Practical Round-Optimal Blind Signatures in the Standard Model
|
|
|
- Beatrix Roberts
- 6 years ago
- Views:
Transcription
1 W I S S E N T E C H N I K L E I D E N S C H A F T IAIK Practical Round-Optimal Blind Signatures in the Standard Model Georg Fuchsbauer, Christian Hanser and Daniel Slamanig, Institute of Science and Technology Austria IAIK, Graz University of Technology, Austria IAIK
2 Blind Signatures Important building block: e-voting, e-cash, ABCs,... 2
3 Motivation Round-optimal blind signatures in the standard model notoriously hard to construct Only 2 out of 50+ constructions in SM (in 30+ years of research) [GRS+11,GG14] Difficulty: malicious key model Underlined by impossibility result [FS10] 3
4 Motivation Round-optimal blind signatures in the standard model notoriously hard to construct Only 2 out of 50+ constructions in SM (in 30+ years of research) [GRS+11,GG14] Difficulty: malicious key model Underlined by impossibility result [FS10] Round-optimality desirable Efficiency Concurrent security 3
5 Contribution 1. New way to build Round-optimal blind sigs from structure-preserving sigs on equivalence classes (SPS-EQ) 1 st practically efficient standard-model construction + extension to partially blind signatures 1 st one-show ABC in the standard model Caveat: blindness under interactive DDH variant 4
6 Contribution (ctd) 2. New results on SPS-EQ: 1 st standard-model construction SPS-EQ implies SPS Optimality criteria from SPS carry over 5
7 Preliminaries Asymmetric bilinear map e : G 1 G 2 G T e(ap, b ˆP) ab = e(p, ˆP) (Bilinearity) e(p, ˆP) 1 GT e(, ) efficiently computable (Non-degeneracy) (Efficiency) 6
8 Preliminaries Asymmetric bilinear map e : G 1 G 2 G T e(ap, b ˆP) ab = e(p, ˆP) (Bilinearity) e(p, ˆP) 1 GT e(, ) efficiently computable (Non-degeneracy) (Efficiency) Structure-Preserving Signatures [AFG+10] signing group element vectors sigs and PKs consist only of group elements verification solely via pairing-product equations + group membership tests 6
9 Signing Equivalence Classes [HS14] As with projective space, we can partition G l into projective equivalence classes: M G l R N G l k Z p : N = k M Functionality: σ on M allows deriving σ on M [M] R 7
10 Signing Equivalence Classes [HS14] As with projective space, we can partition G l into projective equivalence classes: M G l R N G l k Z p : N = k M Functionality: σ on M allows deriving σ on M [M] R IND of classes iff DDH holds on G 7
11 Signing Equivalence Classes (ctd) [HS14] SPS-EQ: As SPS: BGGen R, KeyGen R, Sign R, Verify R but msgs = representatives 8
12 Signing Equivalence Classes (ctd) [HS14] SPS-EQ: As SPS: BGGen R, KeyGen R, Sign R, Verify R but msgs = representatives Plus: ChgRep R (M, σ, µ, pk): Given σ for M, return σ for µm 8
13 Signing Equivalence Classes (ctd) [HS14] Security Properties: Correctness EUF-CMA security Class-hiding 9
14 Signing Equivalence Classes (ctd) [HS14] Security Properties: Correctness EUF-CMA security Class-hiding EUF-CMA defined w.r.t. equivalence classes: Pr [ BG BGGenR(1 κ ), (sk, pk) KeyGen R (BG, l), (M, σ ) A O(sk, ) (pk) : [M ] R [M] R queried M Verify R (M, σ, pk) = 1 ] ɛ(κ), 9
15 Signature Distribution Perfect adaption of sigs: ChgRep R (M, σ, µ, pk) Sign R (µm, sk) 10
16 Signature Distribution Perfect adaption of sigs: ChgRep R (M, σ, µ, pk) Sign R (µm, sk) Perfect adaption of sigs (malicious keys): σ ChgRep R (M, σ, µ, pk) uniform in space of sigs on µm 10
17 Blind Signatures from SPS-EQ Outline: Black-box from any EUF-CMA-secure, perfectly adapting SPS-EQ Blind under plausible interactive DDH variant (Honest-key-blind under DDH) 11
18 Blind Signatures from SPS-EQ (ctd) Idea: Commit to m w/ Pedersen com. C = mp + rq 12
19 Blind Signatures from SPS-EQ (ctd) Idea: Commit to m w/ Pedersen com. C = mp + rq Obtain sig π on M R [(C, P)] R 12
20 Blind Signatures from SPS-EQ (ctd) Idea: Commit to m w/ Pedersen com. C = mp + rq Obtain sig π on M R [(C, P)] R Derive σ on (C, P) 12
21 Blind Signatures from SPS-EQ (ctd) Idea: Commit to m w/ Pedersen com. C = mp + rq Obtain sig π on M R [(C, P)] R Derive σ on (C, P) Output σ + opening of C 12
22 Blind Signatures from SPS-EQ (ctd) 13
23 Blind Signatures from SPS-EQ (ctd) 13
24 Blind Signatures from SPS-EQ (ctd) 13
25 Blind Signatures from SPS-EQ (ctd) 13
26 Blind Signatures from SPS-EQ (ctd) 13
27 Blind Signatures from SPS-EQ (ctd) 13
28 Blind Signatures from SPS-EQ (ctd) 13
29 Blind Signatures from SPS-EQ (ctd) 13
30 Blind Signatures from SPS-EQ (ctd) Security: Unforgeable under EUF-CMA security of SPS-EQ + Diffie-Hellman-Inversion assumption 14
31 Blind Signatures from SPS-EQ (ctd) Security: Unforgeable under EUF-CMA security of SPS-EQ + Diffie-Hellman-Inversion assumption Blind under interactive DDH variant (malicious keys) in the standard model 14
32 Warmup: Proving Blindness (honest keys) 15
33 Warmup: Proving Blindness (honest keys) 15
34 Warmup: Proving Blindness (honest keys) 15
35 Warmup: Proving Blindness (honest keys) 15
36 Warmup: Proving Blindness (honest keys) 15
