E- Business&

need of Digital Signature

Electronic payments: the players

Consumer Merchant Financial institutions

Physical tokensrepresenting value

Digital cash

010110101101010111010110101011010110101011010110101011010101101010110111101011111011010000000110101010110101

Since digital cash is represented by data, it is easily replicated. How do we prevent:

•Counterfeiting?

•Multiple spending?

4

Electronic signatures

The European Community Directive on electronic signatures refers to the concept of an electronic signature as:

data in electronic form attached to, or logically connected with, other electronic data and which serves as a method of authentication

What different things can you think of that might satisfy this rather vague notion of an electronic signature?

5

Advanced electronic signaturesThe European Community Directive on electronic signatures also refers to the concept of an advanced electronic signature as:

an electronic signature that is:

1. uniquely linked to the signatory

2. capable of identifying the signatory

3. created using means under the sole control of the signatory

4. linked to data to which it relates in such a way that subsequent changes in the data is detectable

6

Security requirements

• Data origin authentication of the signer – A digital signature validates the message in the sense that

assurance is provided about the integrity of the message and of the identity of the entity that signed the message.

• Non-repudiation – A digital signature can be stored by anyone who receives

the signed message as evidence that the message was sent and of who sent it. This evidence could later be presented to a third party who could use the evidence to resolve any dispute that relates to the contents and/or origin of the message.

We will define a digital signature on a message to be some data that provides:

7

Symmetric-key ciphers:Block ciphersStream ciphers

Public-keyciphers

Cryptographic goals

Confidentiality Data integrity Authentication Non-repudiation

Message authentication

Entity authenticationArbitrary lengthhash functions

Message Authentication codes (MACs)

Digital signatures

Authentication primitives

Digital signatures

MACs

Digitalsignatures

8

Input to a digital signature• The message

– Since a digital signature needs to offer data origin authentication (and non-repudiation) it is clear that the digital signature itself must be a piece of data that depends on the message, and cannot be a completely separate identifier.

– It may be sent as a separate piece of data to the message, but its computation must involve the message.

• A secret parameter known only by the signer– Since a digital signature needs to offer non-repudiation, its

calculation must involve a secret parameter that is known only by the signer.

– The only possible exception to this rule is if the other entity is totally trusted by all parties involved in the signing and verifying of digital signatures.

9

Properties of a digital signature

• Easy for the signer to sign a message – There is no point in having a digital signature scheme that involves

the signer needing to use slow and complex operations to compute a digital signature.

• Easy for anyone to verify a message– Similarly we would like the verification of a digital signature to be as

efficient as possible.

• Hard for anyone to forge a digital signature – It should be practically impossible for anyone who is not the

legitimate signer to compute a digital signature on a message that appears to be valid. By “appears to be valid” we mean that anyone who attempts to verify the digital signature is led to believe that they have just successfully verified a valid digital signature on a message.

•is a type of asymmetric cryptography used to simulate the security properties of a signature in digital, rather than written, form. Digital signature schemes normally give two algorithms, one for signing which involves the user's secret or private key, and one for verifying signatures which involves the user's public key. The output of the signature process is called the "digital signature.“

•is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are easily transportable, cannot be imitated by someone else, and can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.

What is a digital signature?

• The use of digital signatures usually involves two processes, one performed by the signer and the other by the receiver of the digital signature:

• Digital signature creation uses a hash result derived from and unique to both the signed message and a given private key. For the hash result to be secure, there must be only a negligible possibility that the same digital signature could be created by the combination of any other message or private key.

• Digital signature verification is the process of checking the digital signature by reference to the original message and a given public key, thereby determining whether the digital signature was created for that same message using the private key that corresponds to the referenced public key.

How it works

Paper Signatures V/s Digital Signatures

Parameter Paper Electronic

Authenticity May be forged Can not be copied

Integrity Signature independent of the document

Signature depends on the contents of the document

Non-repudiation

a. Handwriting expert needed

b. Error prone

a. Any computer user

b. Error free

V/s

Electronic RecordElectronic Record

1. Very easy to make copies2. Very fast distribution3. Easy archiving and retrieval4. Copies are as good as original5. Easily modifiable6. Environmental Friendly

Because of 4 & 5 together, these lack authenticity

Digital signatures employ a type of Asymmetric Cryptography. The Scheme typically consists of three Algorithms

A key generation algorithm that selects a private key uniformly at random from a set of possible private keys. The algorithm outputs the private key and a corresponding public key.

A signing algorithm that, given a message and a private key, produces a signature.

A signature verifying algorithm that, given a message, public key and a signature, either accepts or rejects the message's claim to authenticity

Hash value of a message when encrypted with the private key of a person is his digital signature on that e-Document

Digital SignaturesDigital Signatures

Each individual generates his own key pair

[Public key known to everyone &

Private key only to the owner]

Private Key – Used for making Digital Signature

Public Key – Used to verify the Digital Signature

Smart CardiKey

Hardware Tokens

Example• Assume you were going to send the draft of a contract to your

lawyer in another town. You want to give your lawyer the assurance that it was unchanged from what you sent and that it is really from you.

