Lecture Notes in Computer Science 5185

A User-Centric Protocol for Conditional Anonymity Revocation 189
CipherVE−ida = EncVE(ida; Conditions; KARM public−VE ). Then, a PK is executed
to prove that cida is the commitment for ida contained in Cert1 issued by
CertificateIssuer1 (this is achieved by using the proofofknowledgeofasignature
on committed messages technique based on either the SRSA-CL or BM-CL
signature scheme, depending on which signature scheme Cert1 is generated -
see [7, 9] for details). This PK also proves that CipherVE−ida is an encryption
of ida hidden in cida, under the ARM public key:
PK{(Cert1,ida) : cida = Commit(ida,r) ∧
V erifySign(ida,mb, .., mi; K CertificateIssuer1
verify )=1∧
CipherVE−ida = EncVE(ida; Conditions; K ARM
public−VE )}(1)
Protocol (1) allows a user to provide a verifiable encryption of ida without
the verifier learning its value and still be convinced that CipherVE−ida contains
ida. 1 However, CipherVE−ida can be trivially decrypted by ARM without the
user’s knowledge, and there is no enforcement of Conditions fulfillment. Our
UC-ARP protocol seeks to reduce the trust placed in the ARM.
Universal Custodian Hiding Verifiable Encryption (UCHVE): The
UCHVE scheme [4] is used in 1Rh-UC-ARP. Consider a discrete log relation:
y = gx (y and g are known to verifier, but the discrete log value of x is private to
a prover). For a group R of n referee members, the UCHVE encryption scheme
allows a user to verifiably encrypt x to some designated t members from a subset
group T ⊂ R with any k out of these t members required to work jointly to recover
x (1 ≤ k ≤ t ≤ n). T can be formed spontaneously and members of T can
be different from session to session. The identities of the members of T are hidden.
Averifier can only verify if the ciphertext received from a prover correctly
encrypts x, in relation to the known value of y and g, and that any k members of
T have to work together to recover x without learning the identity of the members
of T ,orthevalueofx. This encryption is denoted as EncUCHVE(k,t,n). If k = t, thatis,EncUCHVE(t,t,n), then only when all t members of T work
together can the encrypted message be recovered.
For members of T , t well-formed ciphertext pieces will be generated, each encrypted
using the corresponding member ofT ’s public keys. For members of R not in
T , n−t random values are chosen from specific domains such that they are indistinguishable
from the well-formed ones. Regardless, there will be a total of n ciphertext
pieces (well-formed + random). Intuitively, UCHVE scheme takes up substantial
resources to perform, and therefore its use should be kept to a minimum.
To recover x (assuming that k = t), all members of R have to firstly verify that
he/she is member of T by applying validation checking to the given ciphertext
pieces (details in [4]). For members of R in T , such checking will be successful,
and thus they can decrypt the given ciphertext and produce a share.Formembers
of R not in T , such checking will be unsuccessful, thus output reject and stop.
Once these t shares are collected, they are used as input to a particular function
1
This protocol applies to any number of personal data items, not restricted to
only ida.