Subliminal Channels in Discrete Logarithm Based Signature Schemes and How to Avoid Them Subliminal Channels in Discrete Logarithm Based Signature Schemes and How to Avoid Them

Limited distribution notes: This report has been issued as a Research Report for early dissemination of its contents. In view of the transfer of copyright to the outside publisher its distribution outside the University of Technology Chemnitz-Zwickau prior to publication should be limited to peer communications and speciic requests. After outside publication, requests should be lled only by reprints or legally obtained copies of the article. Abstract A great disadvantage of the ElGamal and the DSA signature scheme is the existence of various subliminal channels as shown previously by Simmons. We demonstrate that these channels also exist in the Meta-ElGamal and Meta-Message recovery schemes, suggest further narrowband subliminal channels and give a solution how to avoid these subliminal channels assuming that the special receiver can't eavesdrop the channel used by the signer and the warden to generate the signature. Without this assumption we show how to avoid broadband subliminal channels in a reenement of the scheme presented before.