![Privacy Feasibility Way Ahead
?
[Images from iStockPhoto.com]
2](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-2-320.jpg)
![Signature Scheme based on SRSA [CL01]
Public key of signer: RSA modulus n and ai, b, d ? QRn
Secret key: factors of n
To sign k messages m1, ..., mk ? {0,1}? :
?
choose random prime e > 2? and integer s ¡Ö n
? compute c such that
m1 mk s e
d = a ?...? a b c mod n
1 k
? signature is (c,e,s)
[SRSA CL-signature system introduced in Camenisch and Lysyanskaya '01. There exist alternative systems in elliptic curve settings, for instance with BBS-alike signatures.]](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-11-320.jpg)
![Signature Scheme based on SRSA [CL01]
A signature (c,e,s) on messages m1, ..., mk is valid iff:
?
m1, ..., mk ? {0,1}?:
?
e > 2?
m1 mk
? d= a ?...? a bs ce mod n
1 k
Theorem: Signature scheme is secure against adaptively
chosen message attacks under Strong RSA assumption.](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-12-320.jpg)
![Vision: Smart Identity Card
Strong accountability and privacy
Sustainable secondary use
Trusted identity basis
Cost effective
Future-proof
[Card picture is an artists conception: the chip of the actual JCOP 41/v.2.2 Java Card used for the feasibility study is on the backside.]
? 2011 IBM Corporation](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-15-320.jpg)
![IBM Presentation Template Full Version
[Independent proof point:
Feasibility Problem Sterckx, Gierlichs, Preneel, Verbauwhede ¡®09]
Run anonymous credential system autonomously and
securely on a standard off-the-shelf Java Card.
Autonomy
All data on card
Malicious terminal
16 ? 2011 IBM Corporation](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-16-320.jpg)
![IBM Presentation Template Full Version
Java Card
Structure
IDMX Applet
Basic Ops interface
Card Java Card API
Manager Java Card VM
Card-Specific Operating System
8-bit CPU 3DES CP Public Key CP
[Source: Prof. Wolfgang Reif ¨C chip cards]
18 ? 2011 IBM Corporation](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-18-320.jpg)
![IBM Presentation Template Full Version
Execution Times for a Full Proof (incl. Communication)
Modulus 1280 bit 1536 bit 1984 bit
Precomputation 5203 ms 7828 ms 13250 ms
Compute A¡¯ 2125 ms 2906 ms 5000 ms
Compute T1 3078 ms 4922 ms 8250 ms
Policy-dependent 2234 ms 2625 ms 3298 ms
Compute 1 562 ms 656 ms 828 ms
response
Total 7437 ms 10453 ms 16548 ms
[Avg. performance measurements with 100 experiments on JCOP 41/v2.2. A': credential blinding, T1: first stage of Sigma-proof commitment, response: Sigma-proof response]
20 ? 2011 IBM Corporation](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-20-320.jpg)
![IBM Presentation Template Full Version
Resources
¡ö This talk is based on P. Bichsel, J. Camenisch, T. Gross, V. Shoup. Anonymous
Credentials on a Standard Java Card. ACM CCS 2009. Prof. V. Shoup is
affiliated with the New York University and contributed to this work during a
sabbatical at IBM Research ¨C Zurich.
