Analysis of VMSS Schemes for Group Key Transfer Protocol

Transcription

1 Aalss of VMSS Schemes for Group Ke Trasfer Protocol Chg-Fag Hsu, Sha Wu To cte ths verso: Chg-Fag Hsu, Sha Wu. Aalss of VMSS Schemes for Group Ke Trasfer Protocol. Chg- Hse Hsu; Xuahua Sh; Valeta Salapura. 11th IFIP Iteratoal Coferece o Netor ad Parallel Computg (NPC), Sep 2014, Ila, Taa. Sprger, Lecture Notes Computer Scece, LNCS-8707, pp , 2014, Netor ad Parallel Computg. < / _51>. <hal > HAL Id: hal Submtted o 25 Nov 2016 HAL s a mult-dscplar ope access archve for the depost ad dssemato of scetfc research documets, hether the are publshed or ot. The documets ma come from teachg ad research sttutos Frace or abroad, or from publc or prvate research ceters. L archve ouverte plurdscplare HAL, est destée au dépôt et à la dffuso de documets scetfques de veau recherche, publés ou o, émaat des établssemets d esegemet et de recherche fraças ou étragers, des laboratores publcs ou prvés. Dstrbuted uder a Creatve Commos Attrbuto 4.0 Iteratoal Lcese

2 Aalss of VMSS schemes for group e trasfer protocol Chg-Fag Hsu 1 Sha Wu 2 1 (Computer School, Cetral Cha Normal Uverst, Wuha, , Cha) 2 (Wuha Techolog ad Busess Uverst, Wuha, , Cha) cherrgfag@gmal.com Abstract. Ko group e trasfer protocols group commucatos usg classcal secret sharg requre that a t -degree terpolatg polomal be computed order to ecrpt ad decrpt the secret group e. Secret sharg plas a mportat role esurg the group commucatos securt. A verfable mult-secret sharg (VMSS) scheme s a mult-secret sharg scheme th the verfable propert. Recetl, Zhao et al. ad Dehord et al. successvel proposed to threshold VMSS schemes. Shortl, usg the same verfcato mechasm, Dehord et al. preseted aother to VMSS schemes. I these schemes, authors clamed that the dealer as absolutel mpossble to become a cheater. I ths paper, e sho that both Zhao scheme ad Dehord scheme, a dshoest dealer ma dstrbute a fae share to a certa partcpat, ad the that partcpat ould subsequetl ever obta the true secret. Ideed, verfcato mechasm should be mproved these schemes; ad furthermore our results hghlght that extra cautos stll be exercsed he costructg schemes ths drecto. Results A verfable mult-secret sharg (VMSS) scheme s a mult-secret sharg scheme th the verfable propert. Recetl, Zhao et al. [3] ad Dehord et al. [1] successvel proposed to threshold VMSS schemes. Shortl, usg the same verfcato mechasm, Dehord et al. preseted aother to VMSS schemes [2]. I these schemes, authors clamed that the dealer as absolutel mpossble to become a cheater. I ths paper, e sho that both Zhao scheme ad Dehord scheme, a dshoest dealer ma dstrbute a fae share to a certa partcpat, ad the that partcpat ould subsequetl ever obta the true secret. Ideed, verfcato mechasm should be mproved these schemes; ad furthermore our results hghlght that extra cautos stll be exercsed he costructg schemes ths drecto.

3 Crptaalss of Zhao scheme I Zhao scheme [3], e assume that D s a dshoest dealer. Let M ( {1.2,..., } ) be a certa partcpat M. The goal of D s to dstrbute a fae share to M ad M ll ot detect ths ad, hece, M ould subsequetl ever obta the true secret. A more detaled descrpto of the attac s as follos: (1) As a prelmar step, D chooses a teger s from the terval [2, N ] s+1 ad computes I R mod N such that I I for 1.2,..., ; (2) After polomal h( x) mod Q s costructed, D computes h ( I ) mod Q for 1.2,...,, ad specall computes h( I ) mod Q stead of h ( I ) mod Q. Afterards, D publshs 1 (,,..., ) or 1 (,,...,, h(1), h(2),..., h( t)) ; (3) Whe a t partcpats clude M at to recover the secrets P, P,.., P (thout loss of geeralt, suppose partcpats { M } t ), t s 1 eas to see that abod ca verf s matched th are doe, I ' s true or false but ca ot verf I or ot for 1.2,..., t. Therefore, after the verfcatos M s uable to detect a dscrepac o (actuall, h( I ) mod Q s ot matched th I ); 1 (4) B usg Lagrage terpolato polomal, these t partcpats clude M ll uquel obta aother polomal h( x) ' mod Q but ot h( x) mod Q, sce the complete share dstrbuted to ot correctl pared. As a cosequece, P, P,.., P. M, that s ( I, ), s M ould ever obta the secrets Through the attac, the verfcato mechasm of Zhao scheme s completel compromsed. Crptaalss of Dehord scheme Ideed, the attac of Dehord scheme [1] s the same as that of Zhao scheme. I Dehord scheme [1], e assume that D s a dshoest dealer. Let M ( {1.2,..., } ) be a certa partcpat M. The goal of D s to dstrbute a fae share to M ad M ll ot detect ths ad, hece, M ould 2

