7
$\begingroup$

Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to:

  1. verify that the data has not been tampered with, and
  2. verify that the message is in fact sent/signed by the one who claims to have?

This paper discusses it, but can it safely and effectively replace DS?

$\endgroup$
1
$\begingroup$

The approach of one-way accumulators aren't a satisfying alternative to DS algorithms. Basically its just another way of using hash functions to generate a Message authentication code by hashing a message and a shared secret, while the author replaces the shared secret with the identities of all participants.

While MACs are a commonly used approach of detect data manipulation, since an attacker can't forge a MAc without knowing the secret key (of course there a several attacks on different MAC schemes and several ways of finding collisions, but an overview of collision resistance, preimage resistance resistance and second preimage resistcance would go beyond the scope of the discussion), nobody can prove the senders identity of a received message. Because all participants share the same key, everybody could have computed the MAC.

Digital signatures use key pairs of $(k_{pub},k_{priv})$ for every party in the protocol, so you can be sure the messages origin way Alice, if the message is signed with Alices $k_{priv}$. The most basic attack on schoolbook DS are replay attacks: An attacker Eve just need to record the message of Alice and replay it later. To prevent this (and other attacks), a challenge-response-protocol is the best way to prove your identity to somebody.

To refer to one-way accumulators, you can say:

  • You can verify to be in possession of these data, all participants computed their identity against. But this is just a combination of a shared secret (participants list) and your own identity. I'm not even sure, if you can call it a MAC at all.
  • You can not verify other messages data. ($\neq$ message integrity)
  • You can not prove your identity, since the scheme is vulnerable to replay attacks. ($\neq$ nonrepudiability)
  • You can not verify the identity of a messages originator.($\neq$ origin integrity)

Since the design relies on a shared message (the participants list), you also have to perform all computations again, if a member is removed or added, which would having a devastating impact for the usage of this scheme.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.