Re: [Secdispatch] The BBS Signature Scheme

[Yoav Nir <[e-mail]>]

If they had a draft with the title “Using BBS Signatures in TLS” then SecDispatch would be the place to ask which WG is the right one for that.

As it is, it’s just an algorithm, so it should go to CFRG with maybe a talk at SAAG.  I don’t see what SecDispatch has to dispatch.

And I though the tictoc WG was supposed to produce the time machine.

> On 21 May 2022, at 18:54, Phillip Hallam-Baker <[e-mail]> wrote:
> 
> SECDISPATCH is what I meant to write.
> 
> When is Elon getting us that edit button for email?
> 
> On Sat, May 21, 2022 at 9:58 AM Yoav Nir <[e-mail] <mailto:[e-mail]>> wrote:
> SECDIR is just the people doing SECDIR reviews. If you want to ask of a certain primitive whether it would be useful for PKIX, TLS, IPsec, SSH or whatever other protocol IETF people are working on, the place where all these people meet is SAAG.
> 
> And also CFRG.
> 
> 
>> On 21 May 2022, at 5:54, Phillip Hallam-Baker <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> I had the same thought except that CFRG is IRTF and so the question they are going to ask is whether anyone is interested in using the primitives. And that seems more SECDIR than SAAG.
>> 
>> They do have an application motivating some of this.
>> 
>> 
>> 
>> On Fri, May 20, 2022 at 10:07 PM Eric Rescorla <[e-mail] <mailto:[e-mail]>> wrote:
>> This should definitely go to CFRG.
>> 
>> I think it might be useful to present in SAAG (not SECDISPATCH) so people are aware that a primitive like this exists and could use it in their protocols. I would focus on those functions not the math, which, as before, belongs in CFRG.
>> 
>> -Ekr
>> 
>> 
>> 
>> On Fri, May 20, 2022 at 5:13 PM Tobias Looker <tobias.looker=[e-mail] <mailto:[e-mail]>> wrote:
>> Hi All,
>> 
>> The editors, WG members of the Applied Cryptography WG <https://identity.foundation/working-groups/crypto.html> at the Decentralized Identity Foundation (DIF) and I would like to discuss the following draft during the SecDispatch session at IETF 114. One possibility is for this to be considered as a work item for the CFRG, since it pertains to cryptography and there are already multiple drafts related to it located here, including Pairing Friendly Curves <https://www.ietf.org/archive/id/draft-irtf-cfrg-pairing-friendly-curves-10.html> and BLS Signatures <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-bls-signature-04>. Security AD Roman Danyliw had suggested that we present this work to SecDispatch.
>> 
>> Draft: https://identity.foundation/bbs-signature/draft-bbs-signatures.html <https://identity.foundation/bbs-signature/draft-bbs-signatures.html> 
>> Repository: https://github.com/decentralized-identity/bbs-signature <https://github.com/decentralized-identity/bbs-signature> 
>> 
>> Below is a brief blurb extracted from the introduction of the draft that introduces the work's purpose.
>> 
>> ---
>> 
>> A digital signature scheme is a fundamental cryptographic primitive that is used to provide data integrity and verifiable authenticity in various protocols. The core premise of digital signature technology is built upon asymmetric cryptography whereby the possessor of a private key is able to sign a message, and where anyone in possession of the public key corresponding to the private key is able to verify the signature.
>> 
>> The BBS signature scheme, deriving its name from the original authors of the underlying academic works from Dan Boneh, Xavier Boyen and Hovav Shacham provide multiple additional unique properties, three key ones are:
>> 
>> **Selective Disclosure** - The scheme allows a signer (issuer) to sign multiple messages and produce a single -constant size- output signature. An intermediary (prover) then possessing the messages and the signature can generate a proof whereby they can choose which messages to disclose, while leaking no-information about the un-disclosed messages. The proof itself guarantees the integrity and authenticity of the disclosed messages (e.g. that they were originally signed by the issuer).
>> 
>> **Unlinkable Proof Presentations** - The proofs generated by the scheme are known as zero-knowledge, proofs-of-knowledge of the signature, meaning a verifying party in receipt of a proof is unable to determine which signature was used to generate the proof, removing a common source of correlation. In general each proof generated is indistinguishable from random even for two proofs generated from the same signature.
>> 
>> **Proof of Possession** - The proofs generated by the scheme prove to a verifier that the party who generated the proof (prover) was in possession of a signature without revealing it. The scheme also supports binding a presentation header to the generated proof. The presentation header can include arbitrary information such as a cryptographic nonce, an audience/domain identifier to ensure the generated proof can only be used appropriately, including providing a way for a verifier to detect a replay attack.
>> 
>> ---
>> 
>> There are numerous applications for BBS signatures due to these unique properties, some of which are starting to be elaborated on here <https://identity.foundation/bbs-signature/draft-bbs-signatures.html#name-usecases>.
>> 
>> This work is also related to the JWP BoF session requested for IETF 114 <https://datatracker.ietf.org/doc/bofreq-miller-json-web-proofs/>, which is a JSON-based cryptographic representation format extending the JOSE family of standards designed to support schemes like BBS signatures.
>> 
>> Thanks,
>>  <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WeN4boYw%26u%3Dhttps%253a%252f%252fmattr.global%252f&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076709977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tKqCMzLUQNCeORd908YqfqZoT7tCy%2FMVwXdjpch1sDY%3D&reserved=0>	
>>  
>> Tobias Looker
>> MATTR
>> CTO
>> [phone]
>> [e-mail] <mailto:[e-mail]>
>>  <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WeN4boYw%26u%3Dhttps%253a%252f%252fmattr.global%252f&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076709977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tKqCMzLUQNCeORd908YqfqZoT7tCy%2FMVwXdjpch1sDY%3D&reserved=0>	
>>  <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1SbN9fvNg%26u%3Dhttps%253a%252f%252fwww.linkedin.com%252fcompany%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076719975%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=t%2BidOI32oaKuTJf1AkcG%2B%2FirIJwbrgzXVZnjOAC52Hs%3D&reserved=0>	
>>  <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WdMte6ZA%26u%3Dhttps%253a%252f%252ftwitter.com%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076729970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=BD9WWyXEjVGlbpbCja93yW%2FzLJZpe%2Ff8lGooe8V6i7w%3D&reserved=0>	
>>  <https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiWwGdMoDtMw%26u%3Dhttps%253a%252f%252fgithub.com%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076729970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4AhRuXZCnU5i3hcngo4H3UiNayYUtXpRcImV4slS1mw%3D&reserved=0>
>> 
>> This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.
>> 
>> _______________________________________________
>> Secdispatch mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/secdispatch <https://www.ietf.org/mailman/listinfo/secdispatch>
>> _______________________________________________
>> Secdispatch mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/secdispatch <https://www.ietf.org/mailman/listinfo/secdispatch>
>> _______________________________________________
>> Secdispatch mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/secdispatch <https://www.ietf.org/mailman/listinfo/secdispatch>
>