Spreading Alerts Quietly and the Subgroup Escape Problem

Abstract

Abstract. We introduce a new cryptographic primitive called the blind coupon mechanism (BCM). In effect, the BCM is an authenticated bit commitment scheme, which is AND-homomorphic. It has not been known how to construct such commitments before. We show that the BCM has natural and important applications. In particular, we use it to construct a mechanism for transmitting alerts undetectably in a message-passing system of n nodes. Our algorithms allow an alert to quickly propagate to all nodes without its source or existence being detected by an adversary, who controls all message traffic. Our proofs of security are based on a new subgroup escape problem, which seems hard on certain groups with bilinear pairings and on elliptic curves over the ring Zn.

A Blind Coupon Mechanism Enabling Veto Voting over Unreliable Networks

“…We are also interested in stronger security for BCMs. Previous BCM analysis [2,3,5] considers only indistinguishability and unforgeability as relevant security properties, ignoring the privacy of the agents contributing coupons. Malicious spotters may attempt to track and follow coupons and thus gain information on individual choices.…”

“…Malicious spotters may attempt to track and follow coupons and thus gain information on individual choices. The original BCM construction [2,3] even suffers from the creation of traceable coupons if key generation is dishonest. Hence, there is a clear lack of privacy notion in [2,3,5], and we therefore add the notion of untraceability to the useful security properties of BCMs.…”

“…Blind Coupon Mechanism. Aspnes et al [2,3] introduce BCM as an AND-homomorphic authenticated bit commitment scheme. The authors construct their scheme based on an abstract group structure (U, G, D) such that U is a finite set, G ⊆ U is a cyclic group and D is a proper subgroup of G. The elements in D are dummy coupons and the elements in G \ D are signal coupons.…”

“…A Blind Coupon Mechanism (BCM) [2,3,5] is a cryptographic primitive allowing confidential signals to be combined in a specific way. A BCM enables a network to distribute a covert signal while ensuring that forging signals is difficult.…”

“…The BCM notion was first introduced by Aspnes et al [2,3] and recently improved by Blazy and Chevalier [5]. A BCM includes a verification algorithm that checks whether a coupon is valid, and a combining algorithm that takes as inputs two valid coupons and outputs a coupon.…”