Background A digital signature is a scheme for demonstrating the authenticity of a digital message or document(s). If a recipient is able to confirm that a digital signature appended to a digital message is valid then that recipient can reasonably believe that the message was created by a known sender, that the sender cannot deny having sent the message, and that the message was not altered in transit.

Often digital signatures employ asymmetric cryptography in which a sender's private key is used to generate a digital signature and in which the sender's public key is used by a recipient to verify that the digital signature, and any message to which the digital signature relates, originated with the sender.

In order for digital signature schemes to work, a sender must be able to store one or more private keys securely. A sender may, for example, store the one or more private keys in special hardware, such as a separate memory device or a smart-card. However, in a world in which the use of digital signatures is becoming more prevalent, this proves an expensive and inefficient solution for wide employment of digital signatures. Furthermore, there is a desire to integrate digital signatures with modern technologies such as mobile devices including mobile phones, which a lot of people use for communicating every day. However, mobile devices may not have the capability to physically connect to a card-reader, the connection interfaces often change rapidly, and connecting a card-reader with a mobile phone is inconvenient for a user. Furthermore, the cryptographic algorithms used for digital signatures may become insecure and the key size insufficient. Changing the algorithm or the key size would mostly mean physical replacement of all smart-cards in use.

Software is much easier to update. Mobile devices update their software automatically so that the users often do not even notice the updating process. From an economic perspective, digital signature solutions based solely on software are appealing. The hardest thing to solve in software-based digital signature solutions is private key management. Keys stored in the static memory of a mobile device or any other type of a computer can easily be cloned by attackers who gain access to the memory. With a cloned key, an attacker can create an unlimited amount of forged signatures that are indistinguishable from the genuine signatures used by a genuine sender.

Even if private keys are stored in encrypted form, using passwords as encryption keys, it is possible for attackers to find the right key by using the so-called dictionary attack. With a dictionary attack, an attacker has a dictionary of passwords which they try one by one until the right password is found. For such an attack to succeed, one needs only for there to be a relatively small number of passwords, and a reference point such that the attacker will know when he has been successful. Practice has shown that human-memorisable passwords are too weak to withstand dictionary attacks.

The issues outlined above are at least as pronounced when multi-party protocols are considered. For example, a sender may send a (digitally signed) message to a receiver and receive a response. The response may be, for example, an indication that the digitally signed message has been received and understood by the receiver. The sender may accordingly want to verify that the receiver did indeed receive the original digitally signed message (and not some other message) and that the response did indeed come from the receiver. Alternatively, for commercial reasons or otherwise a sender may wish to send a message to a third party such that the third party can rest assured that the message has been verified by a second party. Accordingly, a secure method for co-signing messages is desired.

Summary

A method is provided for generating a composite cryptographic signature. The method comprises receiving a message and a first part of a first party signature, the first part of the first party signature derived from the message and a first share of a first private key. The method further comprises generating a first party signature from the first part of the first party signature and a second share of the first private key. The method further comprises generating a second party signature from the message and a second private key. The method further comprises combining the first party signature and the second party signature to generate a composite cryptographic signature.

A number of advantages of the present disclosure will be made apparent to the skilled person. For example, in a scenario in which a first party, or client device, holds the first share of the first private key, and a second party, or server, holds the second share of the first private key and the second private key, then neither the first party or second party alone can make a valid composite signature. Furthermore, if the first party, or client device, is compromised then an attacker is unable to apply a dictionary attack without also having to compromise the second party. As will also be described below, it is easy also for the second party to detect when the first party has been compromised.

The first private key and a public key may be a first key pair. The second private key and a public key may be a second key pair. The public key of the first key pair may be the same as the public key of the second key pair.

The first private key may comprise a first private modulus and a first private exponent. The second private key may comprise a second private modulus and a second private exponent. The public key may comprise a public exponent.

The first private modulus may be a product of prime numbers. The second private modulus may be a product of prime numbers. Each of the prime numbers may be coprime to the public exponent. The method may further comprise generating a composite public modulus from the first private modulus and the second private modulus.

The first share of the first private key may comprise a first additive share of the first private exponent. The second share of the first private key may comprise a second additive share of the first private exponent.

The first share of the first private key may comprise a first multiplicative share of the first private exponent. The second share of the first private key may comprise a second multiplicative share of the first private exponent.

The method may further comprise verifying the origin of the first part of the first party signature using the public key and the message. Receiving a message and a first part of the first party signature may comprise receiving a signing request comprising the message and the first part of the first party signature, and verifying the origin of the first part of the first party signature may comprise checking that the signing request further comprises information relating to one or more previous communications from the same origin.

Receiving a message and a first part of a first party signature may comprise receiving a message and a first part of a first party signature from a client device. Receiving a message and a first part of a first party signature may comprise receiving a message and a first part of a first party signature over a secure channel.

The message may be a hashed message. A hash function is any suitable cryptographic function which can be used to map data of arbitrary size to data of a finite size. The message may be a padded message. The message may be both hashed and padded.

