8,193 research outputs found
Accountable Tracing Signatures from Lattices
Group signatures allow users of a group to sign messages anonymously in the
name of the group, while incorporating a tracing mechanism to revoke anonymity
and identify the signer of any message. Since its introduction by Chaum and van
Heyst (EUROCRYPT 1991), numerous proposals have been put forward, yielding
various improvements on security, efficiency and functionality. However, a
drawback of traditional group signatures is that the opening authority is given
too much power, i.e., he can indiscriminately revoke anonymity and there is no
mechanism to keep him accountable. To overcome this problem, Kohlweiss and
Miers (PoPET 2015) introduced the notion of accountable tracing signatures
(ATS) - an enhanced group signature variant in which the opening authority is
kept accountable for his actions. Kohlweiss and Miers demonstrated a generic
construction of ATS and put forward a concrete instantiation based on
number-theoretic assumptions. To the best of our knowledge, no other ATS scheme
has been known, and the problem of instantiating ATS under post-quantum
assumptions, e.g., lattices, remains open to date.
In this work, we provide the first lattice-based accountable tracing
signature scheme. The scheme satisfies the security requirements suggested by
Kohlweiss and Miers, assuming the hardness of the Ring Short Integer Solution
(RSIS) and the Ring Learning With Errors (RLWE) problems. At the heart of our
construction are a lattice-based key-oblivious encryption scheme and a
zero-knowledge argument system allowing to prove that a given ciphertext is a
valid RLWE encryption under some hidden yet certified key. These technical
building blocks may be of independent interest, e.g., they can be useful for
the design of other lattice-based privacy-preserving protocols.Comment: CT-RSA 201
Accountable Tracing Signatures
Demands for lawful access to encrypted data are a long standing obstacle to integrating cryptographic protections into communication systems. A common approach is to allow a trusted third party (TTP) to gain access to private data. However, there is no way to verify that this trust is well place as the TTP may open all messages indiscriminately. Moreover, existing approaches do not scale well when, in addition to the content of the conversation, one wishes to hide ones identity. Given the importance of metadata this is a major problem. We propose a new signature scheme as an accountable replacement for group signatures, accountable forward and backward tracing signatures
Introducing Accountability to Anonymity Networks
Many anonymous communication (AC) networks rely on routing traffic through
proxy nodes to obfuscate the originator of the traffic. Without an
accountability mechanism, exit proxy nodes risk sanctions by law enforcement if
users commit illegal actions through the AC network. We present BackRef, a
generic mechanism for AC networks that provides practical repudiation for the
proxy nodes by tracing back the selected outbound traffic to the predecessor
node (but not in the forward direction) through a cryptographically verifiable
chain. It also provides an option for full (or partial) traceability back to
the entry node or even to the corresponding user when all intermediate nodes
are cooperating. Moreover, to maintain a good balance between anonymity and
accountability, the protocol incorporates whitelist directories at exit proxy
nodes. BackRef offers improved deployability over the related work, and
introduces a novel concept of pseudonymous signatures that may be of
independent interest.
We exemplify the utility of BackRef by integrating it into the onion routing
(OR) protocol, and examine its deployability by considering several
system-level aspects. We also present the security definitions for the BackRef
system (namely, anonymity, backward traceability, no forward traceability, and
no false accusation) and conduct a formal security analysis of the OR protocol
with BackRef using ProVerif, an automated cryptographic protocol verifier,
establishing the aforementioned security properties against a strong
adversarial model
Lime: Data Lineage in the Malicious Environment
Intentional or unintentional leakage of confidential data is undoubtedly one
of the most severe security threats that organizations face in the digital era.
The threat now extends to our personal lives: a plethora of personal
information is available to social networks and smartphone providers and is
indirectly transferred to untrustworthy third party and fourth party
applications.
In this work, we present a generic data lineage framework LIME for data flow
across multiple entities that take two characteristic, principal roles (i.e.,
owner and consumer). We define the exact security guarantees required by such a
data lineage mechanism toward identification of a guilty entity, and identify
the simplifying non repudiation and honesty assumptions. We then develop and
analyze a novel accountable data transfer protocol between two entities within
a malicious environment by building upon oblivious transfer, robust
watermarking, and signature primitives. Finally, we perform an experimental
evaluation to demonstrate the practicality of our protocol
Report and Trace Ring Signatures
We introduce report and trace ring signature schemes, balancing the desire for signer anonymity with the ability to report malicious behaviour and subsequently revoke anonymity. We contribute a formal security model for report and trace ring signatures that incorporates established properties of anonymity, unforgeability and traceability, and captures a new notion of reporter anonymity. We present a construction of a report and trace ring signature scheme, proving its security and analysing its efficiency, comparing with the state of the art in the accountable ring signatures literature. Our analysis demonstrates that our report and trace scheme is efficient, particularly for the choice of cryptographic primitives that we use to instantiate our construction. We contextualise our new primitive with respect to related work, and highlight, in particular, that report and trace ring signature schemes protect the identity of the reporter even after tracing is complete
Lattice-Based Group Signatures: Achieving Full Dynamicity (and Deniability) with Ease
In this work, we provide the first lattice-based group signature that offers
full dynamicity (i.e., users have the flexibility in joining and leaving the
group), and thus, resolve a prominent open problem posed by previous works.
