網(wǎng)絡(luò)安全導(dǎo)論 課件 第八章 消息認(rèn)證與數(shù)字簽名

第八章消息認(rèn)證與數(shù)字簽名討論議題

1、消息認(rèn)證概念消息認(rèn)證碼2、有限域3、數(shù)字簽名基本簽名算法特殊簽名算法消息認(rèn)證實(shí)現(xiàn)方法比較1、

消息認(rèn)證消息認(rèn)證是指驗(yàn)證者驗(yàn)證所接收到的消息是否確實(shí)來(lái)自真正的發(fā)送方、并且消息在傳送中沒(méi)被修改的過(guò)程。消息認(rèn)證是抗擊偽裝、內(nèi)容篡改、序號(hào)篡改、計(jì)時(shí)篡改和信源抵賴的有效方法。什么是消息認(rèn)證？加密技術(shù)可用來(lái)實(shí)現(xiàn)消息認(rèn)證數(shù)字簽名也可用來(lái)實(shí)現(xiàn)消息認(rèn)證消息認(rèn)證更為簡(jiǎn)單的實(shí)現(xiàn)方法是利用消息認(rèn)證碼消息認(rèn)證的實(shí)現(xiàn)方法消息認(rèn)證碼(MAC)也稱密碼校驗(yàn)和，是指消息被一密鑰控制的公開單向函數(shù)作用后、產(chǎn)生的固定長(zhǎng)度的數(shù)值，即MAC=CK(M)。

消息認(rèn)證碼安全的MAC函數(shù)MAC=CK(M)不但要求要具有單向性和固定長(zhǎng)度的輸出，而且應(yīng)滿足：（1）

如果敵手得到M和CK(M)，則構(gòu)造一滿足CK(M′)=CK(M)的新消息M′在計(jì)算上是不可行的。（2）

CK(M)在以下意義下是均勻分布的：

隨機(jī)選取兩個(gè)消息M、M′，Pr[CK(M)=CK(M′)]=2-n，其中n為MAC的長(zhǎng)。（3）若M′是M的某個(gè)變換，即M′=f(M)，例如f為插入一個(gè)或多個(gè)比特，那么Pr[CK(M)=CK(M′)]=2-n。

消息認(rèn)證碼的安全性要求

消息認(rèn)證碼的構(gòu)造2、有限域什么是有限域？域是一種可進(jìn)行加、減、乘、除運(yùn)算的代數(shù)結(jié)構(gòu)。有限域是僅含有限個(gè)元素的域，有限域在近代編碼、計(jì)算機(jī)理論、組合數(shù)學(xué)等各方面有著廣泛的應(yīng)用。例子例8-1

集合{0，1，2，3，4，5，6}按模7進(jìn)行加減乘除運(yùn)算，便構(gòu)成一個(gè)有限域，這個(gè)域稱為GF（7），在該域中，2/3=2*1/3=2*5=3。例8-2系數(shù)為0、1的多項(xiàng)式，按模多項(xiàng)式x8+x4+x3+x+1進(jìn)行加減乘除運(yùn)算，也構(gòu)成了一個(gè)有限域，稱為GF（28）。這個(gè)域共有256個(gè)元素構(gòu)成，每個(gè)元素可用一個(gè)字節(jié)表示，比如十六進(jìn)制表示的一個(gè)字節(jié)57即為01010111,也即是x6+x4+x2+x+1。3、數(shù)字簽名DigitalsignatureGoal:Usethedigitaltechniquetoemulatethe“hand-writtensignature”SecurityrequirementsUnforgeability:onecannotcreateasignaturethatisclaimedtobeanother’sUndeniability:thesignercannotlaterdenythevalidityofhissignatureRequirementsThesignaturedependsonthesignerandthedocumenttobesigned.Easytocompute:itiseasyforasignertosignadocumentUniversalverifiability:everyonecanverifyvalidityofasignature(withrespecttothesignerandthedocument)Easytostore:thesignatureshouldbeshort

enoughAttacksondigitalsignatureAttacktypeKey-onlyattack(ciphertext-only)Known-messageattack(known-plaintext)Chosen-messageattack

(chosen-plaintext)ForgerytyeExistentialforgerySelectiveforgeryMessageSignFunctionVerificationFunctionSigner’ssecretkeyMessageSignatureSigner’spublickeyMessage

CheckMessage=?Message

TheModelofDigitalSignatureDigitalsignature:usageOff-line:Signingadocumentforemulatingthehand-writtensignatureOn-line:identityauthentication(+sessionkeydistribution)BobAlicechallengecr=Sig(KRBob,c)IfVer(KUBob,r,c)=truethenacceptthat“Bobistalkingtome”Whatsecurityservicecandigitalsignatureprovide?DataIntegrityAuthenticationNon-forgeabilityNon-repudiation

