Efficient Signatures on Randomizable Ciphertexts

Abstract

Randomizable encryption lets anyone randomize a ciphertext so it is distributed like a fresh encryption of the same plaintext. Signatures on randomizable ciphertexts (SoRC), introduced by Blazy et al. (PKC'11), let one adapt a signature on a ciphertext to a randomization of the latter. Since signatures can only be adapted to ciphertexts that encrypt the same message as the signed ciphertext, signatures obliviously authenticate plaintexts. SoRC have been used as a building block in e-voting, blind signatures and (delegatable) anonymous credentials. We observe that SoRC can be seen as signatures on equivalence classes (JoC'19), another primitive with many applications to anonymous authentication, and that SoRC provide better anonymity guarantees. We first strengthen the unforgeability notion for SoRC and then give a scheme that provably achieves it in the generic group model. Signatures in our scheme consist of 4 bilinear-group elements, which is considerably more efficient than prior schemes.

Practical Delegatable Anonymous Credentials From Equivalence Class Signatures

“…This should hold even if issuers and verifiers collude and ideally even when the issuer is allowed to generate its key material maliciously. Technologies related to ACs found numerous applications such as PrivacyPass [19] and related concepts [33] being integrated into the Trust Tokens API 1 as well as standardized within the Internet Engineering Task Force (IETF), or the PrivateStats proposal by Facebook. 2 A recent large scale real-world application of ACs are private groups within the popular Signal messenger [14].…”

“…Thus, no selective disclosure is supported, which however is an important feature and thus prevents many privacy-preserving applications. 𝑖𝑖) Bauer and Fuchsbauer [1] point out a drawback of the weak form of anonymity provided by their DAC constructions. That is, if Alice delegates a credential to Bob, she can identify Bob whenever he shows the credential, which results in a severe degradation of Bob's privacy.…”

“…That is, if Alice delegates a credential to Bob, she can identify Bob whenever he shows the credential, which results in a severe degradation of Bob's privacy. This lies in the nature of the way how such DACs from mercurial signatures are constructed, i.e., when Alice delegates a credential to Bob she uses her secret key to sign Bob's pseudonym under her pseudonym (the randomized public key), which becomes part of Bob's credential (see [1] for more details). Moreover, 𝑖𝑖𝑖) similar to [7], the credential size depends on the delegation chain length 𝐿, and consequently, it grows linearly with 𝐿.…”