Post-Quantum signatures. Johannes Buchmann

Transcription

1 Post-Quantum signatures Johannes Buchmann

2 Thanks to: Carlos Coronado Martin Döring Daniela Engelbert Ulrike Meyer Raphael Overbeck Arthur Schmidt Tobias Straub Ulrich Vollmer Ralf-Philipp Weinmann

3 Digital signatures are crucial for IT security today

4 Countries with digital signature legislation Argentina, Australia, Austria, Belgium, Bermuda, Brazil, Bulgaria, Canada, Chile, Colombia, Costa Rica, Croatia, Czech Republic, Denmark, Dominican Republic, Ecuador, Estonia, European Union, Finland, France, Germany, Greece, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malaysia, Malta, Mexico, Netherlands, New Zealand, Nicaragua, Norway, OECD, Panama, Peru, Philippines, Poland, Portugal, Puerto Rico, Rumania, Russian Federation, Singapore, Slovak Republic, Slovenia, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Trinidad/Tobago Republic, Tunesia, United Kingdom, USA, Uruguay, Venezuela, Vietnam.

5 Applications are ready to use digital signatures

6 Netscape Messenger

7 Outlook Express

8 MICROSOFT WORD

9 ADOBE ACROBAT

10 https

11 Digital signatures in practice

12 Mortgage applications online

13 Air Traffic Control

14 Transactions between Mexican banks

15 Digital signatures in practice: RSA DSA ECC

16 Quantum computers kill all digital signatures

17 1981 Richard Feynman suggests QC 1985 David Deutsch develops theory 1993 Dan Simon finds first algorithms 1994 Peter Shor finds factoring and DL algorithm

18 2001 Chuang et al. factor 15

19 >= 2001 technological progress

20 We need: Quantum-hard problems Signatures Security Models Proofs and experiments Implementations Standards

21 Complexity theory Nielsen & Chuang: QC cannot efficiently solve NP-complete problems Brassard: No deterministic signature based on NP-complete problem

22 Lattice based signatures

23 γ-closest Vector Problem (γ-cvp) Given: Lattice L Z n x Z n γ > 0 Find: v L : x v γ x w for all w L CVP: γ =1

24 Arora et al. (1997): γ Complexity of γ-cvp ( n) - CVP is NP - hard for c log c all not NP - hard NP - hard Goldreich, Goldwasser (2000): ( ) ( n/log n )- CVP is not NP - hard or AM Ω conp n

25 Lattice Signatures Public Key: Bad basis of lattice L Z n Private Key: Reduced basis of L Signature: hash Message m ( ) n x Verification of (m,v): 1. Check v L? 2. Accept iff v close to h(m). solve = h m Z Signature v L γ-cvp

26 GGH/Micciancio Scheme Attack experiments (C. Ludwig): Signature forgery Public Key is HNF dist(h(m), L) relativ to max. distance SunBlade100 Conclusions: Dimension >780 Key size > 1MByte Time [1000 seconds] Dimension 60% 80% 100% Public Key generation > 10 days Signature > 1 hour Verification < 1 second

27 Completely determined by NTRUSign (Hoffstein et al.) q q h h h h h h h h h N 0 1 N 1 N L O M O L M M L L L O M O NTRU Lattice: ( ). 1,q [X]/ X h N Z Signature and verification: efficient polynomial arithmetic (FFT) Lattice basis never explicit

28 Standard EESS#1: N = 251 dim(l) = 502 Public Key: 2008 bit Secret Key: 251 bit

29 McEliece Coding based signatures

30 McEliece Cryptosystem Plaintext m encode mg Code Word w Add Error Vector of Weight t w y Ciphertext c ( G, t)

31 Bounded Distance Decoding Problem Given: linear binary code n ciphertext y F2 weight t N n C F2 Find: Codeword x C with dist( x, y) t Only exponential time algorithms are known

32 Courtois, Finiasz, Sendrier 2001 Counter i Hash of the Document m Hash h( m o i) Hash Value h i decodable? Yes Compute z of Weight t z = H 1 h i No valid/ not valid = Compute s = Hz Signatur ( z, i)

33 Efficiency of CFS Signature Courtois, Finiasz, Sendrier 2001 Public Key Size Signature Verification Best Attack 524 kbyte 2 36 Ops 2 10 Ops 2 83 Ops

34 Signatures based on polynomial equations: SFlash, HFE Signatures based on braid groups

35 Merkle signatures

36 one-time signatures (OTSS) based on hash functions Webserver authentication requires many key pairs

37 Merkle signature scheme: One public key Slightly larger signatures

38 Merkle s tree H(L,R) H(L,R) H(L,R) H(L,R) H(L,R) H(L,R) H(L,R) H(L,R) L R L R L R L R L R L R L R L R H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( ) H( )

39 Key generation = H( ) =

40 Signing =(i,,,,,, ) i

41 Verification = i =(i,,,,,, )

42 Coronado experiments 2 16 leaves and SHA-1 public key size 168 bits secret key size 642 bits signature size 2904 bits

43 N (2 N leaves) Key Generation SHA sec 4.95 sec 9.31 sec sec sec 1.24 min 2.49 min RIPEMD sec 8.74 sec sec sec 1.14 min 2.41 min 4.80 min SunBlade-100 SunOS 5.8 Generic 450 MHz

44 N N Signature (time in ms) SHA-1 RIPEMD160 N div 2 1 N N div

45 Verification (time in ms) N SHA-1 RIPEMD

46 Security status Secure if OTS and hash secure Coronado 2004: forward secure

47 Open problems Provably secure and efficient signature scheme based on lattices, coding theory, HFE Application integration of Merkle

48 FlexiTrust Registration RA Datenbank KA Keys PKI-Teilnehmer Clients CMA LDAP-Server FlexiProvider Certificate managment FlexiTrust Crypto Internet

49 Thank You!