Lecture 8 Digital Signatures

This lecture considers techniques designed to provide the digital counterpart to a handwritten signature. A digital signature of a message is a number dependent on some secret known only to the signer, and, additionally, on the content of the message being signed. Signatures must be verifiable: if a dispute arises as to whether a party signed a document (caused by either a lying signer trying to repudiate a signature it did create, or a fraudulent claimant), an unbiased third party should be able to resolve the matter equitably, without requiring access to the signer ’ s secret information (private key).

Digital signatures have many applications in information security, including authentication, data integrity, and non-repudiation. One of the most significant applications of digital signatures is the certification of public keys in large networks. Certification is a means for a trusted third party (TTP) to bind the identity of a user to a public key, so that at some later time, other entities can authenticate a public key without assistance from a trusted third party.

The concept and utility of a digital signature was recognized several years before any practical realization was available. The first method discovered was the RSA signature scheme, which remains today one of the most practical and versatile techniques available. Subsequent research has resulted in many alternative digital signature techniques. Some offer significant advantages in terms of functionality and implementation.

Outline  The RSA Signature Scheme  The ElGamal Family Signature Schemes  Birthday Attacks

1 The RSA Signature Scheme 1.1 Description

1.1 Description (Continued)

1.2 Example

1.3 Possible Attacks on RSA Signatures Integer Factorization

1.3.2 Multiplicative Property of RSA

1.3.2 Multiplicative Property of RSA (Continued)

1.4 Implementation of RSA Signatures Reblocking Problem

1.4.1 Reblocking Problem (Continued)

1.4.2 Short vs. Long Messages The signature is at least as long as the message. This is a disadvantage when the message is long. To remedy the situation, a hash function is used. The signature scheme is the applied to the hash of the message, rather than to the message itself. The redundancy function R is no longer critical to the security of the signature scheme.

1.4.2 Short vs. Long Messages (Continued)

1.4.3 Performance Characteristics of Signature Generation and Verification

1.4.4 Parameter Selection A modulus of at least 1024 bits is recommended for signatures which require much longer lifetimes or which are critical to the overall security of a large network. It is prudent to remain aware of progress in integer factorization, and to be prepared to adjust parameters accordingly. No weaknesses in the RSA signature scheme have been reported when the public exponent e is chosen to be a small number such as 3 or It is not recommended to restrict the size of the private exponent d in order to improve the efficiency of signature generation.

1.4.5 System-Wide Parameters Each entity must have a distinct RSA modulus; it is insecure to use a system-wide modulus. The public exponent e can be a system-wide parameter, and is in many applications.

2 The ElGamal Family Signature Schemes Most of signature schemes are presented over (mod p) for some large prime p, but all of these mechanisms can be generalized to any finite cyclic group. All of the methods discussed in this part are randomized digital signature schemes. A necessary condition for the security of all of the signature schemes is that computing logarithms in (mod p) should be computationally infeasible. This condition, however, is not necessarily sufficient for the security of these schemes.

2.1 The Digital Signature Algorithm In August of 1991, the U.S. National Institute of Standards and Technology (NIST) proposed a digital signature algorithm (DSA). The DSA has become a U.S. Federal Information Processing Standard (FIPS 186) called the Digital Signature Standard (DSS), and is the first digital signature scheme recognized by any government. The algorithm is a variant of the ElGamal scheme.

2.1.1 Description

2.1.1 Description (Continued)

2.1.2 Security and Implementations of DSA

2.1.2 Security and Implementations of DSA (Continued)

2.2 The ElGamal Signature Scheme Description

2.2.1 Description (Continued)

2.2.2 Example

2.2.3 Security of ElGamal Signatures

2.2.3 Security of ElGamal Signatures (Continued)

2.2.4 Performance Issues of ElGamal Signatures

2.2.4 Performance issues of ElGamal Signatures (Continued)

2.2.5 Variations of the ElGamal Scheme

2.3 The Schnorr Signature Scheme Description

2.3.1 Description (Continued)

2.3.2 Example

2.3.3 Performance Issues

2.4 Message Recovery Vs Appendix

3 Birthday Attacks 3.1 Birthday Problems

3.1 Birthday Problems (Continued)

3.2 Birthday Attacks on Signature Schemes

3.3 Birthday Attacks on Discrete Logarithms

3.4 Meet-in-the-Middle Attacks on Double Encryption

3.4 Meet-in-the-Middle Attacks on Double Encryption (Continued)

Thank You!