WO2006069994A2

WO2006069994A2 - Process and device for the authentication of communications

Info

Publication number: WO2006069994A2
Application number: PCT/EP2005/057176
Authority: WO
Inventors: Roberto Di Pietro; Antonio Durante; Luigi Mancini
Original assignee: Universita' Degli Studi Di Roma 'la Sapienza'
Priority date: 2004-12-27
Filing date: 2005-12-27
Publication date: 2006-07-06
Also published as: ITRM20040642A1; WO2006069994A3

Abstract

A process is described for the authentication of communications that allows chameleonic hash functions to be used without the aid of other authentication mechanisms for electronically signing data.

Description

Process and device for the authentication of communications Field of the invention

This invention refers to the field of communications safety and, more precisely, to a process and device for the authentication of communications. Prior art

The authentication of communications can be defined as a process able to certify the origin of the data. Various authentication techniques exist and they are currently used as basic elements for e-commerce applications, home-banking, pay-tv and other applications in which it is necessary to determine the authenticity of transmitted data with a high level of security.

The basic scheme of authentication methods can be summarized as follows. An authenticator party A possesses IT tools and a secret item of information (typically a secret value, known as a key) that fulfil an authentication technique. A is therefore able to create a binding connection between its own identity and the data that it wishes to authenticate.

The validity of the authentication process rests on the fact that third parties C are unable to authenticate the data instead of A, even if they possess the IT tools of which A disposes, because they do not possess the secret item of information. So-called chameleon hash functions are known, such as those defined and described in the article "Chameleon signatures", authors H. Krawczyk and T. Rabin, published in the Proceedings of the 7^th Annual Symposium on Network and Distributed System Security, year 2000, pages 143-154, for example. A hash function consists of a special mathematical transformation that, when applied to a document to be signed, maps a so-called "footprint" or "stamp": this is a "summary" composed of a greatly reduced (and constant) number of bits, which unambiguously represents the original document. It is necessary that the hash function employed benefits from certain important properties. Briefly put, we can say that a good hash function must be "non-invertible" and "collision-free". The first property means that given a stamp (namely, the hash of a document), it must not be possible to extract the document from which it derives, while the second means that it must not be possible to find two different documents that produce the same stamp. For example, a standard public-domain hash function that enjoys these and other properties is the hash function known as SHA-1 , described in the publication "FIPS PUB 180-1" edited by the National Institute of Standard -NIST- USA, and available from the Internet site http://www.itl.nist.gov/fipspubs/fip180-1.htm. These functions are used in the known manner in combination with standard asymmetric cryptography techniques, such as the RSA functions for example, described in the article by R. Rivest, A. Shamir and L. Adleman, entitled "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", Communications of the ACM, 21 (2), pp. 120-126, February 1978. The RSA functions implement non-transferable electronic signatures, used precisely for authentication.

These known communications authentication techniques are afflicted by the main drawback of computational complication, which limits their effective use, for example, in many practical situations where processing resources are limited. Summary of the invention

Thus, the object of this invention is that of indicating a process and device for the authentication of communications, based on the use of chameleon functions, able to overcome the aforesaid drawbacks. A process and device for the authentication of communications is the object of this invention, as better described in the claims, which form an integral part of this description.

Brief description of the figures

Objects and advantages of this invention shall become apparent from the detailed description that follows of an embodiment thereof (and of its variants) and the enclosed drawings, given by way of a non-limiting example, in which:

Figures 1 and 2 illustrate the steps of the process forming the subject of this invention.

Detailed description of the invention

The Authentication Technique forming the subject of the invention allows a chameleon hash function to be used without the aid of other authentication methods for electronically signing data. According to the general aspects of the method forming the subject of the invention, a party that wishes to use the chameleon hash functions for authenticating data generates two values, CKR and HKR, in accordance with a given generation algorithm, in itself known.

The HKR value is known as the public key and anyone who knows it is able to efficiently calculate the chameleonic hash function, indicated as CHR(m, r).

The possessor of CKR (the secret key, known as the "trapdoor") can easily find collisions for a given output value of the chameleon function. Given a message mO and a pseudo-random value rO (otherwise known as a seed), the CHR function generates a hash value CHR(mO, rO) that satisfies the following properties:

- collision resistance: an efficient algorithm that knowing only the public key HKR can find the two pairs (mO, rO) and (ml , M ), where mO <> ml and/or rO <> M , such that CHR(m0, rO) = CHR(m1 , M ), does not exist. This is due to the fact that all messages m induce the same distribution probability on CHR(m0, rO) for a value "r" chosen in a uniformly random manner.

