JPH1013402A - Private key management method and apparatus for public key cryptography - Google Patents

Abstract

(57) [Summary] [Problem] A private key can be reproduced even when a personal portable device is lost or damaged, and a special key for writing a private key is also provided when a user's private key is input to the personal portable device. Provided is a method and an apparatus for managing a secret key of public key cryptography which does not require a tamper-resistant device. SOLUTION: The partial secret key constituting the secret key,
Each partially secret key is secretly managed by a person who has an interest in the user of the tamper-resistant personal portable device, and is separately sent from each person who has an interest in the user of the tamper-resistant personal portable device. Input to the tamper-resistant personal mobile device, generate a secret key in the tamper-resistant personal mobile device from the input partial secret key, and transfer the generated secret key to the outside of the tamper-resistant personal mobile device. The key is stored in a storage area in the tamper-resistant personal portable device from which the key cannot be read.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a method and an apparatus for managing a private key of a public key encryption used in a personal portable device owned by an individual.

[0002]

2. Description of the Related Art When attempting to sell digital contents having a copyright, such as audio / video and execution programs, using a network, not only user authentication and delivery confirmation but also illegal digital data is required. Copying is a problem.

As a method for solving the problem of user authentication, there is a method of using a public key encryption in digital encryption.

The digital encryption algorithm includes a common key encryption algorithm (secret key encryption algorithm) and a public key encryption algorithm.

[0005] The common key encryption algorithm can perform high-speed operations, but since the same common key is used for the encryption key and the decryption key, only the communicating parties need to keep the secret key secret.

[0006] On the other hand, the public key encryption algorithm is not suitable for high-speed processing because of a large amount of calculation as compared with the common key encryption algorithm. However, since the encryption key and the decryption key use different keys, the encryption key Makes it unnecessary to secretly distribute the key like the common key of the common key encryption algorithm.

However, in the public key encryption algorithm,
Since the encryption key is made public, anyone can generate a ciphertext, so it is necessary to prove who encrypted the sent communication message and so on. Become. Therefore, what has come to be considered is partner authentication using a signature.

[0008] RSA encryption is a typical example of a public key encryption algorithm having a partner authentication function. In the cipher communication, an encryption key is used for encryption, and a decryption key is used for decryption. In addition, a decryption key is used when performing a signature, and an encryption key is used when verifying the signature.

On the other hand, in order to encrypt digital data to be delivered, a common key cryptosystem is used in most cases instead of a public key cryptosystem. The main reason is that symmetric key cryptography, which is much faster than public key cryptography, is more suitable for cryptographic processing of very large digital data.

However, in the common key cryptography, both communicating parties must have a common secret key. Therefore,
In general, a common secret key used for common key encryption is delivered by authenticating the other party using public key encryption, but this alone cannot prevent unauthorized copying by a legitimate purchaser.

[0011]

Therefore, a key used for public key cryptography is generated inside a personal tamper-resistant device using a portable device, and a secret key is generated inside the device. A method has been proposed in which only a device can be used and data cannot be read out of the device (Japanese Patent Application No. 8-72949).

However, there is a problem in operation of this proposal in that a device carried by an individual may be lost or accidentally damaged. In this regard, a proposal has been made to use a special tamper-resistant device for writing a user's private key in a personal portable device (Japanese Patent Application Nos. 7-155030 and 7-1594).
14, Japanese Patent Application No. Hei 7-206442), but in order to be able to reproduce a secret key, a special tamper-resistant device for generating and writing such a secret key is conventionally required. There was a point.

Accordingly, the present invention provides a method for storing a decryption key for decrypting encrypted digital data in a personal portable device in such a manner that the decryption key cannot be physically duplicated, and each time the encrypted digital data is used. In a personal portable device in which only a person who possesses the personal portable device can use digital data by performing decryption processing in the personal portable device, the personal portable device may be lost or damaged. And a private key management method and apparatus for public key cryptography that does not require a special tamper-resistant device for writing the private key even when the user enters the private key into the personal portable device. The purpose is to provide.

[0014]

SUMMARY OF THE INVENTION The present invention relates to a method for generating and managing a secret key of public key cryptography, wherein (a) partial secret keys constituting a secret key, each of which is a tamper-resistant personal mobile phone. A partial secret key, which is secretly managed by a person who has an interest in the device user, is input to the tamper-resistant personal portable device separately from all those who are interested in the user of the tamper-resistant personal portable device. Steps to
(B) generating a secret key in the tamper-resistant personal portable device from the partial secret key input in step (a); and (c) generating the secret key generated in step (b),
Storing the secret key in a storage area within the tamper-resistant personal portable device, wherein the private key cannot be read out of the tamper-resistant personal portable device. I do.

Further, the present invention further comprises the step of (d) using the secret key stored in step (c) for decryption processing and signature processing only inside the tamper-resistant personal portable device. It is characterized by the following.

The present invention also provides the above method, further comprising: (e) detecting the opening of the cover of the tamper-resistant personal portable device; and (f) step (e), covering the tamper-resistant personal portable device. Erasing the secret key from the storage area when the opening of the storage key is detected.

Further, the present invention provides the above-mentioned method, further comprising the step of: (g) detecting the opening of the tamper-resistant personal portable device in step (e) when the cover of the personal tamper-resistant personal portable device is opened. Destroying a component to render the tamper resistant personal portable device unusable.

Further, the present invention provides the above method, further comprising: (h) when the user requests a secret key reproduction due to loss of the secret key in the tamper-resistant personal portable device, the partial secret key is exchanged with the user. Re-entering the tamper-resistant personal mobile device separately from all interested parties, and (i) using the partial secret key input in step (h) in the tamper-resistant personal mobile device, Regenerating the secret key; (j) step (i)
Storing the secret key generated in the above step in the storage area again.

Further, the present invention provides the above method, further comprising: (k) when the user requests the reproduction of the secret key due to the damage of the tamper-resistant personal portable device, the partial secret key has a stake in the user. (I) inputting a new private tamper-resistant personal portable device separately from all persons; and (1) obtaining a secret key in the new tamper-resistant personal portable device from the partial secret key input in step (k). (M) using the secret key generated in step (l) in the new tamper-resistant personal portable device in which the secret key cannot be read out of the new tamper-resistant personal portable device. Storing in a storage area.

Further, the present invention provides the above method, further comprising: (n) new partial secret keys constituting a new secret key, each of which has a stake in a user of the tamper-resistant personal portable device. Inputting a new partial secret key, which is secretly managed by the tamper-resistant personal portable device, to the tamper-resistant personal portable device, separately from all persons having an interest in the user of the tamper-resistant personal portable device; (o) Generating a new secret key in the tamper-resistant personal portable device from the new partial secret key input in step (n); and (p) generating the new secret key generated in step (o). Overwriting the original private key and storing it in the storage area.

