Efficient Constructions of Bilinear Accumulators Ioanna - - PowerPoint PPT Presentation
Efficient Constructions of Bilinear Accumulators Ioanna Karantaidou, Foteini Baldimtsi Set Me Membership ip Bank, GMU, subscription- based service, etc Alice List of members I am Alice ce ... List of members as a Data structure
List of members ... Alice ... ... Bank, GMU, subscription- based service, etc
I am Alice ce
Alice
List of members as a Data structure
lookups depends on n
holder/membership verification in a privacy preserving way: Expensive!
VERIFIER MANAGER Set S
Acc.v
Initialize & Create Acc.v Accumulator Value: holds Set S
VERIFIER MANAGER Set S
Acc.v
User x Wx UpdateAlg update message x Add(x) Update Acc.v
VERIFIER MANAGER Set S
Acc.v
User x Wx UpdateAlg Wx access/service update message x Add(x) Update Acc.v Accumulator value size: O(1) Witness size: O(1) UpdateAlg: O(1) Membership Verification time: O(1)
... Alice ... Charlie Alice
Accumulator acc
Verification algorithm:VerMem(π₯π¦)
π¦ β πππ β VerMem(π₯π¦)=1 π¦ β πππ β VerMem(π₯π¦)=0 (or =1 with negligible prob.) Set/List
Verification=lookup
Alice is a member β verification Bob is not a member β verification
RSA based accumulators [CL02, LLX07, BdM93]
Bilinear Pairing based accumulators [N05, CKS09, ATSM09, ZKP17]
(sk)
User x
Set S
Add(x) π₯π¦ = π π¦1+π‘π β¦ π¦π+π‘π upmsg
π΅ππ. π€ = π π¦1+π‘π β¦ π¦π+π‘π (π+π‘π) π₯π¦ = π π¦1+π‘π β¦ π¦π+π‘π
π₯π¦ = π΅ππ. π€(π¦+π‘π)β1 π₯π¦
(π¦+π‘π)
= π΅ππ. π€ Public parameters: π, ππ‘π , (ππ‘π)2, (ππ‘π)3, β¦ β π₯π¦
(π¦+π‘π)
e(ππ, ππ πππ )=e(π©π π . π , π) (VerMem) Public parameters: π, ππ‘π ,(ππ‘π)2, (ππ‘π)3,β¦β ππ¦ , ππ‘π
(sk)
User x
Set S
Del(x) upmsg
Minimum communication bound (on update messages) for positive accumulators= |d| (number of deletions)
Camacho, Philippe, and Alejandro
update for cryptographic accumulators." International Conference on Cryptology and Information Security in Latin America. Springer, Berlin, Heidelberg, 2010.
(sk)
User x Add(x) π₯π¦ = ππ£ (π+π‘π)β1
Del(x) upmsg
(sk)
User x Add(x) π₯π¦ = ππ£ (π+π‘π)β1
Del(x) upmsg
Proof overview:
q-SDH: Given (p, π», π»π, π, π), {ππ‘π}π,π = 0, β¦ , π there is negligible probability of finding π
1 π‘π+π¦ for π¦ β β€π
Proof overview:
(x,r) in A- sound positive additive acc r in NA- sound positive dynamic acc A-sound positive dynamic acc
Baldimtsi, Foteini, et al. "Accumulators with applications to anonymity-preserving revocation." 2017 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2017.
pseudorandom function
Communication cost= |d| Optimal! No updates for positive accumulator that supports additions only
(x,r) in A- sound positive additive acc r in NA- sound positive dynamic acc A-sound positive dynamic acc
Positive Camenisch et al 09 Nguyen 05 this work (NA- sound) this work (A- sound) Add 1 1 1 1 Del 1 1 1 1 MemWitCreate 1 1 1 1 NonMemWitCreate
1 1 MemWitUpOnDel 1 1 1 1 NonMemWitUpOnAd d
l
1 1 1 1 VerNonMem
1 1 1 1 Parameters 2q q q q
|a|+|d| |a|+|d| |d| |d| Efficient ZKPs β β β β Adaptively-sound β β β
Accumulator acc
NM verification algorithm: VerNonMem(π₯π¦)
π¦ β πππ β VerNonMem(π₯π¦)=1 π¦ β πππ β VerNonMem(π₯π¦)=0 (or =1 with negligible prob.) Set/List
NM verification=lookup
Bob is not a member β NM verification Alice is a member β NM verification
Charlie Alice ... Alice ...
