Sebery J.Cryptography.An introduction to computer security.1989

3. A ! B : fB; rB gk.

where fA; rA; rBgk is the cryptogram for message (A; rA; rB ) under the key k.

The protocol works as follows. First, A sends her challenge to B in clear. In response, B takes the name of A, her challenge rA, and concatenates it with his challenge rB. The triplet is encrypted using the key k. The cryptogram fA; rA; rB gk is sent to A. A decrypts the cryptogram, retrieves the pair of nonces and checks whether the second element is equal to her nonce rA. If there is a match, A knows that B holds the same key. Now, A encrypts B's challenge and forwards fB; rBgk to B. Now B veri es the validity of A's response by rst checking whether there is B in it and next comparing the nonce recovered from the cryptogram with the original rB. If there is a match, B is convinced that A applied the correct key for encryption so she knows the key. The security of the challenge-response protocol depends on the length of the key k, strength of the encryption algorithm, and freshness of the challenges. The protocol can be easily adopted for an unilateral authentication where A authenticates B only.

The encryption algorithm can be replaced by any one-way function including a collision-free hash function. If both A and B decide to used the same hash function h, then the message exchange in the above protocol may proceed as follows:

1.A ! B : rA.

2.B ! A : rB; h(A; rA; rB ; k).

3.A ! B : h(k; B; rB ; rA).

A rst communicates rA to B in clear. B hashes the tuple A; rA; rB; k and forwards the pair (rB; h(A; rA; rB ; k)) to A. A veri es the hash value and sends h(k; B; rB ; rA) to B. Note that A changes the order of elements to make the protocol immune against the replay attack.

13.4.2 Authentication of Public Keys

Suppose that A and B know each other's authentic public key. So A knows KB and B knows KA. Clearly, A has to know her own secret key kA and B has to know his secret key kB. Assume that they wish to verify whether the other entity indeed holds the corresponding secret key. Note that a public key cryptosystem can be used for con dentiality or authenticity (signature). A challenge-response

442 13 IDENTIFICATION

protocol for unilateral authentication of B by A when B uses his public key for con dentiality is described below.

Challenge-response protocol (public encryption)

Goal: A identi es B by checking whether B holds the secret key kB that matches his public key KB.

Assumptions: A chooses a random challenge (nonce) rA. B applies his public key system for con dentiality.

Message Sequence: The protocol consists of the following sequence of messages:

1. A ! B : [rA; A]KA . 2. B ! A : rA.

where [rA; A]KA stands for cryptogram of (rA; A) obtained using the key

KB .

A knowing the public key of B encrypts her nonce rA together with her name A and sends the cryptogram to B. Only B can recover the nonce and the name of A from the cryptogram. B communicates rA to A. If the returned nonce is equal to rA, A accepts that she is dealing with B.

The protocol needs some modi cations when B uses his public key cryptosystem for authentication.

Challenge-response protocol (authentication)

Goal: A identi es B by checking whether B holds the secret key kB that matches the public key KB.

Assumptions: A chooses a random challenge (nonce) rA, B uses his random nonce rB. B applies his public key system for authentication.

Message Sequence: The protocol consists of the following sequence of messages:

1.A ! B : rA.

2.B ! A : rB; hrA; rBikB .

A sends her random challenge to B. B takes a fresh nonce rB and signs the pair. The signature hrA; rBikB is sent to A who veri es its validity in the usual way. Note that the nonce rB may not need to be transmitted in clear if the signature hrA; rBikB allows the recovery of the message.

13.5 Identi cation Protocols

Recall that zero-knowledge proof systems considered in Chapter 12 allow the prover P to demonstrate to the veri er V the knowledge of her secret without revealing any information about it. Clearly, they are ideal vehicles for identi - cation. Note that a direct use of a zero-knowledge proof system allows unilateral authentication of P (Peggy) by V (Victor) and the identi cation protocol will need to consist of a large enough number of iterations. The completeness, soundness, and zero-knowledge properties de ned for interactive proof systems, have their own interpretation in the context of identi cation. An identi cation protocol is complete if a legitimate prover (who follows the protocol) is always correctly identi ed by V . In other words, the probability of false rejection is zero. An identi cation protocol is sound if the veri er detects an impostor with an overwhelming probability. This can be translated into the requirement that the probability of false acceptance be 2 t, where t is the number of iterations. A zero-knowledge identi cation protocol reveals no information about the secret held by the prover under some reasonable computational assumptions.

