Communications security

University of Roma Sapienza DIET Communications security Lecturer: Andrea Baiocchi DIET - University of Roma La Sapienza E-mail: andrea.baiocchi@uniroma1.it URL: http://net.infocom.uniroma1.it/corsi/index.htm [Sti02], Cap. 7, 1-4 [Sta03], Cap. 13, 1, 3 [KPS02], Cap. 6, 8 Lecture 15 Digital signatures - Part II Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 1 About truth and lies Grande sorte è quella degli astrologi, che più fede gli dà una verità che pronosticano che non gli toglie cento falsità. [Francesco Guicciardini] La verità autentica è sempre inverosimile; per renderla più credibile bisogna assolutamente mescolarvi un po di menzogna. [Fjodor Dostojevskij] La verità è che la verità cambia. [Friedrich Nietzsche] Grande è la verità, ma ancora più grande, da un punto di vista pratico, è il silenzio sulla verità. [Aldous Huxley] Non sono sincero nemmeno quando dico che non sono sincero. [Jules Renard] Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 2

The elliptic curve DSA (ECDSA)! US Govt approved (2000) signature scheme (FIPS 186-2)! Uses the SHA-1 hash algorithm! Designed by NIST & NSA! Elliptic curve version of DSA! Creates a 320-bit signature! All the computations involve 160-bit (or slightly more) variables (improved efficiency w.r.t. DSA)! Security depends on difficulty of computing discrete logarithms on finite elliptic curves Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 3 ECDSA key generation! Shared global public values (n, q, E, P) An elliptic curve E defined over GF(n) where n is a prime or a power of 2 A 160-bit prime q and an element P!E of order q (n, q, E, P) are such that the DL problem in the cyclic subgroup "P#$E should be infeasible Typical values of n are of the same order of q! Each user generates his/her private key a and public key Q Select a random integer a with 1 < a < q 1 Compute Q = ap Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 4

ECDSA signature creation! Let P={0, 1}*, A= Z q * "Z q * and define K={(n, q, E, P,a, Q) : Q = ap}! To create the signature y = sig K (x) of a message x, the sender Selects a random integer k with 1! k! q 1 NOTE - k must be destroyed after use and never reused Then computes the point kp = (u, v)! GF(n)"GF(n) The signature pair for x is (r, s) where r = u mod q s = (SHA-1(x) + ar)k 1 mod q If r=0 or s=0, repeat the previous steps! The signature y=(r, s) is sent with the message x Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 5 ECDSA signature verification! To verify the signature y=(r, s) received with the message x, the recipient computes e 1 = s -1 SHA-1(x) mod q e 2 = s -1 r mod q e 1 P+ e 2 Q = (u, v)! If u mod q=r then ver K (x, y) = true (signature is verified) Proof e 1 P+ e 2 Q = e 1 P+ ae 2 P = kp since e 1 + ae 2 % s -1 (SHA-1(x)+ ar) % s --1 ks % k mod q! If u mod q "r then ver K (x, y) = false Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 6

ECDSA efficiency! As in DSA, nearly all the calculations are performed mod q! Only one calculation on E, i.e., in GF(n), is required on both sides, replacing the DSA calculation mod p For r in signing (it does not depend on x and can be pre-computed) For v in verifying! Suitable (i.e., supposed to be secure) curves exist for n slightly larger than 160 bits Minimum size for the curves recommended in FIPS 186-2: 192 bits for p, 163 bits for a power of 2! Elements of GF(n) have typical dimensions comparable to q Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 7 ECDSA security! The ECDSA security relies on the DL in the subgroup "P#$E! Validation of global values (n, q, E, P) - Users should test that n (if not a power of 2) is actually a prime of the required size q is actually a prime of the required size P is actually on E and its order is actually q E is not in any set of curves known to be weak Otherwise, efficient attacks may exist NOTE - Cautions in signature generation (k destroyed and never reused; r=0 and s =0 avoided) have the same security reasons holding in DSA Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 8