Further, the present invention provides the above method, further comprising: creating a backup of the encrypted information to be decrypted by using the secret key stored in the storage area before the secret key needs to be reproduced; Restoring encrypted information from the backup to the tamper-resistant personal portable device after the secret key has been reproduced.

Further, according to the present invention, in the above-mentioned method, a backup of the encrypted information to be decrypted by the original secret key stored in the storage area is created before the secret key is required to be reproduced and updated. Restoring previous machine encryption information from the backup to the tamper-resistant personal portable device before the secret key is updated after the secret key is reproduced; and Decrypting the encrypted information in the tamper-resistant personal portable device using the reproduced private key before the key is updated, and decrypting the encrypted information after the private key is reproduced and updated. Encrypting the obtained information in the tamper-resistant personal portable device using an updated secret key.

Further, according to the present invention, in the above method, (q) two prime numbers p and q are further generated, and (p-1)
Setting the least common multiple of (q-1) and (q-1) to L;
(R) using a public key method n as the product of p and q, and a public key exponent e as a positive integer smaller than L and relatively prime to L; and (s) a user of the tamper-resistant personal portable device. Assuming that the total number of interested parties is k, each of the tamper-resistant personal portable devices is (k−1) positive integers smaller than L and relatively prime to L, respectively, as partial secret keys d ₁ ,
_{d 2, ----, d k-} 1 and the steps of, (t) said step (b) x exp (d) ≡x exp ( d 0 · d 1 · d 2 · ---- · d _k-1) (mod n) where x is to generate a private key d which satisfy any positive integer of less than _{n, e · d 0 · d} 1 · d 2 · ---- · d k- generating a partial secret key d ₀ of the user satisfying ₁ ≡1 the (mod L), and having a.

Further, according to the present invention, there is provided the above-mentioned method, further comprising the user's partial secret key d generated in step (t).
_{Outputting 0} only once from the tamper-resistant personal portable device.

Further, the present invention provides the above method, further comprising: distributing a random number to all persons having an interest in the user of the tamper-resistant personal portable device; and using a partial secret key of all the persons. Sequentially signing the random numbers, and each person having an interest in the user of the tamper-resistant personal portable device verifies the sequentially signed random numbers using a public key, and confirms that the sequentially signed random numbers are safe. Verifying each time, when verified, that the secret key has been generated without tampering.

[0026] The present invention also relates to the above method, further comprising: distributing a secret key reproduction request to all persons having an interest in the user of the tamper-resistant personal portable device; Sequentially signing the secret key reproduction request using a key, and verifying the sequentially signed secret key reproduction request using a public key by each of the interested parties with a user of the tamper-resistant personal portable device. Issuing a secret key reproduction permission when each of the sequentially signed secret key reproduction requests is successfully verified.

Further, the present invention relates to a tamper-resistant personal portable device for generating and managing a private key of a public key cryptosystem, and a partial secret key constituting a secret key, each of which is provided in the tamper-resistant personal portable device. A partial secret key that is secretly managed by a person who has an interest in the user, and is input to the tamper-resistant personal portable device separately from all persons having an interest in the user of the tamper-resistant personal portable device. A second means for generating a secret key in the tamper-resistant personal portable device from the partial secret key input by the first means and the partial secret key input by the first means;
And a third means for storing the secret key generated by the second means in a storage area in the tamper-resistant personal portable device in which the private key cannot be read out of the tamper-resistant personal portable device. And a tamper-resistant personal portable device characterized by having:

The present invention also relates to the above device,
Further, a processor is provided that performs decryption processing and signature processing using the secret key stored in the storage area only inside the tamper-resistant personal portable device.

The present invention also relates to the above device,
Further, opening detection means for detecting opening of the cover of the tamper-resistant personal portable device, and erasing the secret key from the storage area when the opening detection of the tamper-resistant personal portable device is detected by the opening detection means. Means.

The present invention also relates to the above device,
Further, when the opening detection means detects the opening of the tamper-resistant personal portable device, the component mounted in the tamper-resistant personal portable device is destroyed to disable the tamper-resistant personal portable device. It is characterized by having means for performing.

Further, the present invention relates to the above device,
When a user requests a secret key to be recovered due to the loss of a secret key in the tamper-resistant personal portable device, the first means separates the partial secret key from all parties having an interest in the user. The tamper-resistant personal portable device re-enters the secret key in the tamper-resistant personal portable device from the partial secret key input by the first means. The third means is the second means.
The secret key generated by the means is stored again in the storage area.

Further, the present invention relates to the above device,
The first means is a new partial secret key constituting a new secret key, each of which is a new partial secret key that is secretly managed by a person who has an interest in the user of the tamper-resistant personal portable device. A key is separately and individually input to the tamper-resistant personal portable device from all persons having an interest in the user of the tamper-resistant personal mobile device, and the second unit is configured to input the new key input by the first unit. A new secret key is generated in the tamper-resistant personal portable device from the partial secret key, and the third means converts the new secret key generated by the second means to the original secret key. The data is overwritten and stored in the storage area.

The present invention also relates to the above device,
Further, means for generating two prime numbers p and q and setting the least common multiple of (p-1) and (q-1) to L and a product of p and q as a public key method n, which is smaller than L and L Means for setting a public key exponent e to a positive integer which is relatively prime to k, and the total number of persons having an interest in the user of the tamper-resistant personal portable device to k
The tamper-resistant personal portable devices are each separately
Means for setting (k−1) positive integers smaller and relatively prime to L as partial secret keys d ₁ , d ₂ ,..., D _k−1 and the second means x exp (d) ≡x exp (d ₀ · d ₁ · d ₂ ····· d _k-1 ) (mod n) where x is any positive integer less than n and generates a secret key d Means for generating a partial secret key d ₀ of a user that satisfies e · d ₀ · d ₁ · d ₂ ····· d _k−1 ≡1 (mod L). And

The present invention also relates to the above device,
Further comprising means for outputting the partial secret key d ₀ of the user from the resistant tamper personal portable device only once.

