Optimistic Fair Priced Oblivious Transfer A. Rial B. Preneel - - PowerPoint PPT Presentation

▶
optimistic fair priced oblivious transfer
SMART_READER_LITE
LIVE PREVIEW

Optimistic Fair Priced Oblivious Transfer A. Rial B. Preneel - - PowerPoint PPT Presentation

Mar 07, 2023 296 likes •1.08k views

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Optimistic Fair Priced Oblivious Transfer A. Rial B. Preneel Katholieke Universiteit Leuven - ESAT-COSIC IBBT Africacrypt 2010 A. Rial Optimistic Fair POT Motivation

slide-1
SLIDE 1

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Optimistic Fair Priced Oblivious Transfer

  • A. Rial
  • B. Preneel

Katholieke Universiteit Leuven - ESAT-COSIC IBBT

Africacrypt 2010

  • A. Rial

Optimistic Fair POT

slide-2
SLIDE 2

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Definition

Vendor Buyer (m1, . . . , mN), (p1, . . . , pN)

✛

τ ∈ {1, . . . , N}

✲

mτ Properties: V does not learn τ. B does not get any information about other messages. B pays price pτ.

  • A. Rial

Optimistic Fair POT

slide-3
SLIDE 3

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Definition

Vendor Buyer (m1, . . . , mN), (p1, . . . , pN)

✛

τ ∈ {1, . . . , N}

✲

mτ Properties: V does not learn τ. B does not get any information about other messages. B pays price pτ.

  • A. Rial

Optimistic Fair POT

slide-4
SLIDE 4

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Definition

Vendor Buyer (m1, . . . , mN), (p1, . . . , pN)

✛

τ ∈ {1, . . . , N}

✲

mτ Properties: V does not learn τ. B does not get any information about other messages. B pays price pτ.

  • A. Rial

Optimistic Fair POT

slide-5
SLIDE 5

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Definition

Vendor Buyer (m1, . . . , mN), (p1, . . . , pN)

✛

τ ∈ {1, . . . , N}

✲

mτ Properties: V does not learn τ. B does not get any information about other messages. B pays price pτ.

  • A. Rial

Optimistic Fair POT

slide-6
SLIDE 6

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Construction

Vendor Buyer ac0

✛

ac0 Prepaid Mechanism B makes an initial deposit to V. At each purchase, the price is debited from the deposit. V learns neither the price nor the deposit.

  • A. Rial

Optimistic Fair POT

slide-7
SLIDE 7

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Construction

Vendor Buyer ac0

✛

ac0 Prepaid Mechanism B makes an initial deposit to V. At each purchase, the price is debited from the deposit. V learns neither the price nor the deposit.

  • A. Rial

Optimistic Fair POT

slide-8
SLIDE 8

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Construction

Vendor Buyer ac0

✛

ac0 Prepaid Mechanism B makes an initial deposit to V. At each purchase, the price is debited from the deposit. V learns neither the price nor the deposit.

  • A. Rial

Optimistic Fair POT

slide-9
SLIDE 9

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Construction

Vendor Buyer ac0

✛

ac0 Prepaid Mechanism B makes an initial deposit to V. At each purchase, the price is debited from the deposit. V learns neither the price nor the deposit.

  • A. Rial

Optimistic Fair POT

slide-10
SLIDE 10

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Security

Previous Work Half-Simulation secure schemes [AIR01, Tob03]. Vulnerable under attack in [DNO08]. UC-secure scheme [RKP09]. Inefficient. Efficient Full-Simulation Secure POT

  • A. Rial

Optimistic Fair POT

slide-11
SLIDE 11

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Security

Previous Work Half-Simulation secure schemes [AIR01, Tob03]. Vulnerable under attack in [DNO08]. UC-secure scheme [RKP09]. Inefficient. Efficient Full-Simulation Secure POT

  • A. Rial

Optimistic Fair POT

slide-12
SLIDE 12

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Security

Previous Work Half-Simulation secure schemes [AIR01, Tob03]. Vulnerable under attack in [DNO08]. UC-secure scheme [RKP09]. Inefficient. Efficient Full-Simulation Secure POT

