Cryptanalysis of Improved Liaw s Broadcasting Cryptosystem *

Transcription

1 JOURNAL OF INFORMATION SCIENCE AND ENGINEERING 22, (26) Cryptanalysis of Improv Liaw s Broacasting Cryptosystm * J. MUÑOZ MASQUÉ AND A. PEINADO ** Dpartamnto Trataminto la Informacióny Coificación Instituto Física Aplicaa l CSIC C/Srrano, Mari, Spain aim@ic.scic.s ** Dpartamnto Ingniría Comunicacions E.T.S.I. Tlcomunicación Univrsia Málaga Campus Tatinos, E2971 Málaga, Spain apinao@ic.uma.s An inconsistncy in th improvmnt givn in [1] on Liaw s broacasting crytosystm [2] is tct an nw attacks to th systm ar prsnt. A moification of th cryptosystm to ovrcom both th conspiracy attack an our own cryptanalysis is propos. Kywors: cryptanalysis, broacasting ncryption, ky managmnt, public-ky cryptosystm, avsropping, factorization problm 1. INTRODUCTION A scur broacasting cryptosystm must provi a scur communication channl from a snr to a group of lgal or authoriz rcivrs. Many of th propos systms [3-5] rquir a larg numbr of broacast mssags an prsnt a numbr of problms. Morovr, Liaw [2] propos a scur broacasting schm with fwr broacasting mssags, which allows asy insrtion of nw usrs into th activ group. Latr, Tsng an Jan [1] foun svral waknsss in Liaw s schm an propos a moification. Th waknsss tct in [1] allow intrurs to obtain th mastr ky by mans of a conspiracy attack, thus braking th scurity of th systm. Morovr, Sun [7] prov that Liaw s broacasting cryptosystm cannot b oprat bcaus a vry larg amount of information (~2 71 bits) must b kpt by ach usr an b snt for ach broacast. In th prsnt papr, an inconsistncy in th improvmnt propos by Tsng an Jan in [1] is tct prcluing its application. Nw attacks on th original an moifi Liaw s schms [1, 2] ar prsnt an a nw moification is propos which ovrcoms th conspiracy attack of Tsng an Jan. W also giv our own cryptanalysis. This moification os not rquir kping an broacasting th vry larg amount of information point out in [7]. Rciv Jun 16, 23; rvis Octobr 7, 24 & March 1, 25; accpt Sptmbr 26, 25. Communicat by Shiuh-Pyng Shih. * This work has bn support by MEC-Spain unr grant SEG , Evaluación protocolos y algoritmos sguria n sistmas información. 391

2 392 J. MUÑOZ MASQUÉ AND A. PEINADO 2. LIAW S BROADCASTING CRYPTOSYSTEM This papr uss th sam notations as in [1, 2], thus iffrntiating thr phass in th protocol. W consir a systm compos of a cntral authority srvr (CAS) an n usrs U i, 1 i n. Systm stup phas. In this first phas, a cntral authority srvr (CAS) gnrats th public an privat kys for vry usr U i in th systm an fins th following systm paramtrs. Lt N = pq b an RSA moulus [9] whr p = 2p + 1, q = 2q + 1, ar saf prim numbrs, i.., p, q, p, q ar all prim. W st λ(n) = lcm (p 1, q 1) an not th Eulr totint function by φ(n). Intgrs, ar slct such that 1 mo φ(λ(n)) an ar th public ky an privat ky of th systm, rspctivly. Hnc, N an ar ma public, whras p, q an ar kpt scrt. Nxt, CAS chooss a scrt intgr K an computs th privat ky (t i, K i ) an th public ky f(t i ) for vry usr U i such that t i Ki = K mo N, (1) i f( t ) = t, i whr t i is prim. Not that no moular opration is prform whn computing f(t i ). Broacasting phas. Whn a usr U 1 wants to broacast a mssag to usrs U 2,, U a, th CAS is inform an computs 1 B1 f( B ) =, (2) B MK K N PK 1 = E t1 (MK 1 ), 1 1 = mo, whr B 1 = t 2 t 3 t a an E k ( ) is th symmtric ncryption function of th systm with ky k. No moulus opration is prform whn computing f(b 1 ). Nxt, CAS sns f(b 1 ) an PK 1 to usr U 1, an f(b 1 ) to vry usr U i, 2 i a. Accoringly, U 1 can safly rcovr th scrt ky MK 1 = D t1 (PK 1 ), (3) an nciphr th mssag M as C = E MK1 (M), (4) an thn broacast C. Dcryption phas. Whn a lgal usr U, 2 a, rcivs f(b 1 ) an C, th scrt ky is obtain by computing

