Leakage‐resilient lattice‐based partially blind signatures

IET Information SecurityVolume 13, Issue 6 p. 670-684 Research ArticleFree Access Leakage-resilient lattice-based partially blind signatures Dimitrios Papachristoudis, Corresponding Author dpapachristoudis@uom.edu.gr Computational Systems and Software Engineering Laboratory, Department of Applied Informatics, University of Macedonia, Thessaloniki, GreeceSearch for more papers by this authorDimitrios Hristu-Varsakelis, orcid.org/0000-0002-2186-0865 Computational Systems and Software Engineering Laboratory, Department of Applied Informatics, University of Macedonia, Thessaloniki, GreeceSearch for more papers by this authorFoteini Baldimtsi, Department of Computer Science, George Mason University, Fairfax, Virginia, USASearch for more papers by this authorGeorge Stephanides, Computational Systems and Software Engineering Laboratory, Department of Applied Informatics, University of Macedonia, Thessaloniki, GreeceSearch for more papers by this author Dimitrios Papachristoudis, Corresponding Author dpapachristoudis@uom.edu.gr Computational Systems and Software Engineering Laboratory, Department of Applied Informatics, University of Macedonia, Thessaloniki, GreeceSearch for more papers by this authorDimitrios Hristu-Varsakelis, orcid.org/0000-0002-2186-0865 Computational Systems and Software Engineering Laboratory, Department of Applied Informatics, University of Macedonia, Thessaloniki, GreeceSearch for more papers by this authorFoteini Baldimtsi, Department of Computer Science, George Mason University, Fairfax, Virginia, USASearch for more papers by this authorGeorge Stephanides, Computational Systems and Software Engineering Laboratory, Department of Applied Informatics, University of Macedonia, Thessaloniki, GreeceSearch for more papers by this author First published: 01 November 2019 https://doi.org/10.1049/iet-ifs.2019.0156Citations: 2AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract Blind signature schemes (BSS) play a pivotal role in privacy-oriented cryptography. However, with BSS, the signed message remains unintelligible to the signer, giving them no guarantee that the blinded message he signed actually contained valid information. Partially BSS (PBSS) were introduced to address precisely this problem. In this study, the authors present the first leakage-resilient, lattice-based PBSS in the literature. The proposed construction is provably secure in the random oracle model and offers quasi-linear complexity w.r.t. key/signature sizes and signing speed. In addition, it offers statistical partial blindness and its unforgeability is based on the computational hardness of worst-case ideal lattice problems for approximation factors in in dimension n. The proposed scheme benefits from the subexponential hardness of ideal lattice problems and remains secure even if a fraction of the signer's secret key leaks to an adversary via arbitrary side-channels. Several extensions of the security model, such as honest-user unforgeability and selective failure blindness, are also considered and concrete parameters for instantiation are proposed. 1 Introduction Typical digital signatures allow one party, termed the signer, to issue signatures on messages or documents, validating their authenticity. Such schemes primarily safeguard against impersonation of parties, tampering with messages, and repudiation. However, when it comes to privacy-sensitive applications such as electronic voting, e-cash, e-auctions, anonymous authentication via digital credentials, wireless sensor networks, or other cases in which preserving the confidentiality of a user is paramount, the functionality of conventional digital signatures falls short. Blind signature schemes (BSS) are a variant of digital signatures that were pioneered by Chaum in 1982 [1], and have since become a central point of industrial and academic interest. BSS separate the owner of a message from the signer by allowing the owner of the message to interact with the signer and obtain a signature on it that remains unintelligible from the signer's view. The resulting signature can still be verified against the signer's public key, just like with typical digital signatures. However, nobody – including the signer himself – can link a message–signature pair to a signing transcript. As one would suspect though, such a high level of privacy has some grave drawbacks. First, by design, blind signatures provide perfect confidentiality for the receiving user with regards to the message being signed. As a result, blind signatures can potentially provide a gateway for committing 'perfect' crimes [2] such as money laundering, blackmailing, and so on. Second, blind signing provides no guarantee to the signer that the blinded message he signed is of the right 'format' or contains some valid information that should be included in the message (e.g.: the denomination of a digital coin, the date a voucher was issued etc.). Moreover, given that the only attributes over which the signer has control are those bound to his public key, we might end up in a case where multiple keys need to be managed, resulting to an increased complexity for both the signer and verifiers [which is even more problematic if devices with constrained memory (e.g. smart-cards) are being used [3]]. Consider for example a signer that issues blind signatures which expire at the end of the week, then the signer's public key needs to be updated every week, or consider the case of e-cash with multiple denominations: the signer/bank will need to use a different public key for each allowable coin denomination. These major shortcomings of blind signatures spurred the research community to invent primitives with features that could bypass these issues. The two major models that have been proposed, in an effort