IACR Summerschool – Blockchain Technologies Cryptographic e-Cash Jan Camenisch IBM Research – Zurich @JanCamenisch ibm.biz/jancamenisch © 2016 IBM Corporation eCash scenario & requirements Bank Withdrawal Deposit User Spend Merchant Requirements ● Anonymity: Withdrawal and Deposit must be unlinkable ● No Double Spending: Coin is bit-strings, can be spend twice 2 June 1, 2016 © 2016 IBM Corporation Towards a Solution: do it like paper money Bank Withdrawal 100 User 100 100 Deposit Spend Merchant # Sign notes with digital signature scheme – Note = (serial number #, value) – Secure because • signature scheme can not be forged • bank will accepts some serial number only once → on-line e-cash – Not anonymous because (cf. paper solution) • bit-string of signature is unique • serial number is unique 3 June 1, 2016 © 2016 IBM Corporation Towards a Solution Bank Withdrawal 100 100 100 User 100 100 Deposit Spend Merchant # Use (more) cryptography – Hide serial number from bank when issuing • e.g., sign commitment of serial number – Reveal serial number and proof • knowledge of signature on • commitment to serial number – Anonymous because of commitments scheme and zero-knowledge proof 4 June 1, 2016 © 2016 IBM Corporation How to implement this? Signature Schemes Encryption Schemes Zero-Knowledge Proofs Commitment Schemes ..... challenge is to do all this efficiently! 5 June 1, 2016 © 2016 IBM Corporation mathematical setting 6 June 1, 2016 © 2016 IBM Corporation Abelian Groups A set G with operation ▫ is called a group if: – closure for all a,b, in G → a ▫ b in G – commutativity for all a,b, in G → a ▫ b = b ▫ a – associativity for all a,b,c, in G → (a ▫ b) ▫ c = a ▫ (b ▫ c) – identity there exist some e in G, s.t. for all a: a ▫ e = a – invertibility for all a in G, there exist a-1 in G: a ▫ a-1 = e # Example: integers under addition (Z,+)={...,-2,-1,0,1,2,...} or (Zn,+) = {0,1,2,...,n-1} identity: e = 0 inverse: a-1 = - a June 1, 2016 © 2016 IBM Corporation Cyclic Groups # exponentiation = repeated application of ∙ , e.g., a3 = a ∙ a ∙ a # a group is cyclic if every element is power of some fixed element: – i.e., for each a in G, there is unique i such that gi = a – g = generator of the group – define g0= 1 = identity element G = <g> = {1=g0, g1, g2, ..., ., gq-1} – q = |G|= order of group if q is a prime number then G is cyclic → computation in exponents can be done modulo q: gi= gi mod q # computing with exponents: gi+j = gi ∙ gj gij = June 1, 2016 (gi) gi-j = gi / gj = gi ∙ (gj )-1 j i g-i = (g-1) = (gi) -1 © 2016 IBM Corporation The Discrete Logarithm Problem given g and x it is easy to compute gx, g1/x, .... given gx and gy it is easy to compute gx gy = gx+y Discrete Log Assumption given gx it is hard to compute x Diffie-Hellman Assumption given gx and gy it is hard to compute gxy Decisional Diffie-Hellman Assumption given gx, gy, and gz June 1, 2016 it is hard to decide if gz = gxy © 2016 IBM Corporation commitment scheme 10 June 1, 2016 © 2016 IBM Corporation Commitment Scheme: Functionality m m m, 2-36-17 June 1, 2016 ? mє m © 2016 IBM Corporation Commitment Scheme: Security Binding m, 