Practical Verifiable Encryption and Decryption of Discrete Logarithms

Abstract

Abstract. This paper addresses the problem of designing practical protocols for proving properties about encrypted data. To this end, it presents a variant of the new public key encryption of Cramer and Shoup based on Paillier's decision composite residuosity assumption, along with efficient protocols for verifiable encryption and decryption of discrete logarithms (and more generally, of representations with respect to multiple bases). This is the first verifiable encryption system that provides chosen ciphertext security and avoids inefficient cut-and-choose proofs. The presented protocols have numerous applications, including key escrow, optimistic fair exchange, publicly verifiable secret and signature sharing, universally composable commitments, group signatures, and confirmer signatures.

Designated Confirmer Signatures Revisited

“…We then describe an instantiation of the generic construction that is secure under the strong RSA-assumption, the decision composite residuosity assumption, and the decision Diffie-Hellman assumption. In contrast to the scheme briefly sketched by Camenisch and Shoup [3] our scheme does not rely on the random oracle model, and it satisfies stronger security requirements than the schemes proposed in [16] and [13]. Furthermore, the setting we consider is stricter in that we do not assume the existence of a trusted key generator as is done in [3].…”

“…They also proposed both a scheme based on general primitives and more practically oriented schemes, and sketched a security proof for the general construction. In their work on verifiable encryption of discrete logarithms Camenisch and Shoup [3] give a very brief sketch of a DC-signature scheme where most interactive protocols use Schnorr-style techniques.…”

“…The cryptosystem we use is based on Cramer and Shoup's [8] CCA2-secure version of the Paillier [20] as described in [3], i.e., it is a cryptosystem with labels. This cryptosystem is special in that plaintexts "live in the exponent", which simplifies the construction of Schnorr-like proofs about the plaintext.…”

“…There are various protocols in the literature [12,1,9,3] for proving equality of integer exponents over groups of unknown order based on variations of FujisakiOkamoto commitments, under the strong RSA-assumption. These protocols are strictly speaking not proofs of knowledge, since extraction may fail with negligible probability over the choice of commitment parameters, but they can be used as proofs of knowledge provided that there are trusted commitment parameters present during the execution of the protocols.…”

Improving Cut-and-Choose in Verifiable Encryption and Fair Exchange Protocols Using Trusted Computing Technology

“…We now briefly compare the costs of our protocol to two verifiable encryption protocols: that of Camenisch and Damgard [7] (the "CD" protocol), and Camenisch and Shoup [9] (the "CS" protocol), in Table 1. Note that the CS protocol is described only for verifiable encryption of a single secret (not verifiable group encryption); in the table, we estimate the values for k shares.…”