ABCs in Theory and Practice RFIDsec 2015, TUTORIAL Gergely Alpr - - PowerPoint PPT Presentation

▶
abcs in theory and practice
SMART_READER_LITE
LIVE PREVIEW

ABCs in Theory and Practice RFIDsec 2015, TUTORIAL Gergely Alpr - - PowerPoint PPT Presentation

Oct 08, 2022 274 likes •713 views

ABCs in Theory and Practice RFIDsec 2015, TUTORIAL Gergely Alpr Radboud, ICIS DS June 23, 2015 Page 1 of 40 June 23 ABC Tutorial http://www.cs.ru.nl/~gergely Currently we are here... Motivating Attribtues Attribute-based identity

slide-1
SLIDE 1

ABCs in Theory and Practice

RFIDsec 2015, TUTORIAL Gergely Alpár

Radboud, ICIS DS June 23, 2015

Page 1 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial

slide-2
SLIDE 2

Currently we are here...

Motivating Attribtues Attribute-based identity management Crypto of ABCs

slide-3
SLIDE 3

“[By 2025 f]ew individuals will have the energy, interest, or resources to protect themselves from dataveillance; privacy will become a luxury.”

[Pew Research Center, December 2014] Page 2 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Motivating Attribtues

slide-4
SLIDE 4

Authentication

I Passwords

  • “38% of adults sometimes think it would be easier to solve world

peace than attempt to remember all their passwords” [Harris Interactive, 2012] I Many accounts at service providers I Identity management

  • Users
  • Identity provider(s) = Issuer
  • Service providers = Relying party = Verifier

Page 3 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Motivating Attribtues

slide-5
SLIDE 5

Problems with Identity Management

I Security

  • Single point of failure
  • Valuable target

I Privacy

  • Can log in (often)
  • Linking all user activities
  • Profiling

Page 4 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Motivating Attribtues

slide-6
SLIDE 6

Authorisation is necessarily identifying

Page 5 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Motivating Attribtues

slide-7
SLIDE 7

Outline

Motivating Attribtues Attribute-based identity management Crypto of ABCs

Page 6 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Motivating Attribtues

slide-8
SLIDE 8

Currently we are here...

Motivating Attribtues Attribute-based identity management Crypto of ABCs

slide-9
SLIDE 9

Identity and Attributes

[FIDIS 2005] Page 7 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Attribute-based identity management

slide-10
SLIDE 10

Digital Identity

I Attributes I Partial identities I Identifying and non-identifying attributes I Typical authorisation: Username + authentication + lookup I Authorisation based on attributes

  • Directly looking up relevant attributes
  • Identifying and non-identifying authorisation (DEMO: ≥ 18)

Page 8 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Attribute-based identity management

slide-11
SLIDE 11

Identity Management

Page 9 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Attribute-based identity management

slide-12
SLIDE 12

Attribute-Based Identity Management

Page 10 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Attribute-based identity management

slide-13
SLIDE 13

Attribute-Based Credential

Page 11 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Attribute-based identity management

slide-14
SLIDE 14

Issuing and Showing

Page 12 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Attribute-based identity management

slide-15
SLIDE 15

Currently we are here...

Motivating Attribtues Attribute-based identity management Crypto of ABCs

slide-16
SLIDE 16

Plan for Crypto

I Commitment I Zero-knowledge proof I Attribute-based credential (ABC) I Selective disclosure

Page 13 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-17
SLIDE 17

Commitment

I (Temporary) secret in a box with a padlock I . . . and a key. I Phases:

  • Commit
  • Opening

I Examples (related to the DL problem) – secret value x:

  • h = g x (mod p). Commit: h, g, p; Opening: x.
  • h = g r · g x

1 (mod p). Commit: h, g, g1, p; Opening: r, x.

I Computational hiding and perfect binding. OR I Perfect hiding and computational binding. [Damgård 99] Problem 3 The exponents of 23 modulo 29 (the order is q = 7): 1 2 3 4 5 6 7 ... 1 23 7 16 20 25 24 1 ...

Page 14 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-18
SLIDE 18

Where’s Waldo? – Zero-Knowledge Proof

Page 15 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-19
SLIDE 19

Where’s Waldo? – Zero-Knowledge Proof

[Naor et al. 99] Page 16 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-20
SLIDE 20

Where’s Waldo?