An apparatus is provided. The apparatus comprises at least one processor and at least one memory, wherein the at least one memory stores computer-executable instructions which, when executed by the at least one processor, cause the apparatus to perform a method as disclosed herein.

A computer readable medium is provided. The computer readable medium has computer- executable instructions to cause a computer to perform a method according to any of the methods disclosed herein.

A method for generating a composite cryptographic signature is provided. The method comprises, at a first device, generating a first part of a first party signature from a message and a first share of a first private key. The method further comprises, at the first device, sending the message and the first part of the first party signature to a second device. The method further comprises, at the second device, generating a first party signature from the first part of the first party signature and a second share of the first private key. The method further comprises, at the second device, generating a second party signature from the message and a second private key. The method further comprises, at the second device, combining the first party signature and the second party signature to form a composite cryptographic signature.

The method may further comprise, at the second device, communicating the composite cryptographic signature and a composite public key to the first device. The method may further comprise, at the first device, verifying the composite cryptographic signature using the message and the composite public key.

A system for generating a composite cryptographic signature is provided. The system comprises a first device and a second device. The first device and the second device each comprise a processor and at least one memory. The at least one memory of the first device and the at least one memory of the second device each store computer-executable instructions which, when executed by the processors of the first device and the second device

respectively, cause the first device and the second device to perform a method as described herein.

Brief Description of Figures

Illustrative embodiments of the present disclosure will now be described, by way of example only, with reference to the drawings. In the drawings:

Figure 1 shows an illustration of a first party, or client device, and a second party, or server; Figure 2 illustrates a method for generating a composite cryptographic signature;

Figure 3 is a flowchart of a method for generating a composite cryptographic signature; Figure 4 is a flowchart of a method for generating a composite cryptographic signature;

Figure 5 is a flowchart of a method for initialising a second party or server for generating a composite cryptographic signature;

Figure 6 is a flowchart of a method for initialising a first party or client device for generating a composite cryptographic signature; and

Figure 7 is a flowchart for registering a first party or client device at a second party or server.

Throughout the description and the drawings, like reference numerals refer to like parts.

Description

Whilst various embodiments of the invention are described below, the invention is not limited to these embodiments, and variations of these embodiments may be made without departing from the scope of the invention. In the below discussion, the terms "client device" and "server" are used. These terms are purely to distinguish between two parties that interact, i.e. the client device is a first party and the server is a second party. The skilled person would therefore understand that the terms "client device" and "server" are not restrictive. Accordingly, the skilled person would appreciate that a "client signature" or "first party signature" is a digital signature of the first party. Similarly, the skilled person would appreciate that a "server signature" or a "second party signature" is a digital signature of the second party.

In the discussion below, the terms "public" and "private" are used. In the context of asymmetric key pairs, the skilled person would understand that the public key and the private key perform inverse operations, and accordingly, an encryption device may use one of the public key or the private key to encrypt data, and a decryption device may use the other of the public key or the private key to decrypt the data. The skilled person would understand that the private key is a key that is not openly communicated to other parties, and the skilled person would also understand that a public key is a key that is not a private key. While a private key is securely stored, a public key may be knowable to third parties, and may sometimes be openly communicated. For example, a public key may be published in a directory or openly broadcast, or may be a key that an adversary may obtain. Similarly, in what follows, a private exponent or private modulus is an exponent or modulus that is intended to be kept secret. Conversely, a public exponent or a public modulus is an exponent or modulus that is not private.

A key may be shared between two or more parties, where each party holds a share. In such a scenario, a key can only be reconstructed when a sufficient number (of possibly different types) of shares are combined together. Accordingly, a single share of a key on its own cannot be used to reconstruct the key unless combined with a sufficient number of further shares. A key may be "additively shared" if one or more components of shares must be added together to reconstruct the key. In some of the examples that follow, two private exponents are added together to reconstruct a private key. A key may be "multiplicatively shared" if one or more components of shares are multiplied together to reconstruct the key. In some of the examples that follow, two private exponents are multiplied together to reconstruct a private key. The skilled person would appreciate that other types of shares exist and are applicable to the following methods. In the following, a cryptosystem based on modular arithmetic and the factorisation of large numbers is used. That is, the composite signature described below looks like an ordinary RSA (Rivest-Shamir-Adleman) signature and successfully verifies with standard crypto- libraries. However, the skilled person would understand that the methods and techniques taught herein may be used in conjunction with any suitable asymmetric cryptosystem in which public keys and private keys are generated. For example, an asymmetric cryptosystem based on elliptic curves and/or discrete logarithms may be used.

A communication channel is any suitable communication method. A communication channel may be considered secure if an adversary does not have access to data communicated via the communication channel.

Fig 1 shows the architecture of an example system 10. The system 10 comprises a client device 100 and a server 150. The system 10 further comprises a communication channel 20. The communication channel 20 may be a direct channel or an indirect channel over a communications network. For example, the communication channel 20 may comprise the Internet.

