Efficient Unlinkable Sanitizable Signatures from Signatures with - PowerPoint PPT Presentation

Efficient Unlinkable Sanitizable Signatures from Signatures with Re-Randomizable Keys Nils Fleischhacker Johannes Krupp Giulio Malavolta Jonas Schneider Dominique Schr¨ oder Mark Simkin March 7, 2016

✦ ✪ Sanitizable Signatures [ACdMT05] Bob E.D. $ 800

✪ Sanitizable Signatures [ACdMT05] Bob $ 800 ✦ E.D.

✦ Sanitizable Signatures [ACdMT05] Bob censored E.D. ✪ $ 800

✦ Sanitizable Signatures [ACdMT05] Bob censored E.D. ✪ $ 800 Nurse

✪ Sanitizable Signatures [ACdMT05] Bob censored E.D. ✦ $ 800 Nurse

✪ Sanitizable Signatures [ACdMT05] Bob Bob $ 800 ✦ Influenza E.D. $ 800 Nurse

Security of Sanitizable Signatures ◮ Formalized by Brzuska et al. [BFFLPSSV09] ◮ Immutability ◮ Sanitizer Accountability ◮ Signer Accountability ◮ Transparency ◮ Unforgeability ◮ Privacy ◮ Missing property identified by Brzuska et al. [BFLS10] ◮ Unlinkability

Security of Sanitizable Signatures ◮ Formalized by Brzuska et al. [BFFLPSSV09] ◮ Immutability ◮ Sanitizer Accountability ◮ Signer Accountability ◮ Transparency ◮ Unforgeability ◮ Privacy ◮ Missing property identified by Brzuska et al. [BFLS10] ◮ Unlinkability

Security of Sanitizable Signatures ◮ Formalized by Brzuska et al. [BFFLPSSV09] ◮ Immutability ◮ Sanitizer Accountability ◮ Signer Accountability ◮ Transparency ◮ Unforgeability ◮ Privacy ◮ Missing property identified by Brzuska et al. [BFLS10] ◮ Unlinkability

Immutability [ACdMT05][BFFLPSSV09] Bob Charlie E.D. E.D. $ 800 ✪ $ 800 Nurse

Sanitizer-Accountability [ACdMT05][BFFLPSSV09] Bob Influenza $ 800 Nurse Π

Sanitizer-Accountability [ACdMT05][BFFLPSSV09] Bob Influenza $ 800 Nurse Π Yes! This message was sanitized.

Signer-Accountability [ACdMT05][BFFLPSSV09] Bob Stupid $ 800 Π

Signer-Accountability [ACdMT05][BFFLPSSV09] Bob Stupid $ 800 Π Nope! This message was not sanitized.

Transparency [ACdMT05][BFFLPSSV09] Bob Bob ? Influenza Influenza $ 800 $ 800 ???

Unlinkability [BFLS10] Bob Acne $ 800 ? Bob E.D. Nurse $ 800 ??? Bob Influenza $ 800

The General Idea sk sig σ Fix Sign m 1 m 2 m 3 m 4 m 5 sk san

The General Idea sk sig σ Fix Sign m 1 m 2 m 3 m 4 m 5 sk san ? Sign σ ′ σ

The General Idea sk sig σ Fix Sign m 1 m 2 m 3 m 4 m 5 sk san Sign σ ′ σ

Signatures with Re-Randomizable Keys sk κ Gen pk

Signatures with Re-Randomizable Keys Sign sk κ m σ Gen pk

Signatures with Re-Randomizable Keys Sign sk κ m σ Gen pk Verify b

Signatures with Re-Randomizable Keys RandSK Sign sk ρ κ m σ Gen pk Verify RandPK b

Unforgeability under Re-Randomized Keys pk ( sk , pk ) ← Gen (1 κ ) ( m ∗ , σ ∗ )

Unforgeability under Re-Randomized Keys pk ( sk , pk ) ← Gen (1 κ ) m σ ← Sign ( sk , m ) σ ( m ∗ , σ ∗ ) The attacker wins if Verify ( pk , m ∗ , σ ∗ ) = 1 and m � = m ∗

