Probability of collisions in Soft Input Decryption

Transcription

1 Issue 1, Volume 1, Probability of collisios i Soft Iput Decryptio Nataša Živić, Christoph Rulad Abstract I this work, probability of collisio i Soft Iput Decryptio has bee aalyzed ad calculated. Collisios of cryptographic check values cause wrog verificatio results. Therefore, it is importat to fid a aalytical form of a probability of collisios, which ca be used for estimatio of a efficiecy of Soft Iput Decryptio. It is kow, that shorter cryptographic check values cause ofte collisios. For that reaso, the umber of collisios for cryptographic check values has bee tested ad compared with the theoretical results. Keywords Collisios, Probability of Collisios, Probability of a Match, Soft Iput Decryptio. C I. INTRODUCTION HANNEL codig is a costitutioal part of commuicatio systems, which uses redudat iformatio for the recogitio or correctio of errors that occur durig the data trasfer over a oisy chael. Cryptography is icreasigly used i moder commuicatio systems to provide secure iformatio trasfer, i.e. to protect agaist eavesdroppig or maipulatio of trasmitted iformatio, or masqueradig of data origi. The cooperatio betwee chael codig ad cryptography has bee researched i [1], [] ad [3]: usig chael decodig for the improvemet of decryptio results ad, vice versa, usig cryptography for the improvemet of chael decodig. This cocept is called Joit Chael Codig ad Cryptography. A message with a cryptographic check value is trasmitted over a oisy chael usig chael codig ad decodig. The decryptio of the cryptographic check value is very fragile, because all bits of the message ad the cryptographic check value have to be correct. I case that oe bit or more of the iput of decryptio is wrog, about 50 % of decrypted bits are false, ad the verificatio of cryptographic check value fails. This problem ca be solved usig the method of correctio which is studied i this work ad called Soft Iput Decryptio: if the decoder is ot able to recostruct the Mauscript received February 9, 007; Revised received July 11,007. Nataša Živić is with the Istitute for Data Commuicatios Systems, Electrical Egieerig ad Iformatics Departmet, Uiversity of Siege, Siege, 57076, Germay ( atasa.zivic@ui-siege.de). Christoph Rulad is the maager of the Istitute for Data Commuicatios Systems ad a professor at the Electrical Egieerig ad Iformatics Departmet, Uiversity of Siege, Siege, 57076, Germay ( christoph.rulad@ui-siege.de). origial message ad cryptographic check value because of a oisy chael or iefficiecy of the chael decodig algorithm, it is possible to correct the message with the cryptographic check value usig side iformatio of the chael decoder i form of so called L-values. Chael decodig ca be improved usig a message with cryptographic check value which has bee corrected by Soft Iput Decryptio. This method is studied i this work as well ad it uses corrected L-values as feedback iformatio to the chael decoder for improved decodig of those bits which have ot bee yet corrected. The feedback method is iterative, because L-values corrected i oe roud are used for the correctio of bits i the ext iteratio. Collisios of cryptographic check values cause wrog verificatio results. The probability of collisios has bee calculated i this paper. II. CRYPTOGRAPHIC MECHANISMS OF DATA INTEGRITY AND DATA ORIGIN AUTHENTICATION Data itegrity is the property that data have ot bee altered or destroyed i a uauthorized maer [4, 5]. As data ca be chaged durig the trasfer or storig phase, it is importat to check that o modificatio happeed util they were received. Data origi autheticatio is the corroboratio that the source of data received is as claimed [5, 6]. It is the cryptographic service, which proves the idetity of the data origi, i.e. that data were ideed set by the etity which is assumed to be the origiator. Hash values, MAC/H-MACs ad digital sigatures are cosidered as redudacy values i this work, because they have differet legths which ifluece the codig gai, code rate ad probability of collisios. A. Hash Fuctios A hash fuctio is a oe-way fuctio which maps strigs of bits of variable legth to fix-legth strigs of bits, satisfyig two followig properties: - for a give output, it is computatioally ifeasible to fid a iput which maps to this output ad - for a give iput, it is computatioally ifeasible to fid a secod iput which maps to the same output [7]. The same stadard defies a hash code as the strig of bits which is the output of the hash fuctio. A collisio resistat hash fuctio is defied as a hash fuctio satisfyig the followig property: it is computatioally ifeasible to fid ay two distict iputs