Referring to the figure, the client device 100 includes a number of user interfaces including a visual display 110 and a virtual or dedicated user input device 102. The client device 100 further includes a processor 104, a memory 106 and a power system 108. The client device 100 further comprises a communications module 112 for sending and receiving

communications between processor 104 and remote devices such as server 150. For example, the communications module 112 is used for sending and receiving communications across communications channel 20 to a communications module 162 of the server 150. The client device further comprises a port 114 for connecting to further systems, or devices, for example a secondary memory device such as a USB stick.

The processor 104 is configured to receive data, access the memory 106, and to act upon instructions received either from said memory 106, from communications module 112 from user input device 102. The processor 104 is further configured to process instructions pertaining to encryption and decryption. In this respect, the processor 104 is capable of retrieving one or more private keys from memory 106 or from some other source such as via communications module 112 or port 114. The processor is further configured to control the display 110 and to control communications to remote parties such as server 150 via communications module 112. The processor 104 may execute instructions stored in memory 106 in order to encrypt data prior to sending via communications module 112 or in order to decrypt data received from communications module 112.

In operation the processor 104 can execute computer-executable instructions stored in the memory 106 and the results of the processing can be displayed to a user on the display 110. User inputs for controlling the operation of the computer may be received via input device(s) 102.

Server 150 comprises a user inputs device 152 a processor 154, a memory 156, a power system 158, a visual display 160, a communications module 162 and a port 164. The communications module 162 is used by the server to send and receive communications from one or more client devices 100. The processor 154 is configured to receive data, access the memory 156, and to act upon instructions received either from said memory 156, from communications module 162, or from input device 152. The processor 154 is further configured to process instructions pertaining to encryption and decryption. For example, the processor 154 it configured to retrieve public and/or private keys from memory 156. In operation the processor 154 can execute computer-executable instructions stored in the memory 156 and the results of the processing can be displayed to a user on the display 150. User inputs for controlling the operation of the computer may be received via input device(s) 152. Other architectures to that shown in Figure 1 may be used as will be appreciated by the skilled person. The client device, or first device, and the server, or second device, may be, for example, a computer, a mobile phone, a tablet, or other device capable of performing a method according to computer-executable instructions. A user of the client device 100 may desire to send a message m to the server 150 in such a way that the server 150 is able to verify that the message m originated with the client device 100. However the user of the client device 100 may also desire to receive an

acknowledgement that the message m was received by the server and to be secure in the knowledge that the acknowledgement originated with the server 150 and not with an adversarial party. For such a purpose, a composite cryptographic signature may be generated using a method such as that set out below, in which the composite cryptographic signature is generated from a digital signature of the client's device 100 and a digital signature of the server 150. If the client device 100 is able to send message m and information pertaining to its digital signature to server 150, and to receive an acknowledgement, then the client's device 100 may be able to verify that the acknowledgement came from the server 150 and that the acknowledgement was created using both the digital signature of the client device 100 and the digital signature of the server 150.

Fig 2 shows a method for generating a composite cryptographic signature S. In the figure, time flows from top to bottom. Prior to the method shown in Figure 2, a client device (which may or may not be client device 100) and a server (which may or may not be server 150) agree on a public exponent e. The public exponent e may be widely broadcast, for example it may be published in a directory open to the public.

Prior to the method shown in Figure 2, the client device has stored in memory a first share (di , Π-L) of a first private key {d _t , (this will be explained further below). The first private key (d- _L , η-ι) comprises a first private exponent d _x and a first private modulus n _x and is defined such that: ed ₁ 1 mod φ^Π _] where φ is the Euler totient function. The function <p(x) counts the positive integers up to a given integer x that are relatively prime to x.

Prior to the method shown in Figure 2, the server has stored in memory a second share

(di' , Π-L) of the first private key {d _t , n^. The server also has stored in memory a second private key (d ₂ , n ₂ ). The second private key comprises a second private exponent d ₂ and a second modulus n ₂ . The second private key (d ₂ , n ₂ ) is defined such that: ed ₂ = 1 mod φ(η ₂ ) . At step 210, the client device generates a first part y of a client signature s from the message m and the first share (d^ , of the first private key {d _t , n^. In particular, the client device computes: y = m ^d1 ' mod n _x .

In this example, the first share of the first private key comprises a first private exponent share d _x ' and the first private modulus n _x . For extra security, the message m may be hashed and/or padded.

At step 220, the client device sends a signing request to the server. The signing request comprises the message m and the first part y of the client signature S-L. The signing request may be sent directly or indirectly to the server and may be sent over an encrypted channel. For example, message m and the first part y of the client signature S-L may be encrypted using any suitable cryptographic scheme, for decryption at the server.

On receiving the message m and the first part y of the client signature S-L from the client device, the server, at step 230, generates the client signature S-L from the first part y and the second share (di' , of the first private key. The second share of the first private key comprises a second private exponent share d' and the first private modulus n _x . The operation performed by the server at step 230 depends on how the first share and the second share of the first private key are related.

