View
217
Download
0
Tags:
Embed Size (px)
Citation preview
J. HåstadJ. JakobssonA. JuelsM. Yung
Funkspiel Schemes:An Alternative to Conventional Tamper
Resistance
Royal Inst. of Technology, Stockholm RSA LaboratoriesRSA LaboratoriesCertco
Captured by Germans, along with radio and three message/ciphertext pairs
Lauwers worked as radio operator for SOE, British underground during WW II
Germans sought to mount “Funkspiel”, i.e., pass false messages to SOE
Lauwers
SOE made use of a kind of MAC
Subverting the Funkspiel Germans demanded to know “MAC” Lauwers had been instructed to introduce an error into 16th letter
of every message as “MAC” Lauwers made clever observation about his three messages:
…………....stop…..Message 1:
Message 2: …………....stop…..
Message 3: ………….……..…..
o
o
u
e
Claimed that “MAC” involved corruption of ‘o’ in stop
16th letter
Step 1: Alice sends messages to Bob
Alice Bob
Eve
message1, MAC (message1)message2, MAC (message2)message3, MAC (message3)
What do we want?
Eve can’t tell whether Alice changed key– Even though Eve has seen MAC(message1),
MAC(message2),...
Bob can tell whether Alice changed key
Related work
Forward-secure signature schemes– Attacker knows that key evolves
Distress PIN– No security against eavesdropper
Deniable encryption
A funkspiel scheme
MAC key 0:
MAC key 1:
0 1 1 0 1 0 1 0 0 0 1 1 1 00 1 1 11 1 0 0 0 1 1
Problems: We need one bit for every MAC;
Eve can cheat with small probability
???
Another funkspiel scheme (simplified)
Problem: What if Eve sees Bob’s keying material?
She can forge a MAC
h h
???
??
Asymmetric funkspiel scheme
Semantically secure encryption (e.g., El Gamal) ensures that Eve can’t test signature against SK
Key swap for Alice under El Gamal is efficient, e.g., she can randomize last 100 bits
If Eve sees Bob’s keys, she still can’t forge MAC
Scheme is less efficient than symmetric ones
Real-world funkspiel
Alice changes key when she senses Eve is attempting to break in (no coin flipping)
Bob tries to determine whether Alice sent “distress signal”, i.e., changed key
What this good for? Tamper resistant hardware
– Currently uses “zeroization”
– Funkspiel schemes permit detection and tracing – Funkspiel schemes can give false sense of
security or success to attacker– E.g., cash card
Open issues
Power consumption– Many devices have only external power– What about DPA attacks?
How about, e.g., firewalls?