1. Announcements: 1. Presentations start Friday 2. Cem Kaner presenting O167 10 th block today. Questions? This week: DSA, Digital Cash DSA, Digital Cash DTTF/NB479: DszquphsbqizDay 33

2. Birthday attacks on signatures Mallory generates 2 groups of documents: Want a match (m 1, m 2 ) between them such that h(m 1 ) = h(m 2 ) Mallory sends (m 1, h(m 1 )) to Alice, who returns signed copy: (m 1, sig(h(m 1 )). Mallory replaces m 1 with m 2 and uses sig(h(m 1 ) as the signature. The pair (m 2, sig(h(m 1 )) looks like Alice’s valid signature! The pair (m 2, sig(h(m 1 )) looks like Alice’s valid signature! Alice’s defense? What can she do to defend herself? r “good docs” r “fraudulent docs”

3. Alice’s defense She changes a random bit herself! Note this changes her signature: (m 1 ’, sig(h(m 1 ’)) Mallory is forced to generate another message with the same hash as this new document. Mallory is forced to generate another message with the same hash as this new document. Good luck! Good luck!Lessons: Birthday attacks essentially halve the number of bits of security. Birthday attacks essentially halve the number of bits of security. So SHA-1 is still secure against them Make a minor change to the document you sign! Make a minor change to the document you sign!

4. DSA: Digital Signature Algorithm 1994 Similar to ElGamal Assume m is already hashed using SHA: so signing 160-bit message, m.

5. DSA: Digital Signature Algorithm Alice’s Setup: m: 160-bit message m: 160-bit message q: 160-bit prime q: 160-bit prime p: 512-bit prime, such that q is a factor of (p-1) p: 512-bit prime, such that q is a factor of (p-1) g: a primitive root of p. g: a primitive root of p.  =g (p-1)/q (mod p)  =g (p-1)/q (mod p) Then  q = 1 (mod p). (Why?)  =  a. Secret a, 0 < a < q-1  =  a. Secret a, 0 < a < q-1 Publishes: (p,q,  ) Publishes: (p,q,  ) Sig = (r,s) random k, 0 < k < q-1 random k, 0 < k < q-1 r =  k (mod p) r =  k (mod p) s = k -1 (m + ar) (mod q) s = k -1 (m + ar) (mod q)Verify: Compute u1 = s -1 m, u2 = s -1 r Compute u1 = s -1 m, u2 = s -1 r Does (  u1  u2 (mod p))(mod q) = r? Does (  u1  u2 (mod p))(mod q) = r? q=17 p=103 g=2  =?

6. DSA: Digital Signature Algorithm Alice’s Setup: m: 160-bit message m: 160-bit message q: 160-bit prime q: 160-bit prime p: 512-bit prime, such that q is a factor of (p-1) p: 512-bit prime, such that q is a factor of (p-1) g: a primitive root of p. g: a primitive root of p.  =g (p-1)/q (mod p)  =g (p-1)/q (mod p) Then  q = 1 (mod p). (Why?)  =  a. Secret a, 0 < a < q-1  =  a. Secret a, 0 < a < q-1 Publishes: (p,q,  ) Publishes: (p,q,  ) Sig = (r,s) random k, 0 < k < q-1 random k, 0 < k < q-1 r =  k (mod p) r =  k (mod p) s = k -1 (m + ar) (mod q) s = k -1 (m + ar) (mod q)Verify: Compute u1 = s -1 m, u2 = s -1 r Compute u1 = s -1 m, u2 = s -1 r Does (a u1 b u2 (mod p))(mod q) = r? Does (a u1 b u2 (mod p))(mod q) = r? Verify that verification works Advantages over ElGamal? In ElGamal, if you could solve r =  k (mod p) by Pollig-Hellman, you’d have k. In DSA, (p-1) has a large factor, q. If you could solve the non-q factors, there would still be q possibilities for k. How many ints (mod p) give a specific int (mod q)? How hard is it to search for a 512- bit prime p = kq + 1 for some even number k?

7. DSA: Digital Signature Algorithm Alice’s Setup: m: 160-bit message m: 160-bit message q: 160-bit prime q: 160-bit prime p: 512-bit prime, such that q is a factor of (p-1) p: 512-bit prime, such that q is a factor of (p-1) g: a primitive root of p. g: a primitive root of p.  =g (p-1)/q (mod p)  =g (p-1)/q (mod p) Then  q = 1 (mod p). (Why?)  =  a. Secret a, 0 < a < q-1  =  a. Secret a, 0 < a < q-1 Publishes: (p,q,  ) Publishes: (p,q,  ) Sig = (r,s) random k, 0 < k < q-1 random k, 0 < k < q-1 r =  k (mod p) r =  k (mod p) s = k -1 (m + ar) (mod q) s = k -1 (m + ar) (mod q)Verify: Compute u1 = s -1 m, u2 = s -1 r Compute u1 = s -1 m, u2 = s -1 r Does (  u1  u2 (mod p))(mod q) = r? Does (  u1  u2 (mod p))(mod q) = r? Verify that verification works

