网络安全导论 课件 第八章 消息认证与数字签名

第八章消息认证与数字签名讨论议题

1、消息认证概念消息认证码2、有限域3、数字签名基本签名算法特殊签名算法消息认证实现方法比较1、

消息认证消息认证是指验证者验证所接收到的消息是否确实来自真正的发送方、并且消息在传送中没被修改的过程。消息认证是抗击伪装、内容篡改、序号篡改、计时篡改和信源抵赖的有效方法。什么是消息认证？加密技术可用来实现消息认证数字签名也可用来实现消息认证消息认证更为简单的实现方法是利用消息认证码消息认证的实现方法消息认证码(MAC)也称密码校验和，是指消息被一密钥控制的公开单向函数作用后、产生的固定长度的数值，即MAC=CK(M)。

消息认证码安全的MAC函数MAC=CK(M)不但要求要具有单向性和固定长度的输出，而且应满足：（1）

如果敌手得到M和CK(M)，则构造一满足CK(M′)=CK(M)的新消息M′在计算上是不可行的。（2）

CK(M)在以下意义下是均匀分布的：

随机选取两个消息M、M′，Pr[CK(M)=CK(M′)]=2-n，其中n为MAC的长。（3）若M′是M的某个变换，即M′=f(M)，例如f为插入一个或多个比特，那么Pr[CK(M)=CK(M′)]=2-n。

消息认证码的安全性要求

消息认证码的构造2、有限域什么是有限域？域是一种可进行加、减、乘、除运算的代数结构。有限域是仅含有限个元素的域，有限域在近代编码、计算机理论、组合数学等各方面有着广泛的应用。例子例8-1

集合{0，1，2，3，4，5，6}按模7进行加减乘除运算，便构成一个有限域，这个域称为GF（7），在该域中，2/3=2*1/3=2*5=3。例8-2系数为0、1的多项式，按模多项式x8+x4+x3+x+1进行加减乘除运算，也构成了一个有限域，称为GF（28）。这个域共有256个元素构成，每个元素可用一个字节表示，比如十六进制表示的一个字节57即为01010111,也即是x6+x4+x2+x+1。3、数字签名DigitalsignatureGoal:Usethedigitaltechniquetoemulatethe“hand-writtensignature”SecurityrequirementsUnforgeability:onecannotcreateasignaturethatisclaimedtobeanother’sUndeniability:thesignercannotlaterdenythevalidityofhissignatureRequirementsThesignaturedependsonthesignerandthedocumenttobesigned.Easytocompute:itiseasyforasignertosignadocumentUniversalverifiability:everyonecanverifyvalidityofasignature(withrespecttothesignerandthedocument)Easytostore:thesignatureshouldbeshort

enoughAttacksondigitalsignatureAttacktypeKey-onlyattack(ciphertext-only)Known-messageattack(known-plaintext)Chosen-messageattack

(chosen-plaintext)ForgerytyeExistentialforgerySelectiveforgeryMessageSignFunctionVerificationFunctionSigner’ssecretkeyMessageSignatureSigner’spublickeyMessage

CheckMessage=?Message

TheModelofDigitalSignatureDigitalsignature:usageOff-line:Signingadocumentforemulatingthehand-writtensignatureOn-line:identityauthentication(+sessionkeydistribution)BobAlicechallengecr=Sig(KRBob,c)IfVer(KUBob,r,c)=truethenacceptthat“Bobistalkingtome”Whatsecurityservicecandigitalsignatureprovide?DataIntegrityAuthenticationNon-forgeabilityNon-repudiation

签名的一个重要应用证书认证中心(CA)第三方信任的模型Fig.信任的层次结构公正的被信任者经认定可以被信任的中间角色用户群AB网络空间的信任建立问题是信息安全讨论的核心问题，网络空间的信任建立方法很大程度上借鉴了传统生活中建立信任的方法。正如手写签名在传统生活中的重要作用一样，数字签名是网络空间中建立信任的一块基石。

