Accountable Tracing Signatures from Lattices

Abstract

Group signatures allow users of a group to sign messages anonymously in the name of the group, while incorporating a tracing mechanism to revoke anonymity and identify the signer of any message. Since its introduction by Chaum and van Heyst (EUROCRYPT 1991), numerous proposals have been put forward, yielding various improvements on security, efficiency and functionality. However, a drawback of traditional group signatures is that the opening authority is given too much power, i.e., he can indiscriminately revoke anonymity and there is no mechanism to keep him accountable. To overcome this problem, Kohlweiss and Miers (PoPET 2015) introduced the notion of accountable tracing signatures (ATS) -an enhanced group signature variant in which the opening authority is kept accountable for his actions. Kohlweiss and Miers demonstrated a generic construction of ATS and put forward a concrete instantiation based on number-theoretic assumptions. To the best of our knowledge, no other ATS scheme has been known, and the problem of instantiating ATS under post-quantum assumptions, e.g., lattices, remains open to date.In this work, we provide the first lattice-based accountable tracing signature scheme. The scheme satisfies the security requirements suggested by Kohlweiss and Miers, assuming the hardness of the Ring Short Integer Solution (RSIS) and the Ring Learning With Errors (RLWE) problems. At the heart of our construction are a lattice-based key-oblivious encryption scheme and a zero-knowledge argument system allowing to prove that a given ciphertext is a valid RLWE encryption under some hidden yet certified key. These technical building blocks may be of independent interest, e.g., they can be useful for the design of other lattice-based privacy-preserving protocols. Setup(λ):On input the security parameter λ, it outputs public parameter pp.pp is implicit for all algorithms below if not explicitly mentioned. KeyGen(pp): On input pp, it generates a key pair (pk, sk). KeyRand(pk): On input the public key pk, it outputs a new public key pk ′ for the same secret key. Enc(pk, m): On inputs pk and a message m, it outputs a ciphertext ct on this message. Dec(sk, ct): On inputs sk and ct, it outputs the decrypted message m ′ .Correctness. The above scheme must satisfy the following correctness requirement: For all λ, all pp ← Setup(λ), all (pk, sk) ← KeyGen(pp), all pk ′ ← KeyRand(pk), all m, Dec(sk, Enc(pk ′ , m)) = m.

A Survey on Group Signatures and Ring Signatures: Traceability vs. Anonymity

“…Thus it enables tracer accountability. Ling et al [100] used the lattice hardness problems, and presented a quantum-safe accountable tracing group signature scheme.…”

Group Signatures with Designated Traceability over Openers’ Attributes

“…That is, the admitter issues a token that corresponds to a message, and then the opener extracts the signer's identity from the signature using the token. Another direction is "accountable tracing" [15,12]. In an accountable tracing group signature scheme, users in a group are divided into two kinds.…”

Forward-Secure Group Signatures from Lattices

“…While many of them [16,32,45,53,37,11,22] aim to provide enhancement on security and efficiency, they are solely designed for the static groups and often fall too short for specific needs of real-life applications. With regard to advanced features, there have been proposed several schemes [33,34,46,48,40,47] and they are still behind their counterparts in the number-theoretic setting. Specifically, [33,34,46,48] deal with dynamic user enrollments and/or revocations of misbehaving users while [40,47] attempt to restrict the power of the tracing manager or keep his actions accountable.…”

“…With regard to advanced features, there have been proposed several schemes [33,34,46,48,40,47] and they are still behind their counterparts in the number-theoretic setting. Specifically, [33,34,46,48] deal with dynamic user enrollments and/or revocations of misbehaving users while [40,47] attempt to restrict the power of the tracing manager or keep his actions accountable. For the time being, the problem of making GS secure against the key exposure problem is still open in the context of lattices.…”