Revocable Group Signature Schemes with Constant Costs for Signing and Verifying

Nakanishi, Toru; Fujii, Hiroyuki; Hira, Yuta; Funabiki, Nobuo

doi:10.1587/transfun.e93.a.50

Cited by 34 publications

(55 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Theorem 19. If G-SIG is an anonymous revokable group signature scheme [21] and if for any prover P values idpub(P ) and idprv(P ) are either set to null or the group identity, then TREAD AN O is prover-anonymous and…”

Section: Dbcorrupt(·)mentioning

confidence: 99%

A Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding Protocol

Avoine

Bultel

Gambs

et al. 2017

Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

International audienceDistance-bounding protocols have been introduced to thwart relay attacks against contactless authentication protocols. In this context, veri-fiers have to authenticate the credentials of untrusted provers. Unfortunately , these protocols are themselves subject to complex threats such as terrorist-fraud attacks, in which a malicious prover helps an accomplice to authenticate. Provably guaranteeing the resistance of distance-bounding protocols to these attacks is a complex task. The classical countermeasures usually assume that rational provers want to protect their long-term authentication credentials, even with respect to their accomplices. Thus, terrorist-fraud resistant protocols generally rely on artificial extraction mechanisms, ensuring that an accomplice can retrieve the credential of his partnering prover. In this paper, we propose a novel approach to obtain provable terrorist-fraud resistant protocols without assuming that provers have any long-term secret key. Instead, the attacker simply has to replay the information that he has received from his accomplice. Based on this, we present a generic construction for provably secure distance-bounding protocols, and give three instances: (1) an efficient symmetric-key protocol, (2) a public-key protocol protecting the identities of the provers against external eavesdroppers, and finally (3) a fully anonymous protocol protecting the identities of the provers even against malicious verifiers trying to profile them

show abstract

Section: Dbcorrupt(·)mentioning

confidence: 99%

A Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding Protocol

Avoine

Bultel

Gambs

et al. 2017

Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…3) Though signing/verification costs are constant, the size of gpk is O( √ N ) [22] or the size of RL is O(N ) [23]. 4) All costs are asymptotically quite efficient (less than O(log N )), but the real costs are inefficient [24], [19], [25].…”

Section: ) Though the Verification Cost Is O(r) The Signing Costmentioning

confidence: 99%

Secure and Anonymous Communication Technique: Formal Model and Its Prototype Implementation

Emura

Kanaoka

Ohta

et al. 2016

IEEE Trans. Emerg. Topics Comput.

View full text Add to dashboard Cite

Both anonymity and end-to-end encryption are recognized as important properties in privacy-preserving communication. However, secure and anonymous communication protocol that requires both anonymity and end-to-end encryption cannot be realized through a simple combination of current anonymous communication protocols and public key infrastructure (PKI). Indeed, the current PKI contradicts anonymity because the certificate for a user's public key identifies the user. Moreover, we believe that anonymous communication channels should have certain authentication mechanisms because such a channel could incubate criminal communication. To cope with this issue, we propose a secure and anonymous communication protocol by employing identity-based encryption for encrypting packets without sacrificing anonymity, and group signature for anonymous user authentication. Communication occurs in the protocol through proxy entities that conceal user IP addresses from service providers (SPs). We also introduce a proof-ofconcept implementation to demonstrate the protocol's feasibility and analyze its performance. Finally, we conclude that the protocol realizes secure and anonymous communications between users and SPs with practical performance.

show abstract

“…(4) Full dynamic model (Naor et al 2001;Peikert and Rosen 2007;Camenisch and Groth 2004;Nakanishi et al 2009;Libert et al 2012a, b), which allows both the dynamic registration of users and the dynamic revocation of group members, which makes the algorithm has stronger security and higher practicability.…”

Section: Introductionmentioning

confidence: 99%

An efficient full dynamic group signature scheme over ring

Sun

Liu

2019

Cybersecur

View full text Add to dashboard Cite

The group signature scheme is an important primitive in cryptography, it allows members in a group to generate signatures anonymously on behalf of the whole group. In view of the practical application of such schemes, it is necessary to allow users' registration and revocation when necessary, which makes the construction of dynamic group signature schemes become a significant direction. On the basis of (Ling et al., Lattice-based group signatures: achieving full dynamicity with ease, 2017), we present the first full dynamic group signature scheme over ring, and under the premise of ensuring security, the efficiency of the scheme is improved mainly from the following three aspects: the size of keys, the dynamic construction of a Merkle hash tree that used to record the information of registered users, and the reuse of the leaves in this tree. In addition, the public and secret keys of both group manager and trace manager are generated by a trusted third party, which prevents the situation that the two managers generate their respective public key and secret key maliciously. Compared with the counterpart of the scheme in (Ling et al., Lattice-based group signatures: achieving full dynamicity with ease, 2017) over ring, the expected space complexity of the Merkle tree used in our work down almost by half, and the computational complexity of its update has been reduced by a notch because of the dynamic construction of the hash tree.

show abstract

Revocable Group Signature Schemes with Constant Costs for Signing and Verifying

Cited by 34 publications

References 24 publications

A Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding Protocol

A Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding Protocol

Secure and Anonymous Communication Technique: Formal Model and Its Prototype Implementation

An efficient full dynamic group signature scheme over ring

Contact Info

Product

Resources

About