Efficient Redactable Signature and Application to Anonymous - PowerPoint PPT Presentation

Efficient Redactable Signature and Application to Anonymous Credentials Olivier Sanders Orange Labs PKC 2020

Context PKC 2020 – p 2

Digital Signature Digital signature can be used to authenticate digital data ... Name Birthdate Address σ Sign sk not even one bit can be modified PKC 2020 – p 3

Digital Signature Digital signature can be used to authenticate digital data ... Name Birthdate Address σ 0 / 1 Verif pk verification requires knowledge of all signed data PKC 2020 – p 3

Limits of Digital Signature Use Case: One just needs to verify that age ≥ 18 � Efficiency: ✗ ( n messages to send) � Privacy: ✗ (reveals all signed data to the verifier) How to efficiently and privately check that k out of n messages are certified or satisfy some relations? Standard Alternatives: � Alternative 1: 1 signature per message − Efficiency: ∼ ( n signatures to store) − Privacy: ➚ PKC 2020 – p 4

Limits of Digital Signature � Alternative 2: Merkle’s tree − Efficiency: ➚ ( log ( n ) elements to send) − Privacy: ∼ (prevents zero-knowledge proofs) � Alternative 3: proof of knowledge of the n messages − Efficiency: ➘ − Privacy: � ⇒ no satisfying solution PKC 2020 – p 5

Accumulators Solution from [FHS19] 1 ... Name Birthdate Address Sign σ Acc C sk messages are accumulated and then signed 1 Fuchsbauer, Hanser and Slamanig, Structure-preserving signatures on equivalence classes and constant-size anonymous credentials , Journal of Cryptology, 2019 PKC 2020 – p 6

Accumulators Solution from [FHS19] 1 ... Name Birthdate Address Open σ W C a witness W that “birthdate” has been accumulated can be computed 1 Fuchsbauer, Hanser and Slamanig, Structure-preserving signatures on equivalence classes and constant-size anonymous credentials , Journal of Cryptology, 2019 PKC 2020 – p 6

Accumulators Solution from [FHS19] 1 ... 0/1 Name Birthdate Address Open σ Verif W C pk 0/1 AccV Given C , W , σ , one can check that “birthdate” has been signed 1 Fuchsbauer, Hanser and Slamanig, Structure-preserving signatures on equivalence classes and constant-size anonymous credentials , Journal of Cryptology, 2019 PKC 2020 – p 6

Accumulators Assessment of FHS solution (compared to basic signature): � Efficiency: � − O (1) certificate size − O (1) communication complexity 2 − O ( k ) verification complexity � Privacy: ∼ − the k messages must be disclosed, no ability to prove that they satisfy some relations ( e.g. age ≥ 18) ⇒ not fully satisfying 2 excluding the k disclosed messages PKC 2020 – p 7

Unlinkable Redactable Signature Solution from [CDHK15] 3 ... Name Birthdate Address σ Sign sk 1 signature σ on all messages 3 Camenisch, Dubovitskaya, Haralambiev and Kohlweiss, Composable and modular anonymous credentials: Definitions and practical constructions , Asiacrypt, 2015 PKC 2020 – p 8

Unlinkable Redactable Signature Solution from [CDHK15] 3 ... Name Birthdate Address σ σ ′ Deriv pk a signature σ ′ can be derived on a subset of messages 3 Camenisch, Dubovitskaya, Haralambiev and Kohlweiss, Composable and modular anonymous credentials: Definitions and practical constructions , Asiacrypt, 2015 PKC 2020 – p 8

Unlinkable Redactable Signature Solution from [CDHK15] 3 ... Name Birthdate Address σ ′ Deriv pk 0/1 Verif no need to know the redacted messages to check σ ′ 3 Camenisch, Dubovitskaya, Haralambiev and Kohlweiss, Composable and modular anonymous credentials: Definitions and practical constructions , Asiacrypt, 2015 PKC 2020 – p 8

Unlinkable Redactable Signature Assessment of CDHK solution (compared to basic signature): � Efficiency: ➚ − O (1) certificate size − O (1) communication complexity 4 − very large constant − O ( k ) verification complexity � Privacy: ∼ − the k messages must be disclosed, no ability to prove that they satisfy some relations ( e.g. age ≥ 18) − derived signatures can be unlinkable ⇒ not fully satisfying PKC 2020 – p 9 4 excluding the k disclosed messages

Our Contribution PKC 2020 – p 10

Unlinkable Redactable Signature We want an unlinkable redactable signature scheme with: � Efficiency: − short, constant-size (derived) signatures − verification of k out of n messages in O ( k ) � Privacy: − unlinkability: to link signatures derived from the same σ is hard − relations about non-redacted messages can be proved in ZK PKC 2020 – p 11

Pointcheval-Sanders Signature Our starting point: PS signature 5 � use asymmetric bilinear group e : G 1 × G 2 → G T � secret ( x , y 1 , . . . , y n ) and public X = g x , Y i = g y i in G 1 x + � n $ i =1 y i m i � a signature on ( m 1 , . . . , m n ) is � σ 1 ← G 2 and � σ 2 ← � σ 1 � verification: n � Y m i ? e ( g , � σ 2 ) = e ( X , � σ 1 ) i i =1 designed to support proofs of knowledge of m i 5 Pointcheval and Sanders, Short Randomizable Signature , CT-RSA 16 PKC 2020 – p 12