Further, the present invention relates to a method of handling digital data using public key cryptography, comprising the steps of: (a) generating a public key and a private key of a first public key cryptography for signature on a user side; (B) registering the public key of the first public key cryptosystem with the certificate issuing center; and (c) signing the public key of the first public key cryptosystem using the private key of the certificate issuing center; Publishing the signed public key as a user certificate; and (d) generating, on the copyright holder side, a public key and a private key of a second public key cryptosystem for digital data decryption, Storing the secret key of the public key cryptosystem in a storage area in the tamper-resistant personal portable device from which the secret key cannot be read out of the tamper-resistant personal portable device;
(E) The tamper-resistant personal portable device and the public key of the second public key encryption are provided to the user, and the user performs a decryption process using the secret key of the second public key encryption and the first public key. Performing a signature process using an encryption secret key inside the tamper-resistant personal portable device so that digital data provided by the copyright holder can be used. Provide a method for handling digital data.

[0036]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described with reference to the drawings. Here, among public key cryptographic algorithms, they have both an encryption function and an authentication function.
Description will be made using the most widely used RSA encryption.
For details of the RSA encryption, see “Issue Ikeno and Koyama”, edited by the Institute of Electronics, Information and Communication Engineers, “Chapter 6 of Modern Cryptography”.
Chapter RSA Public Key Cryptography ".

(First Embodiment) First, a first embodiment of the present invention will be described in detail with reference to FIGS.

FIG. 1 shows a system configuration according to the first embodiment. This system is connected to a personal portable device 55 of a user 56 used on a user terminal 54 and to the user terminal 54 via a network 53. The service provider 52 and the personal portable device issuer 51 are included.

In the configuration shown in FIG. 1, a user 56 who wants to receive a service provided by the service
Inserts his / her personal portable device 55 into the user terminal 54 and operates the user terminal 54 to transmit desired content from the service provider 52 to the network 53.
Through the user terminal 54.

Here, the number of persons involved in the key generation of the personal portable device 55 may be generally any number.
As shown in FIG. 1, the simplest case in which a service provider 52, a user 56, and a personal portable device issuer 51 are involved in key generation will be described as an example. In addition,
In actual implementation of this first embodiment, when a user receives a service, all entities that are (or will be) financially interested in this user participate in key generation. It is desirable.

In the first embodiment, when issuing the personal portable device 55, the value of the personal portable device 55 is not known to anyone including the manager of the service provider 52 and the owner of the personal portable device 55. It is possible to generate a private key of the public key encryption used by the portable device 55, and it is possible to prove that the private key is only inside the personal portable device 55.

Further, even if the personal portable device 55 is lost or destroyed, the user's private key stored in the personal portable device 55 can be reproduced.

FIG. 2 is a diagram showing a detailed configuration of the personal portable device 55 in the first embodiment.

The personal portable device 55 of FIG. 2 includes a public key exponent initial value input unit 501 and a partial secret key initial value input unit 50 for providing an input to the tamper resistant device section 55A.
2, corrected partial secret key output request input unit 503, plaintext
It has an encrypted text / signature text input unit 504.

The personal portable device 55 shown in FIG. 2 includes a public key method output unit 591 for providing an output from the tamper resistant device section 55A, a public key exponent output unit 592, a corrected partial secret key output unit 593, Encryption processing result output unit 5
94.

The tamper-resistant device section 55A is made of a tamper-resistant device whose inside is covered so that no one can touch it.

The tamper resistant device section 55A includes a public key exponent initial value storage unit 521 connected to the public key exponent initial value input unit 501, and a key generation parameter generation unit connected to the public key exponent initial value storage unit 521. 522 and a key generation parameter storage unit 5 connected to the key generation parameter generation unit 522
23, and a public key exponent storage unit 524 connected to the key generation parameter storage unit 523 and the public key exponent output unit 592.

The tamper-resistant device section 55A
Are a key generation permission determination unit 511 connected to the public key exponent initial value storage unit 521, and a prime number generation unit 51 connected to the key generation permission determination unit 511 and the key generation parameter generation unit 522.
2 and the public key method generation unit 5 connected to the prime number generation unit 512
13, a public key method generation unit 513 and a public key method output unit 5
91 and a public key method storage unit 514 connected thereto.

The tamper-resistant device section 55A
Has a partial secret key correction unit 531 connected to the partial secret key initial value input unit 502, a secret key synthesis unit 532, and a secret key storage unit 533 connected to the secret key synthesis unit 532.

The tamper-resistant device section 55A
Are a final partial secret key output request check section 541 connected to the corrected partial secret key output request input section 503, a final partial secret key output request input section 541, and a partial secret key correction section 5.
31, a secret key synthesizing unit 532, a key generation permission determining unit 511, and a corrected partial secret key storage unit 542 connected to the corrected secret key output unit 593.

The tamper-resistant device section 55A
Are a cryptographic processing unit 551 connected to a plaintext / ciphertext / signature text input unit 504, a public key method storage unit 514, a secret key storage unit 533, and an encryption processing result output unit 594; an open detection unit 561; And a deletion instruction unit 562 connected to the corrected partial secret key storage unit 542 and the secret key storage unit 533.

In the configuration of FIG. 2, when the cover of the tamper-resistant device section 55A is forcibly opened and the secret key of the RSA encryption stored in the tamper-resistant device section 55A is read, the unsealing detection unit 561 is activated. Upon detection of opening, the erasure instruction unit 562 is activated, and the secret key storage unit 533 is opened.
Since the private key stored in the personal portable device 55 is electrically erased, the private key cannot be read even by the owner of the personal portable device 55. Further, in order to prevent the secret key from being rewritten with another key, it is designed such that when opened, the semiconductor chip and the base wiring used in the tamper-resistant device section 55A are broken. An example of such a tamper resistant device is SH Weingard, "Physic
al Security for the μASBYSS System ", Proceedings
1987 IEEE Symposium on Security and Privacy, pp. 5
2-58, April 1987.

Next, the procedure of key generation in the first embodiment will be described.

First, a general procedure for generating a public key (public key exponent e, public key method n) and a secret key (private key exponent d) used in the RSA encryption will be briefly described.

Normally, the key of the RSA encryption is the following (1)-
It is generated in step (5).

(1) Generate two prime numbers p and q.

(2) The product of the two generated prime numbers p and q is used as a public key public key method n.

(3) Let L be the least common multiple of (p-1) and (q-1).

(4) A positive integer smaller than L and mutually prime with L is selected, and this is set as the public key exponent e of the public key.

(5) Generate a secret key exponent d of the secret key that satisfies e · d 1 (mod L).

On the other hand, the first embodiment utilizes the fact that the secret key can be divided into partial secret keys.

In the key generation according to the first embodiment,
The above steps (1) to (4) are left as they are, and the above step (5) is replaced with the following steps (5 ′) and (5 ″).

