Internet.Security

Figure 5.7 Schnorr’s authentication scheme.

To verify x ≡ ay · λt (mod p) ≡ 13, compute:

x≡ (34)(415) (mod 23)

≡ 12 × 3 (mod 23) ≡ 13

Since ar (mod p) ≡ ay λt (mod p) ≡ 13, the authentication is accepted.

5.4.2Schnorr’s Signature Algorithm

For a digital signature, user A concatenates the message m and x and computes the hash code:

h ≡ H (m||x)

User A sends the signature (h, y) to user B. User B computes z ≡ ay λh (mod p) and confirms whether hashing the concatenation of m and z yields:

h ≡ H (m||z)

If h = h , then user B accepts the signature as valid.

For the same level of security, Schnorr’s signature algorithms are shorter than RSA ones. Also, Schnorr’s signatures are much shorter than ElGamal signatures. Figure 5.8 and Table 5.9 illustrate Schnorr’s signature algorithm.

Figure 5.8 Schnorr’s signature scheme.

Table 5.9 Schnorr’s signature algorithm

Preprocessing stage and the two key pair are the same.

then user B accepts the signature as valid

(mod p) such that 7 ≡ 823 543 ≡ 1 (mod 29). Pick a private key s = 4 such that s < q and compute the public key as follows:

λ≡ a−s (mod p)

≡ 7−4 (mod 29) ≡ 24

User A:

Choose a random number r = 5 < q and then compute:

x ≡ ar (mod p)

≡ 75 (mod 29) ≡ 16

Concatenate m and x and hash m||x such that h ≡ H (m||x) = H (12 345||16)

where the message m = 12 345 is assumed., To produce the message digest h = H (m||x), use the Secure Hash Algorithm (SHA) which is closely modelled on MD4. Utilising SHA for h yields a 160-bit message digest as the output, as follows:

h ≡ H (m||x) (mod q) ≡ H (12 345||16) (mod 7)

=a11784b83ea003cd66491c7e1de07296d9d9242c (hexadecimal)

=919671992759145855242593220263016201851705566252

(mod 7) (decimal)

≡ 5

User A computes y ≡ r + sh (mod q):

y ≡ (5 + 4 × 5) (mod 7) ≡ 25 (mod 7) ≡ 4

Send signature (h, y) = (5, 4) to user B. User B first computes: z ≡ ay · λh (mod p)

≡74 × 245 (mod 29)

≡(23 × 7) (mod 29)

≡16

Concatenate m = 12 345 and z and hash it as follows: h ≡ H (m||z) (mod q)

≡H (12 345||16) (mod 7)

≡5

which is identical to h. Therefore, user B accepts the signature as valid because h = h . The next example demonstrates how to solve the problem, making use of the MD5 algorithm in order to compute the 128-bit message digest. The source code of the MD5

program can be obtained from ftp.funet.fi:/pub/crypt/hash/mds/md5.

Example 5.13 If two primes p = 23 and q = 11 are given, then a = 9 is determined. Choose a private key s = 4, a random number r = 7 and the message m = 135.

x ≡ ar (mod p)

≡ 97 (mod 23) ≡ 4

Using the MD5 algorithm, compute the message digest:

h≡ H (m||x) (mod q)

≡H (135||4) (mod 11)

h≡ af 4732711661056eadbf 798ba191272a (hexadecimal)

≡232984575419504758889249578349365372714 (mod 11)

≡0

Using h = 0, y ≡ r + sh (mod q) becomes y ≡ 7 (mod 11).

Send the signature (h, y) = (0, 7) to user B.

User B

When user B receives the signature (h, y), compute:

z≡ ay λh (mod p)

≡ 97 (mod 23) ≡ 4

Applying MD5 to h ≡ H (m||z) (mod q) ≡ H (135||4) (mod 11), we have

h = af 4732711661056eadbf 798ba191272a

Thus, user B confirms verification of h (mod 11) ≡ h (mod 11) ≡ 0.

5.5 Digital Signature Algorithm

In 1991 The National Institute of Standards and Technology (NIST) proposed the Digital Signature Algorithm (DSA) for federal digital signature applications. The proposed new Digital Signature Standard (DSS) uses a public-key signature scheme to verify to a recipient the integrity of data received and the identity of the sender of the data.

DSA provides smartcard applications for digital signature. Key generation in DSA is faster than in RSA. Signature generation has the same level of speed as RSA, but signature verification is much slower than RSA.

Many software companies, such as IBM, Microsoft, Novell and Apple, that have already licenced the RSA algorithm, protested against the DSS. Many companies wanted

NIST to adopt ISO/IEC 9796 for use instead of RSA as the international digital signature standard.

The DSA is based on the difficulty of computing discrete logarithms, and originated from schemes presented by ElGamal and Schnorr. The public key consists of three parameters, p, q and g, and is common to a group of users. Choose q of a 160-bit prime number and select a prime number p with 512 < p < 1024 bits such that q is a prime factor of p − 1. Next, choose g > 1 to be of the form h (p−1)/q (mod p) such that h is an integer between 1 and p − 1.

