Cryptanalysis of Hwang-Chang s a Time-Stamp Protocol for Digital Watermarking

Transcription

1 Cyptanalysis of Hwang-Chang s a Time-Stamp Potocol fo Digital Watemaking *Jue-Sam Chou, Yalin Chen 2, Chung-Ju Chan 3 Depatment of Infomation Management, Nanhua Univesity Chiayi 622 Taiwan, R.O.C *: coesponding autho jschou@mail.nhu.edu.tw Tel: 886+ (0) ext Institute of infomation systems and applications, National Tsing Hua Univesity d949702@oz.nthu.edu.tw Tel: 886+(0) Depatment of Infomation Management, Nanhua Univesity Chiayi 622 Taiwan, R.O.C chanchungju@gmail.com Tel: 886+ (0) ext.207 Abstact In 2005, Hwang et al. [7] poposed a time-stamping potocol fo digit watemaking. They claimed that thei scheme is secue against attacks. Howeve, in this aticle, we will show that thei scheme is not secue enough fo that when the owne of the image sends both the encypted session key and image to the TSS, the attacke can intecept these tansmitted data. Then, he can launch an off-line attack to analyze these intecepted data. We will descibe the attacke s action in this aticle. Afte that, we popose an impoved scheme to pevent this off-line attack. Keywods: Digital watemaks; Copyight potection; Time-stamping. Intoduction Since the concept of watemaking was put fowad in the ealy 990s, many eseaches have paid much attention to it, such as [-8]. Each scheme intends to become an effective appoach in this aea. Geneally speaking, a well constucted watemak can be embedded into the oiginal data unde the equiement that the oiginal data quality degadation is impeceptible. Also, it should be able to be detected when the watemaked data had been tampeed. Besides, a good watemaking scheme should possess the following popeties. () Robustness: since watemaking is designed as a

2 way to authenticate the copyight of the input data, it must be able to esist against diffeent kinds of intentional attacks. (2)Impeceptibility: watemaked data should be accepted with impeceptible quality degadation. (3)Secuity: in watemak pocessing, only the authoized use can execute the coesponding secuity measuements. Thee ae two main categoies in the study of watemaking: the fist is the wave watemaking and the second is the spatial domain watemaking. Although in 998, wave watemaking technique concentating on spatial domain [9] claimed that thei scheme is obust against the geneal signal pocessing attack. Howeve, in 999 and 2000, Peeia et al. found that thei scheme can be boken by two diffeent attacking algoithms as listed in [] and [0] by using geometic attack. Besides, in [] and [0], they also poposed two impovements, espectively. In thei two impovements, each incopoates a signal analysis scheme to stengthen the obustness against the geometic attack. Nevetheless, in 200, Heigel et al. [] found the same weakness as stated in [9] in thei two impovements, [] and [0]. As fo the second kind of watemaking technique, the spatial domain watemaking, thee has been seveal papes poposed in this aea, such as [2, 3, 4, 5, 6, 8]. Howeve, in 2005, Hwang et al. [7] pointed out that all the above-mentioned watemaking schemes ae not secue enough, because thee still exists some beaking methods to the oiginal o embedded image, such as JPEG compession, filteing, noise addition, scaling, otation and geometic distotions, and so on. Thus, they poposed a time-stamping potocol intending to pevent malicious attacks. They claimed that thei scheme is secue. Howeve, afte ou analysis, we find that thei scheme suffes fom the off-line attack. The oganization of this aticle is as follows: in Section 2, we biefly eview Hwang et al.s scheme. In Section 3, we descibe the eason why thei scheme is not secue enough. In Section 4, we show the impovement of thei scheme. Finally, a conclusion is given in Section Review of the Hwang-Chang s scheme In this section, we fist ewite the notations used in Hwang et al.s potocol [7] in Section 2. to make thei scheme moe eadable, then in Section 2.2, we biefly intoduce 2