(5 ') Choose (k-1) positive integers, each smaller than L and relatively prime to L, and use these as secret parameters d ₁ , d ₂ , ---, d _{k- Set} to ₁ . here,
k is the number of required secret parameters, that is, the number of persons involved in key generation.

(5 ″) e · d ₀ · d ₁ · d ₂ ····· d
Generate a secret parameter d ₀ that satisfies _k−1 ≡1 (mod L), and obtain x exp (d) ≡x exp (d ₀ 1d _{1 2 2} ｄd _{k -1} ) (mod n) Here, a secret key d that satisfies the public key method and x is any positive integer less than n is generated.

Here, the divided secret parameters d ₀ , d ₁ , d
It is easy to understand that ₂ , ---, and d _k-1 are _obtained by dividing the secret key d. Also, determine the d _i even know all of the divided secret parameters other than d _i, is required equivalent computing power and break the RSA cryptography. Accordingly, unless all of the divided secret parameters d ₀ , d ₁ , d ₂ , ---, and d _{k -1} are obtained, estimating the secret key d requires the same computational power as breaking RSA encryption. Become. In the first embodiment, this property is effectively used. A similar algorithm using a divided secret parameter for the secret key of the RSA encryption is described in C. Boyd, "Some Applications of Multiple Key Cip.
hers ", Advances in Cryptology-EUROCRYPT '88, pp.
455-467, Lecture Notes in Computer Science Vol. 3
30, Springer-Verlag, 1988.

Next, the procedure for generating a secret key in the first embodiment will be described with reference to the example of k = 3 shown in FIG.
This will be described with reference to FIG. In FIG. 3, a solid line indicates an operation performed via the network, and a broken line indicates an operation performed on the network 5.
3 will be described below.

First, the personal portable device issuer 51 that issues the personal portable device 55 inputs the public key index initial value e ′ and the partial secret key d ₁ to the personal portable device 55 (FIG. 3).
Step (1)).

Here, key generation permission determining section 511 determines whether key generation is permitted as follows.

When the value of the corrected partial secret key storage unit 542 is 0
Is a time immediately after the personal portable device 55 is issued, and the secret key has not been generated yet. Therefore,
When the value of the corrected partial secret key storage unit 542 is 0, the key generation permission determination unit 511 is in the ON state, and the process can transition to the next stage of key generation.

If the private key has already been written in the personal portable device 55, the entity involved in key generation will now
Must be able to update the private key only if the user knows the partial secret key necessary for synthesizing the secret key written in the, so that no one can update the private key without permission There is.

Therefore, when the secret key has already been generated, the entity involved in key generation inputs all the initial values of the currently valid partial secret key from the partial secret key initial value input section 502, and the input is performed. The initial values of the respective partial secret keys are stored in the key generation parameter storage unit 523 (p-1) and (q-
The partial secret key correction unit 531 corrects the value so that it is relatively prime to the least common multiple L of 1). When all of the corrected partial secret keys are equal to those of the corrected partial secret key storage unit 542, the key generation permission determination unit 511 is turned on,
In other cases, the key generation permission determination unit 511 is turned off, and the secret key cannot be updated.

When the key generation permission judgment unit 511 is in the ON state, the prime generation unit 512 newly generates two primes p and q, and then the key generation parameter generation unit 522 sets (p−1) and (q−1). ) Is generated. This least common multiple L is stored in the key generation parameter storage unit 523, and L
A smaller positive integer that is relatively prime to L is obtained by sequentially incrementing the public key exponent initial value e ′, and this is stored in the public key exponent storage unit 524 as the public key exponent e.
Since this public key exponent e can be made public, it can be freely read.

On the other hand, the public key method generation unit 513 generates a product of the two prime numbers p and q generated by the prime number generation unit 512, and stores this as a public method n in the public key method storage unit 514.
Since this public key method n can be made public, it can be freely read.

In step (1) of FIG. 3, the personal portable device issuer 51 inputs the public key exponent initial value e ′ in the public key exponent initial value input section 501, and the inputted public key exponent initial value e ′ is It is stored in the public key exponent initial value storage unit 521.

The personal portable device issuer 51 inputs the partial secret key initial value d ₁ ′ obtained from the random number in the partial secret key initial value input section 502. The input partial secret key initial value d ₁ ′ is corrected by the partial secret key correction unit 531 based on a predetermined rule so as to be relatively prime to L stored in the key generation parameter storage unit 523, and the partial secret key d1
Is required. Here, the partial secret key correcting unit 531 operates so that the same d ₁ is always obtained for the same e, n, d ₁ ′. The simplest way to realize this correction is to sequentially increment d ₁ ′ to obtain d ₁ . The corrected partial secret key d ₁ is stored in the corrected partial secret key storage unit 542.

Next, the personal portable device issuer 51 sends the personal portable device 55 to the service provider 52.

The service provider 52 similarly inputs the partial secret key initial value d ₂ ′ obtained from the random number in the partial secret key initial value input section 502. Then, as in the case of the personal portable device issuer 51, the input partial secret key initial value d ₂ ′ is stored in the key generation parameter storage unit 523 in the L.
Is corrected by the partial secret key correction unit 531 on the basis of a predetermined rule so as to prime the, partial private key d ₂ are determined. Corrected partial secret key d ₂ is stored in the corrected partial secret key memory 542 (Step of Fig. 3 (2)).

Next, the service provider 52 sends the personal portable device 55 to the user 56.

[0079] When the user 56 enters the key generation instruction, personal portable device within _{55 e · d 0 · d 1} · d 2 ≡1 (Mod Partial secret key d ₀ satisfying L) is e, is generated from d _1, d _2, this portion secret key d ₀ is corrected partial secret key memory unit 5
42. Further, x exp (d) ≡x exp (d ₀ · d ₁ · d ₂ ) (mod n) where n is a public key method, x is any positive integer less than n, and a secret key d that satisfies is a secret key. The result is obtained by the combining unit 532 and stored in the secret key storage unit 533 (step (3) in FIG. 3).

After this key generation, the user 56 enters the partial secret key d
_A partial secret key output request input unit 50 that has corrected the output instruction of ₀
3 and the partial secret key d ₀ is output from the corrected partial secret key storage unit 542 via the corrected partial secret key output unit 593 in response to the input. However, the partial secret key d
The output of ₀ is limited only once by the final partial secret key output request check unit 541. The secret key d obtained in the secret key storage unit 533 and the corrected partial secret key storage unit 542
As described above, the corrected partial secret key in is strictly managed by the opening detection unit 561 and the erasure instruction unit 562 as described above, while the user 56 discloses e and n (step (4) in FIG. 3). .

