k -times Full Traceable Ring Signature Xavier Bultel Pascal - PowerPoint PPT Presentation

k -times Full Traceable Ring Signature Xavier Bultel Pascal Lafourcade 31 August 2016, P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 1 / 26

Signature P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 2 / 26

Signature Signature Verification Clef privée Clef publique Secrete key Public key 1977, RSA: m d mod n P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 2 / 26

Ring Signature (Rivest et al. , 2001) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer σ 1 , σ 2 , σ 3 , σ 4 , σ 5 , σ 6 and σ 7 come from Alice or Bob or Carol or David → Anonymous signatures P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 3 / 26

Linkable Signature (Liu et al. , 2004) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer σ 1 , σ 2 and σ 3 come from the same user σ 5 and σ 6 come from the same user No information about σ 4 and σ 7 signer → Anonymous but Linkable P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 4 / 26

1-time Traceable Sig. (Canard et al. , 2006) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) σ 1 , σ 2 and σ 3 comes from Alice Observer σ 5 and σ 6 comes from Carol σ 4 and σ 7 are anonymous → Only 1 anonymous signature per group member P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 5 / 26

2-times Traceable Sig. (Au et al. , 2006) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer σ 1 and σ 3 comes from Alice σ 2 , σ 4 , σ 5 , σ 6 and σ 7 are anonymous → Only 2 anonymous signature P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 6 / 26

2-times Traceable Sig. (Au et al. , 2006) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer σ 1 and σ 3 comes from Alice σ 2 , σ 4 , σ 5 , σ 6 and σ 7 are anonymous → Only 2 anonymous signature σ 2 is anonymous → not full traceable P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 6 / 26

Our contribution: k-times Full Traceable Sig. Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer σ 1 , σ 2 and σ 3 comes from Alice σ 4 , σ 5 , σ 6 and σ 7 are anonymous P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 7 / 26

Our contribution: k-times Full Traceable Sig. Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer σ 1 , σ 2 and σ 3 comes from Alice σ 4 , σ 5 , σ 6 and σ 7 are anonymous → k anonymous signature per users → Trace all cheater’s signatures P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 7 / 26

Our contributions k-times Full Traceable Signature Generalize traceable signatures Ring signature (ad-hoc group) Event oriented Fine-grained k Anonymous (less than k ) Full public linkability (more than k ) Full public traceability (more than k ) Applications: proxy voting 1 k-times veto 2 P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 8 / 26

Application in k-times Veto for CARS’16 Alice Bob Carol David Conference on Anonymous Ring Signatures List of candidates for the Program Commitee (PC): Albert, Bernard, Cedric, Donald, Edward, Fabien, Gaston, Hercul, Ivan, Jim, Karl Each member of Steering Commitee (SC) can exclude k names of the list Vetos are anonymous Members who exceed this limitation are excluded and their vetos are discarded P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 9 / 26

Application: k-times Veto PC= Albert, Bernard, Cedric, Donald, Edward, Fabien, Gaston, Hercul, Ivan, Jim, Karl Veto using 2-times traceable signature: Alice Bob ( Donald , σ ( Donald )) ( Jim , σ ( Jim )) ( Edward , σ ( Edward )) ( Edward , σ ( Edward )) Carol David ( Albert , σ ( Albert )) ( Gaston , σ ( Gaston )) ( Gaston , σ ( Gaston )) P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 10 / 26

Application: k-times Veto PC= Albert, Bernard, Cedric, Donald, Edward, Fabien, Gaston, Hercul, Ivan, Jim, Karl Veto using 2-times full traceable signature: Alice Bob ( Donald , σ ( Donald )) ( Jim , σ ( Jim )) ( Edward , σ ( Edward )) ( Edward , σ ( Edward )) Carol David ( Albert , σ ( Albert )) ( Gaston , σ ( Gaston )) ( Gaston , σ ( Gaston )) P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 10 / 26

Outline Introduction 1 Definitions 2 k -FTRS Security Notions Our Scheme 3 Conclusion 4 P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 11 / 26

Formal Definition L , L 1 and L 2 are sets of public keys (identities) of users’ ring Definition ( k -FTRS) Init ( 1 t ) : output init Gen ( init , k ) : output a signing key pair ( ssk , svk ) Sig E ( ssk , m , L , j ) : output a signature σ Ver E ( L , σ, m ) : check that σ is valid Link E ( L 1 , L 2 , σ 1 , σ 2 , m 1 , m 2 ) : test link between σ 1 and σ 2 Match E ( L 1 , L 2 , σ 1 , σ 2 , m 1 , m 2 ) : output svk u and a tracer ω ( E , u ) Trace E ( L , σ, m , ω ( E , u ) ) : check whether σ comes from the user u . P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 13 / 26