In one embodiment, the first private key may be additively shared. In this scenario, the first private exponent d _x is related to the first private exponent share d _x ' and the second private exponent share d' by: The first private exponent is therefore additively shared between the client device and the server. d _x ' is randomly generated and is independent (as a random variable) of d _x and hence there is no way for an adversary who gains access to d _x ' (encrypted or not) to successfully find d _x without communication with the server. Similarly, d' is randomly generated and is independent (as a random variable) of d _x and hence there is no way for an adversary who gains access to d' to successfully find d _x without communication with the client device. If the first private key is additively shared between the client device and the server then, at step 230, the server generates the client signature s _x by computing: s _t = y ^■ m ^ai mod n _x = mr ^1■ m ^ai mod n _x = m ^ai+ai mod n _x =

In another embodiment, the first private key may be multiplicatively shared. In this scenario, the first private exponent d _x is related to the first private exponent share d _x ' and the second private exponent share d' by: d _x = d' d' mod (pin^. The first private exponent is therefore multiplicatively shared between the client device and the server. d _x ' is randomly generated and is independent (as a random variable) of d _x and hence there is no way for an adversary who gains access to d _x ' (encrypted or not) to successfully find d _x without communication with the server. Similarly, d' is randomly generated and is independent (as a random variable) of d _x and hence there is no way for an adversary who gains access to d' to successfully find d _x without communication with the client device. If the first private key is multiplicatively shared between the client device and the server then, at step 230, the server generates the client signature s _x by computing: d"

s ₁ = y ^d i mod n-L = (m ^dl ) mod n _x = m ^dldl mod n _x = m ^{dldl mod} P( ⁿ mod n _x = m ^dl mod n-L .

Accordingly, the server uses the first part y of the client signature s _t and the second share (di' , Π-L) of the first private key to generate the client signature S-L. Note that the server therefore does not at any time in the method of Figure 2 require knowledge of either the first private exponent d _x or the first private exponent share d _x ' . At step 240, the server verifies that the first part y of the client signature s was generated using the first share (d^ , of a first private key {d _t , n^. In this way, the server can determine that the message m and the first part y came from the client device. In order to perform the verification the server checks that:

(S-L) ⁶¹ ≡ m mod n _x .

If the verification step is satisfied then, at step 250, the server generates a server signature s ₂ . The server signature s ₂ is generated by: s ₂ = n ^d2 mod n ₂

At step 260, the server calculates a public modulus n (so called because it can subsequently be made public). The modulus n is the product of n _x and n ₂ i.e. n = n ₁ n ₂ .

The skilled person would understand that step 260 need not be a part of this method. As the server has knowledge of n, and n ₂ before the protocol of Figure 2 begins, it may be that the modulus n is computed and made public before the protocol of Figure 2 commences or at any other time.

At step 270, the server combines the client signature s _x and the server signature s ₂ to form a composite cryptographic signature S. The composite function S is based on the Chinese remainder theorem and is of the form S = C _ni7l2 (S-L , s ₂ ) where C _ni n ₂ Oi , s ₂ ) = n^ + n ₂ s ₁ mod n and and β are integers satisfying an _x + βη ₂ = 1. Such and β exist, assuming that n _x and n ₂ are relatively prime. At step 280, the server communicates the composite signature S and, optionally, the public modulus n to the client device. At step 290, the client device may verify that the composite signature S has indeed been created using the server's private key. The client device may then determine that the composite signature S did in fact originate with the server and not with an adversarial party. In order to perform this verification, the client device checks that

S ^e ≡ m mod n.

In the method of Figure 2, at no point is the first private modulus n _x or the second private modulus n ₂ made public. Furthermore, if the client device is hacked then the adversary will not be able to create a valid composite signature without the server. If the client device is hacked then it is not also feasible to apply a dictionary attack without communication to the server. Additionally, the server alone cannot create a valid composite digital signature without the client device's share of the first private key. The skilled person would understand that variations of the protocol described above may be made. For example, the verification steps 240 and 290 may be omitted. The server or receiving party may not verify that the original transmission originated from the client device and may instead process the transmission as if it had come from the client device. Similarly, the client device may not verify that the composite signature has been received from the server. A third party may verify, or no verification at all may occur.

Fig. 3 is a flowchart of a method that may be carried out by a client device.

At step 310, the client device generates a first part y = m ¹ mod n _x of a client signature s _x from the message m and the first share d _x ' , of the first private key {d _t , n^.

At step 315, the client device sends a signing request to a server. The signing request comprises the message m and the first part y of the client signature s _t . The message may be sent over a secure communications channel.

At step 320, the client device receives a response z, purported to be from the server. At step 325, the client device checks whether or not the response comprises a composite signature that would indicate that the response has come from the server. In particular, the client device checks whether or not z ^e ≡ m mod n. If, at step 325, the client device finds that z ^e £ m mod n then a determination can be made that z does not comprise a composite signature that comprises a combination of both a client signature and a server signature. Accordingly, the client device may reject the response z at step 330. If, at step 325, the client device finds that z ^e ≡m mod n then a determination can be made that z comprises a composite signature that comprises a combination of both a client signature and a server signature. Accordingly, the client device may accept the response z at step 335. Fig. 4 is a flowchart of a method for generating a composite cryptographic signature, the method performed by a server. At step 410, the method comprises receiving a signal purported to be from a client device. The signal comprises a message m and a number k, where k is purported to be a first part of a client signature which verifies that the message m was sent from the client device.