37 Warmup: Proving Blindness (honest keys; ctd) Game 0: Original game: U(m b, pk) sends (s m b P + rsq, sp) U(m 1 b, pk) sends (s m 1 b P + r s Q, sp) 16
38 Warmup: Proving Blindness (honest keys; ctd) Game 0: Original game: U(m b, pk) sends (s m b P + rsq, sp) U(m 1 b, pk) sends (s m 1 b P + r s Q, sp) Game 1: U(m b, pk) sends (s m b P + tq, sp) 16
39 Warmup: Proving Blindness (honest keys; ctd) Game 0: Original game: U(m b, pk) sends (s m b P + rsq, sp) U(m 1 b, pk) sends (s m 1 b P + r s Q, sp) Game 1: U(m b, pk) sends (s m b P + tq, sp) Game 2: U(m 1 b, pk) analogously 16
40 Warmup: Proving Blindness (honest keys; ctd) Game 0: Original game: U(m b, pk) sends (s m b P + rsq, sp) U(m 1 b, pk) sends (s m 1 b P + r s Q, sp) Game 1: U(m b, pk) sends (s m b P + tq, sp) Game 2: U(m 1 b, pk) analogously m b, m 1 b perfectly hidden in Game 2 16
41 Warmup: Proving Blindness (honest keys; ctd) DDH Game 0 c Game 1 c Game 2 17
42 Warmup: Proving Blindness (honest keys; ctd) DDH Game 0 c Game 1 c Game 2 Simulating U(m b, pk): Embed DDH instance (P, sp, rp, tp) q in sk send (m b sp + q tp, sp) 17
43 Warmup: Proving Blindness (honest keys; ctd) DDH Game 0 c Game 1 c Game 2 Simulating U(m b, pk): Embed DDH instance (P, sp, rp, tp) q in sk send (m b sp + q tp, sp) How to unblind w/o s? sk recompute σ b on (m b P + q rp, P) 17
44 Warmup: Proving Blindness (honest keys; ctd) DDH Game 0 c Game 1 c Game 2 Simulating U(m b, pk): Embed DDH instance (P, sp, rp, tp) q in sk send (m b sp + q tp, sp) How to unblind w/o s? sk recompute σ b on (m b P + q rp, P) Distribution of σ b? 17
45 Warmup: Proving Blindness (honest keys; ctd) DDH Game 0 c Game 1 c Game 2 Simulating U(m b, pk): Embed DDH instance (P, sp, rp, tp) q in sk send (m b sp + q tp, sp) How to unblind w/o s? sk recompute σ b on (m b P + q rp, P) Distribution of σ b? Perfect adaption! 17
46 Warmup: Proving Blindness (honest keys; ctd) DDH Game 0 c Game 1 c Game 2 Simulating U(m b, pk): Embed DDH instance (P, sp, rp, tp) q in sk send (m b sp + q tp, sp) How to unblind w/o s? sk recompute σ b on (m b P + q rp, P) Distribution of σ b? Perfect adaption! t = rs Game 0; t random Game 1 17
47 Proving Blindness Blindness under malicious keys: pk determined by A No access to sk 18
48 Proving Blindness Blindness under malicious keys: pk determined by A No access to sk Rest stays the same 18
49 Proving Blindness (ctd) No access to sk: Perfect adaption under malicious keys! 19
50 Proving Blindness (ctd) No access to sk: Perfect adaption under malicious keys! (Q, ˆQ) determined by A Can t embed DDH 19
51 Proving Blindness (ctd) No access to sk: Perfect adaption under malicious keys! (Q, ˆQ) determined by A Can t embed DDH Interactive DDH variant: relative to (Q, ˆQ) 19
52 Proving Blindness (ctd) No access to sk: Perfect adaption under malicious keys! (Q, ˆQ) determined by A Can t embed DDH Interactive DDH variant: relative to (Q, ˆQ) Still can t recompute σ! 19
53 Proving Blindness (ctd) No access to sk: Perfect adaption under malicious keys! (Q, ˆQ) determined by A Can t embed DDH Interactive DDH variant: relative to (Q, ˆQ) Still can t recompute σ! Use A as signing oracle by rewinding! 19
54 Proving Blindness (ctd) Interactive DDH variant: Given (Q, ˆQ) output by A: e(q, ˆP) = e(p, ˆQ) 20
55 Proving Blindness (ctd) Interactive DDH variant: Given (Q, ˆQ) output by A: e(q, ˆP) = e(p, ˆQ) t in (rp, rq, sp, tq) random, or t = rs? Hard in generic-group model 20
56 Proving Blindness (ctd) Simulating U(m b, pk) (1 st run): 21
57 Proving Blindness (ctd) Simulating U(m b, pk) (2 nd run): 22
58 Efficiency Instantiated w/ SPS-EQ from [FHS14]: U, S: few scalar mult. Verify: 7 pairings 1 scalar mult. 23
59 Partially Blind Signatures and One-show ABCs Partially Blind Signatures: Obtain sig on [(mp, γp, P)] for common info γ Z p 24
60 Partially Blind Signatures and One-show ABCs Partially Blind Signatures: Obtain sig on [(mp, γp, P)] for common info γ Z p One-show ABCs in vein of Brands: Use generalized Pedersen commitments comitting to msg vectors PoKs over attributes during issuing + showing 24
61 New Insights on SPS-EQ SPS-EQ implies SPS: Sign (M, P) to sign M, Only 1 valid representative per class standard EUF-CMA 25
62 New Insights on SPS-EQ SPS-EQ implies SPS: Sign (M, P) to sign M, Only 1 valid representative per class standard EUF-CMA Optimality from [AGHO11] apply to SPS-EQ: 3 bilateral sig elements 2 PPEs for verification 25
63 New Insights on SPS-EQ SPS-EQ implies SPS: Sign (M, P) to sign M, Only 1 valid representative per class standard EUF-CMA Optimality from [AGHO11] apply to SPS-EQ: 3 bilateral sig elements 2 PPEs for verification [AGO11] no reduction from optimally-short SPS-EQ to non-interactive assumptions 25
64 Standard-Model SPS-EQ Construction Using trick of Abe et al. [AGHO11] add 2 random elements to msg no perfect adaption; only class-hiding EUF-CMA proof more involved than [AGHO11] 26
65 Conclusions Practically efficient round-optimal (partially) blind signatures in the standard model One-show ABC in the standard model 27