Unforgeability under Re-Randomized Keys pk ( sk , pk ) ← Gen (1 κ ) m σ ← Sign ( sk , m ) σ m, ρ sk ′ ← RandSK ( sk , ρ ) σ ← Sign ( sk ′ , m ) σ ( m ∗ , σ ∗ , ρ ∗ ) The attacker wins if Verify ( pk , m ∗ , σ ∗ ) = 1 and m � = m ∗ or Verify ( pk ′ , m ∗ , σ ∗ ) = 1 and m � = m ∗ with pk ′ ← RandPK ( pk , ρ ∗ )

Unforgeability under Re-Randomized Keys ◮ Nontrivial Property ◮ Does not follow from standard unforgeability. ◮ Many schemes with re-randomizable keys not unforgeable under re-randomized keys ◮ e.g. Boneh-Boyen, Camenisch-Lysyanskaya ◮ Instantiations in ROM and Standard Model ◮ Schnorr ◮ Hofheinz-Kiltz

Unforgeability under Re-Randomized Keys ◮ Nontrivial Property ◮ Does not follow from standard unforgeability. ◮ Many schemes with re-randomizable keys not unforgeable under re-randomized keys ◮ e.g. Boneh-Boyen, Camenisch-Lysyanskaya ◮ Instantiations in ROM and Standard Model ◮ Schnorr ◮ Hofheinz-Kiltz

Our Construction σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 pk sig pk san

Our Construction σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 RandSK sk ′ pk ′ RandPK pk sig pk san

Our Construction σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig pk san

Our Construction σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig pk san P PoK τ

Our Construction σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ

Our Construction σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ σ

Our Construction Immutability σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ σ

Our Construction Sanitizer-Accountability σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ σ

Our Construction Signer-Accountability σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ σ

Our Construction Transparency σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ σ

Our Construction Unlinkability σ Fix sk sig Sign m 1 m 2 m 3 m 4 m 5 Sign RandSK sk ′ σ ′ pk ′ RandPK pk sig c Enc pk san P PoK τ σ

Comparison Computation BFLS10 using This Paper 1 Groth07 FY04 KGen sig 7 E 1 E 1 E KGen san 1 E 1 E 4 E Sign 15 E 194 E+ 2 P 2831 E Sanit 14 E 186 E+ 1 P 2814 E Verify 17 E 207 E + 62 P 2011 E Proof 23 E 14 E+ 1 P 18 E Judge 6 E 1 E+ 2 P 2 E E=modular exponentiation,P= pairing evaluation 1 Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ -protocols.

Comparison Computation BFLS10 using This Paper 1 Groth07 FY04 KGen sig 7 E 1 E 1 E KGen san 1 E 1 E 4 E Sign 15 E 194 E+ 2 P 2831 E Sanit 14 E 186 E+ 1 P 2814 E Verify 17 E 207 E + 62 P 2011 E Proof 23 E 14 E+ 1 P 18 E Judge 6 E 1 E+ 2 P 2 E E=modular exponentiation,P= pairing evaluation 1 Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ -protocols.

Comparison Storage BFLS10 using This Paper 2 Groth07 FY04 pk sig 7 1 1 sk sig 14 1 1 pk san 1 1 5 sk san 1 1 1 14 69 1620 σ π 4 1 3 measured in group elements 2 Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ -protocols.

Comparison Storage BFLS10 using This Paper 2 Groth07 FY04 pk sig 7 1 1 sk sig 14 1 1 pk san 1 1 5 sk san 1 1 1 14 69 1620 σ π 4 1 3 measured in group elements 2 Instantiated with Schnorr signatures, Cramer-Shoup Encryption, and Fiat-Shamir transformed Σ -protocols.

Conclusion We construct an unlinkable sanitizable signature scheme that can be instantiated at least one order of magnitude more efficiently than previously known schemes.

Thank You! Nils Fleischhacker fleischhacker@cs.uni-saarland.de Full Version: ia.cr/2015/395