At step 415, the server consults a second share (di' , of the first private key, the second share stored in the server's memory. The server computes T, which can be used to check whether or not the message m was sent from the client device. If the first private key was additively shared between the server and the client device then the server computes:

T = k ^■ m ^dl mod n _x .

If instead the first private key was multiplicatively shared between the server and the client device then the server computes:

T = k ¹ mod n _x . At step 420, the server checks whether or not the received number k was generated using the client device's share of the first private key. That is, the server checks that T ^e ≡ m mod n _x .

If, at step 420, the server finds that T ^e £ m mod n _x then the method may abort (step 425). For example, the server may cease communication or may send an error message to the sender.

If, however, at step 420 the server finds that T ^e ≡ m mod n _x then the server may determine that the received number k was generated using the client device's share of the first private key (step 430).

At step 435 the server may perform a further check of the received signal. In particular, the server may check that the received signal contains information relating to information previously received from the client device. For example, a check may be performed to determine whether the message m contains at least a hash of a message m' known to have been received previously from the client device.

If at step 435 the signal fails the further check then the method may be aborted. The server may make a determination that the client device's private key has been cloned and that an adversary has sent the message m and the number k.

If at step 435 the signal passes the further check, then the server may determine that the message m and the number k did come from the client device (step 445). The method then progresses to step 450.

At step 450, the server computes a server signature s ₂ = m ^d2 mod n ₂ .

At step 455, the server combines the client signature T and the server signature s ₂ to generate a composite cryptographic signature S. The composite cryptographic signature is given by S = C _niil2 (7\ s ₂ ) .

At step 460, the server transmits the composite signature. Figure 5 is a flowchart of a method for initialising a server for generating a composite cryptographic signature. The method of Figure 5 may be performed during manufacture to configure a server for generating a composite signature, or may be performed during the signing process.

At step 510, two prime numbers p ₂ and q ₂ are chosen at random. A check is performed to determine that the greatest common denominator of each prime minus one and a pre- established public exponent e is equal to 1, i.e. gcd( p ₂ — 1, e) = gcd(q ₂ — 1, e) = 1. If either of the two selected prime numbers chosen is unsuitable, then the server chooses one or more new prime numbers and performs the check again. When two prime numbers p ₂ and q ₂ are chosen which satisfy gcd( p ₂ — 1, e) = gcd(q ₂ — 1, e) = 1 the method progresses to step 515.

At step 515, the private modulus n ₂ is calculated as the product of the two chosen

primes, n ₂ = p ₂ q ₂ .

At step 520, the private exponent d ₂ is calculated as d ₂ = e ^_1 mod φ(η ₂ ), where φ is the Euler totient function. At step 525, the server stores the private key (d ₂ , n ₂ ) in memory. At step 530, the server deletes the prime numbers p ₂ and q ₂ from memory and also deletes any other intermediate values generated during generation of the server's private key (d ₂ , n ₂ ).

The security of the methods detailed above is demonstrated in the annexe.

Fig. 6 is a flowchart of a method for initialising a client device for generating a composite cryptographic signature.

At step 610, two prime numbers p _x and q _x are chosen at random. A check is performed to determine that the greatest common denominator of each prime minus one and a pre- established public exponent e is equal to 1, i.e. gcd( p _x — 1, e) = gcd(q _t — 1, e) = 1. If either of the two selected prime numbers chosen is unsuitable, then the server chooses one or more new prime numbers and performs the check again. When two prime numbers p _x and q- are chosen which satisfy gcd p ₁ — 1, e) = gcd q — 1, e) = 1 the method progresses to step 615.

At step 615, the private modulus n _x is calculated as the product of the two chosen

primes, n _x = ~p q .

At step 620, the private exponent d _x is calculated as d _x = e ^_1 mod φζη-ι), where φ is the Euler totient function. At step 625, the client device chooses a first private exponent share d _x ' and finds the second private exponent share d' .

If the first private exponent is to be additively shared between the client device and the server then the client device chooses d _x ' at random from the interval [l, ··· , 2 ^len(jll) — l], with the value (p n-i excluded. The second private exponent share d' is then given by dl' = d _x —

If the first private exponent is to be multiplicatively shared between the client device and the server then the client device chooses d _x ' at random from the interval [l, ··· , 2 ^{len( l1} ^ — l], with the value = 1 i.e. the share must be invertible d _x ' is chosen at random. The second private exponent share d' is then given by d' = d _x ·— mod (pin-^).

"l

At step 630, the client device's share of the first private key (d^ , is stored in memory.

