2022-researchexchange.tex (26821B)
1 %\pdfminorversion=3 2 \documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer} 3 \include{setup} 4 5 \title{Zero-Knowledge Age Restriction for GNU Taler} 6 %\subtitle{} 7 8 \setbeamertemplate{navigation symbols}{% 9 \includegraphics[width=1.6cm]{images/fub.pdf} 10 \hspace{1em} 11 \includegraphics[width=2.3cm]{images/bfh.png} 12 \includegraphics[width=1cm]{images/taler-logo-2020.jpg} 13 \includegraphics[width=1cm]{images/fraunhofer.png} 14 \hfill% 15 } 16 %\setbeamercovered{transparent=1} 17 18 \author{Özgür Kesim, Christian Grothoff,\\ Florian Dold, Martin Schanzenbach} 19 \institute{FU Berlin, BFH, Taler Systems SA, Fraunhofer AISEC} 20 21 22 \begin{document} 23 24 25 \section{Introduction} 26 27 \begin{frame}{Age restriction in E-commerce} 28 29 \begin{description} 30 \item[Problem:]~\\[1em] 31 Verification of minimum age requirements in e-commerce.\\[2em] 32 33 \item[Common solutions:] 34 35 \begin{tabular}{l<{\onslide<2->}c<{\onslide<3->}cr<{\onslide}} 36 & \blue{Privacy} & \tikzmark{topau} \blue{Ext. authority}& \\[\medskipamount] 37 1. ID Verification & bad & required & \\[\medskipamount] 38 2. Restricted Accounts & bad & required & \\[\medskipamount] 39 3. Attribute-based & good & required &\tikzmark{bottomau} \\[\medskipamount] 40 \end{tabular} 41 \end{description} 42 43 \uncover<4->{ 44 \begin{tikzpicture}[overlay,remember picture] 45 \draw[orange,thick,rounded corners] 46 ($(pic cs:topau) +(0,0.5)$) rectangle ($(pic cs:bottomau) -(0.3, 0.2)$); 47 \end{tikzpicture} 48 \begin{center} 49 \bf Principle of Subsidiarity is violated 50 \end{center} 51 } 52 \end{frame} 53 54 55 \begin{frame}{Principle of Subsidiarity} 56 \begin{center} \Large 57 Functions of government---such as granting and restricting 58 rights---should be performed\\ 59 {\it at the lowest level of authority possible},\\ 60 as long as they can be performed {\it adequately}. 61 \end{center} 62 \vfill 63 \uncover<2->{ 64 For age-restriction, the lowest level of authority is:\\ 65 \begin{center}\Large 66 Parents, guardians and caretakers 67 \end{center} 68 } 69 \end{frame} 70 71 \begin{frame}{Our contribution} 72 Design and implementation of an age restriction scheme\\ 73 with the following goals: 74 75 \begin{enumerate} 76 \item It ties age restriction to the \textbf{ability to pay} (not to ID's) 77 \item maintains \textbf{anonymity of buyers} 78 \item maintains \textbf{unlinkability of transactions} 79 \item aligns with \textbf{principle of subsidiartiy} 80 \item is \textbf{practical and efficient} 81 \end{enumerate} 82 83 \end{frame} 84 85 86 \section{Age Restriction} 87 88 \begin{frame}{Age restriction} 89 \framesubtitle{Assumptions and scenario} 90 91 \begin{columns} 92 \column{7.5cm} 93 \begin{itemize} 94 \item<1-> Assumption: Checking accounts are under control of eligible adults/guardians. 95 \item<2-> \textit{Guardians} \textbf{commit} to an maximum age 96 \item<3-> \textit{Minors} \textbf{attest} their adequate age 97 \item<4-> \textit{Merchants} \textbf{verify} the attestations 98 \item<5-> Minors \textbf{derive} age commitments from existing ones 99 \item<6-> \textit{Exchanges} \textbf{compare} the derived age commitments 100 \end{itemize} 101 \column{5cm} 102 \uncover<7-> 103 { 104 \begin{center} 105 \fontsize{7pt}{7pt}\selectfont 106 \begin{tikzpicture}[scale=.5] 107 \node[circle,minimum size=15pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 108 \node[circle,minimum size=15pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 109 \node[circle,minimum