Universally Composable and Privacy-Preserving Audit Logs Using - - PowerPoint PPT Presentation

▶
universally composable and privacy preserving audit logs
SMART_READER_LITE
LIVE PREVIEW

Universally Composable and Privacy-Preserving Audit Logs Using - - PowerPoint PPT Presentation

Dec 24, 2023 565 likes •889 views

Universally Composable and Privacy-Preserving Audit Logs Using Bulletin Board Anna Kaplan, Zcash Foundation & Technical University of Munich Joint work with Jan Camenisch, Manu Drijvers, and Maria Dubovitskaya (all at DFINITY) Work was

slide-1
SLIDE 1

Joint work with Jan Camenisch, Manu Drijvers, and Maria Dubovitskaya (all at DFINITY)

Work was conducted while all were at IBM Research Zurich.

Universally Composable and Privacy-Preserving Audit Logs Using Bulletin Board

Anna Kaplan, Zcash Foundation & Technical University of Munich

1

slide-2
SLIDE 2

https://pixabay.com/images/search/accounting/

2

slide-3
SLIDE 3

3

da data id identif ifie ier and da data de details 01.04. 52€ from André 02.04.

  • 59€ to Lea

… KAPLAN 0419

slide-4
SLIDE 4

4

User i User j da data id identif ifie ier and da data de details 01.04. 52€ from André 02.04.

  • 59€ to Lea

… KAPLAN 0419

slide-5
SLIDE 5

5

User i User j da data id identif ifie ier and da data de details 01.04. 52€ from André 02.04.

  • 59€ to Lea

… KAPLAN 0419

Ti Time Us User 1 Us User 2 Us User 3 2/17/2018 13:06:11 data identifier data record session identifier … … … … … …

slide-6
SLIDE 6

6

Ho How to construct such ch a protocol in a go good manner?

Modular cryptographic design, e.g. Universal Composability framework by Canetti '01

slide-7
SLIDE 7

7

Th Theor eoretic backgrou

  • und: Univer

ersal Com

  • mpos
  • sability

PR PROVING A PR PROTOCOL SECURE (Canetti ‘01)

Adver- sary A

Real world Environment E Ideal world

Functiona- lity F

Environment E

Protocol π

Simula- tor S

slide-8
SLIDE 8

8

Th Theor eoretic backgrou

  • und: Univer

ersal Com

  • mpos
  • sability

PR PROVING A PR PROTOCOL SECURE (Canetti ‘01)

~

Adver- sary A

Real world Environment E Ideal world

Functiona- lity F

Environment E

Protocol π

Simula- tor S

Proving a protocol secure means bo both wo worlds sh should be be in indis istin inguis ishable

slide-9
SLIDE 9

9

Th Theor eoretic backgrou

  • und: Univer

ersal Com

  • mpos
  • sability

PR PROVING A PR PROTOCOL SECURE (Canetti ‘01)

~

Adver- sary A

Real world Environment E Ideal world

Functiona- lity F

Environment E

Protocol π

Simula- tor S

Proving a protocol secure means bo both wo worlds sh should be be in indis istin inguis ishable Let π and F be ppt protocols. We show that for any ppt adversary A there exists a ppt adversary S s.t. for any ppt environment E we have: EX EXEC ECF,S,E

,E ≈ EXECπ,A,E ,E

slide-10
SLIDE 10

Protocol πϕ/F’

10

Th Theor eoretic backgrou

  • und: Univer

ersal Com

  • mpos
  • sability

CO COMPOSI SITI TION (Ca Canetti ‘01)

~

Adver- sary A

Real world Environment E Ideal world

Functiona- lity F

Simula- tor S

Environment E

F‘ F‘ ~ ϕ F‘‘ F‘‘‘

…

slide-11
SLIDE 11

Protocol πϕ/F’…

11

Th Theor eoretic backgrou

  • und: Univer

ersal Com

  • mpos
  • sability

GE GENE NERALIZED AND ND EXTEND NDED UC (Canetti et al. ‘07) 7)

~

Adver- sary A

Real world Environment E Ideal world

Functiona- lity F

Simula- tor S

Environment E

F‘ F‘ ~ ϕ F‘‘‘ F‘ ‘

…

Global functio- nality G

slide-12
SLIDE 12

Defining security

12

slide-13
SLIDE 13

Record integrity

13

Wh What security properties should our system follow?

Transaction privacy Auditor authorization Transaction timestamping Auditing correctness Transaction authentication Transaction uniqueness

slide-14
SLIDE 14

14

Ho How is this related to the security properties?

Record integrity Transaction privacy Auditor authorization Transaction timestamping Auditing correctness Transaction authentication Transaction uniqueness

slide-15
SLIDE 15

Providing a protocol

15

slide-16
SLIDE 16

16

Bu Building a scheme – ve very simplified!

Ui Uj

re record id id, , da data id id, , da data ski, pki skj, pkj two cryptographic hash functions: H and Ĥ blockchain timestamp

slide-17
SLIDE 17

17

Bu Building a scheme – ve very simplified!

Ui Uj

re record id id, , da data id id, , da data ski, pki skj, pkj two cryptographic hash functions: H and Ĥ RE RECORD ORD ta tag = H(data id)ski da data ta tag = Ĥ(data║Ĥ(data id)ski) r e c

  • r

d i d , t a t a g g , , d a d a t t a a t a t a g g blockchain timestamp

slide-18
SLIDE 18

18

Bu Building a scheme – ve very simplified!

