Simple and Practical Anonymous Digital Coin Tracing

Slides:

Advertisements

Similar presentations

Ari Juels RSA Laboratories Executable Financial Instruments and MicroMint on the Cheap with Markus Jakobsson Bell Laboratories.

Advertisements

Ari Juels RSA Laboratories Marty Wattenberg 328 W. 19th Street, NYC A Fuzzy Commitment Scheme.

Secure Naming structure and p2p application interaction IETF - PPSP WG July 2010 Christian Dannewitz, Teemu Rautio and Ove Strandberg.

Internet payment systems

RPC Mixing: Making Mix-Nets Robust for Electronic Voting Ron Rivest MIT Markus Jakobsson Ari Juels RSA Laboratories.

Digital Cash Mehdi Bazargan Fall 2004.

The Attestation Mechanism in Trusted Computing. A Simple Remote Attestation Protocol Platform TPM Verifier Application A generates PK A & SK A 2) computes.

Understanding Networked Applications: A First Course Chapter 14 by David G. Messerschmitt.

Anonymous Credentials: How to show credentials without compromising privacy Melissa Chase Microsoft Research.

PORs: Proofs of Retrievability for Large Files

Lect. 18: Cryptographic Protocols. 2 1.Cryptographic Protocols 2.Special Signatures 3.Secret Sharing and Threshold Cryptography 4.Zero-knowledge Proofs.

Digital Signatures and applications Math 7290CryptographySu07.

Authentication and Digital Signatures CSCI 5857: Encoding and Encryption.

Digital Cash Present By Kevin, Hiren, Amit, Kai. What is Digital Cash?  A payment message bearing a digital signature which functions as a medium of.

ELECTRONIC PAYMENT SYSTEMS FALL 2002COPYRIGHT © 2002 MICHAEL I. SHAMOS Electronic Payment Systems Lecture 11 Electronic Cash.

Slide 1 Vitaly Shmatikov CS 378 Digital Cash. slide 2 Digital Cash: Properties uDigital “payment message” with properties of cash uUnforgeable Users cannot.

Payment Systems 1. Electronic Payment Schemes Schemes for electronic payment are multi-party protocols Payment instrument modeled by electronic coin that.

IAW 2006 Cascaded Authorization with Anonymous- Signer Aggregate Signatures Danfeng Yao Department of Computer Science Brown University Joint work with.

Receipt-free Voting Joint work with Markus Jakobsson, C. Andy Neff Ari Juels RSA Laboratories.

Reusable Anonymous Return Channels

Introduction to Modern Cryptography, Lecture 13 Money Related Issues ($$$) and Odds and Ends.

Intro To Secure Comm. Exercise 2. Problem  You wish for your users to access a remote server via user and password.  All of the users have modems and.

Foundations of Network and Computer Security J J ohn Black Lecture #10 Sep 18 th 2009 CSCI 6268/TLEN 5550, Fall 2009.

CMSC 414 Computer and Network Security Lecture 6 Jonathan Katz.

CMSC 414 Computer and Network Security Lecture 7 Jonathan Katz.

ELECTRONIC PAYMENT SYSTEMS SPRING 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Electronic Payment Systems Lecture 11 Electronic Cash.

J. Håstad J. Jakobsson A. Juels M. Yung Funkspiel Schemes: An Alternative to Conventional Tamper Resistance Royal Inst. of Technology, Stockholm RSA Laboratories.

Your Presenter Amer Sharaf Electronic Payments: Where do we go from here? ByMarkus Jakobsson David Mraihi Yiannis Tsiounis Moti Yung.

1 Blind Signatures 盲簽章 Chun-I Fan 范俊逸 E-Commerce & Security Engineering Lab. Department of Computer Science and Engineering National Sun Yat-Sen University.

Digital Cash Damodar Nagapuram. Overview ► Monetary Freedom ► Digital Cash and its importance ► Achieving Digital Cash ► Disadvantages with digital cash.

1 A practical off-line digital money system with partially blind signatures based on the discrete logarithm problem From: IEICE TRANS. FUNDAMENTALS, VOL.E83-A,No.1.

CMSC 414 Computer and Network Security Lecture 16 Jonathan Katz.

Electronic Voting Schemes and Other stuff. Requirements Only eligible voters can vote (once only) No one can tell how voter voted Publish who voted (?)

