An Optimistic fair exchange (OFE) protocol is a protocol for fairly exchanging items between two parties. First in 2008, Huang et al. introduced the concept of ambiguous OFE in which the partial signature is ambiguous but the full one is not. Qu et al. in 2012, proposed a shceme with ambiguity for the full signature but not for the partial one. We solve the problem of both schemes by proposing the first efficient protocol that has ambiguity in both partial and full signature. Meanwhile, by using a traceable ring signature (TRS), we achieve the accountability property. We should highlight that our accountable OFE protocol is the first one secure in the standard model.
An Optimistic fair exchange (OFE) protocol is a protocol for fairly exchanging items between two parties. First in 2008, Huang et al. introduced the concept of ambiguous OFE in which the partial signature is ambiguous but the full one is not. Qu et al. in 2012, proposed a shceme with ambiguity for the full signature but not for the partial one. We solve the problem of both schemes by proposing the first efficient protocol that has ambiguity in both partial and full signature. Meanwhile, by using a traceable ring signature (TRS), we achieve the accountability property. We should highlight that our accountable OFE protocol is the first one secure in the standard model.
An Optimistic fair exchange (OFE) protocol is a good way for two parties to exchange their digital items in a fair way such that at the end of the protocol, both of them receive their items or none of them receives anything. In 2008, Huang et al. presented an efficient OFE protocol, but there is a security problem in their scheme. If the trusted third party (TTP) is dishonest and colludes with the verifier, the TTP can complete the transaction without getting signer's agreement. To solve this problem, we propose an OFE protocol in which there is a tracing algorithm to detect the party who completes the transaction. Furthermore, we obtain the accountability property introduced by Huang et al. in 2011, more efficiently and in the standard model while their protocol is in the random oracle model. We prove the security of our scheme under the chosen-key model and multi-user setting in the standard model.
Fair exchange protocols aim to allow two parties to exchange digital items in a fair manner. Optimistic fair exchange (OFE) is a kind of protocols that solves the fair exchange problem with the help of a trusted third party (TTP), usually referred to as an `arbitrator'. The participation of the arbitrator is only required when there is a dispute between the exchanging parties. In the literature, the highest level of security of optimistic fair exchange is the multi-user security in the chosen-key model, proposed by Huang, Yang, Wong and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme, secure in this sense, can be constructed generically from a conventional signature and a ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting.\nConcurrent signatures, introduced by Chen, Kudla and Paterson in Eurocrypt 2004, allow two parties to produce two ambiguous signatures until an extra piece of information, the keystone, is released by one of the parties. Upon the release of the keystone, the ambiguity will be revoked and the signatures bind to their true signers concurrently. Concurrent signatures, however, are known to fall just short of fully solving the long standing fair exchange of signatures problem. The price for not requiring any TTP is that the party who holds the keystone always has an advantage over the other party in controlling when and whether the protocol completes or not.\nIn this thesis, the fair exchange of digital signatures problem is studied. In the first part of this thesis, the OFE security is strengthened and a more practical model which is called enhanced chosen-key model is proposed. Unlike the existing multiuser setting and chosen-key model, an adversary in the enhanced chosen-key model is further provided with the signing oracle that outputs full signatures generated by the signer, and may even be allowed to have access to the arbitrator's secret key. The necessity for the new model is demonstrated. It is shown that two existing methodologies for constructing optimistic fair exchange schemes remain valid in the enhanced chosen-key model.\nNext, the efficiency of OFE constructions is improved. A model for 2-user ring signatures called `unforgeability against restricted adaptive attacks' is proposed and it is shown that the new ring model is strictly weaker than the model of unforgeability under an adaptive attack, against a static adversary in the 2-user setting. Based on the finding that 2-user ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE schemes in the enhanced chosenkey model, the most efficient OFE scheme whose security does not rely on random oracles is proposed.\nNew situations in OFE are also investigated, and the applications of OFE are extended. The scenarios where the digital items to be exchanged are threshold signatures are considered, and the notion of threshold-oriented OFE (TOFE) together with a security model and an efficient concrete scheme is proposed. It is identified that in some scenarios, it is required that prior to the completion of the protocol, no information about the actual exchange should be revealed to an outsider. To achieve this purpose, the notion of perfect ambiguous optimistic fair exchange (PAOFE) is introduced, the security model for PAOFE is proposed and a generic construction based on existing primitives is offered. OFE in the attribute-based setting is considered and the notion of attribute-based optimistic fair exchange (ABOFE) is proposed. The security model and a construction for ABOFE are presented as well.\nFinally, concurrent signatures is revisited. It is showed that theoretically the party who controls the keystone in a concurrent signature scheme has more advantages than previously thought. In particular, the notion is examined and the advantages are classified into three levels.It is demonstrated that concurrent signatures may be abused in practical applications if one fails to take these advantages into account.