Zero knowledge protocols! We will introduce so called Zero knowledge authentication procedures Peggy Victor Signatures can be derived from those schemes Prover, proves she knows a secret, without revealing anything about it. Verifier, verifies Peggy knows the secret.! Zero-knowledge property Victor can simulate the execution of the authentication procedure and end up with the same information (in a statistical sense) as when interacting with Peggy. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 9 Practical schemes! The Fiat-Shamir protocol is a first practical example of zeroknowledge identity authentication scheme. Based on public-key cryptography. Commitment-challenge-answer paradigm. Basic paradigm repeated k times, with increasing security as k grows.! A conceptually similar scheme is Schnorr s. Based on discrete logarithm.! More variants can be defined based on RSA, graph coloring, etc. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 10

Zero knowledge proof concept Quisquater, Guillon, Berson! Victor stays in position A, while Peggy enters the tunnel.! Once Peggy is inside, Victor moves to B and calls randomly either Left or Right and expects Peggy to come out from the called side.! Peggy proves she has one of the two keys opening the door, yet A Victor left B right Victor cannot know which one. Peggy Locked door (different keys on each side) Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 11 Fiat-Shamir parameter setting! Peggy randomly generates the two primes p and q, computes the module n = pq! Peggy chooses a random number s (1<s<n) and computes the quantity v = s 2 mod n! Then Peggy can forget p, q and publish (n,v) as her public authentication key; store s as her private authentication key.! Security ultimately relies on belief that factoring n can be made unfeasible Efficient computation of square roots mod n can be proved to be equivalent to efficient factoring of n, i.e. if an efficient algorithm to compute square roots mod n is available, then n can be factored efficiently and viceversa. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 12

Fiat-Shamir protocol; ; single run Choose r (random) Compute x = r 2 mod n x (commitment) e (challenge) Choose bit e (random) Compute y = rs e e mod nn y (answer) Check y 2 % xv e mod n Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 13 Fiat-Shamir protocol; attack Choose r (random) Choose random bit b Compute x = r 2 v b mod n x (commitment) e (challenge) Choose bit e (random) Compute y = r mod n y (answer) Success if b=e (probability 1/2) Check y 2 % xv e mod n Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 14

Fiat-Shamir with k repetitions! If Oscar wants to impersonate Peggy, he can do the following: choose a random r in Z n, a random bit b, compute x = r 2 v -b mod n and send x to Victor; If Victor s challenge e=b, then just send r as the answer (check this!)! Thus Oscar has 1/2 success probability on a single run! After k independent challenges the success probability is 1/2 k ; therefore, to prove her identity to Victor Peggy chooses k random number r 1,,r k and she sends to Victor the quantities r j 2 mod n, j=1,,k; Victor challenges Peggy by sending her k randomly chosen binary quantities e j, j=1,,k; Peggy returns to Victor the quantities y j = (s e jr j ) mod n, j=1,,k; Victor checks that y j 2 = (v e jr j2 ) mod n, j=1,,k. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 15 Why Fiat-Shamir protocol works! In each run, Bob obtains triple (x,e,y), with y 2 =xv e mod n and x uniformly distributed over the n sq squares of Z n e random bit with Pr(e=1)=P y is uniformly distributed over Z n for any given secret key s! He could have produced those quantities by himself with the following efficient simulation Choose a random square q=r 2 modn of Z n and a random bit b with Pr(b=1)=P. Compute x s =qv b modn, choose a random bit e with Pr(e=1)=P and let y s =r; if b=e, keep the triple, else erase it and go back to previous step! Triple (x s,b,y s ) has the same properties as triple (x,e,y) provided to Bob by Alice. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 16