- secret key collision: there is an efficient algorithm that taking the secret key CKR, any pair mO, rO and any ml as input, finds a value r1 such that CHR(m0, rO) = CHR(m1 , r1).

More in particular, the Authentication Technique forming the subject of the invention provides for the following steps.

1. Let d be the data to authenticate, HKR the public key and CKR the secret key of a chameleonic function, and CHR(m, r) an application of a chameleonic function, in itself known. Lastly, let H and H be two different standard hash functions, based on the above-mentioned SHA-1 standard for example. Note that CHR :< {0; 1}^w , {0; 1}^w > → {0; 1}²*, where typical values of w could be 1024, and vary in function of the chosen security level and the particular function chosen for implementation.

2. A sender A chooses two values mO and rO in a pseudo-random manner and calculates: β = CHR(m0, rO), (phase M1 , Fig. 1 ) Y = H(β), (phase M2, Fig. 1 ) Given mO, rO and the value H(d | Y), and considering the collision property of the secret key, the sender A is able to generate a pseudo-random value s1 such that CHR(H (d I Y), s1 ) = β (phase M3, Fig. 1 ).

3. Sender A sends the three values to an addressee B: < γ_> d, s1 >, where Y is known as the "authentication token", d is the data to be authenticated and s1 is the pseudo-random value, (phase M4, Fig. 1 ).

4. Addressee B receives the three values < Y, d, s1 > (phase D1 , Fig. 2) and calculates:

• δ = CHR( H (d I Y), s1 ), (phase D2, Fig. 2).

• In phase D3 (Fig. 2), checks that the equivalence H(δ ) = Y is satisfied. If so, then the authentication of the data d is considered as having been successfully performed by addressee B (phase D4, Fig. 2), because only A who possesses the secret key CHR is able to generate s1 in a manner for which CHR( H (d | Y), s1 ) = H(δ) = \. Instead, if the equivalence H(δ ) = Y is not satisfied, authentication fails, phase D5, Fig. 2. Third parties cannot sign data d instead of A because an efficient algorithm does not exist that, knowing only As public key HKR, can find a pair mθ, rO and H(d |

Y), s1 such that CHR(m0, rO) = CHR( H (d | Y), S1 ).

An example of a device that embodies the authentication method forming the subject of the invention thus contemplates a part resident with the sender and a part with the addressee.

The part resident with the sender performs the calculations described in point 2 above, determines the values < Y, d, s1 > and transmits them to the addressee, as in phases M1-M4 in Fig. 1.

The part resident with the addressee receives the values < Y, d, s1 > and performs the calculations described in point 4 above, as in phases D1-D5 in Fig.

2.

The device can be implemented via computers of known type resident with the sender and the addressee, opportunely programmed using known programming languages, such as C, C++ or C# for example. The process can be implemented to advantage through programs resident in said computers that include means of coding for implementing one or more steps of the process, when these programs are run on said computers. It is therefore intended that the scope of protection extends to said programs for computers and also to the media that can be read by computer and contain a recorded message, said computer-readable media including program code for implementing one or more steps of the process when said program is run on a computer. The advantages deriving from the application of this invention are evident. The proposed authentication method allows:

- checking the authenticity of data, incurring a reduced computational cost with respect to other similar techniques (the above-mentioned RSA for example), thanks to the particular efficiency in implementing the chameleon hash functions, based in particular on the techniques described in the above-mentioned article "Chameleon signatures". In fact, while the RSA authentication algorithm requires a computational cost in checking the authenticity of a message equal to O(|z|²), where |z| is the length in bits of the message to authenticate, a "claw-free" implementation allows a cost of only O(|z|) to be incurred. The computational cost is found to be similarly advantageous also in the generation phase of authenticated data.

- reducing the size of the data sent to the addressee for allowing data authentication. In particular, it can be noted that the length of the additional information to allow authentication consists in the values Y and s1 (the data d would in fact be sent in any case). These values are smaller with respect to the values required for RSA type authentication algorithms. The authentication of data with RSA implies the generation of a packet with the length of the encoding key, which is typically 2048 bits. To have the same level of security using the proposed authentication method, s1 can be equal to 1024 bits and v is typically 128 bits long.

