The Biba One-Time Signature and Broadcast Authentication Protocol

1
The Biba One-Time Signature and Broadcast
Authentication Protocol

• Adrian Perrig
• Univ. of California, Berkeley
• ACM CCS 2001

2
Contents

• Introduction
• Biba signature scheme
• The SEALs
• Signature generation
• Signature verification
• Security of this approach
• Biba broadcast authentication protocol
• Conclusion

3
Introduction

• Challenges to design an efficient broadcast
  authentication protocol
• Efficient generation and verification
• Real-time/instant authentication
• Individual message authentication
• Robustness to packet loss
• Scalability
• Small size of authentication information

4
Biba Signature Scheme

• Bins and Balls Signature
• The SEALs
• Self authentication values
• Randomly generated
• But it can be authenticated with the public key
• Example
• Using the PRF F as a commitment scheme
• Given a SEAL s, the public key is fs Fs(0)

5
Biba Signature Scheme

• Signature generation
• m message to be signed, h H(m)
• G hash function family, Gh hash function
• The signer computes Gh to all the SEALs s1, ,
  st and looks for a 2-way collision of 2 SEALs
• Gh(si) Gh(sj) with si ! sj
• The Pair ltsi, sjgt forms the signature

6
Biba Signature Scheme

• Signature verification
• Receive M and ltsi, sjgt
• Authenticate the SEALs si, sj
• Computes hH(m)
• Checks that si ! sj, and Gh(si) Gh(sj)

7
Biba Signature Scheme

• Security of this approach

8
Biba Broadcast Auth. Protocol
9
Conclusion

• Pros.
• Smaller signature size
• Smaller verification overhead
• Cons.
• Public key is larger
• Signature generation overhead is higher
• It can be used to make a broadcast authentication
  protocol