Subject: I-D ACTION:draft-schaad-dhsign-00.txt

From: "Jim Schaad (Exchange)" <[email-masked]>
Date: Fri, 13 Nov 1998 12:04:29 -0800

This draft is referenced from the new CMC draft so it should be of interest
to the readers of that draft.

>To: IETF-Announce: ;
>From: [email-masked]
>Reply-to: [email-masked]
>Subject: I-D ACTION:draft-schaad-dhsign-00.txt
>Date: Fri, 13 Nov 1998 10:46:45 -0500
>Sender: [email-masked]
>
>A New Internet-Draft is available from the on-line Internet-Drafts
directories.
>
>
>	Title		: Diffie-Hellman Signing Algorithm
>	Author(s)	: H. Prafullchandra, J. Schaad
>	Filename	: draft-schaad-dhsign-00.txt
>	Pages		: 8
>	Date		: 12-Nov-98
>	
>This document describes a method for producing a signature from a
>Diffie-Hellman key pair.  This behavior is needed for such operations as
>creating a signature of a PKCS #10 certification request.  This document
>describes two different flavors of the signature algorithm, one using a
>D-H key from a CA and the other using a temporary key created by the
>signer.
>
>Internet-Drafts are available by anonymous FTP.  Login with the username
>"anonymous" and a password of your e-mail address.  After logging in,
>type "cd internet-drafts" and then
>	"get draft-schaad-dhsign-00.txt".
>A URL for the Internet-Draft is:
>ftp://ftp.ietf.org/internet-drafts/draft-schaad-dhsign-00.txt
>
>Internet-Drafts directories are located at:
>
>	Africa:	ftp.is.co.za
>	
>	Europe: ftp.nordu.net
>		ftp.nic.it
>			
>	Pacific Rim: munnari.oz.au
>	
>	US East Coast: ftp.ietf.org
>	
>	US West Coast: ftp.isi.edu
>
>Internet-Drafts are also available by mail.
>
>Send a message to:	[email-masked].  In the body type:
>	"FILE /internet-drafts/draft-schaad-dhsign-00.txt".
>	
>NOTE:	The mail server at ietf.org can return the document in
>	MIME-encoded form by using the "mpack" utility.  To use this
>	feature, insert the command "ENCODING mime" before the "FILE"
>	command.  To decode the response(s), you will need "munpack" or
>	a MIME-compliant mail reader.  Different MIME-compliant mail readers
>	exhibit different behavior, especially when dealing with
>	"multipart" MIME messages (i.e. documents which have been split
>	up into multiple messages), so check your local documentation on
>	how to manipulate these messages.
>		
>		
>Below is the data which will enable a MIME compliant mail reader
>implementation to automatically retrieve the ASCII version of the
>Internet-Draft.
>Content-Type: text/plain
>Content-ID:	<[email-masked]>
>
>ENCODING mime
>FILE /internet-drafts/draft-schaad-dhsign-00.txt
>
><ftp://ftp.ietf.org/internet-drafts/draft-schaad-dhsign-00.txt>

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: EKR <[email-masked]>
Date: 13 Nov 1998 15:46:39 -0800

> to the readers of that draft.
Jim, 
First, a meta-comment:
Why do we need this at all? DH keys are suitable for computing
DSA signatures. Wouldn't it be simpler just to compute a DSA
signature over the data? This would eliminate the need for a common
group between the sender and recipient.

Secondly, I don't believe that the ephemeral scheme is strong.
Provided that the attacker has access to the triplet
g,p,Ys (sender's public key), it's trivial for him to compute
a private key Xe such that he knows:
  
Ye^Xe = g^(XsXe) 

This allows him to forge any number of signed messages
Remember, computing the DH shared secret requires access
to only one of the DH private keys.

I hesitate to bring this up because I'm sure I'm missing something
really obvious, but I sure can't see what it is.

Confused,
-Ekr

-- 
[Eric Rescorla                                   [email-masked]]

---

From: Tony Bartoletti <[email-masked]>
Date: Fri, 13 Nov 1998 17:57:05 -0800

>a private key Xe such that he knows:

Since g^(Xs) = Ys, don't you mean Ys^Xe = g(XsXe) ?

So you use the shared secret Ys^Xe = g(XsXe).  The recipient
must calculate the same shared secret, using the "Xr" of their
own keypair (Xr,Yr), and the (supposed) sender's Ys.  I believe
DH key agreement needs both sides public keys to be "certified"
or otherwise already trusted by both parties.
 
The DSA and DH methods rest upon the "hardness" of inverting
the exponential.  Given you know g, p, and Y (Y = (g^X)mod p)
you should not be able to recover X (in human time, anyway).
But I gather you didn't intend to say you could recover X.
 
>to only one of the DH private keys.

Perhaps I don't understand ALL the issues;)  My understanding:

  Let (Xs,Ys) = sender's keypair
  Let (Xr,Yr) = recipient's keypair
 
  SENDER calculates:     Yr^Xs = g^(XrXs) = SharedSecret1
  RECIPIENT calculates:  Ys^Xr = g^(XsXr) = SharedSecret1

Now, for an impostor to pose as SENDER to the RECIPIENT, they
would need either the sender's Xs or the recipient's Xr.  But
each of these are supposedly secret.

Is the "ephemeral" scheme different than this?
 
>Confused,

Me too.
___tony___

>-Ekr

Tony Bartoletti                                             LL
SPI-NET GURU                                             LL LL
Computer Security Technology Center                   LL LL LL
Lawrence Livermore National Lab                       LL LL LL
PO Box 808, L - 303                                   LL LL LLLLLLLL
Livermore, CA 94551-9900                              LL LLLLLLLL
email: [email-masked]   phone: 510-422-3881             LLLLLLLL