Search

An off-line electronic coin system is presented that offers multi-party security and unconditional privacy of payments. The system improves significantly on the efficiency of the previously most efficient such system known in the literature, due to application of a recently proposed technique called secret-key certificates. By definition of secret-key certificates, pairs consisting of a public key and a matching certificate can be simulated with indistinguishable probability distribution. This allows a variety of polynomial-time reductions from a well-known signature scheme to the cash system. In particular, the withdrawal protocol can be proved to be restrictive blind with respect to one account holder, relying only on a standard intractability assumption; no such result has been proved before in the literature. Another consequence of the application of the secret-key certificate technique is that the withdrawal protocol is not a blind signature issuing protocol. This falsifies the popular belief that efficient privacy-protecting off-line electronic cash systems must be based on withdrawal protocols that are blind signature issuing protocols.

Many signature transporting mechanisms require a signer to issue triples, consisting of a secret key, a matching public key, and a certificate of the signer on the public key. Of particular interest are so-called restrictive blind signature issuing protocols, in which the receiver can blind the issued public key and the certificate but not a certain predicate of the secret key. This paper describes the first generally applicable technique for designing efficient such issuing protocols, based on the recently introduced notion of secret-key certificates. The resulting three-move issuing protocols require the receiver to perform merely a single on-line multiplication, and the property of restrictive blinding can be proved with respect to a plausible intractability assumption. Application of the new issuing protocols results in the most efficient and versatile off-line electronic cash systems known to date, without using the blind signature technique developed by Chaum.

The notion of secret-key certificate schemes is introduced and formalized. As with public-key certificates, triples consisting of a secret key, a corresponding public key, and a secret-key certificate on the public key can only be retrieved by engaging in an issuing protocol with the issuer. The difference with public-key certificates is that pairs consisting of a public key and a secret-key certificate on the public key can be generated by anyone, with a distribution that is indistinguishable from the distribution according to which they are generated in the issuing protocol. Secret-key certificates offer the same functionality as do public-key certificates, because there is no point in using a public-key certificate scheme if the cryptographic actions that are to be performed with respect to a certified public key can be performed without knowing a corresponding secret key. The existence of efficient and secure secret-key certificate schemes is demonstrated by a generally applicable technique for deriving such schemes from signature schemes of a well-known type. The new notion is believed to be of interest in its own right, as it demonstrates an alternative to a stale paradigm in cryptography. More important are the practical advantages: secret-key certificates are better suited for the design of privacy-protecting mechanisms for signature transport, and can be used to construct secure public-key directories and conditional access mechanisms that provably do not leak information that can be of help to forge certificates.

Recently a class of secret-key certificate issuing protocols has been proposed that is believed to be restrictive blind when run in sequential mode. In this report an immunization technique is proposed for modifying these secret-key certificate issuing protocols in order to make them restrictive blind even when run in parallel mode. All the proofs of correctness for the underlying, unmodified protocols are fully preserved under the modification, as is their applicability to privacy-protecting mechanisms for value transport.

A minimal variation is proposed of a recently described secret-key certificate scheme that is derived from the Schnorr signature scheme.The issuing protocol of the variation is conjectured to be restrictive blind in parallel mode, motivated by a recent argument of Schoenmakers.The variation demonstrates that the double use of a generator is not problematic in any way, contrary to the belief expressed by Schoenmakers. A more profound argument for the conjectured security in parallel mode is provided, and similar variations are described for secret-key certificates based on Brickell-McCurley signatures. To create some order in the variety of restrictive blind certificate schemes that have been proposed to date, their specific merits and limitations are categorized and discussed.

The receiver in a restrictive blind certificate issuing protocol can blind the issued public key and the certificate but not a certain blinding-invariant predicate of the secret key. Recently a generally applicable technique was described for designing restrictive blind issuing protocols for a certain type of secret-key certificates, and it was shown that the resulting issuing protocols should not be run in parallel since that would enable an attack in which completely blinded triples can be retrieved. To allow the signer in highly demanding applications to run the restrictive blind certificate issuing protocol in parallel mode, a simple technique for modifying the issuing protocols was proposed. In this note it is shown that the proposed modification technique does not overcome the parallel attack problem.

A new construction is described for designing secret-key certificate schemes based on signature schemes other than of the Fiat-Shamir type. Also described are practical secret-key certificate issuing protocols that enable the Certification Authority to certify public keys, without being able to compromise the confidentiality of the corresponding secret keys. Furthermore the design of secure showing protocols is discussed, exemplified by secret-key certificate schemes based on Fiat-Shamir type signature schemes.

