Endre Bangerter, Stephan Krenn, Martial Seifriz, Ulrich Ultes‐Nitsche
Cryptographic two-party protocols are used ubiquitously in everyday life. While some of these protocols are easy to understand and implement (e.g., key exchange or transmission of encrypted data), many of them are much more complex (e.g., e-banking and e-voting applications, or anonymous authentication and credential systems). For a software engineer without appropriate cryptographic skills the implementation of such protocols is often difficult, time consuming and error-prone. For this reason, a number of compilers supporting programmers have been published in recent years. However, they are either designed for very specific cryptographic primitives (e.g., zero-knowledge proofs of knowledge), or they only offer a very low level of abstraction and thus again demand substantial mathematical and cryptographic skills from the programmer. Finally, some of the existing compilers do not produce executable code, but only metacode which has to be instantiated with mathematical libraries, encryption routines, etc. before it can actually be used. In this paper we present a cryptographically aware compiler which is equally useful to cryptographers who want to benchmark protocols designed on paper, and to programmers who want to implement complex security sensitive protocols without having to understand all subtleties. Our tool offers a high level of abstraction and outputs well-structured and documented Java code. We believe that our compiler can contribute to shortening the development cycles of cryptographic applications and to reducing their error-proneness.
A user centric approach to authentication for home networks is proposed. A zero-knowledge-proof (ZKP) authentication is used to leverage the emerging cloud infrastructure allowing users to temporarily transfer their service and content rights within a trusted environment such as a friend's home. This approach enables the sharing of personalized content and more sophisticated network-based services over a conventional TCP/IP infrastructure. Experimental results derived from a reference prototype are presented. These demonstrate the practicality of the underlying approach. The potential to develop new cloud services for "social" home networks is also discussed.
We present a cryptographic framework to achieve access control, privacy of social relations, secrecy of resources, and anonymity of users in social networks. The main idea is to use pseudonyms to hide user identities, signatures on pseudonyms to establish social relations, and zero-knowledge proofs on these signatures to demonstrate the existence of the corresponding social relations without sacrificing user anonymity. Our framework is generally applicable and, in particular, constitutes an ideal plug-in for decentralized social networks.
This paper presents a distributed anonymous authentication scheme for MANET based on the technique of group signature, secret share and zero-knowledge proof. The scheme takes advantage of the distributed certificate management to solve the authentication and key management problems of MANET which is lack of fixed infrastructure. Meanwhile, the scheme adopts the efficient group signature presented by Camenisch and Stadler, achieved the anonymity in the process of authentication and public key transmission. In the case of a later dispute, the group manager can reveal the identity of node by opening its signature. Besides anonymity and traceability, the scheme also has the property of unforgeability and robustness.
Wireless Sensor Networks (WSNs) offer an excellent opportunity to monitor environments, and have a lot of interesting applications, some of which are quite sensitive in nature and require full proof secured environment. The security mechanisms used for wired networks cannot be directly used in sensor networks as there is no user-controlling of each individual node, wireless environment, and more importantly, scarce energy resources. In this paper, we address some of the special security threats and attacks in WSNs. We propose a scheme for detection of distributed sensor cloning attack and use of zero knowledge protocol (ZKP) for verifying the authenticity of the sender sensor nodes. The cloning attack is addressed by attaching a unique fingerprint to each node, that depends on the set of neighboring nodes and itself. The fingerprint is attached with every message a sensor node sends. The ZKP is used to ensure non transmission of crucial cryptographic information in the wireless network in order to avoid man-in-the middle (MITM) attack and replay attack. The paper presents a detailed analysis for various scenarios and also analyzes the performance and cryptographic strength.
Market research surveys report that 75% of hacks occur at the application layer. Of the multiple vulnerabilities that exist in Web application software, proper authentication of the client and the server to each other is fundamental to the security of the system. In the current scenario, we manage this with the adoption of password-based client authentication and PKI-based server authentication. There exist unresolved vulnerabilities in this system due to the misuse of the client's passwords (impersonation) by those managing the servers. The clients' trust of the server based on the certificates issued by an increasing number of certification authorities is questionable in terms of validity and freshness. For proper authentication in Web applications, we need to verify two conditions: 1) the binding of the identity of the entity with the publicly known name or key and 2) the entity does possess the corresponding private key for the identified public key. In this paper, we use the elliptic curve discrete log problem-based version of classical zero knowledge protocol for proving number 2 and modifications of the existing schemes for proving number 1. We have done a prototype implementation of the solution and security analysis required to satisfy the security objectives.
