Binding ElGamal: A Fraud-Detectable Alternative to Key-Escrow Proposals

Abstract

We propose a concept for a worldwide information security infrastructure that protects law-abiding citizens, but not criminals, even if the latter use it fraudulently (i.e. when not complying with the agreed rules). It can be seen as a middle course between the inflexible but fraudresistant KMI-proposal [8] and the flexible but non-fraud-resistant concept used in TIS-CKE [2]. Our concept consists of adding binding data to the latter concept, which will not prevent fraud by criminals but makes it P t least detectable by third parties without the need of any secret information. In [19], we depict a worldwide framework in which this concept could present a security tool that is flexible enough to be incorporated in any national cryptography policy, on both the domestic and foreign use of cryptography. Here, we present a construction for binding data for ElGamal type public key encryption schemes. As a side result we show that a particular simplification in a multiuser version of ElGamal does not s e c t its security.

A Simple Publicly Verifiable Secret Sharing Scheme and Its Application to Electronic Voting

“…Finally, Section 6 contains several more applications of our PVSS schemes, including a generalization of Binding ElGamal [VT97] and other constructions related to software key escrow, such as [YY98]. We show how threshold variants for these schemes can be obtained easily.…”

“…In [VT97] Verheul and van Tilborg present a scheme called Binding ElGamal that may be used to enhance the strength of a public-key infrastructure depending on software key escrow. The basic scheme provides a mechanism to copy a session-key not only to the intended receiver but also to n trustees.…”

“…In other words, the trustees share the session-key according to a (1, n)-threshold structure. Extensions to (t, n)-threshold scenarios are also described in [VT97]. However, in these extensions it is required that the participants first engage in a shared-key generation protocol (as in the previous section).…”

New efficient and secure protocols for verifiable signature sharing and other applications

“…In [31] the concept of binding cryptography was introduced. In a binding publickey cryptosystem the sender encrypts a message under both the public key of the receiver and the public key of a third party and prove in (non-interactive) ZK that the two ciphertexts contain the same message.…”

“…In a binding publickey cryptosystem the sender encrypts a message under both the public key of the receiver and the public key of a third party and prove in (non-interactive) ZK that the two ciphertexts contain the same message. In [31] a scheme for binding E1Oamal was presented. We show that our RSA V~US scheme can be used to construct binding RSA public key encryptions.…”