signatures with flexible public key introducing
play

Signatures with Flexible Public Key: Introducing Equivalence Classes - PowerPoint PPT Presentation

Signatures with Flexible Public Key: Introducing Equivalence Classes for Public Keys Michael Backes, Lucjan Hanzlik, Kamil Kluzcniak, Jonas Schneider This Talk New primitive! Signatures with Flexible Public Key Applications to


  1. Signatures with Flexible Public Key: Introducing Equivalence Classes for Public Keys Michael Backes, Lucjan Hanzlik, Kamil Kluzcniak, Jonas Schneider

  2. This Talk ▪ New primitive! Signatures with Flexible Public Key ▪ Applications to • sub-linear size Ring Signatures from falsifiable assumptions without trusted setup • efficient standard model Group Signatures in combination with SPS-EQ

  3. Ring Signatures [Rivest-Shamir-Tauman, 2001]

  4. Ring Signatures [Rivest-Shamir-Tauman, 2001] ℛ Ring vk 1 vk 2 vk i sk i … vk n

  5. Ring Signatures [Rivest-Shamir-Tauman, 2001] ℛ Ring vk 1 vk 2 vk i sk i … vk n σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ )

  6. Ring Signatures [Rivest-Shamir-Tauman, 2001] ℛ Ring vk 1 vk 2 vk i sk i … vk n σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) 𝚋𝚍𝚍𝚏𝚚𝚞 / 𝚜𝚏𝚔𝚏𝚍𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( σ , m , ℛ )

  7. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] 𝒝

  8. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l 𝒝

  9. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Corruption Oracle 𝒝

  10. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Corruption Oracle i , m , ℛ 𝒝 σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) σ

  11. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Corruption Oracle i i , m , ℛ 𝒝 σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) sk i σ

  12. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Corruption Oracle i i , m , ℛ 𝒝 σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) sk i σ m *, σ *, ℛ *

  13. Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Corruption Oracle i i , m , ℛ 𝒝 σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) sk i σ 𝒝 wins if m *, σ *, ℛ * 𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( σ *, m *, ℛ *) only honest keys in ℛ * ( m *, ℛ *) never queried

  14. Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l 𝒝

  15. Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle i , m , ℛ 𝒝 σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) σ

  16. Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Challenge Oracle i , m , ℛ i 0 , i 1 , m , ℛ 𝒝 b ← {0,1} σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) σ σ * ← 𝖳𝗃𝗁𝗈 ( sk i b , m , ℛ ) σ *, ω 1 , …, ω l

  17. ̂ Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Challenge Oracle i , m , ℛ i 0 , i 1 , m , ℛ 𝒝 b ← {0,1} σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) σ σ * ← 𝖳𝗃𝗁𝗈 ( sk i b , m , ℛ ) σ *, ω 1 , …, ω l b

  18. ̂ Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006] vk 2 vk 1 … vk l Signing Oracle Challenge Oracle i , m , ℛ i 0 , i 1 , m , ℛ 𝒝 b ← {0,1} σ ← 𝖳𝗃𝗁𝗈 ( sk i , m , ℛ ) σ σ * ← 𝖳𝗃𝗁𝗈 ( sk i b , m , ℛ ) σ *, ω 1 , …, ω l b 𝒝 wins if b = ̂ b

  19. Ring Signatures: Desiderata ▪ Standard Model security, falsifiable assumptions, no ROM ▪ Small signatures for efficiency ▪ No form of trusted setup!

  20. Ring Signatures: Generic Approach Prove Ring Sign the Message Membership

  21. Ring Signatures: Generic Approach Prove Ring Sign the Message Membership

  22. Ring Signatures: [Malavolta-Schröder, 2017]

  23. Ring Signatures: [Malavolta-Schröder, 2017] sk ′ � ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫 ( sk , r ) σ m ← Σ . 𝖳𝗃𝗁𝗈 ( sk ′ � , m || ℛ ) Σ : Signature Scheme with Rerandomizable Keys [Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016]

  24. Ring Signatures: [Malavolta-Schröder, 2017] sk ′ � ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫 ( sk , r ) ( ) vk ′ � = Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖶𝖫 ( vk , r ) π ← Π . 𝖰𝗌𝗉𝗐𝖿 σ m ← Σ . 𝖳𝗃𝗁𝗈 ( sk ′ � , m || ℛ ) vk in ℛ σ = ( vk ′ � , σ m , π ) Σ : Signature Scheme with Rerandomizable Keys [Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016] Π : tailored NIZK-PoK with shared setup

  25. Ring Signatures: [Malavolta-Schröder, 2017] sk ′ � ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫 ( sk , r ) ( ) vk ′ � = Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖶𝖫 ( vk , r ) π ← Π . 𝖰𝗌𝗉𝗐𝖿 σ m ← Σ . 𝖳𝗃𝗁𝗈 ( sk ′ � , m || ℛ ) vk in ℛ σ = ( vk ′ � , σ m , π ) Σ : Signature Scheme with Rerandomizable Keys [Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016] Π : tailored NIZK-PoK with shared setup •No Setup •Security under q-Strong DH assumption + Linear-KEA (GGM) •O(n) signature size