Next, in order to confirm whether or not the above-described key generation has been performed improperly, the following confirmation work is performed.

First, the user 56 generates a random number r as a challenge code (step (5) in FIG. 3). Then, a signature process is performed on the generated random number r using the secret key d in the personal portable device 55 and the public key method n to obtain D (r) (step (6) in FIG. 3). Further, the user 56 obtains D ₀ (r) using the partial secret key d ₀ and the public key method n (step (7) in FIG. 3). And these r, D
(R) and D ₀ (r) are transmitted to the service provider 52 and the personal portable device issuer 51 (step (8) in FIG. 3).
(9)). Here, the communication path for transmitting r, D (r) and D ₀ (r) does not necessarily need to be a secure communication path.

The service provider 52 calculates E (D (r)) using r, D (r), D ₀ (r) received from the user 56 and n and e published by the user 56. It is checked whether this E (D (r)) is equal to r (step (10) in FIG. 3).

When E (D (r)) is equal to r, the service provider 52 can be convinced that the key generation has been performed without any impropriety. Then, the service provider 52 calculates D ₂ (D ₀ (r)) using the partial secret key d ₂ (step (10) in FIG. 3), and transfers this D ₂ (D ₀ (r)) to the personal mobile phone. The message is transmitted to the device issuer 51 (step (1) in FIG. 3).
2)).

On the other hand, the personal portable device issuer 51 also uses the r, D (r) and D ₀ (r) received from the user 56 and the n and e published by the user 56 to obtain E (D
(R)), and checks whether this E (D (r)) is equal to r (step (11) in FIG. 3).

When E (D (r)) is equal to r, the personal portable device issuer 51 can be convinced that the key generation has been performed without fraud. Then, the personal portable device issuer 51 uses the partial secret key d ₁ , D ₂ (D ₀ (r)) received from the service provider 52, and e published by the user 56 to obtain E (D ₁ (D ₂ (D ₀ (r))))
Is calculated, and this E (D ₁ (D ₂ (D ₀ (r)))) is r
(Step (1) in FIG. 3)
3)).

When E (D ₁ (D ₂ (D ₀ (r)))) is equal to r, the personal portable device issuer 51 determines that all the other entities have performed the key generation without any illegality. You can be proof that you are convinced. Then, the personal portable device issuer 51 determines D ₁ (D ₀ (r) and D
₁ (r) and calculate D ₁ (D ₀ (r) and D
₁ (r) is transmitted to the service provider 52 (step (14) in FIG. 3).

The service provider 52 receives the partial secret key d ₂ and D ₁ (D ₀₎ received from the personal portable device issuer 51.
(R)) and e published by the user 56, E (D ₂ (D ₁ (D ₀ (r)))) is calculated, and this E
It is checked whether (D ₂ (D ₁ (D ₀ (r)))) is equal to r (step (15) in FIG. 3).

When this E (D ₂ (D ₁ (D ₀ (r)))) is equal to r, the service provider 52 can be convinced that all other entities have performed the key generation properly. Proof of what you have done. The service provider 52 calculates the _{D 2 (D 1 (r)} ), the D ₂
(D ₁ (r)) is transmitted to the user 56 (step (16) in FIG. 3).

The user 56 receives the public key exponent e, the partial secret key d _0, and the D ₂ (D
₁ (r)) using E (D ₀ (D ₂ (D ₁ (r))))
Is calculated, and this E (D ₀ (D ₂ (D ₁ (r)))) is r
(Step (1) in FIG. 3)
7)).

When this E (D ₀ (D ₂ (D ₁ (r)))) is equal to r, the user 56 is now convinced that all other entities have performed the key generation without any impropriety. Can be evidence of.

When the above key generation and confirmation procedures are completed,
The user 56 can use a service requiring security. In the event that the personal portable device 55 stores secret information unique to the service, the user 56 encrypts the secret information using the public key in the personal portable device 55 and performs encryption. Create a backup of the confidential information that was obtained. Since the backup of the secret information can be decrypted only in the personal portable device 55,
The user 56 manages the backup of the secret information separately from the personal portable device 55.

If the personal portable device 55 is lost or stolen, the owner of the personal portable device 55 will not be able to receive the service, but there is a possibility that the personal portable device 55 may be misused by others. Therefore, in such a case, it is desirable to abolish the previously used secret key and use a new secret key. However, if the secret key is simply changed, data stored and received until now cannot be used. In this regard,
If you make a backup when you receive the service,
In such a case, the amount of data that cannot be used can be minimized.

Next, a procedure for reissuing the personal portable device 55 when the personal portable device 55 is lost in the first embodiment will be described. The following procedure can be applied to a case where the personal portable device 55 is physically destroyed by being dropped or stepped on.

When the personal portable device 55 is lost or destroyed, a procedure for reissuing the private key and the personal portable device is performed as follows according to the flowchart of FIG.

First, the user 56 creates, as electronic information, a “private key due to loss / destruction / reproduction request for personal portable device” describing the loss / destruction. This electronic information can be easily created by a word processor or the like if the items to be described are determined in advance. In the following, this “private key due to loss / destruction / request for reproduction of personal portable device” is Fo
Abbreviated as rm.

Next, the user 56 uses the partial secret key d ₀ secretly owned by the user 56 and the public key method n to form
m is subjected to a signature process to obtain D ₀ (Form). At the time of this signature processing, when n <Form in binary notation, a signature cannot be made by one operation, so a message digest is generated using a hash function and signature processing is performed on the message digest or the form is divided. The signature processing is performed on each part obtained by the above.

Then, the user 56 obtains the obtained signature result D
₀ (Form) and Form itself are the service provider 5
2 and the personal portable device issuer 51 (step 601). Here, online processing can be used for sending D ₀ (Form) and Form.

Next, the service provider 52 has the user 56
By checking the form received from the above, it is confirmed from the past service usage history or the like whether the user 56 has committed fraud, and it is determined whether the reissue request of the personal portable device 55 is appropriate. Personal portable device 55
Is determined to be appropriate, the service provider 52 receives from the user 56 using the partial secret key d ₂ and the public key method n which the service provider 52 has in secret. A signature process is performed on D ₀ (Form) to obtain D ₂
D ₀ (Form) is obtained. And this signature result D ₂ D ₀
(Form) is sent to the personal portable device issuer 51 (step 603).