An off-line electronic coin system is presented that offers multi-party security and unconditional privacy of payments. The system improves significantly on the efficiency of the previously most efficient such system known in the literature, due to application of a recently proposed technique called secret-key certificates. By definition of secret-key certificates, pairs consisting of a public key and a matching certificate can be simulated with indistinguishable probability distribution. This allows a variety of polynomial-time reductions from a well-known signature scheme to the cash system. In particular, the withdrawal protocol can be proved to be restrictive blind with respect to one account holder, relying only on a standard intractability assumption; no such result has been proved before in the literature. Another consequence of the application of the secret-key certificate technique is that the withdrawal protocol is not a blind signature issuing protocol. This falsifies the popular belief that efficient privacy-protecting off-line electronic cash systems must be based on withdrawal protocols that are blind signature issuing protocols.

A minimal variation is proposed of a recently described secret-key certificate scheme that is derived from the Schnorr signature scheme.The issuing protocol of the variation is conjectured to be restrictive blind in parallel mode, motivated by a recent argument of Schoenmakers.The variation demonstrates that the double use of a generator is not problematic in any way, contrary to the belief expressed by Schoenmakers. A more profound argument for the conjectured security in parallel mode is provided, and similar variations are described for secret-key certificates based on Brickell-McCurley signatures. To create some order in the variety of restrictive blind certificate schemes that have been proposed to date, their specific merits and limitations are categorized and discussed.

Recently a class of secret-key certificate issuing protocols has been proposed that is believed to be restrictive blind when run in sequential mode. In this report an immunization technique is proposed for modifying these secret-key certificate issuing protocols in order to make them restrictive blind even when run in parallel mode. All the proofs of correctness for the underlying, unmodified protocols are fully preserved under the modification, as is their applicability to privacy-protecting mechanisms for value transport.

The notion of secret-key certificate schemes is introduced and formalized. As with public-key certificates, triples consisting of a secret key, a corresponding public key, and a secret-key certificate on the public key can only be retrieved by engaging in an issuing protocol with the issuer. The difference with public-key certificates is that pairs consisting of a public key and a secret-key certificate on the public key can be generated by anyone, with a distribution that is indistinguishable from the distribution according to which they are generated in the issuing protocol. Secret-key certificates offer the same functionality as do public-key certificates, because there is no point in using a public-key certificate scheme if the cryptographic actions that are to be performed with respect to a certified public key can be performed without knowing a corresponding secret key. The existence of efficient and secure secret-key certificate schemes is demonstrated by a generally applicable technique for deriving such schemes from signature schemes of a well-known type. The new notion is believed to be of interest in its own right, as it demonstrates an alternative to a stale paradigm in cryptography. More important are the practical advantages: secret-key certificates are better suited for the design of privacy-protecting mechanisms for signature transport, and can be used to construct secure public-key directories and conditional access mechanisms that provably do not leak information that can be of help to forge certificates.

Many signature transporting mechanisms require a signer to issue triples, consisting of a secret key, a matching public key, and a certificate of the signer on the public key. Of particular interest are so-called restrictive blind signature issuing protocols, in which the receiver can blind the issued public key and the certificate but not a certain predicate of the secret key. This paper describes the first generally applicable technique for designing efficient such issuing protocols, based on the recently introduced notion of secret-key certificates. The resulting three-move issuing protocols require the receiver to perform merely a single on-line multiplication, and the property of restrictive blinding can be proved with respect to a plausible intractability assumption. Application of the new issuing protocols results in the most efficient and versatile off-line electronic cash systems known to date, without using the blind signature technique developed by Chaum.

The receiver in a restrictive blind certificate issuing protocol can blind the issued public key and the certificate but not a certain blinding-invariant predicate of the secret key. Recently a generally applicable technique was described for designing restrictive blind issuing protocols for a certain type of secret-key certificates, and it was shown that the resulting issuing protocols should not be run in parallel since that would enable an attack in which completely blinded triples can be retrieved. To allow the signer in highly demanding applications to run the restrictive blind certificate issuing protocol in parallel mode, a simple technique for modifying the issuing protocols was proposed. In this note it is shown that the proposed modification technique does not overcome the parallel attack problem.

A new construction is described for designing secret-key certificate schemes based on signature schemes other than of the Fiat-Shamir type. Also described are practical secret-key certificate issuing protocols that enable the Certification Authority to certify public keys, without being able to compromise the confidentiality of the corresponding secret keys. Furthermore the design of secure showing protocols is discussed, exemplified by secret-key certificate schemes based on Fiat-Shamir type signature schemes.