  • A. Rial

Optimistic Fair POT

slide-13
SLIDE 13

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-14
SLIDE 14

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-15
SLIDE 15

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-16
SLIDE 16

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-17
SLIDE 17

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-18
SLIDE 18

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-19
SLIDE 19

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-20
SLIDE 20

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Priced Oblivious Transfer: Fairness

Previous Work Usually, e-commerce protocols are analyzed to prove their fairness [Kre04]. Non privacy-preserving protocols [EGL85, Gol83]. Privacy-preserving protocols that provide buyers’ anonymity [RR01]. However, no fair POT scheme has been proposed. Malicious V can claim B ran out of funds. Malicious V can deny delivery. Malicious B can falsely accuse an honest V. Fair POT

  • A. Rial

Optimistic Fair POT

slide-21
SLIDE 21

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-22
SLIDE 22

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-23
SLIDE 23

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-24
SLIDE 24

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Overview

Our POT scheme is based on the OT scheme of [CNS07] and thus follows an assisted decryption approach. Generic POT scheme

V((mi , pi )N

i=1)

Initialization B(ac0) sk, ∀i, Ci = POTInitV(mi , pi ) (C1, . . . , CN) ✲ Verify (C1, . . . , CN) ac0 (ac0)

✛

ac0 V Transfer B(τ) POTVerReq(Q) (Q)

✛

(Q, Qpriv) = POTReq(Cτ ) R = POTResp(Q, sk) (R)

✲

POTVerResp(R) (mτ ) = POTComplete(R, Qpriv)

  • A. Rial

Optimistic Fair POT

slide-25
SLIDE 25

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Overview

Our POT scheme is based on the OT scheme of [CNS07] and thus follows an assisted decryption approach. Generic POT scheme

V((mi , pi )N

i=1)

Initialization B(ac0) sk, ∀i, Ci = POTInitV(mi , pi ) (C1, . . . , CN) ✲ Verify (C1, . . . , CN) ac0 (ac0)

✛

ac0 V Transfer B(τ) POTVerReq(Q) (Q)

✛

(Q, Qpriv) = POTReq(Cτ ) R = POTResp(Q, sk) (R)

✲

POTVerResp(R) (mτ ) = POTComplete(R, Qpriv)

  • A. Rial

Optimistic Fair POT

slide-26
SLIDE 26

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Details: Initialization

V computes the ciphertexts (C1, . . . , CN). Computes bilinear map setup (p, G, Gt, e, g). Pick secret key h ∈ G. Ciphertext Ci = (Ai = g1/(x+pi), Bi = e(h, Ai) · mi, pi). B verifies each Ai and makes the initial deposit ac0.

  • A. Rial

Optimistic Fair POT

slide-27
SLIDE 27

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Details: Initialization

V computes the ciphertexts (C1, . . . , CN). Computes bilinear map setup (p, G, Gt, e, g). Pick secret key h ∈ G. Ciphertext Ci = (Ai = g1/(x+pi), Bi = e(h, Ai) · mi, pi). B verifies each Ai and makes the initial deposit ac0.

  • A. Rial

Optimistic Fair POT

slide-28
SLIDE 28

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Details: Initialization

V computes the ciphertexts (C1, . . . , CN). Computes bilinear map setup (p, G, Gt, e, g). Pick secret key h ∈ G. Ciphertext Ci = (Ai = g1/(x+pi), Bi = e(h, Ai) · mi, pi). B verifies each Ai and makes the initial deposit ac0.

  • A. Rial

Optimistic Fair POT

slide-29
SLIDE 29

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Details: Initialization

V computes the ciphertexts (C1, . . . , CN). Computes bilinear map setup (p, G, Gt, e, g). Pick secret key h ∈ G. Ciphertext Ci = (Ai = g1/(x+pi), Bi = e(h, Ai) · mi, pi). B verifies each Ai and makes the initial deposit ac0.

  • A. Rial

Optimistic Fair POT

slide-30
SLIDE 30

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Details: Initialization

V computes the ciphertexts (C1, . . . , CN). Computes bilinear map setup (p, G, Gt, e, g). Pick secret key h ∈ G. Ciphertext Ci = (Ai = g1/(x+pi), Bi = e(h, Ai) · mi, pi). B verifies each Ai and makes the initial deposit ac0.