结论ChinaDigitalSignatureLawhavebecomeeffectiveApril12005ChinaDigitalSignatureLawhasbecomeeffectivePartOne OverviewPartTwo ElectronicDataPartThreeDigitalSignatureandCertification AuthorityPartFour LegalResponsibility

PartSix SupplementaryArticlesDigitalSignatureLawisanInfrastructureofE-COMSupplyChainOnlinePaymentTradingPlatformInformationExchangePlatformCreditSystemDigitalSignatureLawisInfrastructure3.1、基本签名算法FundamentalschemesSignatureschemesbasedonerror-correctingcodesSignatureschemesbasedontwohardproblems

Signatureschemesbasedonellipticcurves

AlgorithmfoundationTwoFamousDigitalSignatureSchemes1.RSADigitalsignaturescheme(basedonthefactorizationproblem)2.ElGamaldigitalsignatureandMeta-ElGamalsignatureschemes(basedonthediscretelogarithm)

‧RSADigitalSignature

(R.L.Rivest,A.Shamir,andL.M.Adleman,1978)‧ElGamalDigitalSignature

(T.ElGamal,1985)‧Schnorr’sDigitalSignature

(C.P.Schnorr,1989)‧DSS

(NIST,1991)Somepopularalgorithms

RSAPublicKeyCryptosystemandDigitalSignatureScheme

Rivest,Shamir,andAdlemanproposedin1978RSAPublicKeyCryptosystem

◆SecurityBasis:FactorizationProblem.

◆Construction:

1.ChoosetwolargeprimenumbersPandQ,thencomputeN=P×Q.2.Selectanintegeresuchthatgcd(e,

(N))=1.3.Computedsuchthate×dmod

(N)=1.4.Publickey=(N,e).5.Privatekey=(P,Q,d).RSAPublicKeyCryptosystemandDigitalSignatureScheme

RSADigitalSignatureScheme

SignFunction:SignatureS=MdmodN.VerificationFunction:M=SemodN.

ExampleP=11,Q=13,N=143,and

(143)=120.e=103,thend=7(for103×7mod120=1).SignforM=3:S=37mod143=42.Verification:M=SemodN=42103mod143=3.ElGamalPublicKeyCryptosystemandDigitalSignatureScheme

ElGamalproposedin1985ElGamalPublicKeyCryptosystem◆

SecurityBasis:DiscreteLogarithmProblem1.IfPisalargeprimeandgandyareintegers,findxsuchthaty=gxmodP.2.ThesecurityrestrictiononP:P-1mustcontainalargeprimefactorQ.◆Construction:

1.ChoosealargeprimenumberPandageneratorgofGF(P).2.Privatekey:arandomintegerxbetween1andP-1.3.Publickey:y=gxmodP.ElGamalPublicKeyCryptosystemandDigitalSignatureScheme

SignFunction:Signature(r,s)formessageM.1.Selectarandomintegerkbetween1andP-1suchthatgcd(k,P-1)=1.2.Computer=gkmodP.3.Computes=k-1(M-xr)mod(P-1).VerificationFunction:

VerifybycheckingwhethergMmodP=(rs)×(yr)modP.(rs)×(yr)=g(M-xr)×gxr=g(M-xr)+xr=gMmodP.ElGamalPublicKeyCryptosystemandDigitalSignatureScheme

ExampleP=23,g=5.x=3,theny=10(for53mod23=10).SignforthemessageM=8.Selectk=5between1and22(P-1).Computer=gkmodP=55mod23=20.Computes=k-1(M-xr)mod(P-1)=5-1(8-3×20)mod22=9×14mod22=16.Verification:gM=58mod23=16(rs)(yr)modP=2016×1020mod23=13×3mod23=16.Schnorr’sDigitalSignatureScheme

SignFunction:Signature(r,s)formessageM.1.