8. DSA: Digital Signature Algorithm Alice’s Setup: m: 160-bit message m: 160-bit message q: 160-bit prime q: 160-bit prime p: 512-bit prime, such that q is a factor of (p-1) p: 512-bit prime, such that q is a factor of (p-1) g: a primitive root of p. g: a primitive root of p.  =g (p-1)/q (mod p)  =g (p-1)/q (mod p) Then  q = 1 (mod p). (Why?)  =  a. Secret a, 0 < a < q-1  =  a. Secret a, 0 < a < q-1 Publishes: (p,q,  ) Publishes: (p,q,  ) Sig = (r,s) random k, 0 < k < q-1 random k, 0 < k < q-1 r =  k (mod p) r =  k (mod p) s = k -1 (m + ar) (mod q) s = k -1 (m + ar) (mod q)Verify: Compute u1 = s -1 m, u2 = s -1 r Compute u1 = s -1 m, u2 = s -1 r Does (a u1 b u2 (mod p))(mod q) = r? Does (a u1 b u2 (mod p))(mod q) = r? Advantages over ElGamal? In ElGamal, if you could solve r =  k (mod p) by Pollig-Hellman, you’d have k. In DSA, (p-1) has a large factor, q. If you could solve the non-q factors, there would still be q possibilities for k. How many ints (mod p) give a specific int (mod q)? q=17 p=103 g=2  =64

9. DSA: Digital Signature Algorithm Alice’s Setup: m: 160-bit message m: 160-bit message q: 160-bit prime q: 160-bit prime p: 512-bit prime, such that q is a factor of (p-1) p: 512-bit prime, such that q is a factor of (p-1) g: a primitive root of p. g: a primitive root of p.  =g (p-1)/q (mod p)  =g (p-1)/q (mod p) Then  q = 1 (mod p). (Why?)  =  a. Secret a, 0 < a < q-1  =  a. Secret a, 0 < a < q-1 Publishes: (p,q,  ) Publishes: (p,q,  ) Sig = (r,s) random k, 0 < k < q-1 random k, 0 < k < q-1 r =  k (mod p) r =  k (mod p) s = k -1 (m + ar) (mod q) s = k -1 (m + ar) (mod q)Verify: Compute u1 = s -1 m, u2 = s -1 r Compute u1 = s -1 m, u2 = s -1 r Does (a u1 b u2 (mod p))(mod q) = r? Does (a u1 b u2 (mod p))(mod q) = r? How hard is it to search for a 512-bit prime p = kq + 1 for some even number k? How do we search for primes? 1/115 of odd 100-digit numbers are prime. What fraction of odd 512-bit integers are prime? Recall our discussion of the density of primes

10. (Day 21) Using within a primality testing scheme Finding large probable primes #primes < x = #primes < x = Density of primes: ~1/ln(x) For 100-digit numbers, ~1/230. So ~1/115 of odd 100-digit numbers are prime Can start with a random large odd number and iterate, applying M-R to remove composites. We’ll soon find one that is a likely prime. Odd? div by other small primes? Prime by Factoring/ advanced techn.? n no yes prime Pass M-R?

11. DSA: Digital Signature Algorithm Alice’s Setup: m: 160-bit message m: 160-bit message q: 160-bit prime q: 160-bit prime p: 512-bit prime, such that q is a factor of (p-1) p: 512-bit prime, such that q is a factor of (p-1) g: a primitive root of p. g: a primitive root of p.  =g (p-1)/q (mod p)  =g (p-1)/q (mod p) Then  q = 1 (mod p). (Why?)  =  a. Secret a, 0 < a < q-1  =  a. Secret a, 0 < a < q-1 Publishes: (p,q,  ) Publishes: (p,q,  ) Sig = (r,s) random k, 0 < k < q-1 random k, 0 < k < q-1 r =  k (mod p) r =  k (mod p) s = k -1 (m + ar) (mod q) s = k -1 (m + ar) (mod q)Verify: Compute u1 = s -1 m, u2 = s -1 r Compute u1 = s -1 m, u2 = s -1 r Does (a u1 b u2 (mod p))(mod q) = r? Does (a u1 b u2 (mod p))(mod q) = r? Show that order of ops matters: Show for p=11, q=5,  =3, k=3, that (  k (mod p))(mod q) != (  k (mod q))(mod p)

12. Show me the money!

13. Digital cash (chapter 11) Want it to be electronic, like a credit card. But what’s so attractive about cash (vs. a credit card)?

14. Digital Cash: goals Electronic: want speed and security Can’t be counterfeited Can a central bank just track electronic notes? Can a central bank just track electronic notes? Then not anonymous! Then not anonymous! Neither could transactions be done offline Neither could transactions be done offline

15. Digital Cash: goals Electronic: want speed and security Can’t be counterfeited Anonymous: spender’s ID not disclosed to merchant Payment done offline Transferable Divisible (can make change) Okimoto and Ohta: Universal electronic cash, In Proc. Advances in Computing – CRYPTO, 1991