  • A. Rial

Optimistic Fair POT

slide-31
SLIDE 31

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Request

B computes a request (POTReq) for item τ: B picks v ← Zp and blinds V = Av

τ, computes a

commitment Cj to new deposit value acj−1 − pτ and a proof that:

She possesses a signature on price pτ. Cj commits to acj−1 − pτ. Cj commits to a non-negative value [CCS08].

  • A. Rial

Optimistic Fair POT

slide-32
SLIDE 32

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Request

B computes a request (POTReq) for item τ: B picks v ← Zp and blinds V = Av

τ, computes a

commitment Cj to new deposit value acj−1 − pτ and a proof that:

She possesses a signature on price pτ. Cj commits to acj−1 − pτ. Cj commits to a non-negative value [CCS08].

  • A. Rial

Optimistic Fair POT

slide-33
SLIDE 33

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Request

B computes a request (POTReq) for item τ: B picks v ← Zp and blinds V = Av

τ, computes a

commitment Cj to new deposit value acj−1 − pτ and a proof that:

She possesses a signature on price pτ. Cj commits to acj−1 − pτ. Cj commits to a non-negative value [CCS08].

  • A. Rial

Optimistic Fair POT

slide-34
SLIDE 34

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Request

B computes a request (POTReq) for item τ: B picks v ← Zp and blinds V = Av

τ, computes a

commitment Cj to new deposit value acj−1 − pτ and a proof that:

She possesses a signature on price pτ. Cj commits to acj−1 − pτ. Cj commits to a non-negative value [CCS08].

  • A. Rial

Optimistic Fair POT

slide-35
SLIDE 35

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Response

V verifies request (POTVerReq) and computes a response (POTResp): W = e(h, V). and a proof that secret key h was used to compute W. B verifies response (POTVerResp) and obtains the message (POTComplete): mτ = Bτ/(W 1/v) = ( mτ·e(Ai,h)

e(h,Av

i )(1/v) )

  • A. Rial

Optimistic Fair POT

slide-36
SLIDE 36

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Response

V verifies request (POTVerReq) and computes a response (POTResp): W = e(h, V). and a proof that secret key h was used to compute W. B verifies response (POTVerResp) and obtains the message (POTComplete): mτ = Bτ/(W 1/v) = ( mτ·e(Ai,h)

e(h,Av

i )(1/v) )

  • A. Rial

Optimistic Fair POT

slide-37
SLIDE 37

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Transfer phase “j”: Response

V verifies request (POTVerReq) and computes a response (POTResp): W = e(h, V). and a proof that secret key h was used to compute W. B verifies response (POTVerResp) and obtains the message (POTComplete): mτ = Bτ/(W 1/v) = ( mτ·e(Ai,h)

e(h,Av

i )(1/v) )

  • A. Rial

Optimistic Fair POT

slide-38
SLIDE 38

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-39
SLIDE 39

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Comparison with Previous Work

UC Secure vs Our Scheme [RKP09] Our Scheme UC Yes No Standard Model Yes Yes Static Corruptions Yes Yes CRS Yes No Assumptions DLIN, TDH, HSDH SDH, BDHE Efficient No Yes

  • A. Rial

Optimistic Fair POT

slide-40
SLIDE 40

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Construction Comparison with Previous Work

Efficiency

Given the upper bound of the deposit D = da. Communication Efficiency [RKP09] Our Scheme Ciph

(12N + 3d + 11) · |G| + |Zp| (2N + 2d + 2) · |G| + (N + 1) · |Zp| + 2 · |Gt |

Req

(86 + 30a) · |G| (a + 7) · |G| + (2a + 7) · |Zp| + (a + 1) · |Gt |

Resp

28 · |G| 3 · |Gt | + |Zp|

  • A. Rial

Optimistic Fair POT

slide-41
SLIDE 41

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-42
SLIDE 42

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-43
SLIDE 43

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-44
SLIDE 44

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-45
SLIDE 45

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-46
SLIDE 46

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-47
SLIDE 47

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-48
SLIDE 48

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-49
SLIDE 49

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Definition

Transformation that turns any secure POT scheme into an Optimistic Fair POT scheme. Properties: Third party A to resolve disputes. A is only involved in case of dispute (optimistic). A must be neutral to guarantee fairness. Privacy-properties of POT are guaranteed (even if A is corrupted).

