|Previous||Table of Contents||Next|
Nonrepudiation and Digital Signatures
Alice can cheat with digital signatures and theres nothing that can be done about it. She can sign a document and then later claim that she did not. First, she signs the document normally. Then, she anonymously publishes her private key, conveniently loses it in a public place, or just pretends to do either one. Alice then claims that her signature has been compromised and that others are using it, pretending to be her. She disavows signing the document and any others that she signed using that private key. This is called repudiation.
Timestamps can limit the effects of this kind of cheating, but Alice can always claim that her key was compromised earlier. If Alice times things well, she can sign a document and then successfully claim that she didnt. This is why there is so much talk about private keys buried in tamper-resistant modulesso that Alice cant get at hers and abuse it.
Although nothing can be done about this possible abuse, one can take steps to guarantee that old signatures are not invalidated by actions taken in disputing new ones. (For example, Alice could lose her key to keep from paying Bob for the junk car he sold her yesterday and, in the process, invalidate her bank account.) The solution is for the receiver of a signed document to have it timestamped .
The general protocol is given in :
Another scheme uses Trent after the fact . After receiving a signed message, Bob can send a copy to Trent for verification. Trent can attest to the validity of Alices signature.
Applications of Digital Signatures
One of the earliest proposed applications of digital signatures was to facilitate the verification of nuclear test ban treaties [1454,1467]. The United States and the Soviet Union (anyone remember the Soviet Union?) permitted each other to put seismometers on the others soil to monitor nuclear tests. The problem was that each country needed to assure itself that the host nation was not tampering with the data from the monitoring nations seismometers. Simultaneously, the host nation needed to assure itself that the monitor was sending only the specific information needed for monitoring.
Conventional authentication techniques can solve the first problem, but only digital signatures can solve both problems. The host nation can read, but not alter, data from the seismometer, and the monitoring nation knows that the data has not been tampered with.
By combining digital signatures with public-key cryptography, we develop a protocol that combines the security of encryption with the authenticity of digital signatures. Think of a letter from your mother: The signature provides proof of authorship and the envelope provides privacy.
Signing before encrypting seems natural. When Alice writes a letter, she signs it and then puts it in an envelope. If she put the letter in the envelope unsigned and then signed the envelope, then Bob might worry if the letter hadnt been covertly replaced. If Bob showed to Carol Alices letter and envelope, Carol might accuse Bob of lying about which letter arrived in which envelope.
In electronic correspondence as well, signing before encrypting is a prudent practice . Not only is it more securean adversary cant remove a signature from an encrypted message and add his ownbut there are legal considerations: If the text to be signed is not visible to the signer when he affixes his signature, then the signature may have little legal force . And there are some cryptanalytic attacks against this technique with RSA signatures (see Section 19.3).
Theres no reason Alice has to use the same public-key/private-key key pair for encrypting and signing. She can have two key pairs: one for encryption and the other for signatures. Separation has its advantages: she can surrender her encryption key to the police without compromising her signature, one key can be escrowed (see Section 4.13) without affecting the other, and the keys can have different sizes and can expire at different times.
Of course, timestamps should be used with this protocol to prevent reuse of messages. Timestamps can also protect against other potential pitfalls, such as the one described below.
|Previous||Table of Contents||Next|