Citation Context

...s secure against concurrent adversaries so is IB-BS. In particular, we obtain the first IB-BS scheme provably secure (in the standard model), against concurrent adversaries (by using the results from =-=[8, 26, 15]-=-), we obtain IB-BS schemes which do not employ bilinear pairings [4], and we obtain IB-BS schemes from any one-way trapdoor permutation [22, 15]. We now formally prove Theorem 4. First we recall the b...

Citation Context

...BDDHI (2 Biliear Decisional Diffie-Hellman Inversion) assumption was introduced by Boneh and Boyen [7] and its stronger variants (q-BDDHI for some polynomial q) already found numerous applications in =-=[7, 8, 9, 35]-=-. 1.2 Related Work and Comparison In [12] it was shown how to use “identity-based techniques” from [14] to obtain direct chosen-ciphertext secure public-key encryption schemes. The techniques from [12...

Citation Context

...h that authentication to different providers cannot be linked together. Finally, the BBS+ signature we analyzed can be regarded as an extension of a digital signature scheme very recently proposed by =-=[17]-=- to support signing of block of committed messages. Our Contributions. – we construct efficient dynamic k-TAA scheme. – we reduce the security of our scheme to well-known intractable assumptions in th...

Citation Context

...ity). Numerous blind signature schemes have been proposed, mostly under specific number-theoretic assumptions, some relying also on the random oracle model [26,1,3,4] and some forgoing random oracles =-=[9,18,24]-=-. Only the work by Juels et al. [17] addresses the construction of blind signatures under general assumptions explicitly, and deploys general two-party protocols and oblivious transfer based on trapdo...

Citation Context

...e received to check whether any of them has been spent more times than its nominal value (double-spending). If the later occurs, the identity of the double-spender is revealed. However, all the anonymous payment schemes demand excessive communication overhead for each transaction because there are a lot of messages that need to be exchanged between the sender and the path nodes.4 This requirement makes e-cash schemes impractical for our system. An alternative solution would be for all users to withdraw a special kind of anonymous coin from the Bank, which can simply be Bank blind endorsements [17], and use these coins to pay the intermediate Tor nodes. Ideal as it might initially seem, using a completely anonymous payment scheme with Tor has its drawbacks. First of all, there is no immediate accountability, since double-spending in this case will not reveal the doublespender. Thus, to prevent double-spending, any payments received should be immediately checked and deposited in the Bank. Unfortunately, im4 In the compact e-cash payment scheme [16], which is considered efficient a single “spend” procedure in e-cash systems would requires at least two rounds of message exchange between th...

Citation Context

.... We now show how to combine automorphic signatures with the Groth-Sahai (GS) proof system to construct the first round-optimal blind signature scheme, satisfying standard security requirements as in =-=[Oka06]-=-. Similarly to Fischlin’s generic construction, our blind signatures are defined as a proof of knowledge of a signature from an underlying scheme, which perfectly hides the signature. We thus only hav...

Citation Context

...bove protocols, as well as Lindell’s impossibility result, much recent work has focused on proving security for blind signature schemes in the concurrent setting by assuming a common reference string =-=[26, 21, 16]-=-. However, although Lindell’s impossibility result was used as justification for relying on a common reference string in these works, Lindell’s results do not apply if game-based security definitions ...