Enhanced privacy id

Direct Anonymous Attestation (DAA) has been adopted in Trusted Platform Module v 1.2 (TPM v1.2) Specification, described by Trusted Computing Group (TCG). It intends to solve the trusted platform attestation and the platform privacy protection. In DAA, the certificate can be used repeatedly and this will provide the opportunities for rogue TPMs to initiate the replay attacks. For identifying the rogue platform, DAA cannot but use a relatively fixed pseudonym rather than a random pseudonym, which would badly weaken the anonymity of the platform. To tackle this problem, a time-and-times-limited strong DAA (TTLS-DAA) scheme, which extends DAA by adding valid period of time and restriction of times into the certificate, is put forward. Since the pseudonym of the user platform is different for each attestation, TTLS-DAA provides stronger anonymity. Being able to control the use of the certificate, it can be widely used in practice especially in commercial fields.

This paper describes the direct anonymous attestation scheme (DAA). This scheme was adopted by the Trusted Computing Group (TCG) as the method for remote authentication of a hardware module, called Trusted Platform Module (TPM), while preserving the privacy of the user of the platform that contains the module. DAA can be seen as a group signature without the feature that a signature can be opened, i.e., the anonymity is not revocable. Moreover, DAA allows for pseudonyms, i.e., for each signature a user (in agreement with the recipient of the signature) can decide whether or not the signature should be linkable to another signature. DAA furthermore allows for detection of known keys: if the DAA secret keys are extracted from a TPM and published, a verifier can detect that a signature was produced using these secret keys. The scheme is provably secure in the random oracle model under the strong RSA and the decisional Diffie-Hellman assumption.

In network-connected UAV (NC-UAV) communication systems, user authentication is replaced by platform identity authentication and integrity check because many NC-UAVs are operated without human intervention. Direct anonymous attestation (DAA) is an attractive cryptographic scheme that provides an elegant balance between platform authentication and anonymity. However, because of the low-level computing capability and limited transmission bandwidth in UAV, the existing DAA schemes are not suitable for NC-UAV communication systems. In this paper, we propose an enhanced DAA scheme with mutual authentication (MA-DAA scheme), which meets the security requirements of NC-UAV communication systems. The proposed MA-DAA scheme, which is based on asymmetric pairings, bundles the identities of trusted platform module (TPM) and Host to solve the malicious module changing attacks. Credential randomization, batch proof and verification, and mutual authentication are realized in the MA-DAA scheme. The computational workload in TPM and Host is reduced in order to meet the low computation and resource requirements in TPM and Host. The entire scheme and protocols are presented, and the security and efficiency of the proposed MA-DAA scheme are proved and analyzed. Our experiment results also confirm the high efficiency of the proposed scheme.

Direct Anonymous Attestation (DAA) is a cryptographic protocol for privacy-protecting authentication. It is standardized in the TPM standard and implemented in millions of chips. A variant of DAA is also used in Intel’s SGX. Recently, Camenisch et al. (PKC 2016) demonstrated that existing security models for DAA do not correctly capture all security requirements, and showed a number of flaws in existing schemes based on the LRSW assumption. In this work, we identify flaws in security proofs of a number of qSDH-based DAA schemes and point out that none of the proposed schemes can be proven secure in the recent model by Camenisch et al. (PKC 2016). We therefore present a new, provably secure DAA scheme that is based on the qSDH assumption. The new scheme is as efficient as the most efficient existing DAA scheme, with support for DAA extensions to signature-based revocation and attributes. We rigorously prove the scheme secure in the model of Camenisch et al., which we modify to support the extensions. As a side-result of independent interest, we prove that the BBS+ signature scheme is secure in the type-3 pairing setting, allowing for our scheme to be used with the most efficient pairing-friendly curves.

