匿名憑證系統能讓使用者在電子交易中不洩漏個人的私密資訊, 進而保護自己的隱私安全。
匿名憑證系統使用了零知識證明手法, 使用者只需揭露少量的屬性就能證明自己身份的真實性, 驗證者也很難得知使用者的真實身份。
在使用者提出相關的憑證後, 使用者可利用累積器 (accumulator) 證明憑證的合法性。
在現存的累積器系統中, 當使用者加入或被撤銷時, 所有的使用者都必須更新自己憑證的 witness, 這讓累積器系統變得不切實際。

在本論文中, 我們檢驗現有的動態累積器的安全性, 並且提出一個新穎又有效率的證明方法, 名為動態反向累積器。
在我們的系統中, 合法使用者的 witness 只在有人被撤銷時才需進行更新, 這使得使用者更新憑證的頻率大幅地減少。

Anonymous credential schemes have been widely employed to prove the authenticity of users while users reveal few specific attributes.
The schemes make users keep their real identities away from the verifier.
Furthermore, an accumulator is used to demonstrate the validity of the credential when a user presents the corresponding certificate.
In existing accumulator schemes, all credential holders have to update their witnesses
if any user joins or is removed from the system, so these schemes become impractical.
In this thesis, the security of the dynamic accumulator scheme will be examined.
Furthermore, a novel and more efficient approach of validity proof, namely the dynamic reversed accumulator, is proposed.
In the proposed dynamic reversed accumulator, the witness needs to be updated only if users are revoked.

