Search Results for “elgamal signature scheme”

Source: ElGamal signature scheme

The ElGamal signature scheme is a digital signature scheme which is based on the difficulty of computing discrete logarithms. It was described by Taher Elgamal in 1985.
The ElGamal signature algorithm is rarely used in practice. A variant developed at the NSA and known as the Digital Signature Algorithm is much more widely used. There are several other variants. The ElGamal signature scheme must not be confused with ElGamal encryption which was also invented by Taher Elgamal.

Overview

ElGamal

History

Operation

scheme

signature

= Key generation

of the multiplicative group of integers modulo p,

Z

p

∗

{\displaystyle Z_{p}^{*}}

.
The algorithm parameters are

(
p
,
g
)

{\displaystyle (p,g)}

. These parameters may be shared between users of the system.

Per-user keys

Given a set of parameters, the second phase computes the key pair for a single user:

Choose an integer

x

{\displaystyle x}

randomly from

{
1
…
p
−
2
}

{\displaystyle \{1\ldots p-2\}}

.
Compute

y
:=

g

x

mod

p

{\displaystyle y:=g^{x}{\bmod {p}}}

.

x

{\displaystyle x}

is the private key and

y

{\displaystyle y}

is the public key.

= Key distribution

=
The signer should send the public key

y

{\displaystyle y}

to the receiver via a reliable, but not necessarily secret, mechanism. The signer should keep the private key

x

{\displaystyle x}

secret.

= Signing

=
A message

m

{\displaystyle m}

is signed as follows:

Choose an integer

k

{\displaystyle k}

randomly from

{
2
…
p
−
2
}

{\displaystyle \{2\ldots p-2\}}

with

k

{\displaystyle k}

relatively prime to

p
−
1

{\displaystyle p-1}

.
Compute

r
:=

g

k

mod

p

{\displaystyle r:=g^{k}{\bmod {p}}}

.
Compute

s
:=
(
H
(
m
)
−
x
r
)

k

−
1

mod

(

p
−
1
)

{\displaystyle s:=(H(m)-xr)k^{-1}{\bmod {(}}p-1)}

.
In the unlikely event that

s
=
0

{\displaystyle s=0}

start again with a different random

k

{\displaystyle k}

.
The signature is

(
r
,
s
)

{\displaystyle (r,s)}

.

= Verifying a signature

=
One can verify that a signature

(
r
,
s
)

{\displaystyle (r,s)}

is a valid signature for a message

m

{\displaystyle m}

as follows:

Verify that

0
<
r
<
p

{\displaystyle 0
and

0
<
s
<
p
−
1

{\displaystyle 0
.
The signature is valid if and only if

g

H
(
m
)

≡

y

r

r

s

(
mod

p
)

.

{\displaystyle g^{H(m)}\equiv y^{r}r^{s}{\pmod {p}}.}

Correctness

The algorithm is correct in the sense that a signature generated with the signing algorithm will always be accepted by the verifier.
The computation of

s

{\displaystyle s}

during signature generation implies

H
(
m
)

≡

x
r
+
s
k

(
mod

p
−
1
)

.

{\displaystyle H(m)\,\equiv \,xr+sk{\pmod {p-1}}.}

Since

g

{\displaystyle g}

is relatively prime to

p

{\displaystyle p}

,

g

H
(
m
)

≡

g

x
r
+
s
k

(
mod

p
)

≡
(

g

x

)

r

(

g

k

)

s

(
mod

p
)

≡
(
y

)

r

(
r

)

s

(
mod

p
)

.

{\displaystyle {\begin{aligned}g^{H(m)}&\equiv g^{xr+sk}{\pmod {p}}\\&\equiv (g^{x})^{r}(g^{k})^{s}{\pmod {p}}\\&\equiv (y)^{r}(r)^{s}{\pmod {p}}.\\\end{aligned}}}

Security

A third party can forge signatures either by finding the signer's secret key x or by finding collisions in the hash function

H
(
m
)
≡
H
(
M
)

(
mod

p
−
1
)

{\displaystyle H(m)\equiv H(M){\pmod {p-1}}}

. Both problems are believed to be difficult. However, as of 2011 no tight reduction to a computational hardness assumption is known.
The signer must be careful to choose a different k uniformly at random for each signature and to be certain that k, or even partial information about k, is not leaked. Otherwise, an attacker may be able to deduce the secret key x with reduced difficulty, perhaps enough to allow a practical attack. In particular, if two messages are sent using the same value of k and the same key, then an attacker can compute x directly.

= Existential forgery

=
The original paper did not include a hash function as a system parameter. The message m was used directly in the algorithm instead of H(m). This enables an attack called existential forgery, as described in section IV of the paper. Pointcheval and Stern generalized that case and described two levels of forgeries:

The one-parameter forgery. Select an

e

{\displaystyle e}

such that

1
<
e
<
p
−
1

{\displaystyle 1
. Set

r
:=

g

e

y

mod

p

{\displaystyle r:=g^{e}y{\bmod {p}}}

and

s
:=
−
r

mod

(
p
−
1
)

{\displaystyle s:=-r{\bmod {(p-1)}}}

. Then the tuple

(
r
,
s
)

{\displaystyle (r,s)}

is a valid signature for the message

m
=
e
s

mod

(
p
−
1
)

{\displaystyle m=es{\bmod {(p-1)}}}

.
The two-parameters forgery. Select

1
<
e
,
v
<
p
−
1

{\displaystyle 1
, and

gcd
(
v
,
p
−
1
)
=
1

{\displaystyle \gcd(v,p-1)=1}

. Set

r
:=

g

e

y

v

mod

p

{\displaystyle r:=g^{e}y^{v}{\bmod {p}}}

and

s
:=
−
r

v

−
1

mod

(
p
−
1
)

{\displaystyle s:=-rv^{-1}{\bmod {(p-1)}}}

. Then the tuple

(
r
,
s
)

{\displaystyle (r,s)}

is a valid signature for the message

m
=
e
s

mod

(
p
−
1
)

{\displaystyle m=es{\bmod {(p-1)}}}

. The one-parameter forgery is a special case of the two-parameter forgery, when

v
=
1

{\displaystyle v=1}

.