Blinding Self-Certified Key Issuing Protocols Using Elliptic Curves

Blinding Self-Certified Key Issuing Protocols Using Elliptic Curves Billy Bob Brumley Helsinki University of Technology Laboratory for Theoretical Computer Science billy.brumley@hut.fi Abstract Self-Certified keys provide an attractive alternative to traditional certificate-based public key infrastructures. Many self-certified key issuing protocols strive to blind trusted third parties to users private keys. One such key issuing protocol is based on the Nyberg-Rueppel signature scheme, but requires a proof of knowledge to avoid impersonation attacks. This paper describes a version of this protocol that uses elliptic curves and eliminates the impersonation attacks and the proof of knowledge. KEYWORDS: elliptic curve cryptography, identity-based cryptography, self-certified keys, key issuing protocols 1 Introduction In traditional certificate-based public key infrastructures, a user s public key is authenticated by means of a trusted third party s (TTP 1 ) explicit signature on the public key. Self- Certified keys [6] are an efficient alternative in which the user s public key is extracted using the identity of the user and TTP s signature on this identity. E-mail addresses and IP addresses are two good examples of identities. Self-certified keys are related to identity-based cryptography [16]. Unfortunately, many self-certified schemes suffer from the key escrow problem, meaning that TTP gains access to the user s private key as well. Avoiding this problem is a desirable property of self-certified key issuing protocols [15]. Related Work. Ateniese et al. [1] presented a selfcertified, identity-based (SCID) scheme which uses multiplicative groups and is based on the Nyberg-Rueppel signature scheme [14]. While a solution was presented to the key escrow problem by blinding TTP to the user s private key, this solution is susceptible to impersonation attacks and requires a proof of knowledge to be used securely. Contributions. The blind key issuing protocol using elliptic curve groups is presented, which does not require a proof of knowledge and is not susceptible to impersonation This work was supported in part by the project Packet Level Authentication funded by TEKES. Thanks to Prof. Kaisa Nyberg for suggestions and comments. Additionally, the author gratefully acknowledges those involved in the PLA project. Additional thanks goes to Tuomas Kivinen for useful comments. 1 The trusted third party will henceforth be referred to as the entity TTP. attacks. Eliminating the proof of knowledge is shown to reduce the complexity of the key issuing protocol. Applications. Self-certified keys and identity-based schemes are well-suited for dynamic networks, where efficient and compact authentication is needed (for example, [4]). Elliptic curves also provide small key and signature sizes, which can be an advantageous feature in dynamic networks. 2 Background Authentication is an important facet of computer security. Digital signatures are a common way of providing such authentication on networks. This section contains a brief review of digital signatures, self-certified keys, and trust. These concepts are helpful in fully understanding the contributions of this paper. 2.1 The Nyberg-Rueppel Signature Scheme The Nyberg-Rueppel signature scheme is a variation of the ElGamal scheme [5] and similarly based on the Discrete Log Problem: given a generator g of large prime order and an element g k, finding k is infeasible. The Nyberg-Rueppel scheme is one of the few schemes present in many popular standards [9]. A version using multiplicative groups is outlined below; H is a collision-resistant hash function. Setup. Primes r, q such that r (q 1) are chosen, as well as a generator g of order r. Keygen. Alice generates a private key s and public key w by computing w = g s (mod q), where s Z r. (1) Sign. To generate a signature (c, d) on a message m, Alice calculates c = H(m)g k (mod q), where k R Z r d = k sc (mod r). (2) Verify. To verify the signature (c, d) on the message m, Bob checks that H(m) = cg d w c (mod q). (3)

