Fair Exchange of Short Signatures without Trusted Third Party

Editor's Notes

• #2: Thankyoufortheintroduction. AndGoodafternooneveryone.
• #3: Let me startwiththemotivation of thiswork. Itis more and more commontotrade digital goodsonthe web: music, e-books, applicationsor virtual goodsliketheone of farmville.
• #4: Obviously as thegoods are made of 0 and 1 itmakessensetotradethemonthe web. Sohow do weensurethatthese can be buyedsecurely? Themostcommonsolutionistorelyon a trustedthirdpartythatwillreceivethepaymentfortheseller and thendelivertheproducttothebuyer. Thissolutionis simple conceptually and thewidelyadopted.
• #5: Howeverthe use of TTP has somedrawbacks.Thefirstoneisthatit produces a strong incentive forcorruptedpartiesstealcritical data likepasswords. Despitealltheprecautionsthese TTP maytake, itis quite difficult in practicetoavoidbeinghacked.
• #6: Anotherissueraisedbythepresence of TTP isrelatedtoprivacy. Indeedthisintermediary has accesstoallthedetails of thecommercialtransactions and itisnotalwaysclearforusershowthisinformationishandled.So in thisworkweproposetoenablesecurecommercialtransactionbetweentoparticipantswithoutthepresence of a trustedthirdparty. Such a solutionwouldnothavethedrawbacksmentionedbefore and would open a pathtosmoother (?) transactions.
• #7: So technicallytheproblemwewanttosolveconsists in exchangingvaluesfairlywhichmeansthateitherbothpartiesobtainwhattheyexpectedornonedoes. Ifwe observe whathappens in thephysicalworldwerealizethattheproblem of fairexchangeissolvedtriviallybecause of theproximity of theparticipants. [CLICK] In thisexample a womanwantstobuyto bread to a man and clearlyifshedoesnotpayorifthesellerdoesnotdeliverthe bread someonewillnotice.[CLICK] So in thephysicalworldthereis a strong incentive to do thingsrightbecause a maliciousparticipantisverylikelyto be caught.[CLICK] As usual things are notthat simple in the digital world. Themainreasonisthatthereis no thisproximityanymore and theidentity of theparticipantsmightnot be known. So weneedtowork more in ordertogetthesamelevel of securitythatwehave in thephysicalworld.
• #8: So let’s try tomodel a commercialtransactionusing digital signatures. Thismightnotwork in all cases butclearlyitappliesto a widerange of situations and thusthisishowwewillmodelthesetransactions.In thisexamplethebuyerholds a digital signaturethatrepresents a digital check and thesellerholds a digital signaturethatwillenabletoactivatehis software.
• #9: Ifwetolerateone of theparticipantstogetsomeadvantage, a natural idea that comes tomindistoreleasethesecretvalue (in our case a signature) graduallybyrevealingeach bit in alternation[Click] Bob releaseshisfirst bit Alice releasesherfirst bit[Click] Bob releasehissecond bit Alice releasehersecond bit….[Click] So this idea seemstowork in avoidingCleve’simpossibilityresultconsidering of course a weakersecuritydefinition. [Click] Butwestillface a problem as a maliciousparticipant can still lie aboutthe bit itreleases.
• #10: So in thisworkwe show howtosolvethisproblemfor a particular signaturescheme, theonebyBoneh and Boyenpresented at Eurocrypt 2004. As alreadymentionedourgoalistoaoidthedependencyon a TTP and as weshallseeourconstructionis quite practical.
• #11: Ourfirstcontributionistoprovide a formal definitionforpartialfairnessthatdoesnotrequiretohandletheexact time of execution of theparticipants and avoidtherelatedstrongassumptions (time line)Regardingefficiency, ourprotocolruns in k+1 rounds where k isthesecurityparameter (TYPO) and bothcommunication and time complexity are quite practical.Moreoverourprotocolisthefirst of thesortforBoneh-Boyen signatures.
• #12: Finallyweprovide new techniquesforprovingthat a commitmentencodes a bit vector and thatthis bit vector isthebinaryexpansion of someothercommittedvalue.
• #13: [Click] In thispresentationcommitmentswill be representedby red boxes thatwhenopenedwithsomekey [Click] revealthevalueinsidethe box thatisturnedto color green [Click].As usual wehavetwoadversaries. [Click ] Bob will try tochangehismindwhenopeningthecommitments and [Click] Alice will try to open the red box beforebeinggiventhekey.
• #14: Wewillalso use Non-Interactive Zero-Knowledgearguments, in particular [Click] [Click]toprovethat a commitmentsencodes a bit.[Click] Here Bob will try to produce a fakeargumentfor a commitmentto a non-bit value and ontheotherside [Click] Alice will try toguessthe bit thatis in the box.