Direct anonymous attestation (DAA) is an anonymous authentication scheme adopted by the Trusted Computing Group in its specifications for trusted computing platforms. This paper presents an efficient construction that implements all anonymous authentication features specified in DAA, including authentication with total anonymity, authentication with variable anonymity, and rogue TPM tagging. The current DAA construction is mainly targeted for powerful devices such as personal computers, and their corresponding application areas, but is not entirely suitable for embedded devices with limited computing capabilities (e.g., cell phones or hand-held PDAs). We propose a new construction with more efficient sign and verify protocols, making it more attractive for embedded devices. We prove that the new construction is secure under the strong RSA assumption and the decisional Diffie-Hellman assumption.

In this paper, we present a new system for anonymous authentication, which allows a user to prove possession of an authenticated credential while not revealing his or her identity. Our system is an extension of an existing group signature scheme, providing additional features drawn from work on traceable signatures and direct anonymous attestation. Our first extension, a property taken from traceable signatures, allows a signer to later "claim" a signature, proving that they are indeed the individual who created this signature. Our second extension, taken from the work on direct anonymous attestation, allows a prover and verifier to agree on the degree of linkability of transactions, ranging from completely unlinkable transactions, to being able to link transactions made within a fixed time period (like a day), to completely linkable transactions. Our scheme is efficient enough to be practical, and is proved to be secure under the strong RSA assumption and the decisional Diffie-Hellman assumption

Direct Anonymous Attestation is TPM2’s method of providing mathematically-proven anonymity or pseudonymity for signing keys in trusted platforms. The simple explanation of how DAA works is that it has a single verification (public) key but a plethora of signing (private) keys. One cannot tell which of many platforms created the signature. This chapter provides a more thorough explanation and enables one to understand (amongst other things) why one can’t tell whether two anonymous DAA signatures were created under the same private key, but can tell whether two pseudonymous DAA signatures were created under the same private key. This chapter is intended for readers with a background or interest in mathematics and/or cryptography.

Fog Computing is a decentralized infrastructure layer between Cloud and Edge Devices moving the computation closer to the edge, allowing good latency and bandwidth even for large-scale Internet of Things deployments. Still, devices using fog services are exposed to the immediate application environment and potentially malicious users, thus security, privacy, and trust are critical issues. To provide trust and privacy within fog infrastructures, enabling the secured execution of future Internet of Things services, lightweight collective and distributed attestation mechanism for the bulk attestation of the edge devices and the fog infrastructure can be used, especially leveraging Direct Anonymous Attestation, an anonymous attestation signature that allows attesting to the state of the host system, without violating the specified privacy of the host. As in all cryptographic schemes the management and protection of keys is of the highest significance. We present key management for a fog architecture in the context of the RAINBOW fog platform and show how the computations of a recently published proof-of-concept implementation of Direct Anonymous Attestation can be distributed in our specific fog environment. We provide details on an embedded system-level implementation and performance benchmarks for Internet of Things applications keys stored with proper hardware-based protection within a Trusted Platform Module.

Direct Anonymous Attestation (DAA) is a special signature scheme that enables remote authentication of a user while preserving privacy under the user's control. Thus, in this paper, based on existing schemes and mechanisms, we firstly construct a DAA signature scheme which is proven secure without random oracles. By making certain reasonable assumptions and employing the techniques of non-interactive zero-knowledge(NIZK) proof system and Two-Party Computation(2PC) scheme, we prove that our scheme satisfies anonymous and untraceable, and compares with existing DAA schemes in the aspects of security and efficiency.