This computation is consistent: cg d w c = H(m)g k g k sc g sc = H(m)g k k sc+sc = H(m) The main operation for signing and verifying is modular exponentiation, which can be computed very efficiently using the Square-and-Multiply Method [11]. If two messages have the same hash value, existential forgery is possible. The signature of the former message can be attached to latter message, which the user may not have signed. But since the hash values are the same, the signature will still verify. This is the reason H must be collisionresistant. Certificates provide a method for verifying public keys. Certificates are generated by TTP by signing the user s public key. This is a common type of Public Key Infrastructure (PKI). While this does provide a method for verifying the included public key, it requires the certificate to be transmitted with signed messages, causing excess storage and computation requirements. 2.2 Self-Certified Keys Self-certified keys are an efficient alternative to certificatebased PKI. Instead of verifying public keys using an explicit signature on a user s public key, the public key is extracted directly from TTP s signature on the user s identity. This reduces the storage and computational requirements. While the extracted public key cannot be explicitly verified, resulting signatures will not verify unless the extracted key is authentic. If the message signature fails to verify, it is unknown whether the user s signature on the message is invalid or the extracted public key is invalid (or both). 2.3 Trust The concept of a trusted third party can be fairly vague when discussing self-certified keys. To better define the notion of trust, Girault [6] introduced three distinct trust levels. Trust Level 1. TTP knows the user s private key and can therefore impersonate the user without being detected. Trust Level 2. TTP does not know the user s private key, but can still impersonate the user without being detected. Trust Level 3. TTP does not know the user s private key, but can impersonate the user. However, such impersonation can be detected. Detected means that if TTP tries to impersonate a user, the user can prove it; for example, providing two different signatures from TTP on the same identity. Trust Level 1 is inadequate for many reasons, one being that it usually requires a secure key escrow. Reaching Trust Level 3 is generally the goal; consider the following scenario. An Internet Service Provider (ISP, the user s TTP) charges based on bandwidth usage. Each packet is digitally signed by the user, providing assurance that the ISP is billing in an honest manner. If the ISP can impersonate the user in an undetectable manner, the ISP can generate false traffic from the user to increase the charges. Trust Levels 1 and 2 are therefore inadequate. This is just one example of why Trust Level 3 is desirable. 3 A Nyberg-Rueppel SCID Scheme A SCID scheme based on the Nyberg-Rueppel signature scheme was presented in [1] where the focus is on provable security. As such, exponentiation of separate generators to the power of the hash values from H takes place. No such exponentiation is present here, as the focus is on efficiency and practicality. While it was noted that elliptic curve groups provide an efficient setting, all of the notation therein is for multiplicative groups. The scheme is presented below. Let k (i) be random integers in Z r. Setup. Primes r, q such that r (q 1) are chosen, as well as a generator g of order r. TTP generates a private key s T and public key w T using (1). Keygen. To generate a key pair on user Alice s identity ID A, TTP calculates r A = g k (mod q) s A = k s T r A (mod r) (4) and escrows (r A, s A ) to Alice. Extract. To extract Alice s public key w A = g sa on identity ID A given public value r A, Bob calculates w A = H(ID A) w ra D r A (mod q) (5) The key issuing protocol Keygen only reaches Trust Level 1. Note that (r A, s A ) is simply a Nyberg-Rueppel signature by TTP on the message ID A. Alice s private key is s A while r A is used by other users to reconstruct Alice s public key as shown in Extract. The public key is correct: w ra D r A = g st ra g k = 1 g k sa+k = gsa As with Nyberg-Rueppel signatures, existential forgery is still possible. In this case, if two users have identities that hash to the same value, they can impersonate the other user. 3.1 A More Secure Key Issuing Protocol A key issuing protocol that reaches Trust Level 3 was also presented in [1] and appears below. Keygen. The following protocol is used to generate a key pair on user Alice s identity ID A. TTP Alice: g ka (mod q) Alice TTP: CHAL TTP Alice: SIG ka (CHAL) TTP: V ER g k A (SIG ka (CHAL)) { r A = g ka g kt (mod q) Alice TTP: s A = k T x T r A (mod r) (6)

