Patent Application
20110302421
Quantum computing offers the possibility of almost unlimited computing power potentially sufficient to crack all conventional cryptographic techniques based on a handful of ‘hard’ problems such as the factoring of a number formed as the product of two large primes. There has therefore been increased interest recently in ways of carrying out security tasks, such as encryption and authentication, that do not depend on conventional cryptographic techniques.
As is well known, two entities that possess the same secret random data can provably achieve both unbreakable secure communication using the Vernam cipher, and discrimination between legitimate messages and false or altered ones (using, for example, Wegman-Carter authentication). In both cases, however, data used from the secret random data shared by the entities must not be re-used. The term “one-time pad” is therefore frequently used to refer to the secret random data shared by the entities and this term, or its acronym “OTP”, is used herein for secret random data shared by more than one entity. Although for absolute security the one-time pad data must be truly random, references to one-time pads (OTP) herein includes secret data that may not be truly random but is sufficiently random as to provide an acceptable degree of security for the purposes concerned.
Embodiments of the invention will now be described, by way of non-limiting example, with reference to the accompanying diagrammatic drawings, in which:
In use, the OTP apparatus 10 is intended to communicate with other OTP apparatus having access to the same secret random data as the apparatus 10 in order to conduct an OTP interaction (that is, an interaction requiring use of the same OTP data by each apparatus). Such other OTP apparatus is hereinafter referred to as the “complementary OTP apparatus” with respect to the apparatus 10; this complementary apparatus can be of the same general form as the user OTP apparatus 10 or can be of a different form.
The OTP apparatus 10 comprises the following functional blocks:
Typically, the functional blocks 11 to 16 are implemented using a program-controlled processing arrangement configured to execute program code stored in a program memory, together with appropriate specialized sub-systems. Further details of each block are given below for the exemplary case where a processor-based system (including a main processor 8 and associated memory 9 holding program code) is used to carry out the data processing tasks of the apparatus 10, such tasks including, in particular, the control and coordination tasks of control block 16 and the running of the security applications embodying the OTP consumption block 15.
The user interface 11 typically comprises an LCD display and an input keypad but may also include audio input and/or output means. This interface is optional in the case of apparatus 10 intended for automatic operation.
The data-transfer interface 12 can comprise a non-wired interface such as a Bluetooth (Trademark) wireless interface or an IrDA infrared interface; however, a wired interface can alternatively or additionally be provided such as an USB interface (as used herein, the term “wired” is to be understood broadly to cover not only conductive wiring and optical fibres, but also any type of interface that requires electrical elements to be brought into physical contact). For circumstances where transit delay is not an issue, it is also possible to implement the data-transfer interface 12 as a removable storage medium (for example, a memory card) and related read/write arrangement.
The OTP memory 13 can be part of the general memory associated with the main processor 8 of apparatus 10 or can be formed by a separate memory. In either case, the OTP data is preferably secured against unauthorized access by one or more appropriate technologies. For example, the memory 13 can all be provided in a tamper-resistant hardware package. Alternatively, a protected storage mechanism can be used in which all but the root of a hierarchy (tree) of encrypted data objects is stored in ordinary memory, the root of the hierarchy being a storage root key which is stored in a tamper-resistant hardware package and is needed to decrypt any of the other data objects of the hierarchy. Furthermore, trusted platform techniques can be used to ensure that only authorized software can access the OTP data. It is also possible to use QRAM (Quantum RAM) technologies.
Where the apparatus 10 is designed such that OTP data is consumed immediately following its provisioning, the security requirements of memory 13 can be reduced (unless the apparatus 10 is designed to operate unattended).