2 Issue 1, Volume 1, 007 which map to the same output. Computatioal feasibility depeds o the specific security requiremets ad eviromet [7]. Collisio resistat hash fuctios are used for the geeratio of digital sigatures. The most commoly used legths of hash value are 160, 8 ad 56 bits. I this case, the collisio probability is greater tha 0.5 after about 80 radomly chose iput messages accordig to the birthday paradox. B. Message Autheticatio Codes (MAC) MAC is a applicatio of a symmetric block cipher [4]. Examples of used block cipher algorithm are DES [8], 3 DES ad AES [9]. ISO/IEC specifies MAC algorithms that use a secret key ad a -bit block cipher to calculate a -bit MAC. These mechaisms ca be used as data itegrity mechaisms to verify the fact that data have ot bee altered. MAC provides oly subective autheticatio, because idetity of data origi caot be prove by a third party (at least two parties are able to geerate the same MAC) [10]. MAC ca oly be used as a message autheticatio mechaism to provide assurace that a message has bee origiated by a etity i possessio of the secret key. A MAC algorithm is a fuctio which maps a strig D of bits ad a secret key K to fixed-legth strigs of bits, satisfyig the followig properties [4]: - for ay key ad ay iput strig the fuctio ca be computed efficietly - for ay fixed key, ad give o prior kowledge of the key, it is computatioally ifeasible to compute a fuctio value o ay ew iput strig. It should be oted that the birthday paradox applies also o MACs. Typical legth of the MAC is the block legth of the block cipher, i.e. 64 or 18 bits. Details about the MAC algorithm are give i [4]. C. Hashed Message Autheticatio Codes (H-MAC) [11] specifies MAC algorithms that use a secret key ad a hash fuctio (or its roud - fuctio) with a -bit result to calculate a m-bit MAC. These mechaisms ca be used as data itegrity mechaisms to verify that data have ot bee altered i a uauthorized maer. They ca also be used as message autheticatio mechaisms to provide assurace that a message has bee origiated by a etity i possessio of the secret key [11]. The legth of H MAC is the same as that of uderlyig hash fuctio: 64, 160, 8 or 56 bits, but the legth ca be adusted as ecessary. For example, for hash fuctios RIPEMID 160 ad SHA 1 the legth of H MAC is 160 bits. Collisio resistace of H MAC is defied as for hash fuctio (see chap. II A.). A H-MAC algorithm (or hashed cryptographic check fuctio) computes a fuctio which maps strig D of bits ad a secret key K to fixed-legth strigs of bits (H-MAC or hashed cryptographic check value), satisfyig the followig properties [11]: - for ay key ad ay iput strig the fuctio ca be computed efficietly - for ay fixed key, ad give o prior kowledge of the key, it is computatioally ifeasible to compute a fuctio value o ay ew iput strig. Details about the H-MAC algorithm are give i [11]. D. Digital Sigatures Digital sigatures provide data origi autheticatio ad support o-repudiatio services. They ormally use asymmetric cryptography, eve if there are solutios for symmetric algorithms based digital sigatures [1]. There are two types of digital sigatures: 1. sigatures givig message recovery (Fig. 1) [13]. sigatures with appedix (Fig. ) [14, 15]. a) Fig. 1 Digital Sigatures givig message recovery (simplified): a) Geeratio b) Verificatio Sigatures givig message recovery ca be applied to short messages, which are exteded by a oetime presigature before the executio of the sigature operatio (see Fig. 1). The decryptor recovers the message from the sigature, if the sigature is proved to be correct. Short message meas, that the legth of the message plus b)

3 Issue 1, Volume 1, redudacy is shorter tha the legth of the private key used i the sigature algorithm. If the message does ot cotai eough redudacy for verificatio, it is added by use of a hash fuctio. If the message is too log, the message recovery is partial. I this case the message is divided ito recoverable part (icluded i the sigature) ad orecoverable part (stored ad/or trasmitted alog with the sigature) [13]. I the case of digital sigatures with appedix, the message has a arbitrary legth (Fig. ). The ecryptor geerates a digital sigature over a hash value which has bee calculated over the message to be siged. The decryptor computes the hash value over the received message ad verifies the