In this section we are going to discuss the Fiat-Shamir identi cation protocol and its more eÆcient variant given by Feige, Fiat, and Shamir. We next study an identity-based identi cation protocol by Guillou and Quisquater. Schnorr presented very eÆcient identi cation protocol designed especially for smart card applications. We describe the Schnorr scheme together with its variant given by Okamoto. Other identi cation protocols not discussed here include several variants based on error correcting codes [491, 94]. One of more exotic intractable problems used to design identi cation protocols is an NPC problem from learning machines, called the perceptrons problem [410].

13.5.1 Fiat-Shamir Identi cation Protocol

Fiat and Shamir [182] designed an identi cation protocol whose security hinges on the assumption that nding square roots modulo N is diÆcult provided the factorization of N is unknown. This is equivalent to the diÆculty of factoring N. The FS protocol is described as follows.

FS identi cation protocol

TA Precomputations: A trusted authority T A holds its public modulus N where N = pq and primes p and q are secret.

444 13 IDENTIFICATION

Registration: P selects her secret s 2R Z . P registers the integer s2

N

(mod N) with T A as her public identi cation information.

Message Sequence: P proves to V that she knows the secret s by performing

the following iterations t times:

1. P ! V : u r2 mod N where r 2R Z .

N

2. V ! P : b 2R f0; 1g.

3. P ! V : v r sb mod N

4. Veri cation: V checks whether v2 ? u b mod N:

V stops on failure or continues otherwise. After t successful iterations V accepts.

T A keeps identi cation information of all registered users. The registration of P has to be performed at the setup stage. Registration has to proceed after the mutual authentication of T A and P, which is typically done by physical exchange of their credentials (passports, identi cation cards with photos, etc.). This step is crucial from a security point of view.

Assume that a veri er V would like to make sure that P is indeed the same person whose public information is published by T A. V asks P to prove herself to him. The identi cation protocol takes t iterations. Each iteration is independent of the other in the sense that an iteration starts from selection of a random r by Peggy, who then squares it and forwards the commitment u to Victor. Next, V chooses his binary challenge b and communicates it to P . Peggy replies by sending v = r sb. Finally, Victor squares the response v and veri es whether the result is equal to u b. If the check fails, V stops and rejects P 's identity, otherwise the protocol continues. If P and V passed t iterations without rejection, then V accepts P .

An impostor, Oscar, may cheat Victor if he is able to guess his binary challenge. Let g 2 f0; 1g be Oscar's guess of Victor's challenge. Oscar selects at random r and sends his commitment

u r2 g mod N:

Victor replies by sending his challenge b 2R f0; 1g. Oscar now has to dispatch

sb g mod N as he needs to know either s or s 1. So he will fail each iteration with probability 1=2. If the protocol is run for t iterations, Oscar is detected as an impostor by Victor with probability 1 2 t. The probability of false acceptance is 2 t.

Consider an example. T A has published the modulus N = 46161041 (p = 4787 and q = 9643). The prover has selected her secret s = 21883917 and registered her public information = s2 25226214 (mod 46161041). The identi cation protocol runs t times. At each run, P selects at random r. Let it be r = 41435437 in the rst round. P sends her commitment

P ! V : u = r2 6360246 (mod 46161041):

V replies by sending his random challenge b = 1. P sends response P ! V : v = rs 39085596 (mod 46161041):

V checks whether v2 42178320 (mod 46161041) is equal to u 42178320 (mod 46161041). Indeed two integers are the same, so P continues the protocol.

