Practical No.

:- 10
~
 Case Study on Digital Signature.

 


A 

  
 or 

  
   is a mathematical scheme for
demonstrating the authenticity of a digital message or document. A valid digital signature gives a
recipient reason to believe that the message was created by a known sender, and that it was not
altered in transit. Digital signatures are commonly used for software distribution, financial
transactions, and in other cases where it is important to detect forgery or tampering.

Digital signatures are often used to implement electronic signatures, a broader term that refers to
any electronic data that carries the intent of a signature, but not all electronic signatures use
digital signatures. In some countries, including the United States, India, and members of the
European Union, electronic signatures have legal significance. However, laws concerning
electronic signatures do not always make clear whether they are digital cryptographic signatures
in the sense used here, leaving the legal definition, and so their importance, somewhat confused.

Digital signatures employ a type of asymmetric cryptography. For messages sent through a
nonsecure channel, a properly implemented digital signature gives the receiver reason to believe
the message was sent by the claimed sender. Digital signatures are equivalent to traditional
handwritten signatures in many respects; properly implemented digital signatures are more
difficult to forge than the handwritten type. Digital signature schemes in the sense used here are
cryptographically based, and must be implemented properly to be effective. Digital signatures
can also provide non-repudiation, meaning that the signer cannot successfully claim they did not
sign a message, while also claiming their private key remains secret; further, some non-
repudiation schemes offer a time stamp for the digital signature, so that even if the private key is
exposed, the signature is valid nonetheless. Digitally signed messages may be anything
representable as a bitstring: examples include electronic mail, contracts, or a message sent via
some other cryptographic protocol.






A digital signature scheme typically consists of three algorithms:

Mc A key generation algorithm that selects a private key uniformly at random from a set of
possible private keys. The algorithm outputs the private key and a corresponding public
key.
Mc A signing algorithm that, given a message and a private key, produces a signature.
Mc A signature verifying algorithm that, given a message, public key and a signature, either
accepts or rejects the message's claim to authenticity.

c
Two main properties are required. First, a signature generated from a fixed message and fixed
private key should verify the authenticity of that message by using the corresponding public key.
Secondly, it should be computationally infeasible to generate a valid signature for a party who
does not possess the private key.

Ã


 


A variety of approaches has been proposed for the digital signature function. These approaches
fall into two categories: direct and arbitrated.


 

 


The direct digital signature involves only the communicating parties (source, destination). It is
assumed that the destination knows the public key of the source. A digital signature may be
formed by encrypting the entire message with the sender's private key or by encrypting a hash
code of the message with the sender's private key.

Confidentiality can be provided by further encrypting the entire message plus signature with
either the receiver's public key (public-key encryption) or a shared secret key (symmetric
encryption). It is important to perform the signature function first and then an outer
confidentiality function. In case of dispute, some third party must view the message and its
signature. If the signature is calculated on an encrypted message, then the third party also needs
access to the decryption key to read the original message. However, if the signature is the inner
operation, then the recipient can store the plaintext message and its signature for later use in
dispute resolution.

All direct schemes described so far share a common weakness. The validity of the scheme
depends on the security of the sender's private key. If a sender later wishes to deny sending a
particular message, the sender can claim that the private key was lost or stolen and that someone
else forged his or her signature. Administrative controls relating to the security of private keys
can be employed to thwart or at least weaken this ploy, but the threat is still there, at least to
some degree. One example is to require every signed message to include a timestamp (date and
time) and to require prompt reporting of compromised keys to a central authority.

Another threat is that some private key might actually be stolen from X at time T. The opponent
can then send a message signed with X's signature and stamped with a time before or equal to T.

~


 


The problems associated with direct digital signatures can be addressed by using an arbiter. They
all operate as follows. Every signed message from a sender X to a receiver Y goes first to an
arbiter A, who subjects the message and its signature to a number of tests to check its origin and
content. The message is then dated and sent to Y with an indication that it has been verified to

c
satisfaction of the arbiter. The presence of A solves the problem faced by direct signature
schemes: that X might disown the message.

The arbiter plays a sensitive and crucial role in this sort of scheme, and all parties must have a
great deal of trust that the arbitration mechanism is working properly. The use of a trusted
system might satisfy this requirement.

Table 1 gives several examples of arbitrated digital signatures. In the first, symmetric encryption
is used. It is assumed that the sender X and the arbiter A share a secret key Kxa and that A and Y
share secret key Kay. X constructs a message M and computes its hash value H(M). Then X
transmits the message plus a signature to A. The signature consists of an identifier IDX of X plus
the hash value, all encrypted using Kxa. A decrypts the signature and checks the hash value to
validate the message. Then A transmits a message to Y, encrypted with Kay. The message
includes IDX, the original message from X, the signature, and a timestamp. Y can decrypt this to
recover the message and the signature. The timestamp informs Y that this message is timely and
not a replay. Y can store M and the signature. In case of dispute, Y, who claims to have received
M from X, sends the following message to A:

The following format is used. A communication step in which P sends a message M to Q is

represented as P Q: M.

