डिजीटल सिग्नेचर

From Wikipedia

This article concerns cryptographic signatures. For signatures in digital form, see electronic signature.

In cryptography, a डिजीटल सिग्नेचर वा डिजीटल सिग्नेचर scheme is a type of asymmetric cryptography used to simulate the security properties of a signature in digital, rather than written, form. डिजीटल सिग्नेचर schemes normally give two algorithms, one for signing which involves the प्रयोगकर्ताको secret वा private key, and one for verifying signatures which involves the प्रयोगकर्ताको public key. The output of the signature process is called the "डिजीटल सिग्नेचर."

डिजीटल सिग्नेचरहरु, like written signatures, are used to provide authentication of the associated input, usually called a "message." Messages may be anything, from electronic mail to a contract, वा even a message sent in a more complicated cryptographic protocol. डिजीटल सिग्नेचरहरु are used to create public key infrastructure (PKI) schemes in which a प्रयोगकर्ताको public key (whether for public-key encryption, डिजीटल सिग्नेचरहरु, वा any other purpose) is tied to a प्रयोगकर्ता by a digital identity certificate issued by a certificate authority. PKI schemes attempt to unbreakably bind प्रयोगकर्ता information (name, address, phone number, etc.) to a public key, so that public keys can be used as a form of identification.

डिजीटल सिग्नेचरहरु are often used to implement electronic signatures, a broader term that refers to any electronic data that carries the intent of a signature[१], but not all electronic signatures use डिजीटल सिग्नेचरहरु.[२][३][४][५] In some countries, including the United States, and in the European Union, electronic signatures have legal significance. However, laws concerning electronic signatures do not always make clear their applicability towards cryptographic डिजीटल सिग्नेचरहरु, leaving their legal importance somewhat unspecified.

विषयसूची

[परिवर्तन्] परिभाषा

डिजीटल सिग्नेचर scheme typically consists of three algorithms:

  • A key generation algorithm G that randomly produces a "key pair" (PK, SK) for the signer. PK is the verifying key, which is to be public, and SK is the signing key, to be kept private.
  • A signing algorithm S, that on input a message m and a signing key SK, produces a signature σ.
  • A signature verifying algorithm V, that on input a message m, a verifying key PK, and a signature σ, either accepts वा rejects.

Two main properties are required. First, signatures computed honestly should always verify. That is, V should accept (mPKS (mSK)) whenever SK is the secret key related to PK, for any message m. Secondly, it should be hard for any adversary, knowing only PK, to create valid signatures

[परिवर्तन्] History

In the famous paper "New Directions in Cryptography", Whitfield Diffie and Martin Hellman first described the notion of a डिजीटल सिग्नेचर scheme, although they only conjectured that such schemes existed.[६][७] Soon afterwards, Ronald Rivest, Adi Shamir, and Len Adleman invented the RSA algorithm, the first scheme for डिजीटल सिग्नेचरहरु[८]. The first widely marketed software package to offer डिजीटल सिग्नेचर was Lotus Notes 1.0, released in 1989, which used the RSA algorithm. [९]

RSA signatures are performed using the algorithms of the RSA cryptosystem. To generate RSA signature keys, one simply generates an RSA key pair. To sign a message m, the signer computes σ=D(SK,m): that is, the signer decrypts the message m to obtain σ. To verify a signature, we check that E(PK,σ) = m, that is, that encrypting σ gives the message m. In this procedure, any m up to a certain maximum size can be used as input. In order to sign messages of arbitrary size, we first apply a cryptographic hash function to reduce the message m to a short digest, which is then signed.

However, other डिजीटल सिग्नेचर schemes were soon developed after RSA, the earliest being Lamport signatures[१०], Merkle signatures (also known as "Merkle trees" वा simply "Hash trees")[११], and Rabin signatures[१२], which required simpler computational hardness assumptions.

In 1988, Shafi Goldwasser, Silvio Micali, and Ronald Rivest became the first to rigorously define the security requirements of डिजीटल सिग्नेचर schemes. They described a hierarchy of attack models:

  1. In a key-only attack, the attacker is only given the public verification key.
  2. In a known message attack, the attacker is given valid signatures for a variety of messages known by the attacker but not chosen by the attacker.
  3. In a chosen message attack, the attacker first learns signatures on arbitrary messages of the attacker's choice.