4 subsequetl ever obta the true secret. A more detaled descrpto of the attac s as follos: (1) As a prelmar step, D chooses a teger f ( r, s ) such that (2) After +1 f ( r, s ) +1 s ad computes 1 f ( r, s ) f ( r, s ) for 1.2,..., ; 1 { r, G g } s publshed ad polomal h( x) mod q s costructed, D computes h ( f ( r, s )) mod q for 1.2,...,, ad specall computes h( f ( r, s )) mod q stead of 1 h ( f ( r, s )) mod q. Afterards, D publshs ( h(1), h(2),..., h( t),,,..., ) ; (3) Whe a t partcpats clude N (,,..., ) or M at to recover the secrets P, P,.., P (thout loss of geeralt, suppose partcpats { M } t ), t s 1 eas to see that abod ca verf f ( r, s ) s true or false but ca ot verf s matched th f ( r, s ) or ot for 1.2,..., t. Therefore, after the verfcatos are doe, (actuall, M s uable to detect a dscrepac o h( f ( r, s )) mod q s ot matched th f ( r, s ) ); 1 (4) B usg Lagrage terpolato polomal, these t partcpats clude M ll uquel obta aother polomal h( x) ' mod q but ot h( x) mod q, sce the complete share dstrbuted to ( f ( r, s ), ), s ot correctl pared. As a cosequece, obta the secrets P, P,.., P. M, that s M ould ever Through ths attac, the verfcato mechasm of Dehord scheme [1] s completel compromsed. Furthermore, sce the eer VMSS schemes proposed b Dehord et al. [2] are based o the same verfcato mechasm, our attac equall apples to them. Coutermeasure The ma fla Zhao scheme ad Dehord scheme s that there are o a for the partcpat to chec hether I (or f ( r, s ) ) chose b her/hmself ad publshed b D are correctl pared or ot. All partcpats ca ot be sure that s matched th I (or f ( r, s ) ) b ol checg the correctess of I (or f ( r, s ) ). Ths oversght allos the dshoest dealer our attac to sed the forged 3

5 thout beg detected b the partcpat. The smplest a to resolve the securt problems th Zhao scheme ad Dehord scheme ould be to chage the verfcato equatos. For Dehord scheme, stead of computg P G f ( r, s ) g for 1.2,...,, D eed to compute G g 1 mod p for 0,1, 2,..., 1 ad publsh them. Through checg g t1 f ( r, s ) ( G ) mod p 0 f ( r, s ) (f t) or g ( G ) mod p (f t ) for 1.2,...,, the partcpats verf hether f ( r, s ) ad are vald (.e, correctl pared). After the secrets are recovered, the partcpats chec P 1 0 G g 1 mod p for 0,1, 2,..., 1 to verf hether P, P,.., P are vald. As a cosequece, our attac ll o loger be vald agast the fxed scheme. I the same a, ths verfcato mechasm equall apples to Zhao scheme ad the eer VMSS schemes proposed b Dehord et al. [2]. Cocluso Ths paper has cosdered the securt of Zhao scheme ad Dehord scheme for verfable mult-secret sharg. Although these schemes clamed the dealer as absolutel mpossble to become a cheater, e have sho that the schemes are deed completel secure agast a dshoest dealer. I addto, e have recommeded a small chage to the schemes that ca address the detfed securt problem. Furthermore, our attac ad securt patch appl also to the eer VMSS schemes proposed b Dehord et al. Refereces [1] M. Hada Dehord, S. Mashhad, A effcet threshold verfable mult-secret sharg, Computer Stadards & Iterfaces 30 (3) (2008) [2] M. Hada Dehord, S. Mashhad, Ne effcet ad practcal verfable mult-secret sharg schemes, Iformato Sceces 178 (9) (2008) [3] J. Zhao, J. Zhag, R. Zhao, A practcal verfable mult-secret sharg scheme, Computer Stadards & Iterfaces 29 (1) (2007)