177 research outputs found
P-signatures and Noninteractive Anonymous Credentials
Get PDFsponsorship: Melissa Chase and Anna Lysyanskaya are supported by NSF grants CNS-0374661 CNS-0627553. Markulf Kohlweiss is supported by the EuropeanCommissions IST Program under Contracts IST-2002-507591PRIME and IST-2002-507932 ECRYPT. (NSF|CNS-0374661, NSF|CNS-0627553, EuropeanCommission's IST Program|IST-2002-507591PRIME, EuropeanCommission's IST Program|IST-2002-507932 ECRYPT)status: Publishe
On the non-malleability of the fiat-shamir transform
Get PDFThe Fiat-Shamir transform is a well studied paradigm for removing interaction from public-coin protocols. We investigate whether the resulting non-interactive zero-knowledge (NIZK) proof systems also exhibit non-malleability properties that have up to now only been studied for NIZK proof systems in the common reference string model: first, we formally define simulation soundness and a weak form of simulation extraction in the random oracle model (ROM). Second, we show that in the ROM the Fiat-Shamir transform meets these properties under lenient conditions. A consequence of our result is that, in the ROM, we obtain truly efficient non malleable NIZK proof systems essentially for free. Our definitions are sufficient for instantiating the Naor-Yung paradigm for CCA2-secure encryption, as well as a generic construction for signature schemes from hard relations and simulation-extractable NIZK proof systems. These two constructions are interesting as the former preserves both the leakage resilience and key-dependent message security of the underlying CPA-secure encryption scheme, while the latter lifts the leakage resilience of the hard relation to the leakage resilience of the resulting signature scheme
Anonymity-preserving public-key encryption: A constructive approach
Get PDFA receiver-anonymous channel allows a sender to send a message to a receiver without an adversary learning for whom the message is intended. Wireless broadcast channels naturally provide receiver anonymity, as does multi-casting one message to a receiver population containing the intended receiver. While anonymity and confidentiality appear to be orthogonal properties, making anonymous communication confidential is more involved than one might expect, since the ciphertext might reveal which public key has been used to encrypt. To address this problem, public-key cryptosystems with enhanced security properties have been proposed.We investigate constructions as well as limitations for preserving receiver anonymity when using public-key encryption (PKE). We use the constructive cryptography approach by Maurer and Renner and interpret cryptographic schemes as constructions of a certain ideal resource (e.g. a confidential anonymous channel) from given real resources (e.g. a broadcast channel). We define appropriate anonymous communication resources and show that a very natural resource can be constructed by using a PKE scheme which fulfills three properties that appear in cryptographic literature (IND-CCA, key-privacy, weak robustness). We also show that a desirable stronger variant, preventing the adversary from selective ”trial-deliveries” of messages, is unfortunately unachievable by any PKE scheme, no matter how strong. The constructive approach makes the guarantees achieved by applying a cryptographic scheme explicit in the constructed (ideal) resource; this specifies the exact requirements for the applicability of a cryptographic scheme in a given context. It also allows to decide which of the existing security properties of such a cryptographic scheme are adequate for the considered scenario, and which are too weak or too strong. Here, we show that weak robustness is necessary but that so-called strong robustness is unnecessarily strong in that it does not construct a (natural) stronger resource
(De-)constructing TLS 1.3
Get PDFSSL/TLS is one of the most widely deployed cryptographic protocols on the Internet. It is used to protect the confidentiality and integrity of transmitted data in various client-server applications. The currently specified version is TLS 1.2, and its security has been analyzed extensively in the cryptographic literature. The IETF working group is actively developing a new version, TLS 1.3, which is designed to address several flaws inherent to previous versions.
