Accumulators and U-Prove Revocation

1. Accumulators andU-Prove Revocation Tolga Acar, Intel Sherman S.M. Chow, The Chinese University of Hong Kong Lan Nguyen, XCG – Microsoft Research

2. Outline Accumulators • Definitionsand Security • Anonymous Revocation • New scheme U-Prove • Overview • Revocation methods • Revocation with the new accumulator Implementation and Performance

3. Accumulator Primitives • Accumulate: Aggregate a set of elements into a single value V. • Non-Membership (NM) Proof: Prove that an element x is NOT accumulated in V without revealing any info about x. • Membership Proof: Prove that an element x is accumulated in Vwithout revealing any info about x. • Efficient Update of V and Proofs’ Witnesses when the accumulated set changes.

4. Accumulator Security • Member Completeness:x is accumulated ⇒ Member proof accepts. • Member Soundness:x is not accumulated ⇒ Member proof rejects. • NM Completeness:x is not accumulated ⇒ NM proof accepts. • NM Soundness:x is accumulated ⇒ NM proof rejects. • Information hiding: The proofs should be Zero-Knowledge or Witness Indistinguishable.

5. Revoking Anonymous Credentials For Blacklisting Anonymous Credentials, • Accumulate blacklisted elements in an accumulator value. • NM Proof proves that an element is not accumulated • ⇒ The element is not blacklisted. • NM Proof does not reveal the element ⇒ Privacy Protection. For Whitelisting Anonymous Credentials, it is similar in the opposite way.

6. Accumulator Scheme – Setup • Bilinear pairing e: where and are cyclic multiplicative groups, all of order prime q. • Setup • Private Key: • Public Key: where Optionally,

7. Accumulator Operations • Items to accumulate is a set • Accumulator value • Non-Membership Witness is with • Compute from t • A new witness for x is computed or updated when a new x‘ is accumulated or an accumulated x’ is removed from the set S • Similar for Membership Witness

8. Efficient Accumulator NM Proof Computations are moved from and to efficient • Prove is PoK: • Instead of To reduce pairing • Add to witness • Hide by and , so • PoK : Efficiency gains • Prover needs no pairing • Verifier needs 2 pairings to verify Similar for the Mem Proof.

9. Outline Accumulators • Definitionsand Security • Anonymous Revocation • New scheme U-Prove • Overview • Revocation methods • Revocation with the new accumulator Implementation and Performance

10. U-Prove Participants: Issuer, User (Prover), Service Provider (Verifier). Issuing Protocol between Issuer and User • User obtains Tokens from Issuer • Token certifies attributes (Driver License, Age > 21,…) Presentation Protocol between User and Service Provider • Users proves certain attributes to Service Provider • Service Provider learns nothing about other attributes

11. U-Prove Crypto Issuing • Each token is a blind signature on a commitment of attributes • Re-Committing to is like a sealed envelop • Blind Signing is like carbon paper • Extracting from is like opening envelop Presenting • Showing disclose attributes • PoK of committed attributes • Verifying the blind signature Different presentations of the same token are linkable

12. Revocation in U-Prove Four Methods • ID Exposure. It breaks privacy. Force revoked user to reveal the ID (S/N or another attribute) • Credential Update. Not efficient. Short validity time encoded in an attribute Issuer periodically updates valid credentials for download • Credential Revocation Lists. Not efficient. List of proofs that the ID is not in blacklisted items • Accumulators Use an accumulator to aggregate the IDs

13. Pros and Cons of using Accumulators • Advantages • Costs to generate and verify unrevoked credential proofs do not depend on the blacklist’s size. • It works for both whitelisting (membership proofs) and blacklisting (non-membership proofs). • Anonymous and unlinkable credentials. Disadvantages • Witness update is expensive. • More complex.

14. Accumulator-Based Revocation Scheme U-Prove integration is based on non-membership proof Demo Scenario • Both User A and User P are issued U-Prove tokens. • User A is blacklisted, so A fails to update NM Witness • ⇒ User A can not generate anonymous proofs. • User P succeeds to update its NM Witness. • ⇒ User P can generate valid anonymous proofs.

15. U-Prove Revocation Scenario

16. Setup and Issuing Use a revocation attribute (rv) to the U-Prove token. Issuer • Public key: • Private key: User • Token: • Private key: • Commitment

17. Revocation and Presentation Blacklist Authority • Public key private key , and revocation table User uses the table to update ’s accumulator witness from the revocation table Presentation • Normal U-Prove Presentation • Prove that is not accumulated (Non-Membership proof)

18. Outline Accumulators • Definitionsand Security • Anonymous Revocation • New scheme U-Prove • Overview • Revocation methods • Revocation with the new accumulator Implementation and Performance

19. Software Design AnonProof U-Prove Idemix Application Revocation API Revocation Accumulator API Proof List Method AccuFS AccuGS Others

20. Software Design • Abstraction: Single definition of Revocation API (for all revoking methods), Single definition of Accumulator API (for all accumulators). • No Redundancy: Single implementation of Revocation using Accumulators. • Extendibility: Easy to add new Accumulators or Applications. • Changeability: Easy to switch among Accumulators or Revocation methods.

21. Performance Compared with the only previous universal accumulator scheme ATSM

22. Thanks and Questions