Flexible broadcast authentication in resource-constrained systems: providing a tradeoff between communication and computational overheads
View Patent ↗A method for authenticating a message that is transmitted wirelessly. The method includes providing a set of private key values that define a private key and performing a key pair generation process that provides a key pair including the private key and a public key, where performing the key pair generation process includes applying one or more hash functions to the private key values, where a succeeding hash function provides a hash of a previous hash function. The scheme uses a signature generation process that generates a message digest by applying a hash function on the message to be signed and then separates the message digest into two parts including signing bits and selection bits and using the private key to sign the message. A receiver verifies the authenticity of the received message using the public key and a signature verification algorithm.
1. A method for authenticating a message that is transmitted wirelessly, said method comprising:
providing a matrix that includes rows of private key values and columns of private key values;
performing a key pair generation process that provides a key pair including a private key and a public key for each row in the matrix, said private key being the set of private key values for that row, wherein performing the key pair generation process includes applying a plurality of hash functions to the private key values where a succeeding hash function provides a hash of a previous hash function, wherein a concatenated value of the final hash values is the public key;
performing a signature generation process, using a microprocessor, that includes generating a message digest by applying a hash function on the message to be signed and separating the message digest into two parts including signing bits and selection bits where the selection bits select which row in the matrix will be used to sign the message and the signing bits are signed by a signing algorithm using the private key values from the selected row, and where performing the signature generation process uses the algorithm:
Input: hash function H: {0,1}*→{0,1} L , block parameter n,n 1 ,k and j,
message M, signature key S
Output: One time signature σ M on M
1: Compute H(M) from M
2: Break H(M) in ‘n’, k-bit words and ‘n’j bit words
3: ‘n’ n 1 k-bits words are used for signing. They are denoted as b 1 1 ,b 2 1 , . . . ,b n 1 1 ,b 1 2 ,b 2 2 , . . . ,b n 1 2 , . . . ,b 1 n ,b 2 n , . . . ,b n 1 n
4:‘n’j bit words represent n indices in {1:2 j } are used for selection,
They are denoted as m 1 , m 2 , . . . , m n
5: Compute b 0 i =Σ l-1 n 1 b l i for each i ε{1:n }
6: For each m i sign (b 0 i ,b 1 i , . . . ,b n 1 i )use Winternitz signature to generate σ m i
7: The signature of M is σ M =[σ m i ∥σ m i ∥. . . ∥σ m n ]
8: return σ M ;
and
performing a signature authentication process that includes using the key pair to authenticate the message.
2. The method according to claim 1 wherein the private key values in each row of the matrix are Winternitz private key values and the private key values in each column of the matrix are hash to obtain random subset private key values.
3. The method according to claim 1 wherein performing the key pair generation process uses the algorithm:
Input: hash function H:{0,1}* →{0,1} L , block parameter n, n 1 , k and j
Output: signature key S, verification key V
1: Choose n, n 1 , k and j such that L=n·n 1 ·k +n·j
2: Choose S 0 0 ,S 0 1 , . . . ,S 0 n 1 , . . . ,S m 0 , S m 1 , . . . S m n 1 , . . . ,S 2 j-1 0 ,S 2 j-1 1 , . . . , S 2 j-1 n 1 ε R {0,1} L uniformly at random, i.e., choose (n 1 +1)2 j random variables of length L
3: Set S ={S 0 0 ,S 0 1 , . . . ,S 0 n 1 , . . . ,S m 0 ,S m 1 , . . . ,S m n 1 , . . . ,S 2 j-1 0 ,S 2 j-1 1 , . . . ,S 2 j-1 n 1 }
4: For each m ε {0:2 j-1 } apply Winternitz key pair generation for S m 0 ,S m 1 , . . . ,S m n 1
5: Denote public value of each m-th Winternitz structure as v m
6: Set V ={v 0 ,v 1 , . . . ,v m , . . . ,v 2 j-1 }, where ∥ denotes concatenation
7: Private key:=S, Public key :=V
8: return (S, V).
