Get Shorty via Group Signatures without Encryption
1 like613 views
This document presents a new construction for group signatures without encryption. It improves upon previous constructions by achieving shorter signature sizes without encryption. The new construction uses a certificateless signature to generate signatures that are half the size of previous group signature constructions, while maintaining similar computational efficiency for signing and verification. It relies on similar mathematical assumptions as prior works, including the LRSW, XDDH, and q-SDH assumptions.
![1 IBM Research – Zurich; 2 University of Bristol
LRSW [Lysyanskaya et al., 1999]
˜ ˜ ˜ ˜
Given (x ← g α , y ← g β ) ∈ G2 and an oracle Ox ,y (·) that, on input of
˜˜
µ ∈ Zq , outputs a triple (a, aβ , aα(1+µβ ) ) ∈ G3 . For all
1
PPT-adversaries it is hard to output (µ, b ∈ G1 ∧ bβ ∧ bα(1+µβ ) ).
XDDH
XDDH holds if DDH is hard in G1 , i.e., if given a tuple (g, g µ , g ν , g ω )
for µ, ν ← Zq it is hard to decide whether ω = µν mod q or random.
q-SDH [Boneh and Boyen, 2004]
2 q
˜ ˜ ˜
Given a q-tuple (g γ , g γ , . . . , g γ ) for some hidden value of γ, it is
hard to output a pair (g 1/(γ+α) , α) for some α ∈ Zq .
19 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation](https://image.slidesharecdn.com/bcnsw2010-getshortyslides-110929042357-phpapp02/85/Get-Shorty-via-Group-Signatures-without-Encryption-14-320.jpg)
![1 IBM Research – Zurich; 2 University of Bristol
Comparison
CL [Camenisch and Lysyanskaya, 2004]
CL signature & Cramer-Shoup encryption
XDDH & LRSW assumption
BBS∗ [Boneh et al., 2004, Shacham, 2007]
BBS signature & Cramer-Shoup encryption
XDDH & q-SDH assumption
´
DP [Delerablee and Pointcheval, 2006]
BBS signature & two ElGamal encryptions
XDDH & q-SDH assumption
20 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation](https://image.slidesharecdn.com/bcnsw2010-getshortyslides-110929042357-phpapp02/85/Get-Shorty-via-Group-Signatures-without-Encryption-15-320.jpg)
![1 IBM Research – Zurich; 2 University of Bristol
Security Model Development
1991..2003
unlinkability
unforgeability
anonymity
traceability
non-frameability
2003 (static groups) [Bellare et al., 2003]
full-anonymity
full-traceability
26 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation](https://image.slidesharecdn.com/bcnsw2010-getshortyslides-110929042357-phpapp02/85/Get-Shorty-via-Group-Signatures-without-Encryption-21-320.jpg)
![1 IBM Research – Zurich; 2 University of Bristol
Security Model Development
2004 (verifier-local revocation) [Boneh and Shacham, 2004]
selfless anonymity
2005 (dynamic groups) [Bellare et al., 2005]
non-frameability
2010 (combination) [Bichsel et al., 2010]
dynamic groups
selfless anonymity
traceability
non-frameability
27 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation](https://image.slidesharecdn.com/bcnsw2010-getshortyslides-110929042357-phpapp02/85/Get-Shorty-via-Group-Signatures-without-Encryption-22-320.jpg)
Get Shorty via Group Signatures without Encryption
- 1. P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 1 IBM Research – Zurich; 2 University of Bristol 15 September 2010 SCN 2010, Amalfi, Italy Get Shorty via Group Signatures without Encryption
- 2. 1 IBM Research – Zurich; 2 University of Bristol Motivation Group Signatures are.. .. a cryptographic authentication mechanism, which is .. .. useful for implementing scenarios, for example, in vehicular communication networks .. .. in a privacy-preserving way. .. not used. 2 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 3. 1 IBM Research – Zurich; 2 University of Bristol Outline Motivation Current Situation Security Notion Current Constructions This Paper Our Security Model Our Construction Comparison 3 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 4. 