CMSC 414 Computer and Network Security Lecture 19 Jonathan Katz.

WS Algorithmentheorie 03 – Randomized Algorithms (Public Key Cryptosystems) Prof. Dr. Th. Ottmann.

How cryptography is used to secure web services Josh Benaloh Cryptographer Microsoft Research.

CMSC 414 Computer and Network Security Lecture 6 Jonathan Katz.

Key Distribution CS 470 Introduction to Applied Cryptography

ELECTRONIC PAYMENT SYSTEMSFALL 2001COPYRIGHT © 2001 MICHAEL I. SHAMOS Electronic Payment Systems Lecture 6 Epayment Security II.

PRIAM: PRivate Information Access Management on Outsourced Storage Service Providers Mark Shaneck Karthikeyan Mahadevan Jeff Yongdae Kim.

Remarks on Voting using Cryptography Ronald L. Rivest MIT Laboratory for Computer Science.

HumanAUT Secure Human Identification Protocols Adam Bender Avrim Blum Manuel Blum Nick Hopper The ALADDIN Center Carnegie Mellon University.

Ari Juels RSA Laboratories Proofs of Work (POWs) and Bread Pudding Protocols with Markus Jakobsson Bell Laboratories.

WISA An Efficient On-line Electronic Cash with Unlinkable Exact Payments Toru Nakanishi, Mitsuaki Shiota and Yuji Sugiyama Dept. of Communication.

Digital Cash By Gaurav Shetty. Agenda Introduction. Introduction. Working. Working. Desired Properties. Desired Properties. Protocols for Digital Cash.

Current issues of e-cash and Fair tracing Network Security Term Project Kim Byeong Gon Cais Lab of ICU

Issues in Cryptography Ronald L. Rivest MIT Laboratory for Computer Science.

Anonymous Identification in Ad Hoc Groups New York, NY, USAApril 6 th, 2004 Yevgeniy Dodis, Antonio Nicolosi, Victor Shoup

Public-Key Cryptography CS110 Fall Conventional Encryption.

How cryptography is used to secure web services Josh Benaloh Cryptographer Microsoft Research.

Topic 22: Digital Schemes (2)

Clemente-Cuervo et al. A PDA Implementation of an Off-line e-Cash Protocol.

Privacy Enhancing Technologies Spring What is Privacy? “The right to be let alone” Confidentiality Anonymity Access Control Most privacy technologies.

WISTP’08 ©LAM /05/2008 A Self-Certified and Sybil-Free Framework for Secure Digital Identity Domain Buildup Christer Andersson Markulf Kohlweiss.

Secure Communication between Set-top Box and Smart Card in DTV Broadcasting Authors: T. Jiang, Y. Hou and S. Zheng Source: IEEE Transactions on Consumer.

A A E E D D C C B B # Symmetric Keys = n*(n-1)/2 F F

A Simple Traceable Pseudonym Certificate System for RSA-based PKI SCGroup Jinhae Kim.

Electronic Cash R. Newman. Topics Defining anonymity Need for anonymity Defining privacy Threats to anonymity and privacy Mechanisms to provide anonymity.

Electronic Payment Systems Presented by Rufus Knight Veronica Ogle Chris Sullivan As eCommerce grows, so does our need to understand current methods of.

A Brief Introduction to Mix Networks Ari Juels RSA Laboratories © 2001, RSA Security Inc.

BZUPAGES.COM E-cash Payment System A company, DigiCash, has pioneered the use of electronic cash or e-cash. Anonymity of the buyer is the key feature of.

ICICS2002, Singapore 1 A Group Signature Scheme Committing the Group Toru Nakanishi, Masayuki Tao, and Yuji Sugiyama Dept. of Communication Network Engineering.

Digital Security Jesline James! 9cc. Contents  The CREATORS!!!! =] The CREATORS!!!! =]  What is Digital Security? What is Digital Security?  How does.

Foundations of Network and Computer Security J J ohn Black CSCI 6268/TLEN 5550, Spring 2014.

Manu Drijvers, Joint work with Jan Camenisch, Anja Lehmann. March 9 th, 2016 Universally Composable Direct Anonymous Attestation.

