1. Cryptography and Network Security Chapter 13 Fifth Edition by William Stallings

2. Chapter 13 – Digital Signatures To guard against the baneful influence exerted by strangers is therefore an elementary dictate of savage prudence. Hence before strangers are allowed to enter a district, or at least before they are permitted to mingle freely with the inhabitants, certain ceremonies are often performed by the natives of the country for the purpose of disarming the strangers of their magical powers, or of disinfecting, so to speak, the tainted atmosphere by which they are supposed to be surrounded. —The Golden Bough, Sir James George Frazer

3. Digital Signatures  have looked at message authentication but does not address issues of lack of trust but does not address issues of lack of trust  digital signatures provide the ability to: verify author, date & time of signature verify author, date & time of signature authenticate message contents authenticate message contents be verified by third parties to resolve disputes be verified by third parties to resolve disputes  hence digital signatures include authentication function with additional capabilities

4. Alice can deny sending a message M to Bob since Bob can also produce MACs for different messages. Bob can produce a MAC for another message M’ and can claim that it came from Alice.

5. PrivateKey PublicKey Bob Key Generation Alice Bob’s Fig 13.2 Simplified Depiction of Essential Elements of Digital Signature Process

6. Attacks and Forgeries  Goldwaser, Micali and Rivest in 1988 identified several attack scenarios on digital signature schemes Key-only attack: Key-only attack: Attacker knows only the public keyAttacker knows only the public key Known message attack: Known message attack: Attacker is given access to a set of messages and their signaturesAttacker is given access to a set of messages and their signatures Generic chosen message attack: Generic chosen message attack: Attacker chooses a list of messages before attempting to break the signature, independent of the particular public key. Then he obtains valid signatures for those messages.Attacker chooses a list of messages before attempting to break the signature, independent of the particular public key. Then he obtains valid signatures for those messages. Directed chosen message attack: Directed chosen message attack: Similar as generic, but the messages are chosen after knowing a particular public key.Similar as generic, but the messages are chosen after knowing a particular public key. Adaptive chosen message attack: Adaptive chosen message attack: Attacker and signer are playing interactive game, where attacker asks for signing different messages, and his queries depend on the knowledge he obtained from previous queries.Attacker and signer are playing interactive game, where attacker asks for signing different messages, and his queries depend on the knowledge he obtained from previous queries.

7. Attacks and Forgeries (cont)  Goldwaser, Micali and Rivest also defined success of breaking a signature scheme Total break: Total break: Attacker finds the signer’s private keyAttacker finds the signer’s private key Universal forgery: Universal forgery: Attacker finds an efficient signing algorithm that provides an equivalent way of constructing signatures on arbitrary messages.Attacker finds an efficient signing algorithm that provides an equivalent way of constructing signatures on arbitrary messages. Selective forgery: Selective forgery: Attacker forges a signature for a particular message chosen by him.Attacker forges a signature for a particular message chosen by him. Existential forgery: Existential forgery: Attacker can forge a signature for at least one message. However he does not have control over the message (so can not harm much the signer).Attacker can forge a signature for at least one message. However he does not have control over the message (so can not harm much the signer).

8. Digital Signature Requirements  must depend on the message signed  must use information unique to sender to prevent both forgery and denial to prevent both forgery and denial  must be relatively easy to produce  must be relatively easy to recognize & verify  be computationally infeasible to forge with new message for existing digital signature with new message for existing digital signature with fraudulent digital signature for given message with fraudulent digital signature for given message  be practical save digital signature in storage

9. Direct Digital Signatures  involve only sender & receiver  assumed receiver has sender’s public-key  digital signature made by sender signing entire message or hash with private-key  can encrypt using receivers public-key  important that sign first then encrypt message & signature  security depends on sender’s private-key

10. Arbitrated Digital Signatures  involves use of arbiter A validates any signed message validates any signed message then dated and sent to recipient then dated and sent to recipient  requires suitable level of trust in arbiter  can be implemented with either private or public-key algorithms  arbiter may or may not see message

12. Using Public-Key Encryption  have a range of approaches based on the use of public-key encryption  need to ensure have correct public keys for other parties  using a central Authentication Server (AS)  various protocols exist using timestamps or nonces