3 thei potocol. 2. Rewiting the notations and definitions used in Hwang et al.s potocol The following notations ae the eplacements of the ones used in Hwang et al.s scheme. X, Y: Denote two stings. Sign K (X): Denotes the signatue on X using key K. Ve K (Y): Denotes the veification of Y using key K. [X, Y]: Denotes a sting consisted of sting X concatenated with sting Y. H(X): Denotes the hash value of sting X. E K (X): Denotes the encyption of sting X using key K. D K (Y): Denotes the decyption of sting Y using key K. t: Denotes the timestamp. 2.2 Hwang-Chang s potocol Hwang- Chang s time stamping watemaking scheme mainly consists of thee phases: () the setup phase (2) time-stamp signing phase and (3) time-stamp veifying phase. In the time stamp veifying phase, eveyone can use the TSS public key to veify the embedded watemak at any time. In this section, we only delineate () the setup phase and (2) the time-stamp signing phase as follows: () Setup phase: The system is initialized with each paticipant having a public key P u and a pivate key S u. All paticipants must be authenticated by a tusted cetificated authoity in advance and thee is a secue one-way hash function known to all paticipants. The owne of the oiginal host media X chooses a andom session key in the potocol. (2) Signing phase: The details fo thei watemaking time-stamping potocol in the signing phase ae shown in figue and descibed as follows: Step. Owne i andomly chooses a numbe and encypts it using 3

4 TSS s public key to obtain the value c. Meanwhile, he also encypts X using as the session key to obtain CX. Then he sends both c and CX to TSS. Step2. Afte eceiving c and CX, TSS decypts c using his pivate key S TSS to obtain. Then, using to decypt CX, he can deduce the value X. Then, TSS uses secue one-way hash function H to compute the hash value of the eceived CX, obtaining d. Then, he concatenates a time stamp t to d and signs on this concatenation using his pivate key S TSS, obtaining s. Finally, TSS uses to encypts the concatenation sting [t, s ], obtaining T. That is, TTS computes s = Signs TSS ([t, H (CX)]) and T = E ([t, s ]), whee t is the timestamp. Afte that, TSS sends T to owne i. Step3. Afte eceiving T, owne i uses the session key to decypt it and obtains t and the TSS s signatue s. Then, befoe embedding the watemak, owne i checks to see if s valid by the following equation. Ve P TSS (s ) = [t, H (CX)] (). If it is valid, owne i then embeds the watemak m to the oiginal media X, getting [X, m]. Afte that, he fist encypts s using session key, obtaining ES, then using ES as the encyption key to encypt [X, m], obtaining X W. That is, he computes X W = E ES ([X, m]). Finally, he sends X W to TSS. is Step4. Afte eceiving X W, TSS also computes ES and uses ES as the decyption key to decypt, obtaining [X, m]. He then extacts X and compaes it with the ealie computed X obtained in step2 to see if these two values ae equal. If it 4

5 so, TSS signs on [s, H (X W )] to get s 2 (=Signs TSS ( [s, H(X W )])). He then encypts s 2 using session key and sends the esult E (s 2 ) to owne i. Finally, TSS destoys X,, s, s 2 and X W. Step5. Afte eceiving E (s 2 ), owne i fist decypts it and then checks to see if s 2 equation. is signed by TSS by the following Ve P TSS (s 2 ) = [s, H (X W )] (2). When all of the above steps wee done, the time stamp watemak signing phase is completed. The time-stamped signatues s, s 2, and the session key all must be kept secet by the owne. Afte that, when a notay equests owne i to veify the time stamp t of a watemaked medium X W, owne i must send (t, s, s 2, CX) to the notay, the notay then can veify the time-stamped signatues s and s 2 using Eqs. () and (2). Owne i TSS Owne i chooses c E D (T) [t, s ] Veify Ve ES E (s ) X W Ve PTSS Veify (s ) [t, H(CX)] E ES ([X,m]) s D (E (s )) 2 P TSS CX E () (X) (s ) [s, H(X PTSS 2 2 W )] c, CX T X W E (s 2 ) D X D (CX) d H(CX) s STSS Sign (c) T E ([ t, s ]) computes s S TSS Sign ([ t, d ]) Checks X in the decypted X the ealie computed X ( D (CX)) 2 ( [s, H(X S TSS W with W )] ), X, X W, s, s 2 wee destoyed Fig.. Hwang-Chang s time stamp potocol fo watemaking. 5