66 Conclusions Practically efficient round-optimal (partially) blind signatures in the standard model One-show ABC in the standard model New results on SPS-EQ Standard-model construction New properties SPS from SPS-EQ (and implications) 27
67 Thank you for your attention! Supported by: 28
68 References AFG+10 M. Abe, G. Fuchsbauer, J. Groth, K. Haralambiev, M. Ohkubo Structure-Preserving Signatures and Commitments to Group Elements. CRYPTO 2010 AGHO11 M. Abe, J. Groth, K. Haralambiev, M. Ohkubo Optimal Structure-Preserving Signatures in Asymmetric Bilinear Groups. CRYPTO 2011 AGO11 M. Abe, J. Groth, M. Ohkubo Separating Short Structure-Preserving Signatures from Non-interactive Assumptions. ASIACRYPT 2011 FHS14 G. Fuchsbauer, C. Hanser and D. Slamanig. EUF-CMA-Secure Structure-Preserving Signatures on Equivalence Classes. Cryptology eprint Archive
69 References (ctd) FS10 M. Fischlin and D. Schröder. On the Impossibility of Three-Move Blind Signature Schemes. EUROCRYPT 2010 GG14 S. Garg and D. Gupta. Efficient Round Optimal Blind Signatures. EUROCRYPT 2014 GRS+11 S. Garg, V. Rao, A. Sahai, D. Schröder and D. Unruh. Round Optimal Blind Signatures. CRYPTO 2011 HS14 C. Hanser and D. Slamanig. Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials. ASIACRYPT
EUF-CMA-Secure Structure-Preserving Signatures on Equivalence Classes
EUF-CMA-Secure Structure-Preserving Signatures on Equivalence Classes Georg Fuchsbauer Christian Hanser 2 Daniel Slamanig 2 IST Austria georg.fuchsbauer@ist.ac.at 2 Institute for Applied Information Processing
Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials
Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials Christian Hanser and Daniel Slamanig Institute for Applied Information Processing and Communications
Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials
Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials Christian Hanser and Daniel Slamanig Institute for Applied Information Processing and Communications
Essam Ghadafi CT-RSA 2016
SHORT STRUCTURE-PRESERVING SIGNATURES Essam Ghadafi e.ghadafi@ucl.ac.uk Department of Computer Science, University College London CT-RSA 2016 SHORT STRUCTURE-PRESERVING SIGNATURES OUTLINE 1 BACKGROUND
Signatures with Flexible Public Key: A Unified Approach to Privacy-Preserving Signatures (Full Version)
Signatures with Flexible Public Key: A Unified Approach to Privacy-Preserving Signatures (Full Version) Michael Backes 1,3, Lucjan Hanzlik 2,3, Kamil Kluczniak 4, and Jonas Schneider 2,3 1 CISPA Helmholtz
Revisiting Cryptographic Accumulators, Additional Properties and Relations to other Primitives
S C I E N C E P A S S I O N T E C H N O L O G Y Revisiting Cryptographic Accumulators, Additional Properties and Relations to other Primitives David Derler, Christian Hanser, and Daniel Slamanig, IAIK,
Round Optimal Blind Signatures
Round Optimal Blind Signatures Sanjam Garg 1, Vanishree Rao 1, Amit Sahai 1, Dominique Schröder 2, and Dominique Unruh 3 1 University of California, Los Angeles, USA 2 University of Maryland, USA 3 University
CRYPTOGRAPHIC PROTOCOLS 2016, LECTURE 16
CRYPTOGRAPHIC PROTOCOLS 2016, LECTURE 16 Groth-Sahai proofs helger lipmaa, university of tartu UP TO NOW Introduction to the field Secure computation protocols Interactive zero knowledge from Σ-protocols
Efficient Two-Move Blind Signatures in the Common Reference String Model
Efficient Two-Move Blind Signatures in the Common Reference String Model E. Ghadafi and N.P. Smart Dept. Computer Science, University of Bristol, Merchant Venturers Building, Woodland Road, Bristol, BS8
Short Structure-Preserving Signatures
This is the full version of the extended abstract which appears in Proceedings of the Cryptographers Track at the RSA Conference (CT-RSA 2016). Short Structure-Preserving Signatures Essam Ghadafi University
Sub-linear Blind Ring Signatures without Random Oracles
Sub-linear Blind Ring Signatures without Random Oracles Essam Ghadafi Dept. Computer Science, University of Bristol, Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB. United Kingdom. ghadafi@cs.bris.ac.uk
Commuting Signatures and Verifiable Encryption
Commuting Signatures and Verifiable Encryption Georg Fuchsbauer Dept. Computer Science, University of Bristol, UK georg@cs.bris.ac.uk Abstract. Verifiable encryption allows one to encrypt a signature while
Short Signatures Without Random Oracles
Short Signatures Without Random Oracles Dan Boneh and Xavier Boyen (presented by Aleksandr Yampolskiy) Outline Motivation Preliminaries Secure short signature Extensions Conclusion Why signatures without
A New Approach To Efficient Revocable Attribute-Based Anonymous Credentials
A New Approach To Efficient Revocable Attribute-Based Anonymous Credentials David Derler, Christian Hanser, and Daniel Slamanig IAIK, Graz University of Technology, Austria {david.derler christian.hanser
Systèmes de preuve Groth-Sahai et applications
Systèmes de preuve Groth-Sahai et applications Damien Vergnaud École normale supérieure C.N.R.S. I.N.R.I.A. 22 octobre 2010 Séminaire CCA D. Vergnaud (ENS) Groth-Sahai proof system and applications Oct.