Page 17 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-21
SLIDE 21

Ali Baba – Zero-Knowledge Proof

[Quisquater et al. 89] Page 18 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-22
SLIDE 22

Ali Baba – Zero-Knowledge Proof

Commitment and Challenge

Page 19 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-23
SLIDE 23

Ali Baba – Zero-Knowledge Proof

Response and Verification Problems 1, 2

Page 20 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-24
SLIDE 24

A “Too Simple” Proof

I Let us work in G of order q I Discrete logarithm: “I know the discrete logarithm x = logg h.” Prover G, g, q, h = g x Verifier Secret: x

x

− − − − − − − − → h

?

= g x I “Now you also know the discrete logarithm logg h.” /

Page 21 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-25
SLIDE 25

Schnorr’s Proof of Knowledge [Schnorr 91]

I Let us work in G of order q I Discrete logarithm: “I know the discrete logarithm x = logg h.” I PK{χ|h = g χ}—Proof of Knowledge I Interactive Prover G, g, q, h = g x Verifier Secret: x (1) w ∈R Zq a := g w

a

− − − − − − − − → (2)

c

← − − − − − − − − c ∈R {0, 1} (3) r := c · x + w (mod q)

r

− − − − − − − − → a

?

= g r · hc (1) Commitment (2) Challenge (3) Response

Page 22 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-26
SLIDE 26

Simulated Communication

I Let us work in G of order q I “I seem to know the discrete logarithm logg h.” , I Simulated conversation: transcript I Choose c ∈R {0, 1}, r ∈R Z⇤

q

a := g r · hc Transcript and verification: (a, c, r) a

?

= g r · hc

Page 23 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-27
SLIDE 27

Schnorr’s Proof of Knowledge [Schnorr 91]

I Let us work in G of order q I Discrete logarithm: “I know the discrete logarithm logg h.” I PK{χ|h = g χ}—Proof of Knowledge I Interactive Prover G, g, q, h = g x Verifier Secret: x (1) w ∈R Zq a := g w

a

− − − − − − − − → (2)

c

← − − − − − − − − c ∈R [0, 2128 − 1] (3) r := c · x + w (mod q)

r

− − − − − − − − → a

?

= g r · hc (1) Commitment (2) Challenge (3) Response

Page 24 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-28
SLIDE 28

Schnorr Signature, i.e. Schnorr with Fiat–Shamir [FS 86]

I Discrete logarithm: “I know the discrete logarithm logg h.” I Non-interactive: SPK{χ|h = g χ}(n)

  • Challenge c is generated by a hash H
  • H : {0, 1}⇤ → [0, 2128 − 1] (128-bit output)

Prover G, g, q, h = g x, H Verifier Secret: x

n

← − − − − − − − − n ∈R Zq w ∈R Zq a := g w c := H(a, n) r := c · x + w (mod q)

a,r

− − − − − − − − − → a

?

= g r · hH(a,n)

Page 25 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-29
SLIDE 29

How to Design ABCs? – In Three Simple Steps

Step 1 Take a commitment scheme Step 2 Generalise it to multiple values Step 3 Sign the extended commitment Step +1 Apply here and there zero-knowledge proofs

Page 26 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-30
SLIDE 30

Example: Idemix

Page 27 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-31
SLIDE 31

Hard Problems

Discrete logarithm RSA Strong RSA

Page 28 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-32
SLIDE 32

Idemix ABC – Based on CL Signature

I Camenisch–Lysyanskaya (CL) signature [CL 01, CL 02] I Strong RSA assumption [BP 97, FO 97]

  • RSA (n = pq) =

⇒ Taking the eth root is hard

  • Strong =

⇒ DL is hard I Group QRn:

  • p, q are safe primes (p = 2p0 + 1, q = 2q0 + 1 s.t. p0, q0 primes)
  • Quadratic residues in Z⇤

n

  • QRn is a subgroup of order ϕ(n)/4

I Notation:

  • Some group elements that you’ll see: A, Z, S, R, R1, R2, R3, . . .
  • Some further integers (exponents): e, v, a, . . .

I Let’s “design” Idemix’s ABCs

Page 29 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-33
SLIDE 33

Step 1: Commitment

Take a commitment scheme – Pedersen on a1 Ra · Ra1

1

where a is random.

