Certification asynchrone à grande échelle avec des arbres
de vérification de certificats
Josep Domingo-FerrerUniversitat Rovira i Virgili
[email protected], le 17 janvier 2003
Contents Introduction
Certificates and revocation CVTs
A new proposal Implicit revocation
Assessment Summary and conclusion
Introduction
Safe use of digital signatures requires certification of public keys
A digital certificate consists of a ‘certificate statement’ (c-statement) and its signature by the CA
Important issues: Revocation Large-scale certificate
management
Approaches to Revocation Certificate Revocation Lists (CRL, X.509 1988) Certificate Revocation Trees (CRT, Kocher
1999) Naor-Nissim Scheme (2-3 trees, 1998) Certificate Revocation System (CRS, Micali
1997) Short-validity certificates: they are valid until
their expiration date (Rivest 2000) Certificate Verification Trees (CVT): certificates
and revocation information are combined in a single Merkle tree (Gassko et al., 2000)
CVTs (1/3) CA builds a Merkle tree:
Every leaf is a c-statement together with its hash value
The hash values of sibling nodes are joined and the hash of the joint value is assigned to their parent node; this procedure iterates until the root node is reached.
CA signs the root node together with the date and additional information
The cert-path of a c-statement is the path from the corresponding leaf node to the root, along with the necessary nodes to verify the leaf node hash
CVTs (2/3)
Sign(RV||Date||Time)
RV=h(H5||H6)
H6=h(H3||H4)H5=h(H1||H2)
H2=h(C2)H1=h(C1)
C1 C2
H3=h(C3) H4=h(C4)
C3 C4
CVTs (3/3) A single signature certifies all public keys in the
CVT (easy to change CA key) The CVT is updated on a regular basis:
Certificates are appended to the tree in batches
Updating the CVT only requires recomputing one signature; the rest of work are hash value computations.
Historical queries can be handled easily Proof of certificate non-existence
A New Proposal
All advantages of CVTs are maintained The following features are added:
Batches of certificates can be requested without requiring substantial storage on the signer’s side
Convenient for short-validity certificates Convenient when the signer’s device is a smart
card Implicit revocation
Asynchronous Certification Based on CVTs The signer requests batches of
certificates without being forced to store the corresponding private keys Certificates can have a short validity
The signer can use a new certificate as soon as the old one has expired
It is assumed that the signer’s device is a smart card SC
The scheme consists of three protocols: generation, signature and implicit revocation
Protocol 1: Generation
1 The signer’s SC generates a key k corresponding to a block symmetric cipher (e.g.: DES, AES).
2 For i=1 to m:(a) SC generates a pair of public-private keys (pki,ski)
(b) SC encrypts ski under k and obtains Ek(ski)
(c) SC sends (pki,Ek(ski)) to CA
(d) SC deletes pki, ski and Ek(ski) from its memory
3 CA stores the Ek(ski) in a safe place
4 In the next CVT update, CA appends the pki received to CVT
Generation
(m times)
pki, E(ski)
CA
SC
CVT
k
E(sk1)
E(skm)
..
.
pk1 pkm...
Generation
The key pairs will be valid in consecutive time intervals
Protocol 1 is run often enough to avoid running out of keys
The larger the batch size m, the less often must Protocol 1 be run
Protocol 2: Signature at Interval t
1 If the signer’s SC already stores skt, then, if necessary, obtain the cert-path for pkt
2 Otherwise:(a) Delete the last stored skj
(b) Obtain Ek(skt) from CA
(c) Decrypt Ek(skt) to obtain skt
(d) Obtain the certificate and the cert-path for pkt from the CVT
3 Sign using skt
cert(pkj)skj
Signature (Interval t)
K
CA
E(sk1)
E(skm)
..
.
CVT
pk1 pkm...
skt cert(pkt
)
E(skt)
SC
signature
Signature
SC only stores the current private key SC obtains a new certificate and its private key
when the current one expires When signing, the cert-path must be appended
to the signature
Protocol 3: Implicit Revocation
1 If SC is compromised or stolen, the CA is informed by the signer
2 CA stops serving encrypted private keys Ek(ski) to SC
Implicit Revocation (t)
cert(pkj)skj
K
CA
E(sk1)
E(skm)
..
.
CVT
pk1 pkm...
SCE(skt)
signature
Implicit Revocation
Protocol 3 implicitly revokes all certificates issued for future time intervals
The current certificate is not revoked To eliminate the need for explicit
revocation of the current certificate, short-validity certificates can be used A short-validity certificate is like to expire
before the intruder has time to tamper with SC and use it
Efficiency Assessment Asynchronous certification. By
requesting batches of certificates ahead of time, a new certificate can be used as soon as the current one expires
Reduced storage. SC only stores a secret symmetric key (k), the current private key and the current certificate
Implicit revocation. It allows certificates to be revoked without updating the CVT nor publishing revocation information
Explicit vs Implicit Revocation Explicit revocation forces CA to publish
revocation information. Even worse, it forces verifiers to check that information before accepting a signature as valid.
Implicit revocation is better in that it prevents the private key corresponding to a revoked certificate from being used to sign
Explicit revocation can be completely eliminated if our scheme is combined with short-validity certificates
Summary and Conclusion
CVTs are a good data structure to manage large-scale CAs
A scheme has been proposed which allows batches of certificates to be requested ahead of time without degrading security
In case the SC is stolen or compromised, implicit revocation is used
Further Details inJ.Domingo, M.Alba and F.Sebé, “Asynchronous
Large-Scale Certification Based on Certificate Verification Trees”, Procs. of CMS’2001. Kluwer Academic Publishers, 2001, pp.185-196.