From authentication to signature! Essential to Fiat-Shamir protocol is Bob s challenge; this needs be adapted in case of non real time interaction (signature)! Given a message m, Alice chooses her commitment (k random squares x j =r j 2 mod n, j=1,,k), appends them to the message, then computes a hash of the whole string.! The resulting hash value is used as Bob surrogate. Each bit is a challenge; answers are used as the message signature. Since Fred can search for a hash value such that he knows the answers to the resulting challenges, we need a larger margin than in real time interaction: this is easily provided by hash length, e.g. 128, 160 or 256 bit. Fred sets x j =r j2 v b j mod n, j=1,,& (& is the number of bits of the hash) and searches for m such that h(m x 1 x 2 x & )=[b 1 b 2 b & ] 2 (existential forgery) Overhead can be substantial. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 17 Schnorr s s scheme! Peggy chooses a prime p, a primitive root ' mod p, a random a, 1<a<p 2, computes (=' a mod p and publishes {',(,p}! Peggy chooses a random k, 1<k<p 1, computes ) = ' k mod p and sends ) to Victor.! Victor chooses a random r, 1<r<p 1, and sends it to Peggy! Peggy computes y = k ar (mod p 1) and sends y to Victor.! Victor checks that ) = ' y ( r mod p. ) and y are just random numbers; Victors learns nothing but those numbers. An impostor should guess the right value of y among p 1 alternatives. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 18

Schnorr protocol; ; single run Choose k r (random) Compute x ) = ' r 2k mod np ) (commitment) r (challenge) Choose bit random e (rando) r, 1<r<p 1 Compute y = k ar rs e mod n p y (answer) Check y) 2 = %' xv y ( e r mod np Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 19 Undeniable signatures! Principals are called signer and verifier; usual procedures are Signature generation: by the signer Signature verification: based on challenge-response! A basic aim of such schemes is to involve actively signer into signature verification, so that signed documents cannot be spread and checked out of signer control! Then, the problem arises that the signer could cheat when doing verification and make a valid signature result as a forgery; hence we need a third procedure Disavowal protocol: based on challenge-response; it allows the verifier to check his claim that the signature comes indeed from the signer and the signer to disavow a forged signature If the signer refuses to take part into the disavowal protocol this can be held as evidence that the signature is, in fact, not genuine. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 20

Chaum-van Antwerpen scheme! Let q and p=n q+1 be primes; let '!Z p * be an element of order q and let (=' a mod p, with 1<a<q 1.! Let G denote the subgroup of Z p * generated by ' and let h: {0,1} * *G; then P=A=G and K = {(p,',(,a), ' of order q, (=' a mod p}. Then, for K!K the signature y is generated as follows! Verification is done as follows y = (h(x)) a mod p Verifier chooses e 1,e 2!Z q * at random, computes c=y e 1 ( e 2 mod p (the challenge) and sends to the signer. Signer computes d=c z mod p, with z=a 1 mod q and sends it back Verifier accepts y as a valide signature iff d=(h(x)) e 1 ' e 2 mod p Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 21 Disavowal protocol 1. Verifier chooses e 1,e 2!Z q * at random, computes c=y e 1 ( e 2 mod p (the challenge) and sends to the signer. 2. Signer computes d=c z mod p, with z=a 1 mod q and sends it back to the verifier. 3. Verifier checks that d"(h(x)) e 1 ' e 2 mod p. 4. Verifier chooses f 1,f 2!Z q * at random, computes C=y f 1 ( f 2 mod p (the challenge) and sends to the signer. 5. Signer computes D=C z mod p, with z=a 1 mod q and sends it back to the verifier. 6. Verifier checks that D"(h(x)) f 1 ' f 2 mod p. 7. Verifier concludes that y is a forgery iff (d' e 2 ) f 1=(D' f 2) e 1 mod p. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 22

Scheme pictorial Alice Computes h(x) Reads y Sends challenge c Sends reply d YES Generates e Choose bit 1,e 2 in (1,q) (random) Computes c = y e 1 ( e 2 modp Check d=(h(x)) e 1 ' e 2 modp (x,y) is forged Alice is cheating (d' e 2 ) f 1=(D' f 2) e 1 modp YES NO (x,y) is valid Sends challenge C Sends reply D YES (x,y) is valid Generates f Choose bit 1,f 2 in (1,q) e (random) Computes C = y f 1 ( f 2 modp Check D=(h(x)) f 1 ' f 2 modp Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 23 NO NO Properties! P1 - If y"(h(x)) a mod p, then verifier will accept y as a valid signature of the message x with probability 1/q. This does not depend on any computational assumption, so security is unconditional! P2 - if y"(h(x)) a mod p and verifier and signer follow the disavowal protocol, then it is (d' e 2 ) f 1=(D' f 2) e 1 mod p. This way signer can claim and show that a signature is forged.! P3 - Suppose y=(h(x)) a mod p and verifier follows the disavowal protocol. If d"x e 1 ' e 2 mod p and D"x f 1 ' f 2 mod p, then the probability that (d' e 2 ) f 1" (D' f 2) e 1 mod p is 1 1/q. This way verifier can give evidence that a denied signature is indeed genuine. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 24