At step 635, the server's share of the first private key (di' , is sent to the server over a secure channel. For example, this information may be conveyed to the server during manufacture. At step 645, the client device deletes the values _x , q _x , d _x , d' and φ{η-^) from memory and also deletes any other intermediate values generated during generation of the client device's share of the first private key. Figure 7 is a flowchart of a method that may be performed at a server in order to register a client device. At step 710, the server receives (di' , from the client device. At step 715, the server computes n = n ₁ n ₂ . At step 720, the server calculates the integers and β using the Extended Euclid's algorithm.

At step 725, the server stores the client device data (di' , n _x , a, β ) in the server's memory.

At step 730, the server sends the public exponent n to the client as acknowledgement that the client has successfully registered with the server.

Variations of the described arrangements are envisaged. For example, the features of all of the disclosed arrangements may be combined in any way.

In the examples provided above, the server has been described as sending the composite signature S to the client device. However, other scenarios are envisaged. For example, the server may send the composite signature to a digital repository for storage or may send the composite signature to a third party. For example, one may consider that a first party, or client, device may operate to send a message to a third party device, and that the third party will only accept the message if it has been verified by a second party, or server. Accordingly the first party and second party may generate a composite signature according to any method as described herein, and the trusted second party may communicate the composite signature to the third party. The third party may use a public key to verify the composite signature and thereby trust that the message from the first party has indeed been verified by the second party. The skilled person would envisage other scenarios in which such operation would be useful. It is envisaged that in some circumstances no verification takes place at the server and/or the client device. For example, the server may simply process data received and issue a purported composite signature in accordance with a method as disclosed herein with no verification that the original received data originated at the client device. The skilled person would understand that any asymmetric cryptosystem may be used. Any public and private key pair system in which the private key can be shared between parties can be used. For example, a cryptosystem based on elliptic curves or discrete logarithms may be used.

For convenience, in the descriptions provided above, a message m was sent across a communication channel. The communication channel may be any suitable communication channel such as a radio connection or the internet. The communication channel may involve a level of encryption. For example, one or more transmissions such as that in which the message m and the first party y of the client signature is sent may be encrypted. For example, the message m and first party y may be encrypted using a public key of the server such that the message m and first party y are only retrievable by use of the server's private key. The message m may be a hashed and/or padded message. Any suitable hash function may be used, for example SHA-256. The message may be in any suitable format understood by a computing device.

The described methods may be implemented by a computer program. The computer program which may be in the form of a web application or 'app' comprises computer-executable instructions or code arranged to instruct or cause a computer or processor to perform one or more functions of the described methods. The computer program may be provided to an apparatus, such as a computer, on a computer readable medium or computer program product. The computer readable medium or computer program product may comprise non- transitory media such as as semiconductor or solid state memory, magnetic tape, a removable computer memory stick or diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disc, and an optical disk, such as a CD-ROM, CD-R/W, DVD or Blu-ray. The computer readable medium or computer program product may comprise a transmission signal or medium for data transmission, for example for downloading the computer program over the Internet.

An apparatus or device such as a computer may be configured to perform one or more functions of the described methods. The apparatus or device may comprise a mobile phone, tablet, laptop or other processing device. The apparatus or device may take the form of a data processing system. The data processing system may be a distributed system. For example, the data processing system may be distributed across a network or through dedicated local connections. The apparatus or device typically comprises at least one memory for storing the computer- executable instructions and at least one processor for performing the computer-executable instructions.

Annexe - Security Proofs

It is assumed that the RSA signature∑ = P(- mod n together with the padding scheme P is secure against existential forgeries via adaptive chosen message attacks. This means that the adversary ^ ² - has an oracle access to the signature scheme and has to produce a pair , ∑(H(M)), such the H(M) was never queried from the oracle. Here, H is a hash function that is modelled as a random oracle.

As the client device's private exponent is shared between the client device and the server, in some proofs it has to be assumed that the adversary also has access to a partial signature omc\e∑ ^' () = P(- ^{~ r} mod n, where r .. ,(n) - 1 } is a random number.

It is assumed that the output distribution of the padding is close to uniform on the image of P. It the padding scheme is probabilistic and uses a random salt s, then we assume that s is given as an argument to the oracle query is in the form∑(m,s) = P _s (m mod n. Adaptive Chosen Message Attack: The adversary A ^∑ ^ having access to the signing oracle produces a correct message-signature pair ,∑(H(M)), without querying∑ with H(M).

Details of the security proof may depend on the types of primes used. Some types of primes may offer better attack-resistance, while other types of primes might be easier to generate.

