Applied Cryptography Spring 2017 Digital signatures

Digital signature

Digital signature - Requirements (assuming that Alice’s key have not be compromised) only Alice should be able to sign the message on her name any should be able to verify that the message is signed by Alice Undeniable digital signatures sometimes it could be useful to additionally require that signature could be verified only in cooperation with Alice (however, when cooperating she shouldn’t be able to deny her signature)

Digital signature – Practicalities M – message,  – its digital signature Depending from signature scheme it could be sufficient to send just , or it might be necessary to send pair (,M) h - a one-way hash function (easy to compute, but for a given M it is hard to find M’ with h(M) = h(M’)) Digital signature: Send message M Sign h(M) and send its digital signature  together with M

Digital signature – Practicalities Signatures are often computed by small chips. Therefore it is preferable that signing of message could be performed faster than verification of signature.

Digital signature - RSA p,q - two large primes (100 digits or more) n = pq e - small odd integer that is relatively prime to (p – 1)(q – 1) d - integer such that de  1 (mod (p – 1)(q – 1)) (it can be shown that it always exists) P = (e,n) - public key S = (d,n) - secret key Signing: S = Md (mod n) Verifying: V(S) = Se (mod n)

RSA – probabilistic signature scheme (PPS) H – hashes {0,1}*{0,1}k G – hashes {0,1}k{0,1}nk1 (G1 and G2 are two parts of this value) Can be shown to be as secure as RSA

Digital signature - ElGamal Taher ElGamal, 1984

Digital signature - ElGamal

Digital signature - ElGamal

Digital signature - ElGamal

Digital signature - ElGamal

ElGamal signatures – a closer look Warnings: Never reuse k – this will instantly allow to recover secret key x. It is not difficult to generate “bad” values of g – either the implementation should be completely trusted, or use a a one way hash function to generate pseudorandom g, whose randomness can then be verified. When verifying signature, check that a < p 

ElGamal - subliminal channel ElGamal: p,g,y=gx mod p - public; x - private h - "signed" message, m - "secret" message gcd(m,p–1) should be 1 Alice: a=gm mod p and finds b: h=xa+mb mod(p–1) Signature: a,b

ElGamal - subliminal channel Alice: a=gm mod p and finds b: h=xa+mb mod(p–1) Signature: a,b Bob: Verification: yaab=gh mod p ? Extraction: m=(b–1(h–xa)) mod(p–1) Implementations of digital signatures should be trusted - this can be used to "broadcast" secret keys!

Digital signature - Schnorr Claus Peter Schnorr, 1989 p - prime q - prime factor of p–1 [can be “small” – e.g. 160 bits] a - aq=1 mod p (and a≠1) [try several a = x(p-1)/q mod p] All these are public s < q - a random number and secret key v = a–s mod p - public key Signing: Pick random k<q and compute x = ak mod p Compute e = H(M,x) and y = (k+se) mod q Signature - pair (e,y) Verification: Compute x’ = ayve mod p and check that e = H(M,x’)

Digital signature - DSA Proposed by the National Institute of Standards and Technology (NIST) in 1991 for use in their Digital Signature Standard (DSS) adopted in 1993. Expanded further in 2000. Design criteria secret but was given for assessment to public. Could be considered as variation of ElGamal scheme. Intended to be free for use for everybody. Received strong criticism from RSA Data Security:) and companies that have invested in RSA

Digital signature - DSA Points of criticism: Can’t be used for encryption and key distribution Developed by NSA and may contain a trapdoor DSA is slower than RSA RSA is de facto standard Selection process was not public, sufficient time for analysis was not provided. DSA may infringe on other patents. The key size is too small.

Digital signature - DSA

Digital signature - DSA

Digital signature - DSA

Digital signature - DSA

Digital signature - DSA

Digital signature - DSA

Discrete logarithm signature schemes

Discrete logarithm signature schemes

Undeniable digital signatures Signature should be such that: Bob should be able to verify signature in cooperation with Alice Alice should be unable to deny the signature Signature can't be verified from message and signature pair alone

Undeniable digital signatures p,g,y=gx mod p - public; x - private Signing (Alice): s=mx mod p Verification (Bob and Alice): 1) (Bob): chooses random a,b<p, sends Alice c=sayb mod p 2) (Alice): computes t=x–1 mod (p–1), sends Bob d=ct mod p 3) (Bob): confirms that d=magb mod p

Undeniable digital signatures p,g,y=gx mod p - public; x - private; signature s=mx mod p Verification (Bob and Alice): 1) (Bob): chooses random a,b<p, sends Alice c=sayb mod p 2) (Alice): computes t=x–1 mod (p–1), sends Bob d=ct mod p 3) (Bob): confirms that d=magb mod p Fake transcript: 1) generate fake pair m,s 2) choose random a,b<p, and compute d=magb mod p and sayb mod p

Undeniable digital signatures (a second look)

Undeniable digital signatures (a second look)

Undeniable digital signatures (a second look)

Undeniable digital signatures (a second look)

Identification schemes Victor wants to communicate with Peggy and be sure that she is the right person. How to achieve this? Peggy and Victor both know a secret key k. Victor sends a random message r and Peggy returns Ek(r). Peggy has a public key d and a secret key s. Victor sends a random message r and Peggy returns Es(r). However, it is not a particularly good idea to sign random numbers :)

Identification schemes However, it is not a particularly good idea to sign random numbers :) Assume RSA is used. d - public, s - secret. Eve wants to get Alice sign m. 1) find m1 and m2 such that m = m1m2 mod n 2) get Alice to sign "random" m1 and m2 3) calculate md mod n = (m1d mod n)(m2d mod n)

For example, if p =7, the quadratic residues are 1, 2, and 4. If p is prime, and a is greater than 0 and less than p, then a is a quadratic residue mod p if x2 = a (mod p) for some x For example, if p =7, the quadratic residues are 1, 2, and 4. 1*1=1=1(mod7) 2*2=4=4(mod7) 3*3=9=2(mod7) 4*4=16=2(mod7) 5*5=25=4(mod7) 6*6=36=1(mod7)

When p is odd, there are exactly (p - 1)/2 quadratic residues mod p If a is a quadratic residue mod p, then a has exactly two square roots, one of them between 0 and (p - 1)/2, and the other between (p - 1)/2 and (p - 1). One of these square roots is also a quadratic residue mod p; this is called the principal square root.

