Digital Signature

1 SEMINAR REPORT 2010

DIGITAL SIGNATURE

ABSTRACT The electronic equivalent of a handwritten signature. There is more to it than than pasting a graphic of a signature signature into a text text docu docume ment nt.. Elec Electr tron onic ic sign signat atur ure e soft softwa ware re bind binds s a signature, or other mark, to a specific document. Just as experts can detect a paper contract that was altered after it was signed signed,, elect electron ronic ic signat signature ure softw software are can detect detect the alteration of an electronically signed file any time in the future.

CIC

(www.cic.com www.cic.com))

and

Silanis

Technology

(www.silanis.com ) ar are e pio pioneer neers s of elec electr tron onic ic sign signat atur ure e techno technolo logy, gy, which which has prove proven n especi especiall ally y releva relevant nt in the financial, insurance and real estate industries. An electronic sign signat atur ure e is ofte often n conf confuse used d with with a "dig "digit ital al sign signat atur ure, e,"" because it uses digital signature technology for detection alte altera rati tion on.. An elec electr tron onic ic sign signat atur ure e

also also re requ quir ires es user user

authentic authenticatio ation n such as a digital certifi certificate, cate, smart smart card or biometric method.

Dept.of COMPUTER SCIENCE

CAS,KDTY

The world's largest digital library

Try Scribd FREE for 30 days to access over 125 million titles without ads or interruptions! Start Free Trial Cancel Anytime.














DIGITAL SIGNATURE

CONTENTS 1. INTRODUCTION

3

2. WHY DIGITAL SIGNATURE

4

3. WHAT IS DIGITAL SIGNATURE

6

4. APPROACHES

9

•

DIRECT APPROACH

9

•

ARBITRATED APPROACH

10

5. HOW THE TECHNOLOGY WORKS

11

6. DIGITAL SIGNATURE STANDARD

12

8. DIGITAL SIGNATURE GENERATION

14

9. RE REQUIREMENTS FO FOR ME MESSAGE TR TRANSMISSION SE SECURITY

16

10. PURPOSE OF DIGITAL SIGNATURE 18 11. AN EXAMPLE

19

12. CONCLUSION

26














DIGITAL SIGNATURE

INTRODUCTION Digi Digita tall signa signatu ture re is a sort sort of Cr Cryp ypto togr grap aphy hy.. Cr Cryp ypto togr grap aphy hy means means keepin keeping g comm communic unication ations s

private. private. It It is a practi practical cal art art of of

converting messages or data into a different form, such that no one read them without having access to the ‘key’. The message may be converted using a ‘code’ (in which case each character or grou group p of char charac acte ters rs is subs substi titu tute ted d by an alte altern rnat ativ ive e one) one),, or ‘ciphe ‘cipher’ r’ (in which case the message message as a whole whole is conve converte rted, d, rath rather er than than indi indivi vidu dual al char charac acte ters rs). ). It deal deals s with with encr encryp ypti tion on,, decryption and authentication. There There are are two two types types of Cryptog Cryptograph raphy: y: 1. Secret key or Symmetric Cryptography 2. Public key or Asymmetric Asymmetric Cryptography

In Symmetric Cryptography the sender and receiver of a message know and use the same

secret key to encrypt the message, and

the receiver uses same key to decrypt the message. Asymmet Asymmetric ric (or public public key) Cryptograph Cryptography y involves involves two related related keys, one of which only the owner knows (the 'private key') and the other which anyone can know (the 'public key'). The advantages of Asymmetric Cryptography are that: •

•

Only one party needs to know the private key. The knowled knowledge ge of the public public key by a third third party party does does not

compromise

security of message transmission. transmissi on.














DIGITAL SIGNATURE

Why Digital Signature Message authentication protects two parties who exchange messages from any third party. However it does not protect two parties against each other. Several forms of disputes between the two are possible. Forr exam Fo exampl ple e supp suppos ose e that that john john send sends s an auth authen enti tica cate ted d mess messag age e to Ma Mary ry,,usin using g one one of the the sche scheme mes. s.Fo Foll llow owin ing g dispute that could arise : 1.

Mary may forge forge a different different message message and and claim claim that it

can come from John.Mary would simply have to create a message and append an authentication code using the key that John and Mary share. 2.

John John can can deny deny send sendin ing g the the mess messag age. e.Be Beca caus use e it is

possible for Mary to forge a message there is no way to prove that John did in fact send the message. Both scenarios are of legitmate concern.Here is an exampl example e of the first first scenar scenario: io:An An electr electroni onic c fund fund trans transfer fer take place and the receiver increases the amount of fund transferred and claims that larger amount had arrived from the sender.An example of the second scenarios is that an electronic nic

mail

messa ssage

conta ntains

instruction

to

a














DIGITAL SIGNATURE

In situation where there is not complete trust betw etwee een n

send sender er

and

rece re ceiiver, ver,so some metthing hing

more more

than han

authen authentic ticati ation on is needed needed .The .The most most attra attracti ctive ve soluti solution on to this problem is the digital signature .The digital signature is analog analogus us to the handwr handwritt itten en signat signature ure.It .It must must have have the following properties:

Properties : •

It must verify the author and the date and time of

signature . •

It must authenticate the the contents at the time of

signature. •

It must be verifiable by third parties,to resolve disputes.

