Communications security

(1)

Andrea Baiocchi, DIET, Università di Roma “Sapienza” - “Sicurezza nelle Comunicazioni” - A.A. 2013-2014 1

Communications security

Lecturer: Andrea Baiocchi

DIET - University of Roma “La Sapienza” E-mail: [email protected]

URL: http://net.infocom.uniroma1.it/corsi/index.htm

University of Roma “Sapienza” DIET

Lecture 15

Digital signatures - Part II

[Sti02], Cap. 7, §§ 1-4 [Sta03], Cap. 13, §§ 1, 3 [KPS02], Cap. 6, § 8

About truth

and

lies

…

Grande sorte è quella degli astrologi, che più fede gli dà una verità che pronosticano che non gli toglie cento falsità.

[Francesco Guicciardini]

La verità autentica è sempre inverosimile; per renderla più credibile bisogna assolutamente mescolarvi un po’ di menzogna.

[Fjodor Dostojevskij]

La verità è che la verità cambia.

[Friedrich Nietzsche]

Grande è la verità, ma ancora più grande, da un punto di vista pratico, è il silenzio sulla verità.

[Aldous Huxley]

Non sono sincero nemmeno quando dico che non sono sincero.

(2)

The elliptic curve DSA (ECDSA)

! US Govt approved (2000) signature scheme (FIPS 186-2)

! Uses the SHA-1 hash algorithm

! Designed by NIST & NSA

! Elliptic curve version of DSA

! Creates a 320-bit signature

! All the computations involve 160-bit (or slightly more) variables

(improved efficiency w.r.t. DSA)

! Security depends on difficulty of computing discrete logarithms

on finite elliptic curves

ECDSA key generation

! Shared global public values (n, q, E, P)

An elliptic curve E defined over _{GF(n) where n is a prime or a power of 2}

A 160-bit prime q and an element P!E of order q

(n, q, E, P) are such that the DL problem in the cyclic subgroup "P#$E

should be infeasible

Typical values of n are of the same order of q

! Each user generates his/her private key a and public key Q

Select a random integer a with 1 < a < q–1 Compute Q = aP

(3)

ECDSA signature creation

! Let P={0, 1}*, A= Z_q*"Z_q* and define

K={(n, q, E, P,a, Q) : Q = aP}

! To create the signature y = sig_K(x) of a message x, the sender

Selects a random integer k with 1 ! k ! q–1

NOTE - k must be destroyed after use and never reused

Then computes the point kP = (u, v) ! GF(n)"GF(n)

The signature pair for x is (r, s) where

r = u mod q

s = (SHA-1(x) + ar)k–1 _{mod q}

If r=0 or s=0, repeat the previous steps

! The signature y=(r, s) is sent with the message x

ECDSA signature verification

! To verify the signature y=(r, s) received with the message x , the

recipient computes

e₁= s-1 _{SHA-1(x) mod q} e₂= s-1 _{r mod q}

e₁P+ e₂Q = (u, v)

! If u mod q=r then ver_K(x, y) = true (signature is verified)

Proof e₁P+ e₂Q = e₁P+ ae₂P = kP

since e₁+ ae₂ % s-1 _{(SHA-1(x)+ ar) % s}--1_{ks % k mod q}

(4)

ECDSA efficiency

! As in DSA, nearly all the calculations are performed mod q

! Only one calculation on E, i.e., in GF(n), is required on both

sides, replacing the DSA calculation mod p

For r in signing (it does not depend on x and can be pre-computed) For v in verifying

! Suitable (i.e., supposed to be secure) curves exist for n slightly

larger than 160 bits

Minimum size for the curves recommended in FIPS 186-2: 192 bits for p, 163 bits for a power of 2

! Elements of GF(n) have typical dimensions comparable to q

ECDSA

security

! The ECDSA security relies on the DL in the subgroup "P#$E ! Validation of global values (n, q, E, P) - Users should test that

n (if not a power of 2) is actually a prime of the required size q is actually a prime of the required size

P is actually on E and its order is actually q

E is not in any set of curves known to be weak

Otherwise, efficient attacks may exist

NOTE - Cautions in signature generation (k destroyed and never reused; r=0 and s =0 avoided) have the same security reasons holding in DSA

(5)

Zero

knowledge protocols

! We will introduce so called Zero knowledge authentication

procedures

Signatures can be derived from those schemes

Peggy

Prover, proves she knows a secret, without revealing anything about it.