Example (2-times) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 14 / 26

Example (2-times) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Observer Detect cheaters: link on all pairs ( σ i , σ j ) → Link σ 1 and σ 3 P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 14 / 26

Example (2-times) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Detect cheaters: link on all pairs ( σ i , σ j ) Observer → Link σ 1 and σ 3 Identify cheater: match on σ 1 and σ 3 → svk alice and tracer ω P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 14 / 26

Example (2-times) Alice Bob ( m 1 , σ 1 ) ( m 2 , σ 2 ) ( m 4 , σ 4 ) ( m 3 , σ 3 ) Carol David ( m 5 , σ 5 ) ( m 7 , σ 7 ) ( m 6 , σ 6 ) Detect cheaters: link on all pairs ( σ i , σ j ) Observer → Link σ 1 and σ 3 Identify cheater: match on σ 1 and σ 3 → svk alice and tracer ω Remove signature: trace using ω on all σ → Trace and remove σ 2 P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 14 / 26

Security Definition (Unforgeability) It is infeasible to forge a signature without the key Signature oracle P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 15 / 26

Security Definition (Unforgeability) It is infeasible to forge a signature without the key Signature oracle Definition (Anonymity) It is infeasible to guess the identity of a signer from less than k signatures Signature oracle (with inherent restrictions) P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 15 / 26

Security Definition (Unforgeability) It is infeasible to forge a signature without the key Signature oracle Definition (Anonymity) It is infeasible to guess the identity of a signer from less than k signatures Signature oracle (with inherent restrictions) Definition (Traceability) More than k signatures are always traceable Signature oracle P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 15 / 26

k -times Full Traceable Ring Signature Xavier Bultel Pascal - PowerPoint PPT Presentation

k -times Full Traceable Ring Signature Xavier Bultel Pascal Lafourcade 31 August 2016, P . Lafourcade (Univ Clermont Auvergne) k -times Full Traceable Ring Signature 31/08/2016 1 / 26 Signature P . Lafourcade (Univ Clermont Auvergne) k

Distributed Identity Based Short Linkable Ring Signature Kasra EdalatNejad Prof. Bryan Ford

Identity Based Ring Signature Why, How, and What Next Sherman S.M. Chow Richard W.C. Lui Lucas

Practical Implementation of Ring-SIS/LWE based Signature and IBE Pauline Bert, Pierre-Alain

W HEN DO WE MOVE TO FULL RING , SELF - CONSISTENT SIMULATIONS ? JR Cary 20180509 1 SIMULATIONS

Discharge uncertainty: sources and implications for hydrological analyses Signature 1 Signature

ratification and signature Signature vs ratification Signature formal expression of intent to

Electronic Signature Electronic Signature El Electronic Signature t i Si t Digital

FY20 Full Ye a r Re sults Pre se nta tio n 21 Aug ust 2020 De live ring inno va tive

Digital Signature Schemes 1 What is digital signature? Properties Who signed what is

FY19 Full Ye a r Re sults Pre se nta tio n Aug ust 2019 De live ring inno va tive industrial

1-out-of-2 Signature Jun Shao 2 Whats 1-out-of-2 Signature Mirosaw Kutyowski 1 and Jun

Full-speed ahead all-electric proton EDM ring Richard Talman Laboratory for Elementary-Particle

BALL BEAR RING SOFT CLOSE SLIDES ES Soft close fu full extension ball beari aring slide Side

EducationLiving in unequal times The facts We live in a world full of broken-ness, one

TIMES TABLES HOW WE TEACH TIMES TABLES AND HOW YOU CAN HELP WHY ARE TIMES TABLES IMPORTANT?

Non-Hamiltonian and Non-Traceable Regular 3-Connected Planar Graphs Nico Van Cleemput Carol T.

Non-Hamiltonian and Non-Traceable Regular 3-Connected Planar Graphs Nico Van Cleemput Carol T.

Virtual ring routing Virtual ring routing Some slides from http://

Ring A Vaginal Ring Containing Dapivirine for HIV-1 PrEP Ring Study: Background Study Design:

Traceable Anonymous Certificate dra raft-ie ietf-pkix-tac-01.txt IE IETF-72 at t PKIX IX WG

Quantitative Laser Spectroscopy for SI-Traceable Measurements of Greenhouse Gases Joseph T.

TRUTHS: - Traceable Radiometry Underpinning Terrestrial- and Helio- Studies: A benchmark mission

lattice element example in the Recycler Ring octupole 14 0.00000 0.33083E-01 0.0000E+00

New criteria for a ring to have a semisimple left quotient ring V. V. Bavula (University of