CS 134 CS 134 Wi Winter 2016 Anonymity Applica cation Example: - PowerPoint PPT Presentation

CS 134 CS 134 Wi Winter 2016 Anonymity Applica cation Example: Elect ctronic c Cash (E-Cash) and Bitco coin 1

Motivation For E-Cash Conventional Cash is: • Counterfeitable • Slow • Costly • Vulnerable • Bad for Remote Transactions 2

Credit Cards, Bank Cards, Checks, and Phone/Subway cards: Easy Fraud Little Privacy 3

Off-line Electronic Cash is for 2-Party (Payer à Payee) Payment Withdrawal Payment Deposit • Low Communication Requirements 4

In Contrast, On-line Payments: “ OK ” 5

E-Cash in 1970s Stephen Wiesner‘s (graduate student at Columbia) paper “Conjugate Coding • and Quantum Money” sent in 1970 to IEEE Transactions on Information Theory Paper immediately rejected • Published in 1983 as is in ACM SIGACT • Proposed design of unforgaeble bank notes based on quantum properties • Influenced Quantum (Cryptographic) Key Distribution (QKD) •

E-Cash in 1980s and 1990s Chaum’s “Blind Signatures for Untraceable Payments” paper is the • first to propose (realizable) E-Cash using blind digital signatures Based on RSA (Rivest Shamir and Adelman) signatures • 1990s 1970s 2000s RSA breaks if one can factor large composite numbers (100s of • decimal digits, 1000s of bits) DigiCash (anonymous ecash) launched by Chaum in 1990. • DigiCash declared bankruptcy in 1998.

Requirements for Anonymous Payments (afterwards known as E-Cash) From Chaum’s “Blind Signatures for Untraceable Payments” paper: Unlinkability: third parties can not determine payee (amount • and time of payment) Provability: individuals can provide (unforgaeble) proof of • payment, or determine identity of payee under exceptional circumstance (e.g., by courts) Revocation: revoke stolen coins or payment media •

Anonymous Payments user 1 user 2

Anonymous Payments user 1 user 2

Anonymous Payments withdraw coins user 1 withdraw coins user 2

Anonymous Payments user 1 user 2

Anonymous Payments transfer coins user 2

Anonymous Payments Was it user 1 or user 2? user 2

Overspending: Problem with Off-line E-Cash Step 1: The bad user copies his money 15

Step 2: The bad user gives copied cash to multiple people 16

!!! The Bank is aware of trouble only later 17

Techniques to Contain Over-Spending Use tamper-resistant hardware to prevent over- 1. spending (e.g., MONDEX in Europe) Trace over-spenders 2. Blacklist over-spenders 3. Put a bound on dollar-value for off-line transactions 4. 18

Tracing be used to fight big-time international crime But, tracing could be abused on many levels 19

Minting the Money/Coins Secret Minting Key to Create Coins (Signatures) Heart of Each Coin is a Digital Signature Public Verification Key to Recognize Coins 20

Minting a Conventional Coin E-Cash Withdrawer The Mint SN= SN= 12345 12345 SN = SN = 12345 12345 BankSig BankSig 21

Without Anonymity Mint Knows Serial Number E-Cash $1 signing key Withdrawer The Mint One Dollar SN 12345 22

Minting an Untraceable Coin E-Cash User The Mint SN= 12345 SN = 12345 BankSig BankSig BankSig 23

Blind Signing is (Like) Signing Through a Veil E-Cash $1 signing key Withdrawer The Mint One Dollar 24

Minting a Trustee-Traceable Coin E-Cash User The Mint SN= 12345 SN = 12345 BankSig BankSig BankSig 25

Escrowing Trustee-Traceable Coins Trustee 1 E-Cash User escrow key1 escrow key2 Trustee 2 SN= 12345 26

Recall: Cryptographic Assumptions Infeasible Tasks 1. Factoring. Given a number N = pq, find p and q primes of at least 2048 bits 1a. RSA assumption . Given exponent e and m e (mod N), find m 27

Recall: Cryptographic Assumptions Infeasible Tasks (continued) of at least 2048 bits 2. Discrete log . Given a prime p, a generator g, and g x (mod p), find x 28

Example of Coin Minting Public Information: N -- Large Composite Number H() -- Cryptographic hash function Private Minting Information: Key = p,q prime numbers such that N=pq A coin has the form: (x,H(x) d mod N), 1 < x < N 29

Minting a Conventional Coin with RSA (Traceable) E-Cash User The Mint x,H(x) x,H(x) x,H(x) d x,H(x) d 30

Anti-counterfeiting Assumption : Without knowing the key, it is difficult to find pre-images that map to the same point H(x) = p,q x H(x) d mod N Where: d = e -1 mod phi(N) 31