On the other hand, the personal portable device issuer 51 checks the Form received from the user 56 and determines whether the request for reissuing the personal portable device 55 is appropriate. Here, when the personal portable device 55 is destroyed, it may be necessary to have the destroyed personal portable device 55 sent to the personal portable device issuer 51 as well. If it is determined that the reissuance of the personal portable device 55 is appropriate, the personal portable device issuer 51 determines that the partial portable key d ₁ secretly owned by the personal portable device issuer 51 and the public key method n D ₀ (Fo) received from the user 56 using
rm) to obtain a signature D ₁ D ₀ (Form). The signature result D ₁ D ₀ (Form) is sent to the service provider 52 (step 602).

Next, the service provider 52 receives the D ₁ D ₀ (Form) received from the personal portable device issuer 51.
Using the partial secret key d ₂ and the public key (e, n) secretly owned by the service provider 52, F ₂ = E
(D ₂ (D ₁ (D ₀ (Form)))) is calculated (step 606), and this F ₂ = E (D ₂ (D ₁ (D
₀ (Form)))) received from the user 56
It is verified whether it is equal to (Step 607). If the verification is successful, the service provider 52 issues a secret key reproduction permission (step 611). Otherwise, the secret key reproduction is stopped (step 61).
2).

On the other hand, the personal portable device issuer 51 receives the D ₂ D ₀ (Form) received from the service provider 52.
Using the partial secret key d ₁ and the public key (e, n) secretly owned by the personal portable device issuer 51,
₁ = E (D ₁ (D ₂ (D ₀ (Form)))) is calculated (step 604), and this F ₁ = E (D ₁ (D ₂ (D
₀ (Form))) received from the user 56
It is verified whether it is equal to rm (step 605).
If the verification is successful, the private key issuer 51 issues a secret key reproduction permission (step 60).
8) If not, the secret key reproduction is stopped (step 609).

When the secret key reproduction permission is obtained from both the personal portable device issuer 51 and the service provider 52, the secret key reproduction is permitted (step 613), and thereafter, the secret key reproduction and the personal portable device reissue are performed. Is performed in the same manner as when a new private key is issued (step 61).
4).

In the procedure for re-issuing the secret key and the personal portable device, it is determined that the form created by the user 56 is correct. The personal portable device issuer 51 and the service provider 5
2. All of the three users 56 involved in key generation can be verified only by signing this Form.
For this reason, in the first embodiment, the secret key cannot be reproduced even if someone or a person other than someone tries to forge the Form by collusion.

Therefore, in the first embodiment,
At the time of key generation, all of the financially interested entities generate secret parameters and write these secret parameters to the personal portable device 55 to perform key generation. You cannot know the secret key. Moreover, should the private key become unusable due to loss or destruction, the private key may only be used when all financially interested entities have authorized the reproduction of the private key and the reissue of the personal portable device. Can be played,
Even in such a case, the user 56 does not lose all the information accumulated so far.

When the personal portable device 55 is reissued due to the loss of the personal portable device 55, the original private key is reproduced, and then the secret key having lost the reproduced private key is reproduced according to the procedure of the flowchart of FIG. It can be replaced with a new secret key different from the key.

In this case, the user 56 has the original partial secret key d
₀ is input to the re-issued personal mobile device 55, and the personal mobile device issuer 51 inputs the original partial secret key d ₁ and the new secret key d _1NEW to the re-issued personal mobile device 55 to provide the service. The person 52 inputs the original partial secret key d ₂ and the new secret key d _2NEW into the re-issued personal portable device 55 (step 700).

Then, it is determined whether or not the original partial secret key d ₁ input by the personal portable device issuer 51 is equal to the reproduced partial secret key d ₁ stored in the personal portable device 55 to be reissued. Verify (step 701)
Also, it verifies whether the original partial secret key d ₂ input by the service provider 52 is equal to the reproduced partial secret key d ₂ stored in the personal portable device 55 to be reissued (step 702). ). These steps 701
If any of the verifications 702 and 702 fails, the issuance of a new secret key is stopped (step 707).

If the verification of both steps 701 and 702 is successful, new partial secret keys d _1NEW and d _1NEW
Use the _2NEW to generate a new partial secret key d _0NEW and new public key exponent e _{NE W} (step 703).

The secret information CardInfo stored in the personal portable device 55 is re-encrypted with a new key, and E _NEW (D ₀ (D ₂ (D ₁ (E (Card Inf
o))))) (Step 704).

The new partial secret key d ₀ is stored in the user 56
(Step 705), while the original partial secret key d
₀ , d ₁ and d ₂ are discarded (step 706).

The RS generated or reproduced as described above
The secret key of the A cipher can convince anyone that only the owner of the personal portable device 55 can use the private key, and the value of the secret key itself includes the owner of the personal portable device 55 as well. It can convince anyone that no one can know.

That is, according to the first embodiment, the partner authentication function can be used to confirm the identity of the person, and even the person who has purchased the digital copyright information cannot make an unauthorized copy. In addition, even when the personal portable device is accidentally lost or destroyed, the same private key that was previously used in the personal portable device 55 is used to write the private key into the personal portable device. It is possible to reproduce without using a device.

In the actual implementation, the personal portable device 55 is a standardized IC card or PC card (P
(CMCIA).

As a method of using the content actually decrypted on the receiving side, the methods disclosed in Japanese Patent Application Nos. 6-298702 and 6-299940 can be used.

(Second Embodiment) Next, a second embodiment of the present invention will be described in detail with reference to FIGS.

In the second embodiment, a secret key for signature is generated as follows by the procedure of the flowchart of FIG.
to manage.

First, the user himself / herself generates a key for public key encryption (step 811), and the generated private key is strictly stored under the responsibility of the user himself (step 812).

On the other hand, the public key is sent to the certificate issuing center trusted by all the entities having financial interests with the user and registered in the certificate issuing center (step 813).

Upon receiving the public key sent from the user (step 814), the certificate issuing center signs the public key of the user using the private key of the certificate issuing center (step 815). Then, the signed public key is published as a user certificate (step 81).
6).

As a result, it is possible to prove that only the user himself has the ability to sign using the private key, and the user blames others for the signature signed using this private key. You will not be able to escape your responsibility.

Next, in order to allow the user to use the digital information without illegally copying the purchased digital information, the secret key of the public key encryption for decrypting the purchased digital information is shown in FIG. It is generated and managed as follows in the procedure of the flowchart. Here, the public key encryption for decryption is provided separately from the public key encryption for signature described above.

First, a key of public key encryption for decrypting digital information is generated by the copyright holder of the digital information (step 821), and the generated secret key is strictly stored in the personal portable device. The secret key for decryption can be used only inside the personal portable device and cannot be read outside (step 822).

