Anonymous Tokens Michele Orr ia.cr/2020/072 1 Anonymous Tokens - - PowerPoint PPT Presentation

▶
anonymous tokens
SMART_READER_LITE
LIVE PREVIEW

Anonymous Tokens Michele Orr ia.cr/2020/072 1 Anonymous Tokens - - PowerPoint PPT Presentation

Oct 30, 2022 47 likes •659 views

Anonymous Tokens Michele Orr ia.cr/2020/072 1 Anonymous Tokens Michele Orr joint work with Ben Kreuter, Tancrde Lepoint, Mariana Raykova ia.cr/2020/072 1 Definition Anonymous tokens are lightweight, single-use anonymous credentials.

slide-1
SLIDE 1

Anonymous Tokens

Michele Orrù

ia.cr/2020/072

1

slide-2
SLIDE 2

Anonymous Tokens

Michele Orrù

joint work with Ben Kreuter, Tancrède Lepoint, Mariana Raykova

ia.cr/2020/072

1

slide-3
SLIDE 3

Definition

Anonymous tokens are lightweight, single-use anonymous credentials.

2

slide-4
SLIDE 4

Definition

Anonymous tokens are lightweight, single-use anonymous credentials.

… we focus on secret-key tokens with a private metadata bit.

2

slide-5
SLIDE 5

The Problem

3

slide-6
SLIDE 6

U

[CloudFlare ] [Tor User] [CDN]

request

I W

request response response / no

Privacy Pass: Bypassing Internet Challenges Anonymously. [PETS'18]

4

Website protection.

CloudFlare's story

slide-7
SLIDE 7

U

[CloudFlare ] [Tor User] [CDN]

request solution? challenge

I W

request response response / no

Privacy Pass: Bypassing Internet Challenges Anonymously. [PETS'18]

4

Website protection.

CloudFlare's story

slide-8
SLIDE 8

U

[CloudFlare ] [Tor User] [CDN]

request solution?

I W

request response response / no

Privacy Pass: Bypassing Internet Challenges Anonymously. [PETS'18]

5

CAPTCHA, CAPTCHA, CAPTCHA

CloudFlare's story

Website protection.

slide-9
SLIDE 9 Art credits: Marie Gutbub. [source]

6

slide-10
SLIDE 10

U

[CloudFlare ] [Tor User] [CDN]

challenge solution? challenge

I W

request response

7

response + tokens / no

Privacy Pass: Bypassing Internet Challenges Anonymously. [PETS'18]

CloudFlare's story

request Website protection.

slide-11
SLIDE 11

U

[CloudFlare ] [Tor User] [CDN]

request, token

I W

request response

Privacy Pass: Bypassing Internet Challenges Anonymously. [PETS'18]

response / no

CloudFlare's story

Website protection.

8

slide-12
SLIDE 12

Micro payments.

Other stories

Challenge bypass on the Ristretto group [Github]

9

slide-13
SLIDE 13

Fraud prevention.

Other stories

Fighting fraud using partially blind signatures. [Facebook Engeneering Blog]

10

slide-14
SLIDE 14

Deprecating 3rd party cookies.

Other stories

Building a more private web: A path towards making third party cookies obsolete. [ ] Chromium Blog

11

slide-15
SLIDE 15

Private medatada

token?

✗

I

𝒝

12

slide-16
SLIDE 16

Private medatada

I

token? … request, σ(b) σ(b) b

𝒝

13

slide-17
SLIDE 17

The (formal) problem

σ ← ⟨U(pp, t), I(sk, b)⟩ Issuance protocol: Redemption algorithm: {0, 1, ⊥} ← V(sk, t, σ)

14

slide-18
SLIDE 18

Security notions

Unlinkability

𝒝

U1

⋮

U2 Un

15

slide-19
SLIDE 19

Security notions

Unlinkability

𝒝

U1

⋮

(t , σ )

i i

i

U2 Un

15

slide-20
SLIDE 20

Security notions

Unlinkability One-more unforgeability

I

𝒝

(t , σ )

i i i=1 ℓ+1

16

slide-21
SLIDE 21

Security notions

Unlinkability One-more unforgeability

I

𝒝

(t , σ )

i i i=1 ℓ+1

⋮ (ℓ) (1)

16

slide-22
SLIDE 22

Security Notions

Unnlinkability One-more unforgeability Privacy of the metadata bit

I(sk, b=0) I(sk, b=1) ≡

ind.

17

slide-23
SLIDE 23

Standardization

W3C: Trust Token API

fetch('https://iacr.org/.well-known/trust-token', { trustToken: { type: 'token-request', issuer: 'ens.fr' } }); 1 2 3 4 5 6

[Example derived from the .]