Computation of quadratic residues mod p: - easy if n is prime and n = 4k+3 - a probabilistic algorithm if n is prime and n = 4k+1 - if n = pq, where p,q are primes, the problem of computing square roots mod n is as hard as is the factorization of n

Feige-Fiat-Shamir identification scheme On July 9, 1986 the three authors submitted a U.S. patent application. Because of its potential military applications, the application was reviewed by the military. Occasionally the Patent Office responds not with a patent, but with something called a secrecy order. On January 6, 1987, three days before the end of their six-month period, the Patent Office imposed that order at the request of the Army. They stated that “...the disclosure or publication of the subject matter...would be detrimental to the national security....” The authors were ordered to notify all Americans to whom the research had been disclosed that unauthorized disclosure could lead to two years’ imprisonment, a $10,000 fine, or both. Furthermore, the authors had to inform the Commissioner of Patents and Trademarks of all foreign citizens to whom the information had been disclosed.

Feige-Fiat-Shamir identification scheme n = pq, where p,q are primes such that p,q=3 mod 4. v - quadratic residue mod n, i.e. z2 = v mod n and v–1 mod n exists s = sqrt(v–1) mod n v - public; s - private Identification protocol: 1) (Peggy): chooses random r<n, sends Victor x=r2 mod n 2) (Victor): sends random b{0,1} 3) (Peggy): if b=0 sends r; if b=1 sends y=r s mod n 4) (Victor): if b=0, verifies x=r2 mod n (Peggy knows r) if b=1, verifies x = y2v mod n (Peggy knows s) Without s Peggy can pick r such that either x=r2 mod n or x = y2v mod n, but not both. Repeat k times for probability 1–2k

Feige-Fiat-Shamir identification scheme n = pq, where p,q are primes such that p,q=3 mod 4. v - quadratic residue mod n, i.e. z2 = v mod n and v–1 mod n exists s = sqrt(v–1) mod n v - public; s - private Identification protocol: 1) (Peggy): chooses random r<n, sends Victor x=r2 mod n 2) (Victor): sends random b{0,1} 3) (Peggy): if b=0 sends r; if b=1 sends y=r s mod n 4) (Victor): if b=0, verifies x=r2 mod n (Peggy knows r) if b=1, verifies x = y2v mod n (Peggy knows s) Replacing Victor by one-way hash function we obtain digital signature scheme!

Elliptic curve cryptosystems Darrell Hankerson Alfred Menezes Scott Vanstone Guide to Elliptic Curve Cryptography Springer, 2004 edition

Elliptic curve cryptosystems Henri Cohen Gerhard Frey Handbook of Elliptic and Hyperelliptic Curve Cryptography Chapman & Hall / CRC 2005 (1st edition)

Elliptic curve cryptosystems

Elliptic curve cryptosystems

Elliptic curve cryptosystems The points on curve forms an additive group with  as identity element.

Elliptic curve cryptosystems

Elliptic curve cryptosystems

Elliptic curve cryptosystems

Elliptic curve cryptosystems

Elliptic curve cryptosystems Thus, we have algorithms for computing points P+Q and kQ (although efficiency for kQ is still and issue).

Elliptic curve cryptosystems To translate algorithms to ECC we need also mappings from Zp to points on curve C (technically somewhat complicated, but good mappings exist).

Elliptic curve cryptosystems ElGamal encryption schemes: Classical Keys: p, g, x (secret), y = gx mod p Encryption: k random < p, a = gk mod p, b = m yk mod p, Decryption: m = bax mod p Elliptic curve Keys: curve C over Fq, point G on C, n = order(G), integer x[1,n1] (secret), Y = xG Encryption: k random from [1,n1], M=F(M) – mapping of message m to point on C, A=kG, B=kY+M Decryption: M=BxA

Elliptic curve cryptosystems ElGamal signature schemes: Classical Keys: p, g, x (secret), y = gx mod p Signing: k random, a = gk mod p, m = (xa+kb)mod(p1) Verification: yaab mod p = gm mod p Elliptic curve Keys: curve C over Fq, point G on C, n = order(G), integer x [1,n1] (secret), Y = xG Signing: k random from [1,n1], A = (a1,a2) = kG (if a1 mod n = 0 chose new k), b = k1(m+xa1) mod n (if s = 0 chose new k) Verification: bA = mG+a1Y

Elliptic curve cryptosystems RSA encryption schemes: Classical Keys: n=pq, e, d: de  1 mod ((p–1)(q–1)) (secret) Encryption: c = me mod n Decryption: m = cd mod n Elliptic curve Keys: n=pq with p,q = 2 mod 3, e, d: de  1 mod ((p+1)(q+1)) (secret) Encryption: represent m as a pair (m1,m2) and regard it as a point M on curve y3=x3+b mod n, where b = m22–m13 mod n, C = eM Decryption: M = dC

Elliptic curve cryptosystems

Elliptic curve cryptosystems

Elliptic curve cryptosystems

Elliptic curve cryptosystems