Gustavus J. Simmons Sandia National Laboratories Albuquerque, NM 87185

Transcription

1 An Impersonaton-Proof Identty Verfcaton Scheme* Gustavus J. Smmons Sanda Natonal Laboratores Albuquerque, NM Most schemes for the verfcaton of personal dentty are logcally flawed n that they requre an ndvdual to exhbt a pece of prvate,.e., secret, nformaton such as a computer access password, a telephone credt card number, a personal dentfcaton number (PIN), etc., to prove hs dentty. The logcal problem s that ths nformaton, once exhbted, s potentally compromsed and. could be used by anyone to undetectably mpersonate the legtmate owner. What s needed s a protocol that wll allow an ndvdual to "prove" that he knows the secret pece of nformaton, whose possesson s equated wth hs dentty, wthout revealng anythng about the nformaton tself whch could ad a would-be cheater to mpersonate hm. Several nvestgators have proposed dentfcaton schemes to accomplsh ths [1,2,3,4] that depend on nteractve-proof schemes, often referred to as zero-knowledge proofs or png-pong protocols, n whch the ndvdual responds to a seres of queres n a way that the legtmate user could, but whch an mpostor (probably) could not. We descrbe a smpler dentty verfcaton scheme whch uses a publc authentcaton channel to valdate a prvate authentcaton channel belongng to the ndvdual who wshes to prove hs dentty. The publc and the prvate channels can be completely ndependent and can even be based on dfferent authentcaton algorthms, or they can both be of the same type. Ths scheme also provdes certfed recepts for transactons whose legtmacy can later be verfed by mpartal arbters who were not nvolved n the transacton tself. The dentty verfcaton scheme descrbed here presupposes the exstence of a trusted ssuer of valdated (sgned) dentfcaton credentals. Ths could be a government agency, a credt card center or fnancal nsttuton, a mltary command center, a centralzed computer faclty, etc. The ssuer frst establshes a publc authentcaton channel to whch he retans the (secret) authentcatng functon. For smplcty, we wll use the well known authentcaton channel based on the RSA cryptoalgorthm for both the publc (ssuer) and the prvate (user) channels, although, as mentoned earler, authentcaton channels based on any other algorthm would work equally well. The ssuer chooses a par of prmes p and q by the same standards used to compute a good RSA modulus,.e., so that t s computatonally nfeasble for anyone to factor n, and then calculates a par of encrypton/decrypton exponents, e and d such that; ' * Ths work performed at Sanda Natonal Laboratores supported by the U. S. Department of Energy under contract no. DE-AC04-76DP C. Pomerance (Ed.): Advances n Cryptology - CRYPT0 '87, LNCS 293, pp , Spnnger-Verlag Berln Hedelberg 1988

2 21 2 ed = 1 (mod p(n)). n and d are made publc. The ssuer keeps e (and equvalently the factors p and 9) secret; n fact, the securty of the system aganst fraudulent clams of valdated dentty s no better than the qualty of protecton gven to e by the ssuer. The ssuer also chooses a polyrandom functon f that maps arbtrary strngs of symbols to the range [O,n). By polyrandom we mean that f cannot be dstngushed from a truly random functon by any polynomally bounded computaton. Many strong, snglekey, cryptographc functons, such as the DES, appear to adequately approxmate ths condton. f s also made publc by the ssuer. User 's dentty s assocated wth an dentfer, I, consstng of such nformaton as hs socal securty number, hs bank account or credt card number, hs mltary ID, etc., and whch could also nch& physcal descrptors such as dgtzed fngerprnts, voce prnts, retnal eye prnts, etc., or any other useful descrptve nformaton, as well as any lmtatons on the authorzaton conveyed n the sgned dentfer, such as credt lmts, expraton date, levels of access, etc. Most mportantly, I. must nclude the publc part of the user's personal authentcaton channel consstng of an RSA modulus n, n > n, and an assocated decrypton exponent d, plus, redundant nformaton, such as message format, fxed felds of symbols common to all dentfers, I, etc. The ssuer calculates and encrypts m usng hs secret key, e. to form the sgnature, s, for the dentfer, I, S, - my (mod n) The ssuer gves the credental (I,s ) to user. No part of the credental need be kept secret. However, the user must keep secret hs prvate encrypton exponent, e, correspondng to d. protectng e, snce hs proof of dentty n the scheme s equated to knowng e. The publc nformaton s the ssuer's modulus n and decrypton exponent d, the polyrandom functon f and a knowledge of the redundant nformaton present n all of, - m for randomly chosen sgnatures s n the I, whch must be suffcent to prevent a forward search cryptanalytc attack [5] on the polyrandom functon f. In other words, someone wshng to fraudulently valdate an dentty could calculate s d the hopes of obtanng a ht wth f(1) for some usable I -- ths s the forward search attack. Hs securty aganst mpersonaton s dependent on hs By makng I contan suffcent redundant nformaton, the probabl- ty of success of ths sort of attack can be made as small as desred. When user wshes to prove hs dentty to a party A, say to gan access to a restrcted faclty or to log on to a computer or to wthdraw money from an ATM,

