Structure-preserving Signatures Research Articles

PriTKT: A Blockchain-Enhanced Privacy-Preserving Electronic Ticket System for IoT Devices.

Electronic tickets (e-tickets) are gradually being adopted as a substitute for paper-based tickets to bring convenience to customers, corporations, and governments. However, their adoption faces a number of practical challenges, such as flexibility, privacy, secure storage, and inability to deploy on IoT devices such as smartphones. These concerns motivate the current research on e-ticket systems, which seeks to ensure the unforgeability and authenticity of e-tickets while simultaneously protecting user privacy. Many existing schemes cannot fully satisfy all these requirements. To improve on the current state-of-the-art solutions, this paper constructs a blockchain-enhanced privacy-preserving e-ticket system for IoT devices, dubbed PriTKT, which is based on blockchain, structure-preserving signatures (SPS), unlinkable redactable signatures (URS), and zero-knowledge proofs (ZKP). It supports flexible policy-based ticket purchasing and ensures user unlinkability. According to the data minimization and revealing principle of GDPR, PriTKT empowers users to selectively disclose subsets of (necessary) attributes to sellers as long as the disclosed attributes satisfy ticket purchasing policies. In addition, benefiting from the decentralization and immutability of blockchain, effective detection and efficient tracing of double spending of e-tickets are supported in PriTKT. Considering the impracticality of existing e-tickets schemes with burdensome ZKPs, we replace them with URS/SPS or efficient ZKP to significantly improve the efficiency of ticket issuing and make it suitable for use on smartphones.

PriRPT: Practical blockchain-based privacy-preserving reporting system with rewards

In order to obtain evidence of a crime timely, most authorities encourage whistleblowers to provide valuable reports by rewarding them with prizes. However, criminals will try their best to delete or tamper with the reports and even threaten and revenge the whistleblowers to escape punishment. Hence, to make the reporting system work, it is essential to ensure the integrity of reported messages and the anonymity of the reporting and rewarding procedures in the reporting system. Most existing schemes for this problem are generally based on ring signatures, which incur high computational overhead and imperfect anonymity. In this paper, we introduce a novel practical blockchain-based privacy-preserving reporting system with rewards dubbed as PriRPT. Specifically, the proposed scheme integrates the permissioned blockchain system, keyed-verification anonymous credential (KVAC), and structure-preserving signatures on equivalence classes (SPS-EQ) to provide reliable auditing of reports, and support anonymous reporting and anonymous rewarding simultaneously. In addition, we achieve higher efficiency in the reporting and rewarding protocol by replacing costly zero-knowledge proofs with KVAC and SPS-EQ. We also formalize the scheme along with security proof and provide rigorous evaluations on an open blockchain platform (JUICE) and a personal laptop to demonstrate its practicability.

Compact Structure-Preserving Signatures with Almost Tight Security

In structure-preserving cryptography, every building block shares the same bilinear groups. These groups must be generated for a specific, a priori fixed security level, and thus, it is vital that the security reduction in all involved building blocks is as tight as possible. In this work, we present the first generic construction of structure-preserving signature schemes whose reduction cost is independent of the number of signing queries. Its chosen-message security is almost tightly reduced to the chosen-plaintext security of a structure-preserving public-key encryption scheme and the security of Groth–Sahai proof system. Technically, we adapt the adaptive partitioning technique by Hofheinz (Eurocrypt 2017) to the setting of structure-preserving signature schemes. To achieve a structure-preserving scheme, our new variant of the adaptive partitioning technique relies only on generic group operations in the scheme itself. Interestingly, however, we will use non-generic operations during our security analysis. Instantiated over asymmetric bilinear groups, the security of our concrete scheme is reduced to the external Diffie–Hellman assumption with linear reduction cost in the security parameter, independently of the number of signing queries. The signatures in our schemes consist of a larger number of group elements than those in other non-tight schemes, but can be verified faster, assuming their security reduction loss is compensated by increasing the security parameter to the next standard level.

SPOT: Secure and Privacy-Preserving PrOximiTy Protocol for e-Healthcare Systems

This paper introduces SPOT, a Secure and Privacy-preserving prOximity based protocol for e-healthcare systems. It relies on a distributed proxy-based approach to preserve users' privacy and a semi-trusted computing server to ensure data consistency and integrity. The proposed protocol ensures a balance between security, privacy and scalability. As far as we know, in terms of security, SPOT is the first one to prevent malicious users from colluding and generating false positives. In terms of privacy, SPOT supports both anonymity of users being in proximity of infected people and unlinkability of contact information issued by the same user. A concrete construction based on structure-preserving signatures and NIWI proofs is proposed and a detailed security and privacy analysis proves that SPOT is secure under standard assumptions. In terms of scalability, SPOT's procedures and algorithms are implemented to show its efficiency and practical usability with acceptable computation and communication overhead.

