Attribute-Based Signatures for Unbounded Languages from Standard - - PowerPoint PPT Presentation

▶
attribute based signatures for unbounded languages from
SMART_READER_LITE
LIVE PREVIEW

Attribute-Based Signatures for Unbounded Languages from Standard - - PowerPoint PPT Presentation

Oct 16, 2023 543 likes •940 views

Attribute-Based Signatures for Unbounded Languages from Standard Assumptions Yusuke Sakai (AIST, Japan) Shuichi Katsumata (AIST, Japan / U. Tokyo, Japan) Nuttapong Attrapadung (AIST, Japan) Goichiro Hanaoka (AIST, Japan) 1 Our Contribution

slide-1
SLIDE 1

Attribute-Based Signatures for Unbounded Languages from Standard Assumptions

Yusuke Sakai (AIST, Japan) Shuichi Katsumata (AIST, Japan / U. Tokyo, Japan) Nuttapong Attrapadung (AIST, Japan) Goichiro Hanaoka (AIST, Japan)

1

slide-2
SLIDE 2

Our Contribution

  • Propose attribute-based signature scheme for

Turing machines

– A key-policy variant – The policy is described by a Turing machine (TM) – The attribute is an input to a TM

2

The scheme allows policies that accept unbounded inputs!

slide-3
SLIDE 3

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

3

slide-4
SLIDE 4

Attribute-Based Signatures (ABS)

skP skPʹ skP P

4

a b c d e

q

slide-5
SLIDE 5

Attribute-Based Signatures

skP skPʹ skx x σ ß AttrSign(pp,skP,M,x)

5

a b c d e

q

x=x1x2x3…

slide-6
SLIDE 6

Attribute-Based Signatures

skP skPʹ skx x M, x, σ 1/0 ß AttrVerify(pp,M,x,σ) σ is made by someone whose policy P satisfy P(x) = 1

6

x=x1x2x3…

slide-7
SLIDE 7

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

7

slide-8
SLIDE 8

Anonymity

skP skPʹ skx x M, x, σ Cannot tell who made σ among signers who satisfy P(x) = 1

8

slide-9
SLIDE 9

Unforgeability

skP skx x M, x, σ Cannot make valid σ if P(x) = 0 skPʹ

9

slide-10
SLIDE 10

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

10

slide-11
SLIDE 11

Certificate Approach (1/2)

skP = θP = Sign(msk, P) skPʹ = θPʹ = Sign(msk, Pʹ) skP x msk

11

Each signer receives a signature on his policy

slide-12
SLIDE 12

Certificate Approach (2/2)

skP x msk M, x, σ

12

skP = θP = Sign(msk, P) skPʹ = θPʹ = Sign(msk, Pʹ)

Prove knowledge of (P, θ): (1) Verify(P, θ) = 1 (2) P(x) = 1

slide-13
SLIDE 13

Difficulty

  • How to prove the complex condition

P(x) = 1

– Remind that P is a Turing machine

  • General zero-knowledge is inefficient,

so we will decompose the statement

13

! ? ?

Prove knowledge of (P, θP): (1) Verify(P, θx) = 1 (2) P(x) = 1

slide-14
SLIDE 14

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

14

slide-15
SLIDE 15

Idea: History of Computation

  • While a TM’s computation is complex, the

computation proceeds sequentially

  • The computation defines a sequence of

“snapshots” of the machine

15

w1 w2 w3 w4 w5

q0

slide-16
SLIDE 16

Idea: History of Computation

  • While a TM’s computation is complex, the

computation proceeds sequentially

  • The computation defines a sequence of

“snapshots” of the machine

16

w1 w2 w3 w4 w5

q0

wʹ1 w2 w3 w4 w5

q1

slide-17
SLIDE 17

Idea: History of Computation

  • While a TM’s computation is complex, the

computation proceeds sequentially

  • The computation defines a sequence of

“snapshots” of the machine

17

w1 w2 w3 w4 w5

q0

wʹ1 w2 w3 w4 w5

q1

wʹ1 wʹ2 w3 w4 w5

q2

slide-18
SLIDE 18

Idea: History of Computation

  • While a TM’s computation is complex, the

computation proceeds sequentially

  • The computation defines a sequence of

“snapshots” of the machine

18

w1 w2 w3 w4 w5

q0

wʹ1 w2 w3 w4 w5

q1

wʹ1 wʹ2 w3 w4 w5

q2

…

slide-19
SLIDE 19

Implement the Certificate Approach

  • Using the sequence of the snapshot (s1, …, sT)

