CS 285 Network Security Digital Signature

1
CS 285 Network Security Digital Signature

• Yuan Xue
• Fall 2012

2
Digital Signature Overview

• Message Authentication Code
• Data integrity
• Source authentication
• Issue
• Source can successfully claim they did not create
  a message
• Reason
• Source and destination share the same key (same
  knowledge)
• Digital Signature
• Message authentication non-repudiation
• Solution
• Use of asymmetric key

3
Digital Signature

• Two approaches

• Encryption of hash value via private key provides
  digital signature
• Any asymmetric encryption algorithm could be used
• E.g. RSA
• Many asymmetric encryption algorithms have export
  restriction
• DSA (digital signature algorithm)-based approach

4
Primitives for Digital Signature Algorithm

• Elgamal Digital Signature
• Based on discrete log operation
• primitive root
• Signature has two components

a is a primitive root of prime number p then a
mod p, a2 mod p, , ap-1 mod p are distinct and
consist of the integers from 1 through p-1 For
any b and a primitive root a of p, unique
exponent I can be found such that b ai mod p
(0lti lt p-1)
5
Digital Signature Algorithm

• Algorithm
• Based on discrete log operation
• Global variables
• p, q, g
• Private key x
• Public key y gx mod p
• User per-msg secret num k

• Digital Signature Algorithm
• An asymmetric key algorithm
• Can not be used for encryption
• Can ONLY be used for digital signature

Generate a random per-message value k where 0 lt k
lt q Calculate r (gk mod p) mod q Calculate s
(k-1(H(m) xr)) mod q The signature is (r, s)
Calculate w s-1 mod q Calculate u1 H(m)w mod
q Calculate u2 rw mod q Calculate v
((gu1yu2) mod p) mod q The signature is valid if
v r
6
Digital Signature Algorithm
7
Public-Key Algorithm Summary
Encryption/ Decryption Digital Signature Key Exchange
RSA Y Y Y
Diffie-Hellman N N Y
DSS N Y N
8
MAC and DS Summary

• Message Authentication Code
• CBC-based
• Hash-based
• Encrypt the hash code
• Hash the message key
• HMAC
• CMAC and more..
• Digital Signature
• Encrypt the hash code
• Digital signature standard

Symmetric Key Encryption
Asymmetric Key Encryption
9
Comparison

• Computation efficiency
• Hash gt symmetric encryption gt asymmetric
  encryption
• Message Authentication Code
• CBC-based
• Hash-based
• Encrypt the hash code
• Hash the message key
• HMAC
• Digital Signature
• Encrypt the hash code
• Digital signature standard

faster
faster