Delegation of cryptographic servers for capture-resilient devices

ABSTRACT

A device that performs private key operations (signatures or decryptions), and whose private key operations are protected by a password, can be immunized against offline dictionary attacks in case of capture by forcing the device to confirm a password guess with a designated remote server in order to perform a private key operation. Recent proposals for achieving this allow untrusted servers and require no server initialization per device. In this paper we extend these proposals to enable dynamic delegation from one server to another; i.e., the device can subsequently use the second server to secure its private key operations. One application is to allow a user who is traveling to a foreign country to temporarily delegate to a server local to that country the ability to confirm password guesses and aid the user's device in performing private key operations, or in the limit, to temporarily delegate this ability to a token in the user's possession. Another application is proactive security for the device's private key, i.e., proactive updates to the device and servers to eliminate any threat of offline password guessing attacks due to previously compromised servers.

REFERENCES

• 1: Mihir Bellare , Anand Desai , David Pointcheval , Phillip Rogaway, Relations Among Notions of Security for Public-Key Encryption Schemes, Proceedings of the 18th Annual International Cryptology Conference on Advances in Cryptology, p.26-45, August 23-27, 1998
• 2: Mihir Bellare , Phillip Rogaway, Random oracles are practical: a paradigm for designing efficient protocols, Proceedings of the 1st ACM conference on Computer and communications security, p.62-73, November 03-05, 1993, Fairfax, Virginia, United States [doi>10.1145/168588.168596]
• 3: M. Bellare and P. Rogaway. Optimal asymmetric encryption. In EUROCRYPT '94 (LNCS 950), pp. 92-111, 1995.
• 4: M. Bellare and P. Rogaway. The exact security ofdigital signatures|How to sign with RSA and Rabin. In EUROCRYPT '96 (LNCS 1070), pp. 399-416, 1996.
• 5: C. Boyd. Digital multisignatures. In H. J. Beker and F. C. Piper, editors, Cryptography and Coding, pp. 241-246. Clarendon Press, 1989.
• 6: Ronald Cramer , Victor Shoup, A Practical Public Key Cryptosystem Provably Secure Against Adaptive Chosen Ciphertext Attack, Proceedings of the 18th Annual International Cryptology Conference on Advances in Cryptology, p.13-25, August 23-27, 1998
• 7: Dorothy E. Denning, Digital signatures with RSA and other public-key cryptosystems, Communications of the ACM, v.27 n.4, p.388-392, April 1984 [doi>10.1145/358027.358052]
• 8: R. Ganesan, Yaksha: augmenting Kerberos with public key cryptography, Proceedings of the 1995 Symposium on Network and Distributed System Security (SNDSS'95), p.132, February 16-17, 1995
• 9: Shafi Goldwasser , Silvio Micali , Ronald L. Rivest, A digital signature scheme secure against adaptive chosen-message attacks, SIAM Journal on Computing, v.17 n.2, p.281-308, April 1988 [doi>10.1137/0217017]
• 10: Amir Herzberg , Markus Jakobsson , Stanislław Jarecki , Hugo Krawczyk , Moti Yung, Proactive public key and signature systems, Proceedings of the 4th ACM conference on Computer and communications security, p.100-110, April 01-04, 1997, Zurich, Switzerland [doi>10.1145/266420.266442]
• 11: D. N. Hoover and B. N. Kausik. Software smart cards via cryptographic camou age. In 1999 IEEE Symp. on Security and Privacy, pp. 208-215, 1999.
• 12: D. Klein. Foiling the cracker: A survey of, and improvements to, password security. In 2 nd USENIX Security Workshop, Aug. 1990.
• 13: Philip MacKenzie , Michael K. Reiter, Networked Cryptographic Devices Resilient to Capture, Proceedings of the 2001 IEEE Symposium on Security and Privacy, p.12, May 14-16, 2001
• 14: Robert Morris , Ken Thompson, Password security: a case history, Communications of the ACM, v.22 n.11, p.594-597, Nov. 1979 [doi>10.1145/359168.359172]
• 15: Ueli M. Maurer , Stefan Wolf, The Diffie–Hellman Protocol, Designs, Codes and Cryptography, v.19 n.2-3, p.147-171, March 2000 [doi>10.1023/A:1008302122286]
• 16: Charles Rackoff , Daniel R. Simon, Non-Interactive Zero-Knowledge Proof of Knowledge and Chosen Ciphertext Attack, Proceedings of the 11th Annual International Cryptology Conference on Advances in Cryptology, p.433-444, August 11-15, 1991
• 17: R. L. Rivest , A. Shamir , L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Communications of the ACM, v.21 n.2, p.120-126, Feb. 1978 [doi>10.1145/359340.359342]
• 18: V. Shoup and R. Gennaro. Securing threshold cryptosystems against chosen ciphertext attack. In EUROCRYPT '98, pp. 1-16, 1998.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.5 COMPUTER SYSTEM IMPLEMENTATION
      C.5.5 Servers

Additional Classification:
  E. Data
  E.3 DATA ENCRYPTION
      Subjects: Public key cryptosystems

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Electronic data interchange (EDI)

General Terms:
Algorithms, Design, Security