Systems and methods for compromise resilient and compact authentication for digital forensics
A new compromise-resilient and compact cryptographic tool is provided that ensures a breach-resilient authentication and integrity of system measurements in computer systems. The described methods are forward-secure digital signatures with signature and partial public key aggregation capabilities. The methods reduce the total space overhead of signature and public key storage. The methods offer a high space efficiency for systems who has relatively low state transitions, wherein the same message is continuously signed and then followed by different messages.
1. A method comprising:
receiving a plurality of messages, wherein each message is associated with a time period from a set of time periods;
receiving a plurality of public key and private key pairs, wherein each pair is associated with a time period from the set of time periods;
for each message of the plurality of messages:
using the private key for the message to generate an aggregate signature for the message based on the message and an aggregate signature of a previous message of the plurality of messages; and
generating an aggregate public key for the message using the public key associated with the message and an aggregate public key associated with the previous message;
providing the aggregate public key and aggregate signature of a last message of the plurality of messages; and
authenticating at least one message of the plurality of messages using the provided aggregate public key and aggregate signature.
2. The method of claim 1 , wherein at least some of the messages of the plurality of messages are the same.
3. The method of claim 1 , wherein the aggregate signatures are generated using a BLS signature scheme.
4. The method of claim 1 , wherein the aggregate signatures are generated using an ETA signature scheme.
5. The method of claim 1 , wherein the aggregate public keys and aggregate signatures are combined for a plurality of different sets of time periods using an MMM generic digital signature scheme.
6. A system comprising:
at least one processor; and
a tangible computer readable medium storing instructions that when executed by the at least one processor cause the at least one processor to:
receive a plurality of images, wherein each image is associated with a time period from a set of time periods;
receive a plurality of public key and private key pairs, wherein each pair is associated with a time period from the set of time periods;
for each image of the plurality of images:
use the private key for the message to generate an aggregate signature for the image based on the image and an aggregate signature of a previous image of the plurality of images; and
generate an aggregate public key for the image using the public key associated with the image and an aggregate public key associated with the previous image;
provide the aggregate public key and aggregate signature of a last image of the plurality of images; and
authenticate at least one image of the plurality of images using the provided aggregate public key and aggregate signature.
7. The system of claim 6 , wherein at least some of the images of the plurality of images are the same.
8. The system of claim 6 , wherein the aggregate signatures are generated using a BLS signature scheme.
9. The system method of claim 6 , wherein the aggregate signatures are generated using an ETA signature scheme.
10. The system of claim 6 , wherein the aggregate public keys and aggregate signatures are combined for a plurality of different sets of time periods using an MMM generic digital signature scheme.
11. A non-transitory computer-readable medium comprising instructions that, when executed by at least one processor, cause the at least one processor to:
receive a plurality of messages, wherein each message is associated with a time period from a set of time periods;
receive a plurality of public key and private key pairs, wherein each pair is associated with a time period from the set of time periods;
for each message of the plurality of messages:
use the private key for the message to generate an aggregate signature for the message based on the message and an aggregate signature of a previous message of the plurality of messages; and
generate an aggregate public key for the message using the public key associated with the message and an aggregate public key associated with the previous message; and
authenticate at least one message of the plurality of messages using the aggregate public key and aggregate signature associated with a last message of the plurality of messages.
12. The computer-readable medium of claim 11 , wherein at least some of the messages of the plurality of messages are the same.
13. The computer-readable medium of claim 11 , wherein the aggregate signatures are generated using a BLS signature scheme.
14. The computer-readable medium of claim 11 , wherein the aggregate signatures are generated using an ETA signature scheme.
15. The computer-readable medium of claim 11 , wherein the aggregate public keys and aggregate signatures are combined for a plurality of different sets of time periods using an MMM generic digital signature scheme.
16. The computer-readable medium of claim 11 , wherein the messages are one or more of bank records, images, or videos.