  • riginal proposal

18

slide-24
SLIDE 24

Standardization

W3C: Trust Token API

fetch('https://iacr.org/.well-known/trust-token', { trustToken: { type: 'token-request', issuer: 'ens.fr' } }); 1 2 3 4 5 6

[Example derived from the .]

  • riginal proposal

fetch('https://eprint.iacr.org/2020/072.pdf', { trustToken: { type: 'raw-token-redemption', issuer: 'ens.fr' } }); 1 2 3 4 5 6

18

slide-25
SLIDE 25

Standardization

W3C: Trust Token API IETF: Privacy Pass draft

fetch('https://iacr.org/.well-known/trust-token', { trustToken: { type: 'token-request', issuer: 'ens.fr' } }); 1 2 3 4 5 6

[Example derived from the .]

  • riginal proposal

fetch('https://eprint.iacr.org/2020/072.pdf', { trustToken: { type: 'raw-token-redemption', issuer: 'ens.fr' } }); 1 2 3 4 5 6

  • 1. Introduction

In some situations, it may only be necessary to check that a clien has been previously authorized by a service; without learning any

  • ther information. Such lightweight authorization mechanisms can

useful in quickly assessing the reputation of a client in latency- sensitive communication.

[Draft ] version 00

18

slide-26
SLIDE 26

Our contribution

19

slide-27
SLIDE 27

Our contribution

Formalization of Anonymous Tokens;

19

slide-28
SLIDE 28

Our contribution

Formalization of Anonymous Tokens; Private Medatada extension;

19

slide-29
SLIDE 29

Our contribution

Formalization of Anonymous Tokens; Private Medatada extension; New techniques for removal of zk proofs.

19

slide-30
SLIDE 30

Our contribution

Formalization of Anonymous Tokens; Private Medatada extension; New techniques for removal of zk proofs.

19

slide-31
SLIDE 31

Our contribution

Formalization of Anonymous Tokens; Private Medatada extension; New techniques for removal of zk proofs.

19

slide-32
SLIDE 32

Related works

20

slide-33
SLIDE 33

Related works

Anonymous Credentials

20

slide-34
SLIDE 34

Related works

Anonymous Credentials Algebraic MACs

20

slide-35
SLIDE 35

Related works

Anonymous Credentials Algebraic MACs Blind Singatures

20

slide-36
SLIDE 36

Privacy Pass

User Issuer

21

slide-37
SLIDE 37

Privacy Pass

User Issuer

Γ := (p, G, G) X = xG

21

slide-38
SLIDE 38

Privacy Pass

T ′

User Issuer

Γ := (p, G, G) r ← Zp

∗

T :

′ = r

H(t)

−1

X = xG

21

slide-39
SLIDE 39

Privacy Pass

W :

′ = xT ′

T ′ W ′

User Issuer

Γ := (p, G, G) r ← Zp

∗

T :

′ = r

H(t)

−1

W := rW ′ X = xG

21

slide-40
SLIDE 40

Privacy Pass

W :

′ = xT ′

T ′ W ′

redemption ⋯ ⋯ t, W

  • 1. check xH(t) = W
  • 2. add to spent tokens.

t

User Issuer

Γ := (p, G, G) r ← Zp

∗

T :

′ = r

H(t)

−1

W := rW ′ X = xG

21

slide-41
SLIDE 41

π := zkp x = { [G T ′] [ X W ′]}

, π check π

Privacy Pass

W :

′ = xT ′

T ′ W ′

redemption ⋯ ⋯ t, W

  • 1. check
  • 2. add to spent tokens.

xH(t) = W t

User Issuer

Γ := (p, G, G) r ← Zp

∗

T :

′ = r

H(t)

−1

W := rW ′ X = xG

22

slide-42
SLIDE 42

π := zkp x = {

b [G

T ′] [Xb W ′]}

W :

′ = x T b ′

X = x G, b ∈

b

{0, 1}

  • 1. check s.t.
  • 2. add to spent tokens.

b x H(t) =

b

W t

Private metadata?

, π check π T ′ W ′

redemption ⋯ ⋯ t, W

User Issuer

Γ := (p, G, G) r ← Zp

∗

T :

′ = r

H(t)

−1

W := rW ′

23

slide-43
SLIDE 43

Attack

r, s ← Zp

∗

T :

′ = r

H(t)

−1

S :

′ = s

H(t)

−1

W :

′ = x T ′

Adversary Issuer

T ′ X =

b

x G, b ∈

b

{0, 1} Γ := (p, G, G) S′ V :

′ = x S 1 ′

24

slide-44
SLIDE 44

Attack

r, s ← Zp

∗

T :

′ = r

H(t)

−1

S :

′ = s

H(t)

−1

W :

