Applied Cryptography

1. Applied Cryptography Spring 2014 Digital signatures

2. Digital signature

3. Digital signature - Requirements • (assuming that Alice’s key have not be compromised) • only Alice should be able to sign the message on her name • any should be able to verify that the message is signed by • Alice • Undeniable digital signatures • sometimes it could be useful to additionally require that • signature could be verified only in cooperation with • Alice (however, when cooperating she shouldn’t be able • to deny her signature)

4. Digital signature – Practicalities • M – message,  – its digital signature • Depending from signature scheme it could be sufficient to send • just , or it might be necessary to send pair (,M) • h - a one-way hash function (easy to compute, but for a • given M it is hard to find M’ with h(M) = h(M’)) • Digital signature: • Send message M • Sign h(M) and send its digital signature together with M

5. Digital signature – Practicalities Signatures are often computed by small chips. Therefore it is preferable that signing of message could be performed faster than verification of signature.

6. Digital signature - RSA p,q - two large primes (100 digits or more) n = pq e - small odd integer that is relatively prime to (p– 1)(q– 1) d - integer such that de  1 (mod(p– 1)(q– 1)) (it can be shown that it always exists) P = (e,n) - public key S = (d,n) - secret key Signing: S = Md(mod n) Verifying: V(S) = Se(mod n)

7. RSA – probabilistic signature scheme (PPS) H – hashes {0,1}*{0,1}k G – hashes {0,1}k{0,1}nk1 (G1 and G2 are two parts of this value) Can be shown to be as secure as RSA

8. Digital signature - ElGamal Taher ElGamal, 1984

9. Digital signature - ElGamal

10. Digital signature - ElGamal

11. Digital signature - ElGamal

12. Digital signature - ElGamal

13. ElGamal signatures – a closer look • Warnings: • Never reuse k – this will instantly allow to recover secret key • x. • It is not difficult to generate “bad” values of g – either the • implementation should be completely trusted, or use a • a one way hash function to generate pseudorandom g, whose • randomness can then be verified. • When verifying signature, check that a < p

14. ElGamal - subliminal channel ElGamal: p,g,y=gx mod p - public; x - private h - "signed" message, m - "secret" message gcd(m,p–1) should be 1 Alice: a=gm mod p and finds b: h=xa+mb mod(p–1) Signature: a,b

15. ElGamal - subliminal channel Alice: a=gm mod p and finds b: h=xa+mb mod(p–1) Signature: a,b Bob: Verification: yaab=gh mod p ? Extraction: m=(b–1(h–xa)) mod(p–1) Implementations of digital signatures should be trusted - this can be used to "broadcast" secret keys!

16. Digital signature - Schnorr Claus Peter Schnorr, 1989 p - prime q - prime factor of p–1 [can be “small” – e.g. 160 bits] a - aq=1 mod p (and a≠1) [try several a = x(p-1)/q mod p] All these are public s < q - a random number and secret key v = a–s mod p - public key Signing: Pick random k<q and compute x = ak mod p Compute e = H(M,x) and y = (k+se) mod q Signature - pair (e,y) Verification: Compute x’ = ayve mod p and check that e = H(M,x’)

17. Digital signature - DSA Proposed by the National Institute of Standards and Technology (NIST) in 1991 for use in their Digital Signature Standard (DSS) adopted in 1993. Expanded further in 2000. Design criteria secret but was given for assessment to public. Could be considered as variation of ElGamal scheme. Intended to be free for use for everybody. Received strong criticism from RSA Data Security:) and companies that have invested in RSA

18. Digital signature - DSA • Points of criticism: • Can’t be used for encryption and key distribution • Developed by NSA and may contain a trapdoor • DSA is slower than RSA • RSA is de facto standard • Selection process was not public, sufficient time for analysis • was not provided. • DSA may infringe on other patents. • The key size is too small.

19. Digital signature - DSA

20. Digital signature - DSA

21. Digital signature - DSA

22. Digital signature - DSA

23. Digital signature - DSA

24. Digital signature - DSA

25. Discrete logarithm signature schemes

26. Discrete logarithm signature schemes

27. Undeniable digital signatures • Signature should be such that: • Bob should be able to verify signature in cooperation with • Alice • Alice should be unable to deny the signature • Signature can't be verified from message and signature pair • alone

28. Undeniable digital signatures p,g,y=gx mod p - public; x - private Signing (Alice): s=mx mod p Verification (Bob and Alice): 1) (Bob): chooses random a,b<p, sends Alice c=sayb mod p 2) (Alice): computes t=x–1 mod (p–1), sends Bob d=ct mod p 3) (Bob): confirms that d=magb mod p