1. You copy-and-paste the contract (it's a short one!) into an e-mail note.

2. Using special software, you obtain a message hash (mathematical summary) of the contract.

3. You then use a private key that you have previously obtained from a public-private key authority to encrypt the hash.

4. The encrypted hash becomes your digital signature of the message. (Note that it will be different each time you send a message.)

• At the other end, your lawyer receives the message. 1. To make sure it's intact and from you, your lawyer makes a hash of

the received message. 2. Your lawyer then uses your public key to decrypt the message hash

or summary. 3. If the hashes match, the received message is valid.

18

Hash functions

1. Condenses arbitrary long inputs into a fixed length output

– You stuff as much data as you want into the function, and it churns out an output (or hash) that is always the same fixed length.

– In general this hash is much smaller than the data that was put into the function.

– Because the hash is a smaller thing that represents a larger thing, it sometimes referred to as a digest, and the hash function as a message digest function.

A hash function is a mathematical function that generally has the following three properties:

19

Hash functions

2. Is one-way – The hash function should be easy to compute, but given the

hash of some data it should be very hard to recover the original data from the hash.

3. It is hard to find two inputs with the same output

– It should be hard to find two different inputs (of any length) that when fed into the hash function result in the same hash (collision free).

– Note that it is impossible for a hash function not to have collisions. If arbitrarily large inputs are all being reduced to a fixed length hash then there will be lots of collisions. (For example - it is impossible to give each of 60 million people a different 4 digit PIN.) The point is that these collisions should be hard to find.

Message HashFunction

MessageDigest

SignatureFunction

Digital Signature

Message

Signature Private Key

Message Hash Function MessageDigest

Digest Signature

SignatureFunction

MessageDigest

If the message

digest are identical,

the signature is valid.

If they are different,

the signature is not

valid.

Signer’s Public Key

Digital Signatures

• Digital Signatures are numbers• Same Length – 40 digits• They are document content dependent

I am George kuttyefcc61c1c03db8d8ea8569545c073c814a0ed755

My place of birth is at Thrissur.fe1188eecd44ee23e13c4b6655edc8cd5cdb6f25

I am 27 years old.0e6d7d56c4520756f59235b6ae981cdb5f9820a0

I am an Engineer.ea0ae29b3b2c20fc018aaca45c3746a057b893e7

I am a Engineer.01f1d8abd9c2e6130870842055d97d315dff1ea3

• These are digital signatures of same person on different documents

• Application Request• Issuance of Digital Signatures

• Accessing Website with Membership ID for Enrollment of Request On line

• Driver Downloading

• Member Login

How To Get & Use Digital Signature

Benefits of digital signatures

These are common reasons for applying a digital signature to communications:• Authentication Although messages may often include information about the entity sending

a message, that information may not be accurate. Digital signatures can be used to authenticate the source of messages. When ownership of a digital signature secret key is bound to a specific user, a valid signature shows that the message was sent by that user. The importance of high confidence in sender authenticity is especially obvious in a financial context. For example, suppose a bank's branch office sends instructions to the central office requesting a change in the balance of an account. If the central office is not convinced that such a message is truly sent from an authorized source, acting on such a request could be a grave mistake.

• Integrity In many scenarios, the sender and receiver of a message may have a need

for confidence that the message has not been altered during transmission. Although encryption hides the contents of a message, it may be possible to change an encrypted message without understanding it. (Some encryption algorithms, known as nonmalleable ones, prevent this, but others do not.) However, if a message is digitally signed, any change in the message will invalidate the signature. Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this is still considered to be computationally infeasible by most cryptographic hash functions.

Drawbacks of digital signatures Despite their usefulness, digital signatures do not alone solve all

the problems we might wish them to.

Non-repudiation

In a cryptographic context, the word repudiation refers to the act of disclaiming responsibility for a message. A message's recipient may insist the sender attach a signature in order to make later repudiation more difficult, since the recipient can show the signed message to a third party (eg, a court) to reinforce a claim as to its signatories and integrity. However, loss of control over a user's private key will mean that all digital signatures using that key, and so ostensibly 'from' that user, are suspect. Nonetheless, a user cannot repudiate a signed message without repudiating their signature key.

Prevention From Misuse

Prevention From Misuse

Don’t Hand over you DSC Media USB/Card to any one

Don’t tell your PIN to anyone

Document Digitally Signed carries same legal status as manually signing as per the IT Act

To prevent this misuse…

• Assign each user fixed keys

• Usually be done by third party: VeriSign…

• Moreover, common good practice: sign first, encrypt later.

Questions?

1. In the digital signature who use the private key and who use the public key?

Private key: sender

Public key: receiver

2. What are the benefits of digital signatures?

Authentication and Integrity