Users (public parameters): S={π¦π}, polynomial division Manager (sk): Οπ=1
|S| (π¦π+π‘π) β β€, used as exponent
a (Οπ=1
|S| π§π) + π π§ = 1
Users (public parameters)/Manager (sk): Οπ=1
|S| π§π β β€, Euclidean algorithm
Bilinear ATSM09, S={π¦π}, π¦π β β€π RSA LLX07, S={π§π}, π§π primes
Users (public parameters): S={π¦π}, polynomial division Manager (sk): Οπ=1
|S| (π¦π+π‘π) β β€, used as exponent
a (Οπ=1
|S| π§π) + π π§ = 1
Users (public parameters)/Manager (sk): Οπ=1
|S| π§π β β€, Euclidean algorithm
Bilinear ATSM09, S={π¦π}, π¦π β β€π RSA LLX07, S={π§π}, π§π primes
non-membership cost: |S|
Can we replace non-membership with constant-runtime membership?? Yes, with a trusted manager
A-sound positive dynamic acc for S A-sound positive dynamic acc for D-S A-sound universal dynamic acc for S
Can we make sure that π΅π·π·1and π΅π·π·2 are disjoint? The accumulator manager always signs the most up to date value of the accumulator
π©π«π«π π©π«π«π
(sk)
(sk) User x Add(x) π₯π¦ = π΅π·π·1.π₯
π©π«π«π (π»π) π©π«π«π (π»π) π¦ β π2 π©π«π«π (π»πΪ{π}) π©π«π«π (π»π β {π})
π©π«π«π. πππ(π²) π©π«π«π. πππ¦(π²)
(sk) User x Del(x) π₯π¦ = π΅π·π·2. π₯
π©π«π«π (π»π) π©π«π«π (π»π) π¦ β π1 π©π«π«π (π»πΪ{π}) π©π«π«π (π»π β {π})
π©π«π«π. πππ¦(π²) π©π«π«π. πππ(π²)
π₯ ππππππ π‘βππ π₯ (non-membership)
User x π₯π¦
VERIFIER π©π«π«π.πππ¬πππ§(π±π²) π©π«π«π.πππ¬πππ§(π₯π§)
π₯π§ User y
Note on Efficiency Concretes:
to Domain size
Asymptotics: All operations constant, independent of accumulated set S
Theorem: A combination of accumulators π΅π·π·1, π΅π·π·2 is a universal dynamic adaptively-sound accumulator if π΅π·π·1, π΅π·π·2 are positive dynamic adaptively-sound accumulators of domain D and one is holding SβD and the other one π βD and public updates are not permitted.
Theorem: A combination of accumulators π΅π·π·1, π΅π·π·2 is a universal dynamic adaptively-sound accumulator if π΅π·π·1, π΅π·π·2 are positive dynamic adaptively-sound accumulators of domain D and one is holding SβD and the other one π βD and public updates are not permitted.
INTUITION: Information obtained by 2 accumulators with the same instantiation could be obtained by different states of 1 accumulator
Theorem: A combination of accumulators π΅π·π·1, π΅π·π·2 is a universal dynamic adaptively-sound accumulator if π΅π·π·1, π΅π·π·2 are positive dynamic adaptively-sound accumulators of domain D and one is holding SβD and the other one π βD and public updates are not permitted.