- guaranteeing the authenticity and non-repudiation properties of the data. In fact, only the possessor of the secret key can generate the pseudo-random value s1 such that:

CHR( H (d I Y), s1 ) = CHR(m0, rθ) = β. - resistance to attacks. The security of the proposed scheme resides in the difficulty for an attacker to calculate a collision for a particular value generated via a chameleon function in the absence of the secret key CKR. In particular, the chameleonic functions can base their difficulty in calculating a collision, in the absence of the private key, on factorization techniques, such as RSA mentioned above, for example, or on the problem of calculating the discrete logarithm, as reported in the article by T. EIGamal: "A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms"; IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. IT-31 , NO. 4, JULY 1985, pp. 469-472. These and other characteristics render the authentication method forming the subject of the invention advantageously applicable to the field of communications between devices of limited processing capacity, such as mobile phones or networks of sensors, for example. In point-to-point or point-to-multipoint communications.

Other embodiments for the described non-limitative example are possible, without however departing from the scope of protection of this invention, including all of the equivalent embodiments for a person skilled in the art. From the above-provided description, a person skilled in the art is able to realize the subject of the invention without introducing further constructional details.

Claims

1. A process for the authentication of communications based on the use of chameleon hash functions, characterized in that it includes the phases of: a)- providing data (d) to authenticate, a public key (HKR) and a secret key (CKR) of a chameleon function, an application of a chameleon function (CHR(m, r)), and two different standard hash functions (H and H). b)- in a generation phase:

- choosing two values (mθ, rO) in a pseudo-random manner;

- calculating the values: β = CHR(m0, rO) and Y = H(β)

- given mθ, rO, and a value H(d | Y), generating a pseudo-random value (s1 ) such that: CHR(H (d | Y), s1 ) = β (phase M3, Fig. 1 )

- generating three values: < Y, d, s1 >. c)- in an authentication phase, based on said three values < Y, d, s1 >: - calculating δ = CHR( H (d | Y), S1 )

- checking the equivalence: H(δ ) = Y

- if said equivalence is satisfied, then said data d is authenticated;

- if said equivalence is not satisfied, then said data d is not authenticated.

2. A process for the authentication of communications based on the use of chameleon hash functions, characterized in that it includes the phases of: a)- having data (d) to authenticate, a public key (HKR) and a secret key (CKR) of a chameleon function; an application of a chameleon function (CHR(m, r)), and two different standard hash functions (H and H). b)- in a generation phase: - choosing two values (mθ, rO) in a pseudo-random manner;

- calculating the values: β = CHR(m0, rO) and Y = H(β)

- given mθ, rO, and a value H(d | Y), generating a pseudo-random value (s1 ) such that: CHR(H (d | Y), s1 ) = β (phase M3, Fig. 1 ) - generating three values: < Y, d, s1 >.

3. A process for the authentication of communications based on the use of chameleon hash functions, characterized in that it includes the phases of: a)- having data (d) to authenticate, a public key (HKR) and a secret key (CKR) of a chameleon function; an application of a chameleon function (CHR(m, r)), and two different standard hash functions (H and H). b)- having three values < Y, d, s1 > generated in a generation phase including the phases of:

- choosing two values (mθ, rO) in a pseudo-random manner

- calculating the values: β = CHR(mO, rO) and Y = H(β)

- generating three values: < Y, d, s1 >. c)- calculating δ = CHR( H (d | Y), S1 );

- checking the equivalence: H(δ ) = Y;

- if said equivalence is satisfied, then said data d is authenticated; - if said equivalence is not satisfied, then said data d is not authenticated.

4. A process for the authentication of communications according to claim 2 or 3, characterized in that said three values < Y, d, s1 > are transmitted and/or received.

5. A device for the authentication of communications based on the use of chameleon hash functions, characterized in that it includes means for the embodiment of the process in claim 1.

6. A device for the authentication of communications based on the use of chameleonic hash functions, characterized in that it includes means for the embodiment of the process in claim 2.

7. A device for the authentication of communications based on the use of chameleonic hash functions, characterized in that it includes means for the performing the process in claim 3.

8. A computer program that includes program code suitable for performing the steps of any of the claims 1 to 4, when said program is run on a computer.

9. Computer-readable media including a recorded program, said computer- readable media including program code suitable for carrying out the steps of any of the claims 1 to 4, when said program is run on a computer.