We present a cryptographic framework to achieve access control, privacy of social relations, secrecy of resources, and anonymity of users in social networks. We illustrate our technique on a core API for social networking, which includes methods for establishing social relations and for sharing resources. The cryptographic protocols implementing these methods use pseudonyms to hide user identities, signatures on these pseudonyms to establish social relations, and zero-knowledge proofs of knowledge of such signatures to demonstrate the existence of social relations without sacrificing user anonymity. As we do not put any constraints on the underlying social network, our framework is generally applicable and, in particular, constitutes an ideal plug-in for decentralized social networks. We analyzed the security of our protocols by developing formal definitions of the aforementioned security properties and by verifying them using ProVerif, an automated theorem prover for cryptographic protocols. Finally, we built a prototypical implementation and conducted an experimental evaluation to demonstrate the efficiency and the scalability of our framework.
In this thesis, we provide contributions to signature schemes and identi cation schemes in four di erent ways.\nFirst, we make contributions to universal designated veri er signatures. We propose the notion of a one-time universal designated veri er signature such that the number of veri ers verifying the signature is controlled by the signer. We also propose the notion of a universal designated veri er signature with threshold-signers such that the privacy and anonymity of the signer can be achieved.\nSecond, we propose a new notion called "policy-controlled signatures". In this notion, a policy-controlled signature can be veri ed by a veri er that satis es a policy assigned by a signer. We provide two extensions to this notion, which are "universal policy-controlled signatures" and "multi-level controlled signatures". Universal policy-controlled signatures allow a party called "a policy signer" to apply a policy on a signature on a particular message such that only a veri er that satis es this policy can verify this policy-controlled signature. In practice, some policies can be simply represented by a level of the security, for example, "POLICY= more than the fth level of security". From the above idea, a de nition of multi-level controlled signatures is introduced. It allows a signer to eliminate the unnecessary chain of attributes in the policy and simply assign the level of security as a policy instead. Hence, the size of the policy remains constant.\nNext, a new notion called "fair multi-signatures" is proposed. A multi-signature allows a group of parties to engage in an interactive protocol in order to generate a joint signature on an agreement. If all the signers follow the protocol honestly, then a multi-signature is generated and distributed fairly. However, if a dishonest signer refuses to complete his part in the protocol, but he has already obtained the other parties' contributions, then the honest signers cannot obtain a multi-signature and yet the dishonest signer can generate a multi-signature. Our notion of fair multisignatures ensures that if the protocol is completed, then every signer involved in the signing protocol can output a multi-signature. Meanwhile, if the protocol is not completed, then none of the signers involved in the signing protocol can output a multi-signature.\nFinally, in modern communications, the public becomes aware of privacy issues. Some identi cation systems provide privacy for users, especially those that are based on zero knowledge proof. However, a malicious user may take advantage of privacy to deny his malicious acts. Hence, we propose a new notion called "escrowed deniable identi cation schemes". In this notion, a trusted party is introduced to act as a transaction opener such that it can generate evidence of the conversation from the deniable transcript generated during the interaction between a prover and a veri er. In an identi cation scheme, the major concern about security is impersonation. The strongest type of attack against identi cation schemes is the reset attack. In this thesis, we provide an identity-based identi cation scheme secure against reset attack. We also provide proof of our scheme which is secure against reset attack in the standard model.
In this thesis, we investigate the notion of privacy for signatures belonging tothe second type, i.e., those which provide privacy with respect to the signed message.
The first part of our work consists of one chapter in which one of the applications of blind signatures in on-line services and games is considered. In this way, we seek an ecient solution for a simple scenario in which a recipient can take a token from an issuer to be paid to an on-line service provider, without revealing anything about the service he intends to use.
The second part of the work considers the problem of formalizing the notion of convertible non-transferable signatures, which is addressed in two chapters. Here the notion of transferability refers to transferring the validity of a signature with respect to a given message by the recipient of the signature to a third party. The basic idea for constructing concrete schemes for such signatures is to build a scheme in which a signature can be valid with regard to any random message unless some piece of information is revealed. Non-transferable (sometimes also called private) signatures enable the signer or the recipient to decide who can verify the issued signature. It is possible to construct such signatures by computing a non-transferable signature using a non-transferable proof (in an interactive or non-interactive way) to prove its validity to the designated veri er. The concept of non-transferable signatures was introduced into cryptography by proposing undeniable signatures, in which after is- suing the signature nobody can verify it with regard to the signed message without the cooperation of the signer. This restriction of veri cation is the point of dierence between traditional signatures that are universally veri able and non-transferable signatures. The best-known examples of non-transferable signatures are undeniable signatures, designated con rmer signatures, directed signatures, universally desig- nated veri er signatures, nominative signatures, etc. In the rst three signatures, it is the signer who is interested in making the signature recognizable only to himself or some pre-chosen party, while in the last two it is the recipient who makes the signature private to himself or some known party chosen by himself. Each of these signatures has its own natural application scenarios. Although these signatures are dierent in both nature and application, almost all of them are built from the same basic primitives: zero-knowledge proofs and commitments.
