Diffie-Hellman Proof-of-Possession Algorithms
obsoleted by
- rfc-6955 — Diffie-Hellman Proof-of-Possession Algorithms
Extracted elements (21)
Diffie-Hellman is a key agreement algorithm and cannot be used directly for signing or encryption. PKCS #10 certification requests require an integrity check value, so two POP algorithms are defined that use the DH key agreement process to produce a shared secret as the basis of an HMAC or discrete-log signature.
LeadingInfo (Subject DN) and TrailingInfo (Issuer DN) from the recipient's certificate are included in the key derivation for the Static DH POP to bind the integrity value to a specific certificate, preventing cross-certificate replay of the POP value.
Using a single set of DH parameters across a PKI allows all keys in the group to be attacked together. The Discrete Logarithm Signature method was introduced so that proof-of-possession does not require common group parameters, eliminating this group-wide attack surface.
The Discrete Logarithm POP is based on DSA but removes FIPS-186's 1024-bit restriction on p and the 160-bit fixed requirement on q. Implementations generating keys for this algorithm should use the DH-X9.42 (RFC 2631) key generation procedure to ensure the q parameter is present and correct.
During signature verification, r and s must each be in the range [1, q-1]. Values outside this range indicate an invalid or forged signature.
q must be at least 160 bits in length. The FIPS-186 restriction that p must be exactly 1024 bits is removed, but the 160-bit lower bound on q (matching DH-X9.42) is retained.
Signature verification MUST perform strong primality tests on both p and q, and MUST verify that q divides p-1. If any check fails the signature is invalid. This is required because the verifier cannot assume parameter validity in the DH POP context.
The Discrete Logarithm POP requires the existence of a q parameter (a large prime such that q divides p-1). If keys are generated per DH-X9.42, this requirement is automatically satisfied. The q parameter enables checking for small-subgroup attacks.
A 'DH certificate' is defined as a certificate whose SubjectPublicKey is a DH public value, signed with any signature algorithm (e.g., RSA or DSA). This is the certificate from which the recipient's DH public key and group parameters are obtained.
Signature verification computes v = ((g^u1 * y^u2) mod p) mod q, where u1 = m*w mod q, u2 = r*w mod q, and w = s^-1 mod q. The signature is valid if and only if v == r.
The Discrete Logarithm signature produces a pair (r, s): r = (g^k mod p) mod q; s = (k^-1 * (m + x*r)) mod q, where k is a fresh random integer and m is the (possibly expanded) message digest. Both r and s must be non-zero; otherwise k is regenerated.
The OID id-alg-dh-pop is assigned as {id-pkix id-alg(6) 4}, identifying the Discrete Logarithm DH proof-of-possession algorithm.
The OID id-dh-sig-hmac-sha1 (id-dhPop-static-HMAC-SHA1) is assigned as {id-pkix id-alg(6) 3}, identifying the static DH HMAC-SHA1 proof-of-possession algorithm.
The POP integrity value is computed as HMAC-SHA1 over the DER-encoded certificationRequestInfo field using the derived key K. The output is encoded as a BIT STRING and placed in the signature field of the certification request.
The Static DH POP process derives a shared secret ZZ = g^xy mod p using the entity's ephemeral private key y and the recipient's public key Rpub, then derives a temporary key K = SHA1(LeadingInfo | ZZ | TrailingInfo) where LeadingInfo is the Subject DN and TrailingInfo is the Issuer DN from the recipient's certificate.
When |q| > 160 bits, the message digest is expanded by iteratively appending SHA-1(current_value) to itself until the accumulated value has at least L bits, then taking the leftmost L-1 bits (where L = floor(log2(q))+1). This ensures the hash value m satisfies 0 <= m < q.
All security relies on the secrecy of private keying material. Disclosure of either party's private key compromises all messages sent or received with that key; loss of the private key makes messages using that key unreadable.
Parameter selection is critical. Implementations must choose parameters appropriate for the intended community and must avoid small-subgroup parameters. FIPS-186 Appendices 2 and 3 contain guidance; adding a q parameter (as required by this document for the DL algorithm) is accepted best practice for detecting small-subgroup attacks.
The Static DH POP algorithm provides integrity but not origination: because the shared secret can be computed by either party (entity or recipient), a rogue recipient could fabricate a valid POP value. The Discrete Logarithm algorithm provides both integrity and origination assurance.
DhSigStatic (also spelled DhPopStatic in normative text) is a SEQUENCE containing an OPTIONAL IssuerAndSerialNumber (identifying the certificate from which the recipient public key was taken) and a mandatory hashValue (MessageDigest) holding the HMAC-SHA1 output. It is encoded as a BIT STRING in the signature field.
The Discrete Logarithm POP signature is identified by OID id-alg-dh-pop {id-pkix id-alg(6) 4} and encoded using Dss-Sig-Value (the (r, s) pair). Parameters are encoded as DomainParameters and may be omitted in the signature if present in the associated key request.