¡ö Identity Mixer Community: idemix.wordpress.com
¨C Download Identity Mixer Library 2.3.2
¨C Read Identity Mixer Specification 2.3.2
¨C http://prime.inf.tu-dresden.de/idemix/
¡ö PrimeLife: www.primelife.eu
¡ö ABC4Trust: www.abc4trust.de
¡ö Email Jan or Thomas: {jca, tgr}[at]zurich.ibm.com
25 ? 2011 IBM Corporation](https://image.slidesharecdn.com/2011-02-03-anonymouscredentialsonjavacard-110226144647-phpapp01/85/Anonymous-Credentials-on-Java-Card-SIT-Smartcard-2011-25-320.jpg)
More Related Content
Similar to Anonymous Credentials on Java Card - SIT Smartcard 2011 (20)
Recently uploaded (20)
![[QUICK TALK] "Why Some Teams Grow Better Under Pressure", Oleksandr Marchenko...](https://cdn.slidesharecdn.com/ss_thumbnails/softskillsfwdays25-250317080651-1a2cccb1-thumbnail.jpg?width=560&fit=bounds)
Anonymous Credentials on Java Card - SIT Smartcard 2011
- 1. Dr. Thomas Gro? ¨C Research Scientist 03 February 2011 Anonymous Credentials on Java Card Patrik Bichsel, Jan Camenisch, Thomas Gro?, Victor Shoup 1 ? 2009 IBM Corporation
- 2. Privacy Feasibility Way Ahead ? [Images from iStockPhoto.com] 2
- 3. Privacy Feasibility Way Ahead ? 3
- 4. ¡°Neil Armstrong¡¯s Footsteps are still there¡± (Robin Wilton, Sun Microsystems) ? 4
- 5. IBM Presentation Template Full Version Anonymous Credentials: Attribute-based Access w/ Strong Security & Privacy 5 ? 2011 IBM Corporation
- 6. Private Credentials: How to Build Them In the beginning...
- 7. State of the Art: How to Build Them asking for a credential
- 8. State of the Art: How to Build Them getting a credential ... containing ¡°birth date = April 3, 1987¡±
- 9. State of the Art: How to Build Them showing a credential ... goes off-line - driver's license - insurance - older > 20
- 10. State of the Art: How to Build Them showing a credential ... containing statements ¡°driver's license, age (as stated in driver¡¯s license) > 20, and insurance¡± Using identity mixer, user can transform (different) token(s) into a new single one that, however, still verifies w.r.t. original signers' public keys.
- 11. Signature Scheme based on SRSA [CL01] Public key of signer: RSA modulus n and ai, b, d ? QRn Secret key: factors of n To sign k messages m1, ..., mk ? {0,1}? : ? choose random prime e > 2? and integer s ¡Ö n ? compute c such that m1 mk s e d = a ?...? a b c mod n 1 k ? signature is (c,e,s) [SRSA CL-signature system introduced in Camenisch and Lysyanskaya '01. There exist alternative systems in elliptic curve settings, for instance with BBS-alike signatures.]
- 12. Signature Scheme based on SRSA [CL01] A signature (c,e,s) on messages m1, ..., mk is valid iff: ? m1, ..., mk ? {0,1}?: ? e > 2? m1 mk ? d= a ?...? a bs ce mod n 1 k Theorem: Signature scheme is secure against adaptively chosen message attacks under Strong RSA assumption.
- 13. Proof of Knowledge of a CL Signature Solution randomize c : ¨C Let c' = c bs'mod n with random s' then d = c'e a m1 mk ¨C ? ... ? a bs* (mod n) holds, 1 k i.e., (c',e, s*) is a also a valid signature! Therefore, to prove knowledge of signature on hidden msgs: ? provide c' ? PK{(e, m1, ..., mk, s) : d = c'e a m1 ? ... ? a mk b s 1 k ¡Ä mi ? {0,1}? ¡Ä e ? 2?+1 ¡À {0,1}? }
- 14. Privacy Feasibility Way Ahead ? 14
- 15. Vision: Smart Identity Card Strong accountability and privacy Sustainable secondary use Trusted identity basis Cost effective Future-proof [Card picture is an artists conception: the chip of the actual JCOP 41/v.2.2 Java Card used for the feasibility study is on the backside.] ? 2011 IBM Corporation
- 16. IBM Presentation Template Full Version [Independent proof point: Feasibility Problem Sterckx, Gierlichs, Preneel, Verbauwhede ¡®09] Run anonymous credential system autonomously and securely on a standard off-the-shelf Java Card. Autonomy All data on card Malicious terminal 16 ? 2011 IBM Corporation
