Partial Blindness

國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

– The Unblind algorithm takes a signature ¯σ and the previously used random string r as input and outputs an unblinded signature σ.

• Verify is a deterministic polynomial­time algorithm that takes an unblinded signature σ, message m, negotiated information inf o, and signer’s public verification key pk as input, and outputs “true” if σ is a valid signature signed by signer with the corresponding signing key sk on message m and common information inf o. Otherwise, it outputs “false”.

9.2 Security Definitions of Partially Blind Signature

Partially blind signature has to meet two security requirements in usual: unforgeability and partial blindness. We now define them as below.

9.2.1 Unforgeability

To model the unforgeability security requirement, we define Game­A played by challenger C and adversary A.

Game ­ A:

• Setup: Challenger C takes a security parameter λ and generates public parameters params. C subsequently sends λ and params to adversary A.

• Attack: Adversary A engages in the signature issuing protocol with challenger C in a concurrent and interleaving way. For each inf o, the number of adversary A executing the signature issuing protocol with ChallengerC until obtain the signature is linf o.

• Response: AdversaryA outputs a info and linf o+1signatures (m₁, σ₁),· · · , (mlinf o+1, σ_{linf o+1}).

Definition 4. A partially blind scheme is existentially unforgeable against adaptive chosen-message attacks if no adversary wins the Game-A with non-negligible probability.

9.2.2 Partial Blindness

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Game ­ B:

• Setup: Challenger C takes a security parameter λ and generates public parameters params. C subsequently sends λ and params to adversary A.

• Preparation: Adversary A selects two different messages m0, m₁ and a common information inf o. A then sends (m0, m₁, inf o) toC.

• Challenge: ChallengerC selects a random bit b, then A sign both mbwith inf o and m_1−b with inf o. After unblinding the response ofA, C sends (m0, m₁, inf o, σ_b, σ_1−b) toA.

• Response: AdversaryA outputs a guess b^′. If b^′ = b, thenA wins.

Definition 5. A partially blind scheme has partial blindness if no adversary wins the Game-B with non-negligible probability.

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 10

The Proposed Scheme 1

We proposed three partially blind signature schemes. In this Chapter we introduce a partially blind signature based on Schnorr blind signature, using random numbers as blinding factors. In Chapter 11 and Chapter 12 we proposed two partially blind signatures based on variant­ECDSA­1 and variant­ECDSA­2 respectively, using Paillier cryptosystem to blind messages.

The selection of public parameters is similar with ECDSA. Public parameters params = (E, G, q, H, H0), where H : {0, 1}^∗ × Z^∗q → Z^∗q and H₀ : {0, 1}^∗ → Z^∗q. To generate the key pair, the signer randomly selects a d∈ [2, · · · , q − 1] as the secret key that remains secret.

Subsequently, the signer publishes their public key Q = dG. To generate a signature, the signer and user interact as presented in Fig. 2. Anyone who knows the signer’s public key can verify this signature by verifying e = H(m∥info, Rx(eQ + sG + cQ) mod q), where R_xdenotes the obtained x coordinate of an elliptic curve point.

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Signer User

k ←− Z^{$ ∗}q γ, δ ←− Z^{$ ∗}q

compute K₁ = kG

K₁

K₂ = K₁+ γG + δQ = (x, y) t = x mod q

e = H(m∥info, t) e^′ = e− δ e^′

c = H₀(inf o) s^′ = (k− (e^′+ c)d)

s^′

s = s^′+ γ signature σ = (e, s) Figure 2: Our First Scheme

The valid signature σ = (e, s) can pass the verification because

e = H(m∥info, t)

= H(m∥info, Rx(k + δd + γ)G mod q)

= H(m∥info, Rx(ed + (k− ed + δd − cd + γ) + cd)G mod q)

= H(m∥info, Rx(ed + (k− e^′d− cd + γ) + cd)G mod q)

= H(m∥info, Rx(ed + (k− e^′′d) + γ + cd)G mod q)

= H(m∥info, Rx(ed + s^′+ γ + cd)G mod q)

= H(m∥info, Rx(eQ + sG + cQ) mod q)

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 11

The Proposed Scheme 2

In this Chapter, a partially blind signature scheme based on variant­ECDSA­1 that we mentioned in Chapter 7, is proposed.

