Anonymous Credentials

Gergely AlpárCollis – November 24, 2011

November 24, 2011. (Collis) G. Alpár: Anonymous credentials 2

Crypt assumptions

My assumptions

• Modular computation: addition, multiplication• Public-key cryptography• (PKI)• Cryptographic hash function• Concatenation

Overview

• Zero-knowledge proof of knowledge• Credentials• Discrete logarithm preliminaries• U-Prove• RSA preliminaries• Idemix• Comparison

Zero-knowledge proofs

Current practice

I know the password!I know the password! I don’t believe you.I don’t believe you.

It’s wachtw0ord201

1Yes, indeed.Yes, indeed.

Zero-knowledge proof

I know the secret!I know the secret! I don’t believe you.I don’t believe you.I can prove it.I can prove it. I'll believe it when I see it.

I'll believe it when I see it.

No, I don’t show it, but I’ll convince you

that I know it.

No, I don’t show it, but I’ll convince you

that I know it.

A hard problem

Waldo and ZK

Where’s Waldo?

Source: findwaldo.com // The Gobbling GluttonsIdea: Moni Naor et al. How to Convince Your Children You are not Cheating, 1999

ZK – Ali baba’s cave

Credentials

Credential flow

Anonymity requirements

• Untraceability• Multi-show unlinkability • Selective disclosure • Attribute property proof • Revocation by user • Revocation by issuer

Age > 18Valid

High-level approaches

• Every time: issuing before showing (U-Prove, 1999)– Untraceability

• Showing with zero-knowledge proof (Idemix, 2001)– Untraceability and unlinkability

• Randomize (self-blindable, 2001)– Unlinkability and untraceability

History of anonymous credentials

1970 1980 1990 2000 2010

1976: Public-key crypto (Diffie & Hellman)

1978: RSA

1981: Digital pseudonym (Chaum)

1985: Zero-knowledge proof

1986: Non-interactive ZK (Fiat & Shamir)

1990-91: Schnorr identification and

signature

1999: U-Prove crypto (Brands)

2001: Idemix crypto (Camenisch & Lysyanskaya)

2002: Idemix JAVA implementation

2009: Light-weight Idemix impl. (IBM)

2010: Microsoft’s U-Prove impl.

2010-14: ABC4Trust (IBM & MS)

Discrete logarithm – preliminaries

Modular computation

mod nax

mod nlogax

= 14 mod 4773 = 343 = 7.47 + 14

log7 14 = 3 mod 47

102 103

10x mod 53

Modular exponentiation

log10 24 = ? mod 53log10 24 = ? mod 5310x mod 53

Discrete logarithm (p = 53, q = 13)

Discrete logarithm (p = 389, q =97)13x mod 389

log13 193 = ? mod 389log13 193 = ? mod 389

p ~ 21024, q ~ 2160

120647512938908028867388901435622501660544582652084763778469179795603511596928068284302347645679661284502756586088182980185380205485840303823342758131447025760358124071773512320456087558761236652680084522358687865972828438154299478474984622198115039866220934797393671281602442459774704328099491586290681366721842531452715241719233458597619542522728958116591 = 54908600274008470198448664033645016278929009692729460183531661597245923990838629299281250570649704467074998536491481089013147840556922261199819117470352438726889035130940581816459311611337430791063760559062579953505419658290163926050903654308761279654642666891806788178269114799030238674475936287917164274641 (mod 147540829457233765072451123330814771849279870508740658191364766390571127595133276091294946062334381927384270351919254939797952329145575009188956176344993292905052474988906261438800251337646245695529118629813762877963253295780055957721171296243452181910303437299543284160580397044072404446659484077705433238843)

gb = h (mod p) where the order of g is q

Efficiently computable• Random numbers– 4, 1, 4, 2, 1, 3, 5, 6, 2, 3, 7, 3, 0, 9, 5, 0, 4, 8, 8, 0, 1, 6, 8,

8, 7, 2, 4, 2, 0, 9, 6, 9, 8, 0, 7, 8, 5, 6, 9

• Modular addition and multiplication– a . b + c (mod n)

• Modular exponentiation– 326 = 3(11010) = 32 .38 .316 = 3 (mod 11)

• 32 = 9 mod 11• 38 = (((9)2)2 mod 11 = 5 mod 11• 316 = 52 mod 11 = 3 mod 11

ZK as a basic building blockZero-knowledge (ZK) proof of knowledgeZero-knowledge (ZK) proof of knowledge Schnorr identificationSchnorr identification

Schnorr signatureSchnorr signature

U-Prove issuanceU-Prove issuance

Blind signatureBlind signature

U-Prove showingU-Prove showing

U-Prove

Crypt assumptionsDiscrete logarithm assumptionDiscrete logarithm assumption

Schnorr identification

• Complete (P: “If I know, I can convince you.”)• Sound (V: “If you don’t know, you cannot convince me.”)• Zero-knowledge