Round Optimal Blind Signatures
Round Optimal Blind Signatures Dominique Schröder University of Maryland Dominique Unruh Saarland University May 25, 2011 Abstract. All known round optimal (i.e., two-move) blind signature schemes either
Improved Structure Preserving Signatures under Standard Bilinear Assumptions
Improved Structure Preserving Signatures under Standard Bilinear Assumptions Charanjit S. Jutla 1 and Arnab Roy 2 1 IBM T. J. Watson Research Center, Yorktown Heights, NY, USA csjutla@us.ibm.com 2 Fujitsu
Policy-based Signature
Reporter:Ximeng Liu Supervisor: Rongxing Lu School of EEE, NTU November 2, 2013 1 2 3 1. Bellare M, Fuchsbauer G. s[r]. Cryptology eprint Archive, Report 2013/413, 2013. 2. [GS08] Jens Groth, Amit Sahai.
Structure Preserving CCA Secure Encryption
Structure Preserving CCA Secure Encryption presented by ZHANG Tao 1 / 9 Introduction Veriable Encryption enable validity check of the encryption (Camenisch et al. @ CRYPTO'03): veriable encryption of discrete
Outline. The Game-based Methodology for Computational Security Proofs. Public-Key Cryptography. Outline. Introduction Provable Security
The Game-based Methodology for Computational s David Pointcheval Ecole normale supérieure, CNRS & INRIA Computational and Symbolic Proofs of Security Atagawa Heights Japan April 6th, 2009 1/39 2/39 Public-Key
Tampering attacks in pairing-based cryptography. Johannes Blömer University of Paderborn September 22, 2014
Tampering attacks in pairing-based cryptography Johannes Blömer University of Paderborn September 22, 2014 1 / 16 Pairings Definition 1 A pairing is a bilinear, non-degenerate, and efficiently computable
Anonymous Credentials Light
Anonymous Credentials Light Foteini Baldimtsi, Anna Lysyanskaya foteini,anna@cs.brown.edu Computer Science Department, Brown University Abstract. We define and propose an efficient and provably secure
Improved Algebraic MACs and Practical Keyed-Verification Anonymous Credentials
Improved Algebraic MACs and Practical Keyed-Verification Anonymous Credentials Amira Barki, Solenn Brunet, Nicolas Desmoulins and Jacques Traoré August 11th, 2016 Selected Areas in Cryptography SAC 2016
Efficient Identity-based Encryption Without Random Oracles
Efficient Identity-based Encryption Without Random Oracles Brent Waters Weiwei Liu School of Computer Science and Software Engineering 1/32 Weiwei Liu Efficient Identity-based Encryption Without Random
Computing on Authenticated Data: New Privacy Definitions and Constructions
Computing on Authenticated Data: New Privacy Definitions and Constructions Nuttapong Attrapadung, Benoit Libert, Thomas Peters To cite this version: Nuttapong Attrapadung, Benoit Libert, Thomas Peters.