Then, the personal portable device storing the private key for decryption and the public key are sent to the user (step 823).

When the user receives the personal portable device storing the private key for decryption and the public key (step 824), the user transfers the purchased digital information to the private key stored inside the personal portable device. It can be used for decoding.

In the procedure shown in FIG. 7, the copyright owner generates a private key of public key encryption used only for decryption of digital information, and locks the private key for decryption in the personal portable device. Only the copyright holder can copy the encrypted digital information, thus preventing unauthorized copying of the digital copyright information.

By using two different types of public key cryptography for signature and decryption as described above, in the second embodiment, when digital information is treated as a product on a network, a willingness to pay is expressed. Can be proved to be a user only, and it can be proved that the user cannot copy digital information without permission of the information provider.

In the second embodiment, the secret key of the public key encryption for decryption and the secret key of the public key encryption for signature may be stored in the same personal portable device, or may be stored in different devices. It may be stored.

[0129]

As described above, according to the present invention,
A private key of public key cryptography that should not be known to anyone can be generated in a personal portable device without using a special private key writing device as a private secret key that can prove that only users can use it. it can. Moreover, even if the personal portable device is accidentally lost or destroyed, the same private key as the previous personal portable device can be reproduced.

By using this personal portable device, when digital information is handled as a product on a network, it is possible to prove that only the user has expressed his will to pay, and that the user is not authorized by the information provider. Can prove that digital information cannot be copied.

[Brief description of the drawings]

FIG. 1 is a diagram showing a schematic configuration of a system according to a first embodiment of the present invention.

FIG. 2 is a block diagram of the personal portable device according to the first embodiment of the present invention.

FIG. 3 is a diagram illustrating a key generation procedure according to the first embodiment of the present invention.

FIG. 4 is a flowchart showing a procedure for reissuing a secret key and a personal portable device according to the first embodiment of the present invention.

FIG. 5 is a flowchart showing a procedure for updating a secret key according to the first embodiment of the present invention.

FIG. 6 is a flowchart illustrating a procedure for generating and managing a secret key for signature in the second embodiment of the present invention.

FIG. 7 is a flowchart showing a procedure for generating and managing a secret key for decryption in the second embodiment of the present invention.

[Explanation of symbols]

 51 Personal Portable Device Issuer 52 Service Provider 53 Network 54 User Terminal 55 Personal Portable Device 55A Tamper-resistant Device Section 56 User 501 Public Key Exponential Initial Value Input Portion 502 Partial Secret Key Initial Value Input Portion 503 Corrected Partial Secret Key Output Request Input unit 504 Plain text / cipher text / signature text input unit 511 Key generation permission determination unit 512 Prime number generation unit 513 Public key method generation unit 514 Public key method storage unit 521 Public key exponent initial value storage unit 522 Key generation parameter generation unit 523 Key Generation parameter storage unit 524 Public key exponent storage unit 531 Partial secret key correction unit 532 Secret key synthesis unit 533 Secret key storage unit 541 Final partial secret key output request check unit 542 Corrected partial secret key storage unit 551 Encryption processing unit 561 Open detection Section 562 erasure instructing section 591 public key method output Part 592 public key exponent output part 593 corrected partial secret key output part 594 encryption processing result output part

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁶ Identification code Agency reference number FI Technical display location H04L 9/00 601F

Claims (22)

