This document is obsolete. Please
refer to RFC 6955.
Network Working Group H. Prafullchandra Request for Comments: 2875 Critical Path Inc Category: Standards Track J. Schaad July 2000
Diffie-Hellman Proof-of-Possession Algorithms
Status of this Memo
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2000). All Rights Reserved.
Abstract
This document describes two methods for producing an integrity check value from a Diffie-Hellman key pair. This behavior is needed for such operations as creating the signature of a PKCS #10 certification request. These algorithms are designed to provide a proof-of- possession rather than general purpose signing.
PKCS #10 [RFC2314] defines a syntax for certification requests. It assumes that the public key being requested for certification corresponds to an algorithm that is capable of signing/encrypting. Diffie-Hellman (DH) is a key agreement algorithm and as such cannot be directly used for signing or encryption.
This document describes two new proof-of-possession algorithms using the Diffie-Hellman key agreement process to provide a shared secret as the basis of an integrity check value. In the first algorithm, the value is constructed for a specific recipient/verifier by using a public key of that verifier. In the second algorithm, the value is constructed for arbitrary verifiers.
Prafullchandra & Schaad Standards Track [Page 1]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
1. An entity (E) chooses the group parameters for a DH key agreement.
This is done simply by selecting the group parameters from a certificate for the recipient of the POP process.
A certificate with the correct group parameters has to be available. Let these common DH parameters be g and p; and let this DH key-pair be known as the Recipient key pair (Rpub and Rpriv).
Rpub = g^x mod p (where x=Rpriv, the private DH value and ^ denotes exponentiation)
2. The entity generates a DH public/private key-pair using the parameters from step 1.
For an entity E:
Epriv = DH private value = y Epub = DH public value = g^y mod p
3. The POP computation process will then consist of:
a) The value to be signed is obtained. (For a RFC2314 object, the value is the DER encoded certificationRequestInfo field represented as an octet string.) This will be the `text' referred to in [RFC2104], the data to which HMAC-SHA1 is applied.
b) A shared DH secret is computed, as follows,
shared secret = ZZ = g^xy mod p
Prafullchandra & Schaad Standards Track [Page 2]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
[This is done by the entity E as Rpub^y and by the Recipient as Epub^x, where Rpub is retrieved from the Recipient's DH certificate (or is the one that was locally generated by the Entity) and Epub is retrieved from the actual certification request.]
c) A temporary key K is derived from the shared secret ZZ as follows:
K = SHA1(LeadingInfo | ZZ | TrailingInfo), where "|" means concatenation.
LeadingInfo ::= Subject Distinguished Name from certificate TrailingInfo ::= Issuer Distinguished Name from certificate
d) Compute HMAC-SHA1 over the data `text' as per [RFC2104] as:
SHA1(K XOR opad, SHA1(K XOR ipad, text))
where, opad (outer pad) = the byte 0x36 repeated 64 times and ipad (inner pad) = the byte 0x5C repeated 64 times.
Namely,
(1) Append zeros to the end of K to create a 64 byte string (e.g., if K is of length 16 bytes it will be appended with 48 zero bytes 0x00). (2) XOR (bitwise exclusive-OR) the 64 byte string computed in step (1) with ipad. (3) Append the data stream `text' to the 64 byte string resulting from step (2). (4) Apply SHA1 to the stream generated in step (3). (5) XOR (bitwise exclusive-OR) the 64 byte string computed in step (1) with opad. (6) Append the SHA1 result from step (4) to the 64 byte string resulting from step (5). (7) Apply SHA1 to the stream generated in step (6) and output the result.
e) The output of (d) is encoded as a BIT STRING (the Signature value).
Prafullchandra & Schaad Standards Track [Page 3]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
The POP verification process requires the Recipient to carry out steps (a) through (d) and then simply compare the result of step (d) with what it received as the signature component. If they match then the following can be concluded:
a) The Entity possesses the private key corresponding to the public key in the certification request because it needed the private key to calculate the shared secret; and b) Only the Recipient that the entity sent the request to could actually verify the request because they would require their own private key to compute the same shared secret. In the case where the recipient is a Certification Authority, this protects the Entity from rogue CAs.
