[Docs] [txt|pdf] [Tracker] [WG] [Email] [Nits]

Versions: 00 01 02 RFC 2875

  Internet Draft                             Hemma Prafullchandra (XETI)
  Expires in 6 months                             Jim Schaad (Microsoft)
  February 25, 1999

              Diffie-Hellman Proof-of-Possession Algorithms

Status of this Memo

  This document is an Internet-Draft and is in full conformance with all
  provisions of Section 10 of RFC2026. Internet-Drafts are working
  documents of the Internet Engineering Task Force (IETF), its areas,
  and its working groups. Internet-Drafts are working documents of the
  Internet Engineering Task Force (IETF), its areas, and its working
  groups.  Note that other groups MAY also distribute working documents
  as Internet-Drafts.

  Internet-Drafts are draft documents valid for a maximum of six months
  and MAY be updated, replaced, or obsoleted by other documents at any
  time.  It is inappropriate to use Internet-Drafts as reference
  material or to cite them other than as "work in progress."

  To learn the current status of any Internet-Draft, please check the
  "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow
  Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
  munari.oz.au Pacific Rim), ds.internic.net (US East Coast), or
  ftp.isi.edu (US West Coast).


  This document describes two methods for producing a signature from a
  Diffie-Hellman key pair.  This behavior is needed for such operations
  as creating a signature of a PKCS #10 certification request.  These
  algorithms are designed to provide a proof-of-possession rather than
  general purpose signing.

1. Introduction

  PKCS #10 [RFC2314] defines a syntax for certification requests. It
  assumes that the public key being requested for certification
  corresponds to an algorithm that is capable of signing/encrypting.
  Diffie-Hellman (DH) is a key agreement algorithm and as such cannot be
  directly used for signing or encryption.

  This document describes two new signing algorithms using the Diffie-
  Hellman key agreement process to provide a shared secret as the basis
  of the signature.  In the first signature algorithm, the signature is
  constructed for a specific recipient/verifier by using a public key of

Prafullchandra, Schaad                                         [Page 1]

INTERNET DRAFT                                          February  1999

  that verifier.  In the second signature algorithm, the signature is
  constructed for arbitrary verifiers.  This is done by creating an
  appropriate D-H key pair and encoding them as part of the signature

2. Terminology

  The following definitions will be used in this document

  DH certificate = a certificate whose SubjectPublicKey is a DH public
  value and is signed with any signature algorithm (e.g. rsa or dsa).

3. DH Signature Process

  The steps for creating a DH signature are:

  1. An entity (E) chooses the group parameters for a DH key agreement.
     In many cases this is done simply by selecting the group parameters
     from a certificate for the recipient of the signature process
     (static DH signatures) but they may be computed for other methods
     (ephemeral DH signatures).

     In the ephemeral DH signature scheme, a temporary DH key-pair is
     generated using the group parameters, which may be computed or
     acquired by some out-of-band means.  In the static DH signature
     scheme, a certificate with the correct group parameters has to be
     available. Let these common DH parameters be g and p; and let this
     DH key-pair be known as the Recipient key pair (Rpub and Rpriv).

     Rpub = g^x mod p         (where x=Rpriv, the private DH value and ^
     denotes exponentiation)

  2. The entity generates a DH public/private key-pair using the
     parameters from step 1.

          For an entity E:
           Epriv = DH private value = y
           Epub  = DH public value  = g^y mod p

  3. The signature computation process will then consist of:

     a) The value to be signed is obtained. (For a RFC2314 object, the
        value is the DER encoded certificationRequestInfo field
        represented as an octet string.) This will be the `text'
        referred to in [RFC2104], the data to which HMAC-SHA1 is

     b) A shared DH secret is computed, as follows,

Prafullchandra, Schaad                                         [Page 2]

INTERNET DRAFT                                          February  1999

               shared secret = ZZ = g^xy mod p

        [This is done by the entity E as g^(y.Rpub) and by the Recipient
        as g^(x.Epub), where Rpub is retrieved from the Recipient's DH
        certificate (or is the one that was locally generated by the
        Entity) and Epub is retrieved from the actual certification
        request. ]

     c) A temporary key K is derived from the shared secret ZZ as

           K = SHA1(LeadingInfo | ZZ | TrailingInfo),
              where "|" means concatenation.

     d) Compute HMAC-SHA1 over the data `text' as per [RFC2104] as:

           SHA1(K XOR opad, SHA1(K XOR ipad, text))

            opad (outer pad) = the byte 0x36 repeated 64 times and
            ipad (inner pad) = the byte 0x5C repeated 64 times.

       (1) Append zeros to the end of K to create a 64 byte string
            (e.g., if K is of length 16 bytes it will be appended with
            48 zero bytes 0x00).
       (2) XOR (bitwise exclusive-OR) the 64 byte string computed in
            step (1) with ipad.
       (3) Append the data stream `text' to the 64 byte string
            resulting from step (2).
       (4) Apply SHA1 to the stream generated in step (3).
       (5) XOR (bitwise exclusive-OR) the 64 byte string computed in
            step (1) with opad.
       (6) Append the SHA1 result from step (4) to the 64 byte string
            resulting from step (5).
       (7) Apply SHA1 to the stream generated in step (6) and output
            the result.

