Using biometric key commitments to prevent unauthorized lending of cryptographic credentials

Efficient zero-knowledge proofs of knowledge (ZK-PoK) are basic building blocks of many practical cryptographic applications such as identification schemes, group signatures, and secure multiparty computation. Currently, first applications that critically rely on ZK-PoKs are being deployed in the real world. The most prominent example is Direct Anonymous Attestation (DAA), which was adopted by the Trusted Computing Group (TCG) and implemented as one of the functionalities of the cryptographic Trusted Platform Module (TPM) chip.Implementing systems using ZK-PoK turns out to be challenging, since ZK-PoK are, loosely speaking, significantly more complex than standard crypto primitives, such as encryption and signature schemes. As a result, implementation cycles of ZK-PoK are time-consuming and error-prone, in particular for developers with minor or no cryptographic skills.In this paper we report on our ongoing and future research vision with the goal to bring ZK-PoK to practice by making them accessible to crypto and security engineers. To this end we are developing compilers and related tools that support and partially automate the design, implementation, verification and secure implementation of ZK-PoK protocols.KeywordsSignature SchemeTrusted Platform ModuleKnowledge PropertyCryptology ePrint ArchiveSecure Multiparty ComputationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Regular (non-private) mining can be applied to manage and utilize accumulated transaction data. For example, the accumulated relative service time per user per month can be calculated given individual transaction from which the user compliance with a service agreement can be determined and possibly billing can be processed. Nevertheless, due to user concerns, cryptographic research developed transactions based on unlinkable anonymous credentials. Given the nature of anonymous credentials the ease of managing accumulated (e.g., per user) is lost. To restore the possibility of management and accumulation of it seems that a suitable form of preserving mining is needed. Indeed, preserving mining methods have been suggested for various protocols and interactions where individual can be contributed in an encrypted form, but not within the context of anonymous credentials. Given our motivation we suggest a new notion of performing privacy preserving mining within the context of anonymous cryptographic credential systems, so as to protect both the of individually contributed and the identity of their sources while revealing only what is needed. To instantiate our approach we focus on a primitive we call data mining group signatures (DMGS), where it is possible for a set of authorities to employ distributed quorum control for conducting preserving mining operations on a batch of transactions while preserving maximum possible anonymity. We define and model the new primitive and its security goals, we then present a construction and finally show its and security properties. Along the way we build a methodology that safely combines multi-server protocols as sub-procedures in a more general setting.

Optimized authentication algorithm for privacy-preserving anonymous credentials using randomized aggregate signatures

All humans are born with unique physically identified body characteristics to other persons which remains unchanged throughout life. These characteristics are taken into account by the emerging technology to get recognized from person to person. The technology used by the traditional human identification system sometimes becomes inefficient when data or images received are not up to the acceptable quality mark or when a person has a face covered with mask-like during epidemic virus fistula. In order to overcome such human recognition challenges, a Multi-biometric sustainable approach (D-nb) has been proposed using two uniquely identified modalities like foot and iris. This approach shrewdly identifies and makes the bodacious recognition among humans and suggests the sagacious result which is foremost better than the traditional biometric system.

We consider the problem of constructing anonymous credentials for use in a setting where the issuer of credentials is also the verifier, or more generally where the issuer and verifier have a shared key. In this setting we can use message authentication codes (MACs) instead of public key signatures as the basis for the credential system. To this end, we construct two algebraic MACs in prime-order groups, along with efficient protocols for issuing credentials, asserting possession of a credential, and proving statements about hidden attributes (e.g., the age of the credential owner). We prove the security of the first scheme in the generic group model, and prove the security of the second scheme\dash using a dual-system-based approach\dash under decisional Diffie-Hellman (DDH). Our MACs are of independent interest, as they are the only uf-cmva-secure MACs with efficient proofs of knowledge. Finally, we compare the efficiency of our new systems to two existing constructions of anonymous credentials: U-Prove and Idemix. We show that the performance of the new schemes is competitive with U-Prove (which does not have multi-show unlinkability), and many times faster than Idemix.