• #15: Solet’sintrodcetheabstractsyntax of theprotocol. Firstsetup: werequirethe use of a CRS. Bothplayersagreeonthemessagesto be signedKeygen: forthesignatureschemeEncryptSig: VerifySign: checkthattheencryptedsignatureiswellformed and thatdecryptionwill lead totheobtention of thesignaturefortherespectivemessages.
• #16: So let’s introduce nowthesecuritydefinition. We use thefollowingexperimentto define whatwecallpartialfairness, as complete fairnessisnotpossiblewithouttrustedthirdparty.[Click] At thebeginningthehonestparticipantwillgeneratehispair of signingkeys[Click] . Theadversarywillaskforsignaturesonmessages of itschoice [Click] Thentheadversarywillchoosetwomessagesm_A, m_Bforwhichthesignatureswill be exchanged. [Click] Obviouslythemessagerelativetothehonestparticipantmustnothavebeenrequestedpreviouslytothesigningoracle.[Click] Thenbothparticipantswillinteractarbitrarily and in particular theadversarymayabortprematurelytheprotocol.[Click] Whentheexchange of messagesstopsthehonestparticipantwill output a tentativesignatureonmessagem_Ausingthe bits theadversary has released. Forexampleiftwo bits remainedto bit releasedthen Bob willchoose at randomone of thefourpossiblecombinationsto complete thesequence of bits and output thecorrespondingsignatureattempt.[Click] Theadversarywillpursueitsowncomputations and output itstentativesignatureonmessagem_B as well.[Click] So wesaythattheprotocolispartiallyfairiftherespectiveprobabilitiesto output a correctsignaturediffers at mostby a polynomial factor.(Justify more therelevance / accuracy of thedefinition?)
• #17: OK we are readyto introduce ourprotocol.So wewilldepictitfromthepoint of view of Bob butrecallthat Alice willperform similar operations.[Click] Bob first computes hissignature and then a blinding factor [Click] thatishidden in a commitment. Whencombinedbothvalues lead toanencryptedsignature. [Click] Thisencryptedsignatureiscomplementedby a commitmentto a bit vector thatisthebinaryexpansion of thepreviousblindingvalue [Click].[Click] Thenweneed Bob to compute a NIZK argumentthatproveseachsmall box contains a bit. Thereasonisthatthe idea of gradual realease of a secretisbasedonthefactthatiftheotherparticipantaborts, I can stillperform a bruteforceattackontheremaining bits and these are nottoomany. Butiftheotherunrevealedvalues are not bits thenspaceforthisbruteforceattackwill be toobig and thustheadversarywoudwin.[Click] Thenweneed a secondargumenttoprovethatindeedthesequence of small red boxes correspondtothebinaryexpansion of thevalue in thebig red box. Thisargument can be seen as the bridge betweenthesequence of bits commitments and theblinding factor.[Click] Therestisstraightforward, Bob willsimply open each bit commitment (in alternationwith Alice).[Click] Finally Alice will be abletorecomputetheblinding factor and recoverthesignature.
• #18: Well,unsurprisinglywehavebilinearmapsforourprotocolfortheirnicealgebraicproperties and alsobecausetheBoneh-Boyen schemeworksforbilinearmaps as well.
• #19: We use q-type (Isitthewayto denote them?) assumptions. Given s a secretweconsiderthe vector g, g^s, g^{s^2} and so one and weassumeitishardto compute g^{1/s} whichisthe q DH assumption.Thebilinearvariant of thisassumptionwewill use isthe q-BilinearAssumption and consists in tryingfortheadversarythevalue e(g,g)^1/s.Thesecurity of theboneh-boyen schemereliesonthe q-SDH assumpitionwhichstatesthatitishardto compute a scalar c and thegroupelement g^{1/(s+c)}. Thesecurity of oursecondargumentalsoneedthisassumption.Finallywe introduce a new assumptioncalledtheq+i DHE assumptionwhichissimplythegeneralization of a previouslyproposedassumption, namelythe q+1 DHE assumption.
