Group Signatures [CH91] preserve the anonymity of the signer. Blind - PowerPoint PPT Presentation

F ORMALIZING G ROUP B LIND S IGNATURES AND P RACTICAL C ONSTRUCTIONS WITHOUT R ANDOM O RACLES Essam Ghadafi ghadafi@cs.bris.ac.uk University of Bristol ACISP 2013 F ORMALIZING G ROUP B LIND S IGNATURES . . .

O UTLINE B ACKGROUND 1 S ECURITY M ODEL 2 B UILDING B LOCKS 3 O UR C ONSTRUCTIONS 4 F ULL A NONYMITY 5 S UMMARY & O PEN P ROBLEMS 6 F ORMALIZING G ROUP B LIND S IGNATURES . . .

O UTLINE B ACKGROUND 1 S ECURITY M ODEL 2 B UILDING B LOCKS 3 O UR C ONSTRUCTIONS 4 F ULL A NONYMITY 5 S UMMARY & O PEN P ROBLEMS 6 F ORMALIZING G ROUP B LIND S IGNATURES . . .

O UTLINE B ACKGROUND 1 S ECURITY M ODEL 2 B UILDING B LOCKS 3 O UR C ONSTRUCTIONS 4 F ULL A NONYMITY 5 S UMMARY & O PEN P ROBLEMS 6 F ORMALIZING G ROUP B LIND S IGNATURES . . .

O UTLINE B ACKGROUND 1 S ECURITY M ODEL 2 B UILDING B LOCKS 3 O UR C ONSTRUCTIONS 4 F ULL A NONYMITY 5 S UMMARY & O PEN P ROBLEMS 6 F ORMALIZING G ROUP B LIND S IGNATURES . . .

O UTLINE B ACKGROUND 1 S ECURITY M ODEL 2 B UILDING B LOCKS 3 O UR C ONSTRUCTIONS 4 F ULL A NONYMITY 5 S UMMARY & O PEN P ROBLEMS 6 F ORMALIZING G ROUP B LIND S IGNATURES . . .

O UTLINE B ACKGROUND 1 S ECURITY M ODEL 2 B UILDING B LOCKS 3 O UR C ONSTRUCTIONS 4 F ULL A NONYMITY 5 S UMMARY & O PEN P ROBLEMS 6 F ORMALIZING G ROUP B LIND S IGNATURES . . .

G ROUP B LIND S IGNATURES Group Signatures [CH91] preserve the anonymity of the signer. Blind Signatures [Cha83] preserve the privacy of the message to be signed. Group Blind Signatures [LZ98] combine properties of the above and thus preserve both the anonymity of the signer + the privacy of the message. F ORMALIZING G ROUP B LIND S IGNATURES . . . 1

G ROUP B LIND S IGNATURES ok ik Opener Issuer gpk User Group F ORMALIZING G ROUP B LIND S IGNATURES . . . 2

G ROUP B LIND S IGNATURES ok ik Opener Issuer gpk User Group F ORMALIZING G ROUP B LIND S IGNATURES . . . 2

G ROUP B LIND S IGNATURES ok ik Opener Issuer gpk Sig User Group F ORMALIZING G ROUP B LIND S IGNATURES . . . 2

G ROUP B LIND S IGNATURES ok ik Opener Issuer gpk Sig User Group F ORMALIZING G ROUP B LIND S IGNATURES . . . 2

H ISTORY AND R ELATED WORK The primitive which combines the properties of a blind signature [Cha83] and a group signature [CH91] was introduced by Lysyanskaya and Zulfikar [LZ98]. Existing constructions: ◮ Lysyanskaya and Zulfikar, 1998. Based on Camenisch-Stadler group signatures [CL97]. ◮ K. Q. Nguyen, Y. Mu, and V. Varadharajan, 1999. Uses divertible zero-knowledge proofs [OO90]. F ORMALIZING G ROUP B LIND S IGNATURES . . . 3

A PPLICATIONS OF G ROUP B LIND S IGNATURES Group blind signatures provide bi-directional privacy and are thus useful for applications where such a requirement is needed. Example applications: ◮ Distributed e-cash, e.g. [LZ98]: The e-coin reveals neither the identity of its holder nor that of the issuing bank/branch. ◮ Other applications include: multi-authority e-voting and e-auction systems. F ORMALIZING G ROUP B LIND S IGNATURES . . . 4