In this paper, we analyze the security of a slightly modified version of the current TLS 1.3 draft. (We do not encrypt the server’s certificate.) Our security analysis is performed in the constructive cryptography framework. This ensures that the resulting security guarantees are composable and can readily be used in subsequent protocol steps, such as password-based user authentication over a TLS-based communication channel in which only the server is authenticated. Most steps of our proof hold in the standard model, with the sole exception that the key derivation function HKDF is used in a way that has a proof only in the random-oracle model. Beyond the technical results on TLS 1.3, this work also exemplifies a novel approach towards proving the security of complex protocols by a modular, step-by-step decomposition, in which smaller sub-steps are proved in isolation and then the security of the protocol follows by the composition theorem
Foundations of decentralised privacy
Get PDFDistributed ledgers, and specifically blockchains, have been an immensely popular investment in the past few years. The heart of their popularity is due to
their novel approach toward financial assets: They replace the need for central,
trusted institutions such as banks with cryptography, ensuring no one entity has
authority over the system. In the light of record distrust in many established
institutions, this is attractive both as a method to combat institutional control
and to demonstrate transparency. What better way to manage distrust than to
embrace it? While distributed ledgers have achieved great things in removing
the need to trust institutions, most notably the creation of fully decentralised
assets, their practice falls short of the idealistic goals often seen in the field.
One of their greatest shortcomings lies in a fundamental conflict with privacy. Distributed ledgers and surrounding technologies rely heavily on the
transparent replication of data, a practice which makes keeping anything hidden very difficult. This thesis makes use of the powerful cryptography of succinct non-interactive zero-knowledge proofs to provide a foundation for re-establishing privacy in the decentralised setting. It discusses the security assumptions and requirements of succinct zero-knowledge proofs atlength, establishing a new framework for handling security proofs about them, and reducing
the setup required to that already present in commonly used distributed ledgers.
It further demonstrates the possibility of privacy-preserving proof-of-stake,
removing the need for costly proofs-of-work for a privacy-focused distributed
ledger. Finally, it lays out a solid foundation for a smart contract system supporting privacy – putting into the hands of contract authors the tools necessary
to innovate and introduce new privacy features
Trusted execution for private and secure computation: a composable approach
Get PDFTrusted Execution Environments (TEEs) protect and
isolate programs, sometimes referred to as enclaves, from all other
software executed on the same processor, through a combination of
specialised hardware, microarchitectural design, and cryptography. They are used both
to underpin the security of computing infrastructure that processes sensitive
data, and as a component in the design of efficient privacy-preserving
protocols. The adoption of this technology is driven by a desire to shift
trust from the operator of computing equipment to its manufacturer. A core
feature of the architecture is remote attestation, allowing a remote party to
verify that a TEE is running a certain program. While initial industrial
deployments often used this to prevent sensitive data from leaking to untrusted
clients, e.g. for media content protection, there is a growing interest in
using TEEs to ensure that programs deployed on a cloud server will not run
any unauthorised or outright mailcious computation on sensitive data provided by users.
TEEs are still a relatively novel technology, with security implications that are still not fully understood, and whose
implementation has been shown to be vulnerable to many attacks.
It is paramount to carefully analyse the guarantees offered by TEEs when used as a
primitive in the construction of application protocols, and how multiple protocols
relying on TEEs might interact with each other when composed. We approach this task using
the tools of the cryptographic literature. In particular, we use the
\emph{universal composability (UC)} framework to examine a high-level
formalisation of TEEs that supports composition without delving into the specific of implementation or different architectural choices.
To demonstrate the scope of the task, we follow the construction of a
cryptographic protocol through several stages. We first extend and reformalise
IRON (Fisch et al, CCS17), a protocol that provides secure computation in a
cloud setting by implementing the functional encryption primitive. Our
extension, called Steel, broadens the class of allowable functions a cloud
server can compute, and we prove the security of our protocol in UC, by
using the formalisation of TEEs provided by Pass et al (EUROCRYPT17).
We then question the cryptographic assumption of this formalism, showing that it
doesn't adequately capture existing attacks which would make Steel insecure,
such as state continuity attacks. We
address this vulnerability by providing a modular trusted execution
abstraction that can adequately capture TEE implementations
with different functional and adversarial guarantees, and provides a more
flexible attestation mechanism. Our new formalism aims to capture existing work
in the literature and rescue previous proofs into a more realistic setting,
closer to real-world implementations.