to overcome these issues are: fair BSS [4, 5] and partially BSS (PBSS) [3, 6]. Fair blind signatures allow a trusted third party to revoke blindness in order to identify either the session during which a given signature was issued (session tracing), or a signature, given a signer's view of a specific session (signature tracing). On the other hand, partially blind signatures allow a signer and a user to include a commonly agreed upon piece of information (denoted info) to the signature. The key idea for achieving this in [6] was to adapt a method proposed in [7] by letting the signer use a secret key, along with two public keys, one of which includes info, with the help of a public hash function. As a result, the final signature is bound to these public keys and thus, to info as well. This approach has the benefit of greatly simplifying key management, because the signer only needs a single key in order to be able to include any auxiliary information (i.e. expiration date or denomination value). Note that PBSS do not immediately solve the problem of whether the blinded message to be signed is of the right format (this problem would be solved generically by including a zero-knowledge proof of knowledge on the format of the message), however, they provide an efficient way to make sure that the info part of the message included the necessary to application information and is of the right format. We would also like to mention that the more recent work of Rückert and Schröder [8] proposed a unified security model called fair partially blind signatures (FPBSS), which combines the security models of both aforementioned primitives into a single. Building a construction in that model would be ideal for real-world applications, balancing the individual needs of customers (blindness), service providers (partial control), and authorities (fairness), and is currently an open problem. However, when designing secure cryptographic schemes, one has to be mindful of developments both in technology and also in the field of cryptanalysis. Indeed, following the formulation of Shor's algorithm [9] in 1994, the need for alternative hardness assumptions that remain intractable even in the presence of quantum computers became as imperative as ever. By now, lattice-based cryptography is one of the predominant approaches for constructing provably secure and efficient cryptographic primitives that can withstand attacks even by a quantum computer. This is largely due to the fact that unlike number-theoretic hardness assumptions, there are no known algorithms for solving the lattice problems that are typically used at the foundation of cryptographic constructions, which has led to their conjectured intractability even against quantum computer attacks. Aside from quantum-resistance, lattices additionally have the unique feature of allowing for worst-case to average-case reductions. Phrased differently, a randomly selected (according to some distribution) problem instance is at least as hard to solve as some related lattice problem in the worst case. This feature not only allows us to reliably base security on worst-case hardness, but also greatly simplifies key selection for constructed cryptosystems. This extraordinary observation was first made by Ajtai in [10]. Moreover, lattice-based constructions are characterised by simplicity, efficiency, and parallelisability as one typically has to perform linear operations on vectors and matrices, as well as reductions modulo some small integer. Finally, lattice-based cryptography offers great versatility and is suitable for a plethora of advanced applications like: fully-homomorphic encryption, attribute-based encryption, general-purpose code obfuscation, hierarchical ID-based constructions, and much more. For a more detailed listing of applications, the reader is referred to surveys like [11]. 1.1 Contributions and related work A previous attempt to construct partially blind signatures from lattices was made in [12]. However, the construction of [12] does not prove partial blindness concretely and in fact seems to prove something weaker than the required notion as it relies on qualitative (if not ambiguous) properties of the signer that cannot be captured by the security model of PBSs. Furthermore, its scope is more limited compared to our proposal because it allows disclosures of the signed message which are acceptable in some applications (e-cash) but unacceptable in others (e-voting, e-auctions). Finally, the scheme of [12] is vulnerable to side-channel attacks, because of the use of discrete Gaussian sampling for the blind signing step [13-15]. We propose the first leakage-resilient, lattice-based PBSS in the literature. Our construction is inspired by the work of Rückert [16] which is currently the best known leakage-resilient BSS based on lattices. However, being a regular BSS, it is subject to the limitations discussed above. Our approach represents a significant step forward for PBSS because: First, because the vast majority of previous PBSS proposals [3, 6, 17-20] are based on number-theoretic assumptions, such as the hardness of large integer factorisation, or the computation of discrete logarithms. Unfortunately, the security of these schemes would be in jeopardy should a reasonable scale quantum computer be constructed, thanks to Shor's algorithm [9]. Consequently, all of these constructions are ill-suited for the post-quantum era. Second, although a tremendous amount of progress has been made in the design of conventional digital signatures from lattices over the past decade [21-30], there is a serious relative dearth when it comes to lattice-based blind signatures [16, 31] (the latter of which has recently been shown to be problematic [32]) despite their importance for privacy-preserving applications. Regarding efficiency, our