To recover secret keys you'd need seriously intense cryptanalytic attacks, so it's not a quick job 💀.

The KSAK is what keeps every device provisioned by the KMS safe 🛡️. It MUST NOT be revealed to any entity other than the KMS that holds it 🙅‍♀️. Each user's SSK authenticates the user as being linked to the ID the KMS assigned it to 🎀. This key MUST NOT be revealed to any entity other than the KMS and the authorized user 👑.

The order of the base point G used in ECCSI MUST be a large prime q 🔢. If k bits of symmetric security are needed, Ceiling(lg(q)) MUST be at least 2*k 💖.

It is RECOMMENDED that the curves and base points defined in [FIPS186-3] be used, since these curves are suitable for cryptographic use 🌸. However, if other curves are used, the security of the curves MUST be assessed 🧐.

In order to ensure that the SSK is only received by an authorized device, it MUST be provided through a secure channel 📬. The strength of the authentication offered by this signature scheme is no greater than the security provided by this delivery channel 🔒.

Identifiers MUST be defined unambiguously by each application of ECCSI 🏷️. Note that it is not necessary to use a hash function to compose an Identifier string. That way, any weaknesses that might otherwise be caused by collisions in hash functions can be avoided, without relying on the structure of the Identifier format 🧠. Applications of ECCSI MAY include a time/date component in their Identifier format, so that Identifiers (and hence SSKs) are only valid for a fixed period of time ⏳.

The use of the ephemeral value r in the hash HE significantly reduces the scope for offline attacks, which improves the overall security compared to [ECDSA] 📈. Furthermore, if Identifiers are specified to contain date-stamps, then all Identifiers, SSKs, signatures, and hash values will periodically become deprecated automatically, which reduces the need for revocation and other extra management methods 🧹✨.

The randomness of values stipulated to be selected at random, as described in this document, is essential to the security provided by ECCSI 🎲. If the value of the KSAK can be predicted, then any signatures can be forged 😱. Similarly, if the value of v used by the KMS to create a user's SSK can be predicted, then the value of the KSAK could be recovered, which would allow signatures to be forged 🙈. If the value of j used by a user is predictable, then the value of his SSK could be recovered, and that would allow that user's signatures to be forged 💀. Guidance on generating random values for security can be found in [RFC4086] 📚.

Note that in most instances, the value s in the Signature can be replaced by q - s. So the malleability of ECCSI signatures is similar to that in [ECDSA]: malleability is available, but it's also very limited 🦋.

7. References 📚

7.1. Normative References 💜

[ECDSA] X9.62-2005, "Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA)", November 2005.
[FIPS186-3] Federal Information Processing Standards Publication (FIPS PUB) 186-3, "Digital Signature Standard (DSS)", June 2009.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk, "Elliptic Curve Cryptography Subject Public Key Information", RFC 5480, March 2009.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic Curve Cryptography Algorithms", RFC 6090, February 2011.

7.2. Informative References 🌈

[BA] Arazi, Benjamin, "Certification of DL/EC Keys", paper submitted to P1363 meeting, August 1998, <http://grouper.ieee.org/groups/1363/StudyGroup/contributions/arazi.doc>.
[FIPS180-3] Federal Information Processing Standards Publication (FIPS PUB) 180-3, "Secure Hash Standard (SHS)", October 2008.
[RFC3830] Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K. Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830, August 2004.
[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker, "Randomness Requirements for Security", BCP 106, RFC 4086, June 2005.
[RFC6508] Groves, M., "Sakai-Kasahara Key Encryption (SAKKE)", RFC 6508, February 2012.
[RFC6509] Groves, M., "MIKEY-SAKKE: Sakai-Kasahara Key Encryption in Multimedia Internet KEYing (MIKEY)", RFC 6509, February 2012.

Appendix A. Test Data 🧪🎀

This appendix is test data built from the NIST P-256 curve and base point 💎. SHA-256 (as defined in [FIPS180-3]) is the hash function here 🔥. The keys and ephemerals (KSAK, v, and j) are arbitrary and just for illustration 🌷.

   // --------------------------------------------------------
   // Global parameters

   n       := 256;

   N       := 32;

   p       := 0x   FFFFFFFF 00000001 00000000 00000000
                   00000000 FFFFFFFF FFFFFFFF FFFFFFFF;

   Hash    := SHA-256;

   // --------------------------------------------------------
   // Community parameters

   B       := 0x   5AC635D8 AA3A93E7 B3EBBD55 769886BC
                   651D06B0 CC53B0F6 3BCE3C3E 27D2604B;

   q       := 0x   FFFFFFFF 00000000 FFFFFFFF FFFFFFFF
                   BCE6FAAD A7179E84 F3B9CAC2 FC632551;

   G       := 0x   04
                   6B17D1F2 E12C4247 F8BCE6E5 63A440F2
                   77037D81 2DEB33A0 F4A13945 D898C296
                   4FE342E2 FE1A7F9B 8EE7EB4A 7C0F9E16
                   2BCE3357 6B315ECE CBB64068 37BF51F5;

   KSAK    := 0x   12345;

   KPAK    := 0x   04
                   50D4670B DE75244F 28D2838A 0D25558A
                   7A72686D 4522D4C8 273FB644 2AEBFA93
                   DBDD3755 1AFD263B 5DFD617F 3960C65A
                   8C298850 FF99F203 66DCE7D4 367217F4;