13.5.2 Feige-Fiat-Shamir Identi cation Protocol

The FS identi cation protocol requires a large number of iterations consequently the identi cation process is slow and computationally expensive for both the prover and veri er. Feige, Fiat, and Shamir came up with a more eÆcient protocol [168]. The security of the protocol relies on the assumption that factoring is diÆcult.

FFS identi cation protocol

TA Precomputations: T A holds its public modulus N where N = pq and primes p 3 mod 4 and q 3 mod 4 are kept secret.

Registration: P performs the following steps:

1.selects at random ` integers s1; : : : ; s` 2R ZN ,

2.chooses a binary vector (e1; : : : ; e`) at random,

( 1)ei si 2 (mod N) for i = 1; : : : ; `,

4.registers (w1; : : : ; w`) with T A as P 's identi cation public information while keeping integers (s1; : : : ; s`) secret.

After t successful iterations, V accepts.

Oscar who would like to impersonate P, can succeed if he can guess V 's challenge. Denote Oscar's guess by (g1; : : : ; g`). Oscar generates a random r 2R ZN and sends his commitment modi ed according to the guessed challenge (g1; : : : ; g`) as

Assume that Oscar has made his guess (g1; : : : ; g`) and sent his commitment

and g1 is its negation. Oscar now has to respond by sending rs1 if (g1 = 0 and b1 = 1) or rs1 1 if (g1 = 1 and b1 = 0). In either case, Oscar has to know s1 . As s1 is secret and it is computationally intractable to compute it from w1, Oscar will be detected as an impostor. The probability of false acceptance is 2 `t.

Consider an example. T A selects p = 1367 and q = 1103 (p 3 mod 4 and q 3 mod 4). The modulus N = 1507801. Let ` = 4 so P selects four random integers. Let them be:

s1 = 1281759 s2 = 63306 s3 = 100742 s4 = 647983

Next V chooses a binary vector e = (1; 1; 0; 1) and computes:

The vector (w1; w2; w3; w4) is the public identi cation information of P and is registered with T A. When P wishes to prove herself to V , both parties execute t iterations of the protocol. We are going to show a single iteration only. P

13.5.3 Guillou-Quisquater Identi cation Protocol

The Guillou-Quisquater (GQ) identi cation protocol is a modi cation of the F S protocol and it is described in [224]. The security of the protocol relies on the assumption that factoring is diÆcult. An attractive feature of the protocol is that it is identity based so the veri er need not use any certi ed elements except the publicly accessible identity of the prover and public key of the trusted authority.

GQ identi cation protocol

TA Precomputations: T A holds its public modulus N where N = pq and primes p and q are secret. Next T A generates two exponents d and e such that d e 1 mod '(N) where '(N) is Euler's totient function. The modulus N and exponent d are public. The factors of N and the exponent e are secret.

Registration: 1. P is assigned a unique identity IDP . The identity is converted into a unique integer JP (1 JP N 1) that is called the shadowed identity. The conversion is public.

2. T A takes JP and signs it, using its secret key e. The signature (mod N)

Message Sequence: P introduces herself to V as an entity with IDP . V converts her identity to the corresponding numerical shadowed identity JP . The identi cation process takes t iterations. A single iteration runs as follows:

After t successful iterations V accepts.

T A sets up an RSA system with public elements (d; N ). T A uses its secret key e to sign JP . The certi cate is kept secret by both T A and P as it is further used by P to prove herself to V . The public information accessible to Victor is Peggy's IDP and her shadowed identity JP .

A single iteration starts from the random selection of r by Peggy. She next sends her commitment u = rd to Victor. Victor chooses his challenge b at random and communicates it to Peggy. Peggy responds by sending v = r b. Victor checks whether JPb vd is equal to rd.

