Key Substitution Attacks on Some Provably Secure Signature Schemes Author: Chik-How Tan Source: IEICE Trans. Fundamentals, Vol.E87-A, 　No.1 Jan. 2004 Speaker: Su Sheng-Yao

Outline Introduction Two Provably Secure Signature Scheme Fischlin Signature Scheme Camenisch-Lysyanskaya Signature Scheme Cryptoanalysis Conclusion

Introduction Provable Security Provably Secure Signature Schemes Security could be proved under standard and well-believed complexity theoretic assumptions Definition, Protocol, Proof Provably Secure Signature Schemes Key Substitution Attack U’s public key and signature s on m adversary A tries to produce a new public key s.t. s is also a valid A’s signature on m

Application e-lottery e-coupon (禮卷) the gambler uses his/her secret key to sign on the e-lottery to ensure that he owns the e-lottery e-coupon (禮卷) require be signed by the buyer and later signed by the shop

History (1998) Goldwasser, Micali and Rivest introduced the security notion of existential unforgeability against adaptive chosen-message attacks (1999) Blake-Wilson and Menezes introduced a duplicate-signature key selection attacks (2004) Menezes and Smart analyzed the security of some signature schemes against this attack, named as key substitution attacks

Fischlin Signature Scheme (1/2) Key Generation: N=pq ( p=2p’+1, so does q ) three random quadratic residues h1, h2, X ZN* Signature Generation: compute (l-bit) H(m), H(.): collision resistant hash fun. compute y=(Xh1ah2a XOR H(m))1/e mod N e: random (l+1)-bit prime a: l-bit long Public key (N, X, h1, h2) Private key (p, q) Signature (y, a, e)

Fischlin Signature Scheme (2/2) Signature Verification: check e : (l+1)-bit odd integer a: l-bit ye= (Xh1a h2a XOR H(m)) mod N

Camenisch-Lysyanskaya Signature Scheme (1/2) Key Generation: N=pq ( p=2p’+1, so does q ) three random quadratic residues h1, h2, X ZN* Signature Generation: compute y=(Xh1sh2m)1/e mod N e >2lm+1: random prime of length le=lm+2 s: random number st. ls=lN+lm+l Public key (N, X, h1, h2) Private key (p, q) Signature (y, s, e)

Camenisch-Lysyanskaya Signature Scheme (2/2) Signature Verification: check e: 2le-1 < e < 2le ye= (Xh1s h2m) mod N

Cryptanalysis (1/2) Weak-key substitution attack (stronger) produce public/private key Strong-key substitution attack public key (without knowing private key) Weak-Key Substitution Attack the same form X = yeh1-s h2-t mod N signature (y, a, e) where s=a, t=a XOR H(m) in Fischlin sheme t=m in C-L scheme

Cryptanalysis (2/2) choose two new primes st. choose two random quadratic residues compute Then public key is valid with secret key and signature (y, a, e) of m

Conclusion Attack the two schemes by weak-key substitution attack A signature scheme secure against existential forgery under adaptive chosen-message attack is inadequate A scheme should be against key substitution attacks or rather under multi-user setting