The selection of public parameters in this scheme is the same as that in ECDSA (i.e., params = (E, G, q, H), where H : {0, 1}^∗ → Z^∗q. To generate the key pair, the signer randomly selects a d ∈ [2, · · · , q −1] as the secret key that remains secret. Then, the signer publishes their public key Q = dG. To generate a signature, the signer and user interact as presented in Fig. 3.

In particular, we adopt the modified Paillier encryption (KeyGen, Enc, Dec) of Yi et al. [14].

More preciously, user needs to generate a modified Paillier encryption key pair ((N, g), (p, k)) by using the KeyGen algorithm and then to generate ciphertexts C₁ = Enc(H(m)) = g^H(m)r₁^N (mod N²) and C₂ = Enc(t) = g^tr^N₂ (mod N²), where r₁, r₂ ←− Z^{$ ∗}_N².

Moreover, we adopt a zero­knowledge proof into our protocol [48]. We define a relation R by

R ={(x, w)|x = (g, N, C), C = g^wr^N mod N²}

The user must provide corresponding zero­knowledge proofs to convince the signer that he/ she knows the witness w that satisfy the relation above for C₁ and C₂. This relation essentially means that both C₁ and C₂ comply with the modified Paillier encryption with the form g^mr^N (mod N²) where m is the plaintext. We now described the process of interactive zero­knowledge proof. To prove that C₁ is a correct form, the user first randomly selects x ∈ Zq, r^′ ∈ Z^∗_N² and then sends C₁^′ = g^xr^′N(mod N²) to the signer. After receiving C₁^′, the signer selects b ∈ {0, 1} and returns it to the user. The user then processes it on the basis of

‧

process ℓ times, the user can convince the signer that the ciphertext C₁ is generated with a probability of 1− 1/2^ℓ in accordance with the Paillier encryption scheme. In addition, the user must use the same method to convince the signer that C₂ is the correct form. This kind of zero­knowledge proof is called interactive, which can be transferred to non­interactive process [49].

Except sending C1, C2 along with zero­knowledge proofs, to make sure that user does not replace inf o with other inf o^′, we require he/she to run the following steps. User randomly selects (l1,· · · , ln) ← Z^∗_ϕ(N²₎, computes Fi = g^liIl^N_i mod N² for i = 1,· · · , n, where I = H(inf o), and sends F₁,· · · , Fn to signer. After accepting C₁, C₂ and their zero­knowledge proofs from user, signer randomly chooses u different numbers i = (i1,· · · , iu) from [1,· · · , n]

and send the list i to user. User now starts the opening phase and discloses L = (l₁,· · · , ln) except lj where j ∈ (i1,· · · , iu). Signer can use L to check whether all the opening ciphertexts are correct. If there exists a ciphertext is not generated correctly, signer aborts it. Since user have no idea what indices signer will pick, he/she cannot replace inf o with some other inf o^′. We provide a detail discussion in Chapter 16.

After interacting with the signer, the user obtains a final signature (t, s, R), where R = l_i1+· · · , liu mod q. Anyone who knows the public key of signer can verify this signature in the ECDSA by computing the following steps:

• Compute u = s⁻¹(H(m) + RH(inf o)) mod q, where R = l_i1 + · · · + liu, and v = s⁻¹t mod q.

• Compute (K_x^′, K_y^′) = uG + vQ and t^′ = K_x^′ mod q.

• Verify whether t^′ = t.

Subsequently, we analyze how a valid signature σ = (t, s, R) can pass the verification.

First, because C₁ = g^H(m)r^N₁ mod N², C₂ = g^tr^N₂ mod N², I = H(inf o) and R = l_i1+· · · + l_iu mod q, we have

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

C = (C₁C₂^dF_i1· · · Fiu)^{k1−1 (mod q)} · r^N (mod N²)

= ((g^H(m)r^N₁ )(g^tr₂^N)^d(g^li1Il_i1^N)· · · (g^liuIl_iu^N))^k

−1

1 (mod q)

· r^N (mod N²)

= g^k−11 (H(m)+RI+td) (mod q)

· (r1^k−11 r^k₂^{−11 d}(l_i1· · · liu)^k−11 r)

N

(mod N²)

= Enc(k₁⁻¹(H(m) + RI + td)).