A prime number p is called a safe prime ifp = 2p'+ 1, where p ^' is also prime. The corresponding prime p' is called a Sophie -Germain prime. The generation of safe primes is time-consuming, especially in low-power mobile devices. Hence, for this implementation, an alternative class of primes are used which are known as quasi-safe primes. Definition 1. A prime number p is called an -quasi-safe prime ifp = 2ap' + 1, where p' is a prime and 1 <a <l. The generation of quasi-safe primes is much faster compared to safe primes. For example, if one needs a 1024-bit p, then if one uses a 15-bit a (with 2 ¹⁴ < a < 2 ¹⁶ ), one needs a 1008-bit P'

Definition 2: A prime number p is called an (f,s)-safe prime ifp = 2app' " + 1, where p ' and p " are primes, \<a<t, and min { ρ', ρ "}≥s-

Security against Malicious Servers

A malicious server is considered as an adversary ^, that has a share r of the client device's private modulus d, which is uniformly distributed on Ζ _φ („). The server-adversary A also has a connection to the client device that sends signing requests to the server. It is assumed that A is able to use such a connection as an oracle∑', i.e. to choose messages m, send m to the oracle and obtain∑'(m) = P(m ^{~ r} mod n. As A knows r, it is easy for A to compute∑(m) = ∑'(m)-P(m) ^r mod n. The goal of A ^∑' (r) is to produce a message M and the signature Σ(Ηβ4)) = P(H(M) mod n, such that H(M) was never queried from∑'.

Theorem 1. If∑is S-secure against existential forgeries via adaptive chosen message attack, then the shared signature system is -secure against malicious servers, where t _mu i is

mul

the time needed for one modular multiplication (with the client's RSA modulus).

Proof (sketch) Let A ^∑' (r) be a t-time adversary that with probability δ produces a pair M, Σ(Ηβ4)) without calling∑' with Ηβ4). An adversary A 'with running time t'~ t is constructed that has oracle access to∑ and with probability δ produces a pair M,∑(H(M)), without calling∑ with H(M).

The adversary A 'first picks a random number r'and then simulates A ^∑' (r)' , so that the∑'- calls∑'(m) is answered with∑(m) P(m) ^'r' mod n. As the simulation is perfect, the success probability of A ' is δ. t+t s

The running time of A ' is t +t-t _mu Thus, δ< mul

S ^■ <t(\+t _mu i), and S> ^~ l+t ^' mul

For example, if the ordinary RSA with 1024-bit primes is 2 -secure and an exponentiation takes time (1024) ³ = 2 ³⁰ (assuming that addition takes about 1024 steps), then the new signature system is at least 2 ⁹⁰ -secure against malicious servers.

Security Against Client Leakage Attack It is assumed that the client device's share is encrypted with a block-cipher using PIN as the key. The cipher is modelled as an ideal cipher with two supporting oracles Ek(x) and E^ ^x (x). The adversary sees the encryption c = Epm(d- r) and may try to decrypt it by using the oracle call y = E _p ¹ ^) with a guessed PIN p. If p = PIN then y = d - r, otherwise y is a random variable independent of d - r and r. Note that as the variables d - r, and y are identically distributed, there is no way for the adversary to see that p = PIN. This can only be checked via communicating with the server.

The adversary's access to the server is modelled as an oracle S with internal state. The oracle S receives queries of the form (m,m ^{d ~ r} mod n) and returns m ^d mod n if the query is in such form. Otherwise S returns J_. If it has returned J_ three times, then S "blocks" and will return only J_ even if the queries were correctly formed. Hence, if the adversary tries random p-s, computes y= E ^x (c) and sends queries S with (m,my mod n), the success probability is -, where K is the total number of PINs. Note that d - r mod φ(η) is uniformly distributed and independent of d. Also note that the adversary has no r, so if the S-oracle is not used during a forgery-attack, then decrypting d- r gives nothing to the adversary.

Lemma 1. Ify and x are independent random variables and x <—Ζ _φ ( _η ) is uniformly distributed, then Pr n ^≡ m ^x (mod n) ^/J = ord(m) , where mE Z n ^* and ordfm) is the order o ^J f m in the multiplicative group Z Lemma 2. If n = pq and p, q are safe primes, then is w<— Z ^* is a uniform random number

Proof By assumptions, there are prime numbers /and 'such that p -1 = 2p 'and q - 1 = 2q'. Hence, the size of the group Z ^* is φ(η) = (p - l)(q - 1) = 4p'q'. As the order of an element must be a divisor of the size of the group, any element m of Z ^* has an order ord(m) E { 1,2,4} or ord(m) > {p',q'}. As all the elements of orders 1, 2, 4 are roots of the polynominal X ⁴ - 1 in Z _n = Z _p x Z _q and any polynominal of degree d may have no more than d roots in Z _p and Zq, the number of roots in Z _n cannot exceed d ² . Hence, the number of elements of degree less than m\n{p',q'} does not exceed d ² = 4 ² = 16.

Lemma 3. If n = pq and p, q are l-quasi-safe primes, then if m— Z _n ^* is a uniform random

, , _ _r . , . . ,p-l q-1-, _π 16^ ⁴

number then Pr \ om(m) <mm\ , H = ·

Proof By assumptions, there are prime numbers p ', q' such that p 1 = 2ap' and q 7 = 2a'q', where both a and a' belong to the interval [1.. Λ - 1]. Hence, the size of the group Z ^* is φ(η) = (p - l)(q - 1) = 4aap' 'q'. As the order of an element must be a divisor of the size of the group, any element m of Z ^* has order ord(m) divisible by 4aa' or ord(m) > m\n{p',q'}. As all the elements of orders divisible by 4aa' are roots of the polynominal X ^4aa' -1 in Z _n = Z _p x Z _q and any polynominal of degree d may have no more than d roots in Z _P and Zq, the number of roots in Zn cannot exceed d ² - Hence, the number of elements of degree less than

{p',q'} = min {^— 2.CL^-, ^ 2—.CL? }≥ mm ^— 2 ^-, ^— 2^-} does not exceed d ² = (4aa)' ² <16i ⁴ .