From outside

Simulation Zero-knowledgeness

Real communication Simulated communication

Non-interactive Schnorr (Fiat—Shamir)

Schnorr signature (freshness)

Schnorr signature

Schnorr blind signature

Credential flow

Issuing

Showing

DL representation

Brands’ issuing protocol (U-Prove)

Brands’ showing protocol (U-Prove)

• Certain attributes are revealed• Others are proven in the token but remaining

hidden

Selective disclosure (U-Prove)

RSA – preliminaries

Crypt assumptionsInteger factorization is hardInteger factorization is hard

RSA signature – recap

Strong RSA assumption

Integer factorization

n p, q

RSA problemRSA problemc, e m

Strong RSA problemStrong RSA problemc m, e

c = me (mod n)

Idemix – selective disclosure

Camenisch—Lysyanskaya signature

Idemix issuing protocol (CL)*

* without intervalsPlus: freshness with nonces! SPKs

Randomized CL-signature

Idemix showing protocol*

* without intervalsPlus: freshness with a nonce! SPK

CL showing: selective disclosure*

* without intervalsPlus: freshness with a nonce! SPK

U-Prove vs. Idemix

Comparison of functionalities

Performance (client)

U-Prove selective disclosure

W. Mostowski, P. Vullers: Efficient U-Prove Implementation for Anonymous Credentials on Smart Cards

Future of anonymous credentials…

• ABC4Trust• NSTIC (discussion by Francisco Corella)• W3C Identity in the browser

Questions?

Gergely Alpargergely@cs.ru.nl

www.cs.ru.nl/~gergely

Anonymous Credentials

Documents

Transcript of Anonymous Credentials

Integrating Anonymous Credentials with eIDs for Privacy-respecting Online Authentication

Anonymous Credentials Light - Cryptology ePrint Archive · Anonymous Credentials Light Foteini Baldimtsi, Anna Lysyanskaya foteini,anna@cs.brown.edu Computer Science Department, Brown

Decentralized Anonymous Credentials

Cinderella: Turning Shabby X.509 Certificates into Elegant ... · X.509 Certificates into Elegant Anonymous Credentials Antoine Delignat-Lavaud Cédric Fournet, Markulf Kohlweiss,

Anonymous ist nicht Anonymous

A Whirlwind Tour of Anonymous Credentials and Related ...€¦ · – Simulator has SK for PK, forms proofs by signing {C i} – IfAoutputsanewstatementx,andextractorcan’textractthe

The Signal Private Group System and Anonymous ...The Signal Private Group System and Anonymous Credentials Supporting E cient Veri able Encryption Melissa Chase Microsoft Research

AnEﬃcientSystem forNon-transferableAnonymousCredentials ... · double-spending test, similar to known e-cash schemes (in fact, our one-show credentials can be used as anonymous

Privacy-Enhancing Proxy Signatures from Non …de nition of secure digital signature schemes is given in Appendix A. 3 Anonymous Credentials In an anonymous credential system there

Decentralized Anonymous Credentials - eprint.iacr.org · Decentralized Anonymous Credentials Christina Garman, Matthew Green, ... play a large role in securing internet infrastructure,

Structure-Preserving Signatures on Equivalence Classes and ... · Structure-Preserving Signatures on Equivalence Classes and Constant-Size Anonymous Credentials Georg Fuchsbauer1,

Composable & Modular Anonymous Credentials: …We validate our deﬁnitions by showing that an URS scheme satisfying strengthened property-based security deﬁnitions with key extraction

Signature Schemes and Anonymous Credentials from Bilinear Mapscs.brown.edu/people/anna/papers/cl04.pdf · Signature Schemes and Anonymous Credentials from Bilinear Maps Jan Camenisch

Algebraic MACs and Keyed-Veri cation Anonymous Credentials · Algebraic MACs and Keyed-Veri cation Anonymous Credentials Melissa Chase Microsoft Research melissac@microsoft.com Sarah

Anonymous Credentials: How to show credentials without compromising privacy

Cinderella: Turning Shabby X.509 ... - paper.seebug.org Conf/37th... · Cinderella: Turning Shabby X.509 Certificates into Elegant Anonymous Credentials Antoine Delignat-Lavaud Cédric

Toward secure and privacy sensitive ID/authentication? · Digital credentials!!#Well recognized potential in on-line transactions – see:! •#David Chaum – Anonymous authentication

Delegatable Attribute-based Anonymous Credentials from ... · Delegatable Attribute-based Anonymous Credentials from Dynamically Malleable Signatures Johannes Bl omer and Jan Bobolz

Anonymous communications and systems · Intro to Anonymous Credentials Both ACLs and Capabilities assume authentication as a first stage! Not a very good model for the “cinema ticket”,

Restricted Usage of Anonymous Credentials in VANET for Misbehaviour Detection