13. Public-Key Approaches  have seen some public-key approaches  if confidentiality is major concern, can use: A->B: E PUb [Ks] || E Ks [M] has encrypted session key, encrypted message has encrypted session key, encrypted message  if authentication needed use a digital signature with a digital certificate: A->B: M || E PRa [H(M)] || E PRas [T||ID A ||PU a ] with message, signature, certificate with message, signature, certificate

14. ElGamal Digital Signature Scheme  Key generation Prime number q, and generator α Prime number q, and generator α Generate a random integer X A such that 1<X A <q-1 Generate a random integer X A such that 1<X A <q-1 Compute Y A = α X A Compute Y A = α X A A’s private key is X A ; A’s public key is ( q, α, Y A ) A’s private key is X A ; A’s public key is ( q, α, Y A )

15. ElGamal Digital Signature Scheme (cont)  Signing a message M Produce a hash m=H(M) Produce a hash m=H(M) Chose a random integer K such that 1 ≤K ≤q-1 and gcd(K, q-1) = 1 Chose a random integer K such that 1 ≤K ≤q-1 and gcd(K, q-1) = 1 Compute S 1 = α K mod q Compute S 1 = α K mod q Compute K -1 mod (q-1) Compute K -1 mod (q-1) Compute S 2 = K -1 (m - X A S 1 ) mod (q-1) Compute S 2 = K -1 (m - X A S 1 ) mod (q-1) The signature is (S 1, S 2 ) The signature is (S 1, S 2 )

16. ElGamal Digital Signature Scheme (cont)  Verification of the signed message M (S 1, S 2 ) Produce a hash m=H(M) Produce a hash m=H(M) Compute V 1 = α m mod q Compute V 1 = α m mod q Compute V 2 = (Y A ) S 1 ( S 1 ) S 2 mod q Compute V 2 = (Y A ) S 1 ( S 1 ) S 2 mod q If V 1 == V 2 return TRUE, else return FALSE If V 1 == V 2 return TRUE, else return FALSE

17. Digital Signature Standard (DSS)  US Govt approved signature scheme  designed by NIST & NSA in early 90's  published as FIPS-186 in 1991  revised in 1993, 1996 & then 2000  uses the SHA hash algorithm  DSS is the standard, DSA is the algorithm  FIPS 186-2 (2000) includes alternative RSA & elliptic curve signature variants

18. Digital Signature Algorithm (DSA)  creates a 320 bit signature  with 512-2048 bit security  smaller and faster than RSA  a digital signature scheme only  security depends on difficulty of computing discrete logarithms  variant of ElGamal & Schnorr schemes

19. Digital Signature Algorithm (DSA)

20. DSA Key Generation  have shared global public key values (p,q,g): choose q, a 160 bit choose q, a 160 bit choose a large prime p < 2 L choose a large prime p < 2 L where L= 512 to 2048 bits and is a multiple of 64where L= 512 to 2048 bits and is a multiple of 64 and q is a prime factor of (p-1)and q is a prime factor of (p-1) choose g = h (p-1)/q choose g = h (p-1)/q where h 1where h 1  users choose private & compute public key: choose x<q choose x<q compute y = g x (mod p) – disseminate y compute y = g x (mod p) – disseminate y

21. DSA Signature Creation  to sign a message M the sender: generates a random signature key k, k<q generates a random signature key k, k<q nb. k must be random, be destroyed after use, and never be reused nb. k must be random, be destroyed after use, and never be reused  then computes signature pair: r = (g k (mod p))(mod q) s = (k -1.H(M)+ x.r)(mod q)  sends signature (r,s) with message M

22. DSA Signature Verification  having received M & signature (r,s)  to verify a signature, recipient computes: w = s -1 (mod q) u1= (H(M).w)(mod q) u2= (r.w)(mod q) v = (g u1.y u2 (mod p)) (mod q)  if v=r then signature is verified  see book web site for details of proof why

23. Practical attributes important for digital signature schemes (this is not in the textbook) a. Security level parameter of the signature scheme, b. key generation speed, c. signing and verification speed d. the speed of the used hash function e. size of the private key f. size of the public key, g. size of the produced signatures, h. the underlying mathematical problem on which the scheme is based i. The period of stability of the scheme since its last tweak or update, j. patent issues connected with the scheme, k. Part of any standard l. Certified software libraries and availability of open source libraries.