2-36-17 m', 3-21-11 June 1, 2016 ? m є m ? m' є m © 2016 IBM Corporation Commitment Scheme: Security Binding m, 2-36-17 m', 3-21-11 June 1, 2016 ? m є m ? m' є m © 2016 IBM Corporation Commitment Scheme: Security Hiding: for all message m, m' m m' June 1, 2016 m m' © 2016 IBM Corporation Commitment Scheme: Security Hiding: for all message m, m' m m' June 1, 2016 m m' ? m m' m m' © 2016 IBM Corporation Commitment Schemes Group G = <g> = <h> of order q To commit to element x Є Zq: • Pedersen: perfectly hiding, computationally binding choose r Є Zq and compute c = gxhr • ElGamal: computationally hiding, perfectly binding: choose r Є Zq and compute c = (gxhr, gr) To open commitment: • reveal x and r to verifier • verifier checks if c = gxhr June 1, 2016 © 2016 IBM Corporation Pedersen's Commitment Scheme Pedersen's Scheme: Choose r Є Zq and compute c = gxhr Perfectly hiding: Let c be a commitment and u= logg h Thus c = gxhr = gx+ur = g(x+ur')+u(r-r') = gx+ur'hr-r' for any r'! I.e., given c and x' here exist r' such that c = gx'hr' Computationally binding: Let c, (x', r') and (x, r) s.t. c = gx'hr' = gxhr Then gx'-x = hr-r' and u = logg h = (x'-x)/(r-r') mod q June 1, 2016 © 2016 IBM Corporation Commitment Scheme: Extended Features Proof of Knowledge of Contents m Proof m true Proof of Relations among Contents m, m' Proof m = 2 •m' June 1, 2016 m m' true © 2016 IBM Corporation Commitment Scheme: Extended Features Let C1 = gmhr and C' = gm'hr then: m Proof m true PK{(α,β): C = gβhα } m, m' Proof m = 2 •m' PK{(α,β,γ): June 1, 2016 m m' true C' = gβhα ⋀ C = (g2)βhγ } © 2016 IBM Corporation zero-knowledge proofs 20 June 1, 2016 © 2016 IBM Corporation Zero-Knowledge Proofs # interactive proof between a prover and a verifier about the prover's knowledge Commitment Challenge Response # properties: zero-knowledge verifier learns nothing about the prover's secret proof of knowledge (soundness) prover can convince verifier only if she knows the secret completeness if prover knows the secret she can always convince the verifier 21 June 1, 2016 © 2016 IBM Corporation Zero Knowledge Proofs of Knowledge of Discrete Logarithms Given group <g> and element y Є <g> . Prover wants to convince verifier that she knows x s.t. y = gx such that verifier only learns y and g. x Prover: random r t := gr t c s := r - cx y, g Verifier: s random c t = gs yc ? notation: PK{(α): y = gα } 22 June 1, 2016 © 2016 IBM Corporation Zero Knowledge Proofs: Security Proof of Knowledge Property: If prover is successful with non-negl. probability, then she “knows” x = log g y , i.e., ones can extract x from her. Assume c ∈ {0,1}k and consider execution tree: c=0 x c = 2k-1 x .. .. x x If success probability for any prover (including malicious ones) is >2 -k then there are two accepting tuples (t,c1,s1) and (t,c2,s2) for the same t. June 1, 2016 © 2016 IBM Corporation Zero Knowledge Proofs: Security Prover might do protocol computation in any way it wants & we cannot analyse code. Thought experiment: # Assume we have prover as a black box → we can reset and rerun prover # Need to show how secret can be extracted via protocol interface