Games: flipping coins over the phone! A short cryptological story. Alice and Bob live very far from each other; one day they have to decide who ll take the beautiful house where they used to spend their summers as young guys. Bob phones Alice and says he s going to flip a coin; Alice chooses Heads and Bob says I m sorry, it was Tails. When Alice tells this story to Cindy, her local cryptologist, she suggests a better method could have been used! Alice chooses two large primes, p and q, computes n=pq and sends n to Bob.! Bob chooses a random x and sends y=x 2 mod n to Alice.! Alice computes the four square roots mod n of y, ±x and ±x, chooses one between x and x at random and sends it to Bob! Bob wins if he can factor n by using the received root r and x. Bob computes gcd(x r,n); if r=x, this yields either p or q. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 25 Cautions! Bob has to verify that the received number gives y (mod n) once squared! Alice has no incentive in using n composed with more than two prime factor, i.e. cheating on the fact that actually n be the product of two primes.! The protocol assumes both Bob and Alice wish to win. No way to verify if Bob denies victory willingly with the above protocol. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 26

Bit commitment! Another short cryptological story Alice runs an advanced research center and claims she has an algorithm to predict the winner of the Sunday horse race for sure. Bob is an addicted to betting at horse races and would love to try Alice s method, so he asks Alice to prove her method by giving the forecast for next race. Alice replies she won t disclose the results until Bob pays the predictor fully. So, they re pretty much in a deadlock, until Cyrus, the local cryptologist, hears about this matter and suggests a method! Alice commits to one bit of information with Bob yet Bob cannot learn that bit until proof time comes! The bit b is set as the k-th most significant bit of a given binary string S (otherwise chosen by Alice at will); Alice computes H=h(S) and sends H to Bob! When proof time comes, Alice sends S to Bob To break commitment Alice should solve a collision problem with h( ) Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 27 A wrong scheme! The bit b is set as the k-th most significant bit of a given binary string S (otherwise chosen by Alice at will); Alice computes C=E K (S) and sends C to Bob! When proof time comes, Alice sends K to Bob, so that he can compute S=D K (C) and check the k-th bit of S.! Q. With this procedure, Alice can cheat. Why is that feasible? A. Given C and bit b, Alice searches for two keys K and K such that the k-th bit of D K (C) is the complement of the k-th bit of D K (C). This is easy, since bits change w.p. 1/2 when key is changed. Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 28

Dual signatures! Used in SET (Secure Electronic Transactions) Started by MasterCard and Visa, 1996! Three parties Purchaser Merchant Bank! Basic issue: P does not want M to get his payment information (e.g. credit card credentials) P does not want B to know what is being bought Yet payment should be tied to purchase order. M P B Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 29 Definitions! H = public hash function! E X = public key encryption function of party X (X=P,M,B)! D X = decryption function of party X (X=P,M,B)! GSO = Goods and Services Order Purchaser (cardholder) and merchant names Description of items/services being sold! PI = Payment Instructions Merchant s name, price paid, details of payment Credit card data Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 30

Protocol schematic GSOMD=H(E M (GSO)) PIMD=H(E B (PI)) POMD=H(PIMD GSOMD) DS=D P (POMD) DS, E B (PI), E M (GSO) Check E P (DS) = H(H(E B (PI)) H(E M (GSO))) If OK, get PI=D B (E B (PI)) DS, E B (PI), E M (GSO) E M (auth D B (auth)) E P (rcpt D M (rcpt)) Check E P (DS) = H(H(E B (PI)) H(E M (GSO))) If OK, get GSO=D M (E M (GSO)) Andrea Baiocchi, DIET, Università di Roma Sapienza - Sicurezza nelle Comunicazioni - A.A. 2013-2014 31