age.tex (26107B)
1 \section{Programmable money: Age restrictions} 2 3 \begin{frame} 4 \vfill 5 \begin{center} 6 {\bf Programmable money: Age restrictions}~\cite{esorics2022age} 7 \end{center} 8 \vfill 9 \end{frame} 10 11 12 \begin{frame}{Age restriction in E-commerce} 13 14 \begin{description} 15 \item[Problem:]~\\[1em] 16 Verification of minimum age requirements in e-commerce.\\[2em] 17 18 \item[Common solutions:] 19 20 \begin{tabular}{l<{\onslide<2->}c<{\onslide<3->}cr<{\onslide}} 21 & \blue{Privacy} & \tikzmark{topau} \blue{Ext. authority}& \\[\medskipamount] 22 1. ID Verification & bad & required & \\[\medskipamount] 23 2. Restricted Accounts & bad & required & \\[\medskipamount] 24 3. Attribute-based & good & required &\tikzmark{bottomau} \\[\medskipamount] 25 \end{tabular} 26 \end{description} 27 28 \uncover<4->{ 29 \begin{tikzpicture}[overlay,remember picture] 30 \draw[orange,thick,rounded corners] 31 ($(pic cs:topau) +(0,0.5)$) rectangle ($(pic cs:bottomau) -(0.3, 0.2)$); 32 \end{tikzpicture} 33 \begin{center} 34 \bf Principle of Subsidiarity is violated 35 \end{center} 36 } 37 \end{frame} 38 39 40 \begin{frame}{Principle of Subsidiarity} 41 \begin{center} \Large 42 Functions of government---such as granting and restricting 43 rights---should be performed\\ 44 {\it at the lowest level of authority possible},\\ 45 as long as they can be performed {\it adequately}. 46 \end{center} 47 \vfill 48 \uncover<2->{ 49 For age-restriction, the lowest level of authority is:\\ 50 \begin{center}\Large 51 Parents, guardians and caretakers 52 \end{center} 53 } 54 \end{frame} 55 56 57 \begin{frame}{Age restriction design for GNU Taler} 58 Design and implementation of an age restriction scheme\\ 59 with the following goals: 60 61 \begin{enumerate} 62 \item It ties age restriction to the \textbf{ability to pay} (not to ID's) 63 \item maintains \textbf{anonymity of buyers} 64 \item maintains \textbf{unlinkability of transactions} 65 \item aligns with \textbf{principle of subsidiartiy} 66 \item is \textbf{practical and efficient} 67 \end{enumerate} 68 69 \end{frame} 70 71 72 \begin{frame}{Age restriction} 73 \framesubtitle{Assumptions and scenario} 74 75 \begin{columns} 76 \column{7.5cm} 77 \begin{itemize} 78 \item<1-> Assumption: Checking accounts are under control of eligible adults/guardians. 79 \item<2-> \textit{Guardians} \textbf{commit} to an maximum age 80 \item<3-> \textit{Minors} \textbf{attest} their adequate age 81 \item<4-> \textit{Merchants} \textbf{verify} the attestations 82 \item<5-> Minors \textbf{derive} age commitments from existing ones 83 \item<6-> \textit{Exchanges} \textbf{compare} the derived age commitments 84 \end{itemize} 85 \column{5cm} 86 \uncover<7-> 87 { 88 \begin{center} 89 \fontsize{7pt}{7pt}\selectfont 90 \begin{tikzpicture}[scale=.5] 91 \node[circle,minimum size=15pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 92 \node[circle,minimum size=15pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 93 \node[circle,minimum size=15pt,fill=black!15] at ( 0:4) (Merchant) {$\Merchant$}; 94 \node[circle,minimum size=15pt,fill=blue!15] at (140:3) (Guardian) {$\Guardian$}; 95 96 \draw[->] (Guardian) to [