Equivocal Blind Signatures and Adaptive UC-Security.

Aggelos Kiayias, Hong-Sheng Zhou

Published Jan 1, 2007• 0 citations

Abstract

We study the design of practical blind signatures in the universal composability (UC) setting against adaptive adversaries. We introduce a new property for blind signature schemes that is fundamental for managing adaptive adversaries: an equivocal blind signature is a blind signature protocol where a simulator can construct the internal state of the client so that it matches a simulated transcript even after a signature was released. We present a general construction methodology for building practical adaptively secure blind signatures: the starting point is a 2-move “lite blind signature”, a lightweight 2-party signature protocol that we formalize and implement both generically as well as number theoretically: formalizing a primitive as “lite ” means that the adversary is required to show all private tapes of adversarially controlled parties; this enables us to conveniently separate zero-knowledge (ZK) related security requirements from the remaining security properties in the primitive’s design methodology. We then focus on the exact ZK requirements for building blind signatures. To this effect, we formalize two special ZK ideal functionalities, single-verifier-ZK (SVZK) and single-prover-ZK (SPZK) and we investigate the requirements for realizing them in a commit-and-prove fashion as building blocks for adaptively secure UC blind signatures. SVZK can be realized without relying on a multi-session UC commitment; as

Related papers

A framework for universally composable non-committing blind signatures

Masayuki Abe, Miyako Ohkubo

This paper studies non-committing type of universally composable (UC) blind signature protocols where an adversary does not necessarily commit to a message when requesting a signature. An ordinary UC blind signature functionality requires users to commit to the message to be blindly signed. It is thereby impossible to realise in the plain model. This paper first shows that even non-committing variants cannot be realised in the plain model. We then characterise UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. The usefulness of the characterisation is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.

International Journal of Applied CryptographyJan 1, 20129 citations

Universally Composable Undeniable Signature.

Kaoru Kurosawa, Jun Furukawa

Abstract. How to define the security of undeniable signature schemes is a challenging task. This paper presents two security definitions of undeniable signature schemes which are more useful or natural than the existing definition. It then proves their equivalence. We first define the UC-security, where UC means universal composability. We next show that there exists a UC-secure undeniable signature scheme which does not satisfy the standard definition of security that has been believed to be adequate so far. More precisely, it does not satisfy the invisibility defined by [10]. We then show a more adequate definition of invisibility which captures a wider class of (naturally secure) undeniable signature schemes. We finally prove that the UC-security against non-adaptive adversaries is equivalent to this definition of invisibility and the strong unforgeability in FZK-hybrid model, where FZK is the ideal ZK functionality. Our result of equivalence implies that all the known proven secure undeniable signature schemes (including Chaum’s scheme) are UC-secure if the confirmation/disavowal protocols are both UC zero-knowledge.

Jan 1, 20082 citations

UNIVERSALLY COMPOSABLE BLIND SIGNATURE FUNCTIONALITY

Shirley Cheung, C. H. LEE, Yunlei Zhao

Blind signatures play a critical role in digital cash systems. In this paper, we investigate the blind signature functionality in the framework of universally composable (UC) security — the strongest security guarantees up to now for cryptographic protocols over the Internet. We present the universally composable blind signature functionality, [Formula: see text]. Our approach is based on a new UC signature functionality [Formula: see text], which is a modified version of the original signature functionality [Formula: see text] presented by Canetti. We also prove that [Formula: see text] and [Formula: see text] are actually equivalent with respect to non-adaptive adversaries. Our result is of both theoretical and practical consequence to future research studies and practical implementations of digital cash systems with universally composable security.

International Journal of Information Technology & Decision MakingDec 1, 20040 citations

A Framework for Universally Composable Non-Committing Blind Signatures.

Masayuki Abe, Miyako Ohkubo

A universally composable (UC) blind signature functionality requres users to commit to the message to be blindly signed. It is thereby impossible to realize in the plain model. This paper shows that even non-committing variants of UC blind signature functionality can not be realized in the plain model. We characterize UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. Usefulness of the characterization is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.

Jan 1, 20090 citations

Adaptively Secure Feldman VSS and Applications to Universally-Composable Threshold Cryptography

Masayuki Abe, Masayuki Abe, Serge Fehr

Abstract. We propose the first distributed discrete-log key generation (DLKG) protocol from scratch which is adaptively-secure in the nonerasure model, and at the same time completely avoids the use of interactive zero-knowledge proofs. As a consequence, the protocol can be proven secure in a universally-composable (UC) like framework which prohibits rewinding. We prove the security in what we call the singleinconsistent-player UC model, which guarantees arbitrary composition as long as all protocols are executed by the same players. As an application, we propose a fully UC threshold Schnorr signature scheme. Our results are based on a new adaptively-secure Feldman VSS scheme. Although adaptive security was already addressed by Feldman in the original paper, the scheme requires secure communication, secure erasure, and either a linear number of rounds or digital signatures to resolve disputes. Our scheme overcomes all of these shortcomings, but on the other hand requires some restriction on the corruption behavior of the adversary, which however disappears in some applications including our new DLKG protocol. We also propose several new adaptively-secure protocols, which may find other applications, like a sender non-committing encryption scheme, a distributed trapdoor-key generation protocol for Pedersen’s commitment scheme, or distributed-verifier proofs for proving relations among commitments or even any NP relations in general. 1

Jan 1, 20040 citations

A Framework for Practical Universally Composable Zero-Knowledge Protocols.

Jan L. Camenisch, Stephan Krenn, Victor Shoup

Abstract. Zero-knowledge proofs of knowledge (ZK-PoK) for discrete logarithms and related problems are indispensable for practical cryptographic protocols. At Eurocrypt 2009, Camenisch, Kiayias, and Yung provided a specification language (the CKY-language) for such protocols, which allows one to modularly design and analyze cryptographic protocols: protocol designers just need to specify the statement they want to prove in zero-knowledge and are ensured that an efficient proof protocol exists and indeed proves the specified statement, provided that the specification was in the CKY-language. However, as specifications in the CKY-language are realized by so-called Σ-protocols, the resulting protocols only satisfy the classical notion of zero-knowledge proofs of knowledge, which not retained if they are composed with themselves or with other protocols, e.g., when used as building blocks for higher-level applications. This problem can be tackled by moving to the Universal Composability (UC) framework, which guarantees retention of security when composing protocols and, in particular, when using them as building blocks in arbitrary contexts. While there exists generic transformations from Σ-protocols to protocols that are secure under this stronger security notion, these transformation are often not efficient enough for the design of practical protocols. In this paper we are aiming for practically efficient ZK-PoK in the UC-framework by introducing

Jan 1, 20110 citations