Signature Schemes with Efficient Protocols and Dynamic Group - PowerPoint PPT Presentation

Signature Schemes with Efficient Protocols and Dynamic Group Signatures from Lattice Assumptions Benoît Libert 1 , 2 San Ling 3 Fabrice Mouhartem 1 Khoa Nguyen 3 Huaxiong Wang 3 1 É.N.S. de Lyon, France 2 CNRS, France 3 Nanyang Technological University, Singapore Asiacrypt, Hanoi, 06/12/2016 Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 1/30

Privacy-Preserving Cryptography Important Goal: Anonymous authentication. Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 2/30

Privacy-Preserving Cryptography Important Goal: Anonymous authentication. e.g. e-voting, e-cash, group signatures, anonymous credentials. . . Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 2/30

Privacy-Preserving Cryptography Important Goal: Anonymous authentication. e.g. e-voting, e-cash, group signatures, anonymous credentials. . . Ingredients ◮ A signature scheme ◮ Zero-knowledge (ZK) proofs Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 2/30

Privacy-Preserving Cryptography Important Goal: Anonymous authentication. e.g. e-voting, e-cash, group signatures, anonymous credentials. . . Ingredients ◮ A signature scheme ◮ Zero-knowledge (ZK) proofs compatible with this signature (no hash functions) Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 2/30

Privacy-Preserving Cryptography Important Goal: Anonymous authentication. e.g. e-voting, e-cash, group signatures , anonymous credentials. . . Ingredients ◮ A signature scheme ◮ Zero-knowledge (ZK) proofs compatible with this signature (no hash functions) Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 2/30

Group Signatures A user wants to take public transportations. Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 3/30

Group Signatures A user wants to take public transportations. timestamp Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 3/30

Group Signatures A user wants to take public transportations. signature ◮ Authenticity & Integrity Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 3/30

Group Signatures A user wants to take public transportations. signature ??? ◮ Authenticity & Integrity ◮ Anonymity Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 3/30

Group Signatures A user wants to take public transportations. signature ??? ◮ Authenticity & Integrity ◮ Anonymity Join ◮ Dynamicity Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 3/30

Group Signatures A user wants to take public transportations. signature ◮ Authenticity & Integrity ◮ Anonymity Join ◮ Dynamicity ◮ Traceability POLICE Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 3/30

Motivation Dynamic group signatures In dynamic group signatures, new group members can be introduced at any time. The dynamic group setting: Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 4/30

Motivation Dynamic group signatures In dynamic group signatures, new group members can be introduced at any time. The dynamic group setting: ◮ Add users without re-running the Setup phase; Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 4/30

Motivation Dynamic group signatures In dynamic group signatures, new group members can be introduced at any time. The dynamic group setting: ◮ Add users without re-running the Setup phase; ◮ Even if everyone, including authorities, is dishonest, no one can sign in your name; Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 4/30

Motivation Dynamic group signatures In dynamic group signatures, new group members can be introduced at any time. The dynamic group setting: ◮ Add users without re-running the Setup phase; ◮ Even if everyone, including authorities, is dishonest, no one can sign in your name; ◮ Most use cases require dynamic groups (e.g., anonymous access control in buildings). Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 4/30

Anonymous Credentials (Chaum’85, Camenisch-Lysyanskya’01) Principle (e.g., U-Prove, Idemix) Involves Authority , Users and Verifiers . ◮ User dynamically obtains credentials from an authority under a pseudonym (= commitment to a digital identity) ◮ . . . and can dynamically prove possession of credentials using different ( unlinkable ) pseudonyms Different flavors : one-show/multi-show credentials, attribute-based access control,. . . Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 5/30

Anonymous Credentials (Chaum’85, Camenisch-Lysyanskya’01) Principle (e.g., U-Prove, Idemix) Involves Authority , Users and Verifiers . ◮ User dynamically obtains credentials from an authority under a pseudonym (= commitment to a digital identity) ◮ . . . and can dynamically prove possession of credentials using different ( unlinkable ) pseudonyms Different flavors : one-show/multi-show credentials, attribute-based access control,. . . General construction from signature with efficient protocols: ◮ Authority gives a user a signature on a committed message; ◮ User proves that same secret underlies different pseudonyms; ◮ User proves that he possesses a message-signature pair. Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 5/30

Signature with Efficient Protocols Signature Scheme with Efficient Protocols (Camenisch-Lysyanskya, SCN’02 ) Signer Verifier Sign Verify Message Message Signature Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 6/30

Signature with Efficient Protocols Signature Scheme with Efficient Protocols (Camenisch-Lysyanskya, SCN’02 ) Signer Verifier Sign Verify Open Message Message Signature ◮ Protocol for signing committed messages Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 6/30

Signature with Efficient Protocols Signature Scheme with Efficient Protocols (Camenisch-Lysyanskya, SCN’02 ) Signer Verifier Sign Verify Open Message Message Signature ZKPoK PoK ◮ Protocol for signing committed messages ◮ Proof of Knowledge (PoK) of (Message; Signature) Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 6/30

Lattice-Based Cryptography Lattice A lattice is a discrete subgroup of R n . Can be seen as integer linear combinations of a finite set of vectors. �� � Λ( b 1 , . . . , b n ) = i ≤ n a i b i | a i ∈ Z Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 7/30

Lattice-Based Cryptography Lattice A lattice is a discrete subgroup of R n . Can be seen as integer linear combinations of a finite set of vectors. �� � Λ( b 1 , . . . , b n ) = i ≤ n a i b i | a i ∈ Z Why? ◮ Simple and efficient; ◮ Still conjectured quantum-resistant; ◮ Connection between average-case and worst-case problems; ◮ Powerful functionalities (e.g., FHE). → Finding a non-zero short vector in a lattice is hard. Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 7/30

Hardness Assumptions: SIS and LWE Parameters : n dimension, m ≥ n , q modulus. ֓ U ( Z m × n For A ← ) : q Small Integer Solution Learning With Errors x s + e , A A = 0 [ q ] A m n ֓ Z n s ← e small error q � � Goal: Given A ∈ Z m × n , find Goal: Given A , A s + e , q x ∈ Z m \{ 0 } small find s ∈ Z n q Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 8/30

Group Signatures: History 1991 Chaum and van Heyst : introduction 2000 Ateniese, Camenisch, Joye and Tsudik : first scalable solution 2003 Bellare, Micciancio and Warinschi : model for static groups Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 9/30

Group Signatures: History 1991 Chaum and van Heyst : introduction 2000 Ateniese, Camenisch, Joye and Tsudik : first scalable solution 2003 Bellare, Micciancio and Warinschi : model for static groups 2004 Kiayias and Yung : model for dynamic groups 2004 Bellare, Shi and Zhang : model for dynamic groups Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 9/30

Group Signatures: History 1991 Chaum and van Heyst : introduction 2000 Ateniese, Camenisch, Joye and Tsudik : first scalable solution 2003 Bellare, Micciancio and Warinschi : model for static groups 2004 Kiayias and Yung : model for dynamic groups 2004 Bellare, Shi and Zhang : model for dynamic groups 2010 Gordon, Katz and Vaikuntanathan : first lattice -based scheme 2013 Laguillaumie, Langlois, Libert and Stehlé : log-size signatures from lattices Fabrice Mouhartem Signatures with Efficient Protocols and Lattice-Based Dynamic GS 06.12.2016 9/30