摘要： 分析了现有容侵CA方案,提出了一种基于二方共享与(t,n)门限方案相结合的容侵CA方案,即先由CA应用服务器(CAA)、密钥服务器(SS)共享CA私钥,而后进一步将SS的共享密钥SK2利用门限密码的思想分成n份,并由n个密钥共享服务器(SSS)共享。在签名过程中既不需要由d2i(1≤i≤n)重构SK2,也不需要由d2i(1≤i≤n)与SK1重构SK。签名被分为CAA的初次签名与SS的二次签名,在形成正式签名前CAA要与SS相互认证,一旦发现对方签名异常,可即时向仲裁中心报警,从而提高了CA系统的安全性及容侵能力。

关键词: 入侵容忍, CA, (t,n)门限方案, 二方共享

Abstract: After the existing schema is analyzed,a new intrusion-tolerant CA scheme based on a new mechanism,which combines two-party secret sharing arithmetic with(t,n) threshold scheme is proposed.Firstly,CA application sever(CAA) shares secret key of CA with secret sharing server(SS),then the SK 2 of SS is further shared among the n secret sharing server(SSS).During the signature,it not only don’t need to reconstruct theSK 2 byd 2i(1≤i ≤ n) but also to reconstruct the SK byd 2i(1≤i ≤ n) and SK1.The signature is divided into two stage,one is primary signature which is performed in CAA,the other is bis signature which is performed in SS.Before the formation of true signature,CAA and SS would perform mutual authentication,once one of them find the opposing party is in fault,they could give an alarm quickly in this way,the proposed mechanism would improve the security and intrusion-tolerant ability of CA.

中图分类号: 

• TP393.08