Efficient Unlinkable Sanitizable Signatures from Signatures with - - PowerPoint PPT Presentation

▶
efficient unlinkable sanitizable signatures from
SMART_READER_LITE
LIVE PREVIEW

Efficient Unlinkable Sanitizable Signatures from Signatures with - - PowerPoint PPT Presentation

Oct 11, 2022 101 likes •577 views

Efficient Unlinkable Sanitizable Signatures from Signatures with Re-Randomizable Keys Nils Fleischhacker Johannes Krupp Giulio Malavolta Jonas Schneider Dominique Schr oder Mark Simkin March 7, 2016 Sanitizable Signatures

slide-1
SLIDE 1

Efficient Unlinkable Sanitizable Signatures from Signatures with Re-Randomizable Keys

Nils Fleischhacker Johannes Krupp Giulio Malavolta Jonas Schneider Dominique Schr¨

  • der

Mark Simkin March 7, 2016

slide-2
SLIDE 2

Sanitizable Signatures [ACdMT05] Bob E.D. $ 800

✦ ✪

slide-3
SLIDE 3

Sanitizable Signatures [ACdMT05] Bob E.D. $ 800 ✦

✪

slide-4
SLIDE 4

Sanitizable Signatures [ACdMT05] Bob E.D. $ 800 censored

✦ ✪

slide-5
SLIDE 5

Sanitizable Signatures [ACdMT05]

Nurse

Bob E.D. $ 800 censored

✦ ✪

slide-6
SLIDE 6

Sanitizable Signatures [ACdMT05]

Nurse

Bob E.D. $ 800 censored

✦ ✪

slide-7
SLIDE 7

Sanitizable Signatures [ACdMT05]

Nurse

Bob E.D. $ 800 Bob Influenza $ 800 ✦

✪

slide-8
SLIDE 8

Security of Sanitizable Signatures

◮ Formalized by Brzuska et al. [BFFLPSSV09]

◮ Immutability ◮ Sanitizer Accountability ◮ Signer Accountability ◮ Transparency ◮ Unforgeability ◮ Privacy

◮ Missing property identified by Brzuska et al. [BFLS10]

◮ Unlinkability

slide-9
SLIDE 9

Security of Sanitizable Signatures

◮ Formalized by Brzuska et al. [BFFLPSSV09]

◮ Immutability ◮ Sanitizer Accountability ◮ Signer Accountability ◮ Transparency ◮ Unforgeability ◮ Privacy

◮ Missing property identified by Brzuska et al. [BFLS10]

◮ Unlinkability

slide-10
SLIDE 10

Security of Sanitizable Signatures

◮ Formalized by Brzuska et al. [BFFLPSSV09]

◮ Immutability ◮ Sanitizer Accountability ◮ Signer Accountability ◮ Transparency ◮ Unforgeability ◮ Privacy

◮ Missing property identified by Brzuska et al. [BFLS10]

◮ Unlinkability

slide-11
SLIDE 11

Immutability [ACdMT05][BFFLPSSV09]

Nurse

Bob E.D. $ 800 Charlie E.D. $ 800✪

slide-12
SLIDE 12

Sanitizer-Accountability [ACdMT05][BFFLPSSV09]

Nurse

Bob Influenza $ 800 Π

slide-13
SLIDE 13

Sanitizer-Accountability [ACdMT05][BFFLPSSV09]

Nurse

Bob Influenza $ 800 Π Yes! This message was sanitized.

slide-14
SLIDE 14

Signer-Accountability [ACdMT05][BFFLPSSV09] Bob Stupid $ 800 Π

slide-15
SLIDE 15

Signer-Accountability [ACdMT05][BFFLPSSV09] Bob Stupid $ 800 Π Nope! This message was not sanitized.

slide-16
SLIDE 16

Transparency [ACdMT05][BFFLPSSV09] Bob Influenza $ 800 Bob Influenza $ 800

?

???

slide-17
SLIDE 17

Unlinkability [BFLS10] Bob Influenza $ 800

Nurse

Bob E.D. $ 800 Bob Acne $ 800

?

???

slide-18
SLIDE 18

The General Idea Sign σFix m1 m2 m3 m4 m5 sksig sksan

slide-19
SLIDE 19

The General Idea Sign σFix m1 m2 m3 m4 m5 Sign σ′ sksig sksan

?