construction is as efficient as the state-of-the-art lattice-based BSS in [16], both in terms of key sizes (ours are slightly smaller) and in computational complexity. However, our construction is not only one step closer to practical applications by allowing the inclusion of a commonly agreed piece of information in the final signature, but also relies on a milder – by a factor of n (the security parameter) – hardness assumption for the underlying worst-case lattice problem. This is important because one has to rely on as mild assumptions as possible in anticipation of attacks arising from emerging technologies. We show that all of the extensions considered in [16] are also satisfied by our scheme, along with an additional extension discussed in Section 5.1. In that case, we show that the efficient transformation that was proposed in [33] can also be used for PBSS, which we believe might be a result of interest on its own when designing such schemes. 1.1.1 Our technique and main challenges Extending [16] to a PBSS was conjectured to be possible in [34]. However, no suggestions as to how this could be realised were given, and the problem was not formally addressed until now as it apparently involved several technical challenges. As per the security model of PBSS [6], we need to show that our scheme is complete, partially blind, and unforgeable. Unfortunately, lattices lack the algebraic structure that is present in (finite) cyclic groups, and which very naturally allows one to achieve partial blindness by simply computing the product/sum of any group element with a random group element. This problem can be rectified through rejection sampling [16, 23], which allows us to make the distributions of exchanged messages, independent of the respective messages that they 'hide'. However, this comes at the price of added complexity. Reducing this complexity is by no means trivial: being able to avoid/simplify rejection sampling would in turn impact many other lattice-based constructions such as [16, 23, 26, 29]. The complexity introduced by rejection sampling makes all of the aforementioned security properties (as well as the extensions that we consider) non-trivial to achieve simultaneously because they are interconnected to one another. In particular: Completeness is hindered, meaning that even if both parties involved in the signature issuing protocol are honest, the protocol may need to be restarted. We address this issue in the same way as [16]. However, since it is possible for the signature issuing protocol to restart, it is important to make sure that both partial blindness and unforgeability hold, even across restarts. Regarding partial blindness, PBSS are built by combining the framework of [6] with witness-indistinguishable identification protocols. For this work, we will use (a slight variant of) the witness-indistinguishable identification scheme of [23] as a basis. However, due to the aforementioned rejection sampling strategy, it is not possible to apply the transformation of [6] in a straightforward manner. This is due to the fact that rejection sampling causes the coefficients of a blinded message to come from a larger set (roughly by a factor of at least n) than the original message's, whenever applied. This turns out to be problematic when we want to 'unblind' to produce the final signature. We address this issue by having the user send a 'shrinked' version of the blinded challenge to the signer (i.e. reducing it modulo the range of the challenge space's coefficients – typically, modulo 3), by carefully setting our scheme's multiple interconnected parameters, and analysing the distributions of messages exchanged between the two parties. Our scheme is shown to be partially blind and an important implication of our approach is obtaining a milder by n hardness assumption for our scheme's unforgeability property. In addition, we employ a statistically hiding commitment scheme to make sure that partial blindness is preserved across protocol restarts. Proving unforgeability is also non-trivial because a malicious user might falsely claim that he failed to obtain a valid signature out of a protocol execution, thus causing the protocol to abort and potentially 'buying' himself multiple valid signatures (this scenario would obviously be catastrophic for applications like e-cash or e-voting). We address this issue by introducing a fourth move to our signature issuing protocol, which serves as a special proof of failure in case the protocol has to be restarted and is akin to [16]. As in [16], we need to show that a malicious user cannot obtain a valid signature out of an aborted protocol execution, unless he is able to solve a computationally hard lattice problem. However, as we will see in Section 4.3.3, this is considerably trickier to achieve compared to [16] because in our PBSS setting there are multiple scenarios which may cause the protocol's restart (in [16] there is only one). Nevertheless, our construction's security will be formally proven in the random oracle model (ROM) [35] under standard worst-case lattice problems pertaining to ideals [36]. Finally, with respect to leakage resilience, we will show that if we impose an additional requirement on the size of one of our scheme's parameters, then it is also resistant against key-leakage via arbitrary side-channels. 