Pairing-Based Fair Electronic Cash Systems

基於雙線性配對之公平電子錢系統

陳雅玲(Chen, Yalin)

指導教授 ： 孫宏民

國立清華大學/電機資訊學院/資訊系統與應用研究所/博士(2013年)

摘要

不可追蹤電子錢是指，針對ㄧ個付款交易，沒有人知道誰是那個付款的人。因為不可追蹤性，也稱作匿名性，使付款者的隱私得以被保護，因此電子錢成為受歡迎的網路付款工具。但不可追蹤性很容易被濫用例如洗錢，行賄，逃稅或勒索等。於是許多學者提出了「公平的電子現金」，也就是如果合法使用電子錢則保有其匿名性，一旦非法使用，則電子錢的匿名將被撤銷。除了「不可追蹤性」和「撤銷匿名性」外，電子現金必須可被公開驗證，不可被偽造，可避免重複花費，和必須避免被非擁有者花費或存入銀行。另外，電子現金系統最好是，付款時不需連線銀行和允許找零。
「盲簽章」是支援不可追蹤電子錢的主要技術，它使一個簽章者簽署一份「封緘的文件」，接收者（也就是封緘的人）「剝掉」封緘後，則得到簽章者對原文件的簽名。更進一步說，如果用某種方法讓「封緘的內容」包含一些追蹤資訊，我們就可以在某些條件下揭露封緘的人。這樣的技術就稱為「公平的盲簽技術」。運用在公平的電子現金上，銀行就是簽章者，而提款者就是封緘的人。「公平」則是指電子錢的匿名性可透過追蹤資訊被取消。
本論文提出了兩個雙線性配對的「公平的盲簽技術」，並發展了相對應的電子錢系統，命名為「IDB現金」和「LEB現金」。「IDB現金」是一個用「個人身份資訊」例如姓名或電子信箱作為公開金鑰的應用系統，所以可以簡化金鑰分配和降低金鑰存取、管理的成本。其次，這個提案能減少通訊成本，因為其每個電子錢協定都內建有「身份認證」和「通訊金鑰交換」功能，因此可省去執行電子錢協定必須先建立安全通道的通訊成本。至於「LEB現金」系統，它是利用知名學者Boneh，Lynn和 Shacham的「短簽章技術」發展一個嵌入提款許可證的盲簽技術 (LEBSS），就是讓簽章者除了盲簽電子錢外，還盲簽一個提款許可證。「LEB現金」的安全比「IDB現金」強，因為LEBSS是以正規的方式證明其不可偽造性和隱私權保護。
和其他相關的雙線性配對公平電子錢系統比較，IDB現金和LEB現金在電子現金大小，通訊成本，和計算成本有很好的效率。IDB現金較其他方案易被實務界採用。LEB現金同時具有效率和可證明的安全性。

關鍵字

公平電子錢 ； 公平盲簽章 ； 雙線性配對密碼系統 ； 可證明安全

並列摘要

Untraceable electronic cash (e-cash) indicates a user made a payment, but no one knows who the payer was. It hence ensures user privacy and becomes an attractive payment tool. However, untraceability property, also called anonymity, is easily abused by criminals who use it for activities such as money laundering, bribing, or blackmailing. To address these problems, researchers introduced fair e-cash systems in which the anonymity of e-cash is maintained if the e-cash is used legally, but is revoked if misused. Except untraceability and anonymity revocation, e-cash should be publicly verifiable, unforgeable, double-spending resistance, and not to be spent by non-owners. In addition, the e-cash system preferably allows bank-offline payment and to give change.
Untraceable e-cash is realized by blind signature schemes in which a signer signs a sealed document, and a receiver can unseal the signed result to obtain a signer’s signature to the original document. Furthermore, if letting the sealed document include some tracking information by some method, we can trace the sealer by some corresponding method. Such construction is referred to as fair blind signature schemes. For an e-cash system, the signer will be a bank and the sealer is a user. That the anonymity can be revoked through the tracking information infers fairness.
In this dissertation, we present two pairing-based fair blind signature schemes and develop two corresponding fair e-cash systems, named IDB-Cash and LEB-Cash. IDB-Cash is an identity-based cryptographic application, using participants’ identity information such as name or email address as public keys, and thus has the advantages of simple key distribution, key management and key access. In addition, the protocols in IDB-Cash possess communication efficiency because each has built-in identity-authentication and key-agreement functions, and it therefore eliminates the cost of necessary pre-built secure channels. As for IDB-Cash, it employs Boneh, Lynn, and Shacham’s short signature primitive to design a license-embedded blind signature scheme (LEBSS) to properly embed a user license into e-cash while keeping the license anonymous to the bank. The LEBSS is provably secure in terms of blindness and unforgeability, providing more robust e-cash than IDB-Cash does.
Compared to related pairing-based fair e-cash literature, IDB-Cash and LEB-Cash are efficient in e-cash size, issuing cost and paying cost. IDB-Cash is welcome to the practice while LEB-Cash possesses both efficiency and provable security.

並列關鍵字

Fair Electronic Cash ； Fair Blind Signature ； Pairing-Based Cryptography ； Provable Security

參考文獻

[3] M.Z. Ashrafi and S.K. Ng. Privacy-preserving e-payments using one-time payment details. Computer Standards & Interfaces, 31, 321–328, 2009.

[4] R. Balasubramanianand and N. Koblitz. The improbability that an elliptic curve has subexponential discrete log problem under the Menezes-Okamoto-Vanstone algorithm. Journal of cryptology, 11(2), 141–145, 1998.

[6] M. Bellare and P. Rogaway. The exact security of digital signatures: how to sign with RSA and Rabin. Advances in cryptology–Eurocrypt’96, LNCS 1070, Springer-Verlag, 1996.

[7] J.E. Beuchat, J.E. González-Díaz, S. Mitsunari, E. Okamoto, F. Rodríguez-Henríquez and T. Teruya. High-speed software implementation of the optimal Ate pairing over Barreto–Naehrig curves. Pairing 2010, LNCS 6487, 21–39, 2010.

[10] D. Boneh, E. Shen and B. Waters. Strongly unforgeable signatures based Computational Diffie-Hellman. M. Yung et al.’s Eds., PKC’06, LNCS 3958, 229–240, 2006.