Ambiguous Optimistic Fair Exchange Research Articles

How to protect privacy in Optimistic Fair Exchange of digital signatures

How to sign an electronic contract online between two parties (say Alice and Bob) in a fair manner is an interesting problem, and has been extensively studied for a long time. Optimistic Fair Exchange (OFE) is an efficient solution to it, in which a semi-trusted third party, named the arbitrator, is responsible for resolving any dispute that may arise during an exchange between Alice and Bob. Recently, several variants of OFE, such as Ambiguous OFE (AOFE) and Perfect AOFE (PAOFE), have been introduced to protect the privacy of Alice and Bob. These primitives prevent any outsider from telling which parties are involved in an exchange of digital signatures before the exchange completes. However, in PAOFE, AOFE and all the existing works on OFE, the arbitrator can always learn the signer’s full signature at (or even before) the end of resolution, which is undesirable in some important applications, for example, signing a contract between two parties which do not want others to find out even when there is a dispute that needs resolution by the arbitrator.In this work, we introduce a new notion called Privacy-Preserving Optimistic Fair Exchange (P2OFE) for protecting the privacy of users, in which other than Alice and Bob, no one else including the arbitrator, can collect any evidence about an exchange between them even after the resolution of a dispute. We formally define P2OFE and present the corresponding security models and propose a concrete and efficient construction of P2OFE. We also discuss about several extensions about implementation. Our scheme is proved to be secure under the given security models based on the Strong Diffie–Helllman and Decision Linear assumptions without relying on the random oracle heuristic.

Ambiguous optimistic fair exchange: Definition and constructions

Optimistic fair exchange (OFE) is a protocol for solving the problem of exchanging items or services in a fair manner between two parties, a signer and a verifier, with the help of an arbitrator which is called in only when a dispute happens between the two parties. In almost all the previous work on OFE, after obtaining a partial signature from the signer, the verifier can present it to others and show that the signer has indeed committed itself to something corresponding to the partial signature even prior to the completion of the transaction. In some scenarios, this capability given to the verifier may be harmful to the signer. In this paper, we propose the notion of ambiguous optimistic fair exchange (AOFE), which is a variant of OFE and requires additionally that the verifier cannot convince anybody about the authorship of a partial signature generated by the signer. We present a formal security model for AOFE in the multi-user setting and chosen-key model, and propose a generic construction of AOFE that is provably secure under our model. Furthermore, we propose an efficient instantiation of the generic construction, security of which is based on Strong Diffie–Hellman assumption and Decision Linear assumption without random oracles.

The construction of ambiguous optimistic fair exchange from designated confirmer signature without random oracles

Ambiguous Optimistic Fair Exchange (AOFE), introduced by Huang et al. in ASIACRYPT 2008, is an extension of OFE that enhances the fairness of the two communicating parties in the exchange of signatures. The first scheme was proven secure without random oracles while its partial signature contains dozens of group elements. Recently, interactive AOFE was introduced and the construction is more practical, where a partial signature only contains three group elements. It is based on the existence of Designated Confirmer Signature (DCS) with a special property where one is able to sample a confirmer signature efficiently from a signer’s signature space. Nevertheless, we note that there are only a few DCS schemes that have this special property. Security of the interactive AOFE construction relies on the q-Computational and Decisional Hidden Strong Diffie-Hellman assumptions. In this paper, we propose a new construction of interactive AOFE from DCS, where the underlying DCS is standard and does not require any special property. We also propose a new DCS construction. By applying our transformation from DCS to interactive AOFE, we build a concrete interactive AOFE which is secure under more standard number-theoretic assumptions, namely Strong Diffie-Hellman and Decision Linear assumptions, without random oracles. A partial signature of the interactive AOFE contains six group elements, while a full signature contains two only.

Efficient Designated Confirmer Signature and DCS-Based Ambiguous Optimistic Fair Exchange

Designated confirmer signature (DCS) extends the undeniable signature so that a party called confirmer can also confirm/disavow nonself-authenticating signatures on the signer's behalf. Previous DCS schemes, however, can let a signer confirm a valid signature but not disavow an invalid one, while only a confirmer can. It remains open to construct a DCS which also allows the signer to disavow. In this work, we propose new security models for formalizing the signer's ability to disavow. We propose a new DCS scheme and prove its security without random oracles. The new DCS scheme is efficient and also convertible. A signature in this new DCS consists of only three bilinear group elements. This is much shorter than any of the existing schemes. In addition, the scheme can be extended to support multiple confirmers and threshold conversion. Adding a confirmer incurs the addition of only one group element in a signature. Furthermore, we propose an efficient construction of ambiguous optimistic fair exchange (AOFE) of digital signatures based on the new DCS scheme. A partial AOFE signature consists of three elements in an elliptic curve group and four in group , and a full signature has only three group elements, which are shorter than those in Garay 's scheme (Crypto 1999) and Huang 's scheme (Asiacrypt 2008).

Group-oriented fair exchange of signatures

Optimistic Fair Exchange (OFE) of digital signatures allows two parties to exchange their signatures in a fair manner so that a third party, called the arbitrator, gets involved only when there is a dispute. Previous work on OFE considers the two parties as individuals and there is no formal study on the scenario where the two parties are two groups of users. In this paper, we formalize this new variant and call it a Group-oriented Optimistic Fair Exchange (GOFE). GOFE allows two users from two different groups to exchange signatures on behalf of their groups in a fair and anonymous manner. We formalize the notion by providing the first set of security models for GOFE, and show that it is closely related to Ambiguous OFE (AOFE) proposed by Huang et al. in Asiacrypt 2008. In particular, we propose a generic transformation which converts a GOFE to an AOFE. We also give an efficient and concrete GOFE construction and prove its security under the security models we defined. The security of the scheme relies on the decision linear assumption and strong Diffie–Hellman assumption in the random oracle model.