Privacy-enhanced remote data integrity checking with updatable timestamp

Remote data integrity checking (RDIC) enables clients to verify whether the outsourced data is intact without keeping a copy locally or downloading it. Nevertheless, the existing RDIC schemes do not support the pay-as-you-go (PAYG) payment model, where the payment is decided by the volume and duration of the outsourced data. Specifically, none of the existing works have considered the client’s control over changes in storage duration. In this paper, we propose an RDIC scheme to simultaneously check the data content and storage duration represented by an updatable timestamp via the third-party auditor (TPA). Also, our proposed scheme achieves indistinguishable privacy (IND-privacy) against TPA for both data content and timestamp. To bind the content and timestamp in the authenticator and support efficient timestamp update, we construct the authenticator with the randomizable structure-preserving signature (SPS). Additionally, we utilize the Groth-Sahai proof and range proof to provide the IND-privacy and guarantee the timestamp validation in the auditing phase. We formalize the definition and security model and provide the formal proof of our scheme. We also present the theoretical and experimental performance analysis to demonstrate that our scheme is comparable to the previous RDIC schemes which do not consider the storage time.

QANIZK for adversary-dependent languages and their applications

Quasi-Adaptive Non-Interactive Zero-Knowledge (QANIZK) proofs make possible efficient NIZK with short proofs by allowing the common reference string to depend on the language. The strongest notion of (computational) soundness for QANIZK is Unbounded Simulation-Soundness (USS). For USS, however, the language is completely beyond the adversary's control.In this paper, we introduce a stronger notion of USS for QANIZK, called USS for Adversary-Dependent Languages (USS-ADL), by allowing the adversary to adaptively develop the language. We present a generic construction of efficient USS-ADL-QANIZK for diverse vector spaces (DVS) over graded rings, of which linear subspaces over bilinear groups are specific instantiations.–Our generic construction provides the first USS-QANIZK for DVS over graded rings. This complements Abdalla et al.'s work (Eurocrypt'15) of QANIZK with one-time simulation-soundness.–As for applications, USS-ADL-QANIZK leads to modular constructions of digital signature and linearly homomorphic (structure-preserving) signature schemes with black-box security reductions.The instantiations cover the efficient USS-QANIZK for linear subspaces over bilinear groups proposed by Kiltz and Wee (Eurocrypt'15), a variant of the efficient structure-preserving signature proposed by Kiltz et al. (Crypto'15) and the efficient linearly homomorphic structure-preserving signature proposed by Kiltz and Wee (Eurocrypt'15). Our USS-ADL-QANIZK provides a new perspective on their constructions and security proofs in a unified way.

Improved generic construction of chameleon hash to group elements

ABSTRACTChameleon hash functions are trapdoor one-way functions with many applications as, for example, off-line/on-line signatures and chameleon signatures. Chameleon signatures are useful to protect privacy of signatures in some business systems where signatures are not allowed to be verified universally, and off-line/on-line signatures are particularly suitable for systems with limited computing resources on-line, but enough computation power off-line, such as in smart card applications. Previous research focused on concrete constructions based on different assumptions, as well as schemes without the key-exposure problem. The main contribution of this paper is a generic construction method of structure-preserving chameleon hash from quasi-adaptive noninteractive zero-knowledge (QANIZK) and two concrete constructions from adaptive sound and simulation sound QANIZK for witness sampleable (WS) distributions proposed by Kiltz and Wee in Eurocrypt 2015, with/without key-exposure respectively. Compared with the constructions from linearly homomorphic structure-preserving signature (LHSPS), our constructions improve the efficiency, the assumptions, as well as the security guarantees.

Proofs of retrievability from linearly homomorphic structure-preserving signatures

Proofs of retrievability from linearly homomorphic structure-preserving signatures

Proofs of retrievability from linearly homomorphic structure-preserving signatures

Proofs of retrievability (PoR) enables clients to outsource huge amount of data to cloud servers, and provides an efficient audit protocol, which can be employed to check that all the data is being maintained properly and can be retrieved from the server. In this paper, we present a generic construction of PoR from linearly homomorphic structure-preserving signature (LHSPS), which makes public verification possible. Authenticity and retrievability of our PoR scheme are guaranteed by the unforgeability of LHSPS. We further extend our result to dynamic PoR, which supports dynamic update of outsourced data. Our construction is free of complicated data structures like Merkle hash tree. With an instantiation of a recent LHSPS scheme proposed by Kiltz and Wee (EuroCrypt15), we derive a publicly verifiable (dynamic) PoR scheme. The security is based on standard assumptions and proved in the standard model.

