Download presentation

Presentation is loading. Please wait.

Published byIsabel Buchanan Modified over 2 years ago

1
Trustee Tokens Simple and Practical Anonymous Digital Coin Tracing Ari Juels RSA Laboratories

2
Quick Review of Chaumian E-cash (DigiCash TM )

3
BANK Alice SK PK Signs Alice -$1 Anonymous digital $1 coin

4
BANK Alice r, x r 3 f(x) rf 1/3 (x) SK PK (x, f 1/3 (x)) Signs 3 = (x, Sig(x)) = mod n

5
An Application for Anonymous E-Cash Improved Computer Viruses (Young and Yung)

6
Improved Computer Virus Edgar r 3 f(x) u Generates unsigned, blinded coin u Generates encryption key pair

7
Improved Computer Virus r 3 f(x) PK

8
Alice

9
Hard Disk

10
Files PK *&DUHF(&$YY$H&*^$RH(*&UH *&(#*R&(*&(*$&(*$&(*U(*F&(*&* *&HKJF(*$YHF(*H$(*^FH*($HF& J(*F&$(*HS(*&$JF*($&SH$*&F$ *(&$*(F&(*$F$(*F&S(*&*F(&*E$$ )*F&(*$&*$&F(*$&F(*$&(*&(#(*$ Encrypted under PK

11
I f you W ant SK, i.e., d yo u r files, with d ra w this Ransom Note

12
BANK Alice Oh, my files! Alice -$1

13
HETTINGA SUCCEEDS GREENSPAN AT FED

14
Anonymous coin Edgar

15
How can we prevent this? Answer: Trustee-based Tracing

16
The Idea: Trustee Tracing Anonymous coin

17
Tracing: Basic Idea Anonymous coin Judge Trustee I order the Trustee to trace this coin. Trustee Secret SK Edgar

18
Coin is anonymous unless trustee traces it

19
Many Trustee-based Tracing Schemes u Brickell et al. ( 95) u Stadler et al. (95) u Jakobsson and Yung (96, 97) u Camenisch et al., Frankel et al. (96) u Davida et al. (97)

20
Trend in schemes Security Features Simplicity Trustee Flexibility Computational Efficiency Our Scheme

21
How our scheme works

22
Two stages Alice Trustee 1. Token withdrawal Alice 2. Coin withdrawal BANK

23
Token withdrawal Alice Trustee Checks that coin contains [Alice] PK Trustee Token Proves identity

24
Trustee Token Alice Trustee Checks that x contains [Alice] PK Trustee Token r, x Sig SK (r 3 f(x)) Proves identity

25
BANK Alice SK Coin withdrawal Checks Signs, Conditionally anonymous digital coin

26
Observe: No change in coin structure or underlying withdrawal protocol

27
Tracing Trustee Token scheme guarantees that coins contain creator identity

28
Blackmail scenario u Edgar registers his coin and gets caught or u Alice cant make the withdrawal for Edgar

29
Enhancements

30
No coin storage u Alice can pseudo-randomly generate coins and blinding factors -- no coin storage

31
Bulk token withdrawal u Alice can withdraw many tokens at once and store prior to coin withdrawals

32
One token - multiple coins

33
Result of Enhancements u Little interaction with Trustee u Tokens fit on, e.g., smart card

34
Pros and Cons

35
Advantages over other schemes u Very simple u Provably secure u No change in coin structure, underlying protocol u Seamless incorporation with DigiCash TM

36
Disadvantages u Trustee interaction needed u Security with multiple trustees needs trusted dealer u Seamless incorporation with DigiCash TM - but no DigiCash TM

37
But... u Can be used for general blind RSA –E.g., X-cash u Method can perhaps be extended to other e-cash systems (?)

38
Questions?

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google