With regard to the OTP provisioning block 14, the most secure way to share secret random data is to use a quantum key distribution (QKD) method such as described for example, in U.S. Pat. No. 5,515,438 and U.S. Pat. No. 5,999,285. In known QKD systems, randomly polarized photons are sent from a transmitting apparatus to a receiving apparatus either through a fiber-optic cable or free space. In the
The OTP provisioning block 14 need not be built around a QKD subsystem and a number of alternative embodiments are possible. Thus, in one such alternative embodiment the OTP provisioning block 14 is simply arranged to store to the OTP memory 13, secret random data received via the data-transfer interface 12 from either:
Rather than the secret random data being generated using a QKD subsystem or being received by the provisioning block 14 from an external source, the OTP provisioning block 14 can include a random data generator 17 for generating random data which is both used to provision the memory 13 with OTP data, and passed via the data-transfer interface 12 directly or indirectly (including via a trusted data store) to other OTP apparatus with which the apparatus 10 wishes to conduct OTP interactions. The random data generator is, for example, a quantum-based arrangement in which a half-silvered mirror is used to pass/deflect photons to detectors to correspondingly generate a “0”/“1” with a 50:50 chance; an alternative embodiment can be constructed based around overdriving a resistor or diode to take advantage of the electron noise to trigger a random event. Other techniques can be used for generating random data, particularly where a reduced level of security is acceptable—in such cases, some relaxation can be permitted on the randomness of the data allowing the use of pseudo random binary sequence generators which are well known in the art.
Where the secret random data is being received or being passed on via the data-transfer interface 12, then it must be done in a highly secure manner (for example, by using a wired interface to connect directly with OTP apparatus or a trusted data store). Encrypting the data being passed is general not going to provide an adequate solution because if the Vernam cipher is employed, at least as much OTP data would be consumed as newly provisioned, whereas standard cryptographic techniques are potentially vulnerable and would reduce the level of security obtained by using the OTP data.
The provisioning block 14 can simply append newly-obtained secret random data to the existing OTP data in memory 13 or can combine the new secret random data with the existing OTP data using a merge function, the merged data then replacing the previous contents of the memory 13. Preferably, the merge function is such that an eavesdropper who has somehow managed to obtain knowledge of the new secret random data, cannot derive any part of the merged data without also having knowledge of the pre-existing OTP data in the memory 13. A wide range of possible merge functions exist including functions for encrypting the new secret random data using the existing OTP data for the encrypting key, and random permutation functions (it will be appreciated that whatever merge function is used, it must be possible for the complementary OTP apparatus to select and use the same function on its copy of the new secret random data and its existing OTP data). Merging of the new secret random data and existing OTP data otherwise than by aggregation, can only be done if the apparatus 10 and the complementary OTP apparatus have the same existing OTP data which should therefore be confirmed between the two apparatus before the new secret random data and existing OTP data are subject to merging. In this respect, it will be appreciated that the OTP apparatus 10 and the complementary OTP apparatus may not have the same existing OTP data for a variety of reasons such as a failed communication between the two apparatus resulting in one of them consuming OTP data but not the other. Of course, it will frequently be possible for the OTP apparatus 10 and the complementary OTP apparatus to cooperate such that if either of them still has OTP data already discarded by the other, then that entity also discards the same data (one method of doing this is described later). However, it will not always be possible for the apparatus 10 and the complementary OTP apparatus to cooperate in this way, or even check whether they have the same existing OTP data, at the time that one or other of the device and apparatus is provided with new secret random data—for example, if the OTP apparatus is being replenished with new secret random data by communication with a trusted random data generator, it may well be that the trusted random data generator is not concurrently in communication with the complementary OTP apparatus, the new secret random data only being subsequently shared with the complementary OTP apparatus. In this type of situation, the new secret random data must be appended to the existing OTP data rather than being merged with it.
The OTP consumption block 15 is arranged to carry out tasks (‘applications’) that require the use (‘consumption’) of OTP data from the memory 13; it is to be understood that, unless otherwise stated herein, whenever data is used from the OTP data held in memory 13, that data is discarded. As already indicated, the OTP consumption block 15 is preferably provided by arranging for the main processor of the apparatus 10 to execute OTP application programs; however, the consumption block 15 can additionally/alternatively comprise specialized hardware processing elements particularly where the OTP application to be executed involves complex processing or calls for high throughput.
A typical OTP consumption application is the evidencing that the apparatus 10 (or its owner/user) possesses a particular attribute. Thus, by way of simplified example, if a complementary OTP apparatus knows that it shares OTP data with OTP apparatus 10 having an identity “X”, then the apparatus 10 can identify itself to the complementary OTP apparatus by sending it a data block from the top of its one-time pad; the complementary apparatus then searches for this data block in the OTP pad it possesses and if a match is found, it knows that it is communicating with entity “X”. Since an OTP apparatus may hold multiple one-time pads, one for each other apparatus with which it wants to be able to have OTP interactions, the apparatus 10 preferably sends the other OTP apparatus an identifier of the one-time pad that the apparatus 10 is proposing to use.
