Enhanced Privacy ID: A Direct Anonymous Attestation Scheme with Enhanced Revocation Capabilities

Extending Nymble-like Systems

“…6 We then compute x e·η j j in j + 1 stages: U computes x i−1 = x η i for 0 < i ≤ j, then raises x 0 to the e th power. This reduces the number of multiplication steps in square-and-multiply to just j + 2.…”

“…7,8 When U wishes to obtain a set of nymbles for an SP, she uses the appropriate verinym to prove that her SP-specific pseudonym from a past linkability window is not on the associated blacklist. This is reminiscent of the BLAC [33]- [35] and EPID [6] approach to blacklisting, which, as discussed elsewhere [20], raises performance and scalability concerns. However, five important distinctions with our approach warrant mention: 1) Since most IP address bans are short term, most revoked users will not appear on a long-term blacklist.…”

“…9 4) An idea due to Brands et al [4], [5] enables the user to perform this non-membership proof using a number of exponentiations proportional to √ M , where M is the size of the blacklist against which the user generates a proof. For large blacklists, this method dramatically outperforms the linear exponentiations approach used in both BLAC [33]- [35] and EPID [6]. 5) Finally, we can use blinded verification tokens to let U prove that she already proved that her SP-specific pseudonym is not on a blacklist, thus eliminating much redundant computation.…”

“…Since Nymble was first proposed in 2006, several schemes have appeared in the literature to solve the same problem, or one of several closely related problems. (For some examples, see [6], [20], [21], [23], [24], [33]- [35].) Three of these schemes operate within the same general framework as Nymble; they change only low-level details to weaken trust assumptions and to provide stronger privacy guarantees and some new functionality.…”

Efficient Signatures of Knowledge and DAA in the Standard Model

“…Apart from this however, signatures are anonymous: two verifiers comparing signatures under their respective basenames cannot tell if a signature under one basename was produced by the same user as another signature under a different basename. Many subsequent papers [14][15][16][17][23][24][25][26][27][28] have advanced the state of the art in two areas. First, since the discovery of cryptographic applications of bilinear pairings over elliptic curves, authors have proposed more efficient pairingbased DAA protocols, first in the symmetric then in the asymmetric setting.…”