In this paper, we present a solution to the problem of e–contract validation in a supply chain with chain contracting topology. In chain contracting, there are multiple bi–lateral contracts that are related, for example one original contract between two partners is modified by subsequent negotiations to form other bi–lateral contracts between other parties in the supply chain. We study how to validate these contracts and ensure appropriate relationship between these contracts. We first identify key technical requirements for such a solution and then present our models that address these requirements. The models are based on the concepts of commitment scheme and zero–knowledge proof. It can be implemented in a contract engine that supports both the contract formation and contract execution phases of the contract life cycle. Also proposed is a cryptographic scheme to facilitate the electronic transfer of payments.
A zero-knowledge protocol allows a prover to convince a verifier of the correctness of a statement without disclosing any other information to the verifier. It is a basic tool and widely used in many other cryptographic applications. However, when stand-alone zero-knowledge protocols are used in complex environments, e.g., the Internet, the basic properties may not be sufficient. This is why researchers considered security of zero-knowledge protocols under concurrent composition and manin-the-middle attacks. Moreover, it is very likely that an adversary might break computers that run the protocol and get internal information of the parties. It is thus necessary to take account of the security of zero-knowledge protocols when adaptive corruptions are allowed. Previous adaptively secure zero-knowledge protocols work either in a stand-alone setting, or in a concurrent setting with trusted setup assumptions. In this paper, we study adaptive security of zero-knowledge protocols under both concurrent self composition and man-in-the-middle attacks in the plain model (i.e., without any set-up assumptions). We provide a construction of adaptively secure concurrent non-malleable zero-knowledge proof/argument for every language in NP.
We define a new notion of relatively-sound non-interactive zeroknowledge (NIZK) proofs, where a private verifier with access to a trapdoor continues to be sound even when the Adversary has access to simulated proofs and common reference strings. It is likely that this weaker notion of relative-soundness suffices in most applications that need simulation-soundness. We show that for certain languages whicharediversegroups,and henceallowsmoothprojectivehashfunctions, one can obtain more efficient single-theorem relatively-sound NIZKsas opposed to simulation-sound NIZKs. We alsoshow that such relatively-sound NIZKs can be used to build rather efficient publiclyverifiable CCA2-encryption schemes. By employing this new publicly-verifiable encryption scheme along withanassociatedsmoothprojective-hash,weshowthatarecentPAKmodel single-round password-basedkey exchange protocol of Katz and
Abstract. Zero-knowledge proofs of knowledge (ZK-PoK) for discrete logarithms and related problems are indispensable for practical cryptographic protocols. At Eurocrypt 2009, Camenisch, Kiayias, and Yung provided a specification language (the CKY-language) for such protocols, which allows one to modularly design and analyze cryptographic protocols: protocol designers just need to specify the statement they want to prove in zero-knowledge and are ensured that an efficient proof protocol exists and indeed proves the specified statement, provided that the specification was in the CKY-language. However, as specifications in the CKY-language are realized by so-called Σ-protocols, the resulting protocols only satisfy the classical notion of zero-knowledge proofs of knowledge, which not retained if they are composed with themselves or with other protocols, e.g., when used as building blocks for higher-level applications. This problem can be tackled by moving to the Universal Composability (UC) framework, which guarantees retention of security when composing protocols and, in particular, when using them as building blocks in arbitrary contexts. While there exists generic transformations from Σ-protocols to protocols that are secure under this stronger security notion, these transformation are often not efficient enough for the design of practical protocols. In this paper we are aiming for practically efficient ZK-PoK in the UC-framework by introducing
Matteo Maffei, Giulio Malavolta, Manuel Reinert, Dominique Schröder
The existing (election) voting systems, e.g., representative democracy, have many limitations and often fail to serve the best interest of the people in collective decision making. To address this issue, the concept of liquid democracy has been emerging as an alternative decision-making model to make better use of "the wisdom of crowds". Very recently, a few liquid democracy implementations, e.g. Google Votes and Decentralized Autonomous Organization (DAO), are released; however, those systems only focus on the functionality aspect, as no privacy/anonymity is considered. In this work, we, for the first time, provide a rigorous study of liquid democracy under the Universal Composability (UC) frame- work. In the literature, liquid democracy was achieved via two separate stages -- delegation and voting. We propose an efficient liquid democracy e-voting scheme that uni es these two stages. At the core of our design is a new voting concept called statement voting, which can be viewed as a natural extension of the conventional voting approaches. We remark that our statement voting can be extended to enable more complex voting and generic ledger-based non-interactive multi-party computation. We believe that the statement voting concept opens a door for constructing a new class of e-voting schemes.