3 CRYPTANALYSIS OF LIAW S BROADCASTING CRYPTOSYSTEM 393 t ti ( f ( B1 )/ f ( t )) i,2 i a MK K mo N K mo N 1 tt 23 ta B1 = = = = (5) K mo N K mo N, an, hnc, th mssag M is ciphr. Not that no moulus opration can b appli ovr th xponnt to ruc th computational cost bcaus th usrs o not know φ(λ(n)). 3. ANALYSIS OF THE IMPROVED LIAW S BROADCASTING CRYPTOSYSTEM Th moifications propos in [1] by Tsng an Jan can b summariz as follows: a) Th privat ky t must only b known to CAS. Thrfor, th privat ky an public ky of vry usr U will b K an f(t i ), rspctivly. In this way, th conspiracy attack to obtain K cannot b prform sinc U os not know his own t. b) Th function f is now fin as f(x) = x mo λ(n), rathr than f(x) = x. Hnc, th public ky f(t i ) of usr U i an f(b 1 ) ar comput as f( ti) = ti mo λ( N), (6) f(b 1 ) = (t 2 t 3 t a ) mo λ(n). Th rst of oprations rmain unchang an th systm works following th prvious (original) schm. W agr with [1] that publishing th valus f(t i ) = t i compromiss th scurity of Liaw s cryptosystm sinc, though factoring intgrs is a har problm, tcting whthr a givn intgr is a prim powr is not that har. In fact, if k = π, π bing a prim, thn by Frmat s thorm w hav k b = ( F F)( b) b (mo π ), (7) for vry intgr b, whr F is th function fin by F(x) = x π. Hnc, π ivis gc (b k b, k) an for most valus of b w will vn hav gc (b k b, k) = π. As th running tim for th Eucli algorithm is O((ln k) 2 ) an computing b k (mo k) is O((ln k) 2 ln b), it follows that k = π can b factor in O((ln k) 3 ); for xampl, s [6, Algorithm 1.7.4]. This factorization problm is also takn into account in [7] in orr to stat th minimum bit lngth of t i, making th systm computationally saf. Accoring to [1], th valu to b publish must b f(t i ) = t i mo λ(n), rathr than f(t i ) = t i itslf. Th problm is that, in this cas, Thorm 1 in [2] is no longr tru. Actually, as simpl numrical xampls show, th quotint f(b 1 )/f(t i ) may not b an intgr an hnc th cryption procss coul fail. Th procur to rcovr th ky MK 1 as xplain in [1] is not vali as th quotint f(b 1 )/f(t i ) os not xist in Z. As a cons-

4 394 J. MUÑOZ MASQUÉ AND A. PEINADO qunc, th moification propos in [1] cannot b rgar as an improvmnt of th systm in [2]. In sction 5, a moification is prsnt to solv th inconsistncy an to ovrcom th attacks in [1]. 4. NEW ATTACKS ON LIAW S BROADCASTING CRYPTOSYSTEM In aition to th conspiracy attack prsnt in [1], thr ar othr aspcts that can compromis th scurity of Liaw s original cryptosystm. First attack. Assum usr U 1 wants to broacast a mssag to th group of usrs {U 2, B1 U 3,, U a }. Accoringly, th CAS will gnrat th ky MK1 = K mo N, with B 1 = t 2 t a. Thn, assuming that usr U a+1 {U 1, U 2,, U a } wants to broacast a mssag to th sam group of usrs th CAS will gnrat th ky B a + 1 a 1 mo, MK + = K N (8) with B a+1 = t 2 t a. As is vint, th valus MK a+1 an B a+1 ar intical to thos gnrat for U 1, namly, MK 1 an B 1. This implis that usr U a+1, who is not authoriz, can ra th mssags from U 1 to th group {U 2, U 3,, U a }, an convrsly. Scon attack. Th first attack can b gnraliz in th following way. Assum U a+1 wants to broacast a mssag to th group of usrs {U 2, U 3,, U a, U a+2, U a+3,, U b }, which inclus th group of lgitimat rcivrs for U 1, i.., {U 2, U 3,, U a }. In this cas, CAS will gnrat B a+1 = t 2 t 3 t a t a+2 t b, (9) f( Ba+ 1) = Ba+ 1, Ba+ 1 MK = K mo N. a+ 1 Thn, unauthoriz usr U 1 can rcovr th nw ky MK a+1, as follows: f ( ta 2) ( a 3) ( b) 2 3 a a 2 b 1 + f t + f t t t t t t + MK mo N = K mo N = MK a + 1. (1) Thrfor, vry usr U of th systm, who formrly snt a mssag to a group of usrs GU 1, can crypt th mssags that a thir usr U k GU 1 {U 1 } sns to a istinct group GU 2 whnvr GU 1 GU 2. Thir attack. Thr is a particular cas in which Liaw s cryptosystm fails. Assum th usr U 1 asks th CAS to sn a mssag to a uniqu usr U 2. This is not a common us of th cryptosystm as it is sign to broacast mssags to a group of usrs, but this option is prmitt by th systm. In such a cas, th CAS woul gnrat th following paramtrs: B 1 = t 2, (11)