size=15pt,fill=black!15] at ( 0:4) (Merchant) {$\Merchant$}; 110 \node[circle,minimum size=15pt,fill=blue!15] at (140:3) (Guardian) {$\Guardian$}; 111 112 \draw[->] (Guardian) to [out=50,in=130, loop] node[above] 113 {$\Commit$} (Guardian); 114 \draw[->,blue] (Client) to [out=-125,in=-190, loop] node[below,left] 115 {\blue{$\Attest$}} (Client); 116 \draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above] 117 {\blue{$\Verify$}} (Merchant); 118 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 119 {\orange{$\Derive$}} (Client); 120 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 121 {\orange{$\Compare$}} (Exchange); 122 123 \draw[orange,|->] (Client) to node[sloped,above,align=left] 124 {\orange{\scriptsize }} (Exchange); 125 \draw[blue,|->] (Client) to node[sloped, above] 126 {\blue{\scriptsize }} (Merchant); 127 \draw[,|->] (Guardian) to node[above,sloped,align=left] 128 {{\scriptsize }} (Client); 129 \end{tikzpicture} 130 \end{center} 131 } 132 \end{columns} 133 \vfill 134 \uncover<7->{Note: Scheme is independent of payment service protocol.} 135 \end{frame} 136 137 138 \begin{frame}{Formal Function Signatures} 139 \small 140 Searching for functions \uncover<2->{with the following signatures} 141 \begin{align*} 142 &\bf \Commit\uncover<2->{: 143 &(\age, \omega) &\mapsto (\commitment, \pruf) 144 &\scriptstyle \N_\Age \times \Omega &\scriptstyle \to \Commitments\times\Proofs, 145 } 146 \\ 147 &\bf \Attest\uncover<3->{: 148 &(\minage, \commitment, \pruf) &\mapsto \attest 149 &\scriptstyle \N_\Age\times\Commitments\times\Proofs &\scriptstyle \to \Attests \cup \{\Nil\}, 150 } 151 \\ 152 &\bf \Verify\uncover<4->{: 153 &(\minage, \commitment, \attest) &\mapsto b 154 &\scriptstyle \N_\Age\times\Commitments\times\Attests &\scriptstyle \to \Z_2, 155 } 156 \\ 157 &\bf \Derive\uncover<5->{: 158 &(\commitment, \pruf, \omega) &\mapsto (\commitment', \pruf', \blinding) 159 &\scriptstyle \Commitments\times\Proofs\times\Omega &\scriptstyle \to \Commitments\times\Proofs\times\Blindings, 160 } 161 \\ 162 &\bf \Compare\uncover<6->{: 163 &(\commitment, \commitment', \blinding) &\mapsto b 164 &\scriptstyle \Commitments\times\Commitments\times\Blindings &\scriptstyle \to \Z_2, 165 } 166 \end{align*} 167 \uncover<7->{ 168 with $\Omega, \Proofs, \Commitments, \Attests, \Blindings$ 169 sufficiently large sets.\\[1em] 170 Basic and security requirements are defined later.\\[2em] 171 } 172 173 \scriptsize 174 \uncover<2->{ 175 Mnemonics:\\ 176 $\Commitments=$ \textit{c$\Commitments$mmitments}, 177 $\commitment=$ \textit{Q-mitment} (commitment), 178 $\Proofs=$ \textit{$\Proofs$roofs}, 179 } 180 \uncover<3->{ 181 $\pruf=$ \textit{$\pruf$roof},\\ 182 $\Attests=$ \textit{a$\Attests$testations}, 183 $\attest=$ \textit{a$\attest$testation}, 184 } 185 \uncover<5->{ 186 $\Blindings=$ \textit{$\Blindings$lindings}, 187 $\blinding=$ \textit{$\blinding$linding}. 188 } 189 \end{frame} 190 191 \begin{frame}{Age restriction} 192 \framesubtitle{Naïve scheme} 193 \begin{center} 194 \begin{tikzpicture}[scale=.85] 195 \node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 196 \node[circle,minimum size=20pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 197 \node[circle,minimum size=20pt,fill=black!15] at ( 0:4) (Merchant) {$\Merchant$}; 198 \node[circle,minimum size=20pt,fill=blue!15] at (140:3) (Guardian) {$\Guardian$}; 199 200 \draw[->] (Guardian) to [out=50,in=130, loop] node[above] 201 {$\Commit$} (Guardian); 202 \draw[->,blue] (Client) to [out=-125,in=-190, loop] node[below,left] 203 {\blue{$\Attest$}} (Client); 204 \draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above] 205 {\blue{$\Verify$}} (Merchant); 206 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 207 {\orange{$\Derive$}} (Client); 208 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 209 {\orange{$\Compare$}} (Exchange); 210 211 \draw[orange,|->] (Client) to node[sloped,above,align=left] 212 {\orange{\scriptsize }} (Exchange); 213 \draw[blue,|->] (Client) to node[sloped, above] 214 {\blue{\scriptsize }} (Merchant); 215 \draw[,|->] (Guardian) to node[above,sloped,align=left] 216 {{\scriptsize }} (Client); 217 \end{tikzpicture} 218 \end{center} 219 \end{frame} 220 221 \begin{frame}{Achieving Unlinkability} 222 \begin{columns} 223 \column{3cm} 224 \begin{center} 225 \fontsize{8pt}{9pt}\selectfont 226 \begin{tikzpicture}[scale=.65] 227 \node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 228 \node[circle,minimum size=20pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 229 230 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 231 {\orange{$\footnotesize \Derive()$}} (Client); 232 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 233 {\orange{$\footnotesize \Compare()$}} (Exchange); 234 235 \draw[orange,|->] (Client) to node[sloped,above,align=left] 236 {\orange{\tiny \uncover<2->{$(\commitment_i,\commitment_{i+1})$}}} (Exchange); 237 \end{tikzpicture} 238 \end{center} 239 240 \column{9cm} 241 Simple use of $\Derive()$ and $\Compare()$ is problematic. 242 243 \begin{itemize} 244 \item<2-> Calling $\Derive()$ iteratively generates sequence 245 $(\commitment_0, \commitment_1, \dots)$ of commitments. 246 \item<2-> Exchange calls $\Compare(\commitment_i, \commitment_{i+1}, .)$ 247 \item[$\implies$]\uncover<3->{\bf Exchange identifies sequence} 248 \item[$\implies$]\uncover<3->{\bf Unlinkability broken} 249 \end{itemize} 250 \end{columns} 251 \end{frame} 252 253 \begin{frame}{Achieving Unlinkability} 254 Define cut\&choose protocol \orange{$\DeriveCompare$}, 255 using $\Derive()$ and $\Compare()$.\\[0.5em] 256 \uncover<2->{ 257 Sketch: 258 \small 259 \begin{enumerate} 260 \item $\Child$ derives commitments $(\commitment_1,\dots,\commitment_\kappa)$ 261 from $\commitment_0$ \\ 262 by calling $\Derive()$ with blindings $(\beta_1,\dots,\beta_\kappa)$ 263 \item $\Child$ calculates $h_0:=H\left(H(\commitment_1, \beta_1)||\dots||H(\commitment_\kappa, \beta_\kappa)\right)$ 264 \item $\Child$ sends $\commitment_0$ and $h_0$ to $\Exchange$ 265 \item $\Exchange$ chooses $\gamma \in \{1,\dots,\kappa\}$ randomly 266 \item $\Child$ reveals $h_\gamma:=H(\commitment_\gamma, \beta_\gamma)$ and all $(\commitment_i, \beta_i)$, except $(\commitment_\gamma, \beta_\gamma)$ 267 \item $\Exchange$ compares $h_0$ and 268 $H\left(H(\commitment_1, \beta_1)||...||h_\gamma||...||H(\commitment_\kappa, \beta_\kappa)\right)$\\ 269 and evaluates $\Compare(\commitment_0, \commitment_i, \beta_i)$. 270 \end{enumerate} 271 \vfill 272 Note: Scheme is similar to the {\it refresh} protocol in GNU Taler. 273 } 274 \end{frame} 275 276 \begin{frame}{Achieving Unlinkability} 277 With \orange{$\DeriveCompare$} 278 \begin{itemize} 279 \item $\Exchange$ learns nothing about $\commitment_\gamma$, 280 \item trusts outcome with $\frac{\kappa-1}{\kappa}$ certainty, 281 \item i.e. $\Child$ has $\frac{1}{\kappa}$ chance to cheat. 282 \end{itemize} 283 \vfill 284 Note: Still need Derive and Compare to be defined. 