# PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments
## 5 Construction of PriSign
### Concrete Construction  
In this section, we present a concrete instantiation of the PriSign scheme based on the ABCT scheme in Section 5.2.1, the ABCB scheme in Section 5.2.2, the TIPFE scheme in Section 5.2.3, and [PERSON]'s SPS scheme [33]. * \(\mathsf{PriSign.Setup}(1^{\lambda},q,n,t,k)\rightarrow(pp,msk,mpk,\mathcal{L})\): As shown in Figure 8, CA runs BIGen to generate public parameters (a Type-III bilinear group) for other algorithms of PriSign scheme, runs \(\mathsf{Groth.KeyGen}\) to generate keys used to issue public-key credentials for issuers, runs ABCT.CredKeyGen to generate keys used to issue attribute-based credentials for users, and runs TIPFE.Setup to generate the keys used to issue keys for policymakers. Finally, it sets the public parameters \(pp\), master secret key \(msk\), master public key \(mpk\), and user registration list \(\mathcal{L}\). * \(\mathsf{PriSign.IssuerKeyGen}(1^{\lambda},q,n,t,k)\): \(-\) Rin \(\mathcal{E}=(G_{1},G_{2},G_{T},r,p,\vec{g},\vec{g})\leftarrow\mathsf{BIGen}(1^ {\lambda})\). * Set \(l-2\), runs \((msk,mpk),\mathcal{L}\leftarrow\mathsf{ABCT.CredKeyGen}((\mathcal{E},q))\). * Run \((mpk,msk_{p})\leftarrow\mathsf{TIPFE.Setup}(\mathcal{B},\mathcal{L},n,t,k)\). * Output \(pp=(\mathcal{B},Q,n,t,k,l)\), \(msk=(msk_{i},msk_{u},msk_{p})\), \(mpk=(mpk_{i},mpk_{u},mpk_{p})\), and \(\mathcal{L}=\emptyset\). Figure 8: Setup algorithm. Figure 9: Issuer Registration algorithm. * \(\mathsf{PriSign.IsSplKey}(psk_{i},vid,\vec{v})\to tk_{vid,\vec{v},i}\): The policymaker \(i\) runs \(dk_{vid,\vec{v},i}\leftarrow\mathsf{TIPFE}\). Extract\((psk_{i},vid,\vec{v})\) to issue a share of the policy key to a verifier with identity \(vid\) and policy \(\vec{v}\). * \(\mathsf{PriSign.AggrPolKey}(vid,\vec{v},\{dk_{vid,i},mpk_{i}\})\to tk_{vid,\vec{v}}\): The verifier \(vid\) runs \(dk_{vid,\vec{v}}\)\(\leftarrow\mathsf{TIPFE}\).KeyAgg\((vid,\{dk_{vid,\vec{v},i},ppk_{i}\})\) to obtain a compact policy key. * \(\mathsf{PriSign.UserKeyGen}(pp)\rightarrow(usk,upk,utk)\): A user runs \((usk,upk,utk)\leftarrow\mathsf{ABCT}\). UserKeyGen\((pp)\) to create their private key, public key, and tracing key. * \(\mathsf{PriSign.UserReg}(\mathsf{U}(uid,usk,upk,utk,\{m_{j}\}_{i\in[4]}) \leftrightarrow\mathsf{CA}(msk,mpk,\mathcal{L}))\rightarrow(ucred,\mathcal{L}^ {\prime})\) /\(\bot\): CA and a user run \((ucred,\mathcal{L}^{\prime})\leftarrow\langle\mathsf{ABCT}.\mathsf{Issue.U}(uid, usk,upk,utk,\{m_{j}\}_{j=1}^{q})\leftrightarrow\mathsf{ABCT}.\) Issue.I\((msk_{u},mpk_{u},\mathcal{L})\rangle\) to create a credential for the user. * \(\mathsf{PriSign.OptTkt}(\mathsf{U}(usk,upk,ucred,\{m_{j}\}_{j\in[1,4]},\mathcal{D },\mathsf{CTX})\leftrightarrow\{(isk,ipk,icred)\})\rightarrow(pst,tkt,dsid, VP)/\bot\): As shown in Figure 10, I computes a ZKSoK \(\Pi_{5}\) to prove to the user that it has been authenticated by CA. After verifying [PERSON]'s \(\Pi_{5}\) and credential \(icred\), U computes a credential presentation \(pqst\) by executing \(\mathsf{ABCT}.\)Show, then randomly selects a double-spend identity for the ticket, blinds it by executing \(\mathsf{ABCB}.\)PreBlind, and sends \((pqst,\mathsf{C})\) to I. [PERSON] verifies the correctness of the user credential and chooses a validity period \(VP\) for the ticket, then computes a ticket \(\tau^{\prime}\) by executing \(\mathsf{ABCB}.\)Blind. * \(\mathsf{PriSign.Trace}(msk,\mathcal{L},pqst)\to uid/\bot\): CA runs \(uid\leftarrow\mathsf{ABCT}.\mathsf{Trace}(mpk_{u},pqst,\mathsf{CTX}, \mathcal{L})\) to trace the user's identity. * \(\mathsf{PriSign.SignOn}(tkt,dsid,VP,\vec{u},mpk)\to tok/\bot\): As shown in Figure 11, U computes a ticket presentation \(tok^{\prime}\) by executing \(\mathsf{ABCB}.\)Show, then randomly selects an encryption key \(K\) and encrypts the presentation information \((tok^{\prime},dsid,VP,ipk)\) using the AES-CTR algorithm [39; 40] to achieve token-hiding.