Upload
gladys-cunningham
View
253
Download
3
Embed Size (px)
DESCRIPTION
Efficiency Unforgeability : only signer can generate Not reusable : not to use for other message Unalterable : No modification of signed message Authentication of a signer Non-repudiation : not denying the act of signing 33
Citation preview
Requirement Security Classification RSA Signature ElGamal Signature DSS Other Signature Schemes Applied Digital Signatures
1
2
Signature Scheme
Efficiency Unforgeability : only signer can generate Not reusable : not to use for other message Unalterable : No modification of signed message Authentication of a signer Non-repudiation : not denying the act of signing
3
Key only or no message attack : Adv access only to public parameters and public keys
Message attack : Adv has access to pairs of message texts and corresponding signatures. Depending on Adv’s power of selecting messages signed by S.◦ Known-messages : Adv doesn’t choose message signed by S.◦ Generic chosen-messages : Adv chooses a set of messages to be
signed before knowing the actual S targeted for attack.◦ Directed chosen-message : Adv chooses a set of messages to be signed
after selecting a specific S but the actual attack. ◦ Adaptive chosen-message : Adv chooses message for signing
dynamically after inspecting signatures he obtained for previous messages.
Adv: Adversary, S: legitimate signer
4
Hard
Easy
Total break : Adv recovers the secret key of S under attack.
Universal forgery : Adv doesn’t obtain the secret key of S, but gains the ability to generate valid signatures for any message.
Selective forgery : Adv doesn’t obtain the secret key of S, but gains the ability to generate valid signatures for any set of preselected messages.
Existential forgery : Adv can create at least one new message and signature pair without knowing the secret key. The messages are only arbitrary bit strings and Adv doesn’t have any power over their composition.
5
Hard
Easy
Consists of 6 elements (M,Mh,A,K,S,V) M : message spaceMh (or Ms) : signing space A : signature spaceK : key space For K K, signing alg. sigK S and its corresponding
verification alg. verK V.Each sigK : M A and verK : M x A {t,f} are fts s.t.,
verK(x,y)= t if y = sigK(x) or verK(x,y)=f if y sigK(x)
6
Signature generation (a) get private key, Ks
(b) m’=h(m) : hash algorithm and s*=sigKs(m’) (c) m, s* : signature
Signature verification (a) obtain public key, Kp
(b) compute m’=h(m) and u=verKp(m’,s*) (c) accept signature iff u=true.
(Ex.) DSA, ElGamal, Schnorr
7
8
(a) signing
Mm
Mhm’
A
s*=sigK(m’)
h sigK
(b) verification
M x A true
false
verK(m,s*)
Signature generation (a) get private key, Ks
(b) m’=R(m) : redundancy function and s*=sigKs(m’) (c) s* : signature
Signature verification (a) obtain public key KP
(b) compute m’= verKp(s*) (c) verify that m’ MR ( if m’ MR, then reject) (d) recover m from m’ by computing R-1(m’)
(Ex.) RSA, Rabin, Nyberg-Rueppel * R() and R-1() are easy to compute.
9
10
(a) signing
M
m
MR
m’
A
s*=sigK(m’)
R sigK
MS
*This scheme can be easily changed to digital signature with appendix s.t., hashing before signing.
(b) verification R: redundancy ft e.g., 1:1 ftMR : image of R
11
Classification Analog DigitalSize of Signature fixed variable
Digital Copy difficult easy
Operation simple mathematical
Legality possible possible
Forgeability un-countermeasured countermeasured
Generation pen computer
Auxiliary tool nothing necessary (hash ft.)
12
BasicComputationally secure
Unconditionally secureProvably secure
Probably secure
ID-based
Certificate-based
Message-recovery
Message-appendix
Non-arbitrator
Arbitrator
Randomized
Deterministic
Randomized
Deterministic
13
Proxy undeniable
Advanced
Undeniable
Multi
(n,k) Multi
One-time, bounded-life
Blind
Fail-stop
Oblivious
Multi undeniable
Proxy
(preparation) n=pq, M=A=n K ={(n,p,q,a,b) : n=pq, ab=1 mod (n)} public key : {b,n}, private key : {a,p,q} (signing) K=(n,p,q,a,b),sigK(x)=xa mod n (verification)verK(x,y)=true x=yb mod n, x,y n
(Problem) If an adversary know signature of x1 and x2 to be s1 and s2, he can create signature of x3=x1x2, i.e., s3{=s1s2=x1
d x2d= (x1x2)d} without knowing secret key, d. To
prevent this, hash(x) or other means must be used. Note that D(m1)D(m2)=D(m1m2) in RSA
14
p : prime, p*: primitive element,
M =p*, A = p
* x p-1*
K ={(p,,a,) : = a mod p} public: (p,,), private: a
(signing) K=(p,,a,), secret random k p-1*
sigK(m,k) = (,) where = k mod p, =(m-a)k-1 mod (p-1)
(verification) m, p* and p-1
*
verK(m,, )=true =m mod p * =a k = m mod p
15
(Preparation) p=467, =2, a=127 =a mod p = 2127mod467=132 message m=100 random k=213 s.t., gcd(213,466)=1. 213-1mod466 =431 signing = k = 2213 mod 467= 29 =(m-a)k-1 mod (p-1)=(100 - 127 x 29) 431 mod
466=51 Verification on m, and =m mod p ? =13229 2951=189 mod 467 m =2100 =189 mod 467
16
Security : without knowing a, forgery of x’s signature is reducible to DLP of finding () chosen ().