t x t c x s t = gs yc = gs' yc' s' → yc'-c = gs-s' → y = g(s-s')/(c'-c) → June 1, 2016 c' x = (s-s')/(c'-c) mod q © 2016 IBM Corporation Zero Knowledge Proofs: Security Zero-knowledge property: If verifier does not learn anything (except the fact that Alice knows x = log g y ) Idea: One can simulate whatever Bob “sees”. Choose random c', s' compute t := g s' c' y t c if c = c' send s' = s , otherwise restart s Problem: if domain of c too large, success probability becomes too small June 1, 2016 © 2016 IBM Corporation Zero Knowledge Proofs: Security One way to modify protocol to get large domain c: x y, g Prover: Verifier: random r random c,v h := H(c,v) t := gr h := H(c,v) ? s := r - cx h t c,v s t = gs yc ? notation: PK{(α): y = gα } 26 June 1, 2016 © 2016 IBM Corporation Zero Knowledge Proofs: Security One way to modify protocol to get large domain c: Choose random c', s' compute t' := gs' yc' after having received c “reboot” verifier Choose random s compute t := gs yc send s h t' c,v h t c,v s June 1, 2016 © 2016 IBM Corporation From Protocols To Signatures Signature SPK{(α): y = gα }(m): Signing a message m: - chose random r Є Zq and - compute - output c := H(gr||m) = H(t||m) s := r - cx mod (q) (c,s) Verifying a signature (c,s) on a message m: - check c = H(gs yc||m) ? ↔ t = gs yc ? Security: - underlying protocol is zero-knowledge proof of knowledge - hash function H(.) behaves as a “random oracle.” 28 June 1, 2016 © 2016 IBM Corporation Zero Knowledge Proofs of Knowledge of Discrete Logarithms Many Exponents: PK{(α,β,γ,δ): y = gα hβzγkδuβ } Logical combinations: PK{(α,β): y = gα ∧ z = gβ ∧ u = gβhα } PK{(α,β): y = gα ∨ z = gβ } Intervals and groups of different order (under SRSA): PK{(α): y = gα ∧ α Є [A,B] } PK{(α): y = gα ∧ z = gα ∧ α Є [0,min{ord(g),ord(g)}] } Non-interactive (Fiat-Shamir heuristic, Schnorr Signatures): PK{(α): y = gα }(m) 29 June 1, 2016 © 2016 IBM Corporation Some Example Proofs and Their Analysis Let g, h, C1, C2, C3 be group elements. Now, what does PK{(α1,β1,α2,β2, α3, β3): C1= gα1hβ1 ∧ C2= gα2hβ2 ∧ C3 =gα3hβ3∧ C3 = gα1gα2hβ3 } mean? → Prover knows values α1, β1, α2, β2, β3 such that C1= gα1hβ1 , C2= gα2hβ2 and C3 = gα1gα2hβ3 = gα1 + α2 hβ3 = g α3 hβ3 α3 = a1 + a2 (mod q) And what about: PK{(α1,...,β3): → C3 = gα1gα2hβ3 = gα1 + 5 α2 hβ3 α3 = a1 + 5 a2 30 C1= gα1hβ1 ∧ C2= gα2hβ2 ∧ C3 =gα3hβ3 ∧ C3 = gα1 (g5)α2hβ3 } June 1, 2016 (mod q) © 2016 IBM Corporation Some Example Proofs and Their Analysis Let g, h, C1, C2, C3 be group elements. Now, what does C1= gα1hβ1 ∧ C2= gα2hβ2 ∧ C3 =gα3hβ3 ∧ C3 = C2α1hβ3 } mean? PK{(α1,..,β3): → Prover knows values α1, β1, α2, β2, β3 such that C1= gα1hβ1 , C2= gα2hβ2 and C3 = C2α1hβ3 = (gα2hβ2)α1hβ3 = gα2·α1hβ3+β2·α1 C3 = gα2·α1 hβ3+β2·α1 = gα3 hβ3' a3 = a1 · a2 (mod q) And what about PK{(α1,β1 β2): → 31 C1= gα1hβ1 ∧ C2= gα2hβ2 ∧ C2 = C1α1hβ2 } a2 = a12 (mod q) June 1, 2016 © 2016 IBM Corporation Some Example Proofs and Their Analysis Let g, h, C1, C2, C3 be group elements. Now, what does PK{(α1,..,β2): C1= gα1hβ1 ∧ C2= gα2hβ2 ∧ g = (C2/C1)α1hβ2 } mean? → Prover knows values α, β1, β2 such that C1= gα1hβ1 g = (C2/C1)α1hβ2 = (C2 