DIGITAL SIGNATURES and AUTHENTICATION PROTOCOLS - Chapter 13

1. DIGITAL SIGNATURES and AUTHENTICATION PROTOCOLS - Chapter 13 • Digital Signatures • Authentication Protocols • Digital Signature Standard

2. Authentication auth A  B protects against{C} Signature sign A  B protects against{A,C} AUTHENTICATION vs SIGNATURE

3. Author Verifiable Date Authenticate by Time Contents Third Party SIGNATURE CHARACTERISTICS

4. Direct • X  Y • weakness: security of private key • Arbitrated • + date • X  A  Y SIGNATURE TYPES

5. ARBITRATED DIGITALSIGNATURE TECHNIQUES

6. Conventional Encryption: After X  A  Y Dispute between X and Y Y  A: EKay[IDx||M||EKax[IDx||H(M)]] Table 13.1: Scheme (a) Arbiter Sees Message

7. Conventional Encryption: Arbiter : neither can read message Eavesdropper Table 13.1: Scheme (b)Arbiter Does Not See Message

8. Public-Key (double) Encryption: advantages: 1. No information shared before communication 2. if KRx compromised date is still correct 3. message secret from Arbiter and Eavesdropper Table 13.1: Scheme (c)Arbiter Does Not See Message

9. Simple Replay: X m E m Logged Replay: X m||T0 t E m||T0(< T0 later) i m Undetected Replay:X m e E m  Backward Replay: X m X m E REPLAY ATTACKS

10. m||T X Y synchronized clocks TIMESTAMP

11. Use NONCE: N X Y m||N X Y handshake required CHALLENGE/RESPONSE

12. ATTACK ON Fig 7.9 • E avesdropper gets Old Ks: • Replay Step 3 • Intercept Step 4 • Impersonate Step 5 • Bogus Messages  Y

13. SOLUTION: TIMESTAMP • A IDA||IDB KDC • 2. KDC EKA[ KS||IDB||T||EKB[KS||IDA||T] ] A • 3. A EKB[KS||IDA||T] B • 4. B EKS[N1] A • 5. A EKS[f(N1)] B

14. To counteract: Suppress – Replay attacks: 1. Check clocks regularly use KDC clock 2. Handshaking via Nonce CLOCK ATTACKS

15. To counteract suppress-replay attacks: • A IDA|| NA B • B IDB||NB||EKB[IDA||NA||TB] KDC • KDC • EKA[IDB||NA||KS||TB]||EKB[IDA||KS||TB]||NB • A • A EKB[IDA||KS||TB]||EKS[NB]B • No clock synch. • TB only checked by B AN IMPROVED PROTOCOL over Fig 7.9

16. - no secret key distribution (public key) • A IDA||IDB AS • AS EKRAS[IDA||KUA||T]||EKRAS[IDB||KUB||T]A • 3. A EKRAS[IDA||KUA||T]||EKRAS[IDB||KUB||T]||EKUB[EKRA[KS||T]] • B • Problem: Clock Synch. AUTHENTICATION SERVER

17. 1. A IDA||IDB KDC 2. KDC EKRauth[IDB||KUB] A 3. A EKUB[NA||IDA] B 4. B IDB||IDA||EKUauth[NA] KDC 5. KDC EKRauth[IDA||KUA]||EKUB[EKRauth[NA||KS||IDA||IDB]] B 6. B EKUA[EKRauth[NA||KS||IDA||IDB]||NB] A 7. A EKS[NB] B ALTERNATIVE NONCE PROTOCOL

18. (e.g. email) • Encrypt Message • Authenticate Sender ONE-WAY AUTHENTICATION

19. A IDA||IDB||N1 KDC • KDC EKA[KS||IDB||N1||EKB[KS||IDA]]A • 3. A EKB[KS,IDA]||EKS[M]B SYMMETRIC-KEY (one-way auth.)

20. Use Figs 11.1b,c, and d or A EKUB[KS]||EKS[M] B or A M||EKRA[H(M)] B PUBLIC-KEY (one-way auth.)

21. Send A’s public key to B A M||EKRA[H(M)]||EKRAS[T||IDA||KUA] B PUBLIC-KEY (one-way auth.)

22. SignatureYES Encryption NO Key-Exchange NO DSS : USES SHA-1

23. DSS : USES SHA-1

24. p,q,g – global public keys x - user private key y - user public key k - user per-message secret number r = (gk mod p) mod q s = [k-1(H(M) + xr)] mod q Signature = (r,s) precomputegk,k-1 DISCRETE LOG

25. w = (s’)-1 mod q u1 = [H(M’)w] mod q u2= (r’)w mod q v = [(gu1.yu2) mod p] mod q wherey=gxmod p v =r’ ? y =gxis one-way: x yYES y  x NO VERIFY

26. DIGITAL SIGNATURE ALGORITHM

27. DSS SIGNING AND VERIFYING