簽名的一個(gè)重要應(yīng)用證書認(rèn)證中心(CA)第三方信任的模型Fig.信任的層次結(jié)構(gòu)公正的被信任者經(jīng)認(rèn)定可以被信任的中間角色用戶群AB網(wǎng)絡(luò)空間的信任建立問(wèn)題是信息安全討論的核心問(wèn)題，網(wǎng)絡(luò)空間的信任建立方法很大程度上借鑒了傳統(tǒng)生活中建立信任的方法。正如手寫簽名在傳統(tǒng)生活中的重要作用一樣，數(shù)字簽名是網(wǎng)絡(luò)空間中建立信任的一塊基石。

結(jié)論ChinaDigitalSignatureLawhavebecomeeffectiveApril12005ChinaDigitalSignatureLawhasbecomeeffectivePartOne OverviewPartTwo ElectronicDataPartThreeDigitalSignatureandCertification AuthorityPartFour LegalResponsibility

PartSix SupplementaryArticlesDigitalSignatureLawisanInfrastructureofE-COMSupplyChainOnlinePaymentTradingPlatformInformationExchangePlatformCreditSystemDigitalSignatureLawisInfrastructure3.1、基本簽名算法FundamentalschemesSignatureschemesbasedonerror-correctingcodesSignatureschemesbasedontwohardproblems

Signatureschemesbasedonellipticcurves

AlgorithmfoundationTwoFamousDigitalSignatureSchemes1.RSADigitalsignaturescheme(basedonthefactorizationproblem)2.ElGamaldigitalsignatureandMeta-ElGamalsignatureschemes(basedonthediscretelogarithm)

?RSADigitalSignature

(R.L.Rivest,A.Shamir,andL.M.Adleman,1978)?ElGamalDigitalSignature

(T.ElGamal,1985)?Schnorr’sDigitalSignature

(C.P.Schnorr,1989)?DSS

(NIST,1991)Somepopularalgorithms

RSAPublicKeyCryptosystemandDigitalSignatureScheme

Rivest,Shamir,andAdlemanproposedin1978RSAPublicKeyCryptosystem

◆SecurityBasis:FactorizationProblem.

◆Construction:

1.ChoosetwolargeprimenumbersPandQ,thencomputeN=P×Q.2.Selectanintegeresuchthatgcd(e,

(N))=1.3.Computedsuchthate×dmod

(N)=1.4.Publickey=(N,e).5.Privatekey=(P,Q,d).RSAPublicKeyCryptosystemandDigitalSignatureScheme

RSADigitalSignatureScheme

SignFunction:SignatureS=MdmodN.VerificationFunction:M=SemodN.

ExampleP=11,Q=13,N=143,and

(143)=120.e=103,thend=7(for103×7mod120=1).SignforM=3:S=37mod143=42.Verification:M=SemodN=42103mod143=3.ElGamalPublicKeyCryptosystemandDigitalSignatureScheme

ElGamalproposedin1985ElGamalPublicKeyCryptosystem◆

SecurityBasis:DiscreteLogarithmProblem1.IfPisalargeprimeandgandyareintegers,findxsuchthaty=gxmodP.2.ThesecurityrestrictiononP:P-1mustcontainalargeprimefactorQ.◆Construction:

1.ChoosealargeprimenumberPandageneratorgofGF(P).2.Privatekey:arandomintegerxbetween1andP-1.3.Publickey:y=gxmodP.ElGamalPublicKeyCryptosystemandDigitalSignatureScheme

SignFunction:Signature(r,s)formessageM.1.Selectarandomintegerkbetween1andP-1suchthatgcd(k,P-1)=1.2.Computer=gkmodP.3.Computes=k-1(M-xr)mod(P-1).VerificationFunction:

VerifybycheckingwhethergMmodP=(rs)×(yr)modP.(rs)×(yr)=g(M-xr)×gxr=g(M-xr)+xr=gMmodP.ElGamalPublicKeyCryptosystemandDigitalSignatureScheme

ExampleP=23,g=5.x=3,theny=10(for53mod23=10).SignforthemessageM=8.Selectk=5between1and22(P-1).Computer=gkmodP=55mod23=20.Computes=k-1(M-xr)mod(P-1)=5-1(8-3×20)mod22=9×14mod22=16.Verification:gM=58mod23=16(rs)(yr)modP=2016×1020mod23=13×3mod23=16.Schnorr’sDigitalSignatureScheme

SignFunction:Signature(r,s)formessageM.1.