29. Undeniable digital signatures p,g,y=gx mod p - public; x - private; signature s=mx mod p Verification (Bob and Alice): 1) (Bob): chooses random a,b<p, sends Alice c=sayb mod p 2) (Alice): computes t=x–1 mod (p–1), sends Bob d=ct mod p 3) (Bob): confirms that d=magb mod p Fake transcript: 1) generate fake pair m,s 2) choose random a,b<p, and compute d=magb mod p and sayb mod p

30. Undeniable digital signatures (a second look)

31. Undeniable digital signatures (a second look)

32. Undeniable digital signatures (a second look)

33. Undeniable digital signatures (a second look)

34. Identification schemes Victor wants to communicate with Peggy and be sure that she is the right person. How to achieve this? Peggy and Victor both know a secret key k. Victor sends a random message r and Peggy returns Ek(r). Peggy has a public key d and a secret key s. Victor sends a random message r and Peggy returns Es(r). However, it is not a particularly good idea to sign random numbers :)

35. Identification schemes However, it is not a particularly good idea to sign random numbers :) Assume RSA is used. d - public, s - secret. Eve wants to get Alice sign m. 1) find m1 and m2 such that m = m1m2 mod n 2) get Alice to sign "random" m1 and m2 3) calculate md mod n = (m1d mod n)(m2d mod n)

36. Quadratic Residues If p is prime, and a is greater than 0 and less than p, then a is a quadratic residuemod p if x2 = a (mod p) for some x For example, if p =7, the quadratic residues are 1, 2, and 4. 1*1=1=1(mod7) 2*2=4=4(mod7) 3*3=9=2(mod7) 4*4=16=2(mod7) 5*5=25=4(mod7) 6*6=36=1(mod7)

37. Quadratic Residues When p is odd, there are exactly (p - 1)/2 quadratic residues mod p If a is a quadratic residue mod p, then a has exactly two square roots, one of them between 0 and (p - 1)/2, and the other between (p - 1)/2 and (p - 1). One of these square roots is also a quadratic residue mod p; this is called the principal square root.

38. Quadratic Residues Computation of quadratic residues mod p: - easy if n is prime and n = 4k+3 - a probabilistic algorithm if n is prime and n = 4k+1 - if n = pq, where p,q are primes, the problem of computing square roots mod n is as hard as is the factorization of n

39. Feige-Fiat-Shamir identification scheme On July 9, 1986 the three authors submitted a U.S. patent application. Because of its potential military applications, the application was reviewed by the military. Occasionally the Patent Office responds not with a patent, but with something called a secrecy order. On January 6, 1987, three days before the end of their six-month period, the Patent Office imposed that order at the request of the Army. They stated that “...the disclosure or publication of the subject matter...would be detrimental to the national security....” The authors were ordered to notify all Americans to whom the research had been disclosed that unauthorized disclosure could lead to two years’ imprisonment, a $10,000 fine, or both. Furthermore, the authors had to inform the Commissioner of Patents and Trademarks of all foreign citizens to whom the information had been disclosed.

40. Feige-Fiat-Shamir identification scheme n = pq, where p,q are primes such that p,q=3 mod 4. v - quadratic residue mod n, i.e. z2 = v mod n and v–1 mod n exists s = sqrt(v–1) mod n v - public; s - private Identification protocol: 1) (Peggy): chooses random r<n, sends Victor x=r2 mod n 2) (Victor): sends random b{0,1} 3) (Peggy): if b=0 sends r; if b=1 sends y=r s mod n 4) (Victor): if b=0, verifies x=r2 mod n (Peggy knows r) if b=1, verifies x = y2v mod n (Peggy knows s) Without s Peggy can pick r such that either x=r2 mod n or x = y2v mod n, but not both. Repeat k times for probability 1–2k

41. Feige-Fiat-Shamir identification scheme n = pq, where p,q are primes such that p,q=3 mod 4. v - quadratic residue mod n, i.e. z2 = v mod n and v–1 mod n exists s = sqrt(v–1) mod n v - public; s - private Identification protocol: 1) (Peggy): chooses random r<n, sends Victor x=r2 mod n 2) (Victor): sends random b{0,1} 3) (Peggy): if b=0 sends r; if b=1 sends y=r s mod n 4) (Victor): if b=0, verifies x=r2 mod n (Peggy knows r) if b=1, verifies x = y2v mod n (Peggy knows s) Replacing Victor by one-way hash function we obtain digital signature scheme!