Couponing Scheme Reduces Computational Power Requirements for DSS Signatures

This paper introduces the new concept of ’use & throw’ DSS authentication coupons. An authentication coupon is a couple of precalculated certificates provided by a trusted centre during a prior on-line communication. Coupons are 28 bytes long and contain r and a cryptogram of the information to be used during the computation of s. Coupons can be even reduced to exactly 20-bytes if only one new common random number is generated during each loading session. DSS Certificates embedding information relevant to applications introduce higher security against fraudulent attempt. Certificates are issued by the authority at the time of loading the related set of coupons. The signature protocol enables simple 8-bit microcontrollers to generate fully compatible DSS signatures in less than 200 ms, about 300 ms with the certificate management, by retrieving r and computing s from the coupon with only two 160-bit modular multiplications. Couponing assumes that the signer enters periodically in contact with the authority to refresh the coupon’s reserve. 1 The DSA Original Scheme The U.S. government has proposed a new cryptographic algorithm as a standard to verify electronically the integrity and source of unclassified information. The process is quite simple in its main goal: it works somewhat like a letter sealed in a transparent envelope. Any receiver can verify the integrity of the message and the identity of the sender. The Digital Signature Standard [1] approval would lead to an efficient information system where electronic documents would be virtually equivalent to paper ones. Authentication based on digital signatures not only assures the receiver that a bank transaction was sent by, say, CityBank from the East Coast to the West Coast, but also the rightness of the message (the message has not been modified by a forger or altered due to a problem on the line). 2 David M’Räıhi and David Naccache The Digital Signature Algorithm (DSA), proposed in August 1991 by the US National Institute of Standards and Technology, is a DLP-based cryptosystem which parameters are: 1. A prime modulus p where 2 < p < 2 for 512 ≤ L ≤ 1024 and L mod 64 = 0. 2. A prime q such that 2 < q < 2 and p − 1 is a multiple of q. 3. A number g = h mod p for some h. 4. A 160-bit secret-key x and an L-bit public-key y defined by the relation: y = g mod p. The integers p, q and g are system parameters and can be public and/or common to a group of users. A 160-bit random k, used by the signer, must be kept secret and regenerated for each signature. In order to sign a message m (hashed value of a primitive file M), the signer computes the signature {r, s} by: r = (g mod p) mod q and s = m + xr k mod q To check {r, s}, the verifier computes: w = 1 s mod q, u1 = mw mod q and u2 = rw mod q And compares if r = (g1y2 mod p) mod q to accept or reject the signature Assuming no algorithmic sophistications, the resources necessary for the implementation of the DSA are: resources Signer Verifier # of 160 bit mult. 2 2 # of 512 bit mult. ≈237 ≈475 modular inverse yes yes transmission 40 bytes size of moduli 84 bytes And the complete process is briefly summarised in figure 1.