Alice s private key is s A = s A k A (mod r). The public key g sa extracts correctly: g xt ra g ka g kt = 1 g kt sa+sa sa+kt = gsa The first few steps of the protocol involves a proof of knowledge by Alice. This is done to prevent impersonation attacks as described below. TTP issues a challenge message CHAL. Alice then signs this message using key k A and TTP verifies this signature using key g ka. 2 1.5 1 0.5 0-0.5-1 P Q -R R 3.2 Impersonation Attacks The threat of an impersonation attack was noted in [1]. However, it is not immediately clear how the attack is carried out, as different generators are used in exponentiation to the power of the hashes. As mentioned, no such exponentiation takes place here; for this case, the attack it is outlined below. Consider a malicious user Malice attempting to obtain a valid signature from TTP on Alice s identity using (6) where no proof of knowledge is performed. Malice (identity ID M ) needs to choose some difference d such that dg ka g kt H(ID M ) = g ka g kt d = H(ID A) H(ID M ). (7) That is, Malice can choose parameters in the following manner. TTP Malice: gka (mod q) H(ID M ) r A = gk A H(ID A)g k T H(ID M) Scalar multiplication, H(ID M) (mod q) Malice TTP: = g ka g kt s A = k T x T r A (mod r) (8) kp = Malice now has a valid signature from TTP on Alice s identity and can freely impersonate Alice. To use this protocol securely, the user must prove knowledge of the discrete log of g ka to the base g (given g ka, the user proves that k A is known) as shown in (6). 4 Using Elliptic Curves Elliptic curves are defined by their Weierstrass equation: y 2 = x 3 + ax + b. (9) Taken over R, these curves have the interesting property that given two points P, Q such that P Q, the line between them intersects the curve at exactly one other point. The reflection of this point on the x-axis is also on the curve, R. This operation is called point addition, denoted P + Q = R. If P = Q, the line tangent to the curve at P is used. In this case, the operation is called point doubling, denoted 2P = R. Algebraically, these points form an abelian group. In cryptography [13, 12], these curves are defined over a finite field F q, where q = p (a prime finite field) or q = 2 m (a binary finite field 2 ) [9]. That is, all x, y F q. 2 The elliptic curve and point addition equations are slightly different when using binary fields. -1.5-2 -2-1.5-1 -0.5 0 0.5 1 1.5 2 Figure 1: Elliptic curve y 2 = x 3 x over R. Point addition and doubling. The sum of two points P = (x 1, y 1 ) and Q = (x 2, y 2 ) is calculated as follows. x 3 = λ 2 x 1 x 2 y 3 = λ(x 1 x 3 ) y 1, where (10) y 2 y 1 if P Q x λ = 2 x 1 3x 2 1 + a if P = Q 2y 1 Note that λ is the slope. This calculation is largely dominated by the cost of the single field inversion present. denoted kp, is the elliptic curve analogue of exponentiation. It is used to compute k multiples of a point. k times { }} { P + P +... + P This can be carried out efficiently by combining point additions and doublings using the Double-and-Add Method (Alg. 1), which is analogous to the square-and-multiply method for exponentiation. As with exponentiation, There are much more efficient methods [7]. Algorithm 1: Scalar multiplication, Double-and-Add. Input: integer k, point P E(F q ) Output: kp Q /* identity element */ while k > 0 do if k is odd then Q Q + P /* k & 1 */ k k/2 /* right shift by one */ P 2P /* point doubling */ end return Q Digital signatures using elliptic curves. Most digital signature schemes that use multiplicative groups (including El- Gamal variations) can also use elliptic curve groups. Table 1 from [9] outlines the analogous operations and settings. In