g-α1h-β1)α1 hβ2 → g1/α1 = C2 g-α1h-β1 hβ2/α1 C2 = gα1 hβ1 h-β2/α1 g1/α1 = gα1 + 1/α1 hβ1-β2/α1 C2 = gα2 hβ2 α2 = α1 + a1-1 (mod q) 32 June 1, 2016 © 2016 IBM Corporation signature schemes 33 June 1, 2016 © 2016 IBM Corporation Signature Scheme: Functionality Key Generation June 1, 2016 © 2016 IBM Corporation Signature Scheme: Functionality Signing (m1,..., mk) σ = sig((m1,..., mk), ) June 1, 2016 © 2016 IBM Corporation Signature Scheme: Functionality Verification (m1,..., mk) σ σ = sig((m1,..., mk), ) ver(σ,(m1,..., mk), ) = true June 1, 2016 © 2016 IBM Corporation Signature Scheme: Security Unforgeability under Adaptive Chosen Message Attack m1 June 1, 2016 σ1 © 2016 IBM Corporation Signature Scheme: Security Unforgeability under Adaptive Chosen Message Attack m1 ml June 1, 2016 σ1 σl © 2016 IBM Corporation Signature Scheme: Security Unforgeability under Adaptive Chosen Message Attack m1 ml σ1 σl σ' and m'≠ mi s.t. ver(σ', m', June 1, 2016 ) = true © 2016 IBM Corporation Signature Scheme: Security Unforgeability under Adaptive Chosen Message Attack m1 ml σ1 σl σ' and m'≠ mi s.t. ver(σ', m', June 1, 2016 ) = true © 2016 IBM Corporation signature schemes with protocols 41 June 1, 2016 © 2016 IBM Corporation Signature Scheme: Signing Hidden Messages ( m1 m,... , m m,jmj+1,..., mk) σ ver(σ,(m1,..., mk), ) = true σ = sig((( m1 mj, mj+1,..., mk), ) m,... , m Verification remains unchanged! Security requirements basically the same, but • Signer should not learn any information about m1, ..., mj • Forgery w.r.t. message clear parts and opening of commitments June 1, 2016 © 2016 IBM Corporation Proving Possession of a Signature σ on (m1,..., mk) June 1, 2016 © 2016 IBM Corporation Proving Possession of a Signature σ on (m1,..., mk) {mi | i є S} June 1, 2016 © 2016 IBM Corporation Proving Possession of a Signature σ on (m1,..., mk) {mi | i є S} σ, {mi | i є/ S} {mi | i є S}, Proof protocol true Variation: ● Send also mi to verifier and ● Prove that committed messages are signed ● Prove properties about hidden/committed m i June 1, 2016 © 2016 IBM Corporation Blind Signatures vs Signatures with Protocols can be used multiple times can be used only once Damgaard,Camenisch&Lysyanska ya Chaum, Brands, et al. Discrete Logs, RSA,.. Strong RSA, DL-ECC,.. June 1, 2016 © 2016 IBM Corporation Some signature schemes 47 June 1, 2016 © 2016 IBM Corporation RSA Signature Scheme – For Reference Rivest, Shamir, and Adlemann 1978 Secret Key: two random primes p and q Public Key: n := pq, prime e, and collision-free hash function H: {0,1}* -> {0,1}ℓ Computing signature on a message m Є {0,1}* d := 1/e mod (p-1)(q-1) s := H(m) d mod n Verification of signature s on a message m Є {0,1}* se = H(m) Correctness: se = (H(m)d)e = H(m)d·e = H(m) 48 June 1, 2016 (mod n) (mod n) © 2016 IBM Corporation RSA Signature Scheme – for reference Verification signature on a message m Є {0,1}* e s := H(m) (mod n) Wanna do proof of knowledge of signature on a message, e.g., PK{ (m,s): se = H(m) (mod n) } But this is not a valid proof expression!!!! :-( 49 June 1, 2016 © 2016 IBM Corporation CL-Signature Scheme Public key of signer: RSA modulus n and ai, b, d Є QRn, Secret key: factors of n To sign k messages m1, ..., mk Є {0,1}ℓ : ● choose random prime 2ℓ+2 > e > 2ℓ+1 and integer s ≈ n ● compute c : c = (d / (a m1·...