Lattice-Based Signature Scheme with Verifier Local Revocation Adeline Langlois 1 San Ling 2 Khoa Nguyen 2 Huaxiong Wang 2 1 LIP, ENS de Lyon, France 2 Nanyang Technological University, Singapore March 27, 2014 PKC 2014 Group Signature with VLR March 27, 2014 1/ 15
Our main result with N members First lattice-based group signature with verifier-local revocation, logarithmic signature size, and security under the SIS assumption in the Random Oracle Model. logarithmic in N hard problem on lattices PKC 2014 Group Signature with VLR March 27, 2014 2/ 15
Group signatures [ChaumVanHeyst91] Group signatures allow any member of a group to anonymously and accountably sign on behalf of this group. ◮ Group manager gpk , gsk i KeyGen, Open ◮ Group members ( gsk i ) Sign ◮ Anyone Verify KeyGen Open Security: • Anonymity Sign • Traceability Group Members Group Manager Verify Anyone PKC 2014 Group Signature with VLR March 27, 2014 3/ 15
Group signatures with verifier-local revocation [ChaumVanHeyst91] [BonehShacham04] Group signatures allow any member of a group to anonymously and accountably sign on behalf of this group. ◮ Group manager gpk , gsk i , grt i KeyGen ◮ Group members ( gsk i ) Sign ◮ Anyone Verify KeyGen Security: • Anonymity Sign Revocated • Traceability Group Member d Group RL Manager Verify fails if grt d ∈ RL Anyone PKC 2014 Group Signature with VLR March 27, 2014 3/ 15
Security: anonymity and traceability Security requirements [BonehShacham04] ◮ Correctness ∀ ( gpk , gsk , grt ) ← KeyGen , ∀ i ∈ [ N − 1] , ∀ M ∈ { 0 , 1 } ∗ , Verify ( gpk , RL, Sign ( gpk , gsk i , M ) , M ) = Valid ⇔ grt i �∈ RL. ◮ Selfless-anonymity A given signature does not leak the identity of its originator. Given gpk and Sign , Corruption and Revocation queries, Goal find which of the two adaptively chosen keys generates the signature. ◮ Traceability No collusion of malicious users can produce a valid signature that cannot be traced to one of them. Given gpk , grt i for all i , and gsk i of users in the collusion, Goal create a valid signature that doesn’t trace to someone in the collusion (or that fails). PKC 2014 Group Signature with VLR March 27, 2014 4/ 15
Applications Need for authenticity and anonymity ◮ Anonymous credentials: anonymous use of certified attributes ◮ E.g.: student card - name, picture, date, grade... ◮ Traffic management (Vehicle Safety Communications project of the U.S. Dept. of Transportation). ◮ Restrictive area access. PKC 2014 Group Signature with VLR March 27, 2014 5/ 15
Prior works ◮ Group signature introduced by [ChaumVanHest91] , ◮ Group signature with verifier local revocation introduced by [Brickell03] and [KiayiasTsiounisYung04] , ◮ Formalized by [BonehShacham04] , ◮ Number of realizations in bilinear map setting : [NakanishiFunabiki05 and 06] , [LibertVergnaud09] , [BichselCamenishNevenSmartWarinschi10] . In lattice-based cryptography: ◮ First one [GordonKatzVaikuntanathan10] , then with signature size linear in N : [CamenischNevenRückert12] . ◮ Signature size logarithmic in N (and full-anonymity): [LaguillaumieLangloisLibertStehlé13] . ◮ Our result: first lattice-based group signature with verifier-local revocation (and we have signature size logarithmic in N ). PKC 2014 Group Signature with VLR March 27, 2014 6/ 15
Lattice-based cryptography From basic to very advanced primitives ◮ Public key encryption [Regev05, ...] , ◮ Lyubashevsky signature scheme [Lyubashevsky12] , ◮ Identity-based encryption [GentryPeikertVaikuntanathan08, ...] , ◮ Attribute-based encryption [Boyen13, GorbunovVaikuntanathanWee13] , ◮ Fully homomorphic encryption [Gentry09, ...] . Advantages of lattice-based primitives ◮ (Asymptotically) efficient, ◮ Security proofs from the hardness of LWE and SIS , ◮ Likely to resist quantum attacks. PKC 2014 Group Signature with VLR March 27, 2014 7/ 15
SIS β and ISIS β Parameters: n dimension, m ≥ n , q modulus. For A ← U ( Z m × n ) : q Short Integer Solution Inhomogeneous SIS x x A A = 0 mod q = u mod q Goal: Given A ← U ( Z m × n Goal: Given A ← U ( Z m × n ) , u ∈ Z n ) , q , q q find x s.t. 0 < � x � ≤ β . find x s.t. 0 < � x � ≤ β . Shown to be as hard as worst-case lattice problems, [GentryPeikertVaikuntanathan2008] PKC 2014 Group Signature with VLR March 27, 2014 8/ 15
