Re: [Secdispatch] The BBS Signature Scheme

[Eric Rescorla <[e-mail]>]

This should definitely go to CFRG.

I think it might be useful to present in SAAG (not SECDISPATCH) so people
are aware that a primitive like this exists and could use it in their
protocols. I would focus on those functions not the math, which, as before,
belongs in CFRG.

-Ekr



On Fri, May 20, 2022 at 5:13 PM Tobias Looker <tobias.looker=
[e-mail]> wrote:

> Hi All,
>
> The editors, WG members of the Applied Cryptography WG
> <https://identity.foundation/working-groups/crypto.html> at the
> Decentralized Identity Foundation (DIF) and I would like to discuss the
> following draft during the SecDispatch session at IETF 114. One possibility
> is for this to be considered as a work item for the CFRG, since it pertains
> to cryptography and there are already multiple drafts related to it located
> here, including Pairing Friendly Curves
> <https://www.ietf.org/archive/id/draft-irtf-cfrg-pairing-friendly-curves-10.html>
>  and BLS Signatures
> <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-bls-signature-04>.
> Security AD Roman Danyliw had suggested that we present this work to
> SecDispatch.
>
> Draft: https://identity.foundation/bbs-signature/draft-bbs-signatures.html
>
> Repository: https://github.com/decentralized-identity/bbs-signature
>
> Below is a brief blurb extracted from the introduction of the draft that
> introduces the work's purpose.
>
> ---
>
> A digital signature scheme is a fundamental cryptographic primitive that
> is used to provide data integrity and verifiable authenticity in various
> protocols. The core premise of digital signature technology is built upon
> asymmetric cryptography whereby the possessor of a private key is able to
> sign a message, and where anyone in possession of the public key
> corresponding to the private key is able to verify the signature.
>
> The BBS signature scheme, deriving its name from the original authors of
> the underlying academic works from Dan Boneh, Xavier Boyen and Hovav Shacham provide
> multiple additional unique properties, three key ones are:
>
> **Selective Disclosure** - The scheme allows a signer (issuer) to sign
> multiple messages and produce a single -constant size- output signature. An
> intermediary (prover) then possessing the messages and the signature can
> generate a proof whereby they can choose which messages to disclose, while
> leaking no-information about the un-disclosed messages. The proof itself
> guarantees the integrity and authenticity of the disclosed messages (e.g.
> that they were originally signed by the issuer).
>
> **Unlinkable Proof Presentations** - The proofs generated by the scheme
> are known as zero-knowledge, proofs-of-knowledge of the signature, meaning
> a verifying party in receipt of a proof is unable to determine which
> signature was used to generate the proof, removing a common source of
> correlation. In general each proof generated is indistinguishable from
> random even for two proofs generated from the same signature.
>
> **Proof of Possession** - The proofs generated by the scheme prove to a
> verifier that the party who generated the proof (prover) was in possession
> of a signature without revealing it. The scheme also supports binding a
> presentation header to the generated proof. The presentation header can
> include arbitrary information such as a cryptographic nonce, an
> audience/domain identifier to ensure the generated proof can only be used
> appropriately, including providing a way for a verifier to detect a replay
> attack.
>
> ---
>
> There are numerous applications for BBS signatures due to these unique
> properties, some of which are starting to be elaborated on here
> <https://identity.foundation/bbs-signature/draft-bbs-signatures.html#name-usecases>
> .
>
> This work is also related to the JWP BoF session requested for IETF 114
> <https://datatracker.ietf.org/doc/bofreq-miller-json-web-proofs/>, which
> is a JSON-based cryptographic representation format extending the JOSE
> family of standards designed to support schemes like BBS signatures.
>
> Thanks,
>
> [image: Mattr website]
> <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WeN4boYw%26u%3Dhttps%253a%252f%252fmattr.global%252f&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076709977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tKqCMzLUQNCeORd908YqfqZoT7tCy%2FMVwXdjpch1sDY%3D&reserved=0>
>
>
>
> *Tobias Looker*
>
> MATTR
> CTO
>
> [phone]
> [e-mail]
>
> [image: Mattr website]
> <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WeN4boYw%26u%3Dhttps%253a%252f%252fmattr.global%252f&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076709977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tKqCMzLUQNCeORd908YqfqZoT7tCy%2FMVwXdjpch1sDY%3D&reserved=0>
>
> [image: Mattr on LinkedIn]
> <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1SbN9fvNg%26u%3Dhttps%253a%252f%252fwww.linkedin.com%252fcompany%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076719975%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=t%2BidOI32oaKuTJf1AkcG%2B%2FirIJwbrgzXVZnjOAC52Hs%3D&reserved=0>
>
> [image: Mattr on Twitter]
> <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WdMte6ZA%26u%3Dhttps%253a%252f%252ftwitter.com%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076729970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=BD9WWyXEjVGlbpbCja93yW%2FzLJZpe%2Ff8lGooe8V6i7w%3D&reserved=0>
>
> [image: Mattr on Github]
> <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiWwGdMoDtMw%26u%3Dhttps%253a%252f%252fgithub.com%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076729970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4AhRuXZCnU5i3hcngo4H3UiNayYUtXpRcImV4slS1mw%3D&reserved=0>
>
>
> This communication, including any attachments, is confidential. If you are
> not the intended recipient, you should not read it - please contact me
> immediately, destroy it, and do not copy or use any part of this
> communication or disclose anything about it. Thank you. Please note that
> this communication does not designate an information system for the
> purposes of the Electronic Transactions Act 2002.
>
> _______________________________________________
> Secdispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdispatch
>