They also describe a hierarchy of attack results:

  1. A total break results in the recovery of the signing key.
  2. A universal forgery attack results in the ability to forge signatures for any message.
  3. A selective forgery attack results in a signature on a message of the adversary's choice.
  4. An existential forgery merely results in some valid message/signature pair not already known to the adversary.

They also present the GMR signature scheme, the first that can be provent to prevent even an existential forgeries against even a chosen message attack.[१३]

Image:डिजीटल सिग्नेचर schema.gif
A diagram depicting the process of creating and verifying a डिजीटल सिग्नेचर based on a trapdoor permutation.

Most early signature schemes were of a similar type: they involve the use of a trapdoor permutation, such as the RSA function, वा in the case of the Rabin signature scheme, computing square modulo composite n. A trapdoor permutation family is a family of permutations, specified by a parameter, that is easy to compute in the forward direction, but is difficult to compute in the reverse direction. However, for every parameter there is a "trapdoor" that enables easy computation of the reverse direction. Trapdoor permutations can be viewed as public-key encryption systems, where the parameter is the public key and the trapdoor is the secret key, and where encrypting corresponds to computing the forward direction of the permutation, while decrypting corresponds to the reverse direction. Trapdoor permutations can also be viewed as डिजीटल सिग्नेचर schemes, where computing the reverse direction with the secret key is thought of as signing, and computing the forward direction is done to verify signatures. Because of this correspondence, डिजीटल सिग्नेचरहरु are often described as based on public-key cryptosystems, where signing is equivalent to decryption and verification is equivalent to encryption, but this is not the only way डिजीटल सिग्नेचरहरु are computed.

Used directly, this type of signature scheme is vulnerable to a key-only existential forgery attack. To create a forgery, the attacker picks a random signature σ and uses the verification procedure to determine the message m corresponding to that signature.[१४] In practice, however, this type of signature is not used directly, but rather, the message to be signed is first hashed to produce a short digest that is then signed. This forgery attack, then, only produces the hash function output that corresponds to σ, but not a message that leads to that value, which does not lead to an attack. In the random oracle model, this hash-and-decrypt form of signature is existentially unforgeable, even against a chosen-message attack.[७]

There are several reasons to sign such a hash (or message digest) instead of the whole document.

  • For efficiency: The signature will be much shorter and thus save time since hashing is generally much faster than signing in practice.
  • For compatibility: Messages are typically bit strings, but some signature schemes operate on other domains (such as, in the case of RSA, numbers modulo a composite number N). A hash function can be used to convert an arbitrary input into the proper format.
  • For integrity: Without the hash function, the text "to be signed" may have to be split (separated) in blocks small enough for the signature scheme to act on them directly. However, the receiver of the signed blocks is not able to recognize if all the blocks are present and in the appropriate order.

[परिवर्तन्] Benefits of डिजीटल सिग्नेचरहरु

These are common reasons for applying a डिजीटल सिग्नेचर to communications:

[परिवर्तन्] Authentication

Although messages may often include information about the entity sending a message, that information may not be accurate. डिजीटल सिग्नेचरहरु can be used to authenticate the source of messages. When ownership of a डिजीटल सिग्नेचर secret key is bound to a specific प्रयोगकर्ता, a valid signature shows that the message was sent by that प्रयोगकर्ता. The importance of high confidence in sender authenticity is especially obvious in a financial context. For example, suppose a bank's branch office sends instructions to the central office requesting a change in the balance of an account. If the central office is not convinced that such a message is truly sent from an authorized source, acting on such a request could be a grave mistake.

[परिवर्तन्] Integrity

In many scenarios, the sender and receiver of a message may have a need for confidence that the message has not been altered during transmission. Although encryption hides the contents of a message, it may be possible to change an encrypted message without understanding it. (Some encryption algorithms, known as nonmalleable ones, prevent this, but others do not.) However, if a message is digitally signed, any change in the message will invalidate the signature. Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this is still considered to be computationally infeasible by most cryptographic hash functions (see collision resistance).

[परिवर्तन्] Drawbacks of डिजीटल सिग्नेचरहरु

Despite their usefulness, डिजीटल सिग्नेचरहरु do not alone solve all the problems we might wish them to.