• #20: Itisnothardtoseethatth q-BDHIimpliestheq+i DHE (type: “-” missing)And ourprotocolissecureunderthe q-SDH assumption and the q-BDHI assumption (thereis a typo!)If 𝑐isfixedthen 𝑞−𝐷𝐻𝐼⇔ 𝑞−𝑆𝐷𝐻Trivial 𝑞−𝐵𝐷𝐻𝐼⇒ 𝑞−𝐷𝐻𝐼
• #21: Let’srecallbrieflytheBoneh and Boyen signaturescheme.[Click] Thekeygenerationalgorithm produces thevaluesx,y in Z_p and compute u=g^x and v=g^yThepublickeywill be thepair (u,v) and thesecretkeyisformedbytheexponents x and y.[Click] Tosign a message m, thesignerfirst compute r, therandomness of thesignature and then output g^1{x+m+yr} alongwiththerandomnessitself.[Click] Verifying a signature \\sigma for a message m consists of computing e(sigma_r,ug^mv^r) and checkthatitisequaltothevalue e(g,g). [Click] Thereasonwhytheschemeiscorrectisbecausetheexponents cancel outduetothebilinearity of e.
• #22: So nowwe are goingtosee in detailhowtheencryptedsignatureiscomputed.
• #23: Firstwechoose a randomblinding factor \\theta in Z_pwhere p istheorder of thegroups. And we compute D=g^thetawhichwill be public.[Click] Thenwe compute thepair (g^{theta/x+m+yr},r) whichis a commonsignaturebutwherethefirstcomponentisraisedtoexponent theta[Click] Given D, \\sigma thepublickey of thesignaturescheme and a message m weverifythattheencryptedsignatureiscorrectbycomputinge(sigma_theta,ug^mv^r) and verifythatitisequalto e(D,g). [Click] As beforethereasonitworksisbecausetheexponents cancel out.
• #24: OK, so nowlet’shave a look at thefirstargumentthatprovethatthesequence of commitments (small boxes) encodes a bit vector.
• #25: Thisargumentmakes use of thecommonreferencestring CRS whichisthetuple of theassumptionsmentionedbefore.[Click] Thestatementtoproveisthatgiventhesequence of commitments C_1,C_2,…,C_qtheproversknowstherandomnessr_i and a bit valueb_isuch -thatC_i=g^{r_i}g_i^b_i. So herewe can note thateachcommitment in position i correspondstothe i-th bit and thatthe position isidentifiedbythe CRS groupelementg_i. Note alsothattherandomnessforeachcommitmentis placed in position “0”.[Click] Theargumentconsist of computingA_i=g_{q-i}^r_ig_q^{b_i} whichconceptually can be seen as the[Click] commmitmentC_iwhichisshiftedby q-i positions totheright. Thenwewillasktheproverto compute thegroupelementB_i so thatwehavetheequality e(A_i,C_ig_i^-1) = e(B_i,g). The idea hereistoforcetheproverto compute theproductb_i(b_i-1) in theexponentwhichshould be equalto 0 as b_iisexpectedto be a bit. In thenextslidewewillsee more detailaboutthis.[Click] Theargumentwillconsist in thepairs (A_i,B_i) foreach position i[Click] Verifyingtheargumentwill be done bycheckingthatA_iiscomputedbyshifttinhthecommitmentC_iby q-i positions totheright and checkingthatB_isatisfiestherelationinvolvingA_iC_i and g_i^{-1}.
• #26: [Click] So hereisthetheoremforthesecurity of ourargument. Thisargumentisperfectly complete, soundundertheq+i DHE assumption and perfectlyzero-knowledge.[Click] Tojustifythesoundness and completeness as welllet’shave a look at theexpressionintroduced in thepreviousslide e(A_i,C_ig_i^{-1}). Ifwerewritethisexpressionweget e(g_{q-i}^{r_i^2}g_q^{r_i(2b_i-1)} multipliedby g_{q+i}^{b_i(b_i-1)},g). So thefirstpartB_i can be computedbytheprover as itknowstherandomnessr_i and thevaluecommitmentb_i.[Click] Ifb_iisnot a bit we can observe thatsomehowtheproverwillhaveto break theq+i DHE assumption in orderto compute B_i.
• #27: We are done withthefirstargument, let’shave a look nowtothesecondargumentwhichpurposeisto relate the bit vector commitment and theblindingvalueusedtoencryptthesignature. Obviouslythisstepiscritical as withoutitwetheverifiercannot be sureifthe bit which are released in step 4 willreallyhelptorecoverthesignature.
• #28: So firstwe use thesamecommonreferencestring and[Click] we set q to \\kappa whichisthesecurityparameter, thatisthenumber of bits toencode a groupelementoranexponent.[Click] Thestatementtoproveisthattheproverknowstherandomness and thevalueb_icommitted in eachC_ithatthesevaluesformthebinaryexpansion of thediscretelogarithm of thegroupelement D whichisused in theencryptedsignature.
