Oblivious Signature-Based Envelope Ninghui Li, Stanford University Wenliang (Kevin) Du, Syracuse University Dan Boneh, Stanford University

Motivation AliceBob I have an message P to report, but I want to make sure you are CIA. Please show me your CIA certificate. I won’t show my CIA certificate to you, just give me the message. ??????

Outline of This Presentation Introduce the Oblivious Signature- Based Envelope (OSBE) concept. An OSBE scheme for RSA signatures. OSBE using Identity Based Encryption (IBE). Summary and Future Work.

Public Key Certificate (an example) Bob’s CIA certificate: PK: the CIA’s public key. M: “Bob is with CIA”  = Sig PK (M): signature on M (certificate). The secret part is 

Oblivious Signature-Based Envelope (OSBE) Message P Sender Receiver Receiver can open the envelope if and only if he/she has the certificate. Sender cannot know whether the receiver has the certificate.

OSBE Definition Setup PK: the Certificate Authority’s public key. M: content of the certificate.  = Sig PK (M): signature on M (certificate). S: Sender of message P (P is given to S only). R 1 : Receiver with . R 2 : Receiver without . PK and M are given to all three parties.

OSBE Definition (cont’d) Interaction One of R 1 and R 2 is chosen as R, without S knowing which one. S and R run an interactive protocol. Open R outputs P if and only if R = R 1. Note: R 1 has the certificate, R 2 doesn’t.

Security Requirements Sound: R 1 can output P with overwhelming probability. Oblivious: S does not learn whether it is communicating with R 1 or R 2. Semantically secure against the receiver: R 2 learns nothing about P.

Outline of This Presentation Introduce the Oblivious Signature- Based Envelope (OSBE) concept. An OSBE scheme for RSA signatures. OSBE using Identity Based Encryption (IBE). Summary and Future Work.

An OSBE Scheme for RSA RSA Signatures: (e, n): public key PK. d: private key. h = hash(M): hash value of M.  = Sig PK (M) = h d (mod n): signature. (h d ) e = (h e ) d = h (mod n).

RSA-OSBE Scheme: Setup Setup: Everybody knows h, M, (e, n) Sender S knows: P Receiver R 1 knows:  = (h d mod n)

Using Key Agreement P Sender Receiver Sender knows the key; Receiver knows the key only if it has h d.

Diffie-Hellman Key Agreement Alice Bob x y h x mod n h y mod n (h x ) y mod n(h y ) x mod n = h x y mod n

Transforming Diffie-Hellman SR1R1 xy  = h d · h x mod n  = h e y mod n  e y = (h d+x ) e y r ‘ = (h e y ) x r = r’ if and only if Receiver knows h d = h e d y · h e x y = h y · h e x y r =  e y / h y = h e x y

Properties Theorem 1: RSA-OSBE is sound (r = r’) Theorem 2: RSA-OSBE is oblivious R 1 :  = h d+x R 2 :  = h x’ {h d+x | x random} and {h x’ | x’ random} are statistically indistinguishable. Theorem 3: RSA-OSBE is semantically secure against the receiver, i.e, R 2 cannot learn r.

Proof of Theorem 3 (Approach) Approach We show that, if there exists an adversary receiver R (who does know h d ) that can break RSA-OSBE i.e., R can learn r by interacting with S, Then we can build an attacker that can generate h d. i.e., we can use R to break RSA signatures

Proof of Theorem 3 R M, (e, n)   = h e y, y random r =  e y · h -y To construct RSA attacker using R, we can construct  such that we can get h d out of , r ? r’ = h exy

Proof of Theorem 3 (cont’d) R  = h ey r =  e y · h -y RSA Attacker randomly generates k, constructs  = h 1+ ek = h e (d+k) Attacker knows R outputs r =  e y · h -y =  e(d+k) · h -(d+k) =  1+ek · h -d · h -k, Let y = d+k, then  = h e y 

Outline of This Presentation Introduce the Oblivious Signature- Based Envelope (OSBE) concept. An OSBE scheme for RSA signatures. OSBE using Identity Based Encryption (IBE). Summary and Future Work.

Identity Based Encryption (IBE) Public encryption key “Bob is a CIA member”. System Parameters Cipher Text Message P Alice Master Key Private decryption key Bob Third Party

IBE implies Signatures Public encryption key “Bob is a CIA member”. System Parameters Alice Master Key Private decryption key Bob Third Party Message to be signed: M PK PK -1  = Sig PK (M)

OSBE Scheme Using IBE Sender Receiver (Bob) (1)Public key K = “Bob is a CIA member” (2) E K (Message) (3) Decrypt E K (Message) using the private key.

Comparisons IBE-OSBE is one round; RSA-OSBE needs two rounds. RSA-OSBE can be used on existing Public Key Infrastructure.

Summary and Future Work OSBE concept RSA-OSBE scheme and IBE-OSBE scheme Future Work: Find OSBE scheme for DSA signatures.