Gilles Barthe, Daniel Hedin, Santiago Zanella-Béguelin, Benjamin Grégoire · 5 authors
Zero-knowledge proofs have a vast applicability in the domain of cryptography, stemming from the fact that they can be used to force potentially malicious parties to abide by the rules of a protocol, without forcing them to reveal their secrets. Σ-protocols are a class of zero-knowledge proofs that can be implemented efficiently and that suffice for a great variety of practical applications. This paper presents a first machine-checked formalization of a comprehensive theory of Σ-protocols. The development includes basic definitions, relations between different security properties that appear in the literature, and general composability theorems. We show its usefulness by formalizing—and proving the security—of concrete instances of several well-known protocols. The formalization builds on CertiCrypt, a framework that provides support to reason about cryptographic systems in the Coq proof assistant, and that has been previously used to formalize security proofs of encryption and signature schemes.
In ESS2008, Yang et al. suggested a key-exposure-free chameleon hashing scheme, and it can be used to design signature and some other cryptography mechanism. In this paper, we construct a new timeliness optimistic fair exchange protocol based on this key-exposure-free chameleon hashing scheme. The new scheme does not require the use of interactive zero-knowledge proofs in the exchange phase. In our scheme, both parties can contact the trusted third party and settle the argument before the deadline. Moreover, the new scheme achieves fairness and timeliness.
DAA scheme in the TCG specification is based on CL signature,which is also combined by group signature and zero knowledge proof techniques to prove the direct anonymous attestation,and its security is based on the decomposition of large numbers.With the increasement of computer performance and the development of cryptography,the problem based on integer factorization problem is likely to be attacked,the corresponding DAA scheme has become no longer safety.But the algorithm based on the elliptic curve discrete logarithm and the prime on the discrete logarithm (double discrete logarithm) can use a shorter key,achieve higher security.Based on double discrete logarithm algorithm,this article designed a new DAA scheme.Demonstrated by analyzing solution,this new DAA scheme could not only meet the requirements of direct anonymous attestation,but also could make the implementation efficiency of the scheme consistent with the original one,while improved its security greatly.
Abstract : Mobile airborne networks deployed and used by the armed forces face significant challenges in balancing security concerns with reliably servicing the needs of the forces dependent on it. These issues are complicated by the ever-changing collaborative environments that these networks are tasked to support. The Zero Knowledge Protocol (ZKP) is a powerful technique that replaces the portion of a traditional credential-based key management system where credentials are exchanged. Instead, in ZKPs a proof of the existence of the credential is sent, allowing the receiver to develop absolute confidence that the user has a valid credential, without exposing the credential to risk of compromise. Based on the results of this research, we assert that it may be possible to construct a ZKP scheme with strong anonymity given any identification protocol and a shared-key update scheme.
Markus Rückert, Michael Schneider, Dominique Schröder
Verifiably encrypted signature schemes (VES) allow a signer to encrypt his or her signature under the public key of a trusted third party, while maintaining public signature verifiability. With our work, we propose two generic constructions based on Merkle authentication trees that do not require non-interactive zero-knowledge proofs (NIZKs) for maintaining verifiability. Both are stateful and secure in the standard model. Furthermore, we extend the specification for VES, bringing it closer to real-world needs. We also argue that statefulness can be a feature in common business scenarios.
Our constructions rely on the assumption that CPA (even slightly weaker) secure encryption, maskable CMA secure signatures, and collision resistant hash functions exist. Maskable means that a signature can be hidden in a verifiable way using a secret masking value. Unmasking the signature is hard without knowing the secret masking value. We show that our constructions can be instantiated with a broad range of efficient signature and encryption schemes, including two lattice-based primitives. Thus, VES schemes can be based on the hardness of worstcase lattice problems, making them secure against subexponential and quantum-computer attacks. Among others, we provide the first efficient pairing-free instantiation in the standard model.