Subversion-Resilient Signature Schemes

Abstract

We provide a formal treatment of security of digital signatures against subversion attacks (SAs). Our model of subversion generalizes previous work in several directions, and is inspired by the proliferation of software attacks (e.g., malware and buffer overflow attacks), and by the recent revelations of Edward Snowden about intelligence agencies trying to surreptitiously sabotage cryptographic algorithms. The main security requirement we put forward demands that a signature scheme should remain unforgeable even in the presence of an attacker applying SAs (within a certain class of allowed attacks) in a fully-adaptive and continuous fashion. Previous notions-e.g., the notion of security against algorithmsubstitution attacks introduced by Bellare et al. (CRYPTO '14) for symmetric encryptionwere non-adaptive and non-continuous. In this vein, we show both positive and negative results for the goal of constructing subversion-resilient signature schemes. • Negative results. As our main negative result, we show that a broad class of randomized signature schemes is unavoidably insecure against SAs, even if using just a single bit of randomness. This improves upon earlier work that was only able to attack schemes with larger randomness space. When designing our new attack we consider undetectability as an explicit adversarial goal, meaning that the end-users (even the ones knowing the signing key) should not be able to detect that the signature scheme was subverted. • Positive results. We complement the above negative results by showing that signature schemes with unique signatures are subversion-resilient against all attacks that meet a basic undetectability requirement. A similar result was shown by Bellare et al. for symmetric encryption, who proved the necessity to rely on stateful schemes; in contrast unique signatures are stateless, and in fact they are among the fastest and most established digital signatures available. As our second positive result, we show how to construct subversion-resilient identification schemes from subversion-resilient signature schemes. We finally show that it is possible to devise signature schemes secure against arbitrary tampering with the computation, by making use of an un-tamperable cryptographic reverse firewall (Mironov and Stephens-Davidowitz, EUROCRYPT '15), i.e., an algorithm that "sanitizes" any signature given as input (using only public information). The firewall we design allows to successfully protect so-called re-randomizable signature schemes (which include unique signatures as special case). As an additional contribution, we extend our model to consider multiple users and show implications and separations among the various notions we introduced. While our study is mainly theoretical, due to its strong practical motivation, we believe that our results have important implications in practice and might influence the way digital signature schemes are selected or adopted in standards and protocols.

Algorithm Substitution Attacks from a Steganographic Perspective

“…As a corollary we obtain the result of Ateniese et al (Theorem 1 in [2]) that for every coin-injective signature scheme, there is a successful algorithm substitution attack of negligible insecurity. Moreover we get (Theorem 2 in [2]) that for every coin-extractable signature scheme, there is a successful and secure ASA. We can conclude also (Theorem 3 in [2]) that unique signature schemes are resistant to ASAs fulfilling the verifiability condition.…”

“…Moreover we get (Theorem 2 in [2]) that for every coin-extractable signature scheme, there is a successful and secure ASA. We can conclude also (Theorem 3 in [2]) that unique signature schemes are resistant to ASAs fulfilling the verifiability condition. Roughly speaking the last property means that each message has exactly one signature and the ASA can only produce valid signatures.…”

“…Particularly, we prove that successful ASAs correspond to secure stegosystems on certain channels and vice versa. This formal proof allows us to conclude that ASAs are stegosystems and to "rediscover" results of [2,6,7] concerning ASAs.…”

“…The modified implementation should remain indistinguishable from a truthful one and its aim is to allow leakage of secret information during subsequent runs of the subverted protocol. Attacks of this kind are known in the literature [2,6,7,22,29,30] and an overview on this topic is given in the current survey [25] by Schneier et al…”

Security of Symmetric Encryption against Mass Surveillance

“…Ateniese, Magri and Venturi [3] study ASAs on signature schemes. Russell, Tang, Yung and Zhou [43] consider ASAs on one-way and trapdoor one-way functions.…”