Selectarandomintegerkbetween1andP-1.2.Computer=h(M,gkmodP).3.Computes=k+x*rmod(P-1).,wherethesecretkeyxthepublickeyy=g-xmodP4.Send(M,r,s)tothereceiver.VerificationFunction:ComputegkmodP=gsyrmodP.Verifybycheckingwhetherr=h(M,gkmodP).DigitalSignatureStandard（DSS)Proposedin1991byNISTasFIPS186-2

Signature:

r=(gkmodp)modq s=k-1(H(m)+xr)modq Verification

t=s-1modq r’=(gH(m)tyrtmodp)modq Ifr=r’,(r,s)islegal.

p:512bitsprimenumber q:160bitsprimenumberandq|(p-1) g:g=h(p-1)/qmodp,h(anyinteger)<p-1 H:onewayhashfunction x:privatekey<q y:y=gxmodp(correspondingpublickey) k-1k=1modq,(r,s)isthesignatureofm.

数字签名的实现类.NETFramework提供了以下类来实现数字签名算法：DSACryptoServiceProviderRSACryptoServiceProvider3.2、特殊签名算法1.Schemeswithmessagerecovery:SignatureswithmessagerecoveryAuthenticatedencryptionschemesAuthenticatedencryptionschemewithmessagelinkagesAuthenticatedencryptionschemewith(t,n)sharedverificationDigitalSignaturewithMessageRecovery建立在ElGamal架构上，其特点是验证的结果即为文件本身。2.Schemeswithsigner-aidedverification:UndeniablesignatureConfirmersignaturesConvertibleundeniablesignaturesGroup-orientedundeniablesignatureUndeniableSignature验证时，需由验证者与签名者合作才可证明其正确性，此法可指定接收者，签名者可确定接收者是谁。ConvertibleUndeniableSignature可由签名者把UndeniableSignature转换成一般的数字签名。ConfirmerSignature与不可否认的数字签名目的相同，不同的是验证者须与指定的确认者合作。3.Schemesformulti-user:Multi-signaturesMulti-signatureschemewithdistinguishedsigningauthoritiesThresholdsignatures(Group-orientedsignature)ThresholdsignatureschemewithtraceablesignerMulti-Signature一份签名需由群体同意才能产生，其特征有只有群体內的成员才能签署文件接收者可验证签名对群体的有效性接收者无法确定哪些成员为签名者遇争议时，可公布签名者名单多重签名的方式可分为两类平行式串联式—需一位公证人DigitalSignaturewith(t,n)SharedVerification一个签名需由多位验证者合作才能验证其正确性，亦即n个验证者中,至少要t个验证者的合作.4.E-cashande-Votingscheme:BlindsignatureBlindthresholdsignaturePartiallyblindsignaturePartiallyBlindthresholdsignatureFairblindsignatureBlindSignature=DigitalSignature+EncryptionUnforgeabilityandUnlinkabilityApplicationsUntraceableElectronicCashAnonymousElectronicVotingPartiallyblindsignaturescanreducethestorageFairblindsignaturescandealwiththemisuseofunlinkabilityblindsignatureBlindSignature签名者不知道文件內容签名者无法追踪文件与盲签名的相互关系。(x,f(x))为privatekey与publickeyS(x,m)为文件m的签名B(m,r)为blinddocument,r为blindfactorU(s,r’)为urn-blindsignature,r为blindfactorBlindSignature的流程A传送blinddocumentB(m,r)给BB用privatekeyx对B(m,r)做签名,将S(x,B(m,r))传给AA验证S(x,B(m,r)),再计算U(S(x,B(m,r)),r’)得到最后的签名S(x,m)BlindSignature

D.Chaumproposedin1983D.Chaum’sBlindSignatureScheme◆

ItusestheRSAalgorithm.SecurityBasis:FactorizationProblem◆Construction:Bobhasapublickey,e,aprivatekey,d,andapublicmodulus,N.AlicewantsBobtosignmessageMblindly.

1.Alicechoosesarandomintegerkbetween1andN.ThensheblindsMbycomputingt=MkemodN.2.Bobsignst,td=(Mke)dmodN.3.Aliceunblindstdbycomputings=td/kmodN=MdmodN.sisthesignatureofmessageM.BlindSignatureProperty:UntraceableApplications:canbeusedinelectroniccashsystem.MerchantConsumerBanksignscoinsdatabaseCoin:(SN,s)1.t=SN×kemodN