Victor

Verifier, verifies Peggy knows the secret.

! Zero-knowledge property

Victor can simulate the execution of the authentication procedure and end up with the same information (in a statistical sense) as when interacting with Peggy.

Practical schemes

! The Fiat-Shamir protocol is a first practical example of

zero-knowledge identity authentication scheme.

Based on public-key cryptography.

Commitment-challenge-answer paradigm.

Basic paradigm repeated k times, with increasing security as k grows.

! A conceptually similar scheme is Schnorr’s.

Based on discrete logarithm.

! More variants can be defined based on RSA, graph coloring,

(6)

Zero

knowledge proof concept

Quisquater

Quisquater,

, Guillon

Guillon,

, Berson

Berson

! Victor stays in position A, while Peggy enters the tunnel.

! Once Peggy is inside, Victor moves to B and calls randomly

either “Left” or “Right” and expects Peggy to come out from the called side. left right Peggy Victor A B Locked door

(different keys on each side)

! Peggy proves she has

one of the two keys opening the door, yet Victor cannot know which one.

Fiat-Shamir parameter setting

! Peggy randomly generates the two primes p and q, computes

the module n = pq

! Peggy chooses a random number s (1<s<n) and computes the

quantity v = s2_{mod n}

! Then Peggy can forget p, q and

publish (n,v) as her public authentication key; store s as her private authentication key.

! Security ultimately relies on belief that factoring n can be made

unfeasible

Efficient computation of square roots mod n can be proved to be equivalent to efficient factoring of n, i.e. if an efficient algorithm to compute square roots mod n is available, then n can be factored efficiently and viceversa.

(7)

Choose r (random)

Compute x = r2_{mod n}

Compute y = rse_{mod n}

Fiat-Fiat-Shamir protocol

Shamir protocol; single

; single run

run

Check y2_{% xv}e_{mod n}

e (challenge) Choose bit e (random) x (commitment)

y (answer) Choose r (random)

Compute x = r2_{mod n}

Compute y = rse_{mod n}

Choose bit e (random)

Check y2_{% xv}e_{mod n}

Fiat-Shamir protocol

;

attack

Compute y = r mod n Choose r (random) Choose random bit b Compute x = r2_v–b_{mod n}

e (challenge) x (commitment)

y (answer)

Success if b=e (probability 1/2) Check y

2_{% xv}e_{mod n} Choose bit e (random)

Choose bit e (random)

Check y2_{% xv}e_{mod n}

Choose r (random) Choose random bit b Compute x = r2_v–b_{mod n}

(8)

Fiat-Shamir with

k

repetitions

! If Oscar wants to impersonate Peggy, he can do the following:

choose a random r in _Z_n, a random bit b, compute x = r2_v-b_{mod n and}

send x to Victor;

If Victor’s challenge e=b, then just send r as the answer (check this!)

! Thus Oscar has 1/2 success probability on a single run

! After k independent challenges the success probability is 1/2k;

therefore, to prove her identity to Victor

Peggy chooses k random number r₁,…,r_k and she sends to Victor the quantities r_j2_{mod n, j=1,…,k;}

Victor challenges Peggy by sending her k randomly chosen binary quantities e_j, j=1,…,k;

Peggy returns to Victor the quantities y_j = (sej_r

j) mod n, j=1,…,k;

Victor checks that y_j2_{= (v}ej_r

j2) mod n, j=1,…,k.

Why Fiat-Shamir protocol works

! In each run, Bob obtains triple (x,e,y), with y2=xve mod n and

x uniformly distributed over the n_sq squares of Z_n

e random bit with _Pr(e=1)=P

y is uniformly distributed over _Z_nfor any given secret key s

! He could have produced those quantities by himself with the

following efficient simulation

Choose a random square q=r2_{modn of} _Z

n and a random bit b with

Pr(b=1)=P.

Compute x_s=qv–b_{modn, choose a random bit e with}Pr(e=1)=P and let y_s=r; if b=e, keep the triple, else erase it and go back to previous step

! Triple (x_s,b,y_s) has the same properties as triple (x,e,y) provided

(9)

From authentication to signature

! Essential to Fiat-Shamir protocol is Bob’s challenge; this needs

be adapted in case of non real time interaction (signature)

! Given a message m, Alice chooses her commitment (k random

squares x_j=r_j2_{mod n, j=1,…,k), appends them to the message,}

then computes a hash of the whole string.