In an anonymous credential system, a user can obtain credentials from the organization and can prove the possession of credentials to the service providers, without leaking the privacy. There are three kinds of parties in the scheme: organization, service providers and users. In the previous works, the anonymous credentials schemes cannot prevent the collusion between the organization and the service providers from finding the users' privacy. In this paper, a scheme of anti-collusion anonymous credentials is proposed, it can be based on any secure public key algorithm. In the scheme, there doesn't need a trusted third party to issue the public keys and the secret keys, the scheme take the advantage of the relation of the public key and the secret key, i.e., it is easy to generate a pair of public key and the corresponding secret key, but hard to deduce the secret key from a particular public key. Therefore, the participant only need to have the ability to generate a pair of public key and secret key.

Secure identity tokens such as Electronic Identity (eID) cards are emerging everywhere. At the same time user-centric identity management gains acceptance. Anonymous credential schemes are the optimal realization of user-centricity. However, on inexpensive hardware platforms, typically used for eID cards, these schemes could not be made to meet the necessary requirements such as future-proof key lengths and transaction times on the order of 10 seconds. The reasons for this is the need for the hardware platform to be standardized and certified. Therefore an implementation is only possible as a Java Card applet. This results in severe restrictions: little memory (transient and persistent), an 8-bit CPU, and access to hardware acceleration for cryptographic operations only by defined interfaces such as RSA encryption operations.Still, we present the first practical implementation of an anonymous credential system on a Java Card 2.2.1. We achieve transaction times that are orders of magnitudes faster than those of any prior attempt, while raising the bar in terms of key length and trust model. Our system is the first one to act completely autonomously on card and to maintain its properties in the face of an untrusted terminal. In addition, we provide a formal system specification and share our solution strategies and experiences gained and with the Java Card.

An electrocardiogram (ECG) biometric system can be wearable and offers continuous authentication. It is suitable for medical applications and has proved its benefits over traditional biometric systems. In this paper, we propose a solution to protect the ECG reference template from eavesdroppers spying the wireless link (between the wearable device and the target application) to preserve the privacy of the ECG reference template. The scheme fulfils the ISO/IEC 24745 biometric template protection requirements. The proposed solution is based on linear prediction coding of the ECG extracted features. We add a specific secret key to enhance unlinkability and renewability of the protected template. We evaluate the authentication performance of the unprotected and the protected system with a large database. Theoretical and empirical evaluations show that the proposed system outstands the fuzzy commitment scheme in terms of algorithmic complexity and energy consumption while preserving the same authentication performances proving its effectiveness, and efficiency.

Similar to verifiable shuffling (mixing), we consider the problem of verifiable rotating a given list of homomorphic encryptions. The offset by which the list is rotated (cyclic shift) should remain hidden. Basically, we will present zero-knowledge proofs of knowledge of a rotation offset and re-encryption exponents, which define how the input list is transformed into the output list. We also briefly address various applications of verifiable rotation, ranging from `fragile mixing' as introduced by Reiter and Wang at CCS'04 to applications in protocols for secure multiparty computation and voting. We present two new, efficient protocols. Our first protocol is quite elegant and involves the use of the Discrete Fourier Transform (as well as the Fast Fourier Transform algorithm), and works under some reasonable conditions. We believe that this is the first time that Fourier Transforms are used to construct an efficient zero-knowledge proof of knowledge. Our second protocol is more general (requiring no further conditions) and only slightly less efficient than the DFT-based protocol. Unlike the previously best protocol by Reiter and Wang, however, which relies on extensive use of verifiable shuffling as a building block (invoking it four times as a sub-protocol), our construction is direct and its performance is comparable to the performance of a single run of the best protocol for verifiable shuffling.

The Power of Preprocessing in Zero-Knowledge Proofs of Knowledge

The current credentialing process for physicians struggled to accommodate fluctuating regional demands for providers during the severe acute respiratory syndrome coronavirus 2 pandemic. This hurdle highlighted existing inefficiencies and difficulties facing healthcare systems across the world and led us to explore how credentialing can be improved using digital technologies. We explain how this is a critical moment to make the shift from physical to digital credentials by specifying how a digital credentialing system could simplify onboarding for providers, enable secure expansion of telehealth services, and enhance information exchange.