5 CRYPTANALYSIS OF LIAW S BROADCASTING CRYPTOSYSTEM = 1 = 2 f( B ) B t, MK K mo N K mo N K. B1 t2 1 = = = 2 In this way, U 1 will irctly know th privat ky K 2 of th usr U 2, compromising th scurity of th systm. It is important to not that ths attacks ar also applicabl to th cas in which B i an f(b i ) ar comput by applying moulus λ(n) ruction, as propos in [1]. 5. MODIFICATIONS TO THE ORIGINAL SCHEME In orr to solv th nw waknsss prsnt in th prvious sction, as wll as th conspiracy attack in [1], w propos incluing th following moifications to Liaw s broacasting cryptosystm. a) Accoring to [1], th prim numbrs t will only b known to th CAS; vn usr U will not known its valu. In this way, th waknss point out in [7] rlat to th rconstruction of K from th knowlg of t has no ffct on this schm. b) Accoring to [1], th function f is rfin as f(x) = x mo λ(n). Hnc, w hav f( t ) = t mo λ( N), (12) i f( B ) = B mo λ( N). i By mans of this moification, th waknss in [7] rgaring th factorization is no longr prsnt, an th amount of information to b kpt or snt is not so larg as thos suggst in [7]. In sction 6, mor tails rgaring this topic will b givn. c) Th paramtr B 1 gnrat by CAS will also inclu th paramtr t 1 of th usr U 1 who wishs to sn a mssag to th group of usrs GU 1 = {U 2, U 3,, U a }. Hnc, w hav B 1 = t 1 t 2 t a mo λ(n). (13) This moification thwarts th attacks in sction 4. ) Th moification b) forcs th rcivrs to moify th ky rconstruction algorithm bcaus th valu f(b i )/f(t ) is not always an intgr. Hnc, th CAS computs f(r c /t ) insta of f(t ), whr r c is a ranom intgr chosn by CAS. A lgal usr U can rconstruct th ky as ( 1) f B f ( rc/ t) mo MK1 = K mo N (14) = K = K mo N. N Mor prcisly, assuming that U 1 wants to broacast a mssag to th group of usrs

