An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials

Abstract

Abstract. The success of electronic authentication systems, be it e-ID card systems or Internet authentication systems such as CardSpace, highly depends on the provided level of user-privacy. Thereby, an important requirement is an efficient means for revocation of the authentication credentials. In this paper we consider the problem of revocation for certificate-based privacy-protecting authentication systems. To date, the most efficient solutions for revocation for such systems are based on cryptographic accumulators. Here, an accumulate of all currently valid certificates is published regularly and each user holds a witness enabling her to prove the validity of her (anonymous) credential while retaining anonymity. Unfortunately, the users' witnesses must be updated at least each time a credential is revoked. For the know solutions, these updates are computationally very expensive for users and/or certificate issuers which is very problematic as revocation is a frequent event as practice shows.In this paper, we propose a new dynamic accumulator scheme based on bilinear maps and show how to apply it to the problem of revocation of anonymous credentials. In the resulting scheme, proving a credential's validity and updating witnesses both come at (virtually) no cost for credential owners and verifiers. In particular, updating a witness requires the issuer to do only one multiplication per addition or revocation of a credential and can also be delegated to untrusted entities from which a user could just retrieve the updated witness. We believe that thereby we provide the first authentication system offering privacy protection suitable for implementation with electronic tokens such as eID cards or drivers' licenses.

Fast Revocation of Attribute-Based Credentials for Both Users and Verifiers

“…The issuer will include this revocation value in the credential without ever learning its value. 8 Option 1: only the user knows the revocation value. The privacy of the credential owner is best protected when only she knows the revocation value.…”

“…Table 1. We compare CRLs [14], accumulators [8,10,24], traditional VLR schemes [1,4,6], VLR schemes with backward unlinkability (VLR-BU) [22], blacklistable anonymous credentials (BLAC) [28], and our scheme. We compare the complexity of the operations and data transfers.…”

“…Revocation may, in fact, happen often. As an example, the nationwide Belgian eID system's revocation list contains more than 375 000 credentials [8] for just over 10 million citizens. A practical revocation scheme must therefore efficiently deal with such large revocation lists.…”

Group Signature with Constant Revocation Costs for Signers and Verifiers

“…Thereafter, many revocable group signature schemes were built, e.g. [3,11,12,13,14,15,16,18,19,20,21,23,24,25,26,31,32]. The first popular approach for handling revocation in group signature schemes is based on dynamic accumulators, originally applied by Camenisch and Lysyanskaya [16], and later adopted to further constructions [20,15,30].…”

“…This property, known as BU-anonymity, was introduced in [13] and further considered in [12,19,25,26,31,32]. Many of existing revocable group signature schemes [3,11,12,13,14,15,16,19,25,26,31,32] have linear computation complexity for the generation and/or verification of group signatures, either O(N) with N being the number of group members, or O(R) with R being the number of revoked members. 1 Jin et al [18] claim that their revocable group signature scheme has constant costs with regard to signing/verifying and lengths of signatures, group public key, and individual secret signing keys.…”