Digital Signature

Digital Signature • Requirement • Security • Classification • RSA Signature • ElGamal Signature • DSS • Other Signature Schemes • Applied Digital Signatures

Signature Scheme

Requirements of Digital Signature • Efficiency • Unforgeability : only signer can generate • Not reusable : not to use for other message • Unalterable : No modification of signed message • Authentication of a signer • Non-repudiation : not denying the act of signing

Security of Digital Signature(I) • Key only or no message attack : Adv access only to public parameters and public keys • Message attack : Adv has access to pairs of message texts and corresponding signatures. Depending on Ad’s power of selecting messages signed by S. • Known-messages : Adv doesn’t choose message signed by Si. • Generic chosen-messages : Adv chooses a set of messages to be signed before knowing the actual Si targeted for attack. • Directed chosen-message : Adv chooses a set of messages to be signed after selecting a specific Si but the actual attack. • Adaptive chosen-message : Adv chooses message for signing dynamically after inspecting signatures he obtained for previous messages. • Adv: Adversary, S: legitimate signer Weak Strong

Security of Digital Signature(II) • Total break : Adv recovers the secret key of S under attack. • Universal forgery : Adv doesn’t obtain the secret key of S, but gains the ability to generate valid signatures for any message. • Selective forgery : Adv doesn’t obtain the secret key of S, but gains the ability to generate valid signatures for any set of preselected messages. • Existential forgery : Adv can create at least one new message and signature pair without knowing the secret key. The messages are only arbitrary bit strings and Adv doesn’t have any power over their composition. Hard Easy

Construction of Digital Signature • Consists of 6 elements (M,Mh,A,K,S,V) • M : message space • Mh (or Ms) : signing space • A : signature space • K : key space • For K K,  signing alg. sigKS and its corresponding verification alg. verK V. • Each sigK : MA and verK : M x A  {t,f} are fts s.t., verK(x,y)= t if y = sigK(x) or verK(x,y)=f if y sigK(x)

Digital signature with appendix(I) • Signature generation (a) get private key, Ks (b) m’=h(m) : hash algorithm and s*=sigKs(m’) (c) m, s* : signature • Signature verification (a) obtain public key, Kp (b) compute m’=h(m) and u=verKp(m’,s*) (c) accept signature iff u=true. (Ex.) DSA, ElGamal, Schnorr

Digitalsignaturewithappendix(II) (a) signing M Mh A h sigK m m’ s*=sigK(m’) (b) verification verK(m,s*) true M x A false

Digital signature with msg recovery(I) • Signature generation (a) get private key, Ks (b) m’=R(m) : redundancy function and s*=sigKs(m’) (c) s* : signature • Signature verification (a) obtain public key KP (b) compute m’= verKp(s*) (c) verify that m’ MR ( if m’  MR, then reject) (d) recover m from m’ by computing R-1(m’) (Ex.) RSA, Rabin, Nyberg-Rueppel * R() and R-1() are easy to compute.

Digital signature with msg recovery(II) (a) signing M MR A R sigK m m’ s*=sigK(m’) MS R: redundancy ft e.g., 1:1 ft MR : image of R (b) verification *This scheme can be easily changed to digital signature with appendix s.t., hashing before signing.

Comparison Item Handwritten Digital Result of Signature Fixed Variable Digital Copy Difficult Easy Operation Simple Mathematical Legality Yes Yes Forgeability Possible Impossible Tool Pen Computer Auxiliary ToolNot Necessary Necessary(Hash ft)

Computationally secure Basic Provably secure Unconditionally secure Probably secure ID-based Non-arbitrator Certificate-based Randomized Message-recovery Deterministic Message-appendix Randomized Arbitrator Deterministic Classification (I)

Undeniable Fail-stop Applied Blind One-time, bounded-life Multi (n,k) Multi Multi undeniable Oblivious Proxy Proxy undeniable Classification (II)

RSASignature • (preparation) n=pq, M=A=n • K ={(n,p,q,a,b) : n=pq, ab=1 mod (n)} • public key : {b,n}, private key : {a,p,q} • (signing) K=(n,p,q,a,b),sigK(x)=xa mod n • (verification)verK(x,y)=true  x=yb mod n, x,y n • (Problem) If an adversary know signature of x1 and x2 to be s1 and s2, he can create signature of x3=x1x2, i.e., s3{=s1s2=x1d x2d= (x1x2)d} without knowing secret key, d. To prevent this, hash(x) or other means must be used. • Note that D(m1)D(m2)=D(m1m2) in RSA

ElGamal Signature(I) • p : prime,   p*: primitive element, • M =p*, A = p* x p-1* • K ={(p,,a,) :  = a mod p} • public: (p,,), private: a • (signing) K=(p,,a,), secret random k p-1* sigK(m,k) = (,) where  = k mod p, =(m-a)k-1 mod (p-1) • (verification) m,   p* and   p-1* verK(m,, )=true =m mod p * =ak =m mod p

ElGamal Signature(II) • (Preparation) p=467, =2, a=127 =a mod p = 2127mod467=132 message m=100 random k=213 s.t., gcd(213,466)=1. 213-1mod466 =431 • signing = k = 2213 mod 467= 29 =(m-a)k-1 mod (p-1)=(100 - 127 x 29) 431 mod 466=51 • Verification on m,  and  =m mod p ?  =13229 2951=189 mod 467 m =2100 =189 mod 467

ElGamal Signature(III) • Security : without knowing a, forgery of x’s signature is reducible to DLP of finding  () chosen  (). • Note • Keep k to be secret • Not to use k two times. • Generalization from p* to any finite Abelian group is possible