Bibliography

[1] T. Acar, S. S.M. Chow, and L. Nguyen, “Accumulators and U-Prove Revocation,”
Proc. of the 17th International Conference on Financial Cryptography and Data Security - FC ’03, LNCS Vol. 7859, pp. 189–196, 2013.
[2] G. Ateniese, D. Song, and G. Tsudik, “Quasi-Efficient Revocation of Group Signatures,”
Proc. of the 6th International Conference on Financial Cryptography - FC ’02, LNCS 2357, pp. 183–197, 2002.
[3] M. Backes, J. Camenisch, and D. Sommer, “Anonymous Yet Accountable Access Control,”
Proc. of the 2005 ACM Workshop on Privacy in the Electric Society, pp. 40–46, 2005.
[4] J. Benaloh and M. de Mare, “One-way Accumulators: A Decentralized Alternative to Digital Signatures,”
Advances in Cryptology - EUROCRYPT ’93, LNCS Vol. 765, pp. 274–285, 1993.
[5] N. Baric ́ and B. Pfitzmann, “Collision-Free Accumulators and Fail-Stop Signature Schemes Without Trees,”
Advances in Cryptology - EUROCRYPT ’97, LNCS Vol. 1233, pp. 480–494, 1997.
[6] J. Camenisch, M. Kohlweiss, and C. Sorirnte, “An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials,”
Proc. of the 12th International Conference on Practice and Theory in Public Key Cryptography - PKC ’09, LNCS Vol. 5443, pp. 481–500, 2009.
[7] J. Camenisch, M. Kohlweiss, and C. Soriente, “Solving Revocation with Efficient Update of Anonymous Credentials,”
Proc. of the 7th International Conference on Security and Cryptography for Networks - SCN ’10, LNCS 6280, pp. 454–471, 2010.
[8] J. Camenisch and T. Groß, “Efficient Attributes for Anonymous Credentials,”
Proc. of the 15th ACM Conference on Computer and Communications Security - CCS ’08, pp. 345–356, 2008.
[9] J. Camenisch and E. Van Herreweghen, “Design and Implementation of the Idemix Anonymous Credential System,”
Proc. of the 9th ACM Conference on Computer and Communications Security - CCS ’02, pp. 21–30, 2002.
[10] J. Camenisch and A. Lysyanskaya, “Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials,”
Advances in Cryptology - CRYPT0 ’02, LNCS Vol. 2442, pp. 61–76, 2002.
[11] J. Camenisch and A. Lysyanskaya, “A Signature Scheme with Efficient Protocols,”
Proc. of the 3rd International Conference on Security in Communication Networks - SCN ’02, LNCS Vol. 2576, pp. 268–289, 2003.
[12] J. Camenisch, “Efficient and Generalized Group Signatures,”
Advances in Cryptology - EUROCRYPT ’97, LNCS Vol. 1233, pp. 465–479, 1997.
[13] L. Chen and T.P. Pedersen, “New Group Signature Schemes,”
Advances in Cryptology - EUROCRYPTO ’94, LNCS Vol. 950, pp. 171–181, 1995.
[14] N. Fazio and A. Nicolosi, “Cryptographic Accumulators : Definitions, Constructions and Applications,”
Technical report, 2002.
[15] E. Fujisaki and T. Okamoto, “Statistical Zero Knowledge Protocols to Prove Modular Polynomial Relations,”
Advances in Cryptology - CRYPTO ’97, LNCS Vol. 1294, pp. 16–30, 1997.
[16] H.J. Kim, J.I. Lim, and D.H. Lee, “Efficient and Secure Member Deletion in Group Signature Schemes,”
Proc. of the 3rd International Conference on Information Security and Cryptology - ICISC ’00, LNCS Vol. 2015, pp. 150– 161, 2001.
[17] J. Lapon, M. Kohlweiss, B.D. Decker, and V. Naessens, “Performance Analysis of Accumulator-Based Revocation Mechanisms,”
Security and Privacy Silver Linings in the Cloud - SEC ’10, IFIP AICT Vol. 330, pp. 289–301, 2010.
[18] J. Lapon, M. Kohlweiss, B.D. Decker, and V. Naessens, “Analysis of Revocation Strategies for Anonymous Idemix Credentials,”
Communications and Multimedia Security - CMS ’11, LNCS Vol. 7025, pp. 3–7, 2011.
[19] J. Li, N. Li, and R. Xue, “Universal Accumulators with Efficient Nonmembership Proofs,”
Proc. of the 5th International Conference on Applied Cryptography and Network Security - ACNS ’07, LNCS Vol. 4521, pp. 253–269, 2007.
[20] A.J. Menezes, P.C. van Oorschot, and S.A. Vanstone,
Handbook of Applied Cryptography, CRC Press, 1997.
[21] A. Mashatan and S. Vaudenay, “A Fully Dynamic Universal Accumulator,”
Proc. of the Romanian Academy, Vol. 14, pp. 269–285, 2013.
[22] L. Nguyen, “Accumulators from bilinear pairings and applications,”
Topics in Cryptology CT-RSA ’05, LNCS Vol. 3376, pp. 275–292, 2005.
[23] C. Paquin and G. Zaverucha, “U-Prove Cryptographic Specification V1.1 (Revision 3),”
Microsoft Corporation, 2013.
[24] J.-J. Quisquater and C. Couvreur, “Fast Decipherment Algorithm for RSA Public-Key Cryptosystem,”
Electronics Letters, Vol. 18, No. 21, pp. 905–907, 1982.
[25] T. Sander, A. Ta-Shma, and M. Yung, “Blind, Auditable Membership Proofs,”
Proc. of the 4th International Conference on Financial Cryptography - FC’00, LNCS Vol. 1962, pp. 53–71, 2001.
[26] Security Team, Computer Science Dept, “Specification of the Identity Mixer Cryptographic Library,”
IBM Research, Zurich, 2009.
[27] D.X. Song, “Practical Forward Secure Group Signature Schemes,”
Proc. of the 8th ACM Conference on Computer and Communications Security - CCS ’01, pp. 225–234, 2001.
[28] G. Tsudik and S. Xu, “Accumulating Composites and Improved Group Signing,”
Advances in Cryptology - ASIACRYPT ’03, LNCS Vol. 2894, pp. 269–286, 2003.
[29] P. Wang, H. Wang, and J. Pieprzyk, “A New Dynamic Accumulator for Batch Updates,”
Proc. of the 9th International Conference on Information and Communications Security - ICICS ’07, LNCS Vol. 4861, pp. 98–112, 2007.