Pointcheval-Sanders Signature � Use Case: V wants to check that a subset { m i } i ∈I of messages is signed and/or satisfies some relations ⇒ messages { m i } i ∈I are redacted, with I = { 1 , . . . , n } \ I � Standard solution: − prove knowledge of redacted messages − reveal and/or prove relations about { m i } i ∈I ⇒ inefficient PKC 2020 – p 13

A First Attempt � Verification of PS signatures: � n Y m i ? e ( g , � σ 2 ) = e ( X , � σ 1 ) i i =1 PKC 2020 – p 14

A First Attempt � Verification of PS signatures: � n Y m i ? e ( g , � σ 2 ) = e ( X , � σ 1 ) i i =1 � � Y m i Y m i ? = e ( X , � σ 1 ) i i i ∈I i ∈I PKC 2020 – p 14

A First Attempt � Verification of PS signatures: � n Y m i ? e ( g , � σ 2 ) = e ( X , � σ 1 ) i i =1 � � Y m i Y m i ? = e ( X , � σ 1 ) i i i ∈I i ∈I � � ? Y m i Y m i = e ( X σ 1 , � σ 1 ) σ 1 = i i i ∈I i ∈I PKC 2020 – p 14

A First Attempt � Verification of PS signatures: � n Y m i ? e ( g , � σ 2 ) = e ( X , � σ 1 ) i i =1 � � Y m i Y m i ? = e ( X , � σ 1 ) i i i ∈I i ∈I � � ? Y m i Y m i = e ( X σ 1 , � σ 1 ) σ 1 = i i i ∈I i ∈I � m i 0 Y m i ? = e ( X σ 1 Y , � σ 1 ) i 0 i i ∈I\ i 0 � ( σ 1 , � σ 1 , � σ 2 ) is not a secure redactable signature on { m i } i ∈I : PKC 2020 – p 14

A First Attempt � Verification of PS signatures: � n Y m i ? e ( g , � σ 2 ) = e ( X , � σ 1 ) i i =1 � � Y m i Y m i ? = e ( X , � σ 1 ) i i i ∈I i ∈I � � ? Y m i Y m i = e ( X σ 1 , � σ 1 ) σ 1 = i i i ∈I i ∈I � m i 0 Y m i ? = e ( X σ 1 Y , � σ 1 ) i 0 i i ∈I\ i 0 � m i 0 − t = e ( X σ ′ 1 Y t Y m i σ ′ ? , � σ 1 ) 1 = σ 1 Y i 0 i i 0 i ∈I\ i 0 � ( σ 1 , � σ 1 , � σ 2 ) is not a secure redactable signature on { m i } i ∈I : ( σ ′ 1 , � σ 1 , � σ 2 ) is valid on t and { m i } i ∈I\ i 0 PKC 2020 – p 14

A Linkable Solution Problem: elements Y u i i , for i ∈ I , can be aggregated in σ 1 � solution 1: prove that σ 1 = � i ∈I Y m i i − inefficient (back to square 1) − overkill: prove more that what we need PKC 2020 – p 15

A Linkable Solution Problem: elements Y u i i , for i ∈ I , can be aggregated in σ 1 � our solution: if σ 1 is honestly formed � g y i ) = e ( g , � g ) f ( y 1 ,..., y n ) e ( σ 1 , � i ∈I f only contains monomials y i · y j , for i � = j PKC 2020 – p 15

A Linkable Solution Problem: elements Y u i i , for i ∈ I , can be aggregated in σ 1 � our solution: if σ 1 is forged � g ) f ( y 1 ,..., y n ) g y i ) = e ( g , � e ( σ 1 , � i ∈I f contains monomials y 2 i , i ∈ I � we add { g y i y j } i � = j in pk − sufficient to compute σ 2 = g f ( y 1 ,..., y n ) if σ 1 honestly formed − not sufficient to compute σ 2 = g f ( y 1 ,..., y n ) if σ 1 forged − “validity” of σ 1 can be checked: e ( σ 1 , � g y i ) ? i ∈I � = e ( σ 2 , � g ) PKC 2020 – p 15

Achieving Unlinkability � Our redactable signature ( σ 1 , σ 2 , � σ 1 , � σ 2 ) is: − � constant size (4 group elements) − � O ( |I| ) complexity for verification − ✗ not unlinkable � ( � σ 1 , � σ 2 ) can be re-randomized but not ( σ 1 , σ 2 ) � We use a different approach: u i 0 − σ 2 only proves that σ 1 does not contain illicit elements { Y i 0 } i 0 ∈I − we can aggregate anything else in σ 1 PKC 2020 – p 16

Achieving Unlinkability $ � Step 1: aggregate t ← Z p under dummy public key 1 σ ′′ σ t − � 2 ← � σ 2 · � 1 $ − re-randomize ( � σ ′ σ ′ σ r σ ′′ 2 ) r ), with r 2 ) ← ( � 1 , ( � ← Z p 1 , � σ ′ σ ′ ( � 1 , � 2 ) is valid on ( m 1 , . . . , m n , t ) PKC 2020 – p 17

Achieving Unlinkability $ � Step 1: aggregate t ← Z p under dummy public key 1 σ ′′ σ t − � 2 ← � σ 2 · � 1 $ − re-randomize ( � σ ′ σ ′ σ r σ ′′ 2 ) r ), with r 2 ) ← ( � 1 , ( � ← Z p 1 , � σ ′ σ ′ ( � 1 , � 2 ) is valid on ( m 1 , . . . , m n , t ) � Step 2: redact { m i } i ∈I and t 1 = g t · � i ∈I Y m i − σ ′ i 2 ← ( � i ∈I Y i ) t � i ∈I , j ∈I ( g y i y j ) m j − σ ′ PKC 2020 – p 17