Fully Anonymous Attribute Tokens from Lattices

Abstract

Abstract. Anonymous authentication schemes such as group signatures and anonymous credentials are important privacy-protecting tools in electronic communications. The only currently known scheme based on assumptions that resist quantum attacks is the group signature scheme by Gordon et al. (ASIACRYPT 2010). We present a generalization of group signatures called anonymous attribute tokens where users are issued attribute-containing credentials that they can use to anonymously sign messages and generate tokens revealing only a subset of their attributes. We present two lattice-based constructions of this new primitive, one with and one without opening capabilities for the group manager. The latter construction directly yields as a special case the first lattice-based group signature scheme offering full anonymity (in the random-oracle model), as opposed to the practically less relevant notion of chosen-plaintext anonymity offered by the scheme of Gordon et al. We also extend our scheme to protect users from framing attacks by the group manager, where the latter creates tokens or signatures in the name of honest users. Our constructions involve new lattice-based tools for aggregating signatures and verifiable CCA2-secure encryption.

A lattice-based group signature scheme with verifier-local revocation

“…Efficiency: For a security parameter n and for a group of N members, the group public key and the signature have bit-sizes O(n 2 ) · log N and O(n) · log N , respectively. This result is comparable to that of [22], and is a noticeable improvement over those of [19] and [13]. 4.…”

“…In particular, we introduce the first group signature with verifier-local revocation from lattice assumptions, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with known lattice-based group signatures, while the schemes from [19], [13] and [22] follow the CPA-anonymity and CCA-anonymity notions from [8,5], our construction satisfies the (weaker) notion of selfless-anonymity for VLR group signatures from [9]. Nevertheless, our scheme has several remarkable advantages over the contemporary counterparts: 1.…”

“…In terms of efficiency, this is a noticeable disadvantage if the group is large, e.g., group of all employees of a big company. Camenisch et al [13] later proposed lattice-based anonymous attribute tokens system, a primitive that can be considered as a generalization of group signature. However, in their construction, the signatures size is still linear in N .…”

Group Signature with Deniability: How to Disavow a Signature

“…In particular, the Groth scheme applies efficient zero-knowledge proofs for bilinear groups, which are known as Groth-Sahai proofs [26]. In addition to these schemes, lattice-based constructions were proposed [24,33,32,13].…”

Simpler Efficient Group Signatures from Lattices

“…Later, Camenisch el al. [29] proposed a variant of [38] with improvements both in efficiency (i.e., shorter group public key) and security (i.e., stronger adversary against anonymity), but the signature size of their scheme was still linear in N . Recently, two papers [44,45] have significantly decreased the signature size.…”