[परिवर्तन्] Non-repudiation

In a cryptographic context, the word repudiation refers to the act of disclaiming responsibility for a message. A message's recipient may insist the sender attach a signature in order to make later repudiation more difficult, since the recipient can show the signed message to a third party (eg, a court) to reinforce a claim as to its signatories and integrity. However, loss of control over a प्रयोगकर्ताको private key will mean that all डिजीटल सिग्नेचरहरु using that key, and so ostensibly 'from' that प्रयोगकर्ता, are suspect. Nonetheless, a प्रयोगकर्ता cannot repudiate a signed message without repudiating their signature key.

[परिवर्तन्] Association of डिजीटल सिग्नेचरहरु and trusted time stamping

डिजीटल सिग्नेचर algorithms and protocols do not inherently provide certainty about the date and time at which the underlying document was signed. The signer might, वा might not, have included a time stamp with the signature, वा the document itself might have a date mentioned on it, but a later reader cannot be certain the signer did not, for instance, backdate the date वा time of the signature. Such misuse can be made impracticable by using trusted time stamping in addition to डिजीटल सिग्नेचरहरु.

[परिवर्तन्] Additional security precautions

[परिवर्तन्] Putting the private key on a smart card

All public key / private key cryptosystems depend entirely on keeping the private key secret. A private key can be stored on a प्रयोगकर्ताको computer, and protected by, for instance, a local password, but this has two disadvantages:

  • the प्रयोगकर्ता can only sign documents on that particular computer and
  • the security of the private key completely depends on the security of the computer, which is notoriously unreliable for many PCs and operating systems.

A more secure alternative is to store the private key on a smart card. Many smart cards are deliberately designed to be tamper resistant (however, quite a few designs have been broken, notably by Ross Anderson and his students). In a typical implementation, the hash calculated from the document is sent to the smart card, whose CPU encrypts the hash using the stored private key of the प्रयोगकर्ता and returns it. Typically, a प्रयोगकर्ता must activate his smart card by entering a personal identification number वा PIN code (thus providing a two-factor authentication). Note that it can be sensibly arranged (but is not always done) that the private key never leaves the smart card. If the smart card is stolen, the thief will still need the PIN code to generate a डिजीटल सिग्नेचर. This reduces the security of the scheme to that of the PIN system, but is nevertheless more secure than are many PCs.

[परिवर्तन्] Using smart card readers with a separate keyboard

Entering a PIN code to activate the smart card, commonly requires a numeric keypad. Some card readers have their own numeric keypad. This is safer than using a card reader integrated into a PC, and then entering the PIN using that computer's keyboard. The computer might be running a keystroke logger (by its owner/operators intention वा otherwise -- due to a virus, for instance) so that the PIN code becomes compromised. Specialized card readers are less vulnerable, though not invulnerable, against tampering with their software वा hardware. And, of course, eavesdropping attacks against all such equipment are possible.

[परिवर्तन्] Other smart card designs

Smart card design is an active field, and there are smart card schemes which are intended to avoid these particular problems, though so far with little security proofs.

[परिवर्तन्] Using डिजीटल सिग्नेचरहरु only with trusted applications

One of the main differences between a डिजीटल सिग्नेचर and a written signature is that the प्रयोगकर्ता does not "see" what he signs. It's the application that presents a hash code to be encrypted with the private key, but in the case of a malicious application a hash code of another document might be presented so that the प्रयोगकर्ताs thinks he is signing the document he sees on the screen but is actually unwillingly signing another (probably less favorable).


[परिवर्तन्] Some डिजीटल सिग्नेचर algorithms

  • Full Domain Hash, RSA-PSS etc., based on RSA
  • DSA
  • ECDSA
  • ElGamal signature scheme
  • Undeniable signature
  • SHA (typically SHA-1) with RSA
  • Rabin signature algorithm
  • Pointcheval-Stern signature algorithm
  • Schnorr signature

[परिवर्तन्] The current state of use — legal and practical

डिजीटल सिग्नेचर schemes all have several prior requirements without which no such signature can mean anything, whatever the cryptographic theory वा legal provision.