As already noted, communication failures and other issues can result in different amounts of OTP data being held by the OTP apparatus 10 and the complementary OTP apparatus; more particularly, the data at the top of the one-time pad held by apparatus 10 can differ from the data at the top of the one-time pad held by the complementary OTP apparatus. This is referred to herein as “misalignment” of the one-time pads. It is therefore convenient for the OTP apparatus and the complementary OTP apparatus to each obtain or maintain a measure indicating how far it has progressed through its OTP data; this measure can also be thought of as a pointer or index to the head of the OTP pad and is therefore referred to below as the “head index”. Preferably, the head index is taken as the remaining size of the OTP data; although other measurements can be used for the head index (such as how much OTP data has been used), measuring the remaining size of the OTP data can be done at any time and so does not require any on-going maintenance. Whatever actual numeric value of the measure used for the head index, in the present specification the convention is used, when discussing head index values, that the nearer the top of the one-time pad is to the bottom of the pad, the “lower” is the value of the head index.
The head index is used to correct for misalignment of the one time pads held by the apparatus 10 and the complementary OTP apparatus as follows. At the start of any OTP interaction, the apparatus 10 and complementary OTP apparatus exchange their head indexes and one of them then discards data from the top of its one-time pad until its head index matches that received from the other—that is, until the one-time pads are back in alignment at the lowest of the exchanged head index values. When OTP data is used by the either apparatus in conducting the OTP transaction, the head index is sent along with the OTP interaction data (e.g. an OTP encrypted message) to enable the recipient to go directly to the correct OTP data in its one-time pad; this step can be omitted since although the one-time pads may have become misaligned by the time a message with OTP interaction data successfully passes in one direction or the other between the two apparatus, this misalignment is likely to be small and a trial-and-error process can be used to find the correct OTP data at the receiving end.
Authentication methods embodying the invention will now be described, these methods being implemented, by way of example, as OTP consumption applications carried out by the consumption blocks 15 of two OTP apparatus 10 of the
a first data block X∥a second data block∥rest of the OTP data where ∥ represents concatenation.
For convenience, the following description is given in terms of operations carried out by entities “Alice” and “Bob” that respectively comprise the OTP apparatus 10A and the OTP apparatus 10B. Furthermore, the authentication carried out is based on the exclusiveness of the possession of the one-time pads and is therefore directly in respect of the OTP apparatus 10A and/or 10B. However, the authentication can be thought of in more general terms as being of the entities Alice and/or Bob; where these entities each also comprise respective parties that have exclusive control of the OTP apparatus 10A, 10B of the same entity, then the authentication is effectively of one or both of these parties. Indeed, the one-time pads may be directly held by such parties (for example, on respective memory cards) and only provided to the OTP apparatus, via the data-transfer interface 12, when required.
The authentication protocols now to be described utilizes multiple hashing functions; these hashing functions need not be cryptographically secure but can be any hashing functions that give a fairly uniform random distribution of output values for the range of inputs it is intended to handle (ideally, 2-universal hashing functions would be used but this is not necessary). The hashing functions are at least notionally organized into families where each family comprises multiple member hashing functions; the convention is used that for an ith such family ƒi, the jth member is represented by ƒi[j]. While the member hashing functions of the same family can be totally unrelated functions, it is preferred that they are all instances of a family-generic parameterized hashing function having one or more parameters the values of which define the individual members. Indeed, the parameterized hashing function may have one or more further parameters which can be used to define a range of different family-generic hashing functions.
An example parameterized hashing function is SHA 256 (the well known Secure Hash Algorithm) which has eight parameters (these constitute the 8 Initial Vector (or IV) words); in this case, the generic hashing function of each family could be SHA 256 with its output truncated to 32 bits, each family being distinguished by a different respective value of a first parameter, and each member of the same family being distinguished by a different respective value of a second parameter.
In the case of a family-generic parameterized hashing function with one or more parameters that determine the specific family member, a random selection of the family member can be effected by using a respective nonce for the or each such parameter. Similarly, in the case of a parameterized hashing function having one or more parameters that are used to determine a specific family, a random selection of the family can be effected by using a respective nonce for the or each such parameter.
