Compact E-Cash and Simulatable VRFs Revisited

Abstract

Efficient non-interactive zero-knowledge proofs are a powerful tool for solving many cryptographic problems. We apply the recent Groth-Sahai (GS) proof system for pairing product equations (Eurocrypt 2008) to two related cryptographic problems: compact e-cash (Eurocrypt 2005) and simulatable verifiable random functions (CRYPTO 2007). We present the first efficient compact e-cash scheme that does not rely on a random oracle. To this end we construct efficient GS proofs for signature possession, pseudo randomness and set membership. The GS proofs for pseudorandom functions give rise to a much cleaner and substantially faster construction of simulatable verifiable random functions (sVRF) under a weaker number theoretic assumption. We obtain the first efficient fully simulatable sVRF with a polynomial sized output domain (in the security parameter). IntroductionSince their invention [BFM88] non-interactive zero-knowledge proofs played an important role in obtaining feasibility results for many interesting cryptographic primitives [BG90,GO92,Sah99], such as the first chosen ciphertext secure public key encryption scheme [BFM88,RS92,DDN91]. The inefficiency of these constructions often motivated independent practical instantiations that were arguably conceptually less elegant, but much more efficient ([CS98] for chosen ciphertext security).We revisit two important cryptographic results of pairing-based cryptography, compact e-cash [CHL05] and simulatable verifiable random functions [CL07], that have very elegant constructions based on non-interactive zero-knowledge proof systems, but less elegant practical instantiations. Our results combine the best of both worlds, a clean design and an efficient implementation.Compact e-cash. Electronic cash (e-cash) was introduced by David Chaum [Cha83] as an electronic analogue of physical money and has been a subject of ongoing cryptographic research since then [CFN90,FY92,CP93,Bra93a,CPS94,Bra93b,SPC95,FTY96,Tsi97]. The participants in an e-cash system are users who withdraw and spend e-cash; a bank that creates e-cash and accepts it for deposit, and merchants who offer goods and services in exchange for e-cash, and then deposit the e-cash to the bank. The main security requirements are (1) anonymity: even if the bank and the merchant and all the remaining users collude with each other, they still cannot distinguish Alice's purchases from Bob's; (2) unforgeability: even if all the users and all the merchants collude against the bank, they still cannot deposit more money than they withdrew.Unfortunately, it is easy to see that, as described above, e-cash is useless. The problem is that here money is represented by data, and it is possible to copy data. Unforgeability will guarantee that the bank will only honor at most one of copy of a given coin for deposit and will reject the others. Anonymity will guarantee that there is no recourse against such a cheating Alice. So one of the merchants will be cheated. There are two known remedies against this double-spending behavior. The ...

Efficient Signatures of Knowledge and DAA in the Standard Model

“…The weak Boneh-Boyen signature scheme [9] was used in [29,2] to construct Verifiable Random Functions (VRF) [43] for small message spaces under two variants of the DDHI assumption. The proof of pseudorandomness uses a technique similar to that for the unforgeability of weak Boneh-Boyen signatures in [9]: if the messages m 1 , .…”

“…We define our LIT as the VRF from [2] and use the first part of their proof of pseudorandomness of VRFs to prove weak f -indistinguishability w.r.t. f (sk) := [sk]P 1 .…”

“…To construct a LIT which is not only weakly indistinguishable and which supports large domains, a natural approach would be to consider large-domain VRFs. There have been several such schemes in the recent literature including the cascade construction of Boneh et al [12] to increase the domain of the Dodis-Yampolskiy VRF [29], the BCKL construction [2] applied to the Dodis-Yampolskiy VRF [29] and the Hohenberger-Waters VRF [38]. Unfortunately, all of the abovementioned schemes violate the weak linkability requirement for LITs, as it is easy to find for example sk 0 = sk 1 and m such that LITTag(sk 0 , m) = LITTag(sk 1 , m).…”

“…4.1) as partially weakly blind signatures, the VRF from [2] as LIT given in Fig. 7 (which has the form of weak Boneh-Boyen signatures [9]) and Waters signatures [46] implicitly for the signatures of knowledge, which are themselves Groth-Sahai proofs [36].…”

Efficient E-Cash in Practice: NFC-Based Payments for Public Transportation Systems

“…Following Chaum's paradigm many schemes were proposed [11,16,7,12,14]. The one due to Brands [11] is known for its efficiency during spending, however, a formal proof of security has never been given for it and it has been recently shown that it cannot be proven secure in the Random Oracle model using currently known techniques [5].…”