  • First, quality algorithms. Some public-key algorithms are known to be insecure, practicable attacks against them having been discovered.
  • Second, quality implementations. An implementation of a good algorithm (or protocol) with mistake(s) will not work.
  • Third, the private key must remain actually secret; if it becomes known to any other party, that party can produce perfect डिजीटल सिग्नेचरहरु of anything whatsoever.
  • Fourth, distribution of public keys must be done in such a way that the public key claimed to belong to, say, Bob actually belongs to Bob, and vice versa. This is commonly done using a public key infrastructure and the public key\leftrightarrowप्रयोगकर्ता association is attested by the operator of the PKI (called a certificate authority). For 'open' PKIs in which anyone can request such an attestation (universally embodied in a cryptographically protected identity certificate), the possibility of mistaken attestation is non trivial. Commercial PKI operators have suffered several publicly known problems. Such mistakes could lead to falsely signed, and thus wrongly attributed, documents. 'closed' PKI systems are more expensive, but less easily subverted in this way.
  • Fifth, प्रयोगकर्ताs (and their software) must carry out the signature protocol properly.

Only if all of these conditions are met will a डिजीटल सिग्नेचर actually be any evidence of who sent the message, and therefore of their assent to its contents. Legal enactment cannot change this reality of the existing engineering possibilities, though some such have not reflected this actuality.

Legislatures, being importuned by businesses expecting to profit from operating a PKI, वा by the technological avant-garde advocating new solutions to old problems, have enacted statutes and/or regulations in many jurisdictions authorizing, endorsing, encouraging, वा permitting डिजीटल सिग्नेचरहरु and providing for (or limiting) their legal effect. The first appears to have been in Utah in the United States, followed closely by the states Massachusetts and California. Other countries have also passed statutes वा issued regulations in this area as well and the UN has had an active model law project for some time. These enactments (or proposed enactments) vary from place to place, have typically embodied expectations at variance (optimistically वा pessimistically) with the state of the underlying cryptographic engineering, and have had the net effect of confusing potential प्रयोगकर्ताs and specifiers, nearly all of whom are not cryptographically knowledgeable. Adoption of technical standards for डिजीटल सिग्नेचरहरु have lagged behind much of the legislation, delaying a more वा less unified engineering position on interoperability, algorithm choice, key lengths, and so on what the engineering is attempting to provide.

See also: ABA डिजीटल सिग्नेचर guidelines

[परिवर्तन्] Using separate key pairs for signing and encryption

In several countries, a डिजीटल सिग्नेचर has a status somewhat like that of a traditional pen and paper signature. Generally, these provisions mean that what is digitally signed legally binds the signer of the document to the terms therein. For that reason, it is often thought best to use separate key pairs for encrypting and signing. Using the encryption key pair a person can engage in an encrypted conversation (eg, about buying a house), but does not legally sign every message he sends. Only when both parties come to an agreement do they sign a contract with their signing keys, and only then are they legally bound by the terms of a specific document. After signing, the document can be sent over the encrypted link.

[परिवर्तन्] Legal aspects

Legislation concerning the effect and validity of डिजीटल सिग्नेचरहरु includes:

[परिवर्तन्] Argentina

[परिवर्तन्] Brazil

  • Medida provisória 2.200-2 (Portuguese) - Brazilian law states that any digital document is valid for the law if it is certified by ICP-Brasil (the official Brazilian PKI) वा if it is certified by other PKI and the concerned parties agree as to the validity of the document.

[परिवर्तन्] China

[परिवर्तन्] European Union and the European Economic Area

[परिवर्तन्] India

[परिवर्तन्] Malaysia

[परिवर्तन्] New Zealand

For an overview of the New Zealand law refer: - The Laws of New Zealand, Electronic Transactions, paras 16-18; or - Commercial Law, paras 8A.7.1-8A.7.4. (these sources are available on the LexisNexis subscription-only website)

[परिवर्तन्] Peru

[परिवर्तन्] Russian Federation

Federal Law of Russian Federation about Electronic डिजीटल सिग्नेचर (10.01.2002)

[परिवर्तन्] United Nations Commission on International Trade Law

[परिवर्तन्] United States

  • Uniform Electronic Transactions Act (UETA)
  • Electronic Signatures in Global and National Commerce Act (E-SIGN), at 15 U.S.C. 7001 et seq.

