Science
Better Computer than BiBa:
Short One-time Signatures with Fast Signing and Verifying Leonid Reyzin and Natan Reyzin April 30th, 2002 Presented by: Michael Lee
Introduction
Problem
One-time signature schemes used in broadcast authentication Needs to have
efficient signing efficient verifying small public key size small signature size
Goal
Create a more efficient one-time signature scheme than Biba
Computer Science
Previous Work
Lamport/Rabin
One-time signature schemes based on one-way functions Created efficient one-time signature scheme for use with broadcast authentication Benefits
Biba
Fast verification of signatures Small communication overhead Time to sign a message
Computer Science
Disadvantages
Overview
One-time signature scheme (HORS) which
verifies slightly faster than Biba signs faster than verifying (much faster than Biba) key and signature sizes are slightly improved for same security level compared to Biba necessary for Biba stream authentication scheme
Can be used r times instead of just once
Can be used in the Biba stream authentication scheme without modification
Computer Science
HORS: Hash to Obtain Random Subset
Pick k and t
k is linear to public key size t is linear to signature size and verification time
T = set {1,2,...,t} f = one-way function
Computer Science
HORS: Hash to Obtain Random Subset
H = hash function resulting in at most a k-element subset of T (picked from an random family of hash functions)
Infeasible that two messages result in same subset (strong collision resistance property of hash functions) SHA-1 should work for small values of r SHA-1 output split into k substrings of length log2 t each. k = 16; t = 210 (160 = 16 * 10) k = 20; t = 28 (160 = 20 * 8)
SHA-1 output k1 k2 k3 k4 k5 k6 k7 k8 k9 k10 k11 k12 k13 k14 k15 k16
Computer Science
Key Generation
Secret Key
Generate t random l-bit strings (s1, ..., st) Secret Key = (k, s1, ..., st) Use one-way function f to compute where vn = f (sn) Key Public = (k, v1, ..., vt)
Public Key
Computer Science
Sign
h = H(m) Split h into k substrings hi, ...hk of length log2 t Interpret hj as integer ij for 1 j k Signature = Ex
si1 ,..., sik
h1 = 50, then the first value in signature will be s50
SHA-1 output h3 h4 h5 h6 h7 h8 h9 h10 h11 h12 h13 h14 h15 h16
h1
h2
Computer Science
Verify
Signature (s1, ..., sk) h = H(m) Split h into k substrings hi, ...hk of length log2 t Interpert hj as integer ij for 1 j k Verify
f ( s j ) = vi j
for all j where 1 j k
Accept signature if true for all j Reject signature if false for any j f (s1) = 1074 = v50
Ex
Computer Science
Security Analysis
HORS signatures can be compromised
when the one-way property of f or H has been broken. if the attacker can cache enough signatures to forge a new signature
H (mr +1 ) H (m1 ) H (m2 ) ... H (mr )
Computer Science
1
Biba Comparison
Sign: Calls to Random Oracle/Hash Function
Biba: 2t HORS: 1 Biba: k HORS: k Biba: k HORS: 1
Computer Science
Verify: Calls to one-way function f
Verify: Calls to Random Oracle/Hash Function
1
Biba Comparison (cont.)
r-non-adaptive message attack HORS can use slightly smaller...