O UR C ONTRIBUTION ◮ A formal security model for the primitive. ◮ A generic construction. ◮ The first instantiations without random oracles. ◮ Other useful building blocks and observations. F ORMALIZING G ROUP B LIND S IGNATURES . . . 5

S ECURITY D EFINITION C HALLENGES The signing protocol is blind, i.e. the message is not known to the signer and the signature is not well defined, so: 1 How to define Full Anonymity, i.e. CCA2 Anonymity? ⇒ How to identify the challenge signature? 2 How to define non-frameability? 3 How to extend blindness to the group setting? F ORMALIZING G ROUP B LIND S IGNATURES . . . 6

S YNTAX OF G ROUP B LIND S IGNATURES A G ROUP B LIND S IGNATURE GKg ( 1 λ ) : Outputs gpk , ik and ok . UKg : Outputs a pair of personal secret/public keys ( ssk [ i ] , spk [ i ]) for a signer. � Join ( gpk , i , ssk [ i ]) , Issue ( ik , i , spk [ i ]) � : If successful, Signer i becomes a member and obtains a group signing key gsk [ i ] . � Obtain ( gpk , m ) , Sign ( gsk [ i ]) � : If successful, the user obtains a signature Σ ; Otherwise, it outputs ⊥ . GVf ( gpk , m , Σ) : Verifies if Σ is valid on the message m . Open ( gpk , ok , reg , m , Σ) : Returns the identity of the signer plus a proof τ . Judge ( gpk , i , spk [ i ] , m , Σ , τ ) : Verifies the Opener’s decision. F ORMALIZING G ROUP B LIND S IGNATURES . . . 7

S ECURITY OF G ROUP B LIND S IGNATURES ◮ Correctness: If all parties are honest, we have that: Signatures are accepted by the GVf algorithm. The Opener can identify the signer. The Judge algorithm accepts the Opener’s decision. F ORMALIZING G ROUP B LIND S IGNATURES . . . 8

S ECURITY OF G ROUP B LIND S IGNATURES ◮ Anonymity: Signatures do not reveal who signed them. gpk,ik Open† Open† i 0 , i 1 SSK SSK Ch Ch ... ModifyReg ModifyReg ModifyReg ModifyReg b←{0,1} b←{0,1} CrptS CrptS SndToS SndToS b * Adversary wins if: b = b ∗ . ◮ † Similarly to IND-RCCA [CKN03], the Open oracle returns ⊥ if the signature opens to i 0 or i 1 . F ORMALIZING G ROUP B LIND S IGNATURES . . . 9

S ECURITY OF G ROUP B LIND S IGNATURES ◮ Traceability: The adversary cannot output an untraceable signature. gpk,ok AddS AddS CrptS CrptS SndToI SndToI ReadReg ReadReg SSK Σ,m SSK Adversary wins if all the following holds: Σ verifies on m . Either Σ does not open to a signer in the group or Judge does not accept the Opener’s decision on Σ . F ORMALIZING G ROUP B LIND S IGNATURES . . . 10

S ECURITY OF G ROUP B LIND S IGNATURES ◮ Non-Frameability: The adversary cannot output a signature that traces to an honest member who did not produce it. gpk,ik,ok CrptS CrptS SndToS ... SndToS OSign OSign ModifyReg ModifyReg SSK id,Σ 1 ,m 1 ,...,Σ n+1 ,m n+1 SSK Adversary wins if all the following holds: ∀ i ∈ { 1 , . . . , n + 1}, Σ i verifies on m i , opens to id and the opening is accepted by Judge . The adversary asked for only n signatures by signer id. If weak unforgeability, the messages are distinct. F ORMALIZING G ROUP B LIND S IGNATURES . . . 11

