Efficient Distributed Tag-Based Encryption and Its Application to Group Signatures with Efficient Distributed Traceability

Abstract

Abstract. In this work, we first formalize the notion of dynamic group signatures with distributed traceability, where the capability to trace signatures is distributed among n managers without requiring any interaction. This ensures that only the participation of all tracing managers permits tracing a signature, which reduces the trust placed in a single tracing manager. The threshold variant follows easily from our definitions and constructions. Our model offers strong security requirements. Our second contribution is a generic construction for the notion which has a concurrent join protocol, meets strong security requirements, and offers efficient traceability, i.e. without requiring tracing managers to produce expensive zero-knowledge proofs for tracing correctness. To dispense with the expensive zero-knowledge proofs required in the tracing, we deploy a distributed tag-based encryption with public verifiability. Finally, we provide some concrete instantiations, which, to the best of our knowledge, are the first efficient provably secure realizations in the standard model simultaneously offering all the aforementioned properties. To realize our constructions efficiently, we construct an efficient distributed (and threshold) tag-based encryption scheme that works in the efficient Type-III asymmetric bilinear groups. Our distributed tag-based encryption scheme yields short ciphertexts (only 1280 bits at 128-bit security), and is secure under an existing variant of the standard decisional linear assumption. Our tag-based encryption scheme is of independent interest and is useful for many applications beyond the scope of this paper. As a special case of our distributed tag-based encryption scheme, we get an efficient tag-based encryption scheme in Type-III asymmetric bilinear groups that is secure in the standard model.

Stronger Security Notions for Decentralized Traceable Attribute-Based Signatures and More Efficient Constructions

“…In distributed tag-based encryption [4,15], the (tag-based) ciphertexts can only be decrypted if all n decryption servers compute their decryption shares correctly. In the threshold variant, at least κ out of n decryption servers must compute their decryption shares correctly for the decryption to succeed.…”

“…Besides the original scheme given in [15], we also use a second variant of the scheme in [15] (shown in Fig. 6) where we transpose the groups in which the public key and the ciphertext lie.…”

“…6. The transposed 1-out-of-1 variant of the distributed tag-based encryption scheme from [15] Overview of the construction. Unlike previous constructions, e.g.…”

Revocable Privacy: Principles, Use Cases, and Technologies

“…Instead, we can distribute the powers of the tracing agent. In a group signature scheme with a distributed tracing agent, several agents need to cooperate before the identity of the signer can be recovered [9]. As long as a decent subset of the tracing agents is trusted, the anonymity of the user's identities is guaranteed.…”

Provably Secure Anonymous-yet-Accountable Crowdsensing with Scalable Sublinear Revocation

“…After the introduction [14], different variants of GS schemes were proposed (collision-resistant GS scheme [19], sign-and-encrypt-and-prove based GS [20], traceable signatures [15,34,35], GS with verifier local revocation [16], GS from blind signatures [36], traceable signatures in standard model [37], group signatures in standard model [38], GS with controllable linkability [39,40], GS with distributed traceability [41], GS with dynamic accumulators [42]). Kiayias et al (traceable signatures [15]) first introduced internal tracing algorithms (trapdoors) to efficiently trace and revoke the anonymity of misbehaving members.…”