1.1.2 Relationship between the present work and impossibility results for BSS In [37], the authors give an impossibility result for three-move BSS with the help of a meta-reduction (i.e. a reduction between reductions). Their approach plays the two security requirements of BSS (blindness and unforgeability) against each other, resulting in a proof that finding black-box reductions from unforgeability to non-interactive problems (like RSA, or discrete logarithm) is hard, unless the problems involved were already easy. Their work covers a broad class of BSS in the literature [1, 17, 38] and subsumes many prior impossibility results for BSS [39-41]. However, the main result of [37] does not apply to our construction. First, the results of [37] are given for BSS rather than PBSS which means that one would first have to show that a corresponding result also holds for PBSS. Second, [37] does not rule out reductions in the ROM [42, p. 3]. Third and most importantly, [37] only applies to BSS with at most three moves, that admit statistical signature-derivation checks (i.e. an observer can determine only from the public data and messages exchanged between a malicious signer and an honest user, whether the user successfully obtained a valid signature or not). In our four-move scheme however, it is impossible for one to tell whether the user truly obtained a valid signature or not within three moves because the user has not revealed all of the relevant information that he uses to produce his final signature. This is important because the components of the final signature must satisfy a certain relation but also fall within certain bounded domains for the signature to be deemed valid. This originates from our rejection sampling strategy and is in sharp contrast to previous number-theoretic BSS (and PBSS), where all of the final signature's components would always fall within some finite group (e.g. in the case of [1]), and thus checks like these would trivially be true due to finite group arithmetic rules. This is in accordance with an observation made by Fischlin and Schröder [37], stating that if the user sends a second message to the signer, which depends on his first message, then the resetting strategy of their meta-reduction cannot be applied. The same argument can also be used for [16]. Additionally, the fairly more recent results of [42] also do not apply to our work. The reason is that the results of that paper only concern schemes with a unique-witness relation between the public and secret key. While many constructions like the original Schnorr BSS fall under that category, our construction relies on a many-to-one witness relation between its public and secret keys (see Lemma 5 in Section 4.3.3). 1.2 Organisation of the paper The remainder of the paper is organised as follows. Section 2 sets the required theoretical and notational groundwork. In Section 3, we describe the formal security model of leakage-resilient PBSS. In Section 4, we give a detailed description of our construction and show that it abides by the formal security model of PBSS, and that it is leakage resilient. Once we have established the baseline security, we examine additional security properties for our proposal. 2 Preliminaries 2.1 Notation Throughout this paper, n will be used to denote the main security parameter. In order to formally define partially blind signatures, we adopt the following notation from [43]. Let and be two algorithms. We denote by , the joint execution of and in an interactive way with private inputs x and y, respectively. The respective private outputs are a for and b for . By , we mean that the interaction can occur at most k times, where . Accordingly, if can invoke an unbounded number of executions of an interactive protocol with in arbitrarily interleaved order, we write . Finally, means that can invoke arbitrarily ordered executions with and , but interact with each algorithm only once. An algorithm is considered efficient if it runs in probabilistic polynomial time. For asymptotics, we assume the standard Landau notation [44]. Additionally, we will use 'soft-' notation to ignore any polylogarithmic factors. We will write if x is sampled uniformly from a finite set S. If is a probabilistic algorithm, we will write to denote that the output of is assigned to y, and that is running with randomly chosen coins. All logarithms are considered to be base 2. We denote the concatenation of strings or matrix columns by . A positive function is called negligible in n if for any polynomial , there exists a , such that . A positive function is called noticeable (or non-negligible), if there exists a positive polynomial and a , such that . A function is called overwhelming if is negligible. Statistical distance provides us with a means of quantifying how 'far apart' two probability distributions (or random variables) are. Although there are many definitions of statistical distance in the literature, our analysis uses the following. Definition 1.(Statistical distance): Let X and Y be two discrete random variables over a (countable) set S . The statistical distance between X and Y is defined as .A well-known property of statistical distance is that it does not increase if we apply a function f to its arguments [45]. Lemma 1.: Let S and T be finite sets, X and Y are random variables taking values in S , and be a function. Then . 2.2 Rejection sampling Rejection sampling is a technique that allows us to draw samples from arbitrarily complex probability distributions. In [23], it was shown how this technique can be utilised to construct a canonical identification scheme from lattices. As this technique is a crucial component to understanding our construction, we give here a brief overview. Let be two integer numbers. Now, consider the set of constant random variables with respective probability mass functions: , and 0 otherwise. Furthermore, let Y be an independent, discrete uniform random variable, taking values in the set and with probability mass function: , and 0 otherwise. We now define a new random variable as the sum of and Y, for any fixed . Obviously, takes values in the set . The distribution of is thus the convolution of distributions and , and its probability mass function is given from the formula [46]: . Notice that if , then the above probability is zero. On the other hand, if , i.e. if , then the above probability equals . Therefore, the probability mass function of is and 0 otherwise. Thus, is just a 'shifted' version of by c 'places'. It is not difficult to notice that is uniformly distributed over . Thus, if we compute , and only output the result if it falls within (and resample Y otherwise), then each value will be equally likely to occur. As a result, we can use this technique to 'hide' the value of c (in other words, is distributed independently of c). We will revisit this discussion more formally in Section 4.3.2. 