Black-Box Wallets: Fast Anonymous Two-Way Payments for Constrained Devices

Abstract

Black-box accumulation (BBA) is a building block which enables a privacy-preserving implementation of point collection and redemption, a functionality required in a variety of user-centric applications including loyalty programs, incentive systems, and mobile payments. By definition, BBA+ schemes (Hartung et al. CCS ‘17) offer strong privacy and security guarantees, such as unlinkability of transactions and correctness of the balance flows of all (even malicious) users. Unfortunately, the instantiation of BBA+ presented at CCS ‘17 is, on modern smartphones, just fast enough for comfortable use. It is too slow for wearables, let alone smart-cards. Moreover, it lacks a crucial property: For the sake of efficiency, the user’s balance is presented in the clear when points are deducted. This may allow to track owners by just observing revealed balances, even though privacy is otherwise guaranteed. The authors intentionally forgo the use of costly range proofs, which would remedy this problem.We present an instantiation of BBA+ with some extensions following a different technical approach which significantly improves efficiency. To this end, we get rid of pairing groups, rely on different zero-knowledge and fast range proofs, along with a slightly modified version of Baldimtsi-Lysyanskaya blind signatures (CCS ‘13). Our prototype implementation with range proofs (for 16 bit balances) outperforms BBA+ without range proofs by a factor of 2.5. Moreover, we give estimates showing that smart-card implementations are within reach.

Privacy-Preserving Incentive Systems with Highly Efficient Point-Collection

“…In [23], Jager and Rupp introduce black-box accumulation (BBA) as a building block for incentive systems. BBA has been improved in two follow-up works to a system called BBA+ [20] by Hartung et al and Black-box Wallet (BBW) by Hoffmann et al [22]. BBA+ adds offline double-spending protection and the collection of negative points.…”

“…Further, they introduce in BBA+ [20] the important and strong notion of forward and backward unlinkable transactions. While BBA and BBA+ use Groth-Sahai NIZK proofs [18] in all protocols, in BBW [22] the system is further optimized for smart-card usage. In contrast to our construction, the concurrent work BBW [22] aims at applications where the spend operation is frequent, e.g.…”

“…While BBA and BBA+ use Groth-Sahai NIZK proofs [18] in all protocols, in BBW [22] the system is further optimized for smart-card usage. In contrast to our construction, the concurrent work BBW [22] aims at applications where the spend operation is frequent, e.g. subway turnstiles, and optimizes it using Bulletproofs [5].…”

Fast Privacy-Preserving Punch Cards

“…Unfortunately, although individual hole punches are unlinkable in the original BBA scheme, the processes of issuing and redeeming a punch card are not. This shortcoming is rectified in a series of follow-up works [5,6,[34][35][36], all of which additionally extend the idea of black box accumulation to support a broader set of functionalities, usually via some combination of blind signatures and zero-knowledge proofs that previously signed values satisfy certain relationships, e.g., that a balance was correctly updated.…”

P4TC—Provably-Secure yet Practical Privacy-Preserving Toll Collection

“…Note that we cannot build on the faster version of BBA+[46] as we aim for a proof in the UC model which collides with their need to rewind adversaries. 4 Unfortunately, online double-spending detection is not feasible in this scenario (even if we required permanent online connection from RSUs) due to the strong time constraints of open road tolling and potentially simultaneously conducted interactions.…”