Group Signatures are Suitable for Constrained Devices

Abstract

Abstract. In a group signature scheme, group members are able to sign messages on behalf of the group. Moreover, resulting signatures are anonymous and unlinkable for every verifier except for a given authority. In this paper, we mainly focus on one of the most secure and efficient group signature scheme, namely XSGS proposed by Delerablée and Pointcheval at Vietcrypt 2006. We show that it can efficiently be implemented in a sensor node or an RFID tag, even if it requires 13 elliptic curve point multiplications, 2 modular exponentiations and one pairing evaluation to produce a group signature. This is done by securely outsourcing part of the computation to an untrusted powerful intermediary. The result is that XSGS can be executed in the MICAz (8-bit 7.37MHz ATmega128 microprocessor) and the TelosB (16-bit 4MHz MSP430 processor) sensor nodes in less than 200 ms.

Efficient Delegation of Zero-Knowledge Proofs of Knowledge in a Pairing-Friendly Setting

“…But as already remarked, one does not require to enforce anonymity of the TPM with respect to the host, since the latter already knows which TPM is inserted (or even sees the signature which is sent outside). And as explained in [7], in DAA schemes and in server-aided version of group signatures, the host is not adversarially-controlled in the anonymity experiment, but just for the impersonation or frameability.…”

“…This increases the contrast between the important needs to embed these protocols in such lightweight devices and their practical limitations when performing many exponentiations or pairing evaluations. A common way to overcome this problem is to delegate (when possible) some computations to a more powerful, but not fully trusted, delegatee as in [5,7,3,8]. Since the latter entity cannot have access to secret values, most of the computations on the prover's side have to be performed by the constrained device, which reduces the benefits of server-aided cryptography.…”

“…As in [5,7,3], we will split the prover into a trusted device which has a limited computational power and a more powerful, but untrusted, machine. As in DAA [5] schemes, the trusted device will be called the TPM (Trusted Platform Module) and the untrusted machine will be called the host.…”

Toward Generic Method for Server-Aided Cryptography

“…When dealing with more complicated protocols, especially those dealing with anonymity, a lot of research has also been carried out. For group signature schemes [12], Maitland and Boyd [24] and then Canard et al [9] proposed variants of existing schemes where the group member is helped by some semi-trusted entity to produce a group signature. This trick is also part of the Direct Anonymous Attestation framework (see e.g.…”

“…We finally provide an algorithm which outputs the best possible secure variant, depending on the time performances of both T and I. All along the paper, we use as a running example the case of group signatures (to make a comparison with the work in [9]) but our method can also be applied to most existing cryptographic primitives.…”