Efficient Fully Structure-Preserving Signatures and Shrinking Commitments

In structure-preserving signatures, public keys, messages, and signatures are all collections of source group elements of some bilinear groups. In this paper, we introduce fully structure-preserving signature schemes, with the additional requirement that even secret keys are group elements. This strong property allows efficient non-interactive proofs of knowledge of the secret key, which is useful in designing cryptographic protocols under simulation-based security where online extraction of the secret key is needed. We present efficient constructions under simple standard assumptions and pursue even more efficient constructions with the extra property of randomizability based on the generic bilinear group model. An essential building block for our efficient standard model construction is a shrinking structure-preserving trapdoor commitment scheme, which is by itself an important primitive and of independent interest as it appears to contradict a known impossibility result that structure-preserving commitments cannot be shrinking. We argue that a relaxed binding property lets us circumvent the impossibility while still retaining the usefulness of the primitive in important applications as mentioned above.

Structure-Preserving Signatures on Equivalence Classes and Constant-Size Anonymous Credentials

Structure-preserving signatures (SPS) are a powerful building block for cryptographic protocols. We introduce SPS on equivalence classes (SPS-EQ), which allow joint randomization of messages and signatures. Messages are projective equivalence classes defined on group-element vectors, so multiplying a vector by a scalar yields a different representative of the same class. Our scheme lets one adapt a signature for one representative to a signature for another representative without knowledge of any secret. Moreover, given a signature, an adapted signature for a different representative is indistinguishable from a fresh signature on a random message. We propose a definitional framework for SPS-EQ and an efficient construction in Type-3 bilinear groups, which we prove secure against generic forgers. We also introduce set-commitment schemes that let one open subsets of the committed set. From this and SPS-EQ, we then build an efficient multi-show attribute-based anonymous credential system for an arbitrary number of attributes. Our ABC system avoids costly zero-knowledge proofs and only requires a short interactive proof to thwart replay attacks. It is the first credential system whose bandwidth required for credential showing is independent of the number of its attributes, i.e., constant-size. We propose strengthened game-based security definitions for ABC and prove our scheme anonymous against malicious organizations in the standard model; finally, we discuss a concurrently secure variant in the CRS model.

Strongly‐optimal structure preserving signatures from Type II pairings: synthesis and lower bounds

Recent work on structure-preserving signatures (SPS) studies optimality of these schemes in terms of the number of group elements needed in the verification key and the signature, and the number of pairing-product equations in the verification algorithm. While these measures are crucial for many applications, another important aspect to consider for performance is verification time, which for these schemes is dominated by pairings computation. Although prior work considers optimality in terms of number of pairing-product equations, this measure does not capture the exact number of pairings needed in verification. To fill this gap, we study the minimal number of pairings needed in verification of SPS. First, we prove lower bounds for schemes in the Type~II setting secure under chosen message attacks in the generic group model. We show that three pairings are necessary and at most one of these pairings can be precomputed. Second, we build an automated tool to search for schemes matching our lower bounds. Using this tool, we find a new randomisable SPS in the Type~II setting that is optimal with respect to our lower bound on the number of pairings, and minimal in terms of group operations to be computed during verification.

Black-Box Accumulation: Collecting Incentives in a Privacy-Preserving Way

Abstract We formalize and construct black-box accumulation (BBA), a useful building block for numerous important user-centric protocols including loyalty systems, refund systems, and incentive systems (as, e.g., employed in participatory sensing and vehicle-to-grid scenarios). A core requirement all these systems share is a mechanism to let users collect and sum up values (call it incentives, bonus points, reputation points, etc.) issued by some other parties in a privacy-preserving way such that curious operators may not be able to link the different transactions of a user. At the same time, a group of malicious users may not be able to cheat the system by pretending to have collected a higher amount than what was actually issued to them. As a first contribution, we fully formalize the core functionality and properties of this important building block. Furthermore, we present a generic and non-interactive construction of a BBA system based on homomorphic commitments, digital signatures, and non-interactive zero-knowledge proofs of knowledge. For our construction, we formally prove security and privacy properties. Finally, we propose a concrete instantiation of our construction using Groth-Sahai commitments and proofs as well as the optimal structure-preserving signature scheme of Abe et al. and analyze its efficiency.

Constant-Size Structure-Preserving Signatures: Generic Constructions and Simple Assumptions

This paper presents efficient structure-preserving signature schemes based on simple assumptions such as decisional linear. We first give two general frameworks for constructing fully secure signature schemes from weaker building blocks such as variations of one-time signatures and random message secure signatures. They can be seen as refinements of the Even---Goldreich---Micali framework, and preserve many desirable properties of the underlying schemes such as constant signature size and structure preservation. We then instantiate them based on simple (i.e., not q-type) assumptions over symmetric and asymmetric bilinear groups. The resulting schemes are structure-preserving and yield constant-size signatures consisting of 11---14 group elements, which compares favorably to existing schemes whose security relies on q-type assumptions.