Moreover, we achieve this non-trivial feat in a relatively simple manner.
Starting with Libert et al.'s fully static construction (Eurocrypt 2016) -
which is arguably the most efficient lattice-based group signature to date, we
introduce simple-but-insightful tweaks that allow to upgrade it directly into
the fully dynamic setting. More startlingly, our scheme even produces slightly
shorter signatures than the former, thanks to an adaptation of a technique
proposed by Ling et al. (PKC 2013), allowing to prove inequalities in
zero-knowledge. Our design approach consists of upgrading Libert et al.'s
static construction (EUROCRYPT 2016) - which is arguably the most efficient
lattice-based group signature to date - into the fully dynamic setting.
Somewhat surprisingly, our scheme produces slightly shorter signatures than the
former, thanks to a new technique for proving inequality in zero-knowledge
without relying on any inequality check. The scheme satisfies the strong
security requirements of Bootle et al.'s model (ACNS 2016), under the Short
Integer Solution (SIS) and the Learning With Errors (LWE) assumptions.
Furthermore, we demonstrate how to equip the obtained group signature scheme
with the deniability functionality in a simple way. This attractive
functionality, put forward by Ishida et al. (CANS 2016), enables the tracing
authority to provide an evidence that a given user is not the owner of a
signature in question. In the process, we design a zero-knowledge protocol for
proving that a given LWE ciphertext does not decrypt to a particular message
Decentralized Threshold Signatures with Dynamically Private Accountability
Threshold signatures are a fundamental cryptographic primitive used in many
practical applications. As proposed by Boneh and Komlo (CRYPTO'22), TAPS is a
threshold signature that is a hybrid of privacy and accountability. It enables
a combiner to combine t signature shares while revealing nothing about the
threshold t or signing quorum to the public and asks a tracer to track a
signature to the quorum that generates it. However, TAPS has three
disadvantages: it 1) structures upon a centralized model, 2) assumes that both
combiner and tracer are honest, and 3) leaves the tracing unnotarized and
static. In this work, we introduce Decentralized, Threshold, dynamically
Accountable and Private Signature (DeTAPS) that provides decentralized
combining and tracing, enhanced privacy against untrusted combiners (tracers),
and notarized and dynamic tracing. Specifically, we adopt Dynamic Threshold
Public-Key Encryption (DTPKE) to dynamically notarize the tracing process,
design non-interactive zero knowledge proofs to achieve public verifiability of
notaries, and utilize the Key-Aggregate Searchable Encryption to bridge TAPS
and DTPKE so as to awaken the notaries securely and efficiently. In addition,
we formalize the definitions and security requirements for DeTAPS. Then we
present a generic construction and formally prove its security and privacy. To
evaluate the performance, we build a prototype based on SGX2 and Ethereum
Foundations of Fully Dynamic Group Signatures
Group signatures are a central cryptographic primitive that has received a considerable amount of attention from the cryptographic community. They allow members of a group to anonymously sign on behalf of the group. Membership is overseen by a designated group manager. There is also a tracing authority that can revoke anonymity by revealing the identity of the signer if and when needed, to enforce accountability and deter abuse. For the primitive to be applicable in practice, it needs to support fully dynamic groups, i.e. users can join and leave at any time. In this work we take a close look at existing security definitions for fully dynamic group signatures. We identify a number of shortcomings in existing security definitions and fill the gap by providing a formal rigorous security model for the primitive. Our model is general and is not tailored towards a specific design paradigm and can therefore, as we show, be used to argue about the security of different existing constructions following different design paradigms. Our definitions are stringent and when possible incorporate protection against maliciously chosen keys. In the process, we identify a subtle issue inherent to one design paradigm, where new members might try to implicate older ones by means of back-dated signatures. This is not captured by existing models. We propose some inexpensive fixes for some existing constructions to avoid the issue
- …