′ = x T ′

Adversary

rW ′ =

? sV ′

Issuer

T ′ W ′ X =

b

x G, b ∈

b

{0, 1} Γ := (p, G, G) S′ V :

′ = x S 1 ′

V ′

24

slide-45
SLIDE 45

W := xT +

′

yS′ T ′ s ← {0, 1} ; S :

λ ′ = H(T , s) ′

X = xG + yH

Privacy Pass variant

User Issuer

Γ := (p, G, G, H) r ← Zp

∗

T :

′ = r

H(t)

−1

25

slide-46
SLIDE 46

W := xT +

′

yS′ W := rW ′ S := rH(T , s)

′

T ′ s, W ′, π s ← {0, 1} ; S :

λ ′ = H(T , s) ′

X = xG + yH

redemption ⋯ ⋯ t, S, W

  • 1. check xH(t) + yS = W
  • 2. add to spent tokens.

t

Privacy Pass variant

User Issuer

Γ := (p, G, G, H) r ← Zp

∗

T :

′ = r

H(t)

−1

25

slide-47
SLIDE 47

W := xT +

′

yS′

π := zkp x + y = { [G T ′] [H S′] [ X W ′]}

W := rW ′ S := rH(T , s)

′

check π T ′ s, W ′, π s ← {0, 1} ; S :

λ ′ = H(T , s) ′

X = xG + yH

redemption ⋯ ⋯ t, S, W

  • 1. check xH(t) + yS = W
  • 2. add to spent tokens.

t

Privacy Pass variant

User Issuer

Γ := (p, G, G, H) r ← Zp

∗

T :

′ = r

H(t)

−1

25

slide-48
SLIDE 48

π := zkp x + y = {

b [G

T ′]

b [H

S′] [Xb W ′]}

W := rW ′ S := rH(T , s)

′

check π T ′ s, W ′, π X =

b

x G +

b

y H, b ∈

b

{0, 1}

redemption ⋯ ⋯ t, S, W

  • 1. check s.t.
  • 2. add to spent tokens.

b x H(t) +

b

y S =

b

W t

Private metadata

User Issuer

Γ := (p, G, G, H) r ← Zp

∗

T :

′ = r

H(t)

−1

W := x T +

b ′

y S

b ′

s ← {0, 1} ; S :

λ ′ = H(T , s) ′

26

slide-49
SLIDE 49

, π

Removing the zk proof

W :

′ = xT ′

T ′ W ′

redemption ⋯ ⋯ t, W

  • 1. check
  • 2. add to spent tokens.

xH(t) = W t

User Issuer

Γ := (p, G, G) r, ρ ← Zp

∗

T :

′ = r(H(t) − ρG)

W := r W +

−1 ′

ρX X = xG

27

slide-50
SLIDE 50

Concrete security

28

slide-51
SLIDE 51

Concrete security

One-more Diffie-Hellman is not extensively studied;

28

slide-52
SLIDE 52

Concrete security

One-more Diffie-Hellman is not extensively studied; Token Hijacking;

28

slide-53
SLIDE 53

Concrete security

One-more Diffie-Hellman is not extensively studied; Token Hijacking; Engeneering issues.

28

slide-54
SLIDE 54

Implementation

#[test] fn it_works() { let mut csrng = rand::rngs::OsRng; // generate a keypair let keypair = KeyPair::generate(&mut csrng); // get the public parameters let pp = PublicParams::from(&keypair); // client's first message (the blinded token) let blinded_token = pp.generate_token(&mut csrng); // server's reponse (the signed token) with hidden metadata bit 0 let signed_token = keypair.sign(&mut csrng, &blinded_token.to_bytes(), 0); // clien'ts unbliding (the final token) let token = blinded_token.unblind(signed_token); assert!(token.is_ok()); // verification of the token assert!(keypair.verify(&token.unwrap()).is_ok()); }

In Rust, using curve25519-dalek::Ristretto.

Check out for fancy stats. [benchmarks report]

29

slide-55
SLIDE 55

Future directions

30

slide-56
SLIDE 56

Future directions

public metadata

30

slide-57
SLIDE 57

Future directions

public metadata public verifiability blind BLS blind Okamoto-Schnorr? :( broken

30

slide-58
SLIDE 58

Future directions

public metadata public verifiability blind BLS blind Okamoto-Schnorr? :( broken batching proofs

30

slide-59
SLIDE 59

Future directions

public metadata public verifiability blind BLS blind Okamoto-Schnorr? :( broken batching proofs

30

slide-60
SLIDE 60

Future directions

public metadata public verifiability blind BLS blind Okamoto-Schnorr? :( broken batching proofs

30

slide-61
SLIDE 61

Future directions

public metadata public verifiability blind BLS blind Okamoto-Schnorr? :( broken batching proofs

30