ASN Encoding
The ASN.1 structures associated with the static Diffie-Hellman POP algorithm are:
issuerAndSerial is the issuer name and serial number of the certificate from which the public key was obtained. The issuerAndSerial field is omitted if the public key did not come from a certificate.
hashValue contains the result of the SHA-1 HMAC operation in step 3d.
DhPopStatic is encoded as a BIT STRING and is the signature value (i.e. encodes the above sequence instead of the raw output from 3d).
The use of a single set of parameters for an entire public key infrastructure allows all keys in the group to be attacked together.
For this reason we need to create a proof of possession for Diffie- Hellman keys that does not require the use of a common set of parameters.
Prafullchandra & Schaad Standards Track [Page 4]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
This POP is based on the Digital Signature Algorithm, but we have removed the restrictions imposed by the [FIPS-186] standard. The use of this method does impose some additional restrictions on the set of keys that may be used, however if the key generation algorithm documented in [DH-X9.42] is used the required restrictions are met. The additional restrictions are the requirement for the existence of a q parameter. Adding the q parameter is generally accepted as a good practice as it allows for checking of small group attacks.
The following definitions are used in the rest of this section:
p is a large prime g = h(p-1)/q mod p , where h is any integer 1 < h < p-1 such that h(p-1) mod q > 1 (g has order q mod p) q is a large prime j is a large integer such that p = qj + 1
x is a randomly or pseudo-randomly generated integer with 1 < x < q y = g^x mod p
Note: These definitions match the ones in [DH-X9.42].
Besides the addition of a q parameter, [FIPS-186] also imposes size restrictions on the parameters. The length of q must be 160-bits (matching output of the SHA-1 digest algorithm) and length of p must be 1024-bits. The size restriction on p is eliminated in this document, but the size restriction on q is replaced with the requirement that q must be at least 160-bits. (The size restriction on q is identical with that in [DH-X9.42].)
Given that there is not a random length-hashing algorithm, a hash value of the message will need to be derived such that the hash is in the range from 0 to q-1. If the length of q is greater than 160-bits then a method must be provided to expand the hash length.
The method for expanding the digest value used in this section does not add any additional security beyond the 160-bits provided by SHA- 1. The value being signed is increased mainly to enhance the difficulty of reversing the signature process.
Prafullchandra & Schaad Standards Track [Page 5]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
This algorithm produces m the value to be signed.
Let L = the size of q (i.e. 2^L <= q < 2^(L+1)). Let M be the original message to be signed.
1. Compute d = SHA-1(M), the SHA-1 digest of the original message.
3. If L > 160 then follow steps (a) through (d) below.
a) Set n = L / 160, where / represents integer division, consequently, if L = 200, n = 1. b) Set m = d, the initial computed digest value. c) For i = 0 to n - 1 m = m | SHA(m), where "|" means concatenation. d) m = LEFTMOST(m, L-1), where LEFTMOST returns the L-1 left most bits of m.
Thus the final result of the process meets the criteria that 0 <= m < q.
The signature verification process is far more complicated than is normal for the Digital Signature Algorithm, as some assumptions about the validity of parameters cannot be taken for granted.
Prafullchandra & Schaad Standards Track [Page 6]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
Given a message m to be validated, the signature value pair (r, s) and the parameters for the key.
1. Perform a strong verification that p is a prime number.
2. Perform a strong verification that q is a prime number.
3. Verify that q is a factor of p-1, if any of the above checks fail then the signature cannot be verified and must be considered a failure.
The parameters for id-alg-dhPOP are encoded as DomainParameters (imported from [PROFILE]). The parameters may be omitted in the signature, as they must exist in the associated key request.
The signature value pair r and s are encoded using Dss-Sig-Value (imported from [PROFILE]).
In the static DH POP algorithm, an appropriate value can be produced by either party. Thus this algorithm only provides integrity and not origination service. The Discrete Logarithm algorithm provides both integrity checking and origination checking.
Prafullchandra & Schaad Standards Track [Page 7]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
All the security in this system is provided by the secrecy of the private keying material. If either sender or recipient private keys are disclosed, all messages sent or received using that key are compromised. Similarly, loss of the private key results in an inability to read messages sent using that key.
Selection of parameters can be of paramount importance. In the selection of parameters one must take into account the community/group of entities that one wishes to be able to communicate with. In choosing a set of parameters one must also be sure to avoid small groups. [FIPS-186] Appendixes 2 and 3 contain information on the selection of parameters. The practices outlined in this document will lead to better selection of parameters.