S ECURITY OF G ROUP B LIND S IGNATURES ◮ Blindness: Group members do not learn the message being signed. gpk,ik m 0 ,m 1 Open† Open† b←{0,1} Σ b SSK SSK Obtain(gpk,m b ) Obtain(gpk,m b ) ModifyReg ReadReg Σ 1-b ModifyReg ReadReg Obtain(gpk,m 1-b ) CrptS Obtain(gpk,m 1-b ) CrptS (Σ 0 ,Σ 1 ) or (┴,┴) SndToS SndToS b * Adversary wins if: b = b ∗ . ◮ † If strong unforgeability, the Open oracle returns ⊥ if ( m , Σ) = ( m b , Σ b ) or ( m , Σ) = ( m 1 − b , Σ 1 − b ) . ◮ If weak unforgeability, the Open oracle returns ⊥ if m ∈ { m 0 , m 1 } . F ORMALIZING G ROUP B LIND S IGNATURES . . . 12

C ONSTRUCTION C HALLENGES How to realize the subtle dual privacy requirement and 1 Maintain round optimality 2 Avoid idealized assumptions ? F ORMALIZING G ROUP B LIND S IGNATURES . . . 13

(P RIME -O RDER ) B ILINEAR G ROUPS G 1 , G 2 , G T are finite cyclic groups of prime order p , where G 1 := � G 1 � and G 2 := � G 2 � . Pairing ( e : G 1 × G 2 − → G T ) : The function e must have the following properties: ◮ Bilinearity: ∀ H 1 ∈ G 1 , H 2 ∈ G 2 x , y ∈ Z , we have e ( H x 1 , H y 2 ) = e ( H 1 , H 2 ) xy . ◮ Non-degeneracy: The value e ( G 1 , G 2 ) � = 1 generates G T . ◮ The function e is efficiently computable. Type-3 [GPS08]: G 1 � = G 2 and no efficiently computable isomorphism between G 1 and G 2 . F ORMALIZING G ROUP B LIND S IGNATURES . . . 14

G ROTH -S AHAI PROOFS Groth-Sahai proofs [GS08]: f × → G 1 G 2 G T ι 1 ↓↑ ρ 1 ι 2 ↓↑ ρ 2 ι T ↓↑ ρ T F H 1 := G 2 H 2 := G 2 H T := G 4 × − → 1 2 T The system work by first committing to (encrypting) the witness and then producing a proof for the statement. The system can be instantiated in either: ◮ The simulation setting ⇒ perfectly hiding proofs. ◮ The extraction setting ⇒ perfectly sound proofs. The limitations: 1 Can only extract one-way function (i.e. G w i ) of an exponent witness w . 2 Cannot simulate and extract at the same time. F ORMALIZING G ROUP B LIND S IGNATURES . . . 15

G ROTH -S AHAI PROOFS Useful Properties of Groth-Sahai Proofs: ◮ Independence of public terms (Also, independently observed by [Fuc11]): Example: n m m n e ( X i , Y j ) γ i , j = t T , � � � � E := e ( A j , Y j ) e ( X i , B i ) j = 1 i = 1 i = 1 j = 1 a proof Π for E is independent of t T ⇒ we can transform Π into a NIZK/NIWI proof for a related equation without knowledge of the original witness. ◮ Re-randomizability of proofs [BCCKLS09]: Re-randomize the GS commitments and update the proofs ⇒ the new proof is unlinkable to the old one. F ORMALIZING G ROUP B LIND S IGNATURES . . . 16

A NEW STRUCTURE - PRESERVING SIGNATURE SCHEME NCL is based on the CL signature scheme [CL04]: T HE NCL S IGNATURE S CHEME KeyGen: Choose x , y ← Z p , set sk := ( x , y ) and 2 , Y := G y pk := ( X := G x 2 ) . Sign: To sign ( M 1 , M 2 ) ∈ G 1 × G 2 , return ⊥ if e ( M 1 , G 2 ) � = e ( G 1 , M 2 ) ; otherwise, compute 1 , B := A y , C := M ay ∈ G 4 � A := G a 1 , D := ( A · C ) x � σ := 1 . Verify: Check that A � = 1 G 1 and e ( B , G 2 ) = e ( A , Y ) e ( C , G 2 ) = e ( B , M 2 ) e ( D , G 2 ) = e ( A · C , X ) F ORMALIZING G ROUP B LIND S IGNATURES . . . 17