Sebery J.Cryptography.An introduction to computer security.1989

The result equals to the message m = 67 so the signature is considered to be valid.

10.3.2 ElGamal Threshold Signatures

The scheme we present is due to Li, Hwang, and Lee [304]. The signature scheme is set up by a trusted dealer, Don who on behalf of the group P = fP1; : : : ; Png, sets up the scheme. The scheme allows to sign a message by every subset B P of t participants (cosigners).

Don rst chooses a collision-resistant one-way function H, a big enough prime modulus p (say bigger than 512 bits) and a large prime divisor q of p 1 (q should be not smaller than 160 bits). Also Don selects at random a

generator g of the cyclic group of order q. Next, Don determines a polynomial f(x) = a0 + a1x + : : : + at 1xt 1 with ai 2R GF (q).

The group secret is k = f(0) and the group public key is y = gk mod p. The shares are

si = ui + f (xi)

where ui 2R GF (q) n 0 and coordinates xi are public (i = 1; : : : ; n). Further Don calculates public elements associated with each participant Pi 2 P. They are yi gsi mod p and zi gui mod p. The parameters (H; p; q; g; y) together with f(yi; zi) j Pi 2 Pg are public and accessible for authentication purposes from White Pages.

Having their (si; ki), Pi generates their partial signature:

372 10 GROUP ORIENTED CRYPTOGRAPHY

If all partial signatures are genuine, Clara creates the signature as:

Next, Victor looks up White Pages for the public parameters of the group and checks:

(t; n) ElGamal threshold signature

Initialization: 1. The dealer selects: a collision-resistant hashing algorithm H, a prime modulus p with its prime factor q, the generator g of a cyclic group of order q and the polynomial f(x) of degree at most (t 1) with public coordinates associated with each Pi 2 P.

2. The secret of the group is k = f(0). The public key of the group is y gk mod p. The shares assigned to participants are si = ui + f(xi).

3. Don publishes (H; p; q; g; y) together with f(yi; zi) j Pi 2 Pg where yi gsi mod p and zi gui mod p.

Signing: 1. Each active participant Pi chooses a secret key ki q 1 and computes ri gki mod p. The element ri is broadcast.

2. Once the active subset B P is known, each participant Pi 2 B computes R and E according to Congruences (10.8) and (10.9), respectively.

3.Pi computes his partial signature ci by using Equation (10.10) and sends (m; ci) to the combiner.

4.The combiner, Clara, veri es the partial signatures by checking Congruence (10.11). If the congruence holds for all participants, she computes

= PPi2B ci mod p. The triple (B; R; ) is the signature of m. Veri cation: A veri er, Victor, checks whether

~

where T is de ned by Congruence (10.12) and E by (10.13). If the check is true the signature is accepted.

The veri er accepts always a genuine signature. This observation ows from the following sequence of congruences:

The scheme has some interesting properties:

{The signature is not anonymous. The currently active subset B must be known to a veri er and the speci cation of B is attached to the signature. That is why the signature resembles a multisignature.

{Partial signatures ci can be veri ed by a combiner. This allows to detect and disregard faulty partial signatures.

{The length of the string is determined by the value of prime q and is no longer than 160 bits.

Security depends on the intractability of discrete logarithm. Some possible attacks are discussed in [304]. Also the authors studied a variant of their signature, which works with no dealer.

10.3.3 Threshold DSS Signatures

Gennaro, Jarecki, Krawczyk, and Rabin designed a threshold DSS signature in [197]. Recall that the regular DSS signature was described in Section 7.4. The signature uses two prime moduli: p and q where q is a large enough factor of (p 1). The integer g 2 GF (p) is an element of order q. The secret key is k (1 k q) and the public key is = gk. Elements ( ; g; p; q) are public. To generate a signature for a message m, the signer picks up a random integer r

374 10 GROUP ORIENTED CRYPTOGRAPHY

(1 r q) and computes x (gr 1 mod p) mod q and y = r(m + k x) mod q. The signature of m is the pair (x; y). Note a slight modi cation in the de nition of x for which we use r 1 instead of prescribed r. To verify the triple (m;~ x;~ y~),

Before we describe a distributed version of DSS signature scheme, we show how to compute r 1 mod q collectively by participants P = fP1; : : : ; Png when they know shares of r (each Pi knows their share ri). To simplify our notation, we are going to use

(t;n)

(r1; : : : ; rn) $ r

to indicate that integer r is shared by P with the threshold t. The algorithm for computing reciprocals of r when its shares are distributed among participants from P, is:

1. Participants collectively generate a (t; n) secret sharing of a random element

a 2 Zq. In other words, each participant Pi selects a random polynomial Æi(x) of degree at most (t 1) and sends corresponding shares via secret channel to the rest of participants so every Pj gets Æi(xj) (i 6= j). The polynomial A(x) = Pni=1 Æi(x) de nes our requested (t; n) secret sharing

(t;n)

2. Participants collectively generate a (2t; n) secret sharing of 0, that is, each

with A(0) = a and shares aj = A(xj) = Pni=1 Æi(xj), or (a1; : : : ; an) $ a.

participant Pi selects a random polynomial Æi(x) (such that Æi(0) = 0) of

requested (2t; n) secret sharing, and each Pi holds the share bi = B(xi).