6 396 J. MUÑOZ MASQUÉ AND A. PEINADO GU 1 = {U 2, U 3,, U a }, thn U 2 can rconstruct th ky MK 1 as ( 1) f B f ( rc / t2) MK1 = K2 mo N (15) = K mo N = K mo N. Not that no moular opration can b appli to th xponnt in Eqs. (14) - (15) bcaus th usrs o not know th valu of λ(n). This fact implis that th nciphring (public) xponnt must b short. ) Furthrmor, th CAS is not rquir to comput an sn PK 1 to usr U 1 (s Eq. (2)), as U 1 can obtain th ky MK 1 in th sam way as th lgitimat rcivrs, i.., ( 1) f B f ( rc / t1) MK1 = K1 mo N (16) = K mo N = K mo N. All ths moifications allow us to rfin Liaw s broacasting cryptosystm accoring to th following stps an phass. Phas 1: Systm stup phas. This phas rsults from applying prvious moifications a) an b) to th original stup phas fin in [1, 2]. In othr wors, CAS chooss p, q, an r c, an computs th systm paramtrs N = pq, an, such that 1 mo φ(λ(n)). Thn, CAS chooss th systm ky K an th prim numbrs t, an computs privat ky K i an public ky f(r c /t ) for vry usr U i in th systm by t i Ki = K mo N, (17) rc r c f = mo λ( N). ti t Nxt, th CAS sns th public kys f(r c /t ) to vry usr U. Phas 2: Broacasting phas. Whn a usr U 1 wants to broacast a mssag M to a group of usrs GU 1 = {U 2, U 3,, U a }, th following stps hav to b prform. Stp 1: U 1 sns a rqust mssag to th CAS inicating th intitis of rcivrs in group GU 1. Stp 2: Th CAS computs B 1 an f(b 1 ) as follows B 1 = t 1 t 2 t a mo N. (18) 1 = 1 f( B ) B mo λ( N), an broacasts f(b 1 ) to U 1, U 2,, U a.

7 CRYPTANALYSIS OF LIAW S BROADCASTING CRYPTOSYSTEM 397 Stp 3: U 1 computs th nciphring ky MK 1 ( 1) f B f ( rc / t1) MK1 = K1 mo N (19) = K mo N = K mo N. an nciphrs mssag M as C = E MK1 (M). Phas 3: Dcryption phas. Evry usr U i, for 2 i a, computs th ky MK 1 from his privat ky K i, his public ky f(t ), an th public paramtr f(b 1 ): ( 1) f B f ( rc/ t) mo MK1 = K mo N (2) = K = K mo N. N Nxt, whn a lgal usr U, 2 a, rcivs C, th mssag M is ciphr. 6. SECURITY AND PERFORMANCE ANALYSIS Th moification propos in sction 5 ovrcoms th conspiracy attack prsnt in [1] an th attacks prsnt in sction 4. Conspiracy attack of two lgal usrs (s [1]). This attack, succssfully appli to Liaw s original broacasting cryptosystm, consirs that two lgal usrs U x, U y shar thir privat kys t x, t y. Sinc t x, t y ar rlativly prim, two numbrs s, r can b obtain satisfying rt x + st y = 1 by th Euclian algorithm. Hnc, th systm ky K can b rcovr from r x s y rt sty rtx+ st x y K K mo N = K K mo N = K mo N = K mo N. (21) Clarly, this attack cannot b appli to th moifi cryptosystm propos in sction 5 sinc th usrs o not know paramtr t. This is th sam argumnt xpos by Tsng an Jan in [1] to avoi th attack. Factorization of f(t ). Accoring to [1], in orr to obtain t, a usr shoul solv th quation f(t ) = t mo λ(n), whr only f(t ) is known, which is not computationally fasibl. By th sam rason, it is computationally infasibl to gt th privat ky of CAS from th prvious quation, thus prvnting th attacks xplain in sction 3 an [7] for obtaining K. Rcovring systm ky K. Anothr way to try rcovring K coms from th situation in which a lgal usr attacks its privat ky K = K t1 mo N. This attack is computationally infasibl as K an t 1 ar not known by th usr. It is also infasibl to obtain K by