! The resulting hash value is used as Bob surrogate.

Each bit is a challenge; answers are used as the message signature. Since Fred can search for a hash value such that he knows the answers to the resulting challenges, we need a larger margin than in real time interaction: this is easily provided by hash length, e.g. 128, 160 or 256 bit.

Fred sets x_j=r_j2_v–bj mod n, j=1,…,& (& is the number of bits of the hash) and searches for m such that h(m||x₁||x₂||…||x_&)=[b₁b₂…b_&]₂ (existential forgery)

Overhead can be substantial.

Schnorr

’

s scheme

! Peggy chooses a prime p, a primitive root ' mod p, a random a,

1<a<p–2, computes (='a_{mod p and publishes {',(,p}}

! Peggy chooses a random k, 1<k<p–1, computes ) = 'k mod p

and sends ) to Victor.

! Victor chooses a random r, 1<r<p–1, and sends it to Peggy

! Peggy computes y = k–ar (mod p–1) and sends y to Victor.

! Victor checks that ) = 'y₍r mod p.

) and y are just random numbers; Victors learns nothing but those numbers.

(10)

Choose r (random)

Compute x = r2_{mod n}

Compute y = rse_{mod n}

Schnorr protocol

Schnorr protocol; single run

; single run

Check y2_{% xv}e_{mod n}

r (challenge)

Choose bit e (rando) ) (commitment)

y (answer) Choose k (random)

Compute ) = 'k_{mod p}

Compute y = k–ar mod p

Choose random r, 1<r<p–1

Check ) = 'y₍r_{mod p}

Undeniable signatures

! Principals are called signer and verifier; usual procedures are

Signature generation: by the signer

Signature verification: based on challenge-response

! A basic aim of such schemes is to involve actively signer into

signature verification, so that signed documents cannot be spread and checked out of signer control

! Then, the problem arises that the signer could cheat when

doing verification and make a valid signature result as a forgery; hence we need a third procedure

Disavowal protocol: based on challenge-response; it allows the verifier

to check his claim that the signature comes indeed from the signer and the signer to disavow a forged signature

(11)

Chaum-van Antwerpen scheme

! Let q and p=N·q+1 be primes; let '!Z_p* be an element of order

q and let (='a_{mod p, with 1<a<q–1.}

! Let G denote the subgroup of Z_p* generated by ' and let h:

{0,1}*_*G; then P=A=G and K = {(p,',(,a), ' of order q, (='a

mod p}. Then, for K!K the signature y is generated as follows

y = (h(x))a_{mod p}

! Verification is done as follows

Verifier chooses e₁,e₂!Zq* at random, computes c=ye1(e2 mod p (the

challenge) and sends to the signer.

Signer computes d=cz_{mod p, with z=a}–1_{mod q and sends it back}

Verifier accepts y as a valide signature iff d=(h(x))e1_'e2 mod p

Disavowal protocol

1. Verifier chooses e₁,e₂!Z_q* at random, computes c=ye1(e2 mod p

(the challenge) and sends to the signer.

2. Signer computes d=cz_{mod p, with z=a}–1_{mod q and sends it}

back to the verifier.

3. Verifier checks that d" ( h(x))e₁_'e₂_{mod p.}

4. Verifier chooses f₁,f₂_!Z_q*_{at random, computes C=y}f1₍f2 mod p

(the challenge) and sends to the signer.

5. Signer computes D=Cz_{mod p, with z=a}–1_{mod q and sends it}

back to the verifier.

6. Verifier checks that D" ( h(x))f₁_'f₂_{mod p.}

(12)

Scheme pictorial

Computes h(x)

Choose bit e (random)

Generates e₁,e₂ in (1,q) Computes c = ye1₍e2 modp Reads y Sends challenge c Sends reply d Check d=(h(x))e1_'e2 modp

Choose bit e (random)

Generates f₁,f₂ in (1,q) Computes C = yf₁₍f₂_modp Check D=(h(x))f₁_'f₂_modp (x,y) is valid YES NO Sends challenge C Sends reply D (x,y) is valid YES NO Alice (d'–e₂₎f₁_=(D'–f₂₎e₁_modp (x,y) is forged YES NO Alice is cheating

Properties

! P1 - If y" ( h(x))a mod p, then verifier will accept y as a valid

signature of the message x with probability 1/q.

