Question

Write a network program where a client will prove to the server that it knows a secret key without revealing the secret key. Implement the Zero Knowledge Proof technique that we have discussed in the class to achieve this. The secret could be a large number or hash code of a password. Hint: Use Big Integer API in Java for handling Big Integer.

Answer 1

The next most clever thing Bob can do is to hash the passwords before storing them. The simplest approach is for Bob to record SHA256(PASSWORD) instead of the raw PASSWORD. Now Ida can't get the password directly. But she can run through a dictionary of likely passwords, hash each one, and compare it, and if she gets a match, now she knows the password too. Because every password is hashed the same way, she can do this in parallel for every entry in the table. Worst of all, she can do this ahead of time, once, and spend hardly any time at all doing the lookup (for certain situations, there is an efficient time/space tradeoff called a "Rainbow Table" that fits onto a DVD-ROM and can deduce the password in a few seconds).

The work it takes to guess a password is the number of passwords that need to be guessed (on average, you'll have to search half the dictionary before you find the word), multiplied by the time it takes to check each guess. Thanks to Bitcoin, modern parallelized GPUs can perform a nearly a billion SHA256 hashes per second, so we'll define Tsearch as 1ns.

Code:

Setup: Bob stores verifiers[ALICE] = sha256(PASSWORD) Alice: send PASSWORD to Bob Bob: grant access if sha256(PASSWORD) == verifiers[ALICE]

Work Needed To Recover Password:

Bob: 0 Eve: 0 Ida: Tsearch(=1ns) * len(dictionary) / num_users

or less with precomputation

Salted Hashed Passwords

To prevent parallel attacks, Bob can hash each password slightly differently, by using a "salt". Anyone who knows the stored hash can still do a dictionary attack, but they have to do a different search for each one.

Code:

Setup: Bob picks 256-bit random SALT, stores in salts[ALICE]

Bob stores verifiers[ALICE]=HMAC_sha256(SALT, PASSWORD)

Alice: send PASSWORD to Bob Bob: look up SALT=salts[ALICE]

grant access if HMAC_sha256(SALT, PASSWORD) == verifiers[ALICE]

Work Needed To Recover Password:

Bob: 0 Eve: 0 Ida: Tsearch * len(dictionary)