Optimal Security Reductions for Unique Signatures: Bypassing Impossibilities with A Counterexample
Optimal Security Reductions for Unique Signatures: Bypassing Impossibilities with A Counterexample Fuchun Guo 1, Rongmao Chen 2, Willy Susilo 1, Jianchang Lai 1, Guomin Yang 1, and Yi Mu 1 1 Institute
Efficient Cryptographic Primitives for. Non-Interactive Zero-Knowledge Proofs. and Applications
Efficient Cryptographic Primitives for Non-Interactive Zero-Knowledge Proofs and Applications by Kristiyan Haralambiev A dissertation submitted in partial fulfillment of the requirements for the degree
Cryptography from Pairings
DIAMANT/EIDMA Symposium, May 31st/June 1st 2007 1 Cryptography from Pairings Kenny Paterson kenny.paterson@rhul.ac.uk May 31st 2007 DIAMANT/EIDMA Symposium, May 31st/June 1st 2007 2 The Pairings Explosion
Structure-Preserving Signatures from Standard Assumptions, Revisited
Structure-Preserving Signatures from Standard Assumptions, Revisited Eike Kiltz, Jiaxin Pan, and Hoeteck Wee 1 Ruhr-Universität Bochum 2 Ruhr-Universität Bochum 3 ENS, Paris {eike.kiltz,jiaxin.pan}@rub.de,
On the Impossibility of Structure-Preserving Deterministic Primitives
On the Impossibility of Structure-Preserving Deterministic Primitives Masayuki Abe 1, Jan Camenisch 2, Rafael Dowsley 3, and Maria Dubovitskaya 2,4 1 NTT Corporation, Japan, abe.masayuki@lab.ntt.co.jp
Automorphic Signatures and Applications
École normale supérieure Département d Informatique Université Paris 7 Denis Diderot Automorphic Signatures and Applications PhD thesis Georg Fuchsbauer 13 October 2010 Abstract We advocate modular design
An Efficient Transform from Sigma Protocols to NIZK with a CRS and Non-Programmable Random Oracle
An Efficient Transform from Sigma Protocols to NIZK with a CRS and Non-Programmable Random Oracle Yehuda Lindell Dept. of Computer Science Bar-Ilan University, Israel lindell@biu.ac.il September 6, 2015
Cryptographic e-cash. Jan Camenisch. IBM Research ibm.biz/jancamenisch. IACR Summerschool Blockchain Technologies
IACR Summerschool Blockchain Technologies Cryptographic e-cash Jan Camenisch IBM Research Zurich @JanCamenisch ibm.biz/jancamenisch ecash scenario & requirements Bank Withdrawal User Spend Deposit Merchant
A lattice-based partially blind signature
SECURITY AND COMMUNICATION NETWORKS Security Comm. Networks 206; 9:820 828 Published online February 206 in Wiley Online Library (wileyonlinelibrary.com)..439 SPECIAL ISSUE PAPER A lattice-based partially
Constant Size Ring Signature Without Random Oracle
Constant Size Ring Signature Without Random Oracle Priyanka Bose, Dipanjan Das, and C. Pandu Rangan Indian Institute of Technology, Madras {priyab,dipanjan,rangan}@cse.iitm.ac.in Abstract. Ring signature
Anonymous Credentials Light
Anonymous Credentials Light Foteini Baldimtsi Brown University foteini@cs.brown.edu Anna Lysyanskaya Brown University anna@cs.brown.edu ABSTRACT We define and propose an efficient and provably secure construction
Efficient Smooth Projective Hash Functions and Applications
Efficient Smooth Projective Hash Functions and Applications David Pointcheval Joint work with Olivier Blazy, Céline Chevalier and Damien Vergnaud Ecole Normale Supérieure Isaac Newton Institute for Mathematical
4-3 A Survey on Oblivious Transfer Protocols
4-3 A Survey on Oblivious Transfer Protocols In this paper, we survey some constructions of oblivious transfer (OT) protocols from public key encryption schemes. We begin with a simple construction of
Structure-Preserving Signatures from Type II Pairings
Structure-Preserving Signatures from Type II Pairings Masayuki Abe 1, Jens Groth 2, Miyako Ohkubo 3, and Mehdi Tibouchi 1 1 NTT Secure Platform Laboratories, Japan 2 University College London, UK 3 Security
Proofs on Encrypted Values in Bilinear Groups and an Application to Anonymity of Signatures
Proofs on Encrypted Values in Bilinear Groups and an Application to Anonymity of Signatures G. Fuchsbauer D. Pointcheval École normale supérieure Pairing'09, 13.08.2009 Fuchsbauer, Pointcheval (ENS) Proofs
The Kernel Matrix Diffie-Hellman Assumption
The Kernel Matrix Diffie-Hellman Assumption Carla Ràfols 1, Paz Morillo 2 and Jorge L. Villar 2 1 Universitat Pompeu Fabra (UPF) Spain 2 Universitat Politècnica de Catalunya (UPC) Spain Matemática Aplicada
Security Analysis of Some Batch Verifying Signatures from Pairings
International Journal of Network Security, Vol.3, No.2, PP.138 143, Sept. 2006 (http://ijns.nchu.edu.tw/) 138 Security Analysis of Some Batch Verifying Signatures from Pairings Tianjie Cao 1,2,3, Dongdai
Universally Composable Adaptive Oblivious Transfer
Universally Composable Adaptive Oblivious Transfer Matthew Green Susan Hohenberger Johns Hopkins University {mgreen,susan}@cs.jhu.edu September 14, 2013 Abstract In an oblivious transfer (OT) protocol,
Short Randomizable Signatures
SESSION ID: CRYP-W02 Short Randomizable Signatures David Pointcheval Senior Researcher ENS/CNRS/INRIA Paris, France Joint work with Olivier Sanders S C I E N C E P A S S I O N
Identification Schemes of Proofs of Ability Secure against Concurrent Man-in-the-Middle Attacks
Identification Schemes of Proofs of Ability Secure against Concurrent Man-in-the-Middle Attacks Hiroaki Anada and Seiko Arita Institute of Information Security, Yokohama, Japan hiroaki.anada@gmail.com,