A and V cannot learn τ. A and B cannot learn non-purchased messages.

Without harming efficiency.

  • A. Rial

Optimistic Fair POT

slide-50
SLIDE 50

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Outline

1

Efficient Priced Oblivious Transfer Construction Comparison with Previous Work

2

Optimistic Fair POT Definition Construction

  • A. Rial

Optimistic Fair POT

slide-51
SLIDE 51

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Verifiably Encrypted Signatures

A VES scheme consists of algorithms Kg(1κ), Sign(sk, m) and Vf(pk, σ, m). AdjKg(1κ) output a key pair (ask, apk) for A. Create(sk, apk, m) computes a VES ω. VesVf(pk, apk, ω, m) verifies a VES ω. Adj(pk, ask, apk, ω, m) extracts σ form ω. Properties: Unforgeability. Opacity.

  • A. Rial

Optimistic Fair POT

slide-52
SLIDE 52

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Verifiably Encrypted Signatures

A VES scheme consists of algorithms Kg(1κ), Sign(sk, m) and Vf(pk, σ, m). AdjKg(1κ) output a key pair (ask, apk) for A. Create(sk, apk, m) computes a VES ω. VesVf(pk, apk, ω, m) verifies a VES ω. Adj(pk, ask, apk, ω, m) extracts σ form ω. Properties: Unforgeability. Opacity.

  • A. Rial

Optimistic Fair POT

slide-53
SLIDE 53

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-54
SLIDE 54

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-55
SLIDE 55

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-56
SLIDE 56

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-57
SLIDE 57

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-58
SLIDE 58

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-59
SLIDE 59

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Protocol based on VES

Non privacy-preserving e-commerce protocol based on VES: B requests an item and sends a VES. V sends the item. B reveals a valid signature. If B does not reveal it, V complains.

A verifies V fulfills delivery. A reveals a signature to V.

If V does not fulfill delivery, B complains.

A verifies V fulfills delivery. A reveals a signature to V.

  • A. Rial

Optimistic Fair POT

slide-60
SLIDE 60

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES

In non-privacy preserving protocols, A can easily verify whether V fulfills delivery. In POT A can learn neither m1, . . . , mN nor τ. However, correctness of requests and responses can be publicly verified.

POTVerReq does not need secret key sk. POTVerResp does not need τ.

  • A. Rial

Optimistic Fair POT

slide-61
SLIDE 61

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES

In non-privacy preserving protocols, A can easily verify whether V fulfills delivery. In POT A can learn neither m1, . . . , mN nor τ. However, correctness of requests and responses can be publicly verified.

POTVerReq does not need secret key sk. POTVerResp does not need τ.

  • A. Rial

Optimistic Fair POT

slide-62
SLIDE 62

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES

In non-privacy preserving protocols, A can easily verify whether V fulfills delivery. In POT A can learn neither m1, . . . , mN nor τ. However, correctness of requests and responses can be publicly verified.

POTVerReq does not need secret key sk. POTVerResp does not need τ.

  • A. Rial

Optimistic Fair POT

slide-63
SLIDE 63

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES

In non-privacy preserving protocols, A can easily verify whether V fulfills delivery. In POT A can learn neither m1, . . . , mN nor τ. However, correctness of requests and responses can be publicly verified.

POTVerReq does not need secret key sk. POTVerResp does not need τ.