2.3 Commitment schemes Commitment schemes are fundamental cryptographic primitives that lie at the heart of many modern cryptographic protocols. Informally, they allow a party to commit to a certain value (or statement), while keeping the actual value hidden from all others, with the ability to reveal that value at a later point. Definition 2.(Commitment schemes): Let be a deterministic polynomial time algorithm, where n is a security parameter. A (non-interactive) commitment scheme consists of two protocols between two parties which are typically named 'sender' and 'receiver': Commit phase: The sender commits to a value by computing , where randomness , and sends C to the receiver. Reveal phase: The sender 'opens' commitment by revealing the 'decommitment' parameter r to the receiver. The receiver can then verify that . Commitment schemes need to satisfy two properties: hiding and binding. The hiding property requires that C does not reveal any information about the committed message , whereas the binding property requires that no algorithm can substitute the committed message with some other message , in such a way that , for some randomness . A commitment scheme is -hiding (resp. binding) if no algorithm exists running in time at most t, that can break the hiding (resp. binding) property with a probability of at least . Both properties can be satisfied computationally or unconditionally. It has been shown that a commitment scheme cannot be unconditionally hiding and unconditionally binding at the same time [47]. For our construction, we will assume a statistically -hiding and computationally -binding commitment scheme. As with [16], we can use a lattice-based cryptographic hash function such as [48] as a message authentication code to construct a purely lattice-based scheme. 2.4 Lattices A lattice is a set of points in n -dimensional space with a periodic structure. The easiest way to represent a lattice is as the set of all integer linear combinations of d linearly independent vectors . These vectors are called a basis for the lattice and are often represented as a matrix . We will write to express this fact. We say that the rank of the lattice is d and its dimension is n. If , the lattice is called full-rank. One of the main computationally hard problems involving lattices is the shortest vector problem (SVP) [10]. Definition 3.(The approximate SVP – ): Let be a lattice and . Find a vector , such that . SVP is conjectured to remain computationally intractable for polynomial approximation factors, even by quantum algorithms [49]. Here, we will focus on a special family of lattices that possess additional algebraic structure, called ideal lattices. In particular, throughout this paper, R will denote the polynomial ring , where q is a prime and is any monic, irreducible polynomial of degree n. For efficiency reasons, the preferred choice for is , where n is a power of 2 (although the ring-structure induced by this choice of allows for much shorter key-sizes and makes operations more efficient through the fast Fourier transform, it provides no further functionality [24, p. 2]). Furthermore, the ring of integers modulo q will be identified with the set It is not hard to see that with vector addition corresponding to polynomial addition, and matrix–vector multiplication corresponding to the convolution product (modulo and q) of polynomials in R. We will identify any polynomial with its coefficient vector (i.e. we will treat polynomials of and vectors of as equivalent). Conventionally, we will denote vectors in with boldface letters and m -tuples of vectors in with boldface letters and a hat. We slightly abuse notation and define and . A lattice corresponds to an ideal , iff every lattice vector is the coefficient vector of a polynomial in I. The SVP problem easily translates to ideal lattices and is called Ring-SVP. The average-case problem upon which we will base our construction's security is that of finding short vectors in the kernel of the family of module homomorphisms , when restricting the domain to , i.e. restricting the coefficients of the input to . This is the collision problem [36], which we now formally state. Definition 4.(Collision problem): Given a function , the collision problem is to find a distinct pair of preimages such that . Evidently, h is linear over , i.e. it satisfies , and . The collision problem can trivially be shown to be as hard as Ring-SIS [45] in the average case and transitively, at least as hard as Ring-SVP in the worst case. The next theorem from [36] provides this connection. Theorem 1.(Worst-case to average-case reduction): Let , where , and . An adversary that solves the problem, i.e. finds preimages such that and , can then use them to solve with approximation factors in the worst case. 3 Syntax and security model of leakage-resilient PBSS PBSS is an extension of regular blind signatures [1, 38, 50] and a simplification of FPBSS [8]. The security model for PBSS was formalised in [6]. A PBSS is comprised by three algorithms , where Sign is an interactive protocol executed between and . Their specification is the following: Key generation: Algorithm outputs a private signing key sk and a corresponding public verification key pk.