Digital signature forgery

In a cryptographic digital signature or MAC system, digital signature forgery is the ability to create a pair consisting of a message, $m$ , and a signature (or MAC), $\sigma$ , that is valid for $m$ , where $m$ has not been signed in the past by the legitimate signer. There are three types of forgery: existential, selective, and universal.^[1]

Types

Besides the following attacks, there is also a total break: when adversary can compute the signer's private key and therefore forge any possible signature on any message.^[2]

Existential forgery (existential unforgeability, EUF)

Existential forgery is the creation (by an adversary) of at least one message/signature pair, $(m, \sigma)$ , where $\sigma$ was not produced by the legitimate signer. The adversary need not have any control over $m$ ; $m$ need not have any particular meaning; the message content is irrelevant — as long as the pair, $(m, \sigma)$ , is valid, the adversary has succeeded in constructing an existential forgery.

Existential forgery is essentially the weakest adversarial goal, therefore the strongest schemes are those that are existentially unforgeable.

Signature of a product of two messages

Take an algorithm, like RSA, with the multiplicative property:

\sigma (m1)\cdot \sigma (m2)=\sigma (m1\cdot m2)

.

This property can be exploited sending a message $m'=m1\cdot m2$ with a signature $\sigma (m')=\sigma (m1\cdot m2)$ .^[3]

A common defense to this attack is to hash the messages before signing them.^[3]

Selective forgery (selective unforgeability, SUF)

Selective forgery is the creation (by an adversary) of a message/signature pair $(m, \sigma)$ where $m$ has been chosen by the challenger prior to the attack.^[4] $m$ may be chosen to have interesting mathematical properties with respect to the signature algorithm; however, in selective forgery, $m$ must be fixed before the start of the attack.

The ability to successfully conduct a selective forgery attack implies the ability to successfully conduct an existential forgery attack.

Universal forgery (universal unforgeability, UUF)

Universal forgery is the creation (by an adversary) of a valid signature, $\sigma$ , for any given message, $m$ . An adversary capable of universal forgery is able to sign messages he chose himself (as in selective forgery), messages chosen at random, or even specific messages provided by an opponent.

References

↑ Vaudenay, Serge (September 16, 2005). A Classical Introduction to Cryptography: Applications for Communications Security (1st ed.). Springer. p. 254. ISBN 978-0-387-25464-7.
↑ Goldwasser, Shafi; Bellare, Mihir (2008). Lecture Notes on Cryptography. Summer course on cryptography. p. 170.
1 2 Fabrizio d'Amore (April 2012). "Digital signatures - DSA" (PDF). La Sapienza University of Rome. pp. 8–9. Retrieved July 27, 2018.
↑ Smart, Nigel P. Cryptography Made Simple. Springer. p. 217. ISBN 978-3-319-21935-6.

This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.

[1] Vaudenay, Serge (September 16, 2005). A Classical Introduction to Cryptography: Applications for Communications Security (1st ed.). Springer. p. 254. ISBN 978-0-387-25464-7.

[GoldwasserBellare-2] Goldwasser, Shafi; Bellare, Mihir (2008). Lecture Notes on Cryptography. Summer course on cryptography. p. 170.

[damore-3] 1 2 Fabrizio d'Amore (April 2012). "Digital signatures - DSA" (PDF). La Sapienza University of Rome. pp. 8–9. Retrieved July 27, 2018.

[4] Smart, Nigel P. Cryptography Made Simple. Springer. p. 217. ISBN 978-3-319-21935-6.