sigature by usig the public key. The result of the sigature verificatio is true or false. a) repudiatio. The algorithm of Soft Iput Decryptio (Fig. 3) is as follows: The decryptio is successfully completed, if the verificatio of the cryptographic check value is successful, i.e. the output is true. If the verificatio is egative, the soft output of the chael decoder is aalyzed ad the bits with the lowest L values are flipped (XOR 1 ), the the decryptor performs the verificatio process ad proves the result of the verificatio agai. If the verificatio is agai egative, bits with aother combiatio of the lowest L -values are chaged. This iterative process will stop whe the verificatio is successful or the eeded resources are cosumed. I case that the attempts for correctio fail, the umber of errors is too large as a result of a very oisy chael or a attack, so that the resources are ot sufficiet to try eough combiatios of flippig bits of low L -values. It may happe that the attempts for correctio of SID block succeed, but the corrected cryptographic value is ot equal to the origial oe: a collisio happes. This case has a extremely low probability whe cryptographic check values are chose uder security aspects. Collisio aspects of cryptographic check values i Soft Iput Decryptio are the subect of this paper. Fig. Digital Sigatures with appedix (simplified): b) a) Geeratio b) Verificatio I both cases, the verificatio result is egative if the iput of the sigature verificatio compared to the output of the siger is modified, or the public key ad private key do ot belog to the same key system. Digital sigatures ad messages - as iput to the decryptor - have to be delivered from the chael decoder free of errors or modificatios to verify the sigature successfully. III. SOFT INPUT DECRYPTION The basic techique which is described ad used i this work is called Soft Iput Decryptio. It cosists of a decryptor which uses soft output of the chael decoder as soft iput. [1]. The cryptographic mechaism which is used by ecryptor ad decryptor geerates ad verifies cryptographic check values (hash values, digital sigatures, MACs, H-MACs) providig data itegrity, data origi autheticatio ad o Fig. 3 Algorithm of the Soft Iput Decryptio Soft Iput Decryptio is block orieted. The block which is take from sequetial iput bits to the chael ecoder ad should be corrected by Soft Iput Decryptio after chael decodig is called SID block (Soft Iput Decryptio block). The SID block may have differet cotets depedig o cryptographic mechaisms ad scearios []. IV. COLLISIONS Collisios caused by chages of bits of a message ad of a redudacy check value by Soft Iput Decryptio (SID) will be aalyzed ad calculated i this paper. A redudacy check value RCV is a cryptographic check value CCV (digital sigature, MAC, H-MAC), if

4 Issue 1, Volume 1, cryptographic check fuctios are used or ay other systematic redudacy value added to a message, for example hash value or CRC. The redudacy check value is the result of a redudacy check fuctio RCF. Note: A hash value has characteristics of a cryptographic check fuctio, but the properties are of a redudacy check fuctio if the hash value is ot combied with ay other cryptographic mechaism. A hash value itself provides o security. The problem of collisios is described i Fig. 4. Note: This type of collisio does ot represet a collisio i the cryptographic sese defied for hash fuctios. This coditio causes wrog results, although the verificatio is successful. Therefore, this evet is regarded as a collisio. This type of collisio happes by chagig bits by Soft Iput Decryptio ad is also the subect of this paper. V. THE PROBABILITY OF MATCH A match is the evet, that the verificatio is successful: RCF ( = RCV" (4) The probability of a match is defied as: Fig. 4 Descriptio of the problem There are followig types of collisios: Type 1: It may happe that the first verificatio before Soft Iput Decryptio started is successful, although the origially set message ad the message which resulted i the successful verificatio are differet. The coditio for collisio i these cases is: [( message message ') ( RCF ( message ') = RCV ')] The collisio is caused by modificatios durig the trasmissio over the chael which could ot be corrected by the chael decoder. This type of collisio is ot a implicatio of Soft Iput Decryptio. For this reaso this collisio will ot be the subect of this paper. Type : It may happe that RCV is equal to the origially set RCV, ad verificatio is successful, although