  26. Signatures with Flexible Public Key (SFPK)

  27. Signatures with Flexible Public Key (SFPK) ( sk , vk ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) σ ← 𝖳𝗃𝗁𝗈 ( sk , m ) 𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( vk , σ , m ) 𝚜𝚏𝚔𝚏𝚍𝚞

  28. Signatures with Flexible Public Key (SFPK) vk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫 ( vk , r ) ( sk , vk ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk , r ) σ ← 𝖳𝗃𝗁𝗈 ( sk , m ) vk ′ � ∼ vk 𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( vk , σ , m ) 𝚜𝚏𝚔𝚏𝚍𝚞

  29. Signatures with Flexible Public Key (SFPK) vk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫 ( vk , r ) ( sk , vk ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk , r ) σ ← 𝖳𝗃𝗁𝗈 ( sk , m ) vk ′ � ∼ vk 𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( vk , σ , m ) 𝚜𝚏𝚔𝚏𝚍𝚞 ( τ , sk , vk ) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) 𝚣𝚏𝚝 ← 𝖣𝗂𝖿𝖽𝗅𝖲𝖿𝗊 ( τ , vk , vk ′ � ) 𝚘𝚙

  30. Signatures with Flexible Public Key (SFPK) vk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫 ( vk , r ) ( sk , vk ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk , r ) σ ← 𝖳𝗃𝗁𝗈 ( sk , m ) vk ′ � ∼ vk 𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( vk , σ , m ) 𝚜𝚏𝚔𝚏𝚍𝚞 Example vk , vk ′ � ∈ 𝔿 ℓ ( τ , sk , vk ) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) vk ∼ vk ′ � if there is r ∈ ℤ * p 𝚣𝚏𝚝 ← 𝖣𝗂𝖿𝖽𝗅𝖲𝖿𝗊 ( τ , vk , vk ′ � ) ( vk r 1 , … vk r ℓ ) = ( vk ′ � 1 , … vk ′ � ℓ ) 𝚘𝚙

  31. SFPK: Unforgeability 𝒝

  32. SFPK: Unforgeability ( τ , sk , vk ) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) ( τ , vk ) 𝒝

  33. SFPK: Unforgeability ( τ , sk , vk ) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) ( τ , vk ) m , r 𝒝 sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk , r ) σ σ ← 𝖳𝗃𝗁𝗈 ( sk ′ � , m )

  34. SFPK: Unforgeability ( τ , sk , vk ) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) ( τ , vk ) m , r 𝒝 sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk , r ) σ σ ← 𝖳𝗃𝗁𝗈 ( sk ′ � , m ) ( vk *, m *, σ *)

  35. SFPK: Unforgeability ( τ , sk , vk ) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ) ( τ , vk ) m , r 𝒝 sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk , r ) σ σ ← 𝖳𝗃𝗁𝗈 ( sk ′ � , m ) 𝒝 wins if 𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓 ( vk *, σ *, m *) ( vk *, m *, σ *) m * never queried 𝚣𝚏𝚝 ← 𝖣𝗂𝖿𝖽𝗅𝖲𝖿𝗊 ( τ , 𝗐𝗅 , 𝗐𝗅 *)

  36. SFPK: Class-Hiding 𝒝

  37. SFPK: Class-Hiding ( sk 0 , vk 0 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 0 ) ( sk 1 , vk 1 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 1 ) 𝒝

  38. SFPK: Class-Hiding ( sk 0 , vk 0 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 0 ) b ← {0,1} ( sk 1 , vk 1 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 1 ) 𝒝

  39. SFPK: Class-Hiding ( sk 0 , vk 0 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 0 ) b ← {0,1} ( sk 1 , vk 1 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 1 ) vk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫 ( vk b , r ) r ← R sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk b , r ) 𝒝

  40. SFPK: Class-Hiding ( sk 0 , vk 0 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 0 ) b ← {0,1} ( sk 1 , vk 1 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 1 ) vk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫 ( vk b , r ) r ← R sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk b , r ) ( vk ′ � , ω 0 , ω 1 ) 𝒝

  41. SFPK: Class-Hiding ( sk 0 , vk 0 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 0 ) b ← {0,1} ( sk 1 , vk 1 ) ← 𝖫𝖿𝗓𝖧𝖿𝗈 (1 λ ; ω 1 ) vk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫 ( vk b , r ) r ← R sk ′ � ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫 ( sk b , r ) ( vk ′ � , ω 0 , ω 1 ) m 𝒝 σ ← 𝖳𝗃𝗁𝗈 ( sk ′ � , m ) σ

Recommend


More recommend