1 IBM Research – Zurich; 2 University of Bristol Group Signature Security Notion 5 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 5. 1 IBM Research – Zurich; 2 University of Bristol Group Signature Security Notion 6 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 6. 1 IBM Research – Zurich; 2 University of Bristol Group Signature Security Notion 7 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 7. 1 IBM Research – Zurich; 2 University of Bristol Group Signature Security Notion 8 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 8. 1 IBM Research – Zurich; 2 University of Bristol Current Constructions 10 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 9. 1 IBM Research – Zurich; 2 University of Bristol Evolving to More Efficient Group Signatures + auction with private bids + vote and prove - key loss 12 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 10. 1 IBM Research – Zurich; 2 University of Bristol Our Construction 14 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 11. 1 IBM Research – Zurich; 2 University of Bristol Pairings Asymmetric pairings with G1 , G2 , GT cyclic groups of prime order q. There exists a efficiently computable map ˆ e : G1 × G2 → GT . ˜ For all x ∈ G1 , y ∈ G2 and α, β ∈ Zq we have ˆ ˜ ˆ ˜ e(x α , y β ) = e(x, y )αβ . ˆ ˜ e(g, g ) = 1. 15 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 12. 1 IBM Research – Zurich; 2 University of Bristol Our Construction – Simplified Join interactive protocol Verify issues a CL signature verify Σ as well as (a ← g ρ , b ← g ρβ , c ← g ρα(1+β ξi ) ) ˆ ˜ ˆ ˜ e(d, g β ) ≡ e(e, g ) Sign Open re-randomize the CL signature for all i check (d ← aζ , e ← bζ , f ← c ζ ) ˆ ˜ ? e(f , g β ) = issue ˆ ˜ ˆ ˜ e(d, g α )e(e, g ξi ) ˆ ˜ e(f ,g ) Σ ← SPK{(ξi ) : ˆ ˜ e(d,x ) ˆ ˜ = e(e, x )ξi }(m) 16 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 13. 1 IBM Research – Zurich; 2 University of Bristol Properties of our Construction - Recap + dynamic groups + selfless anonymity + traceability + non-frameability - linear opening - combined opener and group manager 17 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 14. 1 IBM Research – Zurich; 2 University of Bristol LRSW [Lysyanskaya et al., 1999] ˜ ˜ ˜ ˜ Given (x ← g α , y ← g β ) ∈ G2 and an oracle Ox ,y (·) that, on input of ˜˜ µ ∈ Zq , outputs a triple (a, aβ , aα(1+µβ ) ) ∈ G3 . For all 1 PPT-adversaries it is hard to output (µ, b ∈ G1 ∧ bβ ∧ bα(1+µβ ) ). XDDH XDDH holds if DDH is hard in G1 , i.e., if given a tuple (g, g µ , g ν , g ω ) for µ, ν ← Zq it is hard to decide whether ω = µν mod q or random. q-SDH [Boneh and Boyen, 2004] 2 q ˜ ˜ ˜ Given a q-tuple (g γ , g γ , . . . , g γ ) for some hidden value of γ, it is hard to output a pair (g 1/(γ+α) , α) for some α ∈ Zq . 19 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 15. 1 IBM Research – Zurich; 2 University of Bristol Comparison CL [Camenisch and Lysyanskaya, 2004] CL signature & Cramer-Shoup encryption XDDH & LRSW assumption BBS∗ [Boneh et al., 2004, Shacham, 2007] BBS signature & Cramer-Shoup encryption XDDH & q-SDH assumption ´ DP [Delerablee and Pointcheval, 2006] BBS signature & two ElGamal encryptions XDDH & q-SDH assumption 20 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 16. 1 IBM Research – Zurich; 2 University of Bristol Well... how efficient? 1 ∼ 2 signature length 1 < 2 signature computation time ≈ signature verification time 21 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 17. 1 IBM Research – Zurich; 2 University of Bristol Comparison - Signature Size & Signing Time Scheme Size of Sig. Sign Cost G1 Zq G5 T G3 T G2 T GT G2 1 G1 Ours 3 2 1 3 CL 7 4 1 1 11 DP 4 5 1 1 6 BBS* 4 5 1 3 5 22 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 18. 1 IBM Research – Zurich; 2 University of Bristol Comparison - Verification Scheme Verification Cost P2 P G3 T G2 2 G4 1 G3 1 G2 1 G1 Ours 2 1 1 CL 2 1 2 2 1 DP 1 1 1 1 2 BBS* 1 1 1 4 23 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 19. 