· a mk bs ))1/e mod n 1 ● 50 k signature is (c,e,s) June 1, 2016 © 2016 IBM Corporation CL-Signature Scheme To verify a signature (c,e,s) on messages m1, ..., mk: ● m1, ..., mk Є {0,1}ℓ: ● e > 2ℓ+1 ● d = ce a m1 1 ·...· a mk k bs mod n Theorem: Signature scheme is secure against adaptively chosen message attacks under Strong RSA assumption. 51 June 1, 2016 © 2016 IBM Corporation Sign blindly with CL signatures ( m1 m,... , m m,jmj+1,..., mk) σ σ = sig((( m1 mj, mj+1,..., mk), ) m,... , m C=a m1 a 1 m2 2 bs’ m2 m1 C + PK{(m1,m2,s’): C = a1 a2 s’ b } Choose e,s” (c,e,s’’) e d= c a 52 June 1, 2016 m1 1 a 2 m2 a m3 3 b s’+s’’ c = (d/(C a 3 m3 bs”))1/e mod n mod n © 2016 IBM Corporation Proving Knowledge of a CL-signature Recall: d = ce a1m1a2m2 bs mod n Observe: # Let c' = c btmod n with randomly chosen t # Then d = c'e a1m1a2m2 bs-et (mod n), i.e., (c',e, s* = s-et) is also signature on m1 and m2 To prove knowledge of signature (c',e, s*) on m2 and some m1 # provide c' # PK{(ε, µ1, σ) : d/a2m2 := c'ε a1µ1 b σ ∧ µ Є {0,1}ℓ ∧ ε > 2ℓ+1 } → proves d := c'ε a1µ1 a2m2b σ 53 June 1, 2016 © 2016 IBM Corporation Realizing On-Line eCash 54 June 1, 2016 © 2016 IBM Corporation Recall basic idea Bank Withdrawal 100 100 100 User 100 100 Deposit Spend Merchant # Issue coin: Hide serial number from bank when issuing – sign commitment of random serial number # Spend coin: reveal serial number and proof – knowledge of signature on – commitment to serial number 55 June 1, 2016 © 2016 IBM Corporation On-line E-cash: Withdrawal Choose e,s” c = (d/(C bs”))1/e mod n choose random #, s' and compute C=a 1 # bs' p + C of o r ”) s , e (c, (c,e,s”+s') s.t. d = ce a June 1, 2016 1 # bs” + s' (mod n) © 2016 IBM Corporation On-line E-cash: Payment (c,e,s”+s') s.t. e d= c a 1 # b s” + s' (mod n) compute s' c' = c b mod n proof = PK{(ε, µ, ρ, σ) : June 1, 2016 #, c', pro of d/a # 1 = c'ε b σ (mod n) } © 2016 IBM Corporation On-line E-cash: Payment (c,e,s”+s') s.t. 1 # b s” + s' (mod n) compute s' c' = c b mod n proof = PK{(ε, µ, ρ, σ) : June 1, 2016 #, c', pro of d/a # 1 #, c', proof e d= c a # Є L? OK/ not OK = c'ε b σ (mod n) } © 2016 IBM Corporation Security # Anonymity – Bank does not learn # during withdrawal – Bank & Shop do not learn c, e when spending (c ”) s , ,e #, c', pro of June 1, 2016 #, c', proof C of o r p + # Є L? OK/ not OK © 2016 IBM Corporation Security Double Spending: # Spending = Compute –c' = c bs'mod n –proof = PK{(ε, µ, ρ, σ) : d/a # 1 = c'ε b σ (mod n) } # Can use the same # only once.... – If more #'s are presented than withdrawals: • Proofs would not sound • Signature scheme would not secure June 1, 2016 © 2016 IBM Corporation Realizing Off-Line eCash 61 June 1, 2016 © 2016 IBM Corporation Recall On-Line E-Cash On-Line Solution: 1. Coin = random serial # (chosen by user) signed by Bank 2. Banks signs blindly 3. Spending by sending # and prove knowledge of signature to Merchant 4. Merchant checks validy w/ Bank 100 5. Bank accepts each serial # only once. 100 100 Off-Line: - Can check serial # only after the fact - … but at that point user will have been disappeared... June 1, 2016 © 2016 IBM Corporation Towards off-line signatures Goal: – spending coin once: OK – spending coin twice: anonymity revoked kabl n i L t No 100 No t Lin ka b Link abl e 100 e le 100 Seems like a paradox, but crypto is all about solving paradoxical problems :-) 63 June 1, 2016 © 2016 IBM Corporation Off-line E-cash Main Idea: – Include #, id, r – Upon spending: reveal #, and t = id + r u, with c randomly chosen by merchant – t won't reveal anything about id! – However, given two equations (for the same #, id, r) t1 = id + r u1 t2 = id + r u2 one can solve for id. June 1, 2016 © 2016 IBM Corporation Off-line E-cash: Withdrawal choose random #, r, s' and compute C=a 1 # a 2 r bs' p + C of o r d = ce C a 3 nym bs” mod n ”) s , e (c, (c,e,s”+s') s.t. d = ce a June 1, 2016 1 # a 2 r a 3 nym bs” + s' (mod n) © 2016 IBM Corporation Off-line E-cash: Payment Let G=<g> be a group of order q (c,e,s”+s') s.t. e d= c a # a 1 2 r a 3 nym b s” + s' t, # , c' compute t = r + u nym mod q c' = c bs'mod n proof = PK{(ε, µ, ρ, σ) : d/a June 1, 2016 1 # (mod n) u , pr oo f = c'ε a ρa µ b σ (mod n) 2 3 choose random u ⋀ gt = gρ (gu)µ } © 2016 IBM Corporation Off-line E-cash: Payment PK{(ε, µ, ρ, σ) : d/a 1. d = c'ε a 1 # 1 = c'ε a ρa µ b σ (mod n) ⋀ gt = gρ (gu)µ } # 2 3 a ρa µ b σ (mod n) 2 => (c', ε, σ) 3 is a signature on (#, µ, ρ) 2. gt = gρ+uµ => t = ρ + u µ mod q, i.e., t was computed correctly! June 1, 2016 © 2016 IBM Corporation Off-line E-cash: Deposit # Є L? If so: 1. t = ρ + u µ (mod q) 2. t' = ρ + u' µ (mod q) solve for ρ and µ. => µ = nym because of proof u, t, #, proof June 1, 2016 © 2016 IBM Corporation Off-line E-cash: Security # Unforgeable: – no more coins than #'s, • otherwise one can forge signatures • or proofs are not sound – if coins with same # appears with different u's => reveals nym # Anonymity: – # and r are hidden from signer upon withdrawal – t does not reveal anything about nym (is blinded by r) – proof proof does not reveal anything June 1, 2016 © 2016 IBM Corporation Extensions and more e-Cash # K-spendable cash – Multiple serial numbers and randomizers per coin – Use PRF to generate serial number and randomizers from seed in coin # Money laundering preventions – Must not spend more that $10000 dollars with same party – Essentially use additional coin defined per merchant that controls this Other protocols from these building blocks, essentially anything with authentication and privacy # Anonymous credentials, eVoting, .... Alternative building blocks # A number of signatures scheme that fit the same bill # (Verifiable) encryption schemes that work along as well # Alternative framework: Groth-Sahai proofs plus “structure-preserving” schemes June 1, 2016 © 2016 IBM Corporation Thank you! # eMail: [email protected] # Links: – www.abc4trust.eu – www.futureID.eu – www.au2eu.eu – www.PrimeLife.eu – www.zurich.ibm.com/idemix – idemixdemo.zurich.ibm.com # Code – github.com/p2abcengine & abc4trust.eu/idemix 71 