285 \end{frame} 286 287 \begin{frame}{Refined scheme} 288 289 \begin{tikzpicture}[scale=.8] 290 \node[circle,minimum size=25pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 291 \node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$}; 292 \node[circle,minimum size=25pt,fill=black!15] at ( 0:5) (Merchant) {$\Merchant$}; 293 \node[circle,minimum size=25pt,fill=blue!15] at (130:3) (Guardian) {$\Guardian$}; 294 295 \draw[orange,<->] (Client) to node[sloped,below,align=center] 296 {\orange{$\DeriveCompare$}} (Exchange); 297 \draw[blue,->] (Client) to node[sloped, below] 298 {\blue{$(\attest_\minage, \commitment)$}} (Merchant); 299 300 \draw[->] (Guardian) to [out=150,in=70, loop] node[above] 301 {$\Commit(\age)$} (Guardian); 302 \draw[->] (Guardian) to node[below,sloped] 303 {($\commitment$, $\pruf_\age$)} (Client); 304 \draw[->,blue] (Client) to [out=-50,in=-130, loop] node[below] 305 {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client); 306 \draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below] 307 {\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant); 308 \end{tikzpicture} 309 \end{frame} 310 311 % \begin{frame}{Achieving Unlinkability} 312 % \scriptsize 313 % $\DeriveCompare : \Commitments\times\Proofs\times\Omega \to \{0,1\}$\\ 314 % \vfill 315 % $\DeriveCompare(\commitment, \pruf, \omega) =$ 316 % \begin{itemize} 317 % \it 318 % \itemsep0.5em 319 % \item[$\Child$:] 320 % \begin{enumerate} 321 % \scriptsize 322 % \itemsep0.3em 323 % \item for all $i \in \{1,\dots,\kappa\}: 324 % (\commitment_i,\pruf_i,\beta_i) \leftarrow \Derive(\commitment, \pruf, \omega + i)$ 325 % \item $h \leftarrow \Hash\big(\Hash(\commitment_1,\beta_1)\parallel\dots\parallel\Hash(\commitment_\kappa,\beta_\kappa) \big)$ 326 % \item send $(\commitment, h)$ to $\Exchange$ 327 % \end{enumerate} 328 % \item[$\Exchange$:] 329 % \begin{enumerate} 330 % \setcounter{enumi}{4} 331 % \scriptsize 332 % \itemsep0.3em 333 % \item save $(\commitment, h)$ \label{st:hash} 334 % \item $\gamma \drawfrom \{1,\dots ,\kappa\}$ 335 % \item send $\gamma$ to $\Child$ 336 % \end{enumerate} 337 % \item[$\Child$:] 338 % \begin{enumerate} 339 % \setcounter{enumi}{7} 340 % 341 % \scriptsize 342 % \itemsep0.3em 343 % \item $h'_\gamma \leftarrow \Hash(\commitment_\gamma, \beta_\gamma)$ 344 % \item $\mathbf{E}_\gamma \leftarrow \big[(\commitment_1,\beta_1),\dots, 345 % (\commitment_{\gamma-1}, \beta_{\gamma-1}), 346 % \Nil, 347 % (\commitment_{\gamma+1}, \beta_{\gamma+1}), 348 % \dots,(\commitment_\kappa, \beta_\kappa)\big]$ 349 % \item send $(\mathbf{E}_\gamma, h'_\gamma)$ to $\Exchange$ 350 % \end{enumerate} 351 % \item[$\Exchange$:] 352 % \begin{enumerate} 353 % \setcounter{enumi}{10} 354 % \scriptsize 355 % \itemsep0.3em 356 % \item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}: h_i \leftarrow \Hash(\mathbf{E}_\gamma[i])$ 357 % \item if $h \stackrel{?}{\neq} \HashF(h_1\|\dots\|h_{\gamma-1}\|h'_\gamma\|h_{\gamma+1}\|\dots\|h_{\kappa-1})$ return 0 358 % \item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}$: 359 % if $0 \stackrel{?}{=} \Compare(\commitment,\commitment_i, \beta_i)$ return $0$ 360 % \item return 1 361 % \end{enumerate} 362 % \end{itemize} 363 % \end{frame} 364 365 \begin{frame}{Basic Requirements} 366 367 Candidate functions 368 \[ (\Commit, \Attest, \Verify, \Derive, \Compare) \] 369 must first meet \textit{basic} requirements: 370 371 \begin{itemize} 372 \item Existence of attestations 373 \item Efficacy of attestations 374 \item Derivability of commitments and attestations 375 \end{itemize} 376 \end{frame} 377 378 \begin{frame}{Basic Requirements} 379 \framesubtitle{Formal