ABCs in Theory and Practice RFIDsec 2015, TUTORIAL Gergely Alpr - PowerPoint PPT Presentation

ABCs in Theory and Practice RFIDsec 2015, TUTORIAL Gergely Alpár Radboud, ICIS DS June 23, 2015 Page 1 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely

Currently we are here... Motivating Attribtues Attribute-based identity management Crypto of ABCs

“[By 2025 f]ew individuals will have the energy, interest, or resources to protect themselves from dataveillance ; privacy will become a luxury .” [Pew Research Center, December 2014] Page 2 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Motivating Attribtues

Authentication Passwords I • “38% of adults sometimes think it would be easier to solve world peace than attempt to remember all their passwords” [Harris Interactive, 2012] Many accounts at service providers I Identity management I • Users • Identity provider(s) = Issuer • Service providers = Relying party = Verifier Page 3 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Motivating Attribtues

Problems with Identity Management Security I • Single point of failure • Valuable target Privacy I • Can log in (often) • Linking all user activities • Profiling Page 4 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Motivating Attribtues

Authorisation is necessarily identifying Page 5 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Motivating Attribtues

Outline Motivating Attribtues Attribute-based identity management Crypto of ABCs Page 6 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Motivating Attribtues

Currently we are here... Motivating Attribtues Attribute-based identity management Crypto of ABCs

Identity and Attributes [FIDIS 2005] Page 7 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Attribute-based identity management

Digital Identity Attributes I Partial identities I Identifying and non-identifying attributes I Typical authorisation: Username + authentication + lookup I Authorisation based on attributes I • Directly looking up relevant attributes • Identifying and non-identifying authorisation (DEMO: ≥ 18) Page 8 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Attribute-based identity management

Identity Management Page 9 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Attribute-based identity management

Attribute-Based Identity Management Page 10 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Attribute-based identity management

Attribute-Based Credential Page 11 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Attribute-based identity management

Issuing and Showing Page 12 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Attribute-based identity management

Currently we are here... Motivating Attribtues Attribute-based identity management Crypto of ABCs

Plan for Crypto Commitment I Zero-knowledge proof I Attribute-based credential (ABC) I Selective disclosure I Page 13 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Commitment (Temporary) secret in a box with a padlock I . . . and a key. I Phases: I • Commit • Opening Examples (related to the DL problem) – secret value x : I h = g x ( mod p ) . Commit: h , g , p ; Opening: x . • h = g r · g x • 1 ( mod p ) . Commit: h , g , g 1 , p ; Opening: r , x . Computational hiding and perfect binding. I OR Perfect hiding and computational binding. [Damgård 99] I Problem 3 The exponents of 23 modulo 29 (the order is q = 7): 0 1 2 3 4 5 6 7 ... 1 23 7 16 20 25 24 1 ... Page 14 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Where’s Waldo? – Zero-Knowledge Proof Page 15 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Where’s Waldo? – Zero-Knowledge Proof [Naor et al. 99] Page 16 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Where’s Waldo? Page 17 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Ali Baba – Zero-Knowledge Proof [Quisquater et al. 89] Page 18 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Ali Baba – Zero-Knowledge Proof Commitment and Challenge Page 19 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Ali Baba – Zero-Knowledge Proof Response and Verification Problems 1, 2 Page 20 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

A “Too Simple” Proof Let us work in G of order q I Discrete logarithm: “I know the discrete logarithm x = log g h .” I G , g , q , h = g x Prover Verifier Secret: x x − − − − − − − − → ? = g x h “Now you also know the discrete logarithm log g h .” / I Page 21 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Schnorr’s Proof of Knowledge [Schnorr 91] Let us work in G of order q I Discrete logarithm: “I know the discrete logarithm x = log g h .” I PK { χ | h = g χ } — P roof of K nowledge I Interactive I G , g , q , h = g x Prover Verifier Secret: x (1) w ∈ R Z q a a := g w − − − − − − − − → c (2) c ∈ R { 0 , 1 } ← − − − − − − − − = g r · h � c ? r (3) r := c · x + w ( mod q ) a − − − − − − − − → (1) Commitment (2) Challenge (3) Response Page 22 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Simulated Communication Let us work in G of order q I “I seem to know the discrete logarithm log g h .” , I Simulated conversation: transcript I Choose c ∈ R { 0 , 1 } , r ∈ R Z ⇤ I q a := g r · h � c Transcript and verification: = g r · h � c ? ( a , c , r ) a Page 23 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Schnorr’s Proof of Knowledge [Schnorr 91] Let us work in G of order q I Discrete logarithm: “I know the discrete logarithm log g h .” I PK { χ | h = g χ } — P roof of K nowledge I Interactive I G , g , q , h = g x Prover Verifier Secret: x (1) w ∈ R Z q a a := g w − − − − − − − − → c c ∈ R [ 0 , 2 128 − 1 ] (2) ← − − − − − − − − = g r · h � c ? r (3) r := c · x + w ( mod q ) a − − − − − − − − → (1) Commitment (2) Challenge (3) Response Page 24 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Schnorr Signature, i.e. Schnorr with Fiat–Shamir [FS 86] Discrete logarithm: “I know the discrete logarithm log g h .” I Non-interactive: SPK { χ | h = g χ } ( n ) I • Challenge c is generated by a hash H H : { 0 , 1 } ⇤ → [ 0 , 2 128 − 1 ] (128-bit output) • G , g , q , h = g x , H Prover Verifier Secret: x n n ∈ R Z q ← − − − − − − − − w ∈ R Z q a := g w c := H ( a , n ) a , r = g r · h � H ( a , n ) ? r := c · x + w ( mod q ) a − − − − − − − − − → Page 25 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

How to Design ABCs? – In Three Simple Steps Take a commitment scheme Step 1 Step 2 Generalise it to multiple values Step 3 Sign the extended commitment Step +1 Apply here and there zero-knowledge proofs Page 26 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Example: Idemix Page 27 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Hard Problems Discrete logarithm RSA Strong RSA Page 28 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Idemix ABC – Based on CL Signature Camenisch–Lysyanskaya (CL) signature [CL 01, CL 02] I Strong RSA assumption [BP 97, FO 97] I • RSA ( n = pq ) = ⇒ Taking the e th root is hard • Strong = ⇒ DL is hard Group QR n : I p , q are safe primes ( p = 2 p 0 + 1 , q = 2 q 0 + 1 s.t. p 0 , q 0 primes) • • Quadratic residues in Z ⇤ n • QR n is a subgroup of order ϕ ( n ) / 4 Notation: I • Some group elements that you’ll see: A , Z , S , R , R 1 , R 2 , R 3 , . . . • Some further integers (exponents): e , v , a , . . . Let’s “design” Idemix’s ABCs I Page 29 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Step 1: Commitment Take a commitment scheme – Pedersen on a 1 R a · R a 1 where a is random. 1 Page 30 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Step 2: Generalisation Extend it to multiple values – generalise Pedersen on ( a 1 , . . . , a L ) R a · R a 1 1 · . . . · R a L L | {z } ai Q L i = 1 R i where a is random. Page 31 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Step 3: Signature Sign the extended commitment – CL on attributes: a 1 , . . . , a L ! 1 / e Z A := ( mod n ) S v · R a · Q L i = 1 R a i i where ( a ) , v , e are random. Page 32 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs

Step 3: Signature Sign the extended commitment – CL on attributes: a 1 , . . . , a L ! 1 / e Z A := ( mod n ) S v · R a · Q L i = 1 R a i i where ( a ) , v , e are random. Page 33 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Crypto of ABCs