Re: [Privacy-pass] External verifiability: a concrete proposal

Hi Watson,

Thanks for bringing this up, I like this idea.
I’m not familiar with the Boneh-Lynn-Shacham signature scheme, but it seems what you’re proposing is only a minor modification on the redemption procedure used in the core protocol design.

When it comes to alternative designs for publicly verifiability, the only things that come to my mind are to use a different blind signature scheme, or to try a more general anonymous credential scheme such as https://eprint.iacr.org/2001/019.pdf <https://eprint.iacr.org/2001/019.pdf> (or something more recent). However, I like the simplicity of what you’re proposing, and the similarity that it enjoys with the existing versions of the protocol.

I’d be interested in hearing more opinions on this topic.

Cheers,
Alex

> On 10 Jul 2020, at 00:17, Watson Ladd <watsonbladd@gmail.com> wrote:
> 
> On Thu, Jul 9, 2020 at 6:36 PM Ben Schwartz <bemasc@google.com> wrote:
>> 
>> How would you verify double-spend protection?
> 
> In the applications I've heard of double spending at different places
> is fine, double spending at the same place is not.
> 
>> 
>> On Thu, Jul 9, 2020 at 5:46 PM Watson Ladd <watsonbladd@gmail.com> wrote:
>>> 
>>> Dear WG members,
>>> 
>>> Recently I heard of some interesting applications of privacy pass
>>> where external verifiability would be essential. These applications
>>> where ones where a central server was issuing tokens that various
>>> others could use.
>>> 
>>> My concrete proposal is blind Boneh-Lynn-Shacham signatures.
>>> Concretely we use G1, G2, GT a type III pairing, and have the key of
>>> the issuer be kg_2. As in vanilla privacy pass the tokens are kH(x)
>>> where x is a string and H is a hash function into G_1. However to
>>> verify a token (y, x) one verifies the pairing equations e(y,
>>> g_2)=e(H(x), kg_2). One could use the BLS12-381 parameter set for
>>> this.
>>> 
>>> Sincerely,
>>> Watson Ladd
>>> 
>>> --
>>> Privacy-pass mailing list
>>> Privacy-pass@ietf.org
>>> https://www.ietf.org/mailman/listinfo/privacy-pass
> 
> 
> 
> --
> "Man is born free, but everywhere he is in chains".
> --Rousseau.
> 
> -- 
> Privacy-pass mailing list
> Privacy-pass@ietf.org
> https://www.ietf.org/mailman/listinfo/privacy-pass