Details} 380 381 \begin{description} 382 \item[Existence of attestations] 383 {\scriptsize 384 \begin{align*} 385 \Forall_{\age\in\N_\Age \atop \omega \in \Omega}: 386 \Commit(\age, \omega) =: (\commitment, \pruf) 387 \implies 388 \Attest(\minage, \commitment, \pruf) = 389 \begin{cases} 390 \attest \in \Attests, \text{ if } \minage \leq \age\\ 391 \Nil \text{ otherwise} 392 \end{cases} 393 \end{align*}} 394 \item[Efficacy of attestations] 395 {\scriptsize 396 \begin{align*} 397 \Verify(\minage, \commitment, \attest) = \ 398 \begin{cases} 399 1, \text{if } \Exists_{\pruf \in \Proofs}: \Attest(\minage, \commitment, \pruf) = \attest\\ 400 0 \text{ otherwise} 401 \end{cases} 402 \end{align*}} 403 404 {\scriptsize 405 \begin{align*} 406 \forall_{n \leq \age}: \Verify\big(n, \commitment, \Attest(n, \commitment, \pruf)\big) = 1. 407 \end{align*}} 408 \item[etc.] 409 \end{description} 410 \end{frame} 411 412 %\begin{frame}{Requirements} 413 % \framesubtitle{Details} 414 % 415 % \begin{description} 416 % \item[Derivability of commitments and proofs:]~\\[0.1em] 417 % {\scriptsize 418 % Let \begin{align*} 419 % \age & \in\N_\Age,\,\, \omega_0, \omega_1 \in\Omega\\ 420 % (\commitment_0, \pruf_0) & \leftarrow \Commit(\age, \omega_0),\\ 421 % (\commitment_1, \pruf_1, \blinding) & \leftarrow \Derive(\commitment_0, \pruf_0, \omega_1). 422 % \end{align*} 423 % We require 424 % \begin{align*} 425 % \Compare(\commitment_0, \commitment_1, \blinding) = 1 \label{req:comparity} 426 % \end{align*} 427 % and for all $n\leq\age$: 428 % \begin{align*} 429 % \Verify(n, \commitment_1, \Attest(n, \commitment_1, \pruf_1)) &% 430 % = 431 % \Verify(n, \commitment_0, \Attest(n, \commitment_0, \pruf_0)) 432 % \end{align*}} 433 % \end{description} 434 %\end{frame} 435 436 \begin{frame}{Security Requirements} 437 Candidate functions must also meet \textit{security} requirements. 438 Those are defined via security games: 439 \begin{itemize} 440 \item Game: Age disclosure by commitment or attestation 441 \item[$\leftrightarrow$] Requirement: Non-disclosure of age 442 \vfill 443 444 \item Game: Forging attestation 445 \item[$\leftrightarrow$] Requirement: Unforgeability of 446 minimum age 447 \vfill 448 449 \item Game: Distinguishing derived commitments and attestations 450 \item[$\leftrightarrow$] Requirement: Unlinkability of 451 commitments and attestations 452 453 \end{itemize} 454 \vfill 455 456 Meeting the security requirements means that adversaries can win 457 those games only with negligible advantage. 458 \vfill 459 Adversaries are arbitrary polynomial-time algorithms, acting on all 460 relevant input. 461 \end{frame} 462 463 \begin{frame}{Security Requirements} 464 \framesubtitle{Simplified Example} 465 466 \begin{description} 467 \item[Game $\Game{FA}(\lambda)$---Forging an attest:]~\\ 468 {\small 469 \begin{enumerate} 470 \item $ (\age, \omega) \drawfrom \N_{\Age-1}\times\Omega $ 471 \item $ (\commitment, \pruf) \leftarrow \Commit(\age, \omega) $ 472 \item $ (\minage, \attest) \leftarrow \Adv(\age, \commitment, \pruf)$ 473 \item Return 0 if $\minage \leq \age$ 474 \item Return $\Verify(\minage,\commitment,\attest)$ 475 \end{enumerate} 476 } 477 \vfill 478 \item[Requirement: Unforgeability of minimum age] 479 {\small 480 \begin{equation*} 481 \Forall_{\Adv\in\PPT(\N_\Age\times\Commitments\times\Proofs\to \N_\Age\times\Attests)}: 482 \Probability\Big[\Game{FA}(\lambda) = 1\Big] \le \negl(\lambda) 483 \end{equation*} 484 } 485 \end{description} 486 \end{frame} 487 488 \section{Solution/Instantiation} 489 490 \begin{frame}{Solution: Instantiation with ECDSA} 491 % \framesubtitle{Definition of Commit} 492 493 \begin{description} 494 \item[To Commit to age (group) $\age \in \{1,\dots,\Age\}$]~\\ 495 \begin{enumerate} 496 \item<2-> Guardian generates ECDSA-keypairs, one per age (group): 497 \[\langle(q_1, p_1),\dots,(q_\Age,p_\Age)\rangle\] 498 \item<3-> Guardian then \textbf{drops} all private keys 499 $p_i$ for $i > \age$: 500 \[\Big \langle(q_1, p_1),\dots, 501 (q_\age, p_\age), 502 (q_{\age +1}, \red{\Nil}),\dots, 503 (q_\Age, \red{\Nil})\Big\rangle\] 504 505 \begin{itemize} 506 \item $\Vcommitment := (q_1, \dots, q_\Age)$ is the \textit{Commitment}, 507 \item $\Vpruf_\age := (p_1, \dots, p_\age, \Nil,\dots,\Nil)$ is the \textit{Proof} 508 \end{itemize} 509 \vfill 510 \item<4-> Guardian gives child $\langle \Vcommitment, \Vpruf_\age \rangle$ 511 \vfill 512 \end{enumerate} 513 \end{description} 514 \end{frame} 515 516 \begin{frame}{Instantiation with ECDSA} 517 \framesubtitle{Definitions of Attest and Verify} 518 519 Child has 520 \begin{itemize} 521 \item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $, 522 \item (some) private-keys $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$. 523 \end{itemize} 524 \begin{description} 525 \item<2->[To \blue{Attest} a minimum age $\blue{\minage} \leq \age$:]~\\ 526 Sign a message with ECDSA using private key $p_\blue{\minage}$ 527 \end{description} 528 529 \vfill 530 531 \uncover<3->{ 532 Merchant gets 533 \begin{itemize} 534 \item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $ 535 \item Signature $\sigma$ 536 \end{itemize} 537 \begin{description} 538 \item<4->[To \blue{Verify} a minimum age $\minage$:]~\\ 539 Verify the ECDSA-Signature $\sigma$ with public key $q_\minage$. 540 \end{description} 541 } 542 \vfill 543 \end{frame} 544 545 \begin{frame}{Instantiation with ECDSA} 546 \framesubtitle{Definitions of Derive and Compare} 547 Child has 548 $\Vcommitment = (q_1, \dots, q_\Age) $ and 549 $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$. 550 \begin{description} 551 \item<2->[To \blue{Derive} new $\Vcommitment'$ and $\Vpruf'$:] 552 Choose random $\beta\in\Z_g$ and calculate 553 \small 554 \begin{align*} 555 \Vcommitment' &:= \big(\beta * q_1,\ldots,\beta * q_\Age\big),\\ 556 \Vpruf' &:= \big(\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil\big) 557 \end{align*} 558 Note: $ (\beta p_i)*G = \beta*(p_i*G) = \beta*q_i$\\ 559 \scriptsize $\beta*q_i$ is scalar multiplication on the elliptic curve. 560 \end{description} 561 562 \vfill 563 \uncover<3->{ 564 Exchange gets $\Vcommitment = (q_1,\dots,q_\Age)$, $\Vcommitment' = (q_1', \dots, q_\Age')$ and $\beta$ 565 \begin{description} 566 \item[To \blue{Compare}, calculate:] 567 \small 568 $(\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)$ 569 \end{description} 570 \vfill 571 } 572 \end{frame} 573 574 \begin{frame}{Instantiation with ECDSA} 575 576 Functions 577 (Commit, Attest, Verify, Derive, Compare)\\ 578 as defined in the instantiation with ECDSA\\[0.5em] 579 \begin{itemize} 580 \item meet the basic requirements,\\[0.5em] 581 \item also meet all security requirements.\\ 582 Proofs by security reduction, details are in the paper. 583 \end{itemize} 584 585 \end{frame} 586 587 588 % \begin{frame}{Instantiation with ECDSA} 589 % \framesubtitle{Full definitions} 590 % \scriptsize 591 % 592 % \begin{align*} 593 % \Commit_{E,\FDHg{\cdot}}(\age, \omega) &:= \Big\langle 594 % \overbrace{(q_1,\ldots,q_\Age)}^{= \Vcommitment},\; 595 % \overbrace{(p_1,\ldots,p_\age, \Nil,\ldots,\Nil)}^{= \Vpruf \text{, length }\Age} 596 % \Big\rangle\\ 597 % \Attest_{E,\HashF}(\bage, \Vcommitment, \Vpruf) &:= 598 % \begin{cases} 599 % \attest_\bage := \Sign_{E,\HashF}\big(\bage,\Vpruf[\bage]\big) & \text{if } \Vpruf[\bage] \stackrel{?