E(Kay, [IDX||M||E(Kxa, [IDX||H(M)])])

G ~


 
G 


(1) X A: M||E(Kxa, [IDX||H(M)])

(2) A Y: E(Kay, [IDX||M||E(Kxa, [IDX||H(M)])||T])

Ã
  
 ~



(1) X A: IDX||E(Kxy, M)||E(Kxa, [IDX||H(E(Kxy, M))])

(2) A Y: E(Kay,[IDX||E(Kxy, M)])||E(Kxa, [IDX||H(E(Kxy, M))||T])

Ã
  
 ~
!


(1) X A: IDX||E(PRx, [IDX||E(PUy, E(PRx, M))])

(2) A Y: E(PRa, [IDX||E(PUy, E(PRx, M))||T])

 "
#$ 
 ~
!

Notation:
X = sender
Y = recipient
A = Arbiter
M = message
T = timestamp

c
The arbiter uses Kay to recover IDX, M, and the signature, and then uses Kxa to decrypt the
signature and verify the hash code. In this scheme, Y cannot directly check X's signature; the
signature is there solely to settle disputes. Y considers the message from X authentic because it
comes through A. In this scenario, both sides must have a high degree of trust in A:

Mc X must trust A not to reveal Kxa and not to generate false signatures of the form E(Kxa,
[IDX||H(M)]).
Mc Y must trust A to send E(Kay, [IDX||M||E(Kxa, [IDX||H(M)])||T]) only if the hash value
corrects and the signature was generated by X.
Mc ·oth sides must trust A to resolve disputes fairly.

If the arbiter does live up to this trust, then X is assured that no one can forge his signature and Y
is assured that X cannot disavow his signature.

The preceding scenario also implies that A is able to read messages from X to Y and, indeed, that
any eavesdropper is able to do so. Table 1b shows a scenario that provides the arbitration as
before but also assures confidentiality. In this case it is assumed that X and Y share the secret
key Kxy. Now, X transmits an identifier, a copy of the message encrypted with Kxy, and a
signature to A. The signature consists of the identifier plus the hash value of the encrypted
message, all encrypted using Kxa. As before, A decrypts the signature and checks the hash value
to validate the message. In this case, A is working only with the encrypted version of the
message and is prevented from reading it. A then transmits everything that it received from X,
plus a timestamp, all encrypted with Kay, to Y.

Although unable to read the message, the arbiter is still in a position to prevent fraud on the part
of either X or Y. A remaining problem, one shared with the first scenario, is that the arbiter could
form an alliance with the sender to deny a signed message, or with the receiver to forge the
sender's signature.

All the problems just discussed can be resolved by going to a public-key scheme, one version of
which is shown in Table 1c. In this case, X double encrypts a message M first with X's private
key, PRx and then with Y's public key, PUy. This is a signed, secret version of the message. This
signed message, together with X's identifier, is encrypted again with PRx and, together with IDX,
is sent to A. The inner, double-encrypted message is secure from the arbiter (and everyone else
except Y). However, A can decrypt the outer encryption to assure that the message must have
come from X (because only X has PRx). A checks to make sure that X's private/public key pair is
still valid and, if so, verifies the message. Then A transmits a message to Y, encrypted with PRa.
The message includes IDX, the double-encrypted message, and a timestamp.

This scheme has a number of advantages over the preceding two schemes. First, no information
is shared among the parties before communication, preventing alliances to defraud. Second, no
incorrectly dated message can be sent, even if PRx is compromised, assuming that PRa is not
compromised. Finally, the content of the message from X to Y is secret from A and anyone else.
However, this final scheme involves encryption of the message twice with a public-key
algorithm. We discuss more practical approaches subsequently.

c


%

 


As organizations move away from paper documents with ink signatures or authenticity stamps,
digital signatures can provide added assurances of the evidence to provenance, identity, and
status of an electronic document as well as acknowledging informed consent and approval by a
signatory.

·elow are some common reasons for applying a digital signature to communications:

~



Although messages may often include information about the entity sending a message, that
information may not be accurate. Digital signatures can be used to authenticate the source of
messages. When ownership of a digital signature secret key is bound to a specific user, a valid
signature shows that the message was sent by that user. The importance of high confidence in
sender authenticity is especially obvious in a financial context. For example, suppose a bank's
branch office sends instructions to the central office requesting a change in the balance of an
account. If the central office is not convinced that such a message is truly sent from an
authorized source, acting on such a request could be a grave mistake.




