1. ICICS2002, Singapore 1 A Group Signature Scheme Committing the Group Toru Nakanishi, Masayuki Tao, and Yuji Sugiyama Dept. of Communication Network Engineering Okayama University, Japan

2. ICICS2002, Singapore 2 What’s group signature ？ A group signature Traceable only by TTP He/she is a group member! But, who? applied to anonymous e-cash, auction...

3. ICICS2002, Singapore 3 Committing the membership group Our contribution A group signature scheme with new characteristic Universal group He/she is a member in some group But, which group? … Group 1 Group T divided to multiple groups signature Group ID is traceable only by TTP

4. ICICS2002, Singapore 4 Outline of this presentation  Definition of group signature scheme committing the group  Based conventional group signature scheme  Proposed scheme  Security  Application

5. ICICS2002, Singapore 5 Definition of group signature scheme committing the group Participants except signer and verifier  Membership Manager(MM)…has authority to decide whether an entity may join a group  Revocation Manager(RM)…has authority to trace identity and group ID from the signature Important requirements  Unforgeability of signature  Anonymity, and secrecy of group ID  Traceability of identity and group ID by RM

6. ICICS2002, Singapore 6 Based group signature scheme Ateniese et al.’s scheme in Crypto2000 (ACJT scheme)  Most efficient Efficient in signing/verification and even registration  Provably secure Coalition resistance against an adaptive adversary (Strong adversary reflecting the reality) Why is our scheme based on this?

7. ICICS2002, Singapore 7 In advance, MM & RM set up keys and parameters Registration (joining a group) ACJT scheme: Overview Signature Membership certificate (Sig. for PK) MM Proof( ) Enc RM ( ) PK SK Unforgeable Traceable by RM ID, Anonymous (Zero-knowledge)

8. ICICS2002, Singapore 8 ACJT scheme: Setup MM and RM set up the following:  n=pq: RSA modulus (only MM knows p and q)  a, b, g, h: public elements in QR n (Set of quadratic residues in Z n *)  y=g x : public key (only RM knows x)

9. ICICS2002, Singapore 9 ACJT scheme: Registration Membership certificate: (A, e) s.t. A = (a x b) 1/e (mod n) MM PK: a x SK: x ID, This is an RSA signature that MM only generates

10. ICICS2002, Singapore 10 ACJT scheme: Signature Signature for messege m consists of  T = Enc RM (A) : ElGamal ciphertext w.r.t. y  S = SPK[(x, A, e) s.t. T= Enc RM (A) ∧ A = (a x b) 1/e ](m) Enc RM ( ) Proof( ) SPK: Signature converted from zero-knowledge proof of knowledge (Only one with knowledge can make SPK without revealing information on knowledge)

11. ICICS2002, Singapore 11 Our scheme: Basic idea Registration (joining a group) Signature Membership certificate (Sig. for PK and Group ID) MM Proof( ) Enc RM ( ) PK SK ID, (Zero-knowledge) Enc RM (Group ID)

12. ICICS2002, Singapore 12 Our scheme: Setup and Registration Setup  Another c ∈ QR n  Group IDs E 1,…E T Registration for group ID E t Membership certificate: (A, e) s.t. A = (a x bc Et ) 1/e (mod n) MM PK: a x SK: x ID, (This form is also provably unforgeable…explained later)

13. ICICS2002, Singapore 13 Our scheme: Signature and revocation Signature for messege m consists of  T = Enc RM (A)  T’= Enc RM (h E ｔ )  S = SPK[(x, A, e, E ｔ ) s.t. T= Enc RM (A) ∧ T’=Enc RM (h Et ) ∧ A = (a x bc Et ) 1/e ](m) Group ID can be identified by RM’s decrypting T’ For using E t in exponent, we can construct efficient SPK using known SPKs for secret exponent

14. ICICS2002, Singapore 14 Security : Coalition resisitance Certificate (A,e) is unforgeable even if valid members collude.  Formally, this means the unforgeability against adaptive adversary After obtaining valid certificates from MM a constant times, this adversary forges a new certificate For RSA modulus n and z ∈ QR n, it is infeasible to compute (u,e>1) s.t. u e = z This paper provides the security proof under strong RSA assumption

15. ICICS2002, Singapore 15 Security: Others Unforgeability of group signature ← Unforgeability of cert. and SPK proving cert. Anonymity, and secrecy of group ID ←zero-knowledge-ness of SPK and encryption

16. ICICS2002, Singapore 16 Application: Anonymous survey Anonymous survey to generate statistics on users’ attributes  Background This system generates statistics on attributes secretly Commercial service provider User(Customer) Man or Woman ? Young or Old? Anonymously Marketing

17. ICICS2002, Singapore 17 Problem on previous survey system Previous survey system [Nakanishi&Sugiyama, ACISP01] Vast computation depending on number of all registering users So, inefficient Commercial service providerUser(Customer) Group Signature TTP Group Signature Group Signature Group Signature Female 90% 10% Male Statistics Secure comp.

18. ICICS2002, Singapore 18 Efficient system using proposed scheme(1/2) Setup  Group ID E 1,..,E T are assigned to attribute values (e.g., E 1 : Female, E 2 :Male) Registration (e.g., E 1 :Female) Membership certificate (Sig. for PK and E 1 ) MM PK SK ID,

19. ICICS2002, Singapore 19 Efficient system using proposed scheme(2/2) Commercial service providerUser(Customer) Group Signature including Enc RM (E 1 ) Enc RM (E 2 ) … TTP E 2, E 2 …E 1 （ shuffled) Female 90% 10% Male Known efficient shuffle protocol The cost is independent from number of registering users So, more efficient

20. ICICS2002, Singapore 20 Conclusion Group signature scheme committing the group is proposed  Efficient and provably secure  Useful for applications (e.g., Anonymous survey) Further works  Application to e-cash  Improving anonymous survey