}{\neq} \Nil\\ 600 % \Nil & \text{otherwise} 601 % \end{cases}\\ 602 % % 603 % \Verify_{E,\HashF}(\bage, \Vcommitment, \attest) &:= \Ver_{E,\HashF}(\bage, \Vcommitment[\bage], \attest)\\ 604 % % 605 % \Derive_{E, \FDHg{\cdot}}(\Vcommitment, \Vpruf, \omega) &:= 606 % \Big\langle(\beta * q_1,\ldots,\beta * q_\Age), 607 % (\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil), \beta \Big\rangle \\ 608 % & \text{ with } \beta := \FDHg{\omega} \text{ and multiplication } \beta p_i \text{ modulo } g \nonumber\\ 609 % % 610 % \Compare_E(\Vcommitment, \Vcommitment', \beta) &:= 611 % \begin{cases} 612 % 1 & \text{if } (\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)\\ 613 % 0 & \text{otherwise} 614 % \end{cases} 615 % \end{align*} 616 % \end{frame} 617 618 \section{Integration with GNU Taler} 619 620 \begin{frame}{GNU Taler} 621 \framesubtitle{https://www.taler.net} 622 \begin{columns} 623 \column{4cm} 624 \fontsize{8pt}{9pt}\selectfont 625 \begin{tikzpicture}[scale=.55] 626 \node[circle,fill=black!10] at (3, 4) (Exchange) {$\Exchange$}; 627 \node[circle,fill=black!10] at (0, 0) (Customer) {$\Customer$}; 628 \node[circle,fill=black!10] at (6, 0) (Merchant) {$\Merchant$}; 629 630 \draw[<->] (Customer) to [out=65,in=220] node[sloped,above] {\sf withdraw} (Exchange); 631 \draw[<->] (Customer) to [out=45,in=240] node[sloped,below] {\sf refresh} (Exchange); 632 \draw[<->] (Customer) to node[sloped, below] {\sf purchase} (Merchant); 633 \draw[<->] (Merchant) to node[sloped, above] {\sf deposit} (Exchange); 634 \end{tikzpicture} 635 \column{8cm} 636 \begin{itemize} 637 \item Protocol suite for online payment services 638 \item Based on Chaum's blind signatures 639 % \item Taxable, efficient, free software 640 \item Allows for change and refund (F. Dold) 641 \item Privacy preserving: anonymous and unlinkable payments 642 \end{itemize} 643 \end{columns} 644 645 \vfill 646 \uncover<2->{ 647 \begin{itemize} 648 \item Coins are public-/private key-pairs $(C_p, c_s)$. 649 \item Exchange blindly signs $\FDH(C_p)$ with denomination key $d_p$ 650 \item Verification: 651 \begin{eqnarray*} 652 1 &\stackrel{?}{=}& 653 \mathsf{SigCheck}\big(\FDH(C_p), D_p, \sigma_p\big) 654 \end{eqnarray*} 655 \scriptsize($D_p$ = public key of denomination and $\sigma_p$ = signature) 656 657 \end{itemize} 658 } 659 \end{frame} 660 661 \begin{frame}{Integration with GNU Taler} 662 \framesubtitle{Binding age restriction to coins} 663 664 To bind an age commitment $\commitment$ to a coin $C_p$, instead of 665 signing $\FDH(C_p)$, $\Exchange$ now blindly signs 666 \begin{center} 667 $\FDH(C_p, \orange{H(\commitment)})$ 668 \end{center} 669 670 \vfill 671 Verfication of a coin now requires $H(\commitment)$, too: 672 \begin{center} 673 $1 \stackrel{?