Non-interactive Keyed-Verification Anonymous Credentials

Abstract

Anonymous credential (AC) schemes are protocols which allow for authentication of authorized users without compromising their privacy. Of particular interest are noninteractive anonymous credential (NIAC) schemes, where the authentication process only requires the user to send a single message that still conceals its identity. Unfortunately, all known NIAC schemes in the standard model require pairing based cryptography, which limits them to a restricted set of specific assumptions and requires expensive pairing computations. The notion of keyed-verification anonymous credential (KVAC) was introduced in (Chase et al., CCS'14) as an alternative to standard anonymous credential schemes allowing for more efficient instantiations; yet, making existing KVAC non-interactive either requires pairing-based cryptography, or the Fiat-Shamir heuristic. In this work, we construct the first non-interactive keyed-verification anonymous credential (NIKVAC) system in the standard model, without pairings. Our scheme is efficient, attribute-based, supports multi-show unlinkability, and anonymity revocation. We achieve this by building upon a combination of algebraic MAC with the recent designated-verifier non-interactive zero-knowledge (DVNIZK) proof of knowledge of (Couteau and Chaidos, Eurocrypt'18). Toward our goal of building NIKVAC, we revisit the security analysis of a MAC scheme introduced in (Chase et al., CCS'14), strengthening its guarantees, and we introduce the notion of oblivious non-interactive zero-knowledge proof system, where the prover can generate non-interactive proofs for statements that he cannot check by himself, having only a part of the corresponding witness, and where the proof can be checked efficiently given the missing part of the witness. We provide an efficient construction of an oblivious DVNIZK, building upon the specific properties of the DVNIZK proof system of (Couteau and Chaidos, Eurocrypt'18).

Sharp

“…Anonymous credentials and their constructions come in many flavours [4,24,41], and not all rely on prime order groups alone. Some use pairing groups and some use hidden order groups.…”

Fast Keyed-Verification Anonymous Credentials on Standard Smart Cards

“…Barki et al [3] propose a new KVAC scheme which is currently the most efficient: Proving posession of a credential with u hidden attributes costs u + 12 exponentiations. Couteau and Reichle [25] construct a KVAC scheme with presentation cost 2u + 3 exponentiations in a 2048-bit group, which is less efficient, but works in the standard model. Some of the new constructions were already implemented on the PC platform with promising results [29,35].…”

“…RSA Unlink. MAC Security U-Prove [33] u + 1 0 -Idemix [22] 0 u + 3 sRSA [36] Ringers et al [35] n + u + 9 0 whLRSW [40] MAC DDH [23] 6u + 12 0 DDH [8] MAC GGM [23] 5u + 4 0 GGM [37] MAC BB [4] u + 12 0 q-sDH [9] NIKVAC [25] 2u + 3 0 GGM+IND-CPA This work u + 2 0 n-SCDHI [12] 5 Implementation Results…”