More efficient, provably-secure direct anonymous attestation from lattices

Abstract

The Cloud-Edges (CE) framework, wherein small groups of Internet of Things (IoT) devices are serviced by local edge devices, enables a more scalable solution to IoT networks. The trustworthiness of the network may be ensured with Trusted Platform Modules (TPMs). This small hardware chip is capable of measuring and reporting a representation of the state of an IoT device. When connecting to a network, the IoT platform might have its state signed by the TPM in an anonymous way to prove both its genuineness and secure state through the Direct Anonymous Attestation (DAA) protocol. Currently standardised DAA schemes have their security supported on the factoring and discrete logarithm problems. Should a quantum-computer become available in the next few decades, these schemes will be broken. There is therefore a need to start developing a post-quantum DAA protocol. This paper presents a Lattice-based DAA (LDAA) scheme to meet this requirement. The security of this scheme is proved in the Universally Composable (UC) security model under the hardness assumptions of the Ring Inhomogeneous Short Integer Solution (Ring-ISIS) and Ring Learning With Errors (Ring-LWE) problems. Compared to the only other post-quantum DAA scheme available in related art, the storage requirements of the TPM are reduced twofold and the signature sizes 5 times. Moreover, experimental results show that the signing and verification operations are accelerated 1.1 and 2.0 times, respectively.

The Role of Non-Positional Arithmetic on Efficient Emerging Cryptographic Algorithms

“…This allows for one party to provide their data to another party, while preserving its confidentiality. This property is exploited in [46] to reduce the computational complexity of the DAA. In particular, the additive homomorphism of a commitment scheme is exploited to generate a single proof of knowledge about a secret-key shared between a Trusted Platform Module (TPM) [47] and a Host, instead of two as in traditional schemes [18].…”

“…This leads to a twofold reduction of the storage requirements of the TPM, and to a reduction of the signature size of about five times. In this section, we introduce the DAA in the context of TPM and describe the arithmetic aspects of the scheme proposed in [46].…”

“…The DAA signature includes a zero-knowledge proof-ofknowledge, which is a cryptographic construct used to convince the verifier that the signer possesses a valid membership credential, but without the verifier learning anything else about the identity of the signer. Herein, we describe at a high-level how this proof-of-knowledge may was designed in [46], focusing on how representations through homomorphisms may be leveraged to improve the efficiency of DAA.…”

“…Notice that y 1 + y 2 = y, and that t is used to randomise the signatures. In [46], in contrast, Baum et al' commitment scheme is exploited since it features additive homomorphism. Based on this property, the TPM and the Host produce commitments that, when homomorphically added, result in commitments similar to the ones of (33), but with x 1 + x 2 playing the role of x in (31).…”

“…The TPM and Host may then reveal their replies to the verifier's challenges without anyone learning anything about their secret-key. As a result, a single proof-of-knowledge is required in [46], instead of two as in [18]. As a second optimisation, the commitments are themselves hashed after having been added, resulting in a further reduction in the signature size.…”