A cryptologist at Bell Labs has shown how to improve a standard method for ensuring the trustworthiness of e-commerce transactions, after discovering a flaw that could have made such transactions vulnerable to tampering in the future. A digital signature enables software at the receiving end of an electronic transaction to confirm the identity of the party initiating the transaction and to verify the integrity of the received information. The vulnerability of DSA, which is part of the Digital Signature Standard, does not pose an immediate threat because of the computing power required to launch an attack. If not addressed, however, this weakness could have compromised the future integrity of secure transactions on the Internet and on corporate and governmental intranets. Virtual private networks, online shopping, and financial transactions are among the applications that could have been affected.
Complementary standards provide techniques for keeping confidential information secure.
The vulnerability that Bleichenbacher found in DSA lies in the method that it specifies for generating a secret, random numerical key for each message. The effectiveness of the keys depends on how random the numbers actually are, since this determines how much information an adversary can infer about them. The probability that the algorithm will generate any particular number should be virtually uniform across the range of all possible results. Bleichenbacher further discovered that this bias significantly weakens DSA and could eventually make it more vulnerable to tampering. Though the task of cracking digital signatures would challenge today's most powerful supercomputers, it will become easier for future generations of computers.