The Law regulates the activity of Certificate Authorities and conditions for practical application of डिजीटल सिग्नेचर. However, the Law does not correspond to the recommendations of WTO, UNCITRAL and other influential organizations. डिजीटल सिग्नेचर Systems described in this Law are not compatible with international standards. This is the main reason, why the Law will be overwritten. Amendments should simplify the procedure of डिजीटल सिग्नेचर use.

[परिवर्तन्] Switzerland

[परिवर्तन्] Uruguay

Uruguay laws include both, electronic and डिजीटल सिग्नेचरहरु:

[परिवर्तन्] Turkey

Turkey has an Electronic Signature Law [1] since 2004. This law is stated in European Union Directive 1999/93/EC. Turkey has a Government Certificate Authority - Kamu SM® for all government agents for their internal use and three independent certificate authories all of which are issuing qualified डिजीटल सिग्नेचरहरु.

Turkey had a recent triumph in डिजीटल सिग्नेचरहरु and become the forerunner of mobile signature, that is, qualified signatures that are created using mobile phones. The leading GSM operator of Turkey, Turkcell, had developed the business model of this service for consumers first in the world.

[परिवर्तन्] Legal cases

Court decisions discussing the effect and validity of डिजीटल सिग्नेचरहरु वा डिजीटल सिग्नेचर संग सम्वनधीत legislation:

  • In re Piranha, Inc., 2003 WL 21468504 (N.D. Tex) (UETA does not preclude a person from contesting that he executed, adopted, वा authorized an electronic signature that is purportedly his).
  • Cloud Corp. v. Hasbro, 314 F.3d 289 (7th Cir., 2002)[2] (E-SIGN does not apply retroactively to contracts formed before it took effect in 2000. Nevertheless, the statute of frauds was satisfied by the text of E-mail plus an (apparently) written notation.)
  • Sea-Land Service, Inc. v. Lozen International, 285 F.3d 808 (9th Cir., 2002) [3] (Internal corporate E-mail with signature block, forwarded to a third party by another employee, was admissible over hearsay objection as a party-admission, where the statement was apparently within the scope of the author's and forwarder's employment.)

[परिवर्तन्] References

  1. US ESIGN Act of 2000
  2. The University of Virginia
  3. State of WI
  4. National Archives of Australia
  5. CIO
  6. "New Directions in Cryptography", IEEE Transactions on Information Theory, IT-22(6):644-654, Nov. 1976.
  7. ७.० ७.१ "Signature Schemes and Applications to Cryptographic Protocol Design", Anna Lysyanskaya, PhD thesis, MIT, 2002.
  8. "A Method For Obtaining डिजीटल सिग्नेचरहरु and Public-Key Cryptosystems," Communications of the ACM, 21(2): 120-126, Feb. 1978.
  9. The History of Lotus Notes, accessed April 27, 2007.
  10. "Constructing डिजीटल सिग्नेचरहरु from a one-way function.", Leslie Lamport, Technical Report CSL-98, SRI International, Oct. 1979.
  11. "A certified डिजीटल सिग्नेचर", Ralph Merkle, In Gilles Brassard, ed., Advances in Cryptology -- CRYPTO '89, vol. 435 of Lecture Notes in Computer Science, pp. 218-238, Spring Verlag, 1990.
  12. "Digitalized signatures as intractable as factorization." Michael O. Rabin, Technical Report MIT/LCS/TR-212, MIT Laboratory for Computer Science, Jan. 1979
  13. "A डिजीटल सिग्नेचर scheme secure against adaptive chosen-message attacks.", Shafi Goldwasser, Silvio Micali, and Ronald Rivest. SIAM Journal on Computing, 17(2):281-308, Apr. 1988.
  14. "Modern Cryptography: Theory & Practice", Wenbo Mao, Prentice Hall Professional Technical Reference, New Jersey, 2004, pg. 308. ISBN 0-13-066943-1

[परिवर्तन्] UNDP-APDIP Books


This e-primer provides comprehensive information on the UNCITRAL Model Law, different legislative approaches towards electronic documentation, signatures, and authentication. The legal and regulatory issues around intellectual property, domain name disputes, consumer privacy / protection, as well as cybercrimes, and censorship are also identified.

[परिवर्तन्] External links