Announcements: 1. Pass in HW7 now. 2. Project rubrics posted (peruse together) 3. Teams choose presentation dates now Questions? This week: Birthday attacks, Digital signatures, DSA Birthday attacks, Digital signatures, DSA DTTF/NB479: DszquphsbqizDay 31

Why are digital signatures important? Compare with paper signatures Danger: Eve would like to use your signature on other documents! Solution: sig = f(document, user) Let m be the message/document Let m be the message/document Algorithms we’ll study: RSA RSA ElGamal ElGamal DSA (Digital Signature Algorithm) DSA (Digital Signature Algorithm)

RSA Signatures Alice chooses: p,q, n=pq, p,q, n=pq, e: gcd(n, (p-1)(q-1))=1, e: gcd(n, (p-1)(q-1))=1, d: ed = 1(mod ((p-1)(q-1)) d: ed = 1(mod ((p-1)(q-1)) Publishes n, e Alice’s signature: y = m d (mod n). Delivers (m, y) y = m d (mod n). Delivers (m, y) Bob’s verification: Does m = y e (mod n)? Does m = y e (mod n)? Show the verification works. Note that given the signature y, Bob can compute the message, m.

RSA Signatures Alice chooses: p,q, n=pq, p,q, n=pq, e: gcd(n, (p-1)(q-1))=1, e: gcd(n, (p-1)(q-1))=1, d: ed = 1(mod ((p-1)(q-1)) d: ed = 1(mod ((p-1)(q-1)) Publishes n, e Alice’s signature: y = m d (mod n). Delivers (m, y) y = m d (mod n). Delivers (m, y) Bob’s verification: Does m = y e (mod n)? Does m = y e (mod n)? Show the verification works. Note that given the signature y, Bob can compute the message, m. Eve wants to use Alice’s signature on a different document, m 1 Why doesn’t this work? Eve wants to choose a new y 1, then compute m 1 = y 1 e Why doesn’t this work?

Blind Signature Alice chooses: p,q, n=pq, p,q, n=pq, e: gcd(n, (p-1)(q-1))=1, e: gcd(n, (p-1)(q-1))=1, d: ed = 1(mod ((p-1)(q-1)) d: ed = 1(mod ((p-1)(q-1)) Publishes n, e Bob wants m signed Bob chooses: k: random, gcd(k, n)=1 k: random, gcd(k, n)=1 Bob sends: t=k e m Alice’s signature: s = t d (mod n). s = t d (mod n). Bob’s verification: Computes sk -1 Computes sk -1 Bob wants Alice to sign a document as a method of time-stamping it, but doesn’t want to release the contents yet. Why can’t Alice read m? Verification: Find sk -1 in terms of m What is the significance of this? What’s the danger to Alice of a blind signature?