0
$\begingroup$

Iterative hashing of a private random seed can yield keys for use in HMAC, which if revealed publicly in reverse order and on predetermined schedule, can be used in a manner similar to other asymmetric key signing protocols, where released intermediate key authenticity is verifiable in terms of its relationship to the first released (last in chain) key. The seed is like a private key, and the last of the chain (first released) is like the public key. Useful elaborations are possible, e.g. converting the chain into a branched hierarchy for delegation purposes.

This can't be a new idea. Is it? Does anyone know of existing work on this, either in the journals or in the wild?

This link restates the above with more detail, some diagrams, and a few elaborations: http://ben.mord.io/p/delayed-chained-key-revelation-dckr.html

| improve this question | |
$\endgroup$
  • $\begingroup$ Signatures are used for authentication and non-repudiation. This seems to be targeting the latter. But if you release the private key that is used to generate the signature as public key to verify the signature then anybody can generate that signature. Using a time stamping service seems a better approach (unless I'm missing the goal of this idea, which doesn't seem to be stated in the question). $\endgroup$ – Maarten Bodewes♦ Nov 20 '17 at 21:42
  • $\begingroup$ Hi Maarten, the release schedule is determined in advance precisely to prevent forgery. Only the signer knows a key prior to expiration. To be sure, everyone knows it after expiration - but the protocol considers signatures to signify nothing if first observed after expiration. $\endgroup$ – Benjamin Mord Nov 20 '17 at 23:13
  • $\begingroup$ I see no distinction here between non-repudiation and authentication. A signed session key for example could be used for authentication of a session, if one so desired. $\endgroup$ – Benjamin Mord Nov 20 '17 at 23:20
2
$\begingroup$

That sounds like Tesla, which also uses a chain of MACs (where each key can be computed from values later in the chain), revealing the previous MAC key with each packet. Going through the paper, I don't see how they authenticate the last value; my recollection was that they used a conventional signature scheme.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks, that looks related if not identical to chained concept. I'll read carefully to confirm. (I see no concept of hierarchy however, only chaining.) $\endgroup$ – Benjamin Mord Nov 20 '17 at 23:21
  • $\begingroup$ I discussed with the author of Tesla, and he agrees. Moreover, he informs me it may get use in 2018 to authenticate European navigation satellite signals. Thank you for the pointer! phys.org/news/2017-02-technique-falsification-galileo.html $\endgroup$ – Benjamin Mord Dec 24 '17 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.