         Sample code is also provided in [RFC2104].

     e) The output of (d) is encoded as a BIT STRING (the Signature

  The signature verification process requires the Recipient to carry out
  steps (a) through (d) and then simply compare the result of step (d)
  with what it received as the signature component. If they match then
  the following can be concluded:

Prafullchandra, Schaad                                         [Page 3]

INTERNET DRAFT                                          February  1999

      1) The Entity possesses the private key corresponding to the
  public key in the certification request because it needed the private
  key to calculate the shared secret; and
      2) For the static signature scheme, that only the Recipient that
  the entity sent the request to could actually verify the request
  because they would require their own private key to compute the same
  shared secret. In the case where the recipient is a Certification
  Authority, this protects the Entity from rogue CAs.

4.  Static DH Signature

  In the static DH Signature scheme, the public key used in the key
  agreement process of step 2 is obtained from the entity that will be
  verifying the signature (i.e. the recipient).  In the case of a
  certification request, the public key would normally be extracted from
  a certificate issued to the CA with the appropriate key parameters.

  The values used in step 3c for "LeadingInfo" and the "TrailingInfo"

     LeadingInfo ::= Subject Distinguished Name from certificate
     TrailingInfo ::= Issuer Distinguished Name from certificate

  The ASN.1 structures associated with the static Diffie-Hellman
  signature algorithms are:

     id-dhPop-static-HMAC-SHA1 OBJECT IDENTIFIER ::= { id-pkix id-alg(6)
     <TBD> }

     DhPopStatic ::= SEQUENCE {
         issuerAndSerial IssuerAndSerialNumber OPTIONAL,
         hashValue       MessageDigest

     issuerAndSerial is the issuer name and serial number of the
     certificate from which the public key was obtained.  The
     issuerAndSerial field is omitted if the public key did not come
     from a certificate.

     hashValue contains the result of the SHA-1 HMAC operation in step

  DhPopStatic is encoded as a BIT STRING and is the signature value
  (i.e. encodes the above sequence instead of the raw output from 3d).

5. Discrete Logarithm Signature

  The use of a single set of parameters for an entire public key
  infrastructure allows all keys in the group to be attacked together.

Prafullchandra, Schaad                                         [Page 4]

INTERNET DRAFT                                          February  1999

  For this reason we need to create a proof of possession for Diffie-
  Hellman keys that does not require the use of a common set of

  The method outlined in this document is the same as used by the
  Digital Signature Algorithm, but we have removed the restrictions
  imposed by the [FIPS-186] standard.  The use of this method does
  impose some additional restrictions on the set of keys that may be
  used, however if the key generation algorithm documented in [DH-X9.42]
  is used the required restrictions are met.  The additional
  restrictions are the requirement for the existence of a q parameter.
  Adding the q parameter is generally accepted as a good practice as it
  allows for checking of small group attacks.

  The following definitions are used in the rest of this section:

     p is a large prime
     g = h(p-1)/q mod p ,
        where h is any integer 1 < h < p-1 such that h(p-1) mod q > 1
        (g has order q mod p)
     q is a large prime
     j is a large integer such that p = qj + 1

     x is a randomly or pseudo-randomly generated integer with 1 < x < q
     y = g^x mod p

  Note: These definitions match the ones in [DH-X9.42].

5.1 Expanding the Digest Value

  Besides the addition of a q parameter, [FIPS-186] also imposes size
  restrictions on the parameters.  The length of q must be 160-bits
  (matching output of the SHA-1 digest algorithm) and length of p must
  be 1024-bits.  The size restriction on p is eliminated in this
  document, but the size restriction on q is replaced with the
  requirement that q must be at least 160-bits.  (The size restriction
  on q is identical with that in [DH-X9.42].)

  Given that there is not a random length-hashing algorithm, a hash
  value of the message will need to be derived such that the hash is in
  the range from 0 to q-1.  If the length of q is greater than 160-bits
  then a method must be provided to expand the hash length.

  The method for expanding the digest value used in this section does
  not add any additional security beyond the 160-bits provided by SHA.
  The value being signed is increased mainly to enhance the difficulty
  of reversing the signature process.

  This algorithm produces m the value to be signed.

Prafullchandra, Schaad                                         [Page 5]

INTERNET DRAFT                                          February  1999

  Let L = the size of q (i.e. 2^L <= q < 2^(L+1)).
  Let M be the original message to be signed.

  1. Compute d = SHA-1(M), the SHA-1 digest of the original message.

  2. If L == 160 then m = d.

  3. If L @ 160 then follow steps (a) through (d) below.

        Set n = L / 160, where / represents integer division,
       consequently, if L = 200, n = 1.
     b) Set m = d, the initial computed digest value.
     c) For i = 0 to n -
                       - 1
            m = m | SHA(d),  where "|" means concatenation.
     d) m = LEFTMOST(m, L-1), where LEFTMOST returns the L-1 left most
        bits of m.