(2t;n)

Shortly, (b1; : : : ; bn) $ 0.

3. Participants broadcast their values riai + bi, and each participant recreates the value = ra. Observe that assuming that R(x) is the polynomial that distributes r among P, then the polynomial R(x)A(x) + B(x) becomes ra for x = 0.

4. Pi computes 1 in GF (q) and sets their share ui 1ai. It can be shown

that (u1; : : : ; un) (t;n$) r 1.

An algorithm for a distributed DSS signature is described below. The signature is secure under the assumption that the opponent is passive (can eavesdrop only) and can prevent up to a third of participants to collaborate in the signing process. To simplify the description, we call Joint-Shamir-RSS a protocol

in which all participants collectively generate a (t; n) Shamir secret sharing

with a random secret. Each participant Pi chooses their random polynomial Æi(x) = di;0 + di;1x + : : : + di;t 1xt 1 where di;j 2R GF (q). Each Pi communicates secretly shares of the polynomial Æi(x) to other participants. Finally, the

We denote Joint-Zero-SS a protocol similar to Joint-Shamir-RSS except for all participants select their polynomials such that Æi(0) = 0.

$b and (c1; : : : ; cn) $ c:

3.Participants jointly compute x = gr 1 mod q.(b1; : : : ; bn)

(a) Participants collectively execute Joint-Shamir-RSS so

(t;n)

$a: a

(b)Participant Pi broadcasts vi riai + bi mod q and wi g i mod p. The elements vi; wi are public for i = 1; : : : ; n.

(c)Pi calculates the secret = ra mod q using the Lagrange in-

terpolation of (v1; : : : ; vn). Similarly, Pi computes ga mod p using (w1; : : : ; wn). Clearly, x (ga) 1 mod p mod q. The rst part of

signature x is published.

4. Participants collectively calculate y r(m + k x) mod q.

(a) Pi broadcasts yi ri(m + kix) + ci mod q. Note that

(2t;n)

(y1; : : : ; yn) $ y = r(m + kx):

;n.

5.The signature of message m is (x; y).

Veri cation: Proceeds as in the regular DSS signature. To verify the triple (m;~ x;~ y~), Victor checks whether

376 10 GROUP ORIENTED CRYPTOGRAPHY

The above signature tolerates up to (t 1) lost shares with the total number of n 2t + 1 participants.

A version of the threshold DSS signature that allows to sign messages in the presence of malicious opponents, is described in [197].

10.4 Problems and Exercises

1. Given a (2; 3) conditionally secure Shamir scheme over GF (23) with f(x) where Pi is assigned xi = i for i = 1; 2; 3. Assume some primitive element g 2 GF(23) and take s1 = f(1) = 4 and s2 = f(2) = 19. What is the missing s3? Retrieve the secrets k = f(0) and k0 = gk. Show how the computation of k0 can be done when participants pool their transient shares gsi .

2.Design a (2; 3) conditionally secure Shamir scheme over GF (23 ). Show the reconstruction process of the secret when transient shares are pooled by participants.

3.Feldman [171] suggested a noninteractive veri cation of shares for a (t; n) Shamir scheme with the polynomial f(x) = a0 +a1x+: : :+at 1xt 1 over GF (p) such that p = q+1 ( is

small integer while q is a large prime). The dealer after distribution of shares si = f(xi) to the corresponding participants via secret channels, broadcasts public elements gai mod p

for i = 0; 1; : : : ; t 1. Show how Pi can use their secret si together with the public information to verify the consistency of the share with the public information.

4.Prove that the noninteractive veri cation of shares in Section 10.1.3 fails with a negligible probability.

5.The concept of proactive secret sharing employs a protocol that allows participants to jointly share 0. First each participant Pi generates their own random polynomial Æi(x)

such that Æ(0) = 0. Next Pi plays a role of the dealer and distributes shares Æi(xj) to

6. Given the modular secret sharing. Demonstrate how participants can collectively share "0" by random selection of individual schemes and by distribution of the corresponding shares via secret channels to other participants. Generalize the concept for any linear code.

7. Consider the sequence of threshold schemes indexed by their polynomials ff`(x) j ` = 1; 2; : : :g in the proactive secret sharing. Discuss the perfectness of secret sharing for consecutive periods of time.