INTUITION: Information obtained by 2 accumulators with the same instantiation could be obtained by different states of 1 accumulator PROOF: R has access to Add/Del oracle. A breaks ACC=(π΅π·π·1, π΅π·π·2) soundness. R breaks π΅π·π·1 (positive) soundness
Positive Universal Camenischet al 09 Nguyen 05 this work (A- sound) Au et al 09 This work- Instantiation with Nguyen 05 Add 1 1 1 1 1 Del 1 1 1 1 1 MemWitCreate 1 1 1 1 1 NonMemWitCreate
1 MemWitUpOnAdd 1 1 1 1 MemWitUpOnDel 1 1 1 1 1 NonMemWitUpOnAdd
1 NonMemWitUpOnDel
1 VerMem 1 1 1 1 1 VerNonMem
1 Manager storage 1 1 1 |S| 1 Parameters 2q q q q q?
|a|+|d| |a|+|d| |d| |a|+|d| |a|+|d| Efficient ZKPs β β β β β Adaptively-sound β β β β β
Esha Ghosh , Olga Ohrimenko , Dimitrios Papadopoulos , Roberto Tamassia and Nikos Triandopoulos "Zero-Knowledge Accumulators and Set Operations" IACR Cryptology ePrint Archive 2015 (2015): 404.
MANAGER
Acc.v Member/non- member, witness x?
Adv
MANAGER
Member/non- member, witness x?
Goal:
answers How:
Adv
Acc.v
adversary
accumulator is managed by a trusted entity
harms efficiency
MANAGER
Acc.v=ππ (π¦1+π‘π)(π¦2+π‘π)
S = {π¦1, π¦2}
Acc.v=ππ πβ²(π¦1+π‘π)(π¦2+π‘π)(π+π‘π)
S = {π¦1, π¦2, π}
Add(x) Public parameters: π, ππ‘π ,(ππ‘π)2,(ππ‘π)3,β¦ π = {π¦1, π¦2} πππ. π€ = π(π¦1+π‘π)(π¦2+π‘π) = ππ¦1π¦2+(π¦1+π¦2)π‘π+π‘π2 = ππ¦1π¦2(ππ‘π)π¦1+π¦2(ππ‘π)2
MANAGER
Acc.v=ππ (π¦1+π‘π)(π¦2+π‘π)
S = {π¦1, π¦2}
Acc.v=ππ πβ²(π¦1+π‘π)(π¦2+π‘π)(π+π‘π)
Sβ² = {π¦1, π¦2, π}
auxβ={rrβ}
Set S (aux=r)
Add(x)
ππ£ ππ π£
Users (public parameters): S={π¦π}, polynomial division Manager (sk): Οπ=1
|S| (π¦π+π‘π) β β€, used as exponent
Bilinear ATSM09, S={π¦π}, π¦π β β€π
π β© {π¦} β β π₯π§ = π
1, π 2 = (π(π1 π‘π +πΏ(π§+π‘π)) πβ1, ππ2 π‘π βπΏ Οπ=1
S (π¦π+π‘π) )
π π
1, π©π π . π π π 2,ππ¦ππ‘π = π(π, π)
π β© {π¦} β β π₯π§ = π
1, π 2 = (π(π1 π‘π +πΉ(π§+π‘π)) π β1, ππ2 π‘π βπΉ Οπ=1
S (π¦π+π‘π) )
π π
1, π΅ππ. π€ π π 2, ππ¦ππ‘π = π(π, π)
Add query/witness specific randomness
π β© {π¦} β β π₯π§ = π
1, π 2 = (π(π1 π‘π +πΉ(π§+π‘π)) π β1, ππ2 π‘π βπΉ Οπ=1
S (π¦π+π‘π) )
π π
1, π΅ππ. π€ π π 2, ππ¦ππ‘π = π(π, π)
Add query/witness specific randomness
π β© {π¦} β β π₯π§ = π
1, π 2 = (π(π1 π‘π +πΉ(π§+π‘π)) π β1, ππ2 π‘π βπΉ Οπ=1
S (π¦π+π‘π) )
π π
1, π΅ππ. π€ π π 2, ππ¦ππ‘π = π(π, π)
Add query/witness specific randomness
Solution: instantiate our generic modular universal construction with ZK accumulators with membership operations Result: Non-membership witness creation, Non- membership witness update: O(1)