σ

slide-20
SLIDE 20

The General Idea Sign σFix m1 m2 m3 m4 m5 Sign σ′ sksig sksan σ

slide-21
SLIDE 21

Signatures with Re-Randomizable Keys κ Gen sk pk

slide-22
SLIDE 22

Signatures with Re-Randomizable Keys κ Gen sk pk Sign m σ

slide-23
SLIDE 23

Signatures with Re-Randomizable Keys κ Gen sk pk Sign m σ Verify b

slide-24
SLIDE 24

Signatures with Re-Randomizable Keys κ Gen sk pk Sign m σ Verify b RandSK RandPK ρ

slide-25
SLIDE 25

Unforgeability under Re-Randomized Keys (sk, pk) ← Gen(1κ) pk (m∗, σ∗)

slide-26
SLIDE 26

Unforgeability under Re-Randomized Keys σ ← Sign(sk, m) m σ The attacker wins if Verify(pk, m∗, σ∗) = 1 and m = m∗ (sk, pk) ← Gen(1κ) pk (m∗, σ∗)

slide-27
SLIDE 27

Unforgeability under Re-Randomized Keys σ ← Sign(sk, m) m σ The attacker wins if Verify(pk, m∗, σ∗) = 1 and m = m∗ sk′ ←RandSK(sk, ρ) σ ←Sign(sk′, m) m, ρ σ

  • r Verify(pk′, m∗, σ∗) = 1 and m = m∗ with pk′ ← RandPK(pk, ρ∗)

(sk, pk) ← Gen(1κ) pk (m∗, σ∗, ρ∗)

slide-28
SLIDE 28

Unforgeability under Re-Randomized Keys

◮ Nontrivial Property

◮ Does not follow from standard unforgeability. ◮ Many schemes with re-randomizable keys not unforgeable

under re-randomized keys

◮ e.g. Boneh-Boyen, Camenisch-Lysyanskaya

◮ Instantiations in ROM and Standard Model

◮ Schnorr ◮ Hofheinz-Kiltz

slide-29
SLIDE 29

Unforgeability under Re-Randomized Keys

◮ Nontrivial Property

◮ Does not follow from standard unforgeability. ◮ Many schemes with re-randomizable keys not unforgeable

under re-randomized keys

◮ e.g. Boneh-Boyen, Camenisch-Lysyanskaya

◮ Instantiations in ROM and Standard Model

◮ Schnorr ◮ Hofheinz-Kiltz

slide-30
SLIDE 30

Our Construction Sign σFix m1 m2 m3 m4 m5 sksig pksig pksan

slide-31
SLIDE 31

Our Construction Sign σFix m1 m2 m3 m4 m5 sk′ pk′ RandSK RandPK sksig pksig pksan

slide-32
SLIDE 32

Our Construction Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan σ′

slide-33
SLIDE 33

Our Construction Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ σ′

slide-34
SLIDE 34

Our Construction Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′

slide-35
SLIDE 35

Our Construction Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′ σ

slide-36
SLIDE 36

Our Construction Immutability Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′ σ

slide-37
SLIDE 37

Our Construction Sanitizer-Accountability Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′ σ

slide-38
SLIDE 38

Our Construction Signer-Accountability Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′ σ

slide-39
SLIDE 39

Our Construction Transparency Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′ σ

slide-40
SLIDE 40

Our Construction Unlinkability Sign σFix m1 m2 m3 m4 m5 Sign sk′ pk′ RandSK RandPK sksig pksig pksan PPoK τ Enc c σ′ σ

slide-41
SLIDE 41

Comparison

Computation

This Paper1 BFLS10 using Groth07 FY04 KGensig 7E 1E 1E KGensan 1E 1E 4E Sign 15E 194E+2P 2831E Sanit 14E 186E+1P 2814E Verify 17E 207E + 62P 2011E Proof 23E 14E+1P 18E Judge 6E 1E+2P 2E

E=modular exponentiation,P= pairing evaluation

1Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ-protocols.

slide-42
SLIDE 42

Comparison

Computation

This Paper1 BFLS10 using Groth07 FY04 KGensig 7E 1E 1E KGensan 1E 1E 4E Sign 15E 194E+2P 2831E Sanit 14E 186E+1P 2814E Verify 17E 207E + 62P 2011E Proof 23E 14E+1P 18E Judge 6E 1E+2P 2E

E=modular exponentiation,P= pairing evaluation

1Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ-protocols.

slide-43
SLIDE 43

Comparison

Storage

This Paper2 BFLS10 using Groth07 FY04 pksig 7 1 1 sksig 14 1 1 pksan 1 1 5 sksan 1 1 1 σ 14 69 1620 π 4 1 3

measured in group elements

2Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ-protocols.

slide-44
SLIDE 44

Comparison

Storage

This Paper2 BFLS10 using Groth07 FY04 pksig 7 1 1 sksig 14 1 1 pksan 1 1 5 sksan 1 1 1 σ 14 69 1620 π 4 1 3

measured in group elements

2Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ-protocols.

slide-45
SLIDE 45

Conclusion We construct an unlinkable sanitizable signature scheme that can be instantiated at least one order of magnitude more efficiently than previously known schemes.

slide-46
SLIDE 46

Thank You!

Nils Fleischhacker fleischhacker@cs.uni-saarland.de Full Version: ia.cr/2015/395