1 / 12

Understanding Digital Signatures: RSA, Security, and Non-Repudiation

This resource explores digital signatures, focusing on RSA signatures, their security, and the concept of non-repudiation. It outlines key elements of digital signature schemes, including key generation, signing algorithms, and verification. The document compares digital signatures to traditional signatures used in contracts, emphasizing their importance in the digital world. It also addresses mechanisms like Message Authentication Codes and their relationship to non-repudiation. Students will learn how to securely sign and verify messages and understand the implications of signature validity in electronic transactions.

earl
Télécharger la présentation

Understanding Digital Signatures: RSA, Security, and Non-Repudiation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CryptographyCS 555 Topic 21: Digital Schemes (1) Topic 21

  2. Outline and Readings • Outline • Digital signature • RSA signatures • Hash and sign • Readings: • Katz and Lindell: Chapter 12.1-12.4 Topic 21

  3. Digital Signatures: The Problem • Consider the real-life example where a person pays by credit card and signs a bill; the seller verifies that the signature on the bill is the same with the signature on the card • Contracts are valid if they are signed. • Signatures provide non-repudiation. • ensuring that a party in a dispute cannot repudiate, or refute the validity of a statement or contract. • Can we have a similar service in the electronic world? • Does Message Authentication Code provide non-repudiation? Why? Topic 21

  4. Digital Signatures • MAC: One party generates MAC, one party verifies integrity. • Digital signatures: One party generates signature, many parties can verify. • Digital Signature: a data string which associates a message with some originating entity. • Digital Signature Scheme: • a signing algorithm: takes a message and a (private) signing key, outputs a signature • a verification algorithm: takes a (public) verification key, a message, and a signature • Provides: • Authentication, Data integrity, Non-Repudiation Topic 21

  5. Digital Signature • A signature scheme consists of the following three PPT algorithms • (pk,sk) Gen(1n) key generation •  Signsk(m) signing • b := Vrfypk(m,t) verification algorithm b=1 meaning valid, b=0 meaning invalid Must satisfy (pk,sk)mVrfypk(m, Signsk(m)) = 1 Assume that receiver has an authentic copy of the sender’s public key, then receiver can verify that a document is indeed sent by the sender. Topic 21

  6. Security of Signature Schemes • The experiment Sig-forgeA, • (pk,sk) Gen(1n) • Adversary A is given pk and oracle access to Signsk() • Adversary outputs (m, ). Let Q denote the set of all queries that A asked to the oracle. • Adversary wins if Vrfypk(m,t) = 1 and m  Q • A signature  is existential unforgeable under an adaptive chosen-message attack (or just secure) if for all PPT A, there exists a negligible function negl such that Pr[Mac-forgeA,=1]  negl(n) Topic 21

  7. “Textbook RSA” Signatures Key generation (as in RSA encryption): Public key: (e, n) used for verification Private key: d, used for generation Signing message m with private key • Compute  = md mod n Verifying signature  using public key (e, n) • Check whether e mod n = m Topic 21

  8. Insecurity of “Textbook RSA” • A no-message attack • Choose arbitrary , compute m= e mod n • (m,) is a valid pair • One cannot control what is m • Forging signature on arbitrary message • To forge signature on message m, query signing oracle for m1 (obtaining 1) and m2=m/m1 (mod n) (obtaining 2) • (m, 1 2) is a valid pair Topic 21

  9. RSA Signatures with Hash Use a hash function H: {0,1}* Zn* Signing message m with private key (n,d) • Compute  = H(m)d mod n Verifying signature  using public key (e, n) • Check whether e mod n = H(m) Can be proven secure assuming that H is random oracle. (This is not considered a valid proof of security, but means that no known attack exists.) Topic 21

  10. Hash and Sign Paradigm • Enabling the signing of arbitrary long message. • Given a secure signing scheme (for a fixed message space), and a collision-resistant hash function, first hash and then sign is also secure. • “Textbook RSA” is insecure, so this result does not apply to hash and sign with RSA • Any attack either finds a collision or breaks the security of the signing scheme. Topic 21

  11. Non-repudiation • Nonrepudiation is the assurance that someone cannot deny something. Typically, nonrepudiation refers to the ability to ensure that a party to a contract or a communication cannot deny the authenticity of their signature on a document or the sending of a message that they originated. • Can one deny a signature one has made? • Does email provide non-repudiation? Topic 21

  12. Coming Attractions … • Other Signature Schemes • Reading: Katz & Lindell: Chapter 12.5,12.7 Topic 21

More Related