Efficient zero-knowledge proofs of knowledge (ZK-PoK) are basic building blocks of many practical cryptographic applications such as identification schemes, group signatures, and secure multiparty computation. Currently, first applications that critically rely on ZK-PoKs are being deployed in the real world. The most prominent example is Direct Anonymous Attestation (DAA), which was adopted by the Trusted Computing Group (TCG) and implemented as one of the functionalities of the cryptographic Trusted Platform Module (TPM) chip.Implementing systems using ZK-PoK turns out to be challenging, since ZK-PoK are, loosely speaking, significantly more complex than standard crypto primitives, such as encryption and signature schemes. As a result, implementation cycles of ZK-PoK are time-consuming and error-prone, in particular for developers with minor or no cryptographic skills.In this paper we report on our ongoing and future research vision with the goal to bring ZK-PoK to practice by making them accessible to crypto and security engineers. To this end we are developing compilers and related tools that support and partially automate the design, implementation, verification and secure implementation of ZK-PoK protocols.KeywordsSignature SchemeTrusted Platform ModuleKnowledge PropertyCryptology ePrint ArchiveSecure Multiparty ComputationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The Direct Anonymous Attestation scheme allows to map procedures with an imperative requirement for anonymity, such as voting, to the electronic world while offering provable security. However, the scheme is complex and requires demanding computations to be performed on a tamper-proof device. Such devices, e.g. secure smart cards, are typically resource constrained. We present the first implementation of the (simplified) Direct Anonymous Attestation protocols suitable for contemporary Java Card smart cards. We point out performance bottlenecks and provide efficient solutions which allow our implementation to terminate within acceptable time.

We introduce a new privacy-friendly cryptographic primitive we call Direct Anonymous Attestations with Dependent Basename Opening (DAA-DBO). Such a primitive is a Direct Anonymous Attestation in which the anonymity can be revoked only if a specific authority, called the admitter, allowed to revoke the DAA signatures that include a specific basename. We also present an efficient scheme that achieves this functionality, secure in the random oracle model. Furthermore, we provide a prototype implementation of an anonymous transit pass system, based on this new primitive. Compared to previous privacy-friendly cryptographic primitives with partial linkability, we provide a way to share the power to open signatures between two entities which is more practical than the use of conventional techniques from threshold cryptography.KeywordsPrivacy-enhancing cryptographyDirect anonymous attestationsDependent anonymity revocation

Recently, the notion of the key-insulated public- key system has been suggested to protect the security of users' private keys. A general idea of this system is changing the user's private key along with the time, but the user's public key remains unchanged. In this paper, we propose a new identity (ID)-based key-insulated signature scheme from bilinear pairings. As compared with the recently proposed ID-based key-insulated signature schemes, our proposed scheme has better performance in the batch verifying phase. For security analysis, our scheme is a provably secure key-insulated signature scheme in the random oracle model and under the computational Diffie-Hellman assumption. Meanwhile, to demonstrate the additional advantage of a key-insulated signature, we present a novel application based on the proposed scheme, called full delegation ID-based proxy signature scheme with time restriction. To our best knowledge, no such a proxy signature scheme is proposed until now.

Larp-Protocol for Secure Location Services based on Direct Anonymous Attestation (DAA) Scheme in Manet

Identity-based revocation system (IBRS) generates the ciphertext with a revoked identity list such that only the non-revoked identities can use their private keys to decrypt this ciphertext. IBRS can be efficiently applied in some practical applications, such as the pay-TV systems when the number of revoked identities are much less than the non-revoked ones. However, since IBRS is based on identity-based cryptography, it also suffers from the inherent key escrow problem where the private key generator (PKG) has full control of each user’s private key. As a consequence, it is hard to judge whether a pirated private key is generated by the PKG or the suspected user. There is no study on IBRS fulfilling accountability in literature to date. In this paper, we introduce the notion of accountable authority IBRS (A-IBRS), which provides accountability in IBRS schemes. In an A-IBRS, the aforementioned problem can be alleviated and resolved. Furthermore, a full black-box A-IBRS can distinguish the creator of a black box between the PKG and the associated user and the dishonest PKG is allowed to access the decryption results of the user private key. We formalize the definition and security models of the full black-box A-IBRS schemes. Then, we present a concrete full black-box A-IBRS scheme with constant-size master public key and private key. Finally, we prove the security of our scheme under the defined security models without random oracle.