Subversion-Resilient Signature Schemes

We provide a formal treatment of security of digital signatures against subversion attacks (SAs). Our model of subversion generalizes previous work in several directions, and is inspired by the proliferation of software attacks (e.g., malware and buffer overflow attacks), and by the recent revelations of Edward Snowden about intelligence agencies trying to surreptitiously sabotage cryptographic algorithms. The main security requirement we put forward demands that a signature scheme should remain unforgeable even in the presence of an attacker applying SAs (within a certain class of allowed attacks) in a fully-adaptive and continuous fashion. Previous notions—e.g., the notion of security against algorithmsubstitution attacks introduced by Bellare et al. (CRYPTO ’14) for symmetric encryption— were non-adaptive and non-continuous. In this vein, we show both positive and negative results for the goal of constructing subversion-resilient signature schemes. • Negative results. As ...

• Type: Journal
• Year: 2015
• Where: CCS
• Authors: Giuseppe Ateniese, Bernardo Magri, Daniele Venturi
• Keywords: CCS 2015, Security Privacy