the origially set message ad message are differet. The coditio for this type of collisio is: [( message ( RCV = RCV") ( RCF( This type of collisio happes by chagig bits by Soft Iput Decryptio ad is the subect of this chapter. This type of collisio represets a collisio i the cryptographic sese defied for hash fuctios. Type 3: It may also happe that RCV differs from the origially set RCV, ad a message differs from origially set message, but the verificatio is successful. The coditio for this type of collisio is: [( message ( RCV RCV") ( RCF( (1) () (3) P match = P[ RCF( (5) i ay trial of Soft Iput Decryptio. The correct match P correct is the case that the message ad redudacy check value are corrected by Soft Iput Decryptio ad that o collisio happeed: [( message = ( RCF( The probability of a match betwee the message ad redudacy check value will be calculated uder followig assumptios: 1. all redudacy check values have the same probability of appearace. bits which are chaged i Soft Iput Decryptio are radomly distributed over the message ad redudacy check value. *Note: This assumptio is true for CRC, but it is ot prove that it is true for, for example, hash values. p(match, i) is the probability that a match happes whe i bits of chaged bits are i the message part. Because of assumptio., the probability that i bits of flipped bits are located i the message part of legth of m is give by hypergeometric distributio [10]: (6) m i i p m ( i) =, i = 0,1,..., (7) m + For example, if = 16 ad m = (Fig.53), distributio of i is symmetrical aroud the most likely value i = 8, which meas that it is most likely that the same umber of chaged bits is located i the message ad i the redudacy check value, as expected. For m > the distributio is ot symmetrical ad positios of lowest L -values are mostly i the message. I the case preseted i Fig. 4 with m =, it is

5 Issue 1, Volume 1, most likely that 11 positios of the lowest L values are placed i a message, i.e. 5 positios are i redudacy check value. p i, match i = (9) ad the opposite probability that o match with a specific message occurs is: p i, match 1 pi, match = (10) After attempts of tests, with i bits i the message part, the probability that o match occurs is: i p ( match i) ( p i, match ) 1 = = (11) Fig. 5 Probability p (i) whe m = ( = 16) So, the probability of a match after attempts with i bits i the message part is: p i ( match i) 1 1 = (1) The probability of a match whe i bits with the lowest L values are i a message part is p(match i). The probability of a match p match, whe bits are flipped, ca be calculated as the sum of probabilities of matches for each i: p = p( match, i) = p ( i) p( match i) (8) match Fig. 6 Probability p (i) whe m = ( = 16), i= 0 i= 0 Flippig chose bits withi the Soft Iput Decryptio algorithm, a set of i differet messages ad a set of -i differet redudacy check values are obtaied. The redudacy check fuctio of each of i messages might be equal to ay of -i produced redudacy check values. The probability that ay of -i redudacy check values match to oe specific message is: m Whe the umber of flipped bits is icreased from -1 to, -1 tests are performed, because these tests have ot bee performed before. If the additioally flipped bit is i a m i message part, it happes with the probability of. m + Vice versa, if the additioally flipped bit is i a redudacy check value part, it happes with the probability of ( i). Fially, the probability of a match after flippig m + up to N bits is give as: where ad B = P match = A + B, (13) m i 1 N 1 i ( i) = = i i = i 1 m+ m+ A (14) N 1 = 1 i= 1 m m i i i 1 m+ m+ i i 1 1 (15)

6 Issue 1, Volume 1, VI. THE PROBABILITY OF COLLISIONS A collisio as a implicatio of Soft Iput Decryptio happes i case. (collisio type ) ad 3. (collisio type 3) of Chapter III ad ca be calculated as: P coll = P P (16) match correct The correct match (P correct ) is oe of m+ possible matches of messages ad redudacy check values: P correct m + = 1 (17) The collisio probability is, usig equatios (11), (1), (15) ad (16): P = A + B (18) coll P correct where A ad B are give by equatios (14) ad (15), respectively. The results of tests are show i Fig. 8 i compariso to the results of equatio (18). The results of equatio (18) deped maily o the legth of the redudacy check value, ad they stay almost costat, if the legth of the message chages (the results chage o 7. or higher decimal positio). Tested collisio probability of Soft Iput Decryptio depeds also o the legth of the redudacy