Blind (Digital) Signatures Message is blinded (disguised or randomized) before it is signed • Signature can be publicly verified against the original message • (unblinded one) similar to a standard digital signature Typically employed in privacy-preserving protocols where signer • and author of message are different entities Main goal is to provide unlinkability : prevent signer from linking • the blinded message it signs to a later un-blinded version that it may be called upon to verify

Anonymous Payments via Blind Signatures (6) Not sure!? I (to withdraw coins: obtain saw a random Bank’s signature on a coin (m)) value: m’ (1) send blinded coin/message (m’) (6) I got this coin: sig(m) for coin m Was it M? (2) sign coin: sig(m’) (3) unblind the coin to obtain sig(m) (4) transfer coins: sig(m) (5) receive goods or services

Blind Digital Signatures à Payer’s Privacy [Chaum] E-Cash User The Mint chooses random x,r r e H(x) x,H(x) r e H(x) x, H(x) d rH(x) d rH(x) d 34

RSA-based Blind Signatures Public key (e, N) and corresponding private key (d, p, q), such that N =p*q • and e*d = 1 mod Φ(N) Choose a random r coprime to N, i.e., GCD(r, N) = 1. r e mod N is then used • as a blinding factor. (GCD = greatest common divisor) m’ = m * r e mod N ( m’ is random, does not leak any info about m) • m’ is sent to the signing authority who signs it as • s’ = (m’) d mod N = m d * r ed mod N = m d * r mod N • s’ is sent back to the message owner who unblinds it by multiplying by r -1 to • obtain the signature s = m d mod N

Anonymous Payments via RSA-based Blind Signatures (6) Not sure!? I (to withdraw coins: obtain saw a random Bank’s signature on a coin (m)) value: s’ = m d * r modN (1) m’ = m * r e modN (6) I got this coin: s = m d * modN Was it M? (2) s’ = m d * r modN (3) s = s’ * r -1 modN = m d * modN (4) transfer coins: send coin s (5) receive goods or services

Tracing Double-Spenders • p 1 , p 2 : two large prime numbers such that p 2 | p 1 -1 • G: subgroup of Z p 1 such that |G| = p 2 * • g: generator of G • I: the user’s identity (set up by bank), expressed as a number = Coin = (g a mod p 1 , g b mod p 1 , H(g a ,g b ) d mod N) where I = ab mod p 2 37

Tracing Double-Spenders Seller Buyer g a mod p 1 , g b mod p 1 , • verify Bank’s signature H(g a ,g b ) 1/3 k • send random challenge k r r = ak+b • verify g r =(g a ) k g b 38

Tracing Double-Spenders Two Payments with the same coin yield Buyer’s Identity I r = ak + b a,b r’ = ak’ + b ? a?,b? r = ak + b 39

A lot of E-Cash and anonymous payment schemes followed similar blueprints in the 1990s and early 2000s

2009-2016 2009: Bitcoin paper by Satoshi Nakamoto • Pseudonym for individual or a group • 2009-2011: slow start … • 2011-2013: Silk Road and Dread Pirate Roberts • End 2013: Bitcoin price skyrockets • a lot of people notice • 2014-2015: Price drops by 75% • 2016: Price up again •

In 2016 Large Ecosystem Market Capitalization over $4 Billion ($8.2 Billion a year ago) Number of transactions growing steadily

Bitcoin (BTC) Preliminaries Cryptographic Hash Function: a hash function that is hard to • invert, i.e., computationally infeasible to recreate data from hash value alone, e.g., the secure hash algorithm (SHA) Required properties of a Cryptographic Hash Function: • i. easy to compute hash value h( ) of any message m ii. given h(m) it is (computationally) infeasible to recover m iii. infeasible to modify m without h(m) being also modified iv. infeasible to find two different m with same hash (collision resistance) Proof-of-Work Schemes/Protocols: originally invented as an • economic measure to prevent denial-of-service and spam by requiring clients to solve computationally-demanding puzzles, e.g., find a number that has a certain preamble (say 3 zeros) in its hash

Stepping Back Stepping back: most physical and digital currencies today effectively exist in the form of a ledger . Electronic Blockcain in Bitcoin Accounts in Banks (BTC)

Questions Answered by Bitcoin (BTC) How to maintain integrity of a public ledger in a distributed manner (BTC answer: longest chain of verified transactions) How to use such a ledger for transactions (BTC answer: transferring coins via signatures) How to incentivize people to allocate CPU power to ensure integrity of the longest chain (BTC answer: reward with new minted coins when verifying transactions, also called mining)

Bitcoin’s Peer-to-Peer Network A peer-to-peer network without any “central” authority • for ensuring integrity of transactions and keeping track of ownership of (Bit)coins (and minting them) Ledger and history of ALL transactions are public and • available for anyone to inspect