Optimistic Fair Exchange in a Multi-user Setting

Dodis, Yevgeniy; Lee, Pil Joong; Yum, Dae Hyun

doi:10.1007/978-3-540-71677-8_9

Cited by 64 publications

(117 citation statements)

References 30 publications

Supporting

Mentioning

117

Contrasting

Order By: Relevance

“…[3, 10, 11, 15-22, 28, 29]. In [10], Dodis et al showed a gap between the security of OFE in single-user setting (where there are one signer and one verifier) and that in multi-user setting (where there are multiple signers and verifiers). Using random oracle heuristic, they proposed a OFE secure in the multi-user setting and registered-key model [5].…”

Section: Related Workmentioning

confidence: 99%

“…The partial signature in traditional OFE [3,10,20] is publicly verifiable, and everyone is able to tell from it the fact that the signer signed the message. In the enhanced variant AOFE [15,16,18,19], although the partial signature is ambiguous, however, anyone is still able to confirm that the given partial signature was generated by either the signer or the verifier.…”

Section: Ambiguity Of σ Ambiguity Of σ Variants Before Resolution Aftmentioning

confidence: 99%

See 1 more Smart Citation

P2OFE: Privacy-Preserving Optimistic Fair Exchange of Digital Signatures

Huang

Wong

Susilo

2014

Topics in Cryptology – CT-RSA 2014

View full text Add to dashboard Cite

How to sign an electronic contract online between two parties (say Alice and Bob) in a fair manner is an interesting problem, and has been studied for a long time. Optimistic Fair Exchange (OFE) is an efficient solution to this problem, in which a semi-trusted third party named arbitrator is called in to resolve a dispute if there is one during an exchange between Alice and Bob. Recently, several extensions of OFE, such as Ambiguous OFE (AOFE) and Perfect AOFE (PAOFE), have been proposed to protect the privacy of the exchanging parties. These variants prevent any outsider including the arbitrator from telling which parties are involved in the exchange of signatures before the exchange completes. However, in PAOFE, AOFE, and all the current work on OFE, the arbitrator can always learn the signer's signature at (or before) the end of a resolution, which is undesirable in some important applications, for example, signing a contract between two parties which do not wish others to find out even when there is a dispute that needs a resolution by the arbitrator. In this work, we introduce a new notion called Privacy-Preserving Optimistic Fair Exchange (P2OFE), in which other than Alice and Bob, no one else, including the arbitrator, can collect any evidence about an exchange between them even after the resolution of a dispute. We formally define P2OFE and propose a security model. We also propose a concrete and efficient construction of P2OFE, and prove its security based on the Strong Diffie-Helllman and Decision Linear assumptions in the standard model. Abstract. How to sign an electronic contract online between two parties (say Alice and Bob) in a fair manner is an interesting problem, and has been studied for a long time. Optimistic Fair Exchange (OFE) is an efficient solution to this problem, in which a semi-trusted third party named arbitrator is called in to resolve a dispute if there is one during an exchange between Alice and Bob. Recently, several extensions of OFE, such as Ambiguous OFE (AOFE) and Perfect AOFE (PAOFE), have been proposed to protect the privacy of the exchanging parties. These variants prevent any outsider including the arbitrator from telling which parties are involved in the exchange of signatures before the exchange completes. However, in PAOFE, AOFE, and all the current work on OFE, the arbitrator can always learn the signer's signature at (or before) the end of a resolution, which is undesirable in some important applications, for example, signing a contract between two parties which do not wish others to find out even when there is a dispute that needs a resolution by the arbitrator. In this work, we introduce a new notion called PrivacyPreserving Optimistic Fair Exchange (P 2 OFE), in which other than Alice and Bob, no one else, including the arbitrator, can collect any evidence about an exchange between them even after the resolution of a dispute. We formally define P 2 OFE and propose a security model. We also propose a concrete and efficient construction of P 2 OFE, and prov...

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Ambiguity Of σ Ambiguity Of σ Variants Before Resolution Aftmentioning

confidence: 99%

P2OFE: Privacy-Preserving Optimistic Fair Exchange of Digital Signatures

Huang

Wong

Susilo

2014

Topics in Cryptology – CT-RSA 2014

View full text Add to dashboard Cite

show abstract

“…On the other hand, contrary to the common belief that concurrent signature is applicable to tendering systems (such as [6,17,18]), level 1 advantage to a malicious initial signer could be unacceptable to some of the suppliers. Hence, in those scenarios, the OFE [2][3][4]7] or Ambiguous OFE [10][11][12] systems are indeed more suitable compared to concurrent signatures.…”

Section: Fairness In Practicementioning

confidence: 99%

Fairness in Concurrent Signatures Revisited

Susilo

Wang

et al. 2013

Information Security and Privacy

View full text Add to dashboard Cite

Concurrent signature, introduced by Chen, Kudla and Paterson, is known to just fall short to solve the long standing fair exchange of signature problem without requiring any trusted third party (TTP). The price for not requiring any TTP is that the initial signer is always having some advantage over the matching signer in controlling whether the protocol completes or not, and hence, whether the two ambiguous signatures will bind concurrently to their true signers or not. In this paper, we examine the notion and classify the advantages of the initial signer into three levels, some of which but not all of them may be known in the literature. -Advantage level 0 is the commonly acknowledged fact that concurrent signature is not abuse-free since an initial signer who holds a keystone can always choose to complete or abort a concurrent signature protocol run by deciding whether to release the keystone or not. -Advantage level 1 refers to the fact that the initial signer can convince a third party that both ambiguous signatures are valid without actually making the signatures publicly verifiable. -Advantage level 2 allows the initial signer to convince a third party that the matching signer agrees to commit to a specific message, and nothing else.We stress that advantage level 2 is not about proving the possession of a keystone. Proving the knowledge of a keystone would make the malicious initial signer accountable as this could only be done by the initial signer. We remark that the original security models for concurrent signature do not rule out the aforementioned advantages of the initial signer. Indeed, we show that theoretically, the initial signer always enjoys the above advantages for any concurrent signatures. Our work demonstrates a clear gap between the notion of concurrent signature and optimistic fair exchange (OFE) Abstract. Concurrent signature, introduced by Chen, Kudla and Paterson, is known to just fall short to solve the long standing fair exchange of signature problem without requiring any trusted third party (TTP). The price for not requiring any TTP is that the initial signer is always having some advantage over the matching signer in controlling whether the protocol completes or not, and hence, whether the two ambiguous signatures will bind concurrently to their true signers or not. In this paper, we examine the notion and classify the advantages of the initial signer into three levels, some of which but not all of them may be known in the literature.-Advantage level 0 is the commonly acknowledged fact that concurrent signature is not abuse-free since an initial signer who holds a keystone can always choose to complete or abort a concurrent signature protocol run by deciding whether to release the keystone or not. -Advantage level 1 refers to the fact that the initial signer can convince a third party that both ambiguous signatures are valid without actually making the signatures publicly verifiable. -Advantage level 2 allows the initial signer to convince a third party that the matching...

show abstract

“…Brakerski and Segev [19] define MU security of D-PKE in the auxiliary input setting and give a scheme that achieves it for messages that are block sources, but they do not show a separation between the SU and MU settings. Dodis, Lee and Yum [24] give another example of a setting where SU security does not imply MU security, namely optimistic fair exchange.…”

Section: Introductionmentioning

confidence: 99%

How Secure is Deterministic Encryption?

Bellare

Dowsley

Keelveedhi

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper presents three curious findings about deterministic public-key encryption (D-PKE) that further our understanding of its security, in particular because of the contrast with standard, randomized public-key encryption (R-PKE):• It would appear to be a triviality, for any primitive, that security in the standard model implies security in the random-oracle model, and it is certainly true, and easily proven, for R-PKE. For D-PKE it is not clear and depends on details of the definition. In particular we can show it in the non-uniform case but not in the uniform case.• The power of selective-opening attacks (SOA) comes from an adversary's ability, upon corrupting a sender, to learn not just the message but also the coins used for encryption. For R-PKE, security is achievable. For D-PKE, where there are no coins, one's first impression may be that SOAs are vacuous and security should be easily achievable. We show instead that SOA-security is impossible, meaning no D-PKE scheme can achieve it.• For R-PKE, single-user security implies multi-user security, but we show that there are D-PKE schemes secure for a single user and insecure with two users.

show abstract

Optimistic Fair Exchange in a Multi-user Setting

Cited by 64 publications

References 30 publications

P2OFE: Privacy-Preserving Optimistic Fair Exchange of Digital Signatures

P2OFE: Privacy-Preserving Optimistic Fair Exchange of Digital Signatures

Fairness in Concurrent Signatures Revisited

How Secure is Deterministic Encryption?

Contact Info

Product

Resources

About