[Claims] 1. A method for generating and managing a secret key of public key cryptography, wherein (a) partial secret keys constituting a secret key, each of which has a stake in a user of a tamper-resistant personal portable device. Private key that is secretly managed by
Inputting the tamper-resistant personal portable device separately from all persons having an interest in the user of the tamper-resistant personal mobile device; and (b) extracting the partial secret key input in step (a) from the partial secret key. Generating a secret key in the tamper-resistant personal portable device; and (c) using the secret key generated in step (b) to read the secret key out of the tamper-resistant personal portable device. Storing in a storage area in the tampa personal mobile device;
A private key management method for public key cryptography, comprising: 2. The method of claim 1, further comprising:
(D) A private key management method for public key cryptography, comprising a step of using the secret key stored in step (c) for decryption processing and signature processing only inside the tamper-resistant personal portable device. 3. The method of claim 1, further comprising:
(E) detecting the opening of the cover of the tamper-resistant personal portable device; and (f) when the opening of the cover of the tamper-resistant personal portable device is detected in step (e), the secret key is stored in the storage area. Erasing a secret key for public key cryptography. 4. The method of claim 3, further comprising:
(G) when the opening of the tamper-resistant personal portable device is detected in step (e), the components mounted in the tamper-resistant personal portable device are destroyed and the tamper-resistant personal portable device cannot be used. A private key management method for public key cryptography. 5. The method of claim 1, further comprising:
(H) when a user requests a secret key to be recovered due to loss of a secret key in the tamper-resistant personal portable device, the partial secret key is separately sent to the tamper-resistant personal portable device from all parties having an interest in the user; (I) regenerating the secret key in the tamper-resistant personal portable device from the partial secret key input in step (h), and (j) step (i). And c) storing the secret key generated in (1) again in the storage area. 6. The method of claim 1, further comprising:
(K) when a user requests a secret key reproduction due to damage to the tamper-resistant personal portable device, the partial secret key is separately provided to the new tamper-resistant personal portable device from all parties having an interest in the user. Inputting to the
(L) generating a secret key in the new tamper-resistant personal portable device from the partial secret key input in step (k); and (m) generating the secret key generated in step (l) by: Storing the secret key in a storage area in the new tamper-resistant personal portable device, wherein the secret key cannot be read out of the new tamper-resistant personal portable device. Management method. 7. The method of claim 1, further comprising:
(N) new partial secret keys that constitute a new secret key, each of which is a new partial secret key that is secretly managed by a person who has an interest in the user of the tamper-resistant personal portable device. From each person who has an interest in the user of the tamper-resistant personal mobile device, separately inputting the tamper-resistant personal mobile device into the tamper-resistant personal mobile device; and (o) the new partial secret key input in step (n) Generating a new secret key in the tamper-resistant personal portable device; and (p) storing the new secret key generated in step (o) in the storage area by overwriting the original secret key. And a secret key management method for public key encryption. 8. The method according to claim 1, further comprising: creating a backup of the encrypted information to be decrypted with the secret key stored in the storage area before the secret key is required to be reproduced. Restoring device encryption information from the backup to the tamper-resistant personal portable device after the secret key has been reproduced. 9. The method according to claim 1, further comprising: making a backup of the encryption information to be decrypted with the original secret key stored in the storage area before the secret key regeneration and update are required. Restoring the encrypted information from the backup to the tamper-resistant personal portable device after the private key is reproduced and before the private key is updated; and Decrypting the encrypted information in the tamper-resistant personal portable device using the reproduced private key before the private key is updated, and decrypting the encrypted information after the private key is reproduced and updated. Encrypting the updated information in the tamper-resistant personal portable device using the updated private key. 10. The method of claim 1, further comprising:
(Q) generating two prime numbers p and q and setting the least common multiple of (p-1) and (q-1) to L; (r)
setting a product of p and q as a public key method n, and setting a positive integer smaller than L and relatively prime to L as a public key exponent e; (s) determining a stake of the user of the tamper-resistant personal portable device; Assuming that the total number of certain persons is k, the (k-1) positive integers, each of which is separately smaller than L and relatively prime to L, are respectively set as partial secret keys d ₁ , d ₂ ,
----, d _k-1 and (t) the step (b) is performed as follows: x exp (d) ≡x exp (d ₀ · d ₁ · d ₂ ····· d _k-1 ) (Mod n) where x is an arbitrary positive integer less than n, and a secret key d that satisfies e · d ₀ · d ₁ · d ₂ ····· d _k-1 ≡1 Generating a partial secret key d ₀ of the user that satisfies (mod L); and a secret key management method for public key cryptography. 11. The method according to claim 10, further comprising the step of outputting the partial secret key d ₀ of the user generated in step (t) only once from the tamper-resistant personal portable device. Private key management method for public key cryptography. 12. The method of claim 1, further comprising: distributing a random number to all persons having an interest in the user of the tamper-resistant personal portable device; and using a partial secret key of the all persons. And sequentially signing the random numbers. Each verifying, when verified, that the secret key has been generated without tampering, comprising: 13. The method of claim 1, further comprising: distributing a request to regenerate a secret key to anyone having an interest in the user of the tamper-resistant personal portable device; Sequentially signing the secret key reproduction request using a key, each of the interested parties with the user of the tamper-resistant personal portable device verifies the sequentially signed secret key reproduction request using a public key. Issuing a secret key reproduction permission when each of the sequentially signed secret key reproduction requests is successfully verified, and a secret key management method for public key cryptography. 14. A tamper-resistant personal portable device for generating and managing a private key of public key cryptography, wherein each partial secret key constituting a secret key is associated with a user of the tamper-resistant personal portable device. First means for separately inputting a partial secret key secretly managed by a person from the tamper-resistant personal portable device to the tamper-resistant personal portable device, from all persons having an interest in the user of the tamper-resistant personal portable device. A second means for generating a secret key in the tamper-resistant personal portable device from the partial secret key input by the first means, and a secret key generated by the second means, Tamper-resistant personal portable device, wherein the secret key cannot be read out of the portable device, and stored in a storage area in the tamper-resistant personal portable device. 15. The device according to claim 14, wherein
The tamper-resistant personal portable device further comprises a processor that performs a decryption process and a signature process using the secret key stored in the storage area only inside the tamper-resistant personal portable device. 16. The device according to claim 14, wherein
Further, opening detection means for detecting opening of the cover of the tamper-resistant personal portable device, and erasing the secret key from the storage area when the opening detection of the tamper-resistant personal portable device is detected by the opening detection means. Means, comprising: a tamper resistant personal mobile device. 17. The device according to claim 16, wherein
Furthermore, when the opening detection of the tamper-resistant personal portable device is detected by the unsealing detection means, the components mounted in the tamper-resistant personal portable device are destroyed to disable the tamper-resistant personal portable device. A tamper-resistant personal portable device comprising: 18. The device according to claim 14, wherein
When a user requests a secret key to be recovered due to the loss of a secret key in the tamper-resistant personal portable device, the first means separates the partial secret key from all parties having an interest in the user. The tamper-resistant personal portable device re-enters the secret key in the tamper-resistant personal portable device from the partial secret key input by the first means. The third means is the second means.
The tamper-resistant personal portable device, wherein the secret key generated by the means is stored again in the storage area. 19. The device according to claim 14, wherein
The first means is a new partial secret key constituting a new secret key, each of which is a new partial secret key that is secretly managed by a person who has an interest in the user of the tamper-resistant personal portable device. A key is separately and individually input to the tamper-resistant personal portable device from all persons having an interest in the user of the tamper-resistant personal mobile device, and the second unit is configured to input the new key input by the first unit. A new secret key is generated in the tamper-resistant personal portable device from the partial secret key, and the third means converts the new secret key generated by the second means to the original secret key. A tamper-resistant personal portable device, which is overwritten and stored in the storage area. 20. The device according to claim 14, wherein
Further, two prime numbers p and q are generated, and (p−1) and (q−
A means for setting the least common multiple of 1) to L; a means for setting the product of p and q to a public key method n; a means for setting a positive integer smaller than L and relatively prime to L as a public key exponent e; Each of the tamper-resistant personal mobile devices is separately smaller than L and relatively prime to L, where k is the total number of interested parties with the user of the personal mobile device (k−
1) the positive integers are converted into partial secret keys d ₁ , d ₂ , ---, d
_k exp, and the second means is x exp (d) ≡x exp (d ₀ · d ₁ · d ₂ ····· d _k-1 ) (Mod n) where x is an arbitrary positive integer less than n, and a secret key d that satisfies e · d ₀ · d ₁ · d ₂ ····· d _k-1 ≡1 Means for generating a partial secret key d ₀ of a user satisfying (mod L). 21. The device according to claim 20, wherein
Further, the tamper resistant personal portable device, characterized in that it comprises a means for outputting the partial secret key d ₀ of the user from the resistant tamper personal portable device only once. 22. A method of handling digital data using public key cryptography, comprising the steps of: (a) generating a public key and a secret key of a first public key cryptography for signature on a user side; Registering the public key of the first public key cryptosystem in the certificate issuing center; and (c) signing the public key of the first public key cryptosystem using the private key of the certificate issuing center, and Publishing the public key as a user certificate; and (d) generating a public key and a private key of a second public key cryptosystem for digital data decryption on the copyright holder side, and using the second public key cryptosystem. Storing the secret key of the tamper-resistant personal portable device in a storage area in the tamper-resistant personal portable device where reading of the secret key is impossible outside the tamper-resistant personal portable device; and Provide the public key of the key encryption to the user side, On the user side, the decryption process using the secret key of the second public key encryption and the signature process using the secret key of the first public key encryption are performed inside the tamper-resistant personal portable device. Making the digital data provided by the method usable; and a method for handling digital data.