Anonymous Proxy Signature with Restricted Traceability
Anonymous Proxy Signature with Restricted Traceability Jiannan Wei Joined work with Guomin Yang and Yi Mu University of Wollongong Outline Introduction Motivation and Potential Solutions Anonymous Proxy
Short Signature Scheme From Bilinear Pairings
Sedat Akleylek, Barış Bülent Kırlar, Ömer Sever, and Zaliha Yüce Institute of Applied Mathematics, Middle East Technical University, Ankara, Turkey {akleylek,kirlar}@metu.edu.tr,severomer@yahoo.com,zyuce@stm.com.tr
Short Randomizable Signatures
This is the full version of the extended abstract which appears in Proceedings of the Cryptographers Track at the RSA Conference (CT-RSA 16) (29 February 4 March 2016, San Francisco, CA, USA) Kazue Sako
Concise Multi-Challenge CCA-Secure Encryption and Signatures with Almost Tight Security
Concise Multi-Challenge CCA-Secure Encryption and Signatures with Almost Tight Security Benoît Libert 1, Marc Joye 2, Moti Yung 3, and Thomas Peters 4 1 Ecole Normale Supérieure de Lyon, Laboratoire de
ID-Based Blind Signature and Ring Signature from Pairings
ID-Based Blind Signature and Ring Signature from Pairings Fangguo Zhang and Kwangjo Kim International Research center for Information Security (IRIS) Information and Communications University(ICU), 58-4
Session 4: Efficient Zero Knowledge. Yehuda Lindell Bar-Ilan University
Session 4: Efficient Zero Knowledge Yehuda Lindell Bar-Ilan University 1 Proof Systems Completeness: can convince of a true statement Soundness: cannot convince for a false statement Classic proofs: Written
Strongly Unforgeable Signatures Based on Computational Diffie-Hellman
Strongly Unforgeable Signatures Based on Computational Diffie-Hellman Dan Boneh 1, Emily Shen 1, and Brent Waters 2 1 Computer Science Department, Stanford University, Stanford, CA {dabo,emily}@cs.stanford.edu
CONSTRUCTIONS SECURE AGAINST RECEIVER SELECTIVE OPENING AND CHOSEN CIPHERTEXT ATTACKS
CONSRUCIONS SECURE AGAINS RECEIVER SELECIVE OPENING AND CHOSEN CIPHEREX AACKS Dingding Jia, Xianhui Lu, Bao Li jiadingding@iie.ac.cn C-RSA 2017 02-17 Outline Background Motivation Our contribution Existence:
Schnorr Signature. Schnorr Signature. October 31, 2012
. October 31, 2012 Table of contents Salient Features Preliminaries Security Proofs Random Oracle Heuristic PKS and its Security Models Hardness Assumption The Construction Oracle Replay Attack Security
Fair Blind Signatures without Random Oracles
Fair Blind Signatures without Random Oracles Georg Fuchsbauer and Damien Vergnaud École normale supérieure, LIENS - CNRS - INRIA, Paris, France http://www.di.ens.fr/{~fuchsbau,~vergnaud} Abstract. A fair
On the (Im)possibility of Projecting Property in Prime-Order Setting
On the (Im)possibility of Projecting Property in Prime-Order Setting Jae Hong Seo Department of Mathematics, Myongji University, Yongin, Republic of Korea jaehongseo@mju.ac.r Abstract. Projecting bilinear
Digital Signature Schemes and the Random Oracle Model. A. Hülsing
Digital Signature Schemes and the Random Oracle Model A. Hülsing Today s goal Review provable security of in use signature schemes. (PKCS #1 v2.x) PAGE 1 Digital Signature Source: http://hari-cio-8a.blog.ugm.ac.id/files/2013/03/dsa.jpg
Fang Song. Joint work with Sean Hallgren and Adam Smith. Computer Science and Engineering Penn State University
Fang Song Joint work with Sean Hallgren and Adam Smith Computer Science and Engineering Penn State University Are classical cryptographic protocols secure against quantum attackers? 2 Are classical cryptographic
Short Signatures from Diffie-Hellman, Revisited: Sublinear Public Key, CMA Security, and Tighter Reduction
Short Signatures from Diffie-Hellman, Revisited: Sublinear Public Key, CMA Security, and Tighter Reduction Jae Hong Seo Myongji University jaehongseo@mju.ac.kr Abstract. Designing efficient signature scheme
Short Signatures From Diffie-Hellman: Realizing Short Public Key
Short Signatures From Diffie-Hellman: Realizing Short Public Key Jae Hong Seo Department of Mathematics, Myongji University Yongin, Republic of Korea jaehongseo@mju.ac.kr Abstract. Efficient signature
Attribute-Based Signatures for Circuits from Bilinear Map
Attribute-Based Signatures for Circuits from Bilinear Map Yusuke Sakai, Nuttapong Attrapadung, and Goichiro Hanaoka AIST, Japan {yusuke.sakai,n.attrapadung,hanaoka-goichiro}@aist.go.jp Abstract. In attribute-based
Pairing-Based Cryptography An Introduction
ECRYPT Summer School Samos 1 Pairing-Based Cryptography An Introduction Kenny Paterson kenny.paterson@rhul.ac.uk May 4th 2007 ECRYPT Summer School Samos 2 The Pairings Explosion Pairings originally used
Picnic Post-Quantum Signatures from Zero Knowledge Proofs
Picnic Post-Quantum Signatures from Zero Knowledge Proofs MELISSA CHASE, MSR THE PICNIC TEAM DAVID DERLER STEVEN GOLDFEDER JONATHAN KATZ VLAD KOLESNIKOV CLAUDIO ORLANDI SEBASTIAN RAMACHER CHRISTIAN RECHBERGER
Public-Key Cryptography. Lecture 9 Public-Key Encryption Diffie-Hellman Key-Exchange
Public-Key Cryptography Lecture 9 Public-Key Encryption Diffie-Hellman Key-Exchange Shared/Symmetric-Key Encryption (a.k.a. private-key encryption) SKE: Syntax KeyGen outputs K K E scheme E Syntax a.k.a.