With these three numbers, each user chooses a private key x in the range 1 < x < q − 1 and the public key y is computed from x as y ≡ gx (mod p). Recall that determining x is computationally impossible because the discrete logarithm of y to the base g (mod p) is difficult to calculate.

To sign a message m, the sender computes two parameters, r and s, which are functions of (p, q, g and x), the message digest H (m), and a random number k < q. At the receiver, verification is performed as shown in Table 5.10. The receiver generates a quantity v that is a function of parameters (x, y, r, s−1 and H (m)).

When a one-way hash function H operates on a message m of any length, a fixedlength message digest (hash code) h can be produced such that h = H (m). The message digest h to the DSA input computes the signature for the message m. Signing the message digest rather than the message itself often improves the efficiency of the signature process, because the message digest h is usually much smaller than the message m. The SHA is called secure because it is designed to be computationally impossible to recover a message corresponding to a given message digest. Any change to a message in transit will result in a different message digest, and the signature will fail to verify. The structure of the

Sender: (signing)

Choose k = 5 such that k < q = 11 and compute the signatures (r, s) as follows:

r≡ (gk mod p) (mod q)

≡ (35 mod 23) (mod 11) ≡ 13 (mod 11) ≡ 2

Assume that h = H (m) = 10 and compute:

s≡ k−1 (h + xr) (mod q)

≡ 5−1 (10 + 7 × 2) (mod 11) ≡ (9 × 24) (mod 11) ≡ 216 (mod 11) ≡ 7

where the multiplicative inverse k−1 is:

k · k−1 ≡ 1 (mod q)

5k−1 ≡ 1 (mod 11) from which k−1 = 9

Receiver: (verifying)

Compute:

w≡ s−1 (mod q)

≡ 7−1 (mod 11) ≡ 8

u1 ≡ (h × w) (mod q)

≡ (10 × 8) (mod 11) ≡ 3 u2 ≡ (r × w) (mod q)

≡(2 × 8) (mod 11) ≡ 5

v ≡ ((gu1 × yu2) mod p) (mod q)

≡((33 × 25) mod 23) (mod 11)

≡(864 (mod 23)) (mod 11) ≡ 13 (mod 11) ≡ 2

Since v = r = 2, the signature is verified.

5.6 The Elliptic Curve Cryptosystem (ECC)

The Elliptic Curve Cryptosystem (ECC) was introduced by Neal Koblity and Victor Miller in 1985. The elliptic curve discrete logarithm problem appears to be substantially more difficult than the existing discrete logarithm problem. Considering they have equal levels of security, ECC uses smaller parameters than the conventional discrete logarithm systems.

In this section we first present the concept of an elliptic curve and then discuss its applications to existing public-key algorithms. Finally, we will look at cryptographic algorithms with elliptic curves over the prime or finite fields.

5.6.1 Elliptic Curves

Elliptic curves (ECs) have been studied for many years. Elliptic curves over the prime field Zp or the finite field GF(2n) are particularly interesting because they provide a way of constructing cryptographic algorithms. ECs have the potential to provide faster public-key cryptosystem with smaller key sizes.

Elliptic curves over prime field Zp

Figure 5.10 shows the elliptic curve y2 = x3 + ax + b defined over Zp where a, b Zp · Zp is called a prime field if and only if p > 3 is an odd prime. An elliptic curve (EC) can be made into an abelian group with all points on an EC, including the point at infinity O under the condition of 4a3 + 27b2 = 0 (mod p). If two distinct points P (x1, y1) and Q(x2, y2) are on an elliptic curve, the third point R is defined as P + Q = R(x3, y3) (see Figure 5.10). The third point R is defined as follows: first draw a line through P

Figure 5.10 An elliptic curve.

and Q, find the intersection point −R on the elliptic curve, and finally determine the reflection point R with respect to the x-axis, which is the sum of P and Q. If P (x, y) is a point on an elliptic curve (EC), then P + P = R(x3, y3) (double of P ) is defined as follows: first draw a tangent line to the elliptic curve at P . This tangent line will intersect the EC at a second point (−R). Then R(x3, y3) is the reflection point of −R with respect to the x-axis, as depicted in Figure 5.11. If P (x, y) = O, it is defined as −P (x, −y). Hence if Q = −P , it satisfies P + Q = O. Since all arithmetic operations are written additively, P + P = 2P = O because slope {P (xi , 0)} x-axis when yi = 0.

points P (x1, y1), Q(x2, y2) and R(x3, y3) = P + Q, the following theorems will hold:

1.When P = Q, x3 = α2 − x1 − x2, y3 = −y1 + α (x1 − x3) when α = (y2 − y1)/(x2 − x1). Consider the linear curve y = αx + λ passing through the points P and Q. Then

ficients. Thus it proves to be:

y

−R

P = Q

x

R

Figure 5.11 The doubling of an elliptic curve point.