Biometrics are increasingly used for access control, fraud detection, and authentication systems. Nevertheless, attackers can deceive such systems using forged biometrics. This research proposes a novel method that makes biometric security systems more resilient to such attacks. The proposed method transforms the user’s biometric data into an irreversible code to protect the original data. This code combines data from multiple biometric modalities, making fabricating a false biometric harder. Additionally, the proposed method does not depend on any secret keys, which helps avoid cases of stolen tokens. The proposed method utilizes the generative adversarial network (GAN) to generate synthetic biometric templates from multiple modalities, which is considered a transformation function for biometric data. Three fusion levels are presented; features from multiple biometric modalities are extracted first in each fusion level. Subsequently, the features train a generative adversarial network to produce synthesized biometric templates. These synthesized templates serve as secure substitutes for the original biometrics during authentication, preventing direct exposure of raw biometric data. We evaluated our methods on the CASIA-V3-Internal and MMU1 iris datasets and the AT&T (ORL) and FERET face datasets. The results showed that our proposed methods can achieve higher accuracy, usability, and improved security compared to a single biometric modality. The proposed feature-level, GAN-based, and decision-level fusion schemes achieved 2.03%, 0.82%, and 0.0297% error rates, respectively, for CASIA and ORL datasets and 1.53%, 0.80%, and 0.0313% error rates, respectively, for MMU1 and FERET datasets. Moreover, we have demonstrated that our method resists pre-image and correlation attacks.

Anonymous credentials are protocols in which users obtain certificates from organizations and subsequently demonstrate their possession in such a way that transactions carried out by the same user cannot be linked. We present an anonymous credential scheme with non-interactive proofs of credential possession where credentials are associated with a number of attributes. Following recent results of Camenisch and Gros (CCS 2008), the proof simultaneously convinces the verifier that certified attributes satisfy a certain predicate. Our construction relies on a new kind of P-signature, termed block-wise P-signature , that allows a user to obtain a signature on a committed vector of messages and makes it possible to generate a short witness that serves as a proof that the signed vector satisfies the predicate. A non-interactive anonymous credential is obtained by combining our block-wise P-signature scheme with the Groth-Sahai proof system. It allows efficiently proving possession of a credential while simultaneously demonstrating that underlying attributes satisfy a predicate corresponding to the evaluation of inner products (and therefore disjunctions or polynomial evaluations). The security of our scheme is proved in the standard model under non-interactive assumptions.

We extend the Camenisch-Lysyanskaya anonymous credential system such that selective disclosure of attributes becomes highly efficient. The resulting system significantly improves upon existing approaches, which suffer from a linear number of modular exponentiations in the total number of attributes. This limitation makes them unfit for many practical applications, such as electronic identity cards. Our novel approach can incorporate a large number of binary and finite-set attributes without significant performance impact. It compresses all such attributes into a single attribute base and, thus, boosts the efficiency of all proofs of possession. The core idea is to encode discrete binary and finite-set values as prime numbers. We then use the divisibility property for efficient proofs of their presence or absence. In addition, we contribute efficient methods for conjunctions and disjunctions. The system builds on the strong RSA assumption. We demonstrate the aptness of our method in realistic application scenarios, notably electronic identity cards, and show its advantages for small devices, such as smartcards and cell phones.

Security credential systems are used by vehicles to secure communications in Cooperative Intelligent Transportation Systems (C-ITS). Privacy protection of vehicles/passengers is ensured by a pseudonymization mechanism of communication identities and certificates. Vehicles request pseudonym certificates from the Public Key Infrastructure (PKI) and change them frequently. They renew their certificates pool by requesting new certificates from the PKI.In this paper, we present and discuss the performance of pseudonym certificate reloading from the PKI over cellular network (4G). We conducted several tests, statically and while driving, in order to evaluate the performance in both scenarios.