Attacks on Secure Logging Schemes

Abstract

We present four attacks on three cryptographic schemes intended for securing log files against illicit retroactive modification. Our first two attacks regard the LogFAS scheme by Yavuz et al. (Financial Cryptography 2012), whereas our third and fourth attacks break the BM- and AR-FssAgg schemes by Ma (AsiaCCS 2008).

All schemes have an accompanying security proof, seemingly contradicting the existence of attacks. We point out flaws in these proofs, resolving the contradiction.

G. Hartung—The research project leading to this report was funded by the German Federal Ministry of Education and Research under grant no. 01$\vert$S15035A. The author bears the sole responsibility for the content of this report.

A The Schnorr Signature Scheme

The Schnorr Signature Scheme [18, 19] is based on the hardness of the discrete logarithm problem in some group G. It uses a prime-order subgroup G of $\mathbb {Z}_{p}^*$, where p is large a prime, G’s order q is also a large prime, and q divides $p-1$. Let $\alpha$ be a generator of G. A secret key for Schnorr’s scheme is $y \leftarrow \mathbb {Z}_{q}^*$, the corresponding public key is $Y :=\alpha ^y \pmod {p}$.

In order to sign a message $m$, choose $r \leftarrow \mathbb {Z}_{q}^*$, set $R :=\alpha ^r \pmod {p}$, compute the hash value $e :=H(m\mathop {\Vert }R)$ and set $s :=r - ey \pmod {q}$. The signature is the tuple (R, s). To verify such a signature, recompute the hash value $e :=H(m\mathop {\Vert }R)$ (where R is taken from the signature and $m$ is given as input to the verification algorithm). Then check if $R = Y^e \alpha ^s \pmod {p}$ and return $1$ if and only if this holds.

The Schnorr signature scheme can be shown to be secure based on the hardness of the discrete logarithm problem in G, if $H$ is modelled as a random oracle [4].