Note◦ Keep k to be secret◦ Not to use k two times.
Generalization from p* to any finite Abelian group
is possible
17
After 1991 August for 3-year public debate, NIST announced DSS (Digital Signature Standard) documented FIPS186 in 1994 December.
RSA was not selected since its patent Introduce efficient operation under
subgroup in ElGamal signature scheme Used with DHA (Digital Hash Algorithm)
18
p:512 bit prime, q:160 bit prime, q|p-1, gp*
=g(p-1)/qmod p (q-th root of 1 mod p), M =p
*, A= q x q, K={(p,q,,a,):=a mod p} public: (p,q,,), private: a. (signing) K=(p,q,,a,), secret random k (1k q-
1,gcd(k,q)=1), sigK(m,k) = (,) where = (k mod p) mod q, =(m+a)k-1 mod q.
(verification) m p* and , q
verK(m,, )=true (e1e2 mod p)mod q = . e1= m-1 mod q, e2= -1 mod q.
19
(Ex.) q=101, p=78q+1=7879, g=3, = 378 mod 7879 =170, a=75, = a mod 7879 = 4567
(signing) message m=1234, random k=50, k-1 mod 101=99. = (k mod p) mod q=(17050mod 7879) mod101=2518 mod101=94. =(m+a)k-1 mod q=(1234 +75x94) 99 mod101 = 97.
(verification) sigK(m,k) = (,) =(94,97), m=1234 -1=97-1 mod 101=25, e1= m-1 mod q =1234 x 25 mod 101 =45, e2= -1 mod q = 94 x 25 mod 101 = 27
(e1e2 mod p)mod q= (17045 4567 27 mod 7879 ) mod 101 = 2518 mod 101=94 ? =94 (valid)
20
21
Signature Scheme with additional properties
Blind signature One-time signature
◦ Lamport scheme◦ Bos-Chaum scheme
Undeniable signature◦ Chaum-van Antwerpen scheme
Fail-stop signature◦ van Heyst-Peterson scheme
Group Signature : group member can generate signature if dispute occurs, identify member.
22
23
Without B’s knowing message M itself, A can get a signature of M from B.
RSA scheme, B’s public key :{n,b}, private key:{a}
(1) select random ks.t. gcd(n,k)=1, 1<k<n-1
A(customer) B(Bank)
(2) m*=mkb
mod n
m*
(3) s*= (m*)a mod ns*
(4) s=k-1 s*mod n(signature of M by B : k-1(mkb)a= k-1 ma kba = ma)
(1)randomnumber
(2)blinding
(3)signing
(4)unblinding
A B
g(SBf(m))=SB(m)f:blinding ftg:unblinding ft only A knowsf(m) : blinded message
(Preparation) p=11, q=3, n=33,(n)= 10 x 2=20 gcd(a, (n))=1 => a=3, ab =1 mod (n) => 3 b = 1 mod 20 => b=7 B: public key :{n,b}={33,7}, private key ={a}={3}
(1) A’s blinding of m=5 select k s.t. gcd(k,n)=1. gcd(k,33)=1 => k=2 m* = m kb mod n= 5 27 mod 33 = 640 mod 33 = 13 mod 33(2) B’s signing without knowing the original m s*= (m*)a mod n = 133 mod 33 =2197 mod 33 =19 mod 33(3) A’s unblinding s=k-1 s* mod n (2 k-1=1 mod 33 => k=17) = 17 19 mod 33 =323=26 mod 33
* Original Signature : ma mod n = 53 mod 33 =125 =26 mod 33
24
Properties(p.299)◦ A parameter is used to sign only one message◦ Signing and verifying procedure is very efficient
one-time signature based on Lamport Signature◦ Key generation
k; positive int, f: Y Z one-way ft, private key: y1,0, …, yk,1 , public key: zi,j=f(yi,j), 1 ≤ i ≤ k , j=0,1
◦ Signing for K=(yi,j, zi,j :, 1 ≤ i ≤ k , j=0,1) sigK (x1, …, xk ) =(y1,x1, … yk, xk ).
◦ Verify Signature (a1, …, ak) on msg (x1, …,xk) is verified as : verK((x1, …, xk), (a1, …, ak)) = true ↔ f(ai) = zi, x1 , 1 ≤ i ≤ k
25
Public parameters◦ one-way ft : f(x) = 3x mod 7879◦ k=3,
Alice chooses 6 (secret) random numbers◦ Private key
y1,0=5831, y1,1= 735, y2,0=803, y2,1=2467, y3,0=4285, y3,1=6449◦ Public key : Alice computes 6 y’s under f
Z1,0=2009, z1,1=3810, z2,0=4672, z2,1=4721, z3,0=268, z3,1=5731 Signing on msg x=(1,1,0)
(y1,1, y2,1, y3,0) = (735, 2467, 4285) Verification
3735 mod 7879 = 3810, 3 2467 mod = 4721, 34285 mod = 268
26
Properties(p.313)◦ If a signer signs a message according to the mechanism, a verifier
upon checking the signature should accept it◦ A forger cannot construct signatures that pass the verification
algorithm without doing an exponential amount of work◦ If a forger succeeds in constructing a signature which passes the
verification test then the true signer can produce a proof of forgery with high probability
◦ A signer cannot construct signatures which are claimed to be forgeries at some later time.
Advantages: Even if a very powerful adversary can forge a single signature, the forgery can be detected and the signing mechanism no longer used.
27