• #29: [Click] Theargumentiscomposedbythreevalues: r’ whichis a scalar and togroupelements U and V.[Click] A problemwefaceforcomputingthisargumentisthateachcommitmentisindeed a randomvalue, itis a petersencommitment and thusistotallyindependentfromthevalue D and itsdiscretelogarithm. So whatwehaveto do firstistoremovetherandomness of eachcommitment so thatwe can thensomehow compare the bits inside of eachcommitmentwiththediscretelogarithm of D. Howeverwecannotsimplyrevealtherandomness of eachcommitmentbecauseitwouldgivetotheadversarytomuchinformation and ourprotocolwouldnot be fairanymore. So the idea istomultiplyeachcommitments. Whendoingthatwe can obversethattherandomness of allcommitmentwillaccumulate in the position 0 thatis a theexponent of g. So r’ will be the sum of alltherandomness of eachcommitment. Nowwe can divide theproduct of thecommitmentsby g^{r’} to cancel thisrandomness.Buthow do weknowthattheproverisnotlying?[Click] The idea hereistoseetheproduct of thecommitments as a vector where r’ isthefirstcomponent in position 0, whichisfollowedbythe bits. So nowtheproverwill compute a productthatwillcorrespondtothesamearraybutshiftedbyone position totheleftwhich can be done iftherandomness r’ iscancelled. Nowiftheprover tries to lie he willsomehow be ableto compute theinverse of thesecret $s$ in theexponent. Finallyusingthebilinearmaptheverifier can checkthat r’ isindeedtheaccumulatedrandomness of allthecommitments.[Click] Thenextstepnowistoprovethat U whichrepresentthe bit vector correspondstothebinaryexpansion of theta, whichthediscretelogarithm of D. So whatwe do istocheckthat e(U/D,g)=e(V,g_1g^{-2}) where V iscomputedbytheprover. [Click] The idea istointerpretthe U as thelist of coefficients of somepolynomial P and provethatwhenwe compute P(s)-\\theta in theexponentwe can divide by s-2 whichmeansthat theta isindeedthevaluetakenbythepolynomial P when s=2. And thisiswhatwewantbecausethismeansthatthearray of bits representedby U isthebinaryexpansion of theta. Ifthisrelationshipdoesnotoldthensomehowtheproverwill be ableto divide by s-2 in theexponent and thuswill break the q-SDH assumption.
• #30: So tosummarizeoursecondargmentisperfectly complete, perfectlyzero-knowledge and computationallysoundunderthe q-SDH assumption.
• #31: We are almost done. As wehaveseenstep 4 consistssimply in openingthe bit commitments in alternation as withtheargumentwe can be surethatthe bit thatwill be revealedgraduallywill lead torecoverthesignature, whichhappens at step 5. Let’sseehowitworks.
• #32: Indeeditis quite straightforward. Giventhe bits [Click] werecompute theta andusingtheblindedsignatureweextractthefirstcomponent and [Click] cancel the theta factor.
• #33: I willnot show thesecurityproof of theprotocolhowever I willmention a couple of importantpointsrelatedtoit. [Click] Firstweneed a proof of knowledgeforthediscretelogarithm of D [Click] and alsofortherepresentation in base (g,g_i) of eachpedersencommitment. [Click] Thereasonisthatthesimulatorfortheprotocolneedstokeepsimulatingtheadversarydespitethisoneaborts in orderto be ableto break someassumptionrelatedtothecommitments and theirarguments.
• #34: Anothertechnicallydifficultyweface in thesecurityproofisrelatedtowhathappenswhenwegraduallyrevealeach bit. Whatcouldhappenisthatforsomereasonsome bits orgroups of are harderto compute thanotherswhichcouldgivetheadversarysomeimportantadvantageifitaborts at therightmoment. So in ordertosolvethisissueweneedto introduce anotherassumptioncalledthe “SimultaneousHardness of Bits forDiscreteLogarithmassumption”.[Click] Thisassumptionstatesthat no adversaryisabletodistinguishbetween a randomsequence of k-l bits and thefirst k-l bits of thediscretelogarithm. So thisfits.[Click] More precisely and formallytheadversarycannotdistinguishbetweenthefirstworldwhereitisgiveng^theta and thefirstk-l bits of theta fromtheworldwherethe bits revealed are random and indepentfromthe bits of theta. And obviously l, thenumber of bits that are notdisclosedmust be largeenough so thattheadversarycannotperform a bruteforceattackthatwouldinvalidatetheassumption.[Click] And finally as shownbySchnorr, thisassumptionholds in thegenericgroupmodel.
• #35: We are readytoconclude. Weintroduced a protocoltoexchange in a fairwayboneh boyen signaturewithoutrelying a ontrustedthirdparty. Ourprotocolis quite efficient and as a sideproductweproposedtwo new NIZK argumentsthatmayfindapplications in otherconstructions.[Click] Thankyouverymuchforyourattention!