Lattice-based cryptography toolbox: trapdoors ◮ TrapGen � ( A , T A ) such that T A is a short basis of the lattice q ( A ) = { x ∈ Z m : x T · A = 0 Λ ⊥ (mod q ) } . � A public description of the lattice T A short basis, kept secret ◮ Note that: 1. Computing T A given A is hard, 2. Constructing A together with T A is easy. ◮ With T A , we can sample short vectors in Λ ⊥ q ( A ) . PKC 2014 Group Signature with VLR March 27, 2014 9/ 15
Our construction Ingredients ◮ Certificate of users � key to produce temporary certificate, ◮ Bonsai Tree signature [CashHofheinzKiltzPeikert12] , ◮ ZKPoK using "Stern Extension" adapted from [LingNguyenStehléWang13] . Our scheme ◮ The member uses an interactive protocol to convince the verifier that he is a certified group member and he has not been revoked, ◮ Repeated many times to make the soundness error negligibly small. ◮ Convert this protocol to a signature scheme via Fiat Shamir. PKC 2014 Group Signature with VLR March 27, 2014 10/ 15
Generation of the keys N = 2 ℓ group members KeyGen ◮ Run TrapGen to get A 0 together with a trapdoor T A 0 , ◮ Sample u uniform in Z n q , ◮ Sample 2 ℓ public matrices ( A ( b ) i ) ’s for b ∈ { 0 , 1 } , then define A and for each d ∈ [ N − 1] : A d (as in a Bonsai signature), A 0 A (0) A 0 1 A (1) A ( d 1 ) 1 ∈ Z ( ℓ +1) m × n ∈ Z ( ℓ +1) m × n 1 A = , and A d = . . . q q . . . . A ( d ℓ ) A (0) ℓ ℓ A (1) ℓ PKC 2014 Group Signature with VLR March 27, 2014 11/ 15
Generation of the keys N = 2 ℓ group members KeyGen ◮ Run TrapGen to get A 0 together with a trapdoor T A 0 , ◮ Sample u uniform in Z n q , ◮ Sample 2 ℓ public matrices ( A ( b ) i ) ’s for b ∈ { 0 , 1 } , then define A and for each d ∈ [ N − 1] : A d (as in a Bonsai signature), ◮ For each d , sample a small x d gaussian (using T A 0 ), such that ( x d ) T A d = u T mod q , A 0 A ( d 1 ) � � = u T mod q ( x ( d ) 1 0 ) T ( x d 1 1 ) T ( x d ℓ ℓ ) T . . . . . . A ( d ℓ ) ℓ PKC 2014 Group Signature with VLR March 27, 2014 11/ 15
Generation of the keys N = 2 ℓ group members KeyGen ◮ Run TrapGen to get A 0 together with a trapdoor T A 0 , ◮ Sample u uniform in Z n q , ◮ Sample 2 ℓ public matrices ( A ( b ) i ) ’s for b ∈ { 0 , 1 } , then define A and for each d ∈ [ N − 1] : A d (as in a Bonsai signature), ◮ For each d , sample a small x d gaussian (using T A 0 ), such that ( x d ) T A d = u T mod q , ◮ Public key: gpk = ( A , u ) , ◮ Secret key for each d : gsk d = x ( d ) such that x ( d ) A d = u T mod q , � � x ( d ) = ( x ( d ) ( x d 1 ( x d ℓ 0 ) T 1 ) T ℓ ) T . . . . ◮ Revocation token for each d : grt d = ( x ( d ) 0 ) T A 0 . PKC 2014 Group Signature with VLR March 27, 2014 11/ 15
Sign ◮ To sign a message, the user must hide d ◮ ⇒ he cannot convince a verifier that he knows x ( d ) with ( x ( d ) ) T A d = u T mod q if the verifier does not know A d . PKC 2014 Group Signature with VLR March 27, 2014 12/ 15
Sign ◮ To sign a message, the user must hide d ◮ ⇒ he cannot convince a verifier that he knows x ( d ) with ( x ( d ) ) T A d = u T mod q if the verifier does not know A d . ◮ Solution: prove that he knows x such that x T A = u T mod q , and that for every two consecutive blocks of x ( d ) , one is a zero block. PKC 2014 Group Signature with VLR March 27, 2014 12/ 15
Sign ◮ To sign a message, the user must hide d ◮ ⇒ he cannot convince a verifier that he knows x ( d ) with ( x ( d ) ) T A d = u T mod q if the verifier does not know A d . ◮ Solution: prove that he knows x such that x T A = u T mod q , and that for every two consecutive blocks of x ( d ) , one is a zero block. � � ◮ Recall that x ( d ) = ( x ( d ) ( x d 1 ( x d ℓ 0 ) T 1 ) T ℓ ) T , . . . Construct x : � � ( x ( d ) ( x d 1 0 ) T 1 ) T 0 . . . � �� � if d 1 =0 PKC 2014 Group Signature with VLR March 27, 2014 12/ 15
Sign ◮ To sign a message, the user must hide d ◮ ⇒ he cannot convince a verifier that he knows x ( d ) with ( x ( d ) ) T A d = u T mod q if the verifier does not know A d . ◮ Solution: prove that he knows x such that x T A = u T mod q , and that for every two consecutive blocks of x ( d ) , one is a zero block. � � ◮ Recall that x ( d ) = ( x ( d ) ( x d 1 ( x d ℓ 0 ) T 1 ) T ℓ ) T , . . . Construct x : � � ( x ( d ) ( x d 1 0 ) T 1 ) T 0 . . . � �� � if d 1 =1 PKC 2014 Group Signature with VLR March 27, 2014 12/ 15
Recommend
More recommend
