Accumulators andU-Prove Revocation
Tolga Acar, IntelSherman S.M. Chow, The Chinese University of Hong KongLan Nguyen, XCG – Microsoft Research
OutlineAccumulators Definitions and Security Anonymous Revocation New schemeU-Prove Overview Revocation methods Revocation with the new accumulatorImplementation and Performance
Accumulator Primitives•Accumulate: Aggregate a set of elements into a single value V.
•Non-Membership (NM) Proof: Prove that an element x is NOT accumulated in V without revealing any info about x.
•Membership Proof: Prove that an element x is accumulated in V without revealing any info about x.
•Efficient Update of V and Proofs’ Witnesses when the accumulated set changes.
Accumulator Security• Member Completeness: x is accumulated ⇒
Member proof accepts.• Member Soundness: x is not accumulated ⇒
Member proof rejects.• NM Completeness: x is not accumulated ⇒
NM proof accepts.• NM Soundness: x is accumulated ⇒ NM
proof rejects.• Information hiding: The proofs should be
Zero-Knowledge or Witness Indistinguishable.
Revoking Anonymous Credentials
For Blacklisting Anonymous Credentials,• Accumulate blacklisted elements in an accumulator
value.• NM Proof proves that an element is not accumulated ⇒ The element is not blacklisted.• NM Proof does not reveal the element⇒ Privacy Protection.
For Whitelisting Anonymous Credentials, it is similar in the opposite way.
Accumulator Scheme – Setup Bilinear pairing e: where and are cyclic multiplicative groups, all of order prime q.
Setup Private Key: Public Key: where
Optionally,
Accumulator Operations•Items to accumulate is a set •Accumulator value •Non-Membership Witness is with
Compute from t
•A new witness for x is computed or updated when a new x‘ is accumulated or an accumulated x’ is removed from the set S
•Similar for Membership Witness
Efficient Accumulator NM ProofComputations are moved from and to efficient • Prove is PoK : • Instead of To reduce pairing• Add to witness• Hide by and , so • PoK :Efficiency gains• Prover needs no pairing• Verifier needs 2 pairings to verify Similar for the Mem Proof.
OutlineAccumulators Definitions and Security Anonymous Revocation New schemeU-Prove Overview Revocation methods Revocation with the new accumulatorImplementation and Performance
U-ProveParticipants: Issuer, User (Prover), Service Provider (Verifier).Issuing Protocol between Issuer and User• User obtains Tokens from Issuer• Token certifies attributes (Driver License, Age >
21,…)Presentation Protocol between User and Service Provider• Users proves certain attributes to Service
Provider• Service Provider learns nothing about other
attributes
U-Prove CryptoIssuing• Each token is a blind signature on a commitment of
attributes • Re-Committing to is like a sealed envelop • Blind Signing is like carbon paper• Extracting from is like opening envelopPresenting• Showing disclose attributes• PoK of committed attributes• Verifying the blind signatureDifferent presentations of the same token are linkable
Revocation in U-ProveFour MethodsID Exposure. It breaks privacy.
Force revoked user to reveal the ID (S/N or another attribute)Credential Update. Not efficient.
Short validity time encoded in an attributeIssuer periodically updates valid credentials for download
Credential Revocation Lists. Not efficient.List of proofs that the ID is not in blacklisted items
AccumulatorsUse an accumulator to aggregate the IDs
Pros and Cons of using Accumulators
Advantages• Costs to generate and verify unrevoked credential
proofs do not depend on the blacklist’s size.• It works for both whitelisting (membership proofs)
and blacklisting (non-membership proofs).• Anonymous and unlinkable credentials.Disadvantages• Witness update is expensive.• More complex.
Accumulator-Based Revocation SchemeU-Prove integration is based on non-membership proofDemo Scenario
• Both User A and User P are issued U-Prove tokens.
• User A is blacklisted, so A fails to update NM Witness
⇒ User A can not generate anonymous proofs.• User P succeeds to update its NM Witness. ⇒ User P can generate valid anonymous proofs.
U-Prove Revocation Scenario
Setup and IssuingUse a revocation attribute (rv) to the U-Prove token.Issuer• Public key: • Private key:
User• Token: • Private key: • Commitment
Revocation and PresentationBlacklist Authority• Public key private key , and revocation table
User uses the table to update ’s accumulator witness from the revocation tablePresentation• Normal U-Prove Presentation• Prove that is not accumulated (Non-Membership proof)
Timestamp
Operation Blacklist Accumulator
1 Add 2 Delete 3 Add
OutlineAccumulators Definitions and Security Anonymous Revocation New schemeU-Prove Overview Revocation methods Revocation with the new accumulatorImplementation and Performance
Software Design
Revocation API
AnonProof U-Prove Idemix
Accumulator API
Proof List
AccuFS
AccuGS Others
Application
Revocation
Method
Software Design• Abstraction: Single definition of Revocation
API (for all revoking methods), Single definition of Accumulator API (for all accumulators).
• No Redundancy: Single implementation of Revocation using Accumulators.
• Extendibility: Easy to add new Accumulators or Applications.
• Changeability: Easy to switch among Accumulators or Revocation methods.
PerformanceCompared with the only previous universal accumulator scheme ATSM
Thanks and Questions