Public Key Authentication Protocol

Mutual authentication can be done using public key authentication. To start with let us assume A and B want to establish a session and then use secret key cryptography on that session. The purpose of this initial exchange is authenticate each other and agree on a secret shared session key.

Setup

A sends a request to AS for getting B's public key. Similarly B is trying to get the A's public key. AS sends public key of B and name of B in encrypted form using AS's private key.

Handshake

Whether it came from A or from someone else., but he plays along and sends A back a message containing A's n1, his own random number n2 and a proposed session key, Ks. When A gets this message, he decrypts it using his private key. He sees n1 in it, and hence gets sure that B actually got the message. The message must have come from B, since none else can determine n1. A agrees to the session by sending back message. When B sees n2 encrypted with the session key he just generated, he knows A got message and verified n1.

Digital Signatures

The authenticity of many legal, financial and other documents is determined by the presence or absence of an authorized handwritten signature. The problem of devising a replacement for handwritten signatures is a difficult one. Basically, what is needed is a system bu which one party can send a assigned message to other party in such a way that:

1. The receiver can verify the claimed identity of sender
2. The sender cannot later repudiate the contents of the message.
3. The receiver cannot possibly have concocted the message himself

Message Digest

One criticism of signature methods is that they often couple two distinct functions : authentication and secrecy. Often, authentication is needed but secrecy is not. Since cryptography is slow, it is frequently desirable to be able to send signed plaintext documents.One scheme, known as MESSAGE DIGEST, is based on the idea of a one-way hash function that takes an arbitrarily long piece of plaintext and from it computes a fixed length bit string. This hash function has three important properties:

1. Given p, it is easy to compute MD(P).
2. Given MD(P), it is effectively impossible to find P.
3. No one can generate two messages that have the same message digest.

Main Steps in Authentication

• Sender computes checksum of message and sends it to AS.
• AS returns signature block. Signature block consists of name and checksum of message in encrypted form using AS's symmetric key.
• Recipient sends signature block to AS.
• AS decrypt signature.
• verifies sender's name.
• sends checksum back to recipient.
• Recipient verifies checksum.