Bit Commitment, Fair Coin Flips, and One-Way Accumulators Matt Ashoff 11/9/2004 Cryptographic Protocols.

Forward Secure Signatures on Smart Cards A. Hülsing, J. Buchmann, C. Busold | TU Darmstadt | A. Hülsing | 1.

Secure Biometric Authentication for Weak Computational Devices Mikhail Atallah (Purdue),Keith Frikken (Purdue), Michael Goodrich (UC- Irvine), Roberto.

eCommerce Technology Lecture 13 Electronic Cash

Presentation transcript:

Simple and Practical Anonymous Digital Coin Tracing Trustee Tokens Simple and Practical Anonymous Digital Coin Tracing Ari Juels RSA Laboratories

Quick Review of Chaumian E-cash (DigiCashTM)

Anonymous digital $1 coin Alice BANK PK SK Signs Alice -$1 Anonymous digital $1 coin

r, x rf1/3(x) r3f(x) (x, f1/3(x)) rf1/3(x) = (x, Sig(x)) = PK SK mod n Alice BANK PK SK mod n Signs 3 r3f(x) r, x rf1/3(x) r3f(x) (x, f1/3(x)) = (x, Sig(x)) = rf1/3(x) rf1/3(x)

Improved Computer Viruses (Young and Yung) An Application for Anonymous E-Cash An Application for Anonymous E-Cash

Improved Computer Virus r3f(x) Generates unsigned, blinded coin Generates encryption key pair Edgar

Improved Computer Virus r3f(x) PK

Alice

Hard Disk

Files Encrypted under PK *&DUHF(&$YY$H&*^$RH(*&UH *&(#*R&(*&(*$&(*$&(*U(*F&(*&* *&HKJF(*$YHF(*H$(*^FH*($HF& J(*F&$(*HS(*&$JF*($&SH$*&F$ *(&$*(F&(*$F$(*F&S(*&*F(&*E$$ )*F&(*$&*$&F(*$&F(*$&(*&(#(*$ Encrypted under PK PK Files

If you Want SK, i.e., your files, withdraw this Ransom Note

Alice BANK Oh, my files! Alice -$1

HETTINGA SUCCEEDS GREENSPAN AT FED

Anonymous coin Edgar

Answer: Trustee-based Tracing How can we prevent this?

The Idea: Trustee Tracing Anonymous coin

Tracing: Basic Idea I order the Trustee to trace this coin. Edgar Anonymous coin Judge Trustee Secret SK

Coin is anonymous unless trustee traces it

Many Trustee-based Tracing Schemes Brickell et al. ( ‘95) Stadler et al. (‘95) Jakobsson and Yung (‘96, ‘97) Camenisch et al., Frankel et al. (‘96) Davida et al. (‘97)

Trend in schemes Our Scheme Security Trustee Simplicity Computational Features Trustee Flexibility Simplicity Computational Efficiency

How our scheme works

1. 2. Two stages Token withdrawal Alice Trustee Coin withdrawal Alice BANK 2.

Token withdrawal Proves identity Alice Trustee Checks that Trustee coin contains [“Alice”]PK Trustee Token

Trustee Token Proves identity Alice r, x Trustee Trustee Checks that x contains [“Alice”]PK SigSK(r3f(x))

Coin withdrawal , Conditionally anonymous digital coin SK Alice Checks BANK SK Signs , Checks Conditionally anonymous digital coin

Observe: No change in coin structure or underlying withdrawal protocol

Tracing Trustee Token scheme guarantees that coins contain creator identity

Blackmail scenario Edgar registers his coin and gets caught or Alice can’t make the withdrawal for Edgar

Enhancements

No coin storage Alice can pseudo-randomly generate coins and blinding factors -- no coin storage

Bulk token withdrawal Alice can withdraw many tokens at once and store prior to coin withdrawals

One token - multiple coins

Result of Enhancements Little interaction with Trustee Tokens fit on, e.g., smart card

Pros and Cons

Advantages over other schemes Very simple Provably secure No change in coin structure, underlying protocol Seamless incorporation with DigiCashTM

Disadvantages Trustee interaction needed Security with multiple trustees needs trusted dealer Seamless incorporation with DigiCashTM - but no DigiCashTM

But... Can be used for general blind RSA E.g., X-cash Method can perhaps be extended to other e-cash systems (?)

Questions?