Born and Raised Distributively: Fully Distributed Non-Interactive Adaptively-Secure Threshold Signatures with Short Shares
Published in S. Dolev, Ed., 2014 ACM Symposium on Principles of Distributed Computing (PODC 2014, pp. 303-312, ACM Press, 2014. Born and Raised Distributively: Fully Distributed Non-Interactive Adaptively-Secure
Anonymous Credential Schemes with Encrypted Attributes
Anonymous Credential Schemes with Encrypted Attributes Bart Mennink (K.U.Leuven) joint work with Jorge Guajardo (Philips Research) Berry Schoenmakers (TU Eindhoven) Conference on Cryptology And Network
Recent Advances in Identity-based Encryption Pairing-based Constructions
Fields Institute Workshop on New Directions in Cryptography 1 Recent Advances in Identity-based Encryption Pairing-based Constructions Kenny Paterson kenny.paterson@rhul.ac.uk June 25th 2008 Fields Institute
Limitations on Transformations from Composite-Order to Prime-Order Groups: The Case of Round-Optimal Blind Signatures
Limitations on Transformations from Composite-Order to Prime-Order Groups: The Case of Round-Optimal Blind Signatures Sarah Meiklejohn (UC San Diego) Hovav Shacham (UC San Diego) David Mandell Freeman
Computing on Authenticated Data: New Privacy Definitions and Constructions
Computing on Authenticated Data: New Privacy Definitions and Constructions Nuttapong Attrapadung 1, Benoît Libert 2, and Thomas Peters 2 1 esearch Institute for Secure Systems, AIST (Japan) 2 Université
Black-Box Accumulation: Collecting Incentives in a Privacy-Preserving Way
Proceedings on Privacy Enhancing Technologies ; 2016 (3):62 82 Tibor Jager and Andy Rupp* Black-Box Accumulation: Collecting Incentives in a Privacy-Preserving Way Abstract: We formalize and construct
Efficient Completely Context-Hiding Quotable and Linearly Homomorphic Signatures
Efficient Completely Context-Hiding Quotable and Linearly Homomorphic Signatures Nuttapong Attrapadung 1, Benoît Libert 2, and Thomas Peters 2 1 esearch Center for Information Security, AIST Japan 2 Technicolor
Applied cryptography
Applied cryptography Identity-based Cryptography Andreas Hülsing 19 November 2015 1 / 37 The public key problem How to obtain the correct public key of a user? How to check its authenticity? General answer:
On Two Round Rerunnable MPC Protocols
On Two Round Rerunnable MPC Protocols Paul Laird Dublin Institute of Technology, Dublin, Ireland email: {paul.laird}@dit.ie Abstract. Two-rounds are minimal for all MPC protocols in the absence of a trusted
Security Analysis of an Identity-Based Strongly Unforgeable Signature Scheme
Security Analysis of an Identity-Based Strongly Unforgeable Signature Scheme Kwangsu Lee Dong Hoon Lee Abstract Identity-based signature (IBS) is a specific type of public-key signature (PKS) where any
Logarithmic-Size Ring Signatures With Tight Security from the DDH Assumption
Logarithmic-Size ing Signatures With Tight Security from the DDH Assumption Benoît Libert 1,2, Thomas Peters 3, and Chen Qian 4 1 CNS, Laboratoire LIP, France 2 ENS de Lyon, Laboratoire LIP (U. Lyon, CNS,
Provably Secure Partially Blind Signatures
Provably Secure Partially Blind Signatures Masayuki ABE and Tatsuaki OKAMOTO NTT Laboratories Nippon Telegraph and Telephone Corporation 1-1 Hikari-no-oka Yokosuka-shi Kanagawa-ken, 239-0847 Japan E-mail:
Security of Blind Signatures Revisited
Security of Blind Signatures Revisited Dominique Schröder 1 and Dominique Unruh 2 1 University of Maryland, USA 2 University of Tartu, Estonia Abstract. We revisit the definition of unforgeability of blind
Disjunctions for Hash Proof Systems: New Constructions and Applications
Disjunctions for Hash Proof Systems: New Constructions and Applications Michel Abdalla, Fabrice Benhamouda, and David Pointcheval ENS, Paris, France Abstract. Hash Proof Systems were first introduced by
Outline. Provable Security in the Computational Model. III Signatures. Public-Key Encryption. Outline. David Pointcheval.