Conveniently, in the case of a family-generic parameterized hashing function with a member-selecting parameter Pm that determines the specific family member, for the jth family member the value of this parameter Pm is j. By way of example, consider a family-generic parameterized hashing function, for an ith family, of the form:
ƒi[j]=#(D∥Pm) (1)
where # is a known hash function, D is the subject data to be hashed, Pm is a parameter the value of which determines the family member, and ∥ represents concatenation. Then with Pm equal to j for the jth member of the family:
ƒi[j]=#(D∥j) (2)
Random selection of a member from the family can be effected by generating a nonce Nm and using it for the parameter Pm, that is:
ƒi[Nm]=#(D∥Nm) (3)
Similarly, where different families of hashing function are specified by different values of a family-selecting parameter Pf of a parameterized hashing function, then conveniently, for the ith such family, the parameter Pf has a value i. Extending the foregoing example by adding a further, family-specific, parameter Pf:
ƒi[j]=#(D∥Pf∥Pm) (4)
then with the value of Pf equal to i for the ith family (and Pm equal to j for the jth member):
ƒi[j]=#(D∥i∥j) (5)
Random selection of a family can be effected by generating a nonce Nf and using it for the parameter Pf, that is:
ƒNf[j]=#(D∥Nf∥Pm) (6)
A randomly chosen member of a randomly chosen family would then be:
ƒNf[Nm]=#(D∥Nm∥Nf) (7)
Alice and Bob both have knowledge of a first family of hashing functions ƒ1 arranged to generate a c-bit hash value, and a second family of hashing functions ƒ2 arranged to generate an r-bit hash value. Each member of the first hashing-function family is associated with a respective member of the second hashing-function family—by way of example, this can be expressed in general terms as the jth members of both families being associated. Thus where the first family of hashing functions comprises p members, the second family will also comprise p members.
The
Overall, an eavesdropper can only capture c+r bits at most and n andp are such that:
(n+log2 p)>>(c+r)
whereby there is no realistic prospect of an eavesdropper discovering anything useful. Furthermore, an eavesdropper is even unable to tell from the response whether Bob has found a match in step 22.
Alice and Bob both have knowledge of the following families of hashing functions:
The
Overall, an eavesdropper can only capture (c+r1+r2) bits at most and n, p and q are such that:
(2n+log2 p+log2 q)>>(c+r1+r2)
whereby there is no realistic prospect of an eavesdropper discovering anything useful. Furthermore, an eavesdropper is even unable to tell from the response whether matches have been found in steps 32 and 36. Preferably all challenges and responses are the same size.
By way of example:
n=64;
p,q=256(log2 p,log2 q=8);
c,r1,r2=32.
In one specific example of the
the CHALLENGE-1 is generated by Alice as:
#(X∥NA)
the RESPONSE-1/CHALLENGE-2 is generated by Bob as:
#(Y∥NA∥NB)
the RESPONSE-2 is generated by Alice as:
#(X∥Y∥NB∥NA).
where # is SHA 256 truncated to 32 bits.
With regard to the above-described embodiments, it may be noted that the amount of unknown information introduced by Alice's random choice of the member of the first hashing-function in step 20/30 is, in fact, less than p (number of members) by the number of conflicts found in step 21/31. Similarly, the amount of unknown information introduced by Bob's random choice of second hashing-function family in step 34 is, in fact, less than q (number of second families) by the number of conflicts found in step 35. However, provided log2 p/log2 q is kept sufficiently below the size of the challenge c/response r1 (in other words, c>>log2 p/r1>>log2 q), the number of conflicts will be very low and can be ignored for practical purposes; in any event, a good idea of the number of conflicts likely to occur can be determined through simulation and appropriate adjustment of p and q can be made in the above inequalities.
Many variants are possible to the above described embodiments of the invention. For example, although the conflict checks carried out in step 21, 31 and 35 are preferred, they can be omitted where a slightly reduced degree of certainty in the authentication effected is acceptable.
Furthermore, although embodiments of the invention have been described in relation to OTP apparatus that incorporates, in a self-contained form, OTP storage, provisioning, and consumption, it is to be understood that the apparatus could generally be replaced by a distributed arrangement of its functional blocks. Indeed, any form of OTP apparatus can be used provided it is capable of performing the steps of the authentication-method embodiment to be implemented.
| Number | Date | Country | Kind |
|---|---|---|---|
| 0903104.8 | Feb 2009 | GB | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/GB2010/050076 | 1/20/2010 | WO | 00 | 8/23/2011 |
