Anonymous Identification in Ad Hoc Groups

Abstract

Abstract. We introduce Ad hoc Anonymous Identification schemes, a new multi-user cryptographic primitive that allows participants from a user population to form ad-hoc groups, and then prove membership anonymously in such groups. Our schemes are based on the notion of accumulator with one-way domain, a natural extension of cryptographic accumulators we introduce in this work. We provide a formal model for Ad hoc Anonymous Identification schemes and design secure such schemes both generically (based on any accumulator with one-way domain) and for a specific efficient implementation of such an accumulator based on the Strong RSA Assumption. A salient feature of our approach is that all the identification protocols take time independent of the size of the ad-hoc group. All our schemes and notions can be generally and efficiently amended so that they allow the recovery of the signer's identity by an authority, if the latter is desired. Using the Fiat-Shamir transform, we also obtain constant-size, signerambiguous group and ring signatures (provably secure in the Random Oracle Model). For ring signatures, this is the first such constant-size scheme, as all the previous proposals had signature size proportional to the size of the ring. For group signatures, we obtain schemes comparable in performance with state-of-the-art schemes, with the additional feature that the role of the group manager during key registration is extremely simple and essentially passive: all it does is accept the public key of the new member (and update the constant-size public key of the group).

Bivariate Polynomials Modulo Composites and Their Applications

“…Given a Pedersen commitment and a finite set of elements S, our commitment scheme leads to a simple zero-knowledge protocol for proving knowledge of an opening x of the commitment such that x ∈ S. The length of the proof is log |S|. This technique, which uses Merkle trees [29], has applications to anonymous authentication [20] and credential systems [27] and it has the potential to replace traditional RSA one-way accumulators, introduced by Benaloh and De Mare [8] and revisited by Barić and Pfitzmann [4]. Bilinear maps [34] and class groups [28] also give rise to accumulators, under different cryptographic assumptions.…”

Foundations of Fully Dynamic Group Signatures

“…Another approach, which was adopted by e.g. [CL02,TX03,DKNS04,Ngu05], uses accumulators, i.e. functions that map a set of values into a fixed-length string and permit efficient proofs of membership.…”

Adapting Lyubashevsky’s Signature Schemes to the Ring Signature Setting

“…Most of the existing ring signature schemes are based on number theory assumptions: large integer factorization [10,21], discrete logarithm problem [1,12] and bilinear pairing problems [22,26,5].…”