Practical Cryptanalysis of iso/iec 9796-2 and emv Signatures
نویسندگان
چکیده
In 1999, Coron, Naccache and Stern discovered an existential signature forgery for two popular rsa signature standards, iso/iec 97961 and 2. Following this attack iso/iec 9796-1 was withdrawn. iso/iec 9796-2 was amended by increasing the message digest to at least 160 bits. Attacking this amended version required at least 2 operations. In this paper, we exhibit algorithmic refinements allowing to attack the amended (currently valid) version of iso/iec 9796-2 for all modulus sizes. A practical forgery was computed in only two days using 19 servers on the Amazon ec2 grid for a total cost of ≃ us$800. The forgery was implemented for e = 2 but attacking odd exponents will not take longer. The forgery was computed for the rsa-2048 challenge modulus, whose factorization is still unknown. The new attack blends several theoretical tools. These do not change the asymptotic complexity of Coron et al.’s technique but significantly accelerate it for parameter values previously considered beyond reach. While less efficient (us$45,000), the acceleration also extends to emv signatures. emv is an iso/iec 9796-2-compliant format with extra redundancy. Luckily, this attack does not threaten any of the 730 million emv payment cards in circulation for operational reasons. Costs are per modulus: after a first forgery for a given modulus, obtaining more forgeries is virtually immediate.
منابع مشابه
Index Calculation Attacks on RSA Signature and Encryption
At Crypto ’85, Desmedt and Odlyzko described a chosen-ciphertext attack against plain RSA encryption. The technique can also be applied to RSA signatures and enables an existential forgery under a chosen-message attack. The potential of this attack remained untapped until a twitch in the technique made it effective against two very popular RSA signature standards, namely iso/iec 9796-1 and iso/...
متن کاملDetailed Cost Estimation of CNTW Forgery Attack against EMV Signature Scheme
EMV signature is one of specifications for authenticating credit and debit card data, which is based on ISO/IEC 9796-2 signature scheme. At CRYPTO 2009, Coron, Naccache, Tibouchi, and Weinmann proposed a new forgery attack against the signature ISO/IEC 9796-2 (CNTW attack) [2]. They also briefly discussed the possibility when the attack is applied to the EMV signatures. They showed that the for...
متن کاملA Chosen Messages Attack on the ISO/IEC 9796-1 Signature Scheme
We introduce an attack against the ISO/IEC 9796–1 digital signature scheme using redundancy, taking advantage of the multiplicative property of the RSA and Rabin cryptosystems. The forged signature of 1 message is obtained from the signature of 3 others for any public exponent v. For even v, the modulus is factored from the signature of 4 messages, or just 2 for v = 2. The attacker must select ...
متن کاملCryptanalysis of Countermeasures Proposed for Repairing ISO 9796-1
ISO 9796-1, published in 1991, was the first standard specifying a digital signature scheme with message recovery. In [4], Coron, Naccache and Stern described an attack on a slight modification of ISO 97961. Then, Coppersmith, Halevi and Jutla turned it into an attack against the standard in full [2]. They also proposed five countermeasures for repairing it. In this paper, we show that all thes...
متن کاملFault Attacks on Randomized RSA Signatures
Fault attacks exploit hardware malfunctions or induce them to recover secret keys embedded in a secure device such as a smart card. In the late 90’s, Boneh, DeMillo and Lipton [6] and other authors introduced fault-based attacks on crt-rsa which allow the attacker to factor the signer’s modulus when the message padding function is deterministic. Since then, extending fault attacks to randomized...
متن کامل