Assume that an opponent, Oscar, tries to impersonate Peggy. First, he introduces himself as Peggy with Peggy's IDP . Next at random, Oscar selects r and tries to guess Victor's challenge. Let his guess be g. Oscar sends his commitment

O ! V : u rd JPg mod N:

V sends his challenge b. Oscar has to reply

O ! V : v r g b mod N:

Victor checks whether

Victor fails to detect impostor if Oscar either has guessed g correctly, i.e. g = b or has computed . The rst case may happen with the probability d 1 per iteration. The retrieval of is assumed to be computationally intractable. If the identi cation takes t iterations, the probability of false acceptance is equal

13.5 Identi cation Protocols 449

to d t. Note that if P and V follow the protocol the probability of false rejection is zero.

The GQ protocol is designed with the eÆciency in mind. Keeping the public exponent d short, preferably smaller than 220, is recommended. The shorter d the more eÆcient computations for both P and V . For d 220, most practical GQ protocols would require one iteration only (t = 1). On the other hand, a too short d will force P and V to do many iterations to attain an agreed probability of false acceptance.

Consider a toy example. Let T A set up its RSA system with p = 563, q = 719. The modulus is N = 404797 and the Euler's totient function '(N) = 403516. Let d = 23 then e = 298251. The modulus N and d are public. Peggy is assigned her identity IDP and let her shadowed identity be JP = 123456. T A gives P her secret JP e 79833 mod 404797. P veri es it by checking

JP = 123456 ? d = 123456 (mod 404797):

The check holds so P is sure that is valid.

If V now asks P to identify herself, she rst presents her IDP to V and later

Pand V execute t iterations of the protocol. Consider a single iteration only.

Pselects r = 133504 and sends her commitment u = rd 172296 mod 404797. V chooses his challenge b = 11 and forwards it to P . As expected P sends back her response v = r b 41169 mod 404797. Now V computes

JPb vd 172296 mod 404797:

which equals to u. P and V have completed successfully an iteration of the protocol.

Identi cation protocols may use zero-knowledge proof systems. The FiatShamir protocol is a classic example of a direct application of a zero-knowledge proof system. To reduce the number of interactions between P and V , a common method used in the Feige-Fiat-Shamir and Guillou-Quisquater protocols is to allow the veri er to challenge the prover by sending `-bit challenges (instead of binary). This increases the eÆciency of the protocol but causes some problems. The most important is that the zero-knowledge property becomes harder to prove. Recall that the starting point in proving zero knowledge is the design of an eÆcient transcript simulator that is indistinguishable from the view ensemble generated by the interactions of the real protocol. The simulator runs in an expected polynomial time only if the length of the challenge string

450 13 IDENTIFICATION

is logarithmic. If the challenge string is super-logarithmic the proof system is not known to be zero knowledge. This becomes apparent when an identi cation protocol consists of a single iteration that involves three passes only (P ! V : commitment (or witness), V ! P : challenge and P ! V : response). The single challenge used needs to be long enough so the false acceptance rate can be selected arbitrarily low. This clearly precludes the existence of an eÆcient transcript simulator.

13.6 Identi cation Schemes

Consider \three pass" protocols. From now on, we are going to call them schemes to indicate that they are short versions of identi cation protocols with arbitrary number of passes. Some authors introduced other measurements to indicate that identi cation schemes do not \leak" any information about the secrets held by the provers. These measurements include no useful information transfer [168] or no transferable information with security level [389]. An alternative approach is to prove that breaking an identi cation scheme is equivalent to nding a polynomial time algorithm that solves an intractable problem (such as the discrete logarithm).

13.6.1 Schnorr Identi cation Scheme

Schnorr [453] designed an identi cation scheme that is intended to be suitable for smart cards where both memory and computing power are in short supply. The security of the scheme relies on the assumption that the selected instance of the discrete logarithm problem is intractable.

Schnorr identi cation scheme

TA Precomputations: T A sets up the parameters of the protocol and T A

1.chooses the modulus p such that p is prime,

2.selects a prime q that is a divisor of (p 1),

3.takes an integer 2 Zp such that it is a generator of a group of order q i.e. q 1 mod p,

4.determines the collection of possible challenges f0; 1; : : : ; 2t 1g,

5.applies its secret key to issue certi cates while the corresponding public key is used to verify them,