Provable Security in the Computational Model III Signatures David Pointcheval Ecole normale supérieure, CNRS & INRI Public-Key Encryption Signatures 2 dvanced Security for Signature dvanced Security Notions
G Advanced Cryptography April 10th, Lecture 11
G.30-001 Advanced Cryptography April 10th, 007 Lecturer: Victor Shoup Lecture 11 Scribe: Kristiyan Haralambiev We continue the discussion of public key encryption. Last time, we studied Hash Proof Systems
Non-interactive Designated Verifier Proofs and Undeniable Signatures
Non-interactive Designated Verifier Proofs and Undeniable Signatures Caroline Kudla and Kenneth G. Paterson Information Security Group Royal Holloway, University of London, UK {c.j.kudla,kenny.paterson}@rhul.ac.uk
Extractable Perfectly One-way Functions
Extractable Perfectly One-way Functions Ran Canetti 1 and Ronny Ramzi Dakdouk 2 1 IBM T. J. Watson Research Center, Hawthorne, NY. canetti@watson.ibm.com 2 Yale University, New Haven, CT. dakdouk@cs.yale.edu
Cryptanalysis and improvement of an ID-based ad-hoc anonymous identification scheme at CT-RSA 05
Cryptanalysis and improvement of an ID-based ad-hoc anonymous identification scheme at CT-RSA 05 Fangguo Zhang 1 and Xiaofeng Chen 2 1 Department of Electronics and Communication Engineering, Sun Yat-sen
Practical Adaptive Oblivious Transfer from Simple Assumptions
Practical Adaptive Oblivious Transfer from Simple Assumptions Matthew Green Johns Hopkins University Susan Hohenberger Johns Hopkins University January 7, 2011 Abstract In an adaptive oblivious transfer
On The Security of The ElGamal Encryption Scheme and Damgård s Variant
On The Security of The ElGamal Encryption Scheme and Damgård s Variant J. Wu and D.R. Stinson David R. Cheriton School of Computer Science University of Waterloo Waterloo, ON, Canada {j32wu,dstinson}@uwaterloo.ca
REMARKS ON IBE SCHEME OF WANG AND CAO
REMARKS ON IBE SCEME OF WANG AND CAO Sunder Lal and Priyam Sharma Derpartment of Mathematics, Dr. B.R.A.(Agra), University, Agra-800(UP), India. E-mail- sunder_lal@rediffmail.com, priyam_sharma.ibs@rediffmail.com
Ring Group Signatures
Ring Group Signatures Liqun Chen Hewlett-Packard Laboratories, Long Down Avenue, Stoke Gifford, Bristol, BS34 8QZ, United Kingdom. liqun.chen@hp.com Abstract. In many applications of group signatures,
Groth Sahai proofs revisited
Groth Sahai proofs revisited E. Ghadafi, N.P. Smart, and B. Warinschi Dept. Computer Science, University of Bristol, Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB. United Kingdom. ghadafi,nigel,bogdan}@cs.bris.ac.uk
MTAT Cryptology II. Zero-knowledge Proofs. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Zero-knowledge Proofs Sven Laur University of Tartu Formal Syntax Zero-knowledge proofs pk (pk, sk) Gen α 1 β 1 β i V pk (α 1,...,α i 1 ) α i P sk (β 1,...,β i 1 ) (pk,sk)? R
An Efficient Signature Scheme from Bilinear Pairings and Its Applications
An Efficient Signature Scheme from Bilinear Pairings and Its Applications Fangguo Zhang, Reihaneh Safavi-Naini and Willy Susilo School of Information Technology and Computer Science University of Wollongong,
Certificateless Signcryption without Pairing
Certificateless Signcryption without Pairing Wenjian Xie Zhang Zhang College of Mathematics and Computer Science Guangxi University for Nationalities, Nanning 530006, China Abstract. Certificateless public
Highly-Efficient Universally-Composable Commitments based on the DDH Assumption
Highly-Efficient Universally-Composable Commitments based on the DDH Assumption Yehuda Lindell March 6, 2013 Abstract Universal composability (or UC security) provides very strong security guarantees for
One-Round ID-Based Blind Signature Scheme without ROS Assumption
One-Round ID-Based Blind Signature Scheme without ROS Assumption Wei Gao 1, Xueli Wang 2, Guilin Wang 3, and Fei Li 4 1 College of Mathematics and Econometrics, Hunan University, Changsha 410082, China
On Tightly Secure Non-Interactive Key Exchange
On Tightly Secure Non-Interactive Key Exchange Julia Hesse (Technische Universität Darmstadt) Dennis Hofheinz (Karlsruhe Institute of Technology) Lisa Kohl (Karlsruhe Institute of Technology) 1 Non-Interactive
A Fully-Functional group signature scheme over only known-order group
A Fully-Functional group signature scheme over only known-order group Atsuko Miyaji and Kozue Umeda 1-1, Asahidai, Tatsunokuchi, Nomi, Ishikawa, 923-1292, Japan {kozueu, miyaji}@jaist.ac.jp Abstract. The
PAPER An Identification Scheme with Tight Reduction
IEICE TRANS. FUNDAMENTALS, VOL.Exx A, NO.xx XXXX 200x PAPER An Identification Scheme with Tight Reduction Seiko ARITA, Member and Natsumi KAWASHIMA, Nonmember SUMMARY There are three well-known identification
A Pairing-Based DAA Scheme Further Reducing TPM Resources
A Pairing-Based DAA Scheme Further Reducing TPM Resources Ernie Brickell Intel Corporation ernie.brickell@intel.com Jiangtao Li Intel Labs jiangtao.li@intel.com Abstract Direct Anonymous Attestation (DAA)
Efficient Zero-Knowledge Arguments from Two-Tiered Homomorphic Commitments
Efficient Zero-Knowledge Arguments from Two-Tiered Homomorphic Commitments Jens Groth University College London, UK j.groth@ucl.ac.uk Abstract. We construct practical and efficient zero-knowledge arguments
Non-interactive zero-knowledge proofs in the quantum random oracle model
Non-interactive zero-knowledge proofs in the quantum random oracle model Dominique Unruh University of Tartu Abstract. We present a construction for non-interactive zero-knowledge proofs of knowledge in
Circular chosen-ciphertext security with compact ciphertexts
Circular chosen-ciphertext security with compact ciphertexts Dennis Hofheinz October 9, 2018 Abstract A key-dependent message (KDM) secure encryption scheme is secure even if an adversary obtains encryptions