4. The method according to claim 1 wherein performing the signature verification process uses the algorithm:
Input: hash function H:{0,1}* →{0,1} L , block parameter n, n 1 , k and j,
message M, signature σ m , verification key V
Output: TRUE if the signature is valid, FALSE otherwise
1: Compute (b 1 1 ,b 2 1 , . . . ,b n 1 1 , b 1 2 ,b 2 2 , . . . ,b n 1 2 , . . . ,b 1 n ,b 2 n , . . . ,b n 1 n ) and (m 1 ,m 2 , . . . ,m n )
2: Verify each v m using Winternitz verification
3: If verification returns true for each v m then return TRUE, else return FALSE.
5. The method according to claim 1 wherein the message is transmitted wirelessly from one vehicle to another vehicle.
6. A method for authenticating a message that is transmitted wirelessly, said method comprising:
providing a plurality of private key values where a set of private key values is a private key;
performing a key pair generation process that provides a key pair including a private key and a public key, said private key being the set of private key values, wherein performing a key pair generation process includes applying a plurality of hash functions to the private key values where a succeeding hash function provides a hash of a previous hash function, and wherein a final hash function provides the public key;
performing a signature generation process, using a microprocessor, that includes generating a message digest by applying a hash function on the message to be signed and signing the message digest by separating the message digest into two parts including signing bits and selection bits where the selection bits select which of the private key values will be used for signing and the signing bits are signed, and where performing the signature generation process uses the algorithm:
Input: hash function H:{0,1}* →{0,1} L , block parameter n, k and j, such that L =n(k+j), message M, signature key S
Output: One time signature of σ m on M
1: Compute H(M) from M
2: Break H(M) in n,k-bit words and n,j -bit words
3: n,k -bit words are used for signing, where they are denoted as b 1 1 ,b 2 1 , . . . ,b n 1 ,
4: n, j-bit words are used for selection, where they are denoted as b 1 2 ,b 2 1 , . . . ,b n 2
5: Compute b 0 =Σ i-i n b i 1
6: The signature of M is σ m =[H b 1 1 (S b 1 2 )∥H b 2 1 (S b 2 2 )∥. . . ∥H b n 1 (S b n 2 )∥H n•2 k-b 0 (S c)]
7: return σ m ;
and
performing a signature authentication process that includes using the key pair to authenticate the message.
7. The method according to claim 6 wherein the method employs a one-time signature process that is a combination of a Winternitz one-time signature scheme and a hash to obtain random subset one-time signature scheme.
8. The method according to claim 6 wherein performing the key pair generation process uses the algorithm:
Input: hash function H:{0,1}*→{0,1} L block parameter n, k 1 and k 2
Output: signature key S, verification key V
1: Choose n, k 1 , k 2 and j such that L=n(k+j)
2: Choose s 0 , s 1 , . . . , s 2 j-1 , s c ε R {0,1} L uniformly at random, i.e choose ( 2 j + 1 ) random variables of length L
3: Set S={s 0 ,s 1 , . . . ,s 2 j-1 ,s c }
4: Compute y i =H 2 k (s i ) for i=0, 1, 2, . . . , 2 j-1
5: Compute z=H n·2 k (s c )
6: Set V={y 1 ∥y 2 ∥ . . . . ∥y 2 j-1 ∥z} where ∥ denotes concatenation
7: Private key: =S, Public key: =V
8: return (S,V).
9. The method according to claim 6 wherein performing the signature verification process uses the algorithm:
Input: hash function H:{0,1}*→{0,1} L , block parameter n, k and j, such that L=n(k+j), message M, signature σ M , verification key V
Output: TRUE if the signature is valid, FALSE otherwise
1: Compute b 1 1 ,b 2 1 , . . . , b n 1 1 , b 1 2 , b 2 2 , . . . , b n 2 as in Algorithm 11
2: Denote the σ M received as composed of h b 1 2 ∥ĥ b 2 2 ∥ . . . ∥ĥ b n 2 ∥ĥ c
3: Compute x i =H 2 k -b i 1 (ĥ b i 2 ) for i=1, 2, . . . , n
4: Compute w=H b 0 (ĥ c )
5: If y b i 2 =x i for each i=1, . . . , n and w=z, then return TRUE, else return FALSE.
