Authenticating streamed data in the presence of random packet loss March 17th, Philippe Golle, Stanford University.

Signing streams Stream: sequence of packets Signature: authenticity, non-repudiation E.g: Internet radio station Efficiency Cost of computation (real-time) Communication overhead Robustness Packet loss (UDP)

Outline 1. Existing solutions and their limitations Efficient signatures Amortized signatures 2. Our proposal Construction Optimality applications

Sign each Sign each packet (RSA, DSA,…) “Optimal” solution: Immediate authentication Packets individually verifiable Unpractical: Computational load too high. Maximum: 100 signatures / second 1 digital signature = 100 hashes 1234 AliceBob

Optimization Numerous tricks Small exponent (faster verification) Chinese Remainder Theorem (divide and conquer multiplications) Precomputations (time/memory trade-off) Gain: factor of 2. Incremental verification Variable level of security Signature very large

Hash 12 Hash(2) Digital signature Collision-resistant hash function h: Given h(x), hard to find y such that h(x)=h(y) Example: MD5, SHA-1 Verify the signature on Packet 1. This also authenticates Packet 2.

Hash chain (Gennaro, Rohatgi) Sender processes the stream backwards Append the hash of P i+1 to P i Sign only the first packet Extremely efficient: 1 hash computation / packet Overhead: 20 bytes / packet Problems: Offline case only Packet loss 1234 AliceBob h(2) h(3)h(4) …

One-time Signatures: generation One-time signature scheme: Choose a one-way function f: D->D and 168 elements {a i } of D. Private signing key: family {a i } Public verification key: family {f(a i )} To sign a message M: Hash: h(M) = b 1 b 2 b 3 …………b 160 (in binary) Append to h(M) the number of 0 in h(M): b 1 b 2 b 3 …………b 160 b 161 b 162 …………b 168 Signature: s 0 s 1 s 2 …………s 168 where: S i = a i if b i = 0, otherwise S i = f(a i )

OTS: verification To verify a signature s 0 s 1 s 2 …………s 168 on M: Hash M Append to h(M) the number of 0 in h(M): b 1 b 2 b 3 …………b 160 b 161 b 162 …………b 168 Verify that f(S i )= f(a i ) if b i = 0, otherwise S i = f(a i ) OTS are secure: Can’t flip a 1 to a 0 Can’t flip a 0 to a 1

OTS: efficiency Fast compared to digital signatures : Verify: as fast as RSA with small exponent Sign: twice as fast as DSA Can be used only once Very large: 1000 bytes

OTS chain (Gennaro, Rohatgi) Packet P i contains the public-key to sign P i+1 Faster than “sign each” for online streams Limitations: Overhead: 1000 bytes / packet Issue of packet loss 1234 AliceBob K(2) K(3)K(4)

OTS: optimization Size of OTS proportional to the number of bits of the quantity being signed. MD5: 128 bits, SHA-1: 160 bits Use shorter output? Family of hash functions: 2^40 80-bit hash functions Cost of birthday attack: 2^80 Total output length: 120 bits

Packet groups (Wong & Lam) Sender: Packet 3 is sent as: Receiver: same in reverse h(1) Sign hash

Packet groups: efficiency Trade-off: Efficiency: many packets / group Communication overhead: few packets / group

Packet groups: Tree Sender: Packet 3 is sent as: Receiver: same in reverse Sign 3 78

Motivations Communication overhead: USER_DATA section (MPEG video and audio) Watermarking Open parallel connection Existing solutions Resistant to worst-case packet loss Space / time trade-off We propose: Resistant to average loss New trade-off: efficiency and authentication speed

Model Random loss Bursts (UDP) Maximize length of single worst-case burst Sender Packet buffer (size p) Hash buffer (size h) Receiver Packet buffer Hash buffer Overhead: m: maximum number of hashes / packet

Simple case: no packet buffering Chain of strength a: the hash of packet P i is appended to two other packets: P i+1 and P i+a Only the last packet is signed. Algorithm for generation and verification of the sequence Example: chain of strength 3

Characteristics of a chain Sender: Buffers 1 packet Stores a hashes Receiver Buffer OK: 1 hash Buffer loss: 2 hashes Resistance to loss B = a-1 (optimal) Avg(B) = a-1

Generic Construction (p>1) p=2: one new packet: Example: augmented chain of strength 3

Generalization Sender buffers: p packets h hashes Start with a chain of strength (h-p) Insert (p-1) new packets in-between with the extremity property

Insertion 1 Very simple to implement Optimally resistant to loss But: m grows linearly with p

Insertion 2 Constant m Recursive embedding AB21 AB21

Characteristics Sender Buffers p packets Hash buffer of size h = a+p Receiver Buffer OK: (p+3)/2 Buffer loss: 2 + (p+3)/2 Resistance to loss: B=p(a-1) (optimal) fast recovery B = p (h-p)

Comparison with other schemes SchemeSignaturehashOverhead (bytes) lossverification WL star anyimmediate WL tree anyimmediate LW tree full anyimmediate Chains 11643burstsdelayed

Alternate models Hash buffer of average capacity Average burst Recall B = p (h-p) Average hash: B = p(h-p/2) Average burst: B = p.h

Offline stream authentication Offline stream entirely known to sender signed only once Solution: hash chain Resistance to loss use augmented chains efficiency concern: receiver

Insertion 3 Focus: reduce Buffer OK Buffer Loss = Buffer OK + constant Consider forward edges are never taken.

Conclusion Efficient and flexible authentication scheme. Strength: resistance to random loss (bursts) Implemented as plug-in to Real Audio Player