  Thus the final result of the process meets the criteria that 0 <= m <

5.2 Signature Computation Algorithm

  The signature algorithm produces the pair of values (r, s), which is
  the signature. The signature is computed as follows:

  Given m, the value to be signed, as well as the parameters defined
  earlier in section 5.

   1. Generate a random or pseudorandom integer k, such that 0 < k^-1 <

   2. Compute r = (g^k mod p) mod q.

   3. If r is zero, repeat from step 1.

   4. Compute s = (k^-1 (m + xr)) mod q.

   5. If s is zero, repeat from step 1.

5.3 Signature Verification Algorithm

  The signature verification process is far more complicated than is
  normal for the Digital Signature Algorithm, as some assumptions about
  the validity of parameters cannot be taken for granted.

  Given a message m to be validated, the signature value pair (r, s) and
  the parameters for the key.

Prafullchandra, Schaad                                         [Page 6]

INTERNET DRAFT                                          February  1999

   1. Perform a strong verification that p is a prime number.

   2. Perform a strong verification that q is a prime number.

   3. Verify that q is a factor of p-1, if any of the above checks fail
      then the signature cannot be verified and must be considered a

   4. Verify that r and s are in the range [1, q-1].

   5. Compute w = (s^-1) mod q.

   6. Compute u1 = m*w mod q.

   7. Compute u2 = r*w mod q.

   8. Compute v = ((g^u1 * y^u2) mod p) mod q.

   9. Compare v and r, if they are the same then the signature verified

5.4 ASN Encoding

  The signature is encoded using

      id-alg-dhPOP OBJECT IDENTIFIER ::= {id-pkix id-alg(6) <TBD> }

  The parameters for id-alg-dhPOP are encoded as DomainParameters
  (imported from [PROFILE]).  The parameters may be omitted in the
  signature, as they must exist in the associated key request.

  The signature value pair r and s are encoded using Dss-Sig-Value
  (imported from [PROFILE]).

5. Security Considerations

  All the security in this system is provided by the secrecy of the
  private keying material. If either sender or recipient private keys
  are disclosed, all messages sent or received using that key are
  compromised. Similarly, loss of the private key results in an
  inability to read messages sent using that key.

  Selection of parameters can be of paramount importance.  In the
  selection of parameters one must take into account the community/
  group of entities that one wishes to be able to communicate with.  In
  choosing a set of parameters one must also be sure to avoid small

Prafullchandra, Schaad                                         [Page 7]

INTERNET DRAFT                                          February  1999

  groups.  [FIPS-186] Appendixes 2 and 3 contain information on the
  selection of parameters.  The practices outlined in this document will
  lead to better selection of parameters.

6. Open Issues

  There are no known open issues.

7. References

  [FIPS-186]  Federal Information Processing Standards Publication (FIPS
              PUB) 186, "Digital Signature Standard", 1994 May 19.

  [RFC2314]   B. Kaliski, "PKCS #10: Certification Request Syntax v1.5",
              RFC 2314, October 1997

  [RFC2104]   H. Krawczyk, M. Bellare, R. Canetti, "HMAC: Keyed-Hashing
              for Message Authentication", RFC 2104, February 1997.

  [PROFILE]   R. Housley, W. Ford, W. Polk, D. Solo, "Internet
              X.509 Public Key Infrastructure: Certificate and CRL
              Profile", RFC 2459, January 1999.

  [DH-X9.42]  E. Rescorla, "Diffie-Hellman Key Agreement Method".
              (currently draft-ietf-smime-x942-*.txt)

8. Author's Addresses

  Hemma Prafullchandra
  XETI Inc.
  5150 El Camino Real, #A-32
  Los Altos, CA 94022
  (640) 694-6812

  Jim Schaad
  Microsoft Corporation
  One Microsoft Way
  Redmond, WA 98052-6399
  (425) 936-3101

Appendix A.  ASN.1 Module



Prafullchandra, Schaad                                         [Page 8]

INTERNET DRAFT                                          February  1999

  -- The types and values defined in this module are exported for use in
  -- the other ASN.1 modules. Other applications may use them for their
  -- own purposes.

     IssuerAndSerialNumber, MessageDigest
     FROM CryptographicMessageSyntax { iso(1) member-body(2)
          us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16)
          modules(0) cms(1) }

     Dss-Sig-Value, DomainParameters
     FROM PKIX1Explicit88 {iso(1) identified-organization(3) dod(6)
          internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)

     id-dhSig-static-HMAC-SHA1 OBJECT IDENTIFIER ::= {id-pkix id-alg(6)
     <TBD> }

     DhSigStatic ::= SEQUENCE {
         IssuerAndSerial IssuerAndSerialNumber OPTIONAL,
         hashValue       MessageDigest

     id-alg-dhPOP OBJECT IDENTIFIER ::= {id-pkix id-alg(6) <TBD> }


Prafullchandra, Schaad                                         [Page 9]

Html markup produced by rfcmarkup 1.129c, available from https://tools.ietf.org/tools/rfcmarkup/