Welcome to section 5 Section 5 is
the second section dedicated to public key cryptography.
In section 4 we have seen how to build methods
for encryption and key agreement.
In Section 5 we'll first discuss how
to create digital signature methods from RSA.
Then we will see pkcs standards
that will consolidate RSA algorithms
that we have seen into secure and
standardized methods for encryption and
signature.
In video 5.1. We will see how
to construct in digital signature algorithm from RSA.
Let's get started.
Let's first review the general scheme of
digital signature method.
Alice has a pair of keys a public
APK and a private key or secret
key Escape.
She uses her secret key to compute
a signature s that she appended to
her message X.
and since the pair to Bob
Bob uses Alice's public key PK
to verify that the pair of message and signature
is valid.
Functionally Alice would like to prove to pop that
she is the origin of the message and
that the data she sent was not modified
during Transit.
the security guarantees
are that first it is impossible for
anyone who does not have the private
key to forge a valid pair access.
Second this guarantee must remain even
when the attacker has seen several valid
pairs of messages and
corresponding signatures.
The attackers should not be able to forge a
new pair of message and signature
by manipulating the previous ones.
The way we will proceed to achieve the previous goal
is by transforming a public encryption method
into a digital signature method.
This is done by inverting the rules
of the public key and symmetric
key.
and the encrypt decrypt routines
the signal release decrypts the message
and the verifier Bob encrypts it
Alice is obviously the only party authorized
to do the decrypt operation
as she is the only party who knows the private
key SK Bob which
can be any very verifier can apply the
encrypt using the public.
We would name the decrypt method assigned and the
encrypt method as extract.
Just to have meaningful names in the context of digital
signatures, but the operation performed in
sign and extract are exactly
the same as in decrypt encrypt routines
that we have seen in the previous video.
Notice that the signature method not
only proves origin authentication and data
integrity.
It also allows to recover the original
message from the signature.
So we do not need to send the message with
the signature.
Let's see detailed description of the operations performed by
Alison Bob.
First we have a key generation, which
is identical to what we saw for
the encryption. So there is generation of
the modulus and computation of
the public key e and the corresponding private
key D to sign
a message X Alice Rises the
message to the security key and
since the signature the result as
the signature s and Bob raises the
signature s that he received to the public
key to extract X.
This method is correct for the same reasons
that we saw in the previous video. I
wrote the detailed equalities for
you if you would like to further check,
but conceptually it is very
similar to what we have seen for
the encryption.
We just inverted the rules of the ENT.
How about security does the digital signature
method achieve the security guarantees? We
set a couple of slides ago.
Well, there are at least two security concerns
here first an attacker can
select a random s
Which will be a power of some message X
and the attacker can apply the
extract routine with the public
key because the he knows the public key.
So he can also know the message corresponding to
that signature.
And you would have obtained the valid pair XS so
he can forge the signatures.
The attacker has another way to forge valid
signatures. This is
from what we call a homomorphic property
of RSA and the explanation is
actually that from two signatures.
We can multiply them to obtain a third
valid signature. We
can see the detailed explanation here.
So when the attacker obtains to
sincers SNS prime,
it can be reply them.
And by here writing how these signatures are
related to some messages x and
x Prime and we have a result that says that
the product of two Powers with
the same exponent.
Is the power of the product of
X and X Prime to that exponent?
So this way the attacker obtained
a new signature corresponding to
the message X and express.
So this is another way how by manipulating
a previously sent signatures the
attacker can forge a new signature.
Previous security issues can be fixed using
cryptographic hash function.
This is the hush and sign approach.
So instead of directly signing a message.
We first hash it to obtain some digest h.
Then we sign the Digest.
So Alice sends a pair.
of
X the original message before the hashing and
the signature
Bob has first two recompute the
digest each from X.
Before verifying that S and
H is a valid beer.
I think the cryptographic hashing fix
the security concerns.
For the first attack that we saw in the previous Slide
the attacker cannot retrieve X from random
signature.
To be able to do that. He would have inverted the
hash function which is completely hard.
That's why it's important that we use a cryptographic
hash function and not any attraction.
For the second attack that we have seen these forgery of
signature from previously sent
signatures.
By multiplying the two signatures the
attacker can still obtain a
signature of some message.
But to retrieve the message corresponding to that signature,
he also has to invert the hash
function.
And keep in mind that in this scheme. We have
to send not only the signature but the
original message and the signature.
In this video we saw how to construct digital signatures
from RSA.
We also saw the sort of attacks we can
have with a naive Construction.
We introduced the high level idea of hash and
sign approach that fixes the security problems.
The next video will adapt this approach to our sacred to
system. And we also detail the RSA
standards for both encryption and
signatures.
So see you in the next video.