Ui Uj

re record id id, , da data id id, , da data ski, pki skj, pkj two cryptographic hash functions: H and Ĥ RE RECORD ORD ta tag = H(data id)ski da data ta tag = Ĥ(data║Ĥ(data id)ski) r e c

  • r

d i d , t a t a g g , , d a d a t t a a t a t a g g blockchain timestamp AU AUDIT tag = H(data id)ski u = Ĥ(data id) ski π = NIZK{(ski): tag = H(data id)ski Λ u = Ĥ(data id)ski Λ pki = gski} tag, u, π, data timestamp, record id, ta tag, da data ta tag ta tag, da data ta tag? data tag‘ = Ĥ(data║u) On Only one entry for tag? Is Is t the co corresponding da data ta tag‘ correct? t? Is Is t the c corresponding t timestamp c correct?

slide-19
SLIDE 19

19

Bu Building a scheme – ve very simplified!

Ui Uj

re record id id, , da data id id, , da data ski, pki skj, pkj two cryptographic hash functions: H and Ĥ RE RECORD ORD ta tag = H(data id)ski da data ta tag = Ĥ(data║Ĥ(data id)ski) r e c

  • r

d i d , t a t a g g , , d a d a t t a a t a t a g g blockchain timestamp AU AUDIT tag = H(data id)ski u = Ĥ(data id) ski π = NIZK{(ski): tag = H(data id)ski Λ u = Ĥ(data id)ski Λ pki = gski} tag, u, π, data timestamp, record id, ta tag, da data ta tag ta tag, da data ta tag? data tag‘ = Ĥ(data║u) On Only one entry for tag? Is Is t the co corresponding da data ta tag‘ correct? t? Is Is t the c corresponding t timestamp c correct? Fro1 Fca Fcrs Fro2 Fsmt GrefClock Fbb

slide-20
SLIDE 20

20

Bu Building a scheme mo more forma mally

GrefClock Fca Fbb Fcrs Fro2 Fro1 Fsmt

slide-21
SLIDE 21

How to prove that ideal and real world are indistinguishable

21

slide-22
SLIDE 22

22

Pr Proving security

Protocol πϕ/F’…

~

Adver- sary A

Real world Environment E Ideal world

Functiona- lity F

Simula- tor S

Environment E

F‘ F‘ ~ ϕ G F‘‘

…

G

slide-23
SLIDE 23

23

Pr Proving security

Protocol

Adver- sary A

Real world Environment E F G F Ideal world Simulator S Environment E Ideal world Func- tionality F Simu lator S Environment E G Ideal world Func- tionality F S Environment E

Game 4 Game 3 Game 2 Game 1

slide-24
SLIDE 24

24

Ou Our result

Protocol πaudit EUC-realizes ideal functionality Flaudit with static corruptions and a leakage function l: {0,1}* → {0,1}* in the (GrefClock, Fdcrs, Fca, Flsmt, Fbb)-hybrid model, provided that NIZK is a zero- knowledge and simulation-sound proof of knowledge, and that the DL-assumption holds in G.

slide-25
SLIDE 25

Implementation and further research

25

slide-26
SLIDE 26

26

Im Implementation

As a feature for Identity Mixer in Hyperledger Fabric on ClientSDK in Java with the use of Apache Milagro Crypto Library (AMCL) Instantiating NIZKs: Schnorr’s protocol with Fiat-Shamir heuristic on elliptic curve BN256 (Schnorr ‘91, Fiat and Shamir ‘86, Barreto and Naehrig ‘05)

Te Test on 2 core Intel machine with i5-7200U 7200U 2. 2.5G 5GHz CPU and 8G 8GB RAM ti time in milliseconds Full Identity mixer benchmark test on signing and auditing 229.6 Identity mixer benchmark test on signing 35.5 Identity mixer benchmark test on auditing 10.4

for AMCL: https://github.com/miracl/amcl

slide-27
SLIDE 27

27

Co Conclusion and further problems

Switching to global strict observable programmable random oracle? (Camenisch et al. ’18) Construction without random oracle? Different implementation with Rust, different blockchain or different NIZK? Extending security model with a request by auditor?

slide-28
SLIDE 28

Barreto, Paulo SLM, and Michael Naehrig. "Pairing-friendly elliptic curves of prime order." International Workshop on Selected Areas in

  • Cryptography. Springer, Berlin, Heidelberg, 2005.

Camenisch, Jan, et al. "The Wonderful World of Global Random Oracles." Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, Cham, 2018. Canetti, Ran. "Universally composable security: A new paradigm for cryptographic protocols." Foundations of Computer Science, 2001.

  • Proceedings. 42nd IEEE Symposium on. IEEE, 2001.

Canetti, Ran, et al. "Universally composable security with global setup." Theory of Cryptography Conference. Springer, Berlin, Heidelberg, 2007. Fiat, Amos, and Adi Shamir. "How to prove yourself: Practical solutions to identification and signature problems." Advances in Cryptology—CRYPTO’86. Springer, Berlin, Heidelberg, 1986. Apache Milagro Crypto Library: https://github.com/miracl/amcl Schnorr, Claus-Peter. "Efficient signature generation by smart cards." Journal of cryptology 4.3 (1991): 161-174.

References

28

slide-29
SLIDE 29

Motivation: Auditing and universal composability

29

Defining security Providing a protocol How to prove – a sketch Implementation and further research

slide-30
SLIDE 30

30

Thank you very much and come talk to me, here or @Zcon1!

Anna Kaplan (anna.kaplan@tum.de) Zcash Foundation & Technical University of Munich

30