Moreover, because g^q = (1 + N )^pqk = (1 + N )^N = 1 (mod N²), we have

s = k₂⁻¹Dec(C, (p, k))

= k₂⁻¹k₁⁻¹(h + Rh^′+ td) (mod q),

where h = H(m) and h^′ = H(inf o), and

K = (K_x, K_y)

= k₂K₁

= k₂(k₁)G

= k₁k₂G.

Therefore, if the signature is valid, t^′ = t.

‧

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 12

The Proposed Scheme 3

We proposed a partially blind signature scheme based on variant­ECDSA­2 that mentioned in Chapter 8, in this Chapter.

Both scheme 2 and scheme 3 are based on variants of ECDSA and adopt the modified Paillier encryption system we mentioned in Chapter 3.

The selection of public parameters in this scheme is the same as that in ECDSA (i.e., params = (E, G, q, H, H1), where H : {0, 1}^∗ → Z^∗q and H₁ is a function which map random string to a elliptic curve point. To generate the key pair, the signer randomly selects a d∈ [2, · · · , q − 1] as the secret key that remains secret. Then, the signer publishes their public key Q = dG. To generate a signature, the signer and user interact as presented in Fig. 4. The odified Paillier encryption (KeyGen, Enc, Dec) of Yi et al. and the zero­knowledge proof are adopted there. User first generates a modified Paillier encryption key pair ((N, g), (p, k)) by using the KeyGen algorithm and then generates ciphertexts C₁ = Enc(H(m, I)) = g^H(m,I)r₁^N (mod N²) and C₂ = Enc(t + α₂) = g^t+α2r₂^N (mod N²), where r₁, r₂ ←− Z^{$ ∗}_N².

In our third scheme, the user needs to provide corresponding zero­knowledge proofs of C₁ and C₂ well, with the process that we described in previous section. In additional, in this scheme, there is no need to generate additionally ciphertexts F_i = g^liIl_i^N mod N² other than C₁ and C₂. Our scheme 3 use a different method to prevent user from replacing the common information inf o with other information inf o^′ decided by user himself/herself. Precisely, we hash the common information inf o into a elliptic curve point Z . Both signer and user will bind this point Z to a random number (α₁ for signer and α₂ for user). The random number α₁ will

‧

After interacting with the signer, the user obtains a final signature (t, s, R). Anyone who knows the public key of signer can verify this signature in the ECDSA by computing the following steps:

• Compute u = s⁻¹H(m, I) mod q and v = s⁻¹(t + R) mod q.

• Compute (K_x^′, K_y^′) = uG + vQ and t^′ = K_x^′ mod q.

• Verify whether t^′ = t.

Subsequently, we analyze how a valid signature σ = (t, s, R) can pass the verification.

First, because C₁ = g^H(m)r^N₁ mod N², C₂ = g^t+α2r₂^N mod N², we have

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

where h = H(m, I), and

K = (K_x, K_y)

= k₂K₁

= k₂(k₁)G

= k₁k₂G.

Therefore, if the signature is valid, t^′ = t.

‧

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 13

Security Analysis

Theorem 3. Our first scheme satisfies unforgeability if ECDLP is hard.

Proof. Assume that adversary A can break the unforgeability of our first scheme with non-negligible probability. Then, a challenger C can make use of adversary A to solve ECDLP. At first, C is given an elliptic curve E, a multiplicative group G with generator G and prime order q, and a group element Q∈ G.

• Setup: C selects hash functions H : {0, 1}^∗× Z^∗q → Z^∗q and H₀ :{0, 1}^∗ → Z^∗q which act as random oracles. Then, C initials two lists L1, L₂, sets Q as the public key, and sends Q toA.

• Attack: In this phase, A can adaptively makes the following requests:

– H₀ request: When A requests the oracle with infoi, C first verifies whether (inf o_i, c_i) is in list L₁. If it exists,C responds A with ci; otherwise,C randomly selects a c_i ∈ Z^∗q as a response to A and stores (infoi, c_i) in list L₁ for consistency and to avoid collision.

