Anonymous Credential System with Efficient Proofs for Monotone Formulas on Attributes

Abstract

An anonymous credential system allows a user to convince a service provider anonymously that he/she owns certified attributes. Previously, a system to prove AND and OR relations simultaneously by CNF formulas was proposed. To achieve a constant-size proof of the formula, this system adopts an accumulator that compresses multiple attributes into a single value. However, this system has a problem: the proof generation requires a large computational time in case of lots of OR literals in the formula. One of the example formulas consists of lots of birthdate attributes to prove age. This greatly increases the public parameters correspondent to attributes, which causes a large delay in the accumulator computation due to multiplications of lots of parameters. In this paper, we propose an anonymous credential system with constant-size proofs for monotone formulas on attributes, in order to obtain more efficiency in the proof generation. The monotone formula is a logic formula that contains any combination of AND and OR relations. Our approach to prove the monotone formula is that the accumulator is extended to be adapted to the tree expressing the monotone formula. Since the use of monotone formulas increases the expression capability of the attribute proof, the number of public parameters multiplied in the accumulator is greatly decreased, which impacts the reduction of the proof generation time.

A Security Model of Anonymous Credential System

This security model is similar to the previos work [3].

1.1 A.1 Misauthentication Resistance

Consider the following misauthentication resistance game.

• Misauthentication Resistance Game: The challenger runs IssuerKeyGen, and obtains ipk and isk. He provides $\mathcal{A}$ with ipk, and run $\mathcal{A}$. He sets CU with empty, where CU denotes the set of IDs of users corrupted by $\mathcal{A}$. In the run, $\mathcal{A}$ can query the challenger about the following issuing query:

  • C-Issuing: $\mathcal{A}$ can request the certificates on attribute set $U^{(\mathsf {i})}$ of user $\mathsf {i}$. Then, $\mathcal{A}$ as the user executes CertObtain protocol with the challenger as the issuer.

  Finally, $\mathcal{A}$ outputs a monotone formula $\mathcal {M}^*$, and a proof $\sigma ^*$.

Then, $\mathcal{A}$ wins if

• 1. $\mathbf{Verify}(ipk, \sigma ^*, \mathcal {M}^*) = \mathrm{valid}$, and

• 2. for all $\mathsf {i}\in CU$, $U^{(\mathsf {i})}$ does not satisfy $\mathcal {M}^*$.

Misauthentication resistance requires that for all PPT $\mathcal {A}$, the probability that $\mathcal{A}$ wins the misauthentication resistance game is negligible.

1.2 A.2 Anonymity

Consider the following anonymity game.

• Anonymity Game: The challenger runs $\mathbf{IssuerKeyGen}$, and obtains ipk, isk. He provides $\mathcal{A}$ with ipk, isk, and run $\mathcal{A}$. He sets HU with empty. In the run, $\mathcal{A}$ can query the challenger, as follows.

  • H-Issuing: $\mathcal{A}$ can request the certificates on attribute set $U^{(\mathsf {i})}$ of user $\mathsf {i}$. Then, $\mathcal{A}$ as the issuer executes CertObtain protocol with the challenger as the user. The challenger adds this user to HU.

  • Proving: $\mathcal{A}$ can request the user $\mathsf {i}$’s proof on formula $\mathcal {M}$. Then, the challenger responds the proof on $\mathcal {M}$ of the user $\mathsf {i}$, if the user is in HU.

  During the run, as the challenge, $\mathcal{A}$ outputs a formula $\mathcal {M}$, and two users $\mathsf {i}_0$ and $\mathsf {i}_1$, such that both $U^{(\mathsf {i}_0)}$ and $U^{(\mathsf {i}_1)}$ satisfy ${\mathcal {M}}^*$. If $\mathsf {i}_0\in HU$ and $\mathsf {i}_1\in HU$, the challenger chooses $\phi \in _R \{0,1\}$, and responds the proof on ${\mathcal {M}}^*$ of user $\mathsf {i}_{\phi }$. After that, similarly, $\mathcal {A}$ can make the queries.

  Finally, $\mathcal {A}$ outputs a bit $\phi '$ indicating its guess of $\phi$.

If $\phi '=\phi$, $\mathcal {A}$ wins. We define the advantage of $\mathcal {A}$ as $|\mathrm{Pr}[\phi '=\phi ]-1/2|$.

Anonymity requires that for all PPT $\mathcal {A}$, the advantage of $\mathcal{A}$ on the anonymity game is negligible.