8. A (3; 5) Shamir secret sharing is de ned by the polynomial f(x) = 38 + 57x + 112x2 over GF (131) with public coordinates assigned in typical way xi = i for i = 1; 2; 3; 4; 5. Assume that an active set of participants is B = fP2; P3; P5g. Compute shares si and corrections bi for i = 2; 3; 5. Show encryption and (3; 5) ElGamal threshold decryption by the active set B for q = 263, p = 131 and g = 166 (g is an element of order 131).

9.Consider an instance of (3; 4) ElGamal threshold decryption scheme. Public computations should be performed over GF (23) while secret computations (including secret sharing) should be executed modulo p = 7. Make all necessary assumptions.

10.In the ElGamal threshold decryption, the nal retrieval of message from a cryptogram is

done by the combiner. Discuss how the combiner can handle participants who instead of the prescribed grsi, have sent grsibi.

11.In Section 10.2.2, the RSA threshold decryption is presented for small parameters where the modulus N = 253 and any 3 out of 4 participant can decrypt jointly a cryptogram. Show how the following active sets B can decrypt the cryptogram when

{B = fP2; P3; P4g,

{B = fP1; P2; P3g,

{B = fP1; P2; P4g.

12.Design an instance of the RSA threshold decryption where every 2 out of 5 participants can jointly decrypt a cryptogram. Select two strong primes p and q smaller than 100. Make necessary assumptions.

13.The RSA threshold decryption uses the Shamir secret sharing to allow to construct any (t; n) threshold decryption. The system can be considerably simpli ed for (n; n) threshold decryption. Modify the general (t; n) RSA threshold decryption for the case when t = n. Hint. Apply the Karnin-Greene-Hellman secret sharing.

14.Reconsider the example from Section 10.3.1 Show how the combiner assembles the signature for the active sets

{B = fP2; P3; P4g,

{B = fP1; P2; P3g,

{B = fP1; P2; P4g.

15.Simplify the ElGamal threshold signature when t = n by using the Karnin-Greene- Hellman secret sharing.

11 KEY ESTABLISHMENT PROTOCOLS

So far we have tacitly assumed that all cryptographic algorithms can be readily used assuming that a suitable collection of secret and public keys is already distributed and known to the parties. For instance, secrecy systems based on secret key encryption require the same key to be shared by both the sender and receiver. In this chapter we focus our attention on how keys that are needed to enable cryptographic protection can be exchanged among the parties. The key establishment becomes a major hurdle in computer networks with many users. To show the scale of the problem, assume that a computer network encompasses n users. If we allow any pair of users to communicate in a secure way using private key encryption, then we may need to generate and distribute

n! = n(n 1) 2 2

di erent keys. If some network (cryptographic) services involve more than two users (for example a secure conferencing with i users where i = 2; : : : ; n), the number of possible keys to be distributed can grow exponentially in n as

n

2n = X

i=0

If we cannot pre-distribute keys, then we have to establish them on request whenever there is a collection of parties who want to share the same key.

There are two major categories of key establishment protocols,

{key transport protocols and

{key agreement protocols.

In the rst category, there is, typically, a trusted authority T A (also called a server) that generates the requested key material and distributes it among the parties. This category is also called key distribution protocols. The important ingredient of any T A is trust. For our purposes, trust can be translated into

380 11 KEY ESTABLISHMENT PROTOCOLS

an assumption that a T A will follow the course of action prescribed by the key distribution protocol and will not divulge any secret information to unauthorized users. In particular, we exclude any hostile activity by a T A towards any user. Also any potential attacker is not able to corrupt or collude with T A.

Normally, in key agreement protocols, a key is established collectively as a result of some prescribed interaction among the parties involved in the protocol. This is the class of decentralised key establishment protocols where there is, typically, no need for a trusted authority to generate and distribute cryptographic keys.

The design of key establishment protocols has to be done with extreme caution mainly because the interaction is being done via an insecure public network. Usually the interaction involves the transmission of several messages or protocol passes. It is assumed that a potential attacker can

{record messages and replay them later,

{change their order,

{modify a part or the whole message,

{repeat some messages,

{delete some messages.

Apart from an abundance of potential threats, large computer networks provide no global public trusted read-only registry (White Pages), which could be used to verify identities of the parties involved. The parties are usually called principals. A principal is understood to be any active entity. So it can be a user, a computer process, a terminal, a node in computer network, etc.

The main goal of key establishment protocols is to enable two or more principals to obtain some cryptographic key. Some other desirable goals may include

{key freshness,

{entity authentication,

{key con rmation,

{implicit key authentication, and

{explicit key authentication.

A key is fresh if it has never been generated and used before. Entity authentication is a corroboration process that allows one principal to correctly identify the other involved in the protocol. Typically, it allows a party to check whether the other party is active (alive) at the time when the protocol is being executed.