8 398 J. MUÑOZ MASQUÉ AND A. PEINADO raising K to th xponnt f(r c /t ), that is, f ( rc/ t) t( rc / t) rc K mo N = K mo N = K mo N, (22) whr K an r c ar not known. Attacks in sction 4. Th ky MK i now pns on th snr an all th lgitimat rcivrs. Hnc, vry combination of snr-rcivrs fin a iffrnt ky. As a consqunc, th attacks prsnt in sction 4 hav no ffct on th moifi protocol propos in this papr. Prformanc analysis. Th minimum lngth of f(t ) is much shortr than th lngth (~2 71 bits) suggst in [7] for th Liaw s original cryptosystm to b scur. In our cas, th ffort to obtain or t is quivalnt to factoring N = pq, whr p, q ar saf prim numbrs. Hnc, th minimum lngth of f(t ) is th sam as that of N to mak infasibl a factorization attack; that is, 248 = 2 11 bits, approximatly [1]. Sinc all th paramtrs ar intgrs moulo λ(n), th lngths of f(b 1 ), f(r c /t ), K, t,, an MK 1 ar th sam: 2 11 bits. Not that th public RSA xponnt must b short. In this way, th amount of information a usr has to kp is 2 14 bits, corrsponing to f(b 1 ), f(r c /t ), K, N,, an MK 1. Th amount of information th CAS has to broacast is ruc to th lngth of f(b 1 ), that is, 2 11 bits. Th sam amount of bits is snt to vry usr in th stup phas. Th cryption phas in sction 5 has bn sign taking into account th grat numbr of potntial usrs in a ral broacasting ntwork. Bcaus of this, th computational complxity of th algorithm for nciphring/ciphring th ky MK 1 os not pn on th numbr of lgitimat rcivrs. As can b obsrv from Eq. (19) to (2), only two intgr xponntiations (with a short xponnt ), two moular xponntiations an on moular multiplication ar ncssary to comput MK CONCLUSIONS W hav shown an inconsistncy in th improvmnt of Liaw s cryptosystm propos in [1]. Morovr, both th improvmnt an th original schm [2] suffr svral waknsss which allow illgal usrs to ra nciphr broacast mssags. Th moifications propos in this work ovrcom th conspiracy attack stat in [1] an th waknsss shown in th cryptanalysis abov. In aition, ths moifications ruc th amount of information to b kpt an broacast by th usrs, thus not suffring th waknsss point out in [7, 8]. REFERENCES 1. Y. M. Tsng an J. K. Jan, Cryptanalysis of Liaw s broacasting cryptosystm, Computrs an Mathmatics with Applications, Vol. 41, 21, pp H. T. Liaw, Broacasting cryptosystm in computr ntworks, Computrs an

9 CRYPTANALYSIS OF LIAW S BROADCASTING CRYPTOSYSTEM 399 Mathmatics with Applications, Vol. 37, 1999, pp C. C. Chang an T. C. Wu, Broacasting cryptosystm in computr ntworks using intrpolating polynomials, Computr Systm Scinc an Enginring, Vol. 6, 1991, pp G. H. Chiou an W. T. Chn, Scur broacasting using th scur lock, IEEE Transactions on Softwar Enginring, Vol. 15, 1989, pp W. G. Tzng an M. S. Hwang, A confrnc ky istribution schm for multilvl scurity, in Procings of 5th National Scurity Confrnc, 1995, pp H. Cohn, A Cours in Computational Algbraic Numbr Thory, Grauat Txts in Maths, Vol. 138, Springr-Vrlag, Brlin Hilbrg, H. M. Sun, Scurity of broacasting cryptosystm in computr ntworks, Elctronics Lttrs, Vol. 35, 1999, pp M. S. Hwang, C. C. L, an T. Y. Chang, Broacasting cryptosystm in computr ntworks using gomtric proprtis of lins, Journal of Information Scinc an Enginring, Vol. 18, 22, pp R. Rivst, A. Shamir, an I. Alman, A mtho for obtaining igital signaturs an public-ky cryptosystms, Communications of th ACM, Vol. 21, 1978, pp A. J. Lnstra an E. R. Vrhul, Slcting cryptographic ky sizs, Journal of Cryptology, Vol. 14, 21, pp Jaim Muñoz Masqué obtain th Univrsity gr in Mathmatics at th Univrsia Cntral Barclona, Spain, in 1973 an th Ph.D. in Scinc at th Univrsia Salamanca, Spain, in H was an Assistant Profssor from 1979 to 1985 an a full profssor from 1985 to 1989, both positions in th Univrsia Salamanca. His rsarch topics ar appli mathmatics, computr scinc, information systms, an mathmatical physics. Albrto Pinao Domínguz obtain th Ing. gr in Tlcommunications Enginring at th Univrsity of Málaga in 1993, an th Ph.D. gr in Computr Scinc at th Polytchnic Univrsity of Mari, Spain, in From 1995 to 1998, h was with th National Spanish Council for Scintific Rsarch (CSIC), Mari, Spain, whr his rsarch intrsts wr in cryptography an ntwork scurity. Sinc 1998, h has bn with th Dpartmnt of Ingniría Comunicacions at th Univrsity of Málaga as an Assistant Profssor an thn as an Associat Profssor. His rsarch intrsts inclu cryptography, mobil communications, CDMA cos, smart cars, an watrmarking.