Forward Secure Hashbased Signatures on Smartcards A Hlsing
Forward Secure Hash-based Signatures on Smartcards A. Hülsing, J. Buchmann, C. Busold 16. 08. 2012 | TU Darmstadt | A. Hülsing | 1
Digital Signatures are Important! Software updates E-Commerce … and many others 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 2
What if… IBM 2012: „…optimism about superconducting qubits and the possibilities for a future quantum computer are rapidely growing. “ 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 3
Post-Quantum Signatures Based on Lattice, MQ, Coding Signature and/or key sizes Runtimes Secure parameters 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 4
![Hash-based Signature Schemes [Merkle, Crypto‘ 89] Not only “post-quantum” Fast, also without HW-acceleration Strong](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-5.jpg "Hash-based Signature Schemes [Merkle, Crypto‘ 89] Not only “post-quantum” Fast, also without HW-acceleration Strong")
Hash-based Signature Schemes [Merkle, Crypto‘ 89] Not only “post-quantum” Fast, also without HW-acceleration Strong security guarantees Forward secure Restricted number of signatures Slow Key Generation 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 5
Forward Secure Signatures 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 6
Forward Secure Signatures pk classical sk pk forward sec sk Key gen. sk 1 sk 2 ski t 1 t 2 ti 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 7 sk. T time
Forward Secure Digital Signatures Fulfill intuition of signature Replace timestamps Side-Channel Resistance Document signatures and PKI Stateful Less efficient than standard signature schemes 02. 12. 2011 | TU Darmstadt | A. Huelsing | 8
Construction 02. 12. 2011 | TU Darmstadt | A. Huelsing | 9
Hash-based Signatures PK H H , , H OTS H H SIG = (i, H H H H H OTS OTS 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 10 SK )
![Winternitz OTS [Merkle, Crypto‘ 89; Even et al. , Jo. C‘ 96] SIG =](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-11.jpg "Winternitz OTS [Merkle, Crypto‘ 89; Even et al. , Jo. C‘ 96] SIG =")
Winternitz OTS [Merkle, Crypto‘ 89; Even et al. , Jo. C‘ 96] SIG = (i, 1. = f( , , ) ) 2. Trade-off between runtime and signature size, controlled by parameter w 3. Minimal security requirements [Buchmann et al. , Africacrypt’ 11] 4. Uses PRFF F 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 11
XMSS – secret key FSPRG PRG Generated using forward secure pseudorandom generator (FSPRG), build using PRFF F: FSPRG Secret key: Random SEED for pseudorandom generation of current signature key. 04. 09. 2013 | TU Darmstadt | Andreas Hülsing | 12
![BDS-Tree Traversal [Buchmann et al. , 2008] § Computes authentication paths § Store most](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-13.jpg "BDS-Tree Traversal [Buchmann et al. , 2008] § Computes authentication paths § Store most")
BDS-Tree Traversal [Buchmann et al. , 2008] § Computes authentication paths § Store most expensive nodes § Left nodes are cheap § Distribute costs § (h-k)/2 updates per round # 2 h-1 k h 02. 12. 2011 | TU Darmstadt | A. Huelsing | 13 # 2 h-2
![Accelerate key generation Tree Chaining [Buchmann et al. , 2006] 2 h+1 → 2*2](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-14.jpg "Accelerate key generation Tree Chaining [Buchmann et al. , 2006] 2 h+1 → 2*2")
Accelerate key generation Tree Chaining [Buchmann et al. , 2006] 2 h+1 → 2*2 h/2+1 = 2 h/2+2 j i 29. 04. 2011 | TU Darmstadt | J. Buchmann | 14 But: Larger signatures!
![Distributed Signature Generation Initial proposal [Buchmann et al. , 2007]: § Distribute signature costs](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-15.jpg "Distributed Signature Generation Initial proposal [Buchmann et al. , 2007]: § Distribute signature costs")
Distributed Signature Generation Initial proposal [Buchmann et al. , 2007]: § Distribute signature costs equally among all signatures in lower tree This work: § Use observation: BDS spends more updates than needed § Use unused updates to compute authentication path & signature 02. 12. 2011 | TU Darmstadt | A. Huelsing | 15
Implementation 02. 12. 2011 | TU Darmstadt | A. Huelsing | 16
Hash function & PRF Use plain AES for PRF Use AES with Matyas-Meyer-Oseas in Merkle-Damgård mode for hash function 02. 12. 2011 | TU Darmstadt | A. Huelsing | 17
Results Sign (ms) Verify (ms) Keygen (ms) Signature (byte) Public Key (byte) Secret Key (byte) Bit Sec. Comment XMSS 134 23 925, 400 2, 388 800 2, 448 97 h = 16, w = 4, k = 4 XMSS+ 106 25 5, 600 3, 476 544 3, 760 96 H = 16, w = 4, k = 2 XMSS+ 105 21 5, 800 2, 436 512 3, 376 95 H = 16, w = 8, k = 2 XMSS+ 106 25 22, 200 3, 540 608 4, 304 92 H = 20, w = 4, k = 4 RSA 2048 190 7 11, 000 ≤ 256 ≤ 512 87 Infineon SLE 78 16 Bit-CPU@33 MHz, 8 KB RAM, TRNG, sym. & asym. co-processor NVM: Card 16. 5 million write cycles/ sector, XMSS+ < 5 million write cycles 24. 05. 2012 | TU Darmstadt | A. Huelsing | 18
Conclusion 02. 12. 2011 | TU Darmstadt | A. Huelsing | 19
Conclusion & future work Forward secure signature schemes can be implemented on Smartcards, … … hash-based signatures with on-card key generation, too … performance is comparable to RSA, DSA, ECDSA … … higher provable security level requires different block cipher / hash-function 02. 12. 2011 | TU Darmstadt | A. Huelsing | 20
Thank you, Questions? 02. 12. 2011 | TU Darmstadt | A. Huelsing | 21
![XMSS – Winternitz OTS [Buchmann et al. 2011] - Uses pseudorandom function family -](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-22.jpg "XMSS – Winternitz OTS [Buchmann et al. 2011] - Uses pseudorandom function family -")
XMSS – Winternitz OTS [Buchmann et al. 2011] - Uses pseudorandom function family - Winternitz parameter w, message length m, random value x sk 1 pk 1 x l skl pkl x w 02. 12. 2011 | TU Darmstadt | A. Huelsing | 22
XMSS – secret key FSPRG PRG For multiple signatures use many key pairs. Generated using forward secure pseudorandom generator (FSPRG), build using PRFF Fn: FSPRG Secret key: Random SEED for pseudorandom generation of current signature key. 02. 12. 2011 | TU Darmstadt | A. Huelsing | 23
![XMSS – public key Modified Merkle Tree [Dahmen et al 2008] h second preimage](http://slidetodoc.com/presentation_image_h/0af0fccbbd4b6f2b35b4ed81d4804c8b/image-24.jpg "XMSS – public key Modified Merkle Tree [Dahmen et al 2008] h second preimage")
XMSS – public key Modified Merkle Tree [Dahmen et al 2008] h second preimage resistant hash function Public key =( , b 0, b 1, b 2, h) bh b 1 b 0 02. 12. 2011 | TU Darmstadt | A. Huelsing | 24 b 0
- Slides: 24