Thus the digital digital function includes includes the authentication authentication function.

Requirements : On the basis of these prpperties ,we can formulate the following reqirements for a digital signature: •

The signature must must be a bit pattern pattern that depends on on the

message of being signed. •

The signature must must use some information information uniqe to to

sender ,to prevent both forgery and denial.













6 SEMINAR REPORT 2010 •

DIGITAL SIGNATURE

It must be relatively easy to recognize and verify the

digital signature. •

It must be computationally infeasible to forge a digital

signature ,either ,either by constructing constructing a new massage massage for an existing digital signature or by constructing a fraudulent digital signature for a given message. •

It must be practical to return a copy of the digital

signature in storage. A secure hash function ,embedded in a scheme such as that of figure satifies these reqirements.
















DIGITAL SIGNATURE

What is digital signature Basically, the idea behind digital signatures is the same as your handwritten signature. You use it to authenticate the fact that you promised something that you can't can't take take back back later. later. A digit digital al signat signature ure doesn' doesn'tt involv involve e signing something with a pen and paper then sending it over the Internet. But like a paper signature, it attaches the iden identi tity ty of the the sign signer er to a tran transa sact ctio ion. n. Havi Having ng a digi digita tall certificate is like using your driver's license to verify your identity.

You

may

have

obtained ned

your

license

from

Maryland, for example, but your Maryland license lets you drive in Nevada and Florida. Similarly, your digital certificate proves your online identity to anybody who accepts it. A digital signature can also be used to verify that info inform rmat atio ion n has has not not been been alte altere red d afte afterr it was was sign signed ed.. A digital signature is an electronic signature to be used in all imagi imaginab nable le type type of elect electron ronic ic trans transfer fer.. Digit Digital al signat signature ure significantly differs from other electronic signatures in term














DIGITAL SIGNATURE

verified. The digital signature of a document is a piece of information based on both the document and the signer’s private key. It is typically created through the use of a hash function and a private signing function (encrypting with the signer’s private key). Digital Signatures and hand – written signatures both rely on the fact that it is very hard to find two people with the same signature. People use public –key cryptography to compute digital signatures by associating some someth thin ing g uniq unique ue with with ea each ch pers person on.. When When publ public ic-k -key ey cryp crypto togr grap aphy hy is used used to encr encryp yptt a mess messag age, e, the the send sender er encrypts the message with the public key of the intended recip ecipiient ent. When When publ publiic -ke key y crypt rypto ograp graph hy is used used to calc calcul ulat ate e a digi digita tall sign signat atur ure, e, the the send sender er encr encryp ypts ts the the “digital fingerprint” of the document with his or her own private key. Anyone with access to the public key of the signer may verify the signature. In practice, public-key algorithms are often too inefficient for signing long documents. To save time, digital signature protoc protocols ols use a crypto cryptogra graphi phic c digest digest,, which which is a one-w one-way ay














DIGITAL SIGNATURE

3. The document and the signed hash are transmitted. 4. The recipient recipient produc produces es a one-way hash hash of the document. document. 5. Usin Using g

the the

digi digittal sign signat atur ure e

decrypts the signed

algo algori rith thm, m,th the e

reci re cipi pien entt

hash with the sender's public key.

If the signed hash matches the recipient's hash, the signature is valid and the document is intact.

There is a potential problem with this type of digital signature. Alice not only signed the message she intended to but also signed all other messages that happen to hash to the same message digest. When two messages hash to the sam same messa essage ge dige digest st it is call alled a col collisi lisio on; the collision-free properties of hash functions are a necessary security requirement for most digital signature schemes. A hash function is secure if it is very time consuming, if at all possible, to figure out the original message given its digest. However, there is an attack called the birthday attack that














DIGITAL SIGNATURE

accountability, just as a manufacturer’s brand name does on packaged software. If an organization or individual wants to use the Internet to distribute software, they should be willing to take responsibility for that software. This is based on the the prem premis ise e that that acco account untab abil ilit ity y is a dete deterr rren entt to the the distribution of harmful code.














DIGITAL SIGNATURE

APPROACHES A vari variet ety y of appr approa oach ches es have have been been prop propos osed ed for for digi digita tall signature

function ion.