Lemma 4. If n pq and p, q, are (I, s)-quasi-strong primes, then if m <— Z ^* is a uniform random number then Pr[ord^w <s 1= .

(p-lXq-l)

Proof By assumptions, there are prime numbers p ', q' such that p - 1 = 2app' " and q - 1 = 2a'q'q", where both a and a' belong to the interval [1.. Λ - 1]. Hence, the size of the group Z ^* is φ(η) = (p - l)(q - 1) = 4aap' 'qp' "q". As the order of an element must be a divisor of the size of the group, any element m of Z ^* has order oxd(m) divisible by 4aa' or ord(m)>min{p',q',p ",q"} . As all the elements of orders divisible by 4aa' are roots of the polynominal X ^{t '} -1 in Zn = Z _p x Z _q and any polynominal of degree d may have no more than d roots in Z _P and Z _q , the number of roots in Z _n cannot exceed d ² - Hence, the number of elements of degree less than rs\m{p',q',p ",q"}> s does not exceed d ² = (4aa)' ² <16t ⁴ . Lemma 5. Ifn = pq and p, q are safe primes and P be a padding function, then ifm <— Έ ^* is a uniform random number the Pr[ord(P(m)) < min ^ -, ^ -}]≤ = 2 ^~h+4 , where h is the hash length in bits.

Lemma 6. Ifn = pq and p, q are t-quasi-safe primes and P be a padding function, then if w<— Z _n ^* is a uniform random number the Pr[ord(P(m)) < min {~r, "^J"}] - ~^T- ⁼ 2 ^{~H +4LOG} 2 ^E+4 , where h is the hash length in bits.

Theorem 2. If∑ with safe primes is S-secure against adaptive chosen message attack, then no t-time adversary that has access to client 's encrypted share c = Ep (d-r) can create an existential forgery with probability ^J g °reater than— K + - S+ 2 ^~h+4 + mi .n ² {.p ^κ , ² q.}—-l .

Proof, (sketch) Let _^ 4 ^Σ · S.EO,E -IO ( _c J ¾ _{e a} ^_ti _me adversary that with probability δ produces a pairA^ Σ(Ηβ )) without calling∑ with H(M). Run _^ 4 in an environment in which all the oracle calls, except for 27-calls are simulated. If A calls EQ or Ε ^' ^), the standard "lazy sampling" is used.

A random PEST pi is picked from the set {pi, ...,ρκ) of all possible PINs. This po will be considered as the right PEST, and the "right" client's share is just a random number d" — Ζ _Φ („), i.e. we define E ^~ _Q (C) = d" and E _pQ (d") = c and add these values to the lazy-sampling database.

An S-call S(m,s,y) will be simulated as follows. For the correctness check, we compare^ with P _s (m) ^{d "} mod n and if there is no match, return J_, otherwise, make a 2"-call σ =∑(m,s) and return σ. Note that there is no need for r (the server's share of the client's secret exponent). The probability & that A is successful (produces a forged signature on M) while never calling S successfully with input H(M) cannot exceed— , where t'is the running time of the simulation experiment. As there is no expensive overhead, it can be assumed that t' ~ t.

The probability <¾ that _^ 4 makes a successful S-call S(H(M),s,y) is by Lemma 5, not much

3

larger than -. This is because, as H(M) is a uniformly random number, the probability that οχά(Ρ(Ηβ )))> {^, ^} is at least 1 - T ^h+4 . If this is the case, the probability that all the

_1 2K ² values (P(H(M)) E _pi (c) mod n (for / = \ ..K) are distinct is about 1 - _min ^ _{p q} - _i _ ₁ ^an d any oracle call is successful with probability not larger than -. Hence

Sb < - + ^h+4

min{p,q}

which means that δ < δ _α + Sb≤ - 2K ²

K H— S ^ 2 min{p,q}-l ^'

Theorem 3. If∑ with {-quasi-safe primes is S-secure against adaptive chosen message attack, then no t-time adversary that has access to the client 's encrypted share c = Ep (d-r) can create

3 t 2

an existential forgery with probability greater than— H— l· 2~ ^{h +4log} 2 ^l+4 + . ² _r ^{K ,— .

Proof. Completely analogous to the proof of Theorem 2, except that Lemma 6 is used instead of Lemma 5.

For example, if one uses 1024-bit primes, -t = 2 ¹⁶ , the ordinary TSA is 2 ⁹⁰ -secure and we use a 256-bit hash function is used then for a t-time adversary the guessing probability is:

- + 2 ■90 + t + 2 ■188 2-1019 + 21og ₂

By at least the proof presented in this annex, the security of the methods proposed herein are demonstrated.