Page 30 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-34
SLIDE 34

Step 2: Generalisation

Extend it to multiple values – generalise Pedersen on (a1, . . . , aL) Ra · Ra1

1 · . . . · RaL L

| {z }

QL

i=1 R ai i

where a is random.

Page 31 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-35
SLIDE 35

Step 3: Signature

Sign the extended commitment – CL on attributes: a1, . . . , aL A := Z Sv · Ra · QL

i=1 Rai i

!1/e (mod n) where (a), v, e are random.

Page 32 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-36
SLIDE 36

Step 3: Signature

Sign the extended commitment – CL on attributes: a1, . . . , aL A := Z Sv · Ra · QL

i=1 Rai i

!1/e (mod n) where (a), v, e are random.

Page 33 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-37
SLIDE 37

CL Signature: Idemix ABCs

(A, e, v) where A ≡ Z Sv · Ra · QL

i=1 Rai i

!1/e (mod n) I Commitment

  • Binding: computational (representation problem)
  • Hiding: perfect (randomised)

I CL Signature

  • Private key: p, q; Public key: n = pq, Z, S, “all Rs”
  • A bit like RSA: ( · )1/e (mod n)
  • More complicated: advanced functions

I Issuing: blind signature (zero-knowledge proof)

Page 34 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-38
SLIDE 38

Issuing and Showing

Page 35 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-39
SLIDE 39

CL Signature: Verification

Signature: (A, e, v) where A ≡ Z Sv · Ra · QL

i=1 Rai i

!1/e (mod n) I Public key: n, Z, S, R, R1, . . . , RL I Attributes (block of messages): (a), a1, . . . , aL I Verification: Z

?

≡ Ae · Sv · Ra ·

L

Y

i=1

Rai

i

| {z }

R0

(mod n) I IdP − → U; U − → V

Page 36 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-40
SLIDE 40

CL Signature Randomisation

Signature: (A, e, v) where A ≡ ✓ Z Sv · R0 ◆1/e (mod n) I Select random r I A := A · Sr (mod n), v := v + er Problem 6 (Hint: The verification is Z

?

≡ Ae · Sv · R0 (mod n)) I Indeed, (A, e, v) is valid: A

eSvR0 ≡ AeSerSvSerR0 ≡ AeSvR0 ≡ Z

(mod n). I Can we achieve untraceability with randomisation?

What about e?

Page 37 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-41
SLIDE 41

How to hide e? – i.e. Multi-show Unlinkability

I Randomised signature: (A, e, v) A

eSv · Ra · L

Y

i=1

Rai

i

≡ Z (mod n). I Representation problem is hard: n; Z; (A, S, R, R1, . . . , RL)

?

− → “(e, v, a, a1, . . . , aL)00 I So, to prove that she has a signature:

  • U gives A (i.e. a part of the randomised signature) and
  • U proves that she knows the exponents (i.e. a representation)

PK{(ε, ν, α, α1, . . . , αL) : Z ≡ A

εSνRα L

Y

i=1

Rαi

i

(mod n)}.

But then selective disclosure is easy!

Page 38 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-42
SLIDE 42

Selective disclosure

I Zero-knowledge proof about all exponents: PK{(ε, ν, α, α1, . . . , αL) : Z ≡ A

εSνRα L

Y

i=1

Rαi

i

(mod n)}. I Disclose some and prove the rest; e.g.: U − → V disclose a1, a2 and prove: PK{(ε, ν, α, α3, . . . , αL) : Z · Ra1

1

· Ra2

2

≡ A

εSνRα L

Y

i=3

Rαi

i

(mod n)}. Generalise: Problem 7

Page 39 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs

slide-43
SLIDE 43

In Sum: ABCs are Powerful!

I Security

  • Authenticity
  • Integrity
  • Non-transferability

I Privacy

  • Issuer unlinkability
  • Multi-show unlinkability
  • Selective disclosure (data minimisation)

I Techniques and their smart-card implementations

  • IBM’s Idemix [CL 01, CL 02] → [VA 13]
  • Microsoft’s U-Prove [Brands 99] → [MV 12]
  • Anonymous Credentials Light [BL 13] → [HRP 15] (tomorrow)

Page 40 of 40 http://www.cs.ru.nl/~gergely June 23 ABC Tutorial Crypto of ABCs