Selectarandomintegerkbetween1andP-1.2.Computer=h(M,gkmodP).3.Computes=k+x*rmod(P-1).,wherethesecretkeyxthepublickeyy=g-xmodP4.Send(M,r,s)tothereceiver.VerificationFunction:ComputegkmodP=gsyrmodP.Verifybycheckingwhetherr=h(M,gkmodP).DigitalSignatureStandard（DSS)Proposedin1991byNISTasFIPS186-2

Signature:

r=(gkmodp)modq s=k-1(H(m)+xr)modq Verification

t=s-1modq r’=(gH(m)tyrtmodp)modq Ifr=r’,(r,s)islegal.

p:512bitsprimenumber q:160bitsprimenumberandq|(p-1) g:g=h(p-1)/qmodp,h(anyinteger)<p-1 H:onewayhashfunction x:privatekey<q y:y=gxmodp(correspondingpublickey) k-1k=1modq,(r,s)isthesignatureofm.

數(shù)字簽名的實(shí)現(xiàn)類.NETFramework提供了以下類來(lái)實(shí)現(xiàn)數(shù)字簽名算法：DSACryptoServiceProviderRSACryptoServiceProvider3.2、特殊簽名算法1.Schemeswithmessagerecovery:SignatureswithmessagerecoveryAuthenticatedencryptionschemesAuthenticatedencryptionschemewithmessagelinkagesAuthenticatedencryptionschemewith(t,n)sharedverificationDigitalSignaturewithMessageRecovery建立在ElGamal架構(gòu)上，其特點(diǎn)是驗(yàn)證的結(jié)果即為文件本身。2.Schemeswithsigner-aidedverification:UndeniablesignatureConfirmersignaturesConvertibleundeniablesignaturesGroup-orientedundeniablesignatureUndeniableSignature驗(yàn)證時(shí)，需由驗(yàn)證者與簽名者合作才可證明其正確性，此法可指定接收者，簽名者可確定接收者是誰(shuí)。ConvertibleUndeniableSignature可由簽名者把UndeniableSignature轉(zhuǎn)換成一般的數(shù)字簽名。ConfirmerSignature與不可否認(rèn)的數(shù)字簽名目的相同，不同的是驗(yàn)證者須與指定的確認(rèn)者合作。3.Schemesformulti-user:Multi-signaturesMulti-signatureschemewithdistinguishedsigningauthoritiesThresholdsignatures(Group-orientedsignature)ThresholdsignatureschemewithtraceablesignerMulti-Signature一份簽名需由群體同意才能產(chǎn)生，其特征有只有群體內(nèi)的成員才能簽署文件接收者可驗(yàn)證簽名對(duì)群體的有效性接收者無(wú)法確定哪些成員為簽名者遇爭(zhēng)議時(shí)，可公布簽名者名單多重簽名的方式可分為兩類平行式串聯(lián)式—需一位公證人DigitalSignaturewith(t,n)SharedVerification一個(gè)簽名需由多位驗(yàn)證者合作才能驗(yàn)證其正確性，亦即n個(gè)驗(yàn)證者中,至少要t個(gè)驗(yàn)證者的合作.4.E-cashande-Votingscheme:BlindsignatureBlindthresholdsignaturePartiallyblindsignaturePartiallyBlindthresholdsignatureFairblindsignatureBlindSignature=DigitalSignature+EncryptionUnforgeabilityandUnlinkabilityApplicationsUntraceableElectronicCashAnonymousElectronicVotingPartiallyblindsignaturescanreducethestorageFairblindsignaturescandealwiththemisuseofunlinkabilityblindsignatureBlindSignature簽名者不知道文件內(nèi)容簽名者無(wú)法追蹤文件與盲簽名的相互關(guān)系。(x,f(x))為privatekey與publickeyS(x,m)為文件m的簽名B(m,r)為blinddocument,r為blindfactorU(s,r’)為urn-blindsignature,r為blindfactorBlindSignature的流程A傳送blinddocumentB(m,r)給BB用privatekeyx對(duì)B(m,r)做簽名,將S(x,B(m,r))傳給AA驗(yàn)證S(x,B(m,r)),再計(jì)算U(S(x,B(m,r)),r’)得到最后的簽名S(x,m)BlindSignature

D.Chaumproposedin1983D.Chaum’sBlindSignatureScheme◆

ItusestheRSAalgorithm.SecurityBasis:FactorizationProblem◆Construction:Bobhasapublickey,e,aprivatekey,d,andapublicmodulus,N.AlicewantsBobtosignmessageMblindly.

1.Alicechoosesarandomintegerkbetween1andN.ThensheblindsMbycomputingt=MkemodN.2.Bobsignst,td=(Mke)dmodN.3.Aliceunblindstdbycomputings=td/kmodN=MdmodN.sisthesignatureofmessageM.BlindSignatureProperty:UntraceableApplications:canbeusedinelectroniccashsystem.MerchantConsumerBanksignscoinsdatabaseCoin:(SN,s)1.t=SN×kemodN