1 IBM Research – Zurich; 2 University of Bristol Thank you! 24 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 20. 1 IBM Research – Zurich; 2 University of Bristol ? 25 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 21. 1 IBM Research – Zurich; 2 University of Bristol Security Model Development 1991..2003 unlinkability unforgeability anonymity traceability non-frameability 2003 (static groups) [Bellare et al., 2003] full-anonymity full-traceability 26 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 22. 1 IBM Research – Zurich; 2 University of Bristol Security Model Development 2004 (verifier-local revocation) [Boneh and Shacham, 2004] selfless anonymity 2005 (dynamic groups) [Bellare et al., 2005] non-frameability 2010 (combination) [Bichsel et al., 2010] dynamic groups selfless anonymity traceability non-frameability 27 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 23. 1 IBM Research – Zurich; 2 University of Bristol Comparison - Assumptions Separate Underlying Hard Problems Scheme GM & Opener for Anonymity and Traceability Ours XDDH and LRSW CL XDDH and LRSW DP XDDH and q-SDH BBS∗ XDDH and q-SDH 28 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 24. 1 IBM Research – Zurich; 2 University of Bristol Bellare, M., Micciancio, D., and Warinschi, B. (2003). Foundations of group signatures: Formal definitions, simplified requirements, and a construction based on general assumptions. In Biham, E., editor, EUROCRYPT ’03, volume 2656 of LNCS, pages 614–629. Springer. Bellare, M., Shi, H., and Zhang, C. (2005). Foundations of group signatures: The case of dynamic groups. In Menezes, A., editor, CT-RSA ’05, volume 3376 of LNCS, pages 136–153, San Francisco, CA, USA. Springer. Bichsel, P., Camenisch, J., Neven, G., Smart, N. P., and Warinschi, B. (2010). 28 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 25. 1 IBM Research – Zurich; 2 University of Bristol Get shorty via group signatures without encryption. In Garay, J. A. and De Prisco, R., editors, SCN ’10, volume 6280 of LNCS, pages 381–398. Springer. Boneh, D. and Boyen, X. (2004). Short signatures without random oracles. In Cachin, C. and Camenisch, J., editors, EUROCRYPT ’04, volume 3027 of LNCS, pages 54–73. Springer. Boneh, D., Boyen, X., and Shacham, H. (2004). Short group signatures. In Franklin, M. K., editor, CRYPTO ’04, volume 3152 of LNCS, pages 41–55. Springer. Boneh, D. and Shacham, H. (2004). 28 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 26. 1 IBM Research – Zurich; 2 University of Bristol Group signatures with verifier-local revocation. In Atluri, V., Pfitzmann, B., and McDaniel, P., editors, Proc. 11th ACM CCS, pages 168–177. ACM Press. Camenisch, J. and Lysyanskaya, A. (2004). Signature schemes and anonymous credentials from bilinear maps. In Franklin, M. K., editor, CRYPTO ’04, volume 3152 of LNCS, pages 56–72. Springer. ´ Delerablee, C. and Pointcheval, D. (2006). Dynamic fully anonymous short group signatures. In Nguyen, P. Q., editor, VIETCRYPT ’06, volume 4341 of LNCS, pages 193–210, Hanoi, Vietnam. Springer. 28 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation
- 27. 1 IBM Research – Zurich; 2 University of Bristol Lysyanskaya, A., Rivest, R., Sahai, A., and Wolf, S. (1999). Pseudonym systems. In Heys, H. and Adams, C., editors, Selected Areas in Cryptography, volume 1758 of LNCS. Springer. Shacham, H. (2007). A Cramer-Shoup encryption scheme from the linear assumption and from progressively weaker linear variants. Cryptology ePrint Archive, Report 2007/074. http://eprint.iacr.org/. 28 / 28 P. Bichsel1 , J. Camenisch1 , G. Neven1 , N.P. Smart2 , B. Warinschi2 | Get Shorty via Group Signatures without Encryption | 15 September 2010 | ibmStyle.tex 2010-09-12 pbi © 2010 IBM Coorporation