  • A. Rial

Optimistic Fair POT

slide-64
SLIDE 64

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: construction

Generic OFPOT scheme

V((mi , pi )N

i=1)

Initialization B(ac0) sk, ∀i, Ci = POTInitV(mi , pi ) (C1, . . . , CN) ✲ Verify (C1, . . . , CN) ac0 (ac0, σ(0, ac0))

✛

ac0 V Transfer “j” B(τ) POTVerReq(Q) (Q, ω(j, Q))

✛

(Q, Qpriv) = POTReq(Cτ ) R = POTResp(Q, sk) (R)

✲

POTVerResp(R) (Q, σ(j, Q))

✛

(mτ ) = POTComplete(R, Qpriv)

  • A. Rial

Optimistic Fair POT

slide-65
SLIDE 65

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-66
SLIDE 66

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-67
SLIDE 67

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-68
SLIDE 68

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-69
SLIDE 69

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-70
SLIDE 70

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-71
SLIDE 71

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-72
SLIDE 72

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

OFPOT based on VES: disputes

V complains: V sends request Q, ω(j, Q) and response R to A. A verifies request and response. A sends R to B and reveals σ(j, Q) to V. B complains: B sends request Q, ω(j, Q) to A. A verifies request and sends it to V. V returns a response to A. A verifies the response. A sends response to B and reveals σ(j, Q) to V.

  • A. Rial

Optimistic Fair POT

slide-73
SLIDE 73

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Conclusion

POT scheme. Full-simulation secure. Standard model. Efficient. Optimistic fair POT. A only involved in case of dispute. Privacy preserved when A corrupted. Efficient.

  • A. Rial

Optimistic Fair POT

slide-74
SLIDE 74

Motivation Efficient Priced Oblivious Transfer Optimistic Fair POT Definition Construction

Conclusion

POT scheme. Full-simulation secure. Standard model. Efficient. Optimistic fair POT. A only involved in case of dispute. Privacy preserved when A corrupted. Efficient.

  • A. Rial

Optimistic Fair POT

slide-75
SLIDE 75

Appendix For Further Reading

For Further Reading I

William Aiello, Yuval Ishai, and Omer Reingold. Priced oblivious transfer: How to sell digital goods. In Birgit Pfitzmann, editor, EUROCRYPT, volume 2045 of Lecture Notes in Computer Science, pages 119–135. Springer, 2001. Jan Camenisch, Rafik Chaabouni, and Abhi Shelat. Efficient protocols for set membership and range proofs. In Josef Pieprzyk, editor, ASIACRYPT, volume 5350 of Lecture Notes in Computer Science, pages 234–252. Springer, 2008.

  • A. Rial

Optimistic Fair POT

slide-76
SLIDE 76

Appendix For Further Reading

For Further Reading II

Jan Camenisch, Gregory Neven, and Abhi Shelat. Simulatable adaptive oblivious transfer. In Moni Naor, editor, EUROCRYPT, volume 4515 of Lecture Notes in Computer Science, pages 573–590. Springer, 2007. Ivan Damgård, Jesper Buus Nielsen, and Claudio Orlandi. Essentially optimal universally composable oblivious transfer. Cryptology ePrint Archive, Report 2008/220, 2008. http://eprint.iacr.org/. Shimon Even, Oded Goldreich, and Abraham Lempel. A randomized protocol for signing contracts.

  • Commun. ACM, 28(6):637–647, 1985.
  • A. Rial

Optimistic Fair POT

slide-77
SLIDE 77

Appendix For Further Reading

For Further Reading III

Oded Goldreich. A simple protocol for signing contracts. In CRYPTO, pages 133–136, 1983. Steve Kremer. Formal analysis of optimistic fair exchange protocols, 2004. Alfredo Rial, Markulf Kohlweiss, and Bart Preneel. Universally composable adaptive priced oblivious transfer. In Hovav Shacham and Brent Waters, editors, Pairing, volume 5671 of Lecture Notes in Computer Science, pages 231–247. Springer, 2009.

  • A. Rial

Optimistic Fair POT

slide-78
SLIDE 78

Appendix For Further Reading

For Further Reading IV

Indrakshi Ray and Indrajit Ray. An anomymous fair exchange e-commerce protocol. In IPDPS, page 172. IEEE Computer Society, 2001. Christian Tobias. Practical oblivious transfer protocols. In IH ’02: Revised Papers from the 5th International Workshop on Information Hiding, pages 415–426, London, UK, 2003. Springer-Verlag.

  • A. Rial

Optimistic Fair POT