These

approaches

fall

into

two

categories: •

Direct approach

•

Arbitrated approach

Direct digital signature: A direct digital signature involves only the comm commun unic icat atio ion n part partie ies s (sou (sourc rce e and and dest destin inat atio ion) n).. It is assumed that the destination knows the public key of the source. A digital signature may be formed by encrypting the entir ntire e messa essage ge with the sen sender’ der’s s pri private ate ke key y or by encrypting the hash code of the message with the sender’s private key. Confidentiality can be provided by further
















DIGITAL SIGNATURE

All direct schemes described so far have a common flaw: The validity of the scheme depends on the security of the sender’s private key. If a sender later wishes to deny sending a particular message, he can claim that the private key was lost or stolen and that someone else forged his signature. Administrative controls relating to the security of private private keys can be employed to thwart or at least weaken this ploy. One example is to require every signed message to incl includ ude e a time timest stam amp p (dat (date e and and time time)) and and to re requ quir ire e prompt

reporting to

compromise

keys

by

a

central

authority. Another threat is that the private key might be stolen from sender X at time T. The opponent can then send














DIGITAL SIGNATURE

there here ar are e no chanc hances es of a send sende er X to diso isownin ning the message, as is the case with the direct digital signatures. The arbiter plays a crucial role in arbitrated digital signatures and all parties must have a great deal of trust that the arbitration mechanism working properly. The use of a trusted system might satisfy this requirement.

HOW THE TECHNOLOGY WORKS Digital

signatures

require

the

use

of

public-key

cryptography .If you are going to sign something, digitally, you need to obtain both a public key and a private key. The














DIGITAL SIGNATURE














DIGITAL SIGNATURE

DIGITAL SIGNATURE STANDARD The National Institute Institute of Standards Standards and Technology has published Federal Information processing standards Publications (FIPS PUBS), known as digital signature standard. The DSS makes use of the Secure Hash Algorithm (SHA) and present a new digital signature technique called the Digital Signature Algorithm (DSA) appropriate for applications requiring a digital rather than written signature. The DSA digital digital signature is a pair pair of large numbers numbers represented in a computer as strings of binary digits. The digital signature is computed using a set of rules (i.e., the DSA) and a set of parameters such that the identity of the signatory and integrity of the data can be verified. The DSA














DIGITAL SIGNATURE

message digest (see Figure 1). The message digest is then input to the DSA to generate the digital signature. The digital signature is sent to the intended verifier along with the signed data (often called the message). The verifier of the message and signature verifies the signature by using the sender's public key. The same hash function must also be used in the verification process. The hash function is specified in a separate standard, the Secure S ecure Hash Standard (SHS), FIPS 180. Similar procedures may be used to generate and verify signatures for stored as well as transmitted data.
















DIGITAL SIGNATURE

is inte intend nded ed for for use use in elec electr tron onic ic mail mail,, elec electr tron onic ic fund funds s transfer, transfer, electronic electronic data exchange, exchange, software software distribut distribution, ion, data data storag storage, e, and other other applic applicati ations ons which which requir require e data data integrity assurance and data origin authentication. The DSA may be implemented in software, firmwa firmware, re, hardwa hardware, re, or any combi combinat nation ion thereo thereof. f. NIST NIST is developing a validation program to test implementations for conformance to this standard.














DIGITAL SIGNATURE

DIGITAL SIGNATURE GENERATION To begin with the process, a check

(mes (messa sage ge)) must must be crea create ted. d. In or orde derr to crea create te a digi digita tall sign signat atur ure e with ith the chec heck, a pro process ess know nown as “has hash function must occur. The hash function is a mathematical algorithm that creates a digital representation or fingerprint














DIGITAL SIGNATURE

something called a digital certificate. For that, you go to a certi certific ficate ate issuer issuer,, which which will will give give you you a digita digitall certi certific ficate ate that says, in effect, "Here is Mike, and here is his public key. Anyt Anythi hing ng he sign signs s with with his his corr corres espo pond ndin ing g priv privat ate e ke key y is valid." When you buy something online and digitally sign the transaction, you provide the merchant with your digital certificate. If the merchant trusts the issuer of the certificate, he uses the certificate to verify your signature.














DIGITAL SIGNATURE

Requirements for Message Transmission Security The requirements of a security regime which addresses these risks are conventionally summarized under four broad headings. For the sender and receiver to be confident in the outcome of their communications, all of these requirements need to be satisfied.














DIGITAL SIGNATURE

This requires that the recipient can be sure that, whether accidentally, or because of an action by any party: •

The message has not not been changed or lost during

transmission; •

The message has not not been prevented from from reaching the

recipient; and •

The message has not not reached the recipient recipient twice.
















DIGITAL SIGNATURE

PURPOSE OF DIGITAL SIGNATURE














DIGITAL SIGNATURE

digital signatures yield a high degree of assurance without adding resources for processing.














DIGITAL SIGNATURE

AN EXAMPLE














DIGITAL SIGNATURE

Bob’s Public key is available to anyone who needs it, but he keeps his Private key to himself.Keys are used to encrypt information. Encrypting information means "scrambling it up", so that only a














DIGITAL SIGNATURE

very difficult to forge. In addition, the signature assures that any chan change ges s made ade to the the data data that that has has been been sign signed ed can can not not go undetected.































































Digital Signature

Recommend Documents