Finally, we show how the Steel protocol can be used as a composable building block to provide a privacy preserving
contact tracing service that bridges the privacy properties of decentralised
contact tracing with the ability to conduct data analytics enabled by
centralised contact tracing. We construct and prove the protocol in a modular
manner, showcasing the power of universal composability
Randomizable Proofs and Delegatable Anonymous Credentials
Get PDFsponsorship: Jan Camenisch was supported in part by the European Commission through the ICT and IST programmes under contract ICT-216483 PRIMELIFE. Markulf Kohlweiss was supported in part by the Concerted Research Action (GOA) Ambiorics 2005/11 of the Flemish Government, by the IAP Programme P6/26 BCRYPT of the Belgian State (Belgian Science Policy), and in part by the European Commission through the ICT and IST programmes under the following contracts: ICT-216483 PRIMELIFE and ICT-216676 ECRYPT II. Hovav Shacham was supported by an AFOSR MURI grant and, while at the Weizmann Institute of Science, by a Koshland Scholars Program postdoctoral fellowship. Mira Belenkiy, Melissa Chase and Anna Lysyanskaya acknowledge the support of NSF grants 0831293, 0627553 and 0347661. The information in this document reflects only the authors' views. (European Commission through the ICT and IST programme|ICT-216483, Concerted Research Action (GOA) Ambiorics of the Flemish Government, IAP Programme of the Belgian State (Belgian Science Policy)|P6/26 BCRYPT, European Commission through the ICT and IST programmes|ICT-216483, European Commission through the ICT and IST programmes|ICT-216676, AFOSR MURI grant, Weizmann Institute of Science, Koshland Scholars Program postdoctoral fellowship, NSF|0831293, NSF|0627553, NSF|0347661, Direct For Computer & Info Scie & Enginr; Division Of Computer and Network Systems|0627553, Direct For Computer & Info Scie & Enginr; Division Of Computer and Network Systems|0347661, Direct For Computer & Info Scie & Enginr; Division Of Computer and Network Systems|0831293)status: Publishe
Privacy in digital and decentralized identity and asset transfers
Get PDFDecentralized systems, exemplified by blockchain technology, have redefined trust and transparency by replacing centralized state management with a decentralized paradigm. This shift eliminates single points of trust and failure, and establishes a transparent, immutable ledger. However, the inherent design of most blockchains, which supports permissionless read access, exposes stored data to public scrutiny, thereby undermining privacy. Consequently, preserving data confidentiality is a core challenge in these systems. The pursuit of privacy frequently conflicts with regulatory compliance, as the latter demands data accessibility that privacy-preserving mechanisms may intentionally conceal. Achieving a balance between these opposing requirements is essential for the broad adoption of decentralized systems. Cryptographic techniques, such as zero-knowledge proofs, enable the verification of statements without disclosing extraneous details, yet their computational overhead often degrades system efficiency and hence usability. Thus, addressing the interplay of privacy, compliance, and efficiency remains critical to realizing the full potential of blockchain-based ecosystems.
This thesis, first, proposes a novel cryptographic primitive tailored for privacy-preserving, and regulatory-compliant decentralized identities. In digital asset transfers, regulatory frameworks require the association of blockchain transactions with real-world identities. Without such linkage, certain enforcements become impractical. The introduced primitive facilitates the generation of unlinkable pseudonyms that are cryptographically bound to verified real-world identities, ensuring Sybil resilience, anonymity, and efficiency. Leveraging this identity framework, the thesis develops three innovative constructions for digital asset transfers that harmonize privacy, compliance, and efficiency. These constructions support crucial applications including Central Bank Digital Currencies (CBDCs), stablecoins, and Real-World Asset (RWA) tokenization. We formalize critical requirements and realize them using standard cryptographic assumptions. Key features include self-custody, interoperability, blockchain-agnosticism, proofs of balance, receiver affirmation, asset-specific auditing, anonymity, Sybil resilience, unlinkability, multi-party transactions, blockchain-independent fees, tracing, privacy revocation, and additional considerations.
These contributions establish a strong foundation for decentralized infrastructures, advancing privacy, compliance, and efficiency in blockchain technology
- …