This does not depend on any computational assumption, so security is unconditional

! P2 - if y" ( h(x))a mod p and verifier and signer follow the

disavowal protocol, then it is (d'–e2)f1=(D'–f2)e1 mod p.

This way signer can claim and show that a signature is forged.

! P3 - Suppose y=(h(x))a mod p and verifier follows the disavowal

protocol. If d" xe1_'e2 mod p and D" xf1_'f2 mod p, then the

probability that (d'–e₂₎f₁_{" ( D'}–f₂₎e₁_{mod p is 1–1/q.}

This way verifier can give evidence that a denied signature is indeed genuine.

(13)

Games: flipping coins over the phone

! A short “cryptological” story.

Alice and Bob live very far from each other; one day they have to decide who’ll take the beautiful house where they used to spend their summers as young guys. Bob phones Alice and says he’s going to flip a coin; Alice chooses Heads and Bob says “I’m sorry, it was Tails”. When Alice tells this story to Cindy, her local cryptologist, she suggests a better method could have been used…

! Alice chooses two large primes, p and q, computes n=pq and

sends n to Bob.

! Bob chooses a random x and sends y=x2 mod n to Alice.

! Alice computes the four square roots mod n of y, ±x and ±x’,

chooses one between x and x’ at random and sends it to Bob

! Bob wins if he can factor n by using the received root r and x.

Bob computes gcd(x–r,n); if r=x’, this yields either p or q.

Cautions

! Bob has to verify that the received number gives y (mod n) once

squared

! Alice has no incentive in using n composed with more than two

prime factor, i.e. cheating on the fact that actually n be the product of two primes.

! The protocol assumes both Bob and Alice wish to win.

(14)

Bit commitment

! Another short “cryptological” story

Alice runs an advanced research center and claims she has an algorithm to predict the winner of the Sunday horse race for sure. Bob is an addicted to betting at horse races and would love to try Alice’s method, so he asks Alice to prove her method by giving the forecast for next race. Alice replies she won’t disclose the results until Bob pays the predictor fully. So, they’re pretty much in a deadlock, until Cyrus, the local cryptologist, hears about this matter and suggests a method…

! Alice commits to one bit of information with Bob yet Bob cannot

learn that bit until proof time comes

! The bit b is set as the k-th most significant bit of a given binary

string S (otherwise chosen by Alice at will); Alice computes

H=h(S) and sends H to Bob

! When proof time comes, Alice sends S to Bob

To break commitment Alice should solve a collision problem with h(·)

A wrong scheme

! The bit b is set as the k-th most significant bit of a given binary

string S (otherwise chosen by Alice at will); Alice computes

C=E_K(S) and sends C to Bob

! When proof time comes, Alice sends K to Bob, so that he can

compute S=D_K(C) and check the k-th bit of S.

! Q. With this procedure, Alice can cheat. Why is that feasible?

A. Given C and bit b, Alice searches for two keys K and K’ such that the k-th bit of D_K(C) is the complement of the k-th bit of D (C). This is easy, since bits change w.p. 1/2 when key is changed.

(15)

Dual signatures

! Used in SET (Secure Electronic Transactions)

Started by MasterCard and Visa, 1996

! Three parties

Purchaser Merchant Bank

! Basic issue:

P does not want M to get his payment information (e.g. credit card credentials)

P does not want B to know what is being bought Yet payment should be tied to purchase order.

P

B M

Definitions

! H = public hash function

! E_X = public key encryption function of party X (X=P,M,B)

! D_X = decryption function of party X (X=P,M,B)

! GSO = Goods and Services Order

Purchaser (cardholder) and merchant names Description of items/services being sold

! PI = Payment Instructions

Merchant’s name, price paid, details of payment Credit card data

(16)

Protocol schematic

GSOMD=H(E_M(GSO)) PIMD=H(E_B(PI)) POMD=H(PIMD || GSOMD)

DS=D_P(POMD)

DS, E_B(PI), E_M(GSO)

Check E_P(DS) = H(H(E_B(PI)) || H(E_M(GSO))) If OK, get GSO=D_M(E_M(GSO))

Check E_P(DS) = H(H(E_B(PI)) || H(E_M(GSO))) If OK, get PI=D_B(E_B(PI))

DS,

E_B(PI),

E_M(GSO)

E_M(auth || D_B(auth))