3
$\begingroup$

This is a follow-up to this answer. The context & vocabulary used is that of a decentralized identity system.

Let $I$ be the issuer of a credential, $H$ the holder and $V$ the verifier. In this setting, $I$ signs a credential $C$ with their private key, and hands it over to $H$ for storage, who may then present it to $V$ to prove their identity.

One flaw remains in this system: if such were the intentions of $V$, nothing prevents them from giving the signed data contained in $C$ to a third-party, who could then verify & attest that the credential is authentic even though $H$ didn't give the credential themself.

How could this be avoided?

Note: regarding the link between this question and the answer cited above, I'm not sure if the question I asked about deniable authentication was formulated well enough: I wasn't interested in making the ZKP unreadable to third parties (I fear this is impossible if Bob / $V$ is part of the conspiracy), but my goal was to make the whole credential (passport, in that case) no longer provably authentic.

Improve this question
$\endgroup$

2 Answers 2

Reset to default
2
$\begingroup$

The solution is rather simple; instead of letting $H$ give the general credential $C$ to $V$, the following steps could be taken:

  1. $H$ sends $C$ to $I$, along with $V$'s public key.
  2. $I$ checks that they signed the credential themself, takes the content, and signs it again with a ring signature made from $V$'s public key and $I$'s own private key. The resulting credential may be called $C_V$. It is sent back to $H$.
  3. $H$ sends $C_V$ to $V$ as a proof of identity.

At this point, $V$ can trust the received credential, as the potential signers are $\{I, V\}$, and $V$ knows they didn't sign it. When $V$ tries to leak the data, they have no way of proving the data authentic.

Improve this answer
$\endgroup$
5
  • 1
    $\begingroup$ The main disadvantage of this solution is that it requires $I$ to sign $C$ with a separate ring signature for each verifier $V$. In practice (if there are too many potential verifiers $V$ for $I$ to issue ring signatures for all of them in advance) that might require real-time communication between $H$ and $I$ (or at least between $H$ and some additional party entrusted by $I$ to perform step 2 on their behalf). But, as I noted in my comment on the original discussion, I'm not actually sure this can be done in general without such extra communication. $\endgroup$
    – Ilmari Karonen
    Dec 24, 2021 at 17:55
  • $\begingroup$ @IlmariKaronen: Yes, that's problematic. I wish there has a way to "ring-sign" something only with (a) the non-signers' PKs and (b) the already-signed message with the SK. I might ask a question about that, at first sight it doesn't seem unfeasible and that would be a hell of an elegant solution. (edit: Or maybe it is unfeasible, but I don't know enough about the math behind signing to tell) $\endgroup$
    – deb
    Dec 25, 2021 at 11:54
  • $\begingroup$ It's done: crypto.stackexchange.com/q/97819/88017. I'm not really expecting any miracle, though. $\endgroup$
    – deb
    Dec 25, 2021 at 15:38
  • $\begingroup$ @IlmariKaronen: Looks like it's impossible without communication, you were right. $\endgroup$
    – deb
    Dec 26, 2021 at 9:12
  • 1
    $\begingroup$ Btw there is the partial solution of the issuer signing using sub-keys, which are rotated out after a period of time. The private keys for the rotated-out sub-keys are released so that anyone could forge the existence of a credential prior to that expiry. However, if the verifier records proof of knowledge of the credentials e.g. on a blockchain prior to the keys being rotated out, then this mechanism fails. See mit.edu/~specter/blog/2020/dkim $\endgroup$
    – knaccc
    Dec 26, 2021 at 10:54
0
$\begingroup$

Use a zero knowledge proof that the signature exists rather than sending a signature directly.

The holder and verifier execute the protocol and this convinces the verifier that the signature exists without revealing it.

For signatures based on discrete log problems (Schnorr signatures, ED25519, ECDSA) this transformation is easy to do. If the Verifier has a known public key, the Holder can do this in a single message.

Other signature algorithms also allow existence ZKPs but may require arithmetic circuit proofs.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.