practice, an elliptic curve E is used with a base point generator G of prime order r. It is very difficult to solve the Elliptic Curve Discrete Log Problem: given the generator G of large prime order and some other point kg, finding k is infeasible. Multiplicative Groups Elliptic Curve Groups Setting F q curve E over F q Basic operation multiplication in F q addition of points Main operation exponentiation scalar multiplication Base element generator g base point G Base element order prime r prime r Private key s (integer mod r) s (integer mod r) Public key w (element of F q) W (point on E) Table 1: Elliptic curve and multiplicative group analogues. Elliptic curves are often used when small public keys and signatures are needed. Table 2 from [10] shows an equivalent level of security; using elliptic curve cryptography (ECC) requires much fewer bits. Symmetric ECC DSA/RSA 80 163 1024 112 233 2048 128 283 3072 192 409 7680 256 571 15360 Table 2: Comparable key sizes (in bits). Point compression. Public keys (or any point on E, a group element) are made up of (x, y) coordinates, but the y- coordinate can be compressed; given an x-coordinate, there are either two or zero solutions to (9). Therefore, it suffices to store x and a compression bit b (determines which solution to take). This point compression is accomplished using the function COMPRESS. Point decompression. DECOMPRESS yields a point P given x and compression bit b. The complexity depends on the underlying field. In the prime case, this involves computing a square root in a prime field, not a trivial operation. In the binary case, a quadratic equation is solved. This depends on the representation of the binary field elements. When using a normal basis representation, this is accomplished very quickly and involves only a few field multiplications and some bit rotations. For more on the basics of ECC, see [8]. 4.1 An Elliptic Curve SCID Scheme The SCID scheme (Sec. 3) as well as the blind key issuing protocol (6) can be modified to use elliptic curve groups. The analogous steps are presented below, with minor modifications 3. The proof of knowledge is not performed. Setup. Elliptic curve E is chosen with base point generator G of prime order r where r #E. TTP generates a domain private key s T R Z r and domain public key W T = s T G. 3 Some signs have been changed. This does not affect the principles. Also, the point k A G can be compressed if needed. TTP then publishes W T. Keygen. The following protocol (elliptic curve analogue of (6)) is used to generate a key pair on user Alice s identity ID A. It reaches Trust Level 3. TTP Alice: k A G TTP: (r A, b A ) = COMPRESS(k A G + k T G) r A = r A + s A = k T r A s T (mod r) Alice TTP: (r A, b A, s A ) (11) Alice s private key is s A = k A + s A (mod r). Extract. To extract Alice s public key W A = s A G on identity ID A given public values (r A, b A ), Bob calculates W A = DECOMPRESS(r A, b A ) r A W T (12) The extracted public key is correct (W A = s A G): W A = DECOMPRESS(r A, b A ) r A W T = DECOMPRESS(r A +, b A ) r A W T = k A G + k T G r A s T G = (k A + k T r A s T )G = (k A + s A )G = s A G 4.2 Attempting Impersonation Attacks Consider Malice attempting to obtain a valid signature from TTP on Alice s identity using (11). Malice must send an element of the group; more specifically, a point in the main subgroup (a multiple of the point G). TTP can and should verify this. As in (7), Malice needs to choose some difference d such that [(k A + d)g + k T G] x + H(ID M ) = [k A G + k T G] x +. (13) This seems to be very unlikely, as Malice does not know TTP s random value k T. 5 Results & Conclusions In an attempt to quantify the likelihood of impersonation success, an experiment was run using an implementation in Java. As such an experiment requires every point on the curve to be computed, only small, toy curves can be examined, as standard curves for cryptographic use have too many points. A few different curves over prime fields were examined. The results suggest the probability of impersonation success is extremely low, only slightly higher than guessing a private key on the curve. This suggests that as the size of the curve increases, the probability of success of such an impersonation attack shrinks to an insignificant amount. Table 3 compares the storage and computation requirements when verifying message signatures using traditional certificate-based PKI and when using self-certified keys. Not only is there one less elliptic scalar multiplication (ESM) present, but the three can be done simultaneously [3] very efficiently. In conclusion, a modification to an existing blind selfcertified key issuing protocol has been presented for use with