In many scenarios, the sender and receiver of a message may have a need for confidence that the
message has not been altered during transmission. Although encryption hides the contents of a
message, it may be possible to change an encrypted message without understanding it. However,
if a message is digitally signed, any change in the message after signature will invalidate the
signature. Furthermore, there is no efficient way to modify a message and its signature to
produce a new message with a valid signature, because this is still considered to be
computationally infeasible by most cryptographic hash functions.

!#



Non-repudiation, or more specifically non-repudiation of origin, is an important aspect of digital

signatures. ·y this property an entity that has signed some information cannot at a later time
deny having signed it. Similarly, access to the public key only does not enable a fraudulent party
to fake a valid signature. This is in contrast to symmetric systems, where both sender and
receiver share the same secret key, and thus in a dispute a third party cannot determine which
entity was the true source of the information.

 
" 


"

& 

c
All public key / private key cryptosystems depend entirely on keeping the private key secret. A
private key can be stored on a user's computer, and protected by a local password, but this has
two disadvantages:

Mc the user can only sign documents on that particular computer

Mc the security of the private key depends entirely on the security of the computer

A more secure alternative is to store the private key on a smart card. Many smart cards are
designed to be tamper-resistant (although some designs have been broken, notably by Ross
Anderson and his students). In a typical digital signature implementation, the hash calculated
from the document is sent to the smart card, whose CPU encrypts the hash using the stored
private key of the user, and then returns the encrypted hash. Typically, a user must activate his
smart card by entering a personal identification number or PIN code (thus providing two-factor
authentication). It can be arranged that the private key never leaves the smart card, although this
is not always implemented. If the smart card is stolen, the thief will still need the PIN code to
generate a digital signature. This reduces the security of the scheme to that of the PIN system,
although it still requires an attacker to possess the card. A mitigating factor is that private keys, if
generated and stored on smart cards, are usually regarded as difficult to copy, and are assumed to
exist in exactly one copy. Thus, the loss of the smart card may be detected by the owner and the
corresponding certificate can be immediately revoked. Private keys that are protected by
software only may be easier to copy, and such compromises are far more difficult to detect.

%
 '
&

Entering a PIN code to activate the smart card commonly requires a numeric keypad. Some card
readers have their own numeric keypad. This is safer than using a card reader integrated into a
PC, and then entering the PIN using that computer's keyboard. Readers with a numeric keypad
are meant to circumvent the eavesdropping threat where the computer might be running a
keystroke logger, potentially compromising the PIN code. Specialized card readers are also less
vulnerable to tampering with their software or hardware and are often EAL3 certified.

%


 
 '




One of the main differences between a digital signature and a written signature is that the user
does not "see" what he signs. The user application presents a hash code to be encrypted by the
digital signing algorithm using the private key. An attacker who gains control of the user's PC
can possibly replace the user application with a foreign substitute, in effect replacing the user's
own communications with those of the attacker. This could allow a malicious application to trick
a user into signing any document by displaying the user's original on-screen, but presenting the
attacker's own documents to the signing application.

To protect against this scenario, an authentication system can be set up between the user's
application (word processor, email client, etc.) and the signing application. The general idea is to
provide some means for both the user app and signing app to verify each other's integrity. For
example, the signing application may require all requests to come from digitally-signed binaries.

c
å  å 

Technically speaking, a digital signature applies to a string of bits, whereas humans and
applications "believe" that they sign the semantic interpretation of those bits. In order to be
semantically interpreted the bit string must be transformed into a form that is meaningful for
humans and applications, and this is done through a combination of hardware and software based
processes on a computer system. The problem is that the semantic interpretation of bits can
change as a function of the processes used to transform the bits into semantic content. It is
relatively easy to change the interpretation of a digital document by implementing changes on
the computer system where the document is being processed. From a semantic perspective this
creates uncertainty about what exactly has been signed. WYSIWYS (What You See Is What You
Sign) means that the semantic interpretation of a signed message cannot be changed. In
particular this also means that a message cannot contain hidden info that the signer is unaware
of, and that can be revealed after the signature has been applied. WYSIWYS is a desirable
property of digital signatures that is difficult to guarantee because of the increasing complexity
of modern computer systems.



 
 &


An ink signature can be easily replicated from one document to another by copying the image
manually or digitally. Digital signatures cryptographically bind an electronic identity to an
electronic document and the digital signature cannot be copied to another document. Paper
contracts often have the ink signature block on the last page, and the previous pages may be
replaced after a signature is applied. Digital signatures can be applied to an entire document,
such that the digital signature on the last page will indicate tampering if any data on any of the
pages have been altered