6 3. Why thei scheme is not secue enough In this section, we point out why thei scheme is not secue enough. Fo, in thei scheme, the owne sends all the messages, CX, T, E (s 2 ) encypted using the same key, except fo the values c which is encypted using TSS s public key. This would be a weakness since the attacke can launch an off-line attack due to the ability of today s compute computing coopeation though netwok, i.e., the collision finding of hash function MD5 is unde such a computation coopeation [9]. Especially, the ciphetext T is the encyption of the concatenation of timestamp t and s using key. Fo t is usually an easily ecognizable paamete, the attacke has the ight, once he has seen the ecognizable timestamp t in the decyption esult. And afte this, the attacke has obtained the session key, he can get s 2 and theefoe s. Fom s and, he can compute ES and hencefoth obtains [X, m] fom X W. Also, he can get X fom CX. Besides, except fo the above-mentioned weakness, in thei scheme, TTS destoys the paametes,, X, X W, s and s 2 finally. This would incu the situation whee owne i claims that the idea X belongs to him but the attacke can pove to the thid paty that he owns the idea X as well fo he has s and s 2 afte he has the session key. The notay can not identify which one is the eal owne of the copyight X. This second weakness is fom the fact that ID is not bound to the idea X of the eal owne. Hence, we popose an impovement to enhance its secuity. 4. Impovement of thei scheme In this section, we pesent an impovement on both the secuity and efficiency in thei scheme. We descibe ou method in Section 4., and in Section 4.2, the signing phase and the veification phase, espectively. In ou impovement, we denote ID i as owne i s ID, T p as the TSS s public key and T s as the TSS s secet key. Ou scheme just uns in two passes which is fa moe efficient and secue than Hwang-Chang s scheme. 4. The signing phase The pocedue fo ou watemaking time-stamping potocol in signing phase ae shown in figue 2 and also descibed as follows: 6

7 Step. Owne i andomly chooses a numbe as the session key. He encypts the oiginal image X, the watemak m, his ID i and using TSS s public key T p to obtain the value c( E ( X, m, ID, )) T p i and then sends to TSS. Step2. TSS decypts c using his pivate key T s to obtain X, m, ID i and. Then, TSS uses the one-way hash function H to compute the hash value of X, m, ID i and a timestamp t, obtaining d. Afte that, he signs on d using his pivate key, obtaining s. Finally, TSS uses session key to encypt s, obtaining T and at last he sends the timestamp t and T to owne i. Step3. Afte eceiving t and T, owne i uses to decypt T and obtains the TSS s signatue s. Then, owne i veify to see if s is valid and checks to see whethe the esult of equals to H(X, m, ID i, t) by the following equation. Ve Tp (s ) = d = H (X, m, ID i, t). (3). Owne i TSS Owne i chooise c E Tp (X, m, ID, ) (s ) D (T ) ve (s ) d TP checks d? H(X, m, ID, t) i i c t, T (X,m, ID, ) D d H(X, m, ID, t) s Signs (d) T E (s ) i Ts i TS (c), X, m, s wee destoyed Fig.2. the signing phase of ou poposed time-stamping watemaking. 4.2 The veification phase The time-stamping veification phase is descibed as follows: Step. The notay equests owne i to veify the time-stamp of a medium X and the coesponding watemak m. 7