June 1, 2016 © 2016 IBM Corporation References # D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In EUROCRYPT ’87, vol. 304 of LNCS, pp. 127–141. Springer-Verlag, 1988. # S. Brands. Rapid demonstration of linear relations connected by boolean operators.In EUROCRYPT ’97, vol. 1233 of LNCS, pp. 318–333. Springer Verlag, 1997. # Mihir Bellare: Computational Number Theory http://www-cse.ucsd.edu/~mihir/cse207/w-cnt.pdf # Camenisch, Lysanskaya: Dynamic Accumulators and Applications to Efficient Revocation of Anonymous Credentials. Crypto 2002, Lecture Notes in Computer Science, Springer Verlag. # Ateniese, Song, Tsudik: Quasi-Efficient Revocation of Group Signatures. In Financial Cryptography 2002, Lecture Notes in Computer Science, Springer Verlag. # Jan Camenisch, Natalie Casati, Thomas Gross, Victor Shoup: Credential Authenticated Identification and Key Exchange. CRYPTO 2010:255-276 # Jan Camenisch, Maria Dubovitskaya, Gregory Neven: Oblivious transfer with access control. ACM Conference on Computer and Communications Security 2009: 131-140 # Ateniese, Song, Tsudik: Quasi-Efficient Revocation of Group Signatures. In Financial Cryptography 2002, Lecture Notes in Computer Science, Springer Verlag. # M. Bellare, C. Namprempre, D. Pointcheval, and M. Semanko: The One-More-RSA-Inversion Problems and the Security of Chaum's Blind Signature Scheme. Journal of Cryptology, Volume 16, Number 3. Pages 185 -215, Springer-Verlag, 2003. # E. Bangerter, J. Camenisch and A. Lyskanskaya: A Cryptographic Framework for the Controlled Release Of Certified Data. In Twelfth International Workshop on Security Protocols 2004. www.zurich.ibm.com/~jca/publications # Stefan Brands: Untraceable Off-line Cash in Wallets With Observers: In Advances in Cryptology – CRYPTO '93. Springer Verlag, 1993. June 1, 2016 © 2016 IBM Corporation References # J. Camenisch and A. Lyskanskaya: Efficient Non-transferable Anonymous Multi-show Credential System with Optional Anonymity Revocation. www.zurich.ibm.com/~jca/publications # David Chaum: Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms. In Communications of the ACM, Vol. 24 No. 2, pp. 84—88, 1981. # David Chaum: Blind Signatures for Untraceable Payments. In Advances in Cryptology – Proceedings of CRYPTO '82, 1983. # David Chaum: Security Without Identification: Transaction Systems to Make Big Brother obsolete: in Communications of the ACM, Vol. 28 No. 10, 1985. # Camenisch, Shoup: Practical Verifiable Encryption and Decryption of Discrete Logarithms. CRYPTO 2003: 126-144 # Victor Shoup: A computational introduction to Number Theory and Algebra. Available from: http://www.shoup.net/ntb/ # D. Chaum: Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms. In Communications of the ACM. # D. Chaum: The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability. Journal of Cryptology, 1988. # J. Camenisch and V. Shoup: Practical Verifiable Encryption and Decryption of Discrete Logarithms. In Advances in Cryptology CRYPTO 2003. # T. ElGamal: A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms. In Advances in Cryptology CRYPTO '84. June 1, 2016 © 2016 IBM Corporation