– H request: Similarly, when A requests the oracle with (mi, inf oi, ti), C first verifies whether any (m_i, inf o_i, t_i, e_i) pairs are in list L₂. If one exists, C responds A with ei; otherwise, C randomly selects a ei ∈ Z^∗q as a response to A and stores (mi, inf o_i, t_i, e_i) in list L₂ for consistency and to avoid collision.

A requests the oracle with (m C selects e ∈ Z^∗

‧

x coordinate of the input value. When calculating ti, C verifies whether any (m_i, inf o_i, t_i) pairs are in L₂. If one is present, C selects a different si and repeats the aforementioned steps. Finally, (m_i, inf oi, ti, ei) is stored in list L2. C then sends (ei, s_i) to A.

• Forgery: In this phase, A outputs a valid signature σ^∗ = (e^∗, s^∗) for message m^∗ and agreed information inf o^∗.

By using a forking lemma [44], C can construct a Las Vegas machine to produce another signature ¯σ = (¯e, ¯s), where ¯e ̸= e^∗. C then solves the ECDLP by computing

Theorem 4. Our first scheme satisfies partial blindness.

Proof. Supposing adversary A is given a challenge tuple (m0, m₁, inf o, (e₀, s₀), (e₁, s₁)).

Moreover, the adversary’s view of the signing process is (K₁, (e^′₀, s^′₀), (e^′₁, s^′₁). Some blind random factors can map (K₁, e^′_i, s^′_i) to (e_j, s_j) for any i, j ∈ {0, 1}; therefore, A cannot distinguish between two message–signature pairs from their view of the signing process.

Let γ^′ = e− e^′, δ^′ = s− s^′, and c = H₀(inf o). Because s^′ = (k− (e^′+ c)d), we have:

‧

always lead to the same relationship defined in the signing protocol.

Moreover, (e₀, s₀) has the same distribution as (e₁, s₁) where (e₀, s₀), (e₁, s₁) are generated relative to the random numbers (γ, δ) chosen from Z^∗q. Therefore, A cannot distinguish between two messages from the signature pairs in their view.

Theorem 5. Our second scheme satisfies unforgeability if the variant-ECDSA-1 is unforgeable.

Proof. Because adversary A must provide a ciphertext of H(m) (i.e., C1) and t (i.e., C₂) with their zero-knowledge proofs to challenger C to convince C that A produced the ciphertexts (C1, C2) in accordance with the Paillier cryptosystem honestly.

A follows the Paillier encryption process, and challenger C responds with C = (C1C₂^dFi1· · · Fiu)^{k−11 (mod q)}r^N (mod N²) = Enc(k₁⁻¹(H(m) + RH(inf o) + td)) (mod q)).

Therefore, A can only obtain a signature (t, s, R) for message m and info, where s = k₂⁻¹[k₁⁻¹(H(m) + RH(inf o) + td)] (mod q) and R is a sum of some random numbers.

Note that if adversaryA disobeys the scheme and sends integers other than the ciphertext

‧

ECDSA-1 signature. The only difference is: since our scheme 2 is a partially blind signature, verifier in our scheme 2 will calculate the hash value of inf o, say H(inf o), and obtain R^′ = RH(inf o). Verifier then verify the variant-ECDSA-1 signature (t, s, R^′) through the verification process of variant-ECDSA-1. Since common information inf o is just a string generated from the negotiation between A and C and is known to both participants at the beginning, its presence does not affect the security. Therefore, if the variant-ECDSA-1 is unforgeable, as we proved in Chapter 7, given some partially blind signatures generated from scheme 2,A cannot forge one more partially blind signature.

Theorem 6. Our second scheme satisfies partial blindness if the underlying modified Paillier encryption is semantically secure.

Proof. Supposing adversaryA is given a challenge tuple (m0, m₁, inf o, (t₀, s₀, R₀), (t₁, s₁, R₁)).