}{=} 674 \mathsf{SigCheck}\big(\FDH(C_p, \orange{H(\commitment)}), D_p, \sigma_p\big)$ 675 \end{center} 676 \vfill 677 \end{frame} 678 679 \begin{frame}{Integration with GNU Taler} 680 \framesubtitle{Integrated schemes} 681 \fontsize{8pt}{9pt}\selectfont 682 \begin{tikzpicture}[scale=.9] 683 \node[circle,minimum size=25pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 684 \node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$}; 685 \node[circle,minimum size=25pt,fill=black!15] at ( 0:5) (Merchant) {$\Merchant$}; 686 \node[circle,minimum size=25pt,fill=blue!15] at (130:3) (Guardian) {$\Guardian$}; 687 688 \draw[<->] (Guardian) to node[sloped,above,align=center] 689 {{\sf withdraw}\orange{, using}\\ $\FDH(C_p\orange{, H(\commitment)})$} (Exchange); 690 \draw[<->] (Client) to node[sloped,below,align=center] 691 {{\sf refresh} \orange{ + }\\ \orange{$\DeriveCompare$}} (Exchange); 692 \draw[<->] (Client) to node[sloped, below] 693 {{\sf purchase} \blue{+ $(\attest_\minage, \commitment)$}} (Merchant); 694 \draw[<->] (Merchant) to node[sloped, above] 695 {{\sf deposit} \orange{+ $H(\commitment)$}} (Exchange); 696 697 \draw[->] (Guardian) to [out=70,in=150, loop] node[above] 698 {$\Commit(\age)$} (Guardian); 699 \draw[->] (Guardian) to node[below,sloped] 700 {($\commitment$, $\pruf_\age$)} (Client); 701 \draw[->,blue] (Client) to [out=-50,in=-130, loop] node[below] 702 {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client); 703 \draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below] 704 {\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant); 705 \end{tikzpicture} 706 \end{frame} 707 708 \begin{frame}{Instantiation with Edx25519} 709 Paper also formally defines another signature scheme: Edx25519.\\[1em] 710 711 \begin{itemize} 712 \item Scheme already in use in GNUnet, 713 \item based on EdDSA (Bernstein et al.), 714 \item generates compatible signatures and 715 \item allows for key derivation from both, private and public keys, independently. 716 \end{itemize}~\\[1em] 717 718 Current implementation of age restriction in GNU Taler uses Edx25519. 719 \end{frame} 720 721 \section{Discussion, Related Work, Conclusion} 722 723 \begin{frame}{Discussion} 724 \begin{itemize} 725 \item Our solution can in principle be used with any token-based payment scheme 726 \item GNU Taler best aligned with our design goals (security, privacy and efficiency) 727 \item Subsidiarity requires bank accounts being owned by adults 728 \begin{itemize} 729 \item Scheme can be adapted to case where minors have bank accounts 730 \begin{itemize} 731 \item Assumption: banks provide minimum age 732 information during bank 733 transactions. 734 \item Child and Exchange execute a variant of 735 the cut\&choose protocol. 736 \end{itemize} 737 \end{itemize} 738 \item Our scheme offers an alternative to identity management systems (IMS) 739 \end{itemize} 740 \end{frame} 741 \begin{frame}{Related Work} 742 \begin{itemize} 743 \item Current privacy-perserving systems all based on attribute-based credentials (Koning et al., Schanzenbach et al., Camenisch et al., Au et al.) 744 \item Attribute-based approach lacks support: 745 \begin{itemize} 746 \item Complex for consumers and retailers 747 \item Requires trusted third authority 748 \end{itemize} 749 \vfill 750 \item Other approaches tie age-restriction to ability to pay ("debit cards for kids") 751 \begin{itemize} 752 \item Advantage: mandatory to payment process 753 \item Not privacy friendly 754 \end{itemize} 755 \end{itemize} 756 \end{frame} 757 758 \begin{frame}{Conclusion} 759 Age restriction is a technical, ethical and legal challenge. 760 761 Existing solutions are 762 \begin{itemize} 763 \item without strong protection of privacy or 764 \item based on identity management systems (IMS) 765 \end{itemize} 766 \vfill 767 768 Our scheme offers a solution that is 769 \begin{itemize} 770 \item based on subsidiarity 771 \item privacy preserving 772 \item efficient 773 \item an alternative to IMS 774 \end{itemize} 775 \end{frame} 776 777 778 \end{document}