we can rephrase the proof as follows:

  • To enforce validity of transition, the KGC signs
  • n all possible valid transition:

θ[s,sʹ] ß Sign(msk, (s,sʹ)) ∀s à sʹ: valid transition

19

Prove knowledge of (s1, …, sT): (1) si → si+1 follows the transition function

slide-20
SLIDE 20

Signing Every Possible Transition

20

s0: s1: s2:

valid transition valid transition

Prove knowledge of (s0, s1, θ1): Verify(vk, (s0, s1), θ1) = 1

slide-21
SLIDE 21

Signing Every Possible Transition

21

s0: s1: s2:

valid transition valid transition

Prove knowledge of (s0, s1, θ1): Verify(vk, (s0, s1), θ1) = 1 Prove knowledge of (s1, s2, θ2): Verify(vk, (s1, s2), θ2) = 1

slide-22
SLIDE 22

Signing Every Possible Transition

22

s0: s1: s2:

valid transition valid transition

Prove knowledge of (s1, …, sT, θ1, …, θT): (1) Verify((si-1,si), θi) = 1

slide-23
SLIDE 23

Main Difficulty

  • Possible pairs of snapshots are infinitely many,

– since snapshots have unbounded lengths

  • We further decompose this condition

23

Prove knowledge of (s1, …, sT, θ1, …, θT): (1) Verify((si-1,si), θi) = 1

slide-24
SLIDE 24

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

24

slide-25
SLIDE 25

Configuration

  • A snapshot is encoded into a single string,

configuration

  • Consists of (1) the content of the tape

interleaved with (2) the state symbol q

– the position of q encodes the position of the head

25

w1 w2 w3 w4 w5

q

… w1 w2 q w3 w4 w5 …

slide-26
SLIDE 26

Locality of Rewriting

  • Each symbol in a new configuration is

determined by neighbors in the old configuration

  • Four neighbors are sufficient for any case

26

w1 w5 w4 w3 q w2 step t: w1 w5 w4 wʹ3 w2 qʹ step t+1:

slide-27
SLIDE 27

The General Cases

  • Each cell will be determined by the four

neighbors in the old configuration

27

a b c d Case 1 a b c d b c d e Case 2 b c d qÕ c d e q Case 3 c d qÕ e d e q x Case 4 d qÕ e xÕ e q x f Case 5 qÕ e xÕ f q x f g Case 6 e xÕ f g

a b c d e q x f g a b c d qÕ e xÕ f g

Case 1 Case 2 Case 3 Case 4 Case 5 Case 6

new:

  • ld:
slide-28
SLIDE 28

Enforcing Validity of Transition

  • To enforce validity of transition

KGC signs on every valid 5-tuple: θ[w1, w2, w3, w4, u] ß Sign(msk, (w1, w2, w3, w4, u))

  • The signer proves the knowledge of signature

for every symbol in the new configuration

28

w1 w3 w4 w2 u

w1 w5 w4 w3 q w2 w1 w5 w4 wʹ3 w2 qʹ

  • ld:

new:

slide-29
SLIDE 29

Enforcing Validity of Transition

  • To enforce validity of transition

KGC signs on every valid 5-tuple: θ[w1, w2, w3, w4, u] ß Sign(msk, (w1, w2, w3, w4, u))

  • The signer proves the knowledge of θ

for every symbol in the new configuration

29

w1 w3 w4 w2 u

w1 w5 w4 w3 q w2 w1 w5 w4 wʹ3 w2 qʹ

  • ld:

new:

Prove knowledge of (w1, w2, q, w3, qʹ, θ1): Verify(vk, (w1, w2, q, w3, qʹ), θ1) = 1

slide-30
SLIDE 30

Enforcing Validity of Transition

  • To enforce validity of transition

KGC signs on every valid 5-tuple: θ[w1, w2, w3, w4, u] ß Sign(msk, (w1, w2, w3, w4, u))

  • The signer proves the knowledge of θ

for every symbol in the new configuration

30

w1 w3 w4 w2 u

w1 w5 w4 w3 q w2 w1 w5 w4 wʹ3 w2 qʹ

  • ld:

new:

Prove knowledge of (w2, q, w3, w4, w2, θ2): Verify(vk, (w2, q, w3, w4, w2), θ2) = 1

slide-31
SLIDE 31

Enforcing Validity of Transition

  • To enforce validity of transition

KGC signs on every valid 5-tuple: θ[w1, w2, w3, w4, u] ß Sign(msk, (w1, w2, w3, w4, u))

  • The signer proves the knowledge of θ

for every symbol in the new configuration

31

w1 w3 w4 w2 u

w1 w5 w4 w3 q w2 w1 w5 w4 wʹ3 w2 qʹ

  • ld:

new:

Prove knowledge of (q, w3, w4, w5, wʹ3, θ3): Verify(vk, (q, w3, w4, w5, wʹ3), θ3) = 1

slide-32
SLIDE 32

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

32

slide-33
SLIDE 33

Putting All Together

  • Proves the knowledge of signatures on the

neighbors (quadratic in running time of TM)

  • Every symbol is hidden as a witness

33

w1 w2 w3 w4 wʹ5 w6 w7 w8 w9 w10 q2 w1 w2 w3 w4 q1 w6 w7 w8 w9 w10 w5 w1 w2 w3 w4 q3 wʹʹ6 w7 w8 w9 w10 wʹ5 w1 w2 w3 q4 w4 w6 w7 w8 w9 w10 wʹʹ5

Verify((wʹ5, q2, w6, w7, wʹ5), θ) = 1

slide-34
SLIDE 34

The Scheme

  • Setup:

– crs ß CRSGen(1k), (vk, sk) ß SigKg(1k)

  • KeyGen:

– for every valid 5-tuple (w1, w2, w3, w4, u):

  • θ[w1, w2, w3, w4, u] ß SigSign(sk, (w1, w2, w3, w4, u))
  • Sign: {wi,j}i,j: 2D arrangement of configurations

– πi,j ß Prove(crs, (wi-1,j-2, wi-1,j-1,, wi-1,j, wi+1,j, wi,j, θ))

  • Verify: for all (i,j) verify πi,j

34

w1 w3 w4 w2 u

slide-35
SLIDE 35

Main Theorem

35

Theorem If the non-interactive proof system is witness-indistinguishable and extractable, the signature scheme is unforgeable, the proposed scheme is anonymous and unforgeable Theorem If SXDH assumption holds, the proposed scheme satisfies anonymity and unforgeability

Instantiate this with GS proofs in SXDH setting and structure-preserving signatures

!

slide-36
SLIDE 36

Efficiency

36

|Γ|: The size of the tape alphabet T: The running time of the TM Signing key length Signature length Verification time O(|Γ|4) O(T2) O(T2)

  • The scheme is reasonably efficient!
slide-37
SLIDE 37

Agenda

  • Attribute-Based Signatures
  • Security Requirement
  • Certificate Approach
  • Idea 1: History of Computation
  • Idea 2: Locality of Rewriting
  • Overview of the Scheme
  • Conclusion

37

slide-38
SLIDE 38

Summary

  • Proposed attribute-based signature scheme

for unbounded languages (Turing machines)

– Uniform model of computation as the policy – No bound on the sizes of both TMs and attributes – Can be instantiated from the SXDH assumption in bilinear groups

38