Security Articles from Wikipedia

Digital signature 43
Definition
A digital signature scheme typically
consists of three algorithms:
• A key generation algorithm that
selects a private key uniformly at
random from a set of possible
private keys. The algorithm outputs
the private key and a corresponding
public key.
• A signing algorithm that, given a
message and a private key, produces
a signature.
• A signature verifying algorithm
that, given a message, public key
and a signature, either accepts or
rejects the message's claim to
authenticity.
Diagram showing how a simple digital signature is applied and then verified
Two main properties are required. First, a signature generated from a fixed message and fixed private key should
verify the authenticity of that message by using the corresponding public key. Secondly, it should be
computationally infeasible to generate a valid signature for a party who does not possess the private key.
History
In 1976, Whitfield Diffie and Martin Hellman first described the notion of a digital signature scheme, although they
only conjectured that such schemes existed. [6][7] Soon afterwards, Ronald Rivest, Adi Shamir, and Len Adleman
invented the RSA algorithm, which could be used to produce primitive digital signatures [8] (although only as a
proof-of-concept—"plain" RSA signatures are not secure [9] ). The first widely marketed software package to offer
digital signature was Lotus Notes 1.0, released in 1989, which used the RSA algorithm.
To create RSA signature keys, generate an RSA key pair containing a modulus N that is the product of two large
primes, along with integers e and d such that e d ≡ 1 (mod φ(N)), where φ is the Euler phi-function. The signer's
public key consists of N and e, and the signer's secret key contains d.
To sign a message m, the signer computes σ ≡ m d (mod N). To verify, the receiver checks that σ e ≡ m (mod N).
As noted earlier, this basic scheme is not very secure. To prevent attacks, one can first apply a cryptographic hash
function to the message m and then apply the RSA algorithm described above to the result. This approach can be
proven secure in the so-called random oracle model.
Other digital signature schemes were soon developed after RSA, the earliest being Lamport signatures, [10] Merkle
signatures (also known as "Merkle trees" or simply "Hash trees"), [11] and Rabin signatures. [12]
In 1988, Shafi Goldwasser, Silvio Micali, and Ronald Rivest became the first to rigorously define the security
requirements of digital signature schemes. [13] They described a hierarchy of attack models for signature schemes,
and also present the GMR signature scheme, the first that can be proven to prevent even an existential forgery
against a chosen message attack. [13]
Most early signature schemes were of a similar type: they involve the use of a trapdoor permutation, such as the RSA
function, or in the case of the Rabin signature scheme, computing square modulo composite n. A trapdoor
permutation family is a family of permutations, specified by a parameter, that is easy to compute in the forward
direction, but is difficult to compute in the reverse direction without already knowing the private key. However, for