Digital Signatures and Certificates

Introduction to Digital Signatures

• The lecture explores the application of hash functions in digital signatures and certificates, essential for online transactions.

• Digital certificates standardize the use of digital signatures globally, facilitating document authentication.

Understanding Digital Signatures

• A digital signature serves as the electronic equivalent of a handwritten signature, ensuring uniqueness and authenticity.

• Unlike physical documents, digital signatures are applied to files, allowing individuals to sign electronically.

Mechanism of Digital Signatures

• The process involves creating a hash digest from a message (M), which is then signed using the signer’s private key.

• Each individual possesses a unique private key (D), making it difficult for others to forge their signature.

Verification Process

• Signature verification utilizes the public key corresponding to the private key used for signing, ensuring non-repudiation.

• Public key algorithms are robust against forgery; thus, signers cannot deny their signatures due to this security feature.

Types of Digital Signatures

Signature with Appendix

• This method computes a hash value from the message before applying a signing transformation using the private key.

• The generated signature (S) can be sent alongside the original message (M), allowing recipients to verify authenticity.

Verification Steps

• To verify, recipients compute the hash value from M and decrypt S using the sender's public key. If both values match, verification succeeds.

Signature with Message Recovery

Verification Process of Digital Signatures

Understanding Signature Verification

• The verification process involves applying the function F V on the signature S using a public key to retrieve the message. If the output resembles normal text, it indicates successful decoding.

• For double assurance, one can check if M equals M' . However, this method is more resource-intensive due to larger message encryption and slower public key operations.

Types of Signatures

Deterministic vs. Probabilistic Signatures

• Deterministic signatures produce the same output for identical inputs since they rely on a consistent algorithm, private key, and hash function.

• In contrast, probabilistic signatures generate different outputs for the same input across multiple runs, enhancing security by introducing variability.

Examples of Digital Signature Algorithms

• Various digital signature methods exist including Rabin, ElGamal, Schnorr, DSA, and elliptic curve techniques. These utilize transformations for both signature generation and verification.

• While RSA is reliable, its computational complexity makes it slower compared to other methods that are easier to implement.

Lightweight Cryptography

Elliptic Curve Cryptography (ECC)

• ECC is an emerging technique suitable for lightweight cryptography applications where devices have limited computing resources and battery life.

• It offers advantages in terms of reduced memory usage and faster processing speeds compared to traditional algorithms like RSA.

Alternative Signature Methods

Blind Signatures

• Blind signatures allow a signer to sign a message without seeing its content. This involves generating a random number that obscures the original message before signing.

• The sender (A), after garbling their message with a random number K , sends it to another party (B), who signs it without knowledge of its content.

Undeniable Signatures

• Undeniable signatures require active participation from the signer during verification. This limits their practicality as constant confirmation from the signer can be burdensome.

Security Concerns in Digital Signatures

Risks of Key Compromise

Understanding Selective and Existential Forgery

Types of Forgery in Digital Signatures

• Selective Forgery: An attacker can generate valid signatures for a specific set of messages chosen by them, but not for all possible messages.

• Existential Forgery: The attacker can create signatures for certain messages that they cannot choose themselves. This type is more complex than selective forgery.

• Key Only Attack: Involves an attacker who only knows the public key verification process. If the RSA algorithm is secure, this attack remains difficult to execute.

• Known Message Attack: The attacker has access to some message-signature pairs and attempts to modify them to create new valid signatures.

• Chosen Message Attack: Similar to known message attacks, but here the attacker selects specific messages for which they want valid signatures.

Digital Certificates and Their Importance

Role of Digital Certificates in Online Security

• When engaging in online transactions (e.g., internet banking), browsers verify digital certificates from websites like banks to ensure secure connections.

• A digital certificate contains a public key along with other identifying information about the entity it represents, ensuring authenticity during transactions.

• Trusted third parties, known as Certification Authorities (CAs), issue these certificates, helping users trust the public keys they are using.

• If a certificate is compromised, CAs have processes in place to revoke it, preventing further use for establishing authenticity.

• Revoked certificates are listed on a Certificate Revocation List (CRL), which helps maintain security by tracking invalidated certificates over time.

Contents and Standards of Digital Certificates

Key Components of Digital Certificates

• A digital certificate includes details about the entity such as name and address alongside its public key; this information must be verified upon download.

• Each certificate has a validity duration; once expired or suspected of compromise, it may become invalid and subject to revocation by the CA.

Understanding Digital Certificates

Overview of Digital Certificates

• The issuer of a digital certificate includes details about the public and private key, validity period, and sender's public key information. Users can find examples of digital certificates online by searching for "digital certificate example."

Key Components of a Certificate

• An example certificate from amazon.com is discussed, highlighting that it is signed by a trusted party (Very Sign). It includes an expiry date and organizational details such as the address in Seattle, Washington.

• The signing authority (Very Sign) confirms the authenticity of the certificate. The signature algorithm used is SHA-1 with RSA encryption.

Signature Verification

• The certificate specifies the algorithm used for signing and provides a 256-byte signature that can be verified. This ensures that users can confirm the integrity of the data.

• The public key included in the certificate is crucial for users to verify their communications securely.

Conclusion on Cryptographic Standards