6. References
[FIPS-186] Federal Information Processing Standards Publication (FIPS PUB) 186, "Digital Signature Standard", 1994 May 19.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- Hashing for Message Authentication", RFC 2104, February 1997.
[PROFILE] Housley, R., Ford, W., Polk, W., and D. Solo, "Internet X.509 Public Key Infrastructure: Certificate and CRL Profile", RFC 2459, January 1999.
[DH-X9.42] Rescorla, E., "Diffie-Hellman Key Agreement Method", RFC 2631, June 1999.
7. Authors' Addresses
Hemma Prafullchandra Critical Path Inc. 5150 El Camino Real, #A-32 Los Altos, CA 94022
Phone: (640) 694-6812 EMail: hemma@cp.net
Jim Schaad
EMail: jimsch@exmsft.com
Prafullchandra & Schaad Standards Track [Page 8]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
BEGIN --EXPORTS ALL -- The types and values defined in this module are exported for use -- in the other ASN.1 modules. Other applications may use them -- for their own purposes.
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
Appendix B. Example of Static DH Proof-of-Possession
The following example follows the steps described earlier in section 3.
Step 1: Establishing common Diffie-Hellman parameters. Assume the parameters are as in the DER encoded certificate. The certificate contains a DH public key signed by a CA with a DSA signing key.
q: E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30 FB
g: 26 A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 53 3F 90 06 61 50 38 3E D2 B9 7D 81 1C 12 10 C5 0C 53 D4 64 D1 8E 30 07 08 8C DD 3F 0A 2F 2C D6 1B 7F 57 86 D0 DA BB 6E 36 2A 18 E8 D3 BC 70 31 7A 48 B6 4E 18 6E DD 1F 22 06 EB 3F EA D4 41 69 D9 9B DE 47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1 39 9A FF 04 D5 6E 7E 94 3D 03 B8 F6 31 15 26 48 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD
j: A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7 B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 92
y: 5F CF 39 AD 62 CF 49 8E D1 CE 66 E2 B1 E6 A7 01 4D 05 C2 77 C8 92 52 42 A9 05 A4 DB E0 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69 B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21 E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 8F C5 1A
seed:
Prafullchandra & Schaad Standards Track [Page 18]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB 09 E4 98 34
C: 00000037
x: 3E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7 52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D
Step 2. Form the value to be signed and hash with SHA1. The result of the hash for this example is: 5f a2 69 b6 4b 22 91 22 6f 4c fe 68 ec 2b d1 c6 d4 21 e5 2c
Step 3. The hash value needs to be expanded since |q| = 256. This is done by hashing the hash with SHA1 and appending it to the original hash. The value after this step is:
Next the first 255 bits of this value are taken to be the resulting "hash" value. Note in this case a shift of one bit right is done since the result is to be treated as an integer:
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
: 92 458 30 26: SEQUENCE { 460 03 21: BIT STRING 0 unused bits : 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB : 09 E4 98 34 483 02 1: INTEGER 55 : } : } : } 486 03 132: BIT STRING 0 unused bits : 02 81 80 5F CF 39 AD 62 CF 49 8E D1 CE 66 E2 B1 : E6 A7 01 4D 05 C2 77 C8 92 52 42 A9 05 A4 DB E0 : 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69 : B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22 : 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF : D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21 : E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 : 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 : 8F C5 1A : } 621 A0 0: [0] : } 623 30 12: SEQUENCE { 625 06 8: OBJECT IDENTIFIER '1 3 6 1 5 5 7 6 4' 635 05 0: NULL : } 637 03 72: BIT STRING 0 unused bits : 30 45 02 21 00 A1 B5 B4 90 01 34 6B A0 31 6A 73 : F5 7D F6 5C 14 43 52 D2 10 BF 86 58 87 F7 BC 6E : 5A 77 FF C3 4B 02 20 59 40 45 BC 6F 0D DC FF 9D : 55 40 1E C4 9E 51 3D 66 EF B2 FF 06 40 9A 39 68 : 75 81 F7 EC 9E BE A1 : }
Prafullchandra & Schaad Standards Track [Page 22]
RFC 2875 Diffie-Hellman Proof-of-Possession Algorithms July 2000
Full Copyright Statement
Copyright (C) The Internet Society (2000). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society.