10. The method according to claim 6 wherein the message is transmitted wirelessly from one vehicle to another vehicle.
11. A method for authenticating a message that is transmitted wirelessly, said method comprising:
providing a set of private key values that define a private key;
performing a key pair generation process that provides a key pair including the private key and a public key, wherein performing the key pair generation process includes applying one or more hash functions to the private key values where a succeeding hash function provides a hash of a previous hash function, and wherein a final hash function provides the public key;
performing a signature generation process, using a microprocessor, that includes generating a message digest by applying a hash function on the message to be signed and separating the message digest into two parts including signing bits and selection bits, and where performing the signature generation process uses the algorithm:
Input: hash function H:{0,1}* →{0,1} L , block parameter n,n 1 ,k and j, message M, signature key S
Output: One time signature σ m on M
1: Compute H(M) from M
2: Break H(M) in ‘n’, k-bit words and ‘n’j bit words
3: ‘n’ n 1 k bits words are used for signing. They are denoted as b 1 1 ,b 2 1 , . . . , b n 1 1 ,b 1 2 ,b 2 2 , . . . , b n 1 2 , . . . , b 1 n ,b 2 n , . . . , b n 1 n
4: ‘n’j bit words represent n indices in {1:2 j } are used for selection,
They are denoted as m 1 , m 2 , . . . , m n
5: Compute b 0 i =Σ l-1 n 1 b l i for each i ε{1:n}
6: For each m i sign (b 0 i ,b i i , . . . , b n 1 i ) use Winternitz signature to generate σ m i
7: The signature of M is σ M =[σ m i ∥σ m i ∥. . . . ∥σ m n ]
8: return σ m ;
and
performing a signature authentication process that includes using the key pair to authenticate the message.
12. The method according to claim 11 wherein performing the key pair generation process uses the algorithm:
Input: hash function H: {0,1}*→{0,1} L , block parameter n, n 1 , k and j
Output: signature key S, verification key V
1: Choose n, n 1 , k and j such that L=n·n 1 ·k+n·j
2: Choose s 0 0 , s 0 1 , . . . , s 0 n 1 , . . . , s m 0 , s m 1 , . . . , s m n 1 , . . . , s 2 j-1 0 , s 2 j-1 1 , . . . ,
s 2 j-1 n 1 ε R {0,1} L uniformly at random, i.e., choose (n 1 +1)2 j random variables of length L
3: Set S={s 0 0 , s 0 1 , . . . , s 0 n 1 , . . . , s m 0 , s m 1 , . . . , s m n 1 , . . . , s 2 j-1 0 , s 2 j-1 1 , . . . , s 2 j-1 n 1 }
4: For each m ε{0:2 j-1 } apply Winternitz key pair generation for s m 0 , s m 1 , . . . , s m n 1
5: Denote public value of each m-th Winternitz structure as v m
6: Set V={v 0 , v 1 , . . . , v m , . . . , v 2 j-1 }, where ∥ denotes concatenation
7: Private key: =S, Public key: =V
8: return (S,V).
13. The method according to claim 11 wherein performing the signature verification process uses the algorithm:
Input: hash function H:{0,1}*→{0,1} L , block parameter n, n 1 , k and j, message M, signature σ M , verification key V
Output: TRUE if the signature is valid, FALSE otherwise
1: Compute (b 1 1 , b 2 1 , . . . , b n 1 1 , b 1 2 , b 2 2 , . . . , b n 1 2 , . . . , b 1 n , b 2 n , . . . , b n 1 n ) and (m 1 , m 2 , . . . , m n )
2: Verify each v m using Winternitz verification
3: If verification returns true for each v m then return TRUE, else return FALSE.
14. The method according to claim 11 wherein the message is transmitted wirelessly from one vehicle to another vehicle.