Optimistic fair exchange (OFE) protocols are useful tools for two participants to fairly exchange items with the aid of a third party who is only involved if needed. A widely accepted requirement is that the third party's involvement in the exchange must be transparent, to protect privacy and avoid bad publicity. At the same time, a dishonest third party would compromise the fairness of the exchange and the third party thus must be responsible for its behaviors. This is achieved in OFE protocols with another property called accountability. It is unfortunate that the accountability has never been formally studied in OFE since its introduction ten years ago. In this paper, we fill these gaps by giving the first complete definition of accountability in OFE where one of the exchanged items is a digital signature and a generic (also the first) design of OFE where transparency and accountability coexist.
The notion of optimistic fair exchange (OFE) protocol was proposed by Asokan et al. in order to solve the problem of exchanging items or services in a fair manner between a signer and a verifier. There are various OFE protocols and variants in the literature, and they possess different security properties. In this paper, we provide an overview on the development of OFE protocol and its variants, namely, ambiguous OFE, perfect ambiguous OFE, privacy preserving OFE, accountable OFE, and group-oriented OFE. In precise, we investigate the security properties, evolutions and relationships among them. We also provide an evolution tree diagram to present their developments as well as three comparison analysis tables to compare and contrast their security properties.
Optimistic Fair Exchange protocol was designed for two parties to exchange in a fair way where an arbitrator always remains offline and will be referred only if any dispute happens. There are various optimistic fair exchange protocols with different security properties in the literature. Most of the optimistic fair exchange protocols satisfy resolution ambiguity where a signature signed by the signer is computational indistinguishable from the one resolved by the arbitrator. Huang et al. proposed the first generic framework for accountable optimistic fair exchange protocol in the random oracle model where it possesses resolution ambiguity and is able to reveal the actual signer when needed. Ganjavi et al. later proposed the first generic framework in the standard model. In this paper, we propose a new generic framework for accountable optimistic fair exchange protocol in the standard model using ordinary signature, convertible undeniable signature, and ring signature scheme as the underlying building blocks. We also provide an instantiation using our proposed generic framework to obtain an efficient pairing-based accountable optimistic fair exchange protocol with short signature.
Optimistic fair exchange (OFE) is a kind of protocol that solves the fair exchange problem with the help of a trusted third party, usually referred to as an arbitrator. Participation of the arbitrator is required only when there is a dispute among the exchanging parties. Thus, the majority of the executions of the exchange does not involve the arbitrator and hence the term optimistic. The passive nature of the arbitrator makes optimistic fair exchange a desirable tool in applications, such as contract signing and electronic commerce. The highest level of security of optimistic fair exchange in the literature is the multiuser security in the chosen-key model, proposed by Huang, Yang, Wong, and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme secure in this sense can be constructed generically from a conventional digital signature and a two-party ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting. In this paper, we propose a new security model for two-party ring signatures called unforgeability against restricted adaptive attacks and demonstrate that our new model is strictly weaker than the model of unforgeable under an adaptive attack, against a static adversary in the 2-user setting. We make an observation that two-party ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE scheme following the aforementioned generic construction. Based on this observation, more efficient OFE schemes secure in the standard model can be constructed. Specifically, we prove that the well-known Bender, Katz, and Morselli's 2-user ring signature is secure in our weakened model. Based on this two-party ring signature, we construct an OFE secure in the chosen-key model offering multiuser security in the standard model under the computational Diffie-Hellman assumption. The assumption is arguably weaker than those used in all existing constructions, which rely on the random oracle model, decisional assumptions, or the strong Diffie-Hellman assumptions. It is also worth noting that our scheme is the most efficient one in the standard model, and offers comparable efficiency against those secure under the random oracle model.