8 Step2. The owne i sends (X, m, ID i, t, s ) to the notay. Step3. The notay veifies s, obtaining d and compaes d to the computed H(X, m, ID i, t) in Eq (3). 5. Secuity analysis The impovement we poposed is that we embed the owne s ID, a timestamp t, and the watemak m to the copyight X to be hashed by TSS. Ou method can get id of the situation whee the notay can not identify which one, the eal owne i o the succeeded off-line attacke is the eal owne of the copyight of X as mentioned in Section 3. Fo, using ou attack, if an attacke intecepts the value c, he can not decypt it because he does not know the TSS s secet key. Besides, ou method also avoid the situation whee the easily ecognizable timestamp t is diectly encypted by. If T is boken, the attacke still can not obtain X and m fo they ae hashed by a secue one way function. This makes ou impovement moe obust than Hwang-Chang s scheme. 6. Conclusion This aticle shows that Hwang et al.s scheme is not secue enough. Fo, in thei scheme, most tansmitted data ae encypted using the same key, thus making an attacke can launch an off-line attack to analyze the encypted data. We have poposed an impoved scheme to enhance thei secuity and afte ou analysis in Section 5, we conclude that ou scheme is moe obust than theis. Refeences [] S. Peeia, J.J.K.O. Ruanaidh, F. Deguillaume, G. Csuka, T. Pun, Template based ecovey of fouie-based watemaks using log pola and log log maps, Poc. IEEE Int. Conf. Computing and Systems, vol., 999, pp [2] C.-W. Tang, H.-M. Hang, A featue-based obust digital image watemaking scheme, IEEE Tans. Signal Pocess. 5 (4) (2003) [3] M. Kutte, S.K. Bhattachajee, T. Ebahimi, Towads second geneation watemaking schemes, Poc. IEEE Int. Conf. Image Pocess., vol., 999, pp

9 [4] S. Bhattachajee, M. Kutte, Compession toleant image authentication, Poc. IEEE Int. Conf. Image Pocess., vol., 998, pp [5] B.-S. Kim, J.-G. Choi, K.-H. Pak, Image nomalization using invaiant centoid fo st invaiant digital image watemaking, IWDW (2003) [6] J.J.K. O_Ruanaidh, W.J. Dowling, F.M. Boland, Phase watemaking of digital image, Poc. IEEE Int. Conf. Image Pocess., vol. 3, 996, pp [7] M. Kutte, F. Jodan, F. Bossen, Digital signatue of colo images using amplitude modulation, J. Electon. Imaging 7 (2) (998) [8] I. Cox, J. Kilian, F.T. Leighton, T. Shamoon, Secue spead spectum watemaking fo multimedia, IEEE Tans. Image Pocess. 6 (2) (997) [9] H. Inoue, A. Miyazaki, A. Yamamoto, T. Katsua, Digital watemak based on the wavelet tansfom and its obustness on image compession, Poc. IEEE Int. Conf. Image Pocess., vol. 2, 998, pp [0] S. Peeia, T. Pun, Robust template matching fo affine esistant image watemaks, IEEE Tans. Image Pocess. 9 (6) (2000) [] A. Heigel, S. Voloshynovskiy, Y. Rytsa, The watemak template attack, Poc. SPIE, vol. 434, 200, pp [2] J. O Ruanaidh, T. Pun, Rotation, scale and tanslation invaiant spead spectum digital image watemaking, Signal Pocess 66 (3) (998) [3] D. Zheng, J. Zhao, A.E. Saddik, Rst-invaiant digital image watemaking based on log pola mapping and phase coelation, IEEE Tans. Cicuits Syst. Video Technol. 3 (8) (2003) [4] V. Solachidis, I. Pitas, Ciculaly symmetic watemak embedding in 2-D DFT domain, IEEE Tans. Image Pocess. 0 () (200) [5] M. Kutte, Watemaking esisting to tanslation, otation and scaling, Poc. SPIE, vol. 3528, pp [6] F. Sebe, J. Domingo-Fee, J. Heea, Spatial-domain image watemaking obust against compession, filteing, copping, and scaling, ISW 2000, Belin, LNCS, vol. 975, Spinge-Velag, Belin, 2000, pp [7] M.S. Hwang, K.F. Hwang, C.C. Chang, A time-stamping potocol fo digital watemaking, Applied Mathematics and Computation 69, 2005,

10 [8] W. Lu, H. Lu, F.L. Chung, Featue based watemaking using watemak template match, Applied Mathematics and Computation [9] Eic Thompson, MD5 collisions and the impact on compute foensics, Digital investigation 2005, pp