check value ad has o sigificat chage (o 4. or higher decimal place) with the chage of message legth, but it is lower tha the collisio probability calculated by equatio (18). The reaso that tested collisio probability is lower tha the oe of equatio (18) is that the equatio (18) is got assumig radom combiatios of chaged bits. Soft Iput Decryptio uses L -values to fid the correct message ad ot radom combiatios of chaged bits, so that the probability of the correct match is much higher tha that i equatio (17). For that reaso, the results of equatio (18) theoretic results i Fig. 8, ca be used as the worst case, i.e. a upper limit of the collisio probability. VII. COLLISION TESTS Collisio tests were performed by simulatios of Soft Iput Decryptio usig short redudacy check values (up to 4 bits) ad messages of various legths, for N = 8. All simulatios are programmed i C/C++ programmig laguage. For each poit of the curves tests are performed, which is eough for reliability of results [16]. The trasfer of the SID block is simulated by the use of a AWGN chael. The used covolutioal ecoder has a code rate r = 1/ ad costrait legth m = (Fig. 7). The decoder uses a MAP algorithm [17]. SHA-1 hash fuctio (160 bits) is used as a redudacy check fuctio. Shorter redudacy check values used for tests are got by takig right most bits of the hash value. Soft Iput Decryptio tests stopped after the first successful verificatio. After each verificatio it is checked if the verificatio is correct or a collisio happeed. So, the umber of collisios is couted. u c 1 c Fig. 8 Compariso of collisio results of tests ad theoretical results for up to 8 trials VIII. CONCLUSION This paper aalyzes probability of collisios which ca happe usig Soft Iput Decryptio. Collisios are stadard problem i cryptography, as they implicate wrog verificatio results. Probability of collisios grows as the legth of cryptographic check values decrease. Computatio of probability of collisio has bee performed by subtractio of the probability of match ad probability of the correct match. Additioally, simulatios have bee performed for compariso of aalytical (theoretical) results ad results of tests. The compariso shows that aalytical results ca be used for estimatio of the efficiecy of Soft Iput Decryptio, as the upper boud of probability of collisios of Soft Iput Decryptio. Fig. 7 Covolutioal ecoder r = ½, m =

7 Issue 1, Volume 1, REFERENCES [1] N. Živić, C. Rulad, Soft Iput Decryptio, 4 th Turbocode Coferece, 6 th Source ad Chael Code Coferece, VDE/IEEE, i Plastics, Muich, April 006. [] N. Živić, C. Rulad: Chael Codig as a Cryptography Ehacer, Advaces i Commuicatios, Proceedig i the 11th WSEAS iteratioal coferece o Commuicatios (part of the 007 CSCC multicoferece), Agios Nikolaos, Crete Islad, Greece, July 007. [3] N. Živić, C. Rulad, Feedback i Joit Codig ad Cryptography, 7 th Iteratioal ITG Coferece o Source ad Chael Codig VDE/IEEE, Ulm, Jauary 008. [4] ISO/IEC , Iformatio techology Security techiques Message Autheticatio Codes (MACs) Part 1: Mechaisms usig a block cipher, [5] ISO/IEC , Iformatio techology Security techiques Norepudiatio Part 1: Geeral, 004. [6] ISO/IEC , Iformatio techology Security techiques Etity autheticatio mechaisms Part 1: Geeral, [7] ISO/IEC , Iformatio techology Security techiques Hashfuctios Part 1: Geeral, 000. [8] ISO/IEC 837, Modes of operatio for 64-bit block cipher algorithm, [9] ISO/IEC , Iformatio techology Security techiques Ecryptio algorithms Part 3: Block ciphers, 005. [10] C. Rulad, Iformatiossicherheit i Dateetze, Datacom Verlag, Bergheim, [11] ISO/IEC 9797-, Iformatio techology Security techiques Message Autheticatio Codes (MACs) Part : Mechaisms usig a hash- fuctio, 000. [1] C. Rulad, Realizig digital sigatures with oe-way hash fuctio, Cryptologia, Vol XVII, Number 3, July [13] ISO/IEC 9796-, Iformatio techology Security techiques Digital sigatures givig message recovery Part : Discrete logarithm based mechaisms, 006. [14] ISO/IEC , Iformatio techology Security techiques Digital sigatures with appedix Part 1: Geeral, [15] ISO/IEC , Iformatio techology Security techiques Cryptographic techiques based o Elliptic Curves Part 4: Digital sigatures givig message recovery, 004. [16] M. Jeruchim, P. Balaba, K. S. Shamuga, Simulatio of Commuicatio Systems, Kluwer Academic/Pleum Publ, New York, 000. [17] L. Bahl, J. Jeliek, J., Raviv, F. Raviv, Optimal decodig of liear codes for miimizig symbol error rate, IEEE Trasactios o Iformatio Theory, IT-0, March 1974.