An Improved Efficient Secret Handshakes Scheme with Unlinkability Author: Jie Gu and Zhi Xue Source: IEEE Comm. Letters 15 (2) (2011) Presenter: Yu-Chi Chen 1

Outline Introduction Huang and Cao’s scheme The proposed scheme Conclusions 2

Introduction A secret handshakes scheme – affiliation-hiding authentication – firstly introduced by Balfanz et al. – For example, two FBI agents, Alice and Bob, want to discover and communicates with other agents, but they don’t want to reveal their affiliations to non-agents. 3

Introduction An unlinkable secret handshakes scheme – provide unlinkability – an adversary cannot link any two different instances of same party. Given C, to guess C is AB, A’B’, or other. (blind signature) unlinkability has been widely considered in many applications. 4

Introduction Jarecki et al.’s scheme – an unlinkable secret handshakes scheme – not efficient, but secure at present Huang and Cao presented an unlinkable secret handshakes scheme – novel and efficient – Simple, so it can be published in IEEE-CL. 5

Outline Introduction Huang and Cao’s scheme The proposed scheme Conclusions 6

Bilinear pairing Referred to as “bilinear maps” e: G 1 × G 2 →G 3 G 1, G 2 : (+, q) G 3 : (×, q) 7

Bilinear pairing Properties: – Computation: given P 1 (P 2 ) in G 1 (G 2 ), we can obtain e(P 1, P 2 ) in G 3 – Bilinear: given aP 1 and bP 2, where a, b in Z q, then e(aP 1, bP 2 ) = e(P 1, P 2 ) ab – Non-degenerate: P 1 (P 2 ) is a generator of G 1 (G 2 ), then e(P 1, P 2 ) ≠ 1. (or e(P 1, P 2 ) is a generator of G 3 ) 8

Huang and Cao’s scheme This figure is copied from IEEE Comm. Letters 13 (9) (2009), page 731 9

Comments Su found the scheme cannot provide authenticated key exchange security. Youn and Park also found the scheme cannot provide authenticated key exchange security and affiliation-hiding. 10

Outline Introduction Huang and Cao’s scheme The proposed scheme Conclusions 11

Gu and Xue’s idea The main weakness is that the outsider can use the public key (sP) to – succeed handshakes or – find which affiliation is for the user. Straight solution: no public key. 12

Gu and Xue’s scheme This figure is copied from IEEE Comm. Letters 15 (2) (2011), page

Huang and Cao’s scheme This figure is copied from IEEE Comm. Letters 13 (9) (2009), page

Huang and Cao’s scheme This figure is copied from IEEE Comm. Letters 13 (9) (2009), page

Gu and Xue’s scheme This figure is copied from IEEE Comm. Letters 15 (2) (2011), page

Gu and Xue’s scheme The scheme actually remedies the security loophole of Huang and Cao’s scheme. – However, it is very straightforward. – It does not violate the definition of USH. Gu and Xue also attach the security analysis. 17

Outline Introduction Huang and Cao’s scheme The proposed scheme Conclusions 18

Conclusions They propose an improved USH scheme. They brief security analysis. 19