Subversion-resilient signatures: Definitions, constructions and applications

Abstract

We provide a formal treatment of security of digital signatures against subversion attacks (SAs). Our model of subversion generalizes previous work in several directions, and is inspired by the proliferation of software attacks (e.g., malware and buffer overflow attacks), and by the recent revelations of Edward Snowden about intelligence agencies trying to surreptitiously sabotage cryptographic algorithms. The main security requirement we put forward demands that a signature scheme should remain unforgeable even in the presence of an attacker applying SAs (within a certain class of allowed attacks) in a fully-adaptive and continuous fashion. Previous notions-e.g., the notion of security against algorithmsubstitution attacks introduced by Bellare et al. (CRYPTO '14) for symmetric encryptionwere non-adaptive and non-continuous. In this vein, we show both positive and negative results for the goal of constructing subversion-resilient signature schemes. Negative results. We show that a broad class of randomized signature schemes is insecure against stateful SAs, even if using just a single bit of randomness. On the other hand, we establish that signature schemes with enough min-entropy are insecure against stateless SAs. The attacks we design are undetectable to the end-users (even if they know the signing key). Positive results. We complement the above negative results by showing that signature schemes with unique signatures are subversion-resilient against all attacks that meet a basic undetectability requirement. A similar result was shown by Bellare et al. for symmetric encryption, who proved the necessity to rely on stateful schemes; in contrast unique signatures are stateless, and in fact they are among the fastest and most established digital signatures available. As our second positive result, we show how to construct subversion-resilient identification schemes from subversion-resilient signature schemes. We finally show that it is possible to devise signature schemes secure against arbitrary tampering with the computation, by making use of an un-tamperable cryptographic reverse firewall (Mironov and Stephens-Davidowitz, EUROCRYPT '15), i.e., an algorithm that "sanitizes" any signature given as input (using only public information). The firewall we design allows us to successfully protect so-called re-randomizable signature schemes (which include unique signatures as a special case). As an additional contribution, we extend our model to consider multiple users and show implications and separations among the various notions we introduced. While our study is mainly theoretical, due to its strong practical motivation, we believe that our results have important implications in practice and might influence the way digital signature schemes are selected or adopted in standards and protocols.

True2F: Backdoor-Resistant Authentication Tokens

“…Ateniese et al show that if a digital signature scheme Σ is unique or rerandomizable then there are very efficient reverse firewalls for Σ [6]. Our firewalled signing protocol is a reverse firewall for ECDSA, which is neither unique nor rerandomizable.…”

“…The innovation is that our protocol outputs unmodified ECDSA signatures, which is critical for backwards compatibility. In Section 9, we explain how our construction relates to subliminal-free [44,45,46,108,109] and subversion-resistant signature schemes [6].…”

On the Security of Symmetric Encryption Against Mass Surveillance

“…The cryptographic reverse firewall is a generic way to prevent a tampered machine from leaking information to BB via any scheme. And the cryptographic reverse firewalls [20]- [22] mainly targeted at the protection of the public-key schemes. According to the results in [20], the improved asymmetric subversion model for signature and identification [23], [24] is further presented.…”

Fuzzing+Hardware Performance Counters-Based Detection of Algorithm Subversion Attacks on Post-Quantum Signature Schemes

“…State-of-the-art literature suggests two pathways to evade ASA: 1) design of subversion-resilient algorithms and 2) detection. Subversion-resilient design of cryptography algorithms were proposed in [10], [11]. Designing subversion-resilient algorithms requires cryptanalysis of the algorithm.…”