Sanitizable signature schemes, as defined by Ateniese et al. (ESORICS 2005), allow a signer to partly delegate signing rights to another party, called the sanitizer. That is, the sanitizer is able to modify a predetermined part of the original message such that the integrity and authenticity of the unchanged part is still verifiable. Ateniese et al. identify five security requirements for such schemes (unforgeability, immutability, privacy, transparency and accountability) but do not provide formal specifications for these properties. They also present a scheme that is supposed to satisfy these requirements.

Here we revisit the security requirements for sanitizable signatures and, for the first time, present a comprehensive formal treatment. Besides a full characterization of the requirements we also investigate the relationship of the properties, showing for example that unforgeability follows from accountability. We then provide a full security proof for a modification of the original scheme according to our model.

/pdf/security-of-sanitizable-signatures-revisited-3x92jras7m.pdf

Security of Sanitizable Signatures Revisited

We present a number of enhancements to the voter verifiable election scheme Pret a Voter [CRS05]. Firstly, we propose a mechanism for the distributed construction by a set of independent clerks of the ballot forms. This construction leads to proto-ballot forms with the candidate list encrypted and ensures that only a collusion of all the clerks could determine the cryptographic seeds or the onion/candidate list association. This eliminates the need to trust a single authority to keep this information secret. Furthermore, it allows the on-demand decryption and printing of the ballot forms, so eliminating chain of custody issues and the chain voting style attacks against encrypted receipt schemes identified in [RP05]. The ballot forms proposed here use ElGamal randomised encryption so enabling the use of re-encryption mixes for the anonymising tabulation phase in place of the decryption mixes. This has a number of advantages over the RSA decryption mixes used previously: tolerance against failure of any of the mix tellers, full mixing of terms over the Z * p space and enabling the mixes and audits to be fully independently rerun if necessary.

Prêt à Voter with Re-encryption Mixes

We present a number of enhancements to the voter verifiable election scheme Pret a Voter [CRS05]. Firstly, we propose a mechanism for the distributed construction by a set of independent clerks of the ballot forms. This construction leads to proto-ballot forms with the candidate list encrypted and ensures that only a collusion of all the clerks could determine the cryptographic seeds or the onion/candidate list association. This eliminates the need to trust a single authority to keep this information secret. Furthermore, it allows the on-demand decryption and printing of the ballot forms, so eliminating chain of custody issues and the chain voting style attacks against encrypted receipt schemes identified in [RP05].

The ballot forms proposed here use ElGamal randomised encryption so enabling the use of re-encryption mixes for the anonymising tabulation phase in place of the decryption mixes. This has a number of advantages over the RSA decryption mixes used previously: tolerance against failure of any of the mix tellers, full mixing of terms over the Zp* space and enabling the mixes and audits to be fully independently rerun if necessary.

https://link.springer.com/content/pdf/10.1007/11863908_20.pdf

Prêt à voter with re-encryption mixes

Data sharing has never been easier with the advances of cloud computing, and an accurate analysis on the shared data provides an array of benefits to both the society and individuals. Data sharing with a large number of participants must take into account several issues, including efficiency, data integrity and privacy of data owner. Ring signature is a promising candidate to construct an anonymous and authentic data sharing system. It allows a data owner to anonymously authenticate his data which can be put into the cloud for storage or analysis purpose. Yet the costly certificate verification in the traditional public key infrastructure (PKI) setting becomes a bottleneck for this solution to be scalable. Identity-based (ID-based) ring signature, which eliminates the process of certificate verification, can be used instead. In this paper, we further enhance the security of ID-based ring signature by providing forward security: If a secret key of any user has been compromised, all previous generated signatures that include this user still remain valid. This property is especially important to any large scale data sharing system, as it is impossible to ask all data owners to re-authenticate their data even if a secret key of one single user has been compromised. We provide a concrete and efficient instantiation of our scheme, prove its security and provide an implementation to show its practicality.

/pdf/cost-effective-authentic-and-anonymous-data-sharing-with-3uk5umasqh.pdf

Cost-Effective Authentic and Anonymous Data Sharing with Forward Security

Sanitizable signatures allow a designated party, called the sanitizer, to modify parts of signed data such that the immutable parts can still be verified with respect to the original signer. Ateniese et al. (ESORICS 2005) discuss five security properties for such signature schemes: unforgeability, immutability, privacy, transparency and accountability. These notions have been formalized in a recent work by Brzuska et al. (PKC 2009), discussing also the relationships among the security notions. In addition, they prove a modification of the scheme of Ateniese et al. to be secure according to these notions.

Here we discuss that a sixth property of sanitizable signature schemes may be desirable: unlinkability. Basically, this property prevents that one can link sanitized message-signature pairs of the same document, thus allowing to deduce combined information about the original document. We show that this notion implies privacy, the inability to recover the original data of sanitized parts, but is not implied by any of the other five notions. We also discuss a scheme based on group signatures meeting all six security properties.

/pdf/unlinkability-of-sanitizable-signatures-1ul6r3uk23.pdf

Unlinkability of sanitizable signatures

Sanitizable signatures introduced by Ateniese et al. is a powerful and fairly practical tool that enables an authorised party called the censor to modify designated parts of a signed message in an arbitrary way without interacting with the signer. In our paper we present several extensions of this paradigm that make sanitizable signatures even more useful. First of all we show how to limit the censor's abilities to modify mutable parts of a signed message to a predetermined set of strings. In our next proposal we show how to construct a scheme wherein the censor can insert an arbitrary string into a document, but this must be the same string in all designated places. We also present a construction based on a sanitizable signature that allows the censor to present only a constant number of versions of the sanitized message. Another extension provides so-called strong transparency. In this case the verifier does not know which parts of the message could have been modified. Finally, we point out new applications of sanitizable signatures based on combining them with time released cryptography techniques.

Extended sanitizable signatures

We analyze electronic voting schemes and show that in many cases it is quite easy to implement a kleptographic channel, which is a profound danger for electronic voting systems. We show serious problems with Neff's scheme. We present also attacks on Chaum's visual voting scheme and some related schemes, which work at least when implementation is not careful enough.

/pdf/kleptographic-attacks-on-e-voting-schemes-4dko6mhu1a.pdf

Kleptographic attacks on e-voting schemes

David Chaum introduced Visual Voting scheme in which a voter obtains a paper receipt from a voting machine. This receipt can be used to verify that his vote was counted in the final tally, but cannot be used for vote selling. The Chaum's system requires sophisticated printers and application of randomized partial checking (RPC) method.

We propose a complete design of a voting system that preserves advantages of the Chaum's scheme, but eliminates the use of special printers and RPC.

/pdf/a-practical-voting-scheme-with-receipts-2tmqdsib6h.pdf

A practical voting scheme with receipts

We propose a version of ring signatures for which the set of potential signers may be reduced: the real signer can prove that he or she has created the signature, while every other member of the ring can prove not to be the signer. Possibility to run these protocols is triggered by publishing certain secret information. The proposed scheme is an intermediate solution between the classical ring and group signatures, and can be used for instance for e-auction schemes.

/pdf/step-out-ring-signatures-4u43o1id3p.pdf

Anna Lauks

Papers

Extended sanitizable signatures

Kleptographic attacks on e-voting schemes

A practical voting scheme with receipts

Step-Out Ring Signatures

Extended sanitizable signatures