Certificate-Based PKI Self-Certified signature (2r) signature (2r) public key (q + 1) self-certified public key (q + 1) TTP signature on public key (2r) - verify public key (2 ESM s) extract public key (1 ESM) verify signature (2 ESM s) verify signature (2 ESM s) Table 3: Storage and computation requirements. elliptic curves (11). This is much less complex than its multiplicative group analogue (6), as no proof of knowledge is needed. 5.1 Future Work Although experimental results suggest impersonation is not a serious threat in (11), the true upper-bound on the probability of impersonation success is an open question. Future work is planned. In the area of small and short signatures, probably the most active area of research is pairing-based cryptography [2], which also uses elliptic curves. However, pairings are generally considered much more expensive to compute than scalar multiplications. Efficient settings and methods for calculating pairings could be a topic of research. References [1] G. Ateniese and B. de Medeiros. A provably secure Nyberg-Rueppel signature variant with applications. Cryptology eprint Archive, Report 2004/093, 2004. http://eprint.iacr.org/. [2] D. Boneh, B. Lynn, and H. Shacham. Short signatures from the Weil pairing. In ASIACRYPT 01: Proceedings of the 7th International Conference on the Theory and Application of Cryptology and Information Security, pages 514 532, London, UK, 2001. Springer- Verlag. [8] D. Hankerson, A. Menezes, and S. Vanstone. Guide to elliptic curve cryptography. Springer, New York, 2004. [9] IEEE. Standard specifications for public-key cryptography. Technical Report P1363 / D13, Institute of Electrical and Electronics Engineers (IEEE), November 1999. [10] IETF. ECC cipher suites for TLS. Technical report, TLS Working Group, Internet Engineering Task Force (IETF), October 2005. [11] D. E. Knuth. The Art of Computer Programming: Seminumerical Algorithms, volume 2. Addison- Wesley, Reading, MA, 3rd edition, 1998. [12] N. Koblitz. Elliptic curve cryptosystems. Mathematics of Computation, 48:203 209, 1987. [13] V. S. Miller. Use of elliptic curves in cryptography. In CRYPTO 85: Advances in Cryptology, pages 417 426, London, UK, 1986. Springer-Verlag. [14] K. Nyberg and R. A. Rueppel. A new signature scheme based on the DSA giving message recovery. In CCS 93: Proceedings of the 1st ACM conference on Computer and communications security, pages 58 61, New York, NY, USA, 1993. ACM Press. [15] H. Petersen and P. Horster. Self-Certified Keys: Concepts and Applications. In Proceedings of the Third International Conference on Communications and Multimedia Security, pages 102 116, London, 1997. Chapman & Hall. [16] A. Shamir. Identity-based cryptosystems and signature schemes. In Proceedings of CRYPTO 84 on Advances in cryptology, pages 47 53, New York, NY, USA, 1985. Springer-Verlag New York, Inc. [3] B. B. Brumley. Efficient three-term simultaneous elliptic scalar multiplication with applications. In V. Fåk, editor, Proceedings of the 11th Nordic Workshop on Secure IT Systems (NordSec 2006), pages 105 116, Linköping, Sweden, 2006. [4] C. Candolin, J. Lundberg, and H. Kari. Packet level authentication in military networks. In Proceedings of the 6th Australian Information Warfare & IT Security Conference, Geelong, Australia, November 2005. [5] T. ElGamal. A Public-Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms. IEEE Transactions on Information Theory, IT-31(4):469 472, 1985. [6] M. Girault. Self-certified public keys. In D. W. Davies, editor, Advances in Cryptology - EuroCrypt 91, pages 490 497, Berlin, 1991. Springer-Verlag. Lecture Notes in Computer Science Volume 547. [7] D. M. Gordon. A survey of fast exponentiation methods. J. Algorithms, 27(1):129 146, 1998.