24. Practical attributes important for digital signature schemes (this is not in the textbook) a. Security level parameter of the signature scheme,

25. Practical attributes important for digital signature schemes (this is not in the textbook) b. key generation speed, In most use case scenarios we need the generated public/private keys to be valid for a certain period which is much longer than the period spent on key generation. From that point of view, the key generation speed, although an important attribute in the digital signatures metric, has not so big weight as a crucial operational attribute. On the other hand, the key exposure problem produces case scenarios where we need to generate just short lived public/private pairs. If the user plan to employ the public key cryptography in such cases, then the key generation speed should be given a higher weight. Different algorithms and techniques for faster generation of provable or probable prime numbers, and other parameters for the standardized digital signatures schemes.

26. Practical attributes important for digital signature schemes (this is not in the textbook) b. key generation speed,

27. Practical attributes important for digital signature schemes (this is not in the textbook) c. signing and verification speed The efficiency of digital signature schemes is mostly perceived via the signing and the verification speed. The efficiency of digital signature schemes is mostly perceived via the signing and the verification speed. Poor performances compared with symmetric encryption techniques. Poor performances compared with symmetric encryption techniques. Which signature scheme to use should be taken depending of what kind of signature processes will be performed in the system. Which signature scheme to use should be taken depending of what kind of signature processes will be performed in the system. If the process is such that the company server receives a lot of signed transactions from individual clients and have to verify every signature, RSA signatures with small public exponent should be chosen. If the process is such that the company server receives a lot of signed transactions from individual clients and have to verify every signature, RSA signatures with small public exponent should be chosen. If a company needs to send a bulk of signed invoices to hundreds of thousands (or millions) of users, then elliptical curve signature schemes should be chosen If a company needs to send a bulk of signed invoices to hundreds of thousands (or millions) of users, then elliptical curve signature schemes should be chosen

28. Practical attributes important for digital signature schemes (this is not in the textbook) c. signing and verification speed

29. Practical attributes important for digital signature schemes (this is not in the textbook) c. signing and verification speed

30. Practical attributes important for digital signature schemes (this is not in the textbook) c. signing and verification speed

31. Practical attributes important for digital signature schemes (this is not in the textbook) c. signing and verification speed

32. Practical attributes important for digital signature schemes (this is not in the textbook) d. The speed of the used hash function The message hashing (for long messages) can have similar or even much higher computational cost then the operations of signing and verification.

33. Practical attributes important for digital signature schemes (this is not in the textbook) d. The speed of the used hash function The message hashing (for long messages) can have similar or even much higher computational cost then the operations of signing and verification.

34. Practical attributes important for digital signature schemes (this is not in the textbook) d. The speed of the used hash function The message hashing (for long messages) can have similar or even much higher computational cost then the operations of signing and verification.

35. Practical attributes important for digital signature schemes (this is not in the textbook) e. Size of the private key  If the private key is too big, that scheme might be not so appropriate for implementing in smart cards or RFIDs since the hardware resources are scarce in those technologies.  Specifics of the signature scheme:  For example the size of the private key in RSA is of the same order as the size of the public key, but in all practical implementations (like in the popular OpenSSL) the size of the private key is actually 8 times bigger than the bit size of the public key (due to the use of the Chinese Remainder Theorem for speeding up the signature process).

36. Practical attributes important for digital signature schemes (this is not in the textbook) f. Size of the public key  Tradeoffs between security levels and the properties of the scheme  Example: if we need to design a digital signature scheme that has 256 bits of security, then choosing RSA would be totally unpractical since the public key would need 15360 bits, and the operational speed would be low.  In such a case, a natural choice would be a signature scheme based on elliptical curves with parameters long around 512 bits.

37. Practical attributes important for digital signature schemes (this is not in the textbook) g. Size of the produced signatures  Number of expected signed documents that the system will handle during the whole operational period (and much far beyond that - as a legal requirements for archiving the signed documents).  Have to take into consideration the size of the produced signatures.  For example, if we model a digital signature system that will be used by 100 million bank customers, during a period of 30 years, and if we assume that every customer during a period of 30 years will produce ~10,000 signed transactions then we have to plan for the storage of trillions signed documents.  In that case, any difference in the size of the signatures have big implications.

38. Practical attributes important for digital signature schemes (this is not in the textbook)

39. Summary  have discussed: digital signatures digital signatures authentication protocols (mutual & one-way) authentication protocols (mutual & one-way) digital signature algorithm and standard digital signature algorithm and standard