DSS (I) • After 1991 August for 3-year public debate, NIST announced DSS (Digital Signature Standard) documented FIPS186 in 1994 December. • RSA was not selected since its patent • Introduce efficient operation under subgroup in ElGamal signature scheme • Used with DHA (Digital Hash Algorithm)

DSS(II) • p:512 bit prime, q:160 bit prime, q|p-1, gp* • =g(p-1)/qmod p (q-th root of 1 mod p), • M =p*, A= q x q, K={(p,q,,a,):=a mod p} • public: (p,q,,), private: a. • (signing) K=(p,q,,a,), secret randomk (1k  q-1,gcd(k,q)=1),sigK(m,k) = (,) where  = (k mod p) mod q, =(m+a)k-1mod q. • (verification) m  p* and ,   q verK(m,, )=true  (e1e2 mod p)mod q = . e1= m-1 mod q, e2= -1 mod q.

DSS(III) (Ex.) q=101, p=78q+1=7879, g=3, = 378 mod 7879 =170, a=75,  =amod 7879= 4567. (signing) message m=1234, random k=50, k-1 mod 101=99. = (k mod p) mod q=(17050mod 7879) mod101=2518 mod101=94. =(m+a)k-1mod q=(1234 +75x94) 99 mod101 = 97. (verification) sigK(m,k) = (,) =(94,97), m=1234 -1=97-1 mod 101=25, e1= m-1 mod q =1234 x 25 mod 101 =45, e2= -1 mod q = 94 x 25 mod 101 = 27 (e1e2 mod p)mod q= (17045 4567 27 mod 7879 ) mod 101 = 2518 mod 101=94 ?  =94 (valid)

Signature Scheme with additional properties

Applied Digital Signature • Blind signature • One-time signature • Lamport scheme • Bos-Chaum scheme • Undeniable signature • Chaum-van Antwerpen scheme • Fail-stop signature • van Heyst-Peterson scheme • Group Signature : group member can generate signature if dispute occurs, identify member.

Chaum’s Blind Signature(I) • Without B’s knowing message M itself, A can get a signature of M from B. • RSA scheme, B’s public key :{n,b},private key:{a} B A(customer) A B(Bank) (1)random number (1) select random k s.t. gcd(n,k)=1, 1<k<n-1 (2)blinding m* (3)signing (3) s*= (m*)a mod n (2) m*=mkb mod n (4)unblinding s* g(SBf(m))=SB(m) f:blinding ft g:unblinding ft only A knows f(m) : blinded message (4) s=k-1 s*mod n (signature of M by B : k-1(mkb)a= k-1 ma kba= ma)

Chaum’s Blind Signature(II) • (Preparation) p=11, q=3, n=33,(n)= 10 x 2=20 • gcd(a, (n))=1 => a=3, ab =1 mod (n) => 3 b = 1 mod 20 => b=7 • B: public key :{n,b}={33,7},private key ={a}={3} (1) A’s blinding of m=5 select k s.t. gcd(k,n)=1. gcd(k,33)=1 => k=2 m* = m kb mod n= 5 27 mod 33 = 640 mod 33 = 13 mod 33 (2) B’s signing without knowing the original m s*= (m*)a mod n = 133 mod 33 =2197 mod 33 =19 mod 33 (3) A’s unblinding s=k-1 s* mod n (2 k-1=1 mod 33 => k=17) = 17 19 mod 33 =323=26 mod 33 * Original Signature : ma mod n = 53 mod 33 =125 =26 mod 33

One-time Signature(I) • Properties(p.299) • A parameter is used to sign only one message • Signing and verifying procedure is very efficient • one-time signature based on Lamport Signature(p.300) • Key generation • k; positive int, f: Y Z one-way ft, • private key: y1,0, …, yk,1 , public key: zi,j=f(yi,j), 1 ≤ i ≤ k , j=0,1 • Signing for K=(yi,j, zi,j :, 1 ≤ i ≤ k , j=0,1) • sigK (x1, …, xk ) =(y1,x1, … yk, xk ). • Verify • Signature (a1, …, ak) on msg (x1, …,xk) is verified as : • verK((x1, …, xk), (a1, …, ak)) = true ↔ f(ai) = zi, x1 , 1 ≤ i ≤ k

One-time Signature(II) • Public parameters • one-way ft : f(x) = 3x mod 7879 • k=3, • Alice chooses 6 (secret) random numbers • Private key y1,0=5831, y1,1= 735, y2,0=803, y2,1=2467, y3,0=4285, y3,1=6449 • Public key : Alice computes 6 y’s under f Z1,0=2009, z1,1=3810, z2,0=4672, z2,1=4721, z3,0=268, z3,1=5731 • Signing on msg x=(1,1,0) (y1,1, y2,1, y3,0) = (735, 2467, 4285) • Verification 3735 mod 7879 = 3810, 3 2467 mod = 4721, 34285 mod = 268

Fail-Stop signature schemes • Properties(p.313) • If a signer signs a message according to the mechanism, a verifier upon checking the signature should accept it • A forger cannot construct signatures that pass the verification algorithm without doing an exponential amount of work • If a forger succeeds in constructing a signature which passes the verification test then the true signer can produce a proof of forgery with high probability • A signer cannot construct signatures which are claimed to be forgeries at some later time. • Advantages: Even if a very powerful adversary can forge a single signature, the forgery can be detected and the signing mechanism no longer used.

Digital Signature