   // --------------------------------------------------------
   // Signer ID

   ID      := "2011-02\0tel:+447700900123\0",
            = 0x   3230 31312D30 32007465 6C3A2B34
                   34373730 30393030 31323300;

   // --------------------------------------------------------
   // Creating SSK and PVT

   v       := 0x   23456;

   PVT     := 0x   04
                   758A1427 79BE89E8 29E71984 CB40EF75
                   8CC4AD77 5FC5B9A3 E1C8ED52 F6FA36D9
                   A79D2476 92F4EDA3 A6BDAB77 D6AA6474
                   A464AE49 34663C52 65BA7018 BA091F79;

   HS      := hash( 0x 04
                       6B17D1F2 E12C4247 F8BCE6E5 63A440F2
                       77037D81 2DEB33A0 F4A13945 D898C296
                       4FE342E2 FE1A7F9B 8EE7EB4A 7C0F9E16
                       2BCE3357 6B315ECE CBB64068 37BF51F5
                       04
                       50D4670B DE75244F 28D2838A 0D25558A
                       7A72686D 4522D4C8 273FB644 2AEBFA93
                       DBDD3755 1AFD263B 5DFD617F 3960C65A
                       8C298850 FF99F203 66DCE7D4 367217F4
                       32303131 2D303200 74656C3A 2B343437

                       37303039 30303132 3300
                       04
                       758A1427 79BE89E8 29E71984 CB40EF75
                       8CC4AD77 5FC5B9A3 E1C8ED52 F6FA36D9
                       A79D2476 92F4EDA3 A6BDAB77 D6AA6474
                       A464AE49 34663C52 65BA7018 BA091F79 ),

            = 0x       490F3FEB BC1C902F 6289723D 7F8CBF79
                       DB889308 49D19F38 F0295B5C 276C14D1;

   SSK     := 0x       23F374AE 1F4033F3 E9DBDDAA EF20F4CF
                       0B86BBD5 A138A5AE 9E7E006B 34489A0D;

   // --------------------------------------------------------
   // Creating a Signature

   M       := "message\0",
            = 0x   6D657373 61676500;

   j       := 0x   34567;
   J       := 0x   04
                   269D4C8F DEB66A74 E4EF8C0D 5DCC597D
                   DFE6029C 2AFFC493 6008CD2C C1045D81
                   6DDA6A13 10F4B067 BD5DABDA D741B7CE
                   F36457E1 96B1BFA9 7FD5F8FB B3926ADB;

   r       := 0x   269D4C8F DEB66A74 E4EF8C0D 5DCC597D
                   DFE6029C 2AFFC493 6008CD2C C1045D81;

   HE      := hash( 0x
                   490F3FEB BC1C902F 6289723D 7F8CBF79
                   DB889308 49D19F38 F0295B5C 276C14D1
                   269D4C8F DEB66A74 E4EF8C0D 5DCC597D
                   DFE6029C 2AFFC493 6008CD2C C1045D81
                   6D657373 61676500 ),

            = 0x   111F90EA E8271C96 DF9B3D67 26768D9E
                   E9B18145 D7EC152C FA9C23D1 C4F02285;

   s'      := 0x   E09B528D 0EF8D6DF 1AA3ECBF 80110CFC
                   EC9FC682 52CEBB67 9F413484 6940CCFD;

   s       := 0x   E09B528D 0EF8D6DF 1AA3ECBF 80110CFC
                   EC9FC682 52CEBB67 9F413484 6940CCFD;

   Sig     := 0x   269D4C8F DEB66A74 E4EF8C0D 5DCC597D
                   DFE6029C 2AFFC493 6008CD2C C1045D81
                   E09B528D 0EF8D6DF 1AA3ECBF 80110CFC
                   EC9FC682 52CEBB67 9F413484 6940CCFD
                   04

                   758A1427 79BE89E8 29E71984 CB40EF75
                   8CC4AD77 5FC5B9A3 E1C8ED52 F6FA36D9
                   A79D2476 92F4EDA3 A6BDAB77 D6AA6474
                   A464AE49 34663C52 65BA7018 BA091F79;

   // --------------------------------------------------------
   // Verifying a Signature

   Y       := 0x   04
                   833898D9 39C0013B B0502728 6F95CCE0
                   37C11BD2 5799423C 76E48362 A4959978
                   95D0473A 1CD6186E E9F0C104 B472499E
                   1A24D6CE 3D85173F 02EBBD94 5C25F604;

   J       := 0x   04
                   269D4C8F DEB66A74 E4EF8C0D 5DCC597D
                   DFE6029C 2AFFC493 6008CD2C C1045D81
                   6DDA6A13 10F4B067 BD5DABDA D741B7CE
                   F36457E1 96B1BFA9 7FD5F8FB B3926ADB;

   Jx      := 0x   269D4C8F DEB66A74 E4EF8C0D 5DCC597D
                   DFE6029C 2AFFC493 6008CD2C C1045D81;

   Jx = r  modulo p

   // --------------------------------------------------------

Author's Address 🦋

Michael Groves CESG Hubble Road Cheltenham GL51 8HJ UK

EMail: Michael.Groves@cesg.gsi.gov.uk

📦 where this page comes from

ietf: rfc6507 2012-02
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms