Optimistic Fair Exchange Research Articles

Verifiable Encryption from MPC-in-the-Head

Verifiable encryption (VE) is a protocol where one can provide assurance that an encrypted plaintext satisfies certain properties, or relations. It is an important building block in cryptography with many useful applications, such as key escrow, group signatures, optimistic fair exchange, and others. However, the majority of previous VE schemes are restricted to instantiation with specific public-key encryption schemes or relations. In this work, we propose a novel framework that realizes VE protocols using zero-knowledge proof systems based on the MPC-in-the-head paradigm (Ishai et al. STOC 2007). Our generic compiler can turn a large class of zero-knowledge proofs into secure VE protocols for any secure public-key encryption scheme with the undeniability property, a notion that essentially guarantees binding of encryption when used as a commitment scheme. Our framework is versatile: because the circuit proven by the MPC-in-the-head prover is decoupled from a complex encryption function, the work of the prover is focused on proving the encrypted data satisfies the relation, not the proof of plaintext knowledge. Hence, our approach allows for instantiation with various combinations of properties about the encrypted data and encryption functions. We then consider concrete applications, to demonstrate the efficiency of our framework, by first giving a new approach and implementation to verifiably encrypt discrete logarithms in any prime order group more efficiently than was previously known. Then we give the first practical verifiable encryption scheme for AES keys with post-quantum security, along with an implementation and benchmarks.

A Publicly Verifiable Optimistic Fair Exchange Protocol Using Decentralized CP-ABE

Abstract Fair exchange is a challenging problem for two mutually distrusting players. It is widely known that fair exchange is impossible without a trusted third party (TTP). However, relying on a single TTP can cause a single-point failure. An intuitive idea is to adopt multiple TTPs to distribute trust. This paper constructs a two-party optimistic fair exchange (OFE) protocol using decentralized ciphertext-policy attribute-based encryption (CP-ABE), achieving decentralized TTPs. This is achievable because decentralized CP-ABE ciphertext supports a nested access control policy. A nested access control policy fits perfectly in a fair exchange protocol which contains multiple roles (i.e. players and TTPs). Further, we apply non-interactive zero knowledge proofs to prove the well-formedness of ciphertexts, so as to enforce players to follow the protocol specification honestly. Consequently, we construct an OFE protocol in which each player’s operations are publicly verifiable without revealing secret information. Also, we obtain decentralized TTPs with optimism (i.e. the TTPs are involved only when arbitration is required), autonomy (i.e. the TTPs do not need to interact with each other), statelessness (i.e. the TTPs do not need to store data for the exchange protocol) and verifiability (i.e. the TTPs are publicly verifiable). Compared with previous work, our protocol assumes only a public communication channel and each party’s operations are publicly verifiable. Besides, it achieves a favorable $O(n)$ verification complexity in the normal case, where $n$ is the number of TTPs. Finally, we present a proof-of-concept implementation to demonstrate the feasibility.

Implementation of Multifactor Authentication Using Optimistic Fair Exchange

In this work, two participants fairly send or receive things through the aid of intermediate who is only engaged if required. An up-to-date accepted necessity is with the aim of involving third party in the trade should be transparent, to save from privacy and evade terrible publicity. Together, a dishonest intermediate will negotiate the fairness of the trade and so the intermediate should be liable in case of any behavioural changes. Optimistic fair exchange (OFE) is one of the classical protocols to assure fairness of indulgence for a party. This exchange can be done by means of an arbitrator. The most important aspect of OFE is to describe security models so as to capture real-time attacks and design schemes secure in practical models. Signaller is confirmed with the data to send the correct person to address that to make sure it is. Since then the SMS has gone through to achieve that can hold the path to the right to see which if any is the fact that to ensure there is. After the signature is created by creating it to be able to well take care of it and then to the right of the person to pay off that is sure to make it. In this project, to avoid the third party attack (hacking) and unauthorized person access the particular important data. The data should be transmitted in sender to receiver that receiver only have a correct data without any data losses, protect a data security in cyber-attacks. A signature may be digitally and OFE design for the exchanged item have trade-off between transparency and accountability.

Optimistic Fair Exchange in Cloud-Assisted Cyber-Physical Systems

Recently, optimistic fair exchange in electronic commerce (e-commerce) or mobile commerce (m-commerce) has made great progress. However, new technologies create large amounts of data and it is difficult to handle them. Fortunately, with the assistance of cloud computing and big data, optimistic fair exchange of digital items in cyber-physical systems (CPSes) can be efficiently managed. Optimistic fair exchange in cloud-assisted CPSes mainly focuses on online data exchange in e-commerce or online contracts signing. However, there exist new forms of risks in the uncertain network environment. To solve the above problems, we use a new technique called verifiably encrypted identity-based signature (VEIS) to construct optimistic fair exchange in cloud-assisted CPSes. VEIS is an encrypted signature, and we can check the validity of the underlying signature without decrypting it. We introduce a robust arbitration mechanism to guarantee fairness of the exchange, and even the trusted third party (TTP) cannot get the original signatures of the exchange parties. And the TTP in our protocol is offline, which greatly improves the efficiency. Besides, we show that our protocol is secure, fair, and practical.

A Generic Framework for Accountable Optimistic Fair Exchange Protocol

Optimistic Fair Exchange protocol was designed for two parties to exchange in a fair way where an arbitrator always remains offline and will be referred only if any dispute happens. There are various optimistic fair exchange protocols with different security properties in the literature. Most of the optimistic fair exchange protocols satisfy resolution ambiguity where a signature signed by the signer is computational indistinguishable from the one resolved by the arbitrator. Huang et al. proposed the first generic framework for accountable optimistic fair exchange protocol in the random oracle model where it possesses resolution ambiguity and is able to reveal the actual signer when needed. Ganjavi et al. later proposed the first generic framework in the standard model. In this paper, we propose a new generic framework for accountable optimistic fair exchange protocol in the standard model using ordinary signature, convertible undeniable signature, and ring signature scheme as the underlying building blocks. We also provide an instantiation using our proposed generic framework to obtain an efficient pairing-based accountable optimistic fair exchange protocol with short signature.

Accumulable optimistic fair exchange from verifiably encrypted homomorphic signatures

Let us consider a situation where a client (Alice) frequently buys a certain kind of product from a shop (Bob) (e.g., an online music service sells individual songs at the same price, and a client buys songs multiple times in a month). In this situation, Alice and Bob would like to aggregate the total transactions and pay once per month because individual payments are troublesome. Though optimistic fair exchange (OFE) has been considered in order to swap electronic items simultaneously, known OFE protocols cannot provide such aggregate function efficiently because various costs are bounded by the number of transactions in the period. In order to run this aggregation procedure efficiently, we introduce a new kind of OFE called accumulable OFE (AOFE) that allows clients to efficiently accumulate payments in each period. In AOFE, any memory costs, computational costs, and communication complexity of the payment round must be constant in terms of the number of transactions. Since a client usually has just a low power and poor memory device, these efficiencies are desirable in practice. Currently, known approaches (e.g., based on verifiably encrypted signature scheme) are not very successful for constructing AOFE. Thus, we consider a new approach based on a new cryptographic primitive called verifiably encrypted homomorphic signature scheme (VEHS). In this paper, we propose a generic construction of AOFE from VEHS and also present a concrete VEHS scheme over a composite-order bilinear group by using the dual-form signature techniques. This VEHS scheme is also of independent interest. Since we can prove the security of VEHS without random oracles, our AOFE protocol is also secure without random oracles. Finally, we implemented our AOFE protocol, and it is efficient enough for practical use.

Provably secure robust optimistic fair exchange of distributed signatures

We introduce the concept of optimistic fair exchange of distributed signatures (OFEDS) which allows two groups of parties to fairly exchange digital signatures. Specifically, an authorized set of parties from each group can jointly take part in the protocol on behalf of the affiliated group to fulfill obligation, and a semi-trusted arbitrator will intervene in the protocol only when there are disputes between two sides. Our OFEDS extends the functionality of optimistic fair exchange of threshold signatures to a more generic case. We formalize the security model of OFEDS, in which besides the standard security requirements for existing optimistic fair exchange protocols, robustness is incorporated so that OFEDS can be successfully performed even when there exist some dishonest signers. We propose a non-interactive construction of OFEDS based on the well-established Computational Diffie–Hellman (CDH) assumption. Our proposal shows that there exists CDH-based OFEDS for any general monotone access structure. Theoretical and experimental analyses demonstrate our OFEDS construction has reasonable efficiency for real applications.

How to protect privacy in Optimistic Fair Exchange of digital signatures

How to sign an electronic contract online between two parties (say Alice and Bob) in a fair manner is an interesting problem, and has been extensively studied for a long time. Optimistic Fair Exchange (OFE) is an efficient solution to it, in which a semi-trusted third party, named the arbitrator, is responsible for resolving any dispute that may arise during an exchange between Alice and Bob. Recently, several variants of OFE, such as Ambiguous OFE (AOFE) and Perfect AOFE (PAOFE), have been introduced to protect the privacy of Alice and Bob. These primitives prevent any outsider from telling which parties are involved in an exchange of digital signatures before the exchange completes. However, in PAOFE, AOFE and all the existing works on OFE, the arbitrator can always learn the signer’s full signature at (or even before) the end of resolution, which is undesirable in some important applications, for example, signing a contract between two parties which do not want others to find out even when there is a dispute that needs resolution by the arbitrator.In this work, we introduce a new notion called Privacy-Preserving Optimistic Fair Exchange (P2OFE) for protecting the privacy of users, in which other than Alice and Bob, no one else including the arbitrator, can collect any evidence about an exchange between them even after the resolution of a dispute. We formally define P2OFE and present the corresponding security models and propose a concrete and efficient construction of P2OFE. We also discuss about several extensions about implementation. Our scheme is proved to be secure under the given security models based on the Strong Diffie–Helllman and Decision Linear assumptions without relying on the random oracle heuristic.

Revisiting Security Against the Arbitrator in Optimistic Fair Exchange

Revisiting Security Against the Arbitrator in Optimistic Fair Exchange

Revisiting Optimistic Fair Exchange Based on Ring Signatures

Optimistic fair exchange (OFE) is a kind of protocol that solves the fair exchange problem with the help of a trusted third party, usually referred to as an arbitrator. Participation of the arbitrator is required only when there is a dispute among the exchanging parties. Thus, the majority of the executions of the exchange does not involve the arbitrator and hence the term optimistic. The passive nature of the arbitrator makes optimistic fair exchange a desirable tool in applications, such as contract signing and electronic commerce. The highest level of security of optimistic fair exchange in the literature is the multiuser security in the chosen-key model, proposed by Huang, Yang, Wong, and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme secure in this sense can be constructed generically from a conventional digital signature and a two-party ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting. In this paper, we propose a new security model for two-party ring signatures called unforgeability against restricted adaptive attacks and demonstrate that our new model is strictly weaker than the model of unforgeable under an adaptive attack, against a static adversary in the 2-user setting. We make an observation that two-party ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE scheme following the aforementioned generic construction. Based on this observation, more efficient OFE schemes secure in the standard model can be constructed. Specifically, we prove that the well-known Bender, Katz, and Morselli’s 2-user ring signature is secure in our weakened model. Based on this two-party ring signature, we construct an OFE secure in the chosen-key model offering multiuser security in the standard model under the computational Diffie–Hellman assumption. The assumption is arguably weaker than those used in all existing constructions, which rely on the random oracle model, decisional assumptions, or the strong Diffie-Hellman assumptions. It is also worth noting that our scheme is the most efficient one in the standard model, and offers comparable efficiency against those secure under the random oracle model.

Ambiguous optimistic fair exchange: Definition and constructions

Optimistic fair exchange (OFE) is a protocol for solving the problem of exchanging items or services in a fair manner between two parties, a signer and a verifier, with the help of an arbitrator which is called in only when a dispute happens between the two parties. In almost all the previous work on OFE, after obtaining a partial signature from the signer, the verifier can present it to others and show that the signer has indeed committed itself to something corresponding to the partial signature even prior to the completion of the transaction. In some scenarios, this capability given to the verifier may be harmful to the signer. In this paper, we propose the notion of ambiguous optimistic fair exchange (AOFE), which is a variant of OFE and requires additionally that the verifier cannot convince anybody about the authorship of a partial signature generated by the signer. We present a formal security model for AOFE in the multi-user setting and chosen-key model, and propose a generic construction of AOFE that is provably secure under our model. Furthermore, we propose an efficient instantiation of the generic construction, security of which is based on Strong Diffie–Hellman assumption and Decision Linear assumption without random oracles.

Optimistic fair exchange in the enhanced chosen-key model

Optimistic fair exchange (OFE) is a kind of protocol to guarantee fairness for the parties involved in an exchange with the help of an arbitrator. A fundamental work of optimistic fair exchange is to define security models capturing realistic attacks and design schemes secure in practical models. The security models are very essential to ensure that they capture practical situation, which will ensure that the protocols can be adopted in practice.The contributions of this paper are three fold. First, we observe that the existing OFE models do not capture realistic situation, where the adversary can actually observe the full signatures generated by the signer, prior to launching the actual attack. That is to say, the adversary is not provided with the signing oracle, which will produce full signatures generated by the signer. It is commonly believed that the full signatures generated by the signer can be simulated by the full signatures generated by the arbitrator. Unfortunately, we show that this perception is false. Second, we propose an enhanced model of OFE that explicitly provides the adversary with the signing oracle, which outputs the full signatures generated by the signer. We demonstrate the difference between our enhanced model and the existing chosen-key model through two concrete OFE schemes that serve as counterexamples. Finally, we revisit two existing generic constructions of optimistic fair exchange schemes, one based on verifiably encrypted signatures, and the other based on conventional signatures and ring signatures. Our result shows that the two generic approaches can still offer schemes secure in our enhanced model, which captures the real scenario that dishonest users may have access to the full signatures generated by the signer.

Collusion-Resistance in Optimistic Fair Exchange

Optimistic fair exchange (OFE) is a type of cryptographic protocols aimed at solving the fair exchange problem over open networks with the help of a third party to settle disputes between exchanging parties. It is well known that a third party is necessary in the realization of a fair exchange protocol. However, a fully trusted third party may not be available over open networks. In this paper, the security of most of the proposed OFE protocols depends on the assumption that the third party is semitrusted in the sense that it may misbehave on its own but does not conspire with either of the main parties. The existing security models of OFE have not taken into account the case where the potentially dishonest third party may collude with a signer in the sense of sharing its secret key with the signer. In this paper, to reduce the trust level of the arbitrator and increase the security of OFE, we propose an enhanced security model that, for the first time, captures this scenario. We also show a separation between the existing model and our enhanced model with a concrete counter example. Finally, we revisit two popular approaches in the construction of OFE protocols, which are based on verifiably encrypted signature and conventional signature plus ring signature, respectively. Our result shows that the conventional signature plus ring signature approach approach remains valid in our enhanced model. However, for schemes based on verifiably encrypted signature, slight modifications are needed to guarantee the security.

ID-Based Optimistic Fair Exchange Scheme Based on RSA

Fairness of exchange is a significant property for secure online transactions, and a fair exchange scheme is a useful tool for ensuring the fairness of exchanges conducted over networks. In this paper, we propose an ID-based optimistic fair exchange scheme based on the RSA function, one which is designed by combining a well-known RSA-based signature scheme and the (naive) RSA function. Note that the main contribution of this paper is to give the first provably secure ID-based fair exchange scheme based on the RSA function, whose security can be proved under fully formalized security models. Our scheme has the following additional strongpoints. The scheme is setup-free; hence, there is no registration step between a user and an arbitrator. Moreover, the proposed scheme is designed in an ID-based setting; thus, it is possible to eliminate the need for certificates and avoid some related problems.

Verifiably encrypted signatures with short keys based on the decisional linear problem and obfuscation for encrypted VES

Verifiably encrypted signatures (VES) are encrypted signatures under a public key of a trusted third party. We can verify their validity without decryption. VES has useful applications such as online contract signing and optimistic fair exchange. We propose a VES scheme that is secure under the decisional linear (DLIN) assumption in the standard model. We also propose new obfuscators for encrypted signatures (ES) and encrypted VES (EVES) that are secure under the DLIN assumption. All previous VES schemes in the standard model are either secure under standard assumptions (such as the computational Diffie–Hellman assumption) with large verification (or secret) keys or secure under non-standard dynamic $$q$$ -type assumptions (such as the $$q$$ -strong Diffie–Hellman extraction assumption) with short verification keys. Our scheme is the first VES scheme with short verification (and secret) keys secure under the DLIN assumption (standard assumption). We construct new obfuscators for ES/EVES as byproducts of our new VES scheme. They are more efficient than previous obfuscators with respect to public key size. Previous obfuscators for EVES are secure under non-standard assumption and use zero-knowledge (ZK) proof systems and Fiat–Shamir heuristics to obtain non-interactive ZK, i.e., its security is considered in the random oracle model. Thus, our scheme also has an advantage with respect to assumptions and the security model. Our new obfuscator for ES is obtained from our new obfuscator for EVES.

Attribute-based optimistic fair exchange: How to restrict brokers with policies

Optimistic fair exchange (OFE) is a kind of protocols for solving the fair exchange problem between two participants with the help of an arbitrator that only needs to be involved when dispute occurs. As far as we are concerned, all previous work on OFE does not take into account user's attributes such as nationality and age. We identify that in some applications, the attributes could play an important role in the exchange to take place, and OFE may not be suitable to these scenarios. We introduce a new notion named attribute-based optimistic fair exchange (ABOFE) to solve the fair exchange problem in the attribute-based setting. We formalise the notion of ABOFE and present a security model in the multi-user setting under the chosen-key attack. We also present a generic construction of ABOFE from existing cryptographic primitives and prove that our proposal is secure with respect to our definition in the standard model. An instantiation in the standard model is discussed.

Efficient certificate-based verifiable encrypted signature scheme

Certificate-based public key cryptographic is a novel cryptographic primitive solving the heavy management problem in the conventional public key cryptographic. Verifiable encrypted signature is useful for many cryptographic protocols and often is used as to construct an optimistic fair exchange, it can convince a verifier that a given cipher text is an encryption of signature on a given message. In this paper, we propose an efficient certificate-based verifiable encrypted signature scheme by combining certificate-based public key cryptographic with a verifiable encrypted signature. We first give the formal definition of the certificate-based verifiable encrypted signature and its security goal, then we construct a secure certificate-based verifiable encrypted signature scheme, and gives the security analysis. The analysis shows that our scheme satisfies the security properties including validity, unforgeability, and opacity, and simplifies the certificate management process, solves the escrow problem, and there are fewer pairing operations and the least number of the total operations comparing with the other existing verifiable encrypted signature schemes.

An optimistic fair exchange protocol with active intermediaries

The study of business transactions is a topic of interest in the field of electronic commerce. Fair Exchange protocols deal with the problem of how the different parties involved in a transaction can exchange their parts securely, i.e., with assurance that the other parties will carry on with the transaction. Fair Exchange is a field of research that has been extensively studied, but we have found that previous proposals have failed to address one problem that concerns electronic commerce, i.e., transactions with active intermediaries. Previous Fair Exchange protocols deal with scenarios where only 2 parties are involved or scenarios where N known parties have to reach a common agreement, omitting scenarios where active intermediaries are involved. In this paper, we present an Optimistic Fair Exchange protocol for transactions with active intermediaries, which, to the best of our knowledge, is the first of its kind.

A Formal Analysis Method for Optimistic Fair Exchange Protocol

A Formal Analysis Method for Optimistic Fair Exchange Protocol

Certificate‐based verifiably encrypted RSA signatures

AbstractThe RSA signature scheme is one of the most popular signature schemes to date. This paper proposes a certificate‐based verifiably encrypted RSA signature scheme that is the first to accomplish optimistic fair exchange of the standard RSA signatures. The main characteristic of this scheme is that the signer can unilaterally choose a certificate authority as his/her adjudicator in fair exchange. Then a certificate, or generally, a signature, acts not only as the binding of the public key and its holder but also as the certificate authority's guarantee against partiality in adjudication. We introduce a strong security model, in which there are three types of inside adversaries with more power than outside adversaries in previous verifiably encrypted RSA signature schemes. We then show that the proposed scheme is existentially unforgeable under the Discrete Logarithm (DL) assumption, the Computational Diffile‐Dellman (CDH) assumption, and the RSA assumption in the random oracle model. Because the proposed scheme can be directly used in the current Public‐Key Infrastructure (PKI) environment, it is more practical and trustworthy than the previous schemes in the real world. Copyright © 2013 John Wiley & Sons, Ltd.