1
$\begingroup$

I came across an IC device configuration & security flow and the details are illustrated in image below. I'm wondering must the ECDSA pair with the SHA Hashing function?

Alternatively, what if using the AES-GCM to generate both CIPHER & TAG? The GF generated TAG later go through the ECDSA to be encrypted with the private key.

So from the decryption side, it exactly work the same like the image except replacing the SHA engines with the AES-GCM engine. I'm wondering why this is uncommon in all the industry practice?

Or will anything go wrong with the scheme I describe above?

enter image description here

Improve this question
$\endgroup$
9
  • 1
    $\begingroup$ The picture has a big flaw! ECDSA Encrypt/decrypt! ECDSA is a signature, not encryption. And the signature cannot be verified with the bitsream. $\endgroup$ – kelalaka Nov 17 '20 at 18:20
  • $\begingroup$ @kelalaka, probably ignore the encrypt/decrypt word. On the transmit portion, data go through SHA engine and generate the output (say A) go through ECDSA with private key, and it generate B signature. On the receiver portion, the B signature go through ECDSA with public key, it recover A. So now, simply take this A to compare over to the whatever same data that go through again the SHA engine on the receiver side which it should generate A eventually. $\endgroup$ – Pi-Turn Nov 17 '20 at 18:34
  • 1
    $\begingroup$ BTW: ECDSA doesn't work internally by "decrypting with a public key and comparing against the digest". $\endgroup$ – poncho Nov 17 '20 at 18:44
  • $\begingroup$ ECDSA requirements depend on the curve used since the order of the groups plays the role. It is still problematic ECDSA need the data for verification. $\endgroup$ – kelalaka Nov 17 '20 at 18:45
  • 1
    $\begingroup$ That image is wrong; the best I can hope is that some graphic artist (not knowing better) took the same diagram with RSA, and relabeled it for ECDSA, and somehow it wasn't proofed by someone who knew better. If that came from their technical people, well, that would indicate that they don't have a clue... $\endgroup$ – poncho Nov 17 '20 at 19:27
1
$\begingroup$

I will first address the issues of the diagram;

Encryption part

Although the encryption is mentioned as optional

  1. there is no mention of how the AES key is generated. The common method is the Diffie-Hellman Key Exchange and the Elliptic Curve version of it is preferred ECDH.

  2. there is no mention of the mode of operation. CBC, CTR, GCM,... etc.

  3. There is no mention of the nonce/IV generation. The nonce generation is crucial;

    • In the CBC it must be unpredictable
    • In the CTR and GCM the (IV,key) pair should be never use more than once.

ECDSA part;

  1. The naming is completely wrong. We use signature and verification and those processes are completely different than encryption and decryption, even in the RSA. In short RSA decryption is not signature.

  2. The verification part is wrong. Only the signature part is sent, the signature and message must both exist during the ECDSA verification. They tend to make it symmetric but it is wrong.

Questions

I'm wondering must the ECDSA pair with the SHA Hashing function?

They didn't show which curve is used there. If a curve like P521 or Goldilocks is used the one may need XOFs like SHAKE128-512 series, or use SHA256 as CTR mode to generate more than one block to support all of the curve needs.

Alternatively, what if using the AES-GCM to generate both CIPHER & TAG? The GF generated TAG later go through the ECDSA to be encrypted with the private key.

The AES-GCM doesn't produce a digital signature, they can provide confidentiality, integrity, and authentication only if correctly used. AES-GCM can not provide non-repudiation. For digital signatures, you need a digital signature algorithm.

Or will anything go wrong with the scheme I describe above?

If there is no need for a digital signature, then it can be fine. The AES-GCM has a better alternative; AES-GCM-SIV is a nonce misuse resistant scheme. This can only leak the same message is sent again if the same message is sent again with the same (key,IV) pair is.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Why AES-GCM can not produce non-repudiation signature? So I can't treat the authentication tag produced by the Galois Multiplication as the signature? My naive thinking of after feeding it in to the ECDSA....then it become diginal signature as the output. $\endgroup$ – Pi-Turn Nov 18 '20 at 1:06
  • 1
    $\begingroup$ With AES-GCM (or any other symmetric system) both the encrypting party and the decrypting party have access to the same shared secret key. So either party can generate a message and a MAC (tag) for that message. Thus, either party can claim the other sent the message, and all that can be proven is that one of them created the message. With an asymmetric signature only the party holding the private key could create the signature. That's non-repudiation, so symmetric schemes can't guarantee that. $\endgroup$ – SAI Peregrinus Nov 18 '20 at 2:33
0
$\begingroup$

Or will anything go wrong with the scheme I describe above?

Is the AES key public? If it is, then it is easy to generate two messages that have the same tag (and hence would act like a collision).

If the AES key secret to both the signer and the verifier? If it is, well, why bother with ECDSA at all; if you have a shared secret key, you can use a Message Authentication Code (e.g. HMAC, CMAC, GMAC) which is far more efficient than ECDSA (or any other public key signature operation).

Improve this answer
$\endgroup$
2
  • $\begingroup$ But using ECDSA in this case prevent others to generate the authentic message because the private key is not known. $\endgroup$ – Pi-Turn Nov 17 '20 at 18:53
  • 1
    $\begingroup$ @Pi-Turn: if they can find a second message with the same GCM tag (which, as I mentioned, is easy if the GCM key is public), then that message would be authenticated with the same signature (because it would be converted into the same tag, and the ECDSA operation, seeing the expected tag, would claim success) $\endgroup$ – poncho Nov 17 '20 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.