- 17. IBM Presentation Template Full Version Java Card* Limitations ¡ì 8-bit CPU (3.57 MHz) ¡ì Limited access to public key-CP (only standard RSA, DSA) ¡ì Limited RAM (2K) *: JCOP 41/v2.2 17 ? 2011 IBM Corporation
- 18. IBM Presentation Template Full Version Java Card Structure IDMX Applet Basic Ops interface Card Java Card API Manager Java Card VM Card-Specific Operating System 8-bit CPU 3DES CP Public Key CP [Source: Prof. Wolfgang Reif ¨C chip cards] 18 ? 2011 IBM Corporation
- 19. System Overview User PC User interacts/ Browser request: policy/ Backend consents response: proof to policy (Server) Identity Wallet Identity Mixer Validation request: policy/ pkI response: proof Validates proofs with Key Point issuer¡¯s public key Transforms inserts/owns certificates Smart ID Card in privacy- Identity Mixer preserving identity proof statements skU certificates Maintains master key and certificates confidential Won the Innovation Award 2009 (Gesellschaft f¨¹r Informatik, GI) Secure Javacard 19 ? 2011 IBM Corporation
- 20. IBM Presentation Template Full Version Execution Times for a Full Proof (incl. Communication) Modulus 1280 bit 1536 bit 1984 bit Precomputation 5203 ms 7828 ms 13250 ms Compute A¡¯ 2125 ms 2906 ms 5000 ms Compute T1 3078 ms 4922 ms 8250 ms Policy-dependent 2234 ms 2625 ms 3298 ms Compute 1 562 ms 656 ms 828 ms response Total 7437 ms 10453 ms 16548 ms [Avg. performance measurements with 100 experiments on JCOP 41/v2.2. A': credential blinding, T1: first stage of Sigma-proof commitment, response: Sigma-proof response] 20 ? 2011 IBM Corporation
- 21. Privacy Technology Way Ahead ? 21
- 22. IBM Presentation Template Full Version Just Launched ABC4Trust Project ¡ö EU FP 7 research project ¡ö 13.5 Million EUR, 4 years ¡ö 12 partners ¡ñ Goethe University Frankfurt Unabh?ngiges Landeszentrum f¨¹r ¡ñ Datenschutz ¡ñ Alexandra Institute Eurodocs ¡ñ ¡ñResearch Academic Computer Technology Institute CryptoExperts (SmartCards) ¡ñ ¡ñ IBM Research Microsoft R&D France ¡ñ ¡ñ Lenio Municipality of S?derhamn ¡ñ ¡ñ Nokia Siemens Networks Technische Universit?t Darmstadt ¡ñ 22 ? 2011 IBM Corporation
- 23. IBM Presentation Template Full Version ABC4Trust Goals Achieve paradigm shift and interoperability in trustworthy infrastructures ¡ö Establish abstraction and unification of different crypto algorithms. ¡ö Create interaction flows, architecture & data formats as well as policies. ¡ö Realize reference implementation. ¡ö Validate concepts by real-world pilots in the eID space. ¡ö Establish NG smart card implementation of anonymous credentials. ¨CRealization by CryptoExperts, lead by Pascal Paillier. ¨CNative SmartCard, direct access to crypto co-processor. 23 ? 2011 IBM Corporation
- 24. Privacy Feasibility Way Ahead Anonymous Anonymous credentials: Technology credential future-proof feasible and systems to be solution to practical: harmonized, ? minimal efficiently integrated disclosure realizable on into identity and attribute smart cards management authentication systems 24
- 25. IBM Presentation Template Full Version Resources ¡ö This talk is based on P. Bichsel, J. Camenisch, T. Gross, V. Shoup. Anonymous Credentials on a Standard Java Card. ACM CCS 2009. Prof. V. Shoup is affiliated with the New York University and contributed to this work during a sabbatical at IBM Research ¨C Zurich. ¡ö Identity Mixer Community: idemix.wordpress.com ¨C Download Identity Mixer Library 2.3.2 ¨C Read Identity Mixer Specification 2.3.2 ¨C http://prime.inf.tu-dresden.de/idemix/ ¡ö PrimeLife: www.primelife.eu ¡ö ABC4Trust: www.abc4trust.de ¡ö Email Jan or Thomas: {jca, tgr}[at]zurich.ibm.com 25 ? 2011 IBM Corporation