29/Jul/2009 Young Hoon Park

 M.Bellare, D.Micciancio, B.Warinschi, Foundations of Group Signatures: Formal Definitions, Simplified Requirements, and a Construction based on General Assumptions (Eurocrypt ’03)  B.K.Chaurasia, S.Verma, S.M.Bhasker, Message broadcast in VANETs using Group Signature (IEEE WCSN ’08)  X.Sun, X.Lin, P.H.Ho, Secure Vehicular Communications Based on Group Signature and ID-based Signature Scheme (IEEE, ICC ’07)

 Simple solution: give all users same private key …  … but, extra requirements: ◦ Ability to revoke signers when needed. ◦ Tracing Authority Key Issuer User 1 User 2 Is sig from user 1 or 2? msg sig

 D. Chaum and E. van Heyst. [EC ’91]  N. Baric and B. Pfitzman [EC ’97]  G. Ateniese, J. Camenisch, M. Joye, G. Tsudik [EC ’00]  J. Camenisch and A. Lysyanskaya. [Cr ’02]  G. Ateniese, D. Song, and G. Tsudik [FC ’02]  M. Bellare, D. Micciancio, and B. Warinschi [EC ’03]

Basic: tracing, but no revocation (static groups). Group sig system consists of four algorithms: ◦ Setup(, n) : = sec param. n = #users. output: group-pub-key ( GPK ), ( GSK 1, …, GSK n ), group-tracing key ( GTK ) ◦ Sign(M, GSK i ) : outputs group signature  on M. ◦ Verify(M, , GPK) : outputs yes or no. ◦ Trace(M, , GTK) : outputs i  {1,…,n} or fail.

 Applications ◦ Trusted Computing ◦ Vehicle Safety Communication  Issues ◦ Revocation Mechanism ◦ Traceability

 Type 0 ◦ For each revocation event, generate new GPK. ◦ Give each unrevoked user its new private key.  Type 1 ◦ For each revocation event, send a short broadcast message RL to all signers and all verifiers.  (GPK old, RL)  GPK new  (GSK i, old, RL)  GSK i, new  Type 2 ◦ For each revocation, send RL to verifiers only.  Verify(GPK, (m,  ), RL)

 Type 0 ◦ No tracing possible  Type 1 ◦ Given a black box signing device, can identify at least one number of coalition that created device.  Type 2 ◦ Given a signature, can identify at least one number of coalition that created signature.

 Vehicular Ad-hoc NETwork  The main goal is providing safety and comfort for passengers  Major components ◦ Road Side Units(RSUs)  are located in the critical points of the road.  communicates with vehicles. ◦ On Board Units(OBUs)  The communication devices on the vehicles

 Message spoofing  Message replay attack  Integrity attack  Impersonation attack  Denial of service  Movement tracking

 Integrity and source authentication  Vehicle anonymity  RSU ID Exposure  Vehicle ID Traceability  Efficiency  Robustness

 RSU does not need anonymity  Hence, the public key based digital signatures are used.  Message format for RSU

 The main challenge of communications is contradiction between anonymity and traceability.  The straightforward solutions ◦ Anonymous certificate ◦ Signatures should be saved in the central manager.  Problems ◦ It is difficult to maintain. ◦ It is inefficient to trace back to the real identities.  Proposed solution ◦ Using group signature (RSA based)

 Key setup ◦ Group manager’s private key : only GM knows. ◦ Group public key : shared to all members.  Membership registration ◦ Make individual private key  Shared to each member and GM ◦ Generate and send the user public key. private key Individual, Group public key

 Signing ◦ Message is signed with not only user’s private key, but also public key and group public key  Verification ◦ Signed message can be verified with group public key. ◦ Only group member can verify ◦ Only group member’s signature can be verified.  Recover ◦ Performed by the group manager. ◦ After the operation, the sender’s public key is revealed.

 Membership revocation ◦ The examples of the case  The vehicle is compromised  ID and private keys are identified by the law authority. ◦ The group manager have to change the public key. ◦ Two ways of changing public key  GM makes all unrevoked users update the new public key.  Verifier Local Revocation

 Average Delay ◦  Average Loss Ratio ◦

 Group signature should provide not only the integrity of message and the anonymity, but also the traceability and member’s revocation.  VANET is one of the applications of group signature to support vehicles’ security and privacy.  However, algorithm of revocation should be developed for the efficiency.