Linearly homomorphic structure-preserving signatures and their applications

Structure-preserving signatures (SPS) are signature schemes where messages, signatures and public keys all consist of elements of a group over which a bilinear map is efficiently computable. This property makes them useful in cryptographic protocols as they nicely compose with other algebraic tools (like the celebrated Groth---Sahai proof systems). In this paper, we consider SPS systems with homomorphic properties and suggest applications that have not been provided before (in particular, not by employing ordinary SPS). We build linearly homomorphic structure-preserving signatures under simple assumptions and show that the primitive makes it possible to verify the calculations performed by a server on outsourced encrypted data (i.e., combining secure computation and authenticated computation to allow reliable and secure cloud storage and computation, while freeing the client from retaining cleartext storage). Then, we give a generic construction of non-malleable (and actually simulation-sound) commitment from any linearly homomorphic SPS. This notably provides the first constant-size non-malleable commitment to group elements.

Non-Interactive Anonymous Credential Based on Structure-Preserving Signature

ABSTRACTStructure-preserving signature, as a special kind of digital signature, provides a way to construct modular cryptographic protocols with reasonable efficiency while retaining conceptual simplicity. This feature makes it suitable to be applied in the construction of non-interactive anonymous credential systems, which allows the user to convince a verifier of the possession of a certificate issued by the trusted authority anonymously and efficiently without interaction. In this paper, we design a secure and efficient structure-preserving signature scheme (SPSIG), and combine the scheme with Groth–Sahai non-interactive zero-knowledge (GSNIZK) proof system to construct a non-interactive anonymous credential scheme. The SPSIG is based on q-ADH-SDH assumption and can resist existential forgery in the chosen message attack. The message, signature, and verification keys are group elements, which are fully compatible with the GSNIZK system. The SXDH assumption is employed to instantiate the certificate-proving process, which is considered to be the most efficient instantiation at the moment. We analyze the efficiency and formally prove the security in the standard model. The result shows that our scheme satisfies correctness, zero knowledge, and unforgeability, and achieves identity authentication in the way of anonymity. Besides, our scheme has stronger anonymity, traceability, and non-interaction, and has lower communication cost compared with the conventional schemes.

Tightly secure signatures and public-key encryption

We construct the first public-key encryption (PKE) scheme whose chosen-ciphertext (i.e., IND-CCA) security can be proved under a standard assumption and does not degrade in either the number of users or the number of ciphertexts. In particular, our scheme can be safely deployed in settings in which no a-priori bound on the number of encryptions and/or users is known. As a central technical building block, we devise the first structure-preserving signature scheme with a tight security reduction. (This signature scheme may be of independent interest.) Combining this scheme with Groth---Sahai proofs yields a tightly simulation-sound non-interactive zero-knowledge proof system for group equations. If we use this proof system in the Naor---Yung double encryption scheme, we obtain a tightly IND-CCA secure PKE scheme from the decision linear assumption. We point out that our techniques are not specific to PKE security. Rather, we view our signature scheme and proof system as general building blocks that can help to achieve a tight security reduction.

Structure-Preserving Signatures and Commitments to Group Elements

A modular approach to constructing cryptographic protocols leads to simple designs but often inefficient instantiations. On the other hand, ad hoc constructions may yield efficient protocols at the cost of losing conceptual simplicity. We suggest a new design paradigm, structure-preserving cryptography, that provides a way to construct modular protocols with reasonable efficiency while retaining conceptual simplicity. A cryptographic scheme over a bilinear group is called structure-preserving if its public inputs and outputs consist of elements from the bilinear groups and their consistency can be verified by evaluating pairing-product equations. As structure-preserving schemes smoothly interoperate with each other, they are useful as building blocks in modular design of cryptographic applications. This paper introduces structure-preserving commitment and signature schemes over bilinear groups with several desirable properties. The commitment schemes include homomorphic, trapdoor and length-reducing commitments to group elements, and the structure-preserving signature schemes are the first ones that yield constant-size signatures on multiple group elements. A structure-preserving signature scheme is called automorphic if the public keys lie in the message space, which cannot be achieved by compressing inputs via a cryptographic hash function, as this would destroy the mathematical structure we are trying to preserve. Automorphic signatures can be used for building certification chains underlying privacy-preserving protocols. Among a vast number of applications of structure-preserving protocols, we present an efficient round-optimal blind-signature scheme and a group signature scheme with an efficient and concurrently secure protocol for enrolling new members.