3 21 3 etc., he ntates the exchange by dentfyng hmself to A usng hs dentfcaton credental: u. s a strng of symbols that descrbes or dentfes the transacton s requestng; u could be the date, the amount of the wthdrawal, etc. A, who need not be a subscrber hmself,.e., he may not have an dentfcaton Credental ssued by the trusted ssuer, reples wth a strng of symbols, ua, that descrbe the transacton from hs standpont; termnal ID, transacton number, Confrmaton of wthdrawal mount, etc.. ua A Both user and A form the concatenaton of u and ua, u - u, ua, and calculate the polyrandom functon f(u) of the resultng strng; 2 - f(u). In addton, A calculates f(i) - m and s d whch wll n all probabflty equal m modulo n f aqd only f the ssung authorty sgned I wth s. Hence A accepts the credental (I,s) as vald f and only f d f(i) - s (mod n). At ths pont n the protocol, A s confdent that the user dentfed n I can authentcate messages usng the prvate authentcaton channel descrbed n I, n other words, that user knows e. In partcular, user can calculate - ze (mod d) t usng hs prvate exponent e, whch he communcates to A: tl A Note that z s beng used effectvely as a one-tme key, ndetermnate to both and A because of the polyrandom nature of f, to permt to gve A an encrypted functon of z n a form that wll permt A to satsfy hmself that had to know e wthout provdng any nformaton whatsoever about el. A knows the dentty clamed by from I, whch he accepts as vald f and only f the followng dentty s satsfed:

4 21 4 d t. * z (mod n) If the person seekng to be recognzed as user really s who he clams to be,.e., f he knows e, then (1) wll be satsfed. However, f he s not user, SO that he doesn't know e, then n order for hm to be able to mpersonate,.e.. to cause (1) to be satsfed, he must be able to fnd a number x such that d x = z (mod n) n or d are values sgned by the ssuer n I wth only the authorzed user knowng e or equvalently the factorzaton of n z s a pseudorandom number ontly ' determned by user and by A. Solvng (2) wthout knowng e s equvalent to breakng the RSA cryptoal orthm from cphertext alone. A keeps the 4-tuple (I,s.):u,t as hs certfed recept for the transac- 9 1 l ton. Anyone, usng only publcly avalable nformaton..e., n, d and f, can verfy that the &-tuple satsfes (1) whch valdates the transacton descrpton and verfes that t was sgned,.e., endorsed, by user. If both communcants requre a certfed recept the one-way protocol descrbed above can be easly mod- fed to be a two-way protocol between two partes, and, both of whom must possess dentfcaton credentals valdated by the ssuer. All actons are sp- metrc n ths case. The exchange s of the form (I,s.):u 1 + (I,s):u t where user would keep the 4-tuple [(I,s):u,t ] as hs certfed recept, etc. References 1. A. Fat and A. Shamr, "How to prove yourself: practcal solutons to dentfcaton and sgnature problems," Proceedngs of Crypto-86, Santa Barbara, August 1986, pp A. Shamr, "Identty-based cryptosystems and sgnature schemes," Proceedngs of Crypto'84, Santa Barbara, August 1984, pp Goldrech, S. Hcal and A. Wgderson, "Proofs that yeld nothng but the valdty of the asserton and the methodology of cryptographc protocol desgn," Submtted to 27th Symposum on Foundatons of Computer Scence, November 1986.

5 E. Okamoto, 'Proposal for dentty-based key dstrbuton systems," nectroncs Letters, Vol. 22, No. 24 (Nov. 20, 1986), pp G. J. Smmons and D. B. Holdrdge, "Forward search as a cryptanalytc tool aganst a publc key prvacy channel," Proceedngs of the IEEE Computer Socety 1982 Symposum on Securty and Prvacy, Oakland, CA, Aprl 26-28, 1982, pp