Besides, the adversary’s view of the signing process is (K₁, (C₁, C₂, F₁,· · · , Fn, i, L, C)₀, (C₁, C₂, F₁,· · · , Fn, i, L, C)₁). Here, (C₁, C₂)₀ and (C₁, C₂)₁ can be viewed as the ciphertexts that encrypt (H(m₀), t₀) and (H(m₁), t₁) by using the semantically secure modified Paillier encryption [14]. Therefore, A cannot obtain any information from the signing view without knowing the secret key. Moreover, although A can obtain k₁⁻¹(H(m)+RI +td) (mod q) through the homomorphic property of Paillier cryptosystem, without knowing secret key,A cannot distinguish which message is encrypted, i.e., m = m0

or m = m₁. Nevertheless, from A’s view, he/she cannot distinguish between s0, R₀ and s₁, R₁. In detail, since R is the sum of l_i1,· · · , liu and A only holds Fi1,· · · , Fiu (which are ciphertexts of l_i1I,· · · , liuI, I = H(inf o)) from user, without the secret key of Paillier encryption, A cannot distinguish R with any other random number. Therefore, A cannot distinguish between two messages from the signature pairs and their view.

Theorem 7. Our third scheme satisfies unforgeability if the variant-ECDSA-2 is unforgeable.

Proof. Because adversary A must provide a ciphertext of H(m) (i.e., C1) and t + α₂ (i.e., C₂) with their zero-knowledge proofs to challenger C to convince C that A produced the ciphertexts (C₁, C₂) in accordance with the Paillier cryptosystem honestly. A follows the Paillier encryption process, and challenger C responds with C = (g^α1C₁C₂^d)^{k−11 (mod q)}r^N (mod N²) = Enc(k₁⁻¹(H(m||I) + (t + R)d)) (mod q)), where I = RZ = RH1(inf o), and

‧

α1. Therefore, A can only obtain a signature (t, s, R) for message m and info, where s = k₂⁻¹[k₁⁻¹(H(m||I) + (t + R)d)] (mod q) and R is a random number. Note that, if adversaryA disobeys the scheme and sends integersother than the ciphertext of H(m||R) and t + α₂, (t, s, R) will not be a valid signature for message m and inf o.

Nevertheless, the signature (t, s, R) that scheme 3 output is basically a valid variant-ECDSA-2 signature. Here is the only difference: since our scheme 3 is a partially blind signature, verifier in our scheme 3 will use hash function H1to calculate the Z = H1(inf o).

In variant-ECDSA-2 verifier compute u = s⁻¹H(m||R), while in our scheme 3 verifier compute u = s⁻¹H(m||I) where I = RZ = RH1(inf o). Since common information inf o is just a string generated from the negotiation between A and C and is known to both participants at the beginning, its presence does not affect the security. Therefore, if the variant-ECDSA-2 is unforgeable, as we proved in Chapter 8, given some partially blind signatures generated from scheme 3,A cannot forge one more partially blind signature.

Theorem 8. Our third scheme satisfies partial blindness if the underlying modified Paillier encryption is semantically secure.

Proof. Supposing adversaryA is given a challenge tuple (m0, m₁, inf o, (t₀, s₀, R₀), (t₁, s₁, R₁)).

The adversary’s view of the‘ signing process is (K₁, (C₁, C₂, C)₀, (C₁, C₂, C)₁). Here, (C₁, C₂)₀ and (C₁, C₂)₁ can be viewed as the ciphertexts that encrypt (H(m₀||I0), t₀) and (H(m₁||I1), t₁), where I₀ = ((α₁)₀ + (α₂)₀)H₁(inf o) and I₁ = ((α₁)₁ + (α₂)₁)H₁(inf o), by using the semantically secure modified Paillier encryption [14]. Therefore, A cannot obtain any information from the signing view without knowing the secret key. Moreover, although adversary A can obtain k⁻¹1 (H(m, I) + (t + R)d) (mod q) (R = α₁ + α₂) through the homomorphic property of Paillier cryptosystem (in fact, ciphertext C only), without knowing secret key, A cannot distinguish which plaintext is encrypted, i.e., (k₁)⁻¹₀ (H(m₀, I₀)+(t₀+R₀)d) (mod q) or (k₁)⁻¹₁ (H(m₁, I₁)+(t₁+R₁)d) (mod q). Thereby, fromA’s view, A cannot distinguish between s0, R₀, where s₀ = (k₂)⁻¹₀ (k₁)⁻¹₀ (H(m₀, I₀) + (t₀+R₀)d) (mod q) and s₁, R₁, where s₁ = (k₂)⁻¹₁ (k₁)⁻¹₁ (H(m₁, I₁)+(t₁+R₁)d) (mod q)).

Additionally, even though A try to hide a random integer β into the ciphertext C that he/she returns to C by C = E(β) instead of k1⁻¹(H(m, I) + (t + R)d) (mod q), it can be detected because the signature (t, s, R), where s = k⁻¹β, is not a valid signature of

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 14

Efficiency Analysis

In this section, we compare our proposed scheme with other related partially blind signature schemes [40, 50, 51] in terms of computational cost and signature size. As presented in Table 6, T_{M L}, T_EM, T_EX, T_IN, T_BP, T_{M T P}, and T_CH represent the time required to calculate the modular multiplication of two integers, elliptic curve scalar point multiplication, modular exponentiation, modular inversion of an integer, bilinear pairing, map­to­point hash function, and chaotic function, respectively. Moreover, to facilitate result comparison, we use the least time­intensive operation of T_{M L}as the base operation to represent the other operations. According to [52–54], T_EM ≈ 29TM L, T_EX ≈ 240TM L, T_IN ≈ 11.6TM L, T_BP ≈ 87TM L, and T_{M T P} ≈ 29TM L.

The comparison results of computational costs are presented in Table 7 and 8. Although scheme [40] and scheme [50] are secure under the standard model, they require more than 20T_EX and several high­cost operations including T_IN and T_BP during the issuing and verification

Table 6: Operation Notations

Notations Operation ≈ TM L

T_{M L} Modular multiplication of two integers 1

TEM Elliptic curve scalar point multiplication 29

T_EX Modular exponentiation 240

TIN Modular inversion of an integer 11.6

T_BP Bilinear pairing 87

TM T P Map-to-point hash function 29

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Table 7: Comparison-1 of Computational Efficiency

Schemes Computational cost

Issue phase Verification phase

[40] 20T_{M L}+ 17T_EX + 6T_IN 4T_{M L}+ 3T_EX + 2T_BP [50] 8T_{M L}+ (11 + k₁+ k₂)T_EX + 5T_BP 3T_EX + 3T_BP

[51] 7T_{M L}+ 6T_EM + T_IN 3T_{M L}+ 3T_EM

Scheme 1 T_{M L}+ 3T_EM 3T_EM

Scheme 2 (n + 2u + 3)T_{M L}+ 2T_EM

2T_{M L}+ 2T_EM + T_IN +(2n + 2u + 4ℓ + 5)T_EX + 2T_IN

Scheme 3 3T_{M L}+ 4T_EM + (7 + 4ℓ)T_EX + 2T_IN+ 2T_{M T P} 2T_{M L}+ 3T_EM + T_IN+ T_{M T P}

k₁, k₂: bit length of m and m∥info in [50], respectively.

ℓ: number of interactive rounds in zero-knowledge proof.

n: the number of ciphertexts generated by user.

u: the number of ciphertexts chosen by signer.

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Table 8: Comparison-2 of Computational Efficiency

Schemes Total computational cost ≈ TM L

[40] 24T_{M L}+ 20T_EX + 6T_IN+ 2T_BP 5415.6

[50] 8T_{M L}+ (14 + k₁ + k₂)T_EX + 8T_BP 4064 + 240(k₁+ k₂)

[51] 10T_{M L}+ 9T_EM + T_IN 300

Scheme 1 T_{M L}+ 6T_EM 175

Scheme 2 (n + 2u + 5)T_{M L}+ 4T_EM 481n + 482u + 960ℓ

+(2n + 2u + 4ℓ + 5)T_EX + 3T_IN +1355.8

Scheme 3 5T_{M L}+ 7T_EM + (7 + 4ℓ)T_EX + 3T_IN+ 3T_{M T P} 960ℓ + 2009.8

k₁, k₂: bit length of m and m∥info in [50], respectively.

ℓ: number of interactive rounds in zero-knowledge proof.

n: the number of ciphertexts generated by user.

u: the number of ciphertexts chosen by signer.

phases. Scheme [51] is inexpensive in terms of computational cost because it is based on ECC. It cost only 300T_{M L} without pairings and MTP functions. Subsequently, we discuss the computational cost of our schemes. Our scheme 1 needs only 175T_{M L} to finish total computation, which is the most practical. Our scheme 2 requires 481n + 482u + 960ℓ + 1355.8 in total, where n is the number of ciphertexts generated by user, u is the number of ciphertexts randomly chosen by signer, and ℓ is the number of rounds in zero­knowledge proof. Our scheme 3 requires 960ℓ + 2009.8 in total, where ℓ is the number of rounds in zero­knowledge proof.

Although our scheme 2 and 3 have more expensive computation cost than other schemes, these two schemes can almost be directly used in current ECDSA systems.

Table 9 compares the signature size of our scheme and those of [40, 50, 51]. To ensure a fair comparison, we adopted a similar security level [55] at 128­bit for all schemes.

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Table 9: Comparison of Signature Size

Schemes Complexity Signature size (bits)

[40] |G| + 2|q| 672

[50] 2|G| 448

[51] 3|q| + |G| 896

Ours Scheme 1 2|q| 448

Ours Scheme 2 3|q| 672

Ours Scheme 3 3|q| 672

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 15 Performance

In this chapter we demonstrate the performance of our partially blind signature schemes, under a machine with 8GB RAM and Intel(R) Core(TM) i5­4460 CPU with 2.3 GHZ processor speed on Windows 10. The running time is shown in Table 10, where the elliptic curve we choose is secp256k1, which is the same as the curve used in the Bitcoin. Besides, we let l, the number of rounds in zero­knowledge proofs equals 10, and u and n, the number of ciphertexts generated by user and chosen by signer equals 5 and 10, respectively.

Table 10: Running Time of the Proposed Partially Blind Signatures

Schemes Running Times(secs)

Issue Verify

Scheme 1 0.228 0.183

Scheme 2 217.846 0.151

‧

In this section we focus on our scheme 2. We first discuss about if a malicious user who knows what indices that signer will pick, then he/she can make a signature for different inf o^′. Then, we discuss the probability that malicious can successfully guess what indices that the signer will pick before sending C₁ to the signer.

First, if the user has known what indices that signer will pick, he/she can perform the following steps to replace inf o with inf o^′ and make a signature σ = (t, s, R^′) for (m, inf o^′) that can pass the verification. Suppose the user has known that signer will choose indices (i₁,· · · , iu), he/she then produces F_j = g^l′jI′z_j^N mod N², for j = i₁,· · · , iu, where I^′ = H(inf o^′) and l^′_j and z_j are decided by the user. Signer follows the protocol and computes C = (C₁C₂^dF_i1· · · Fiu)^{k1−1 (mod q)}· r^N (mod N²). Then, the signer returns C to the user.

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

σ can pass the verification: Any verifier calculates u = s⁻¹(H(m) + R^′H(inf o^′)) mod q and v = s⁻¹t mod q. With (u, v), the verifier can process as the verify in ECDSA and pass the verification. Hence, the above shows that a malicious user who knows what indices signer will choose can produce valid signature for inf o^′.

To avoid that user can easily guess the indices chosen by signer, the setting of n and u is important. The probability of a malicious user guessing all indices is

u

n ×_n^u−1₋₁ × ^u_n⁻²₋₂ × · · · ×_n−u+1¹ , as shown in Table 11.

Table 11: The Probability that User Guesses All the Indices Chosen by Signer under the Setting of n and u

u 5 10 15 20 25

n 10 20 30 40 50

Pro. 3∗ 10⁻³ 5∗ 10⁻⁶ 6∗ 10⁻⁹ 7∗ 10⁻¹² 7∗ 10⁻¹⁵

‧ 國

立 政 治 大 學

‧

N a tio na

l C h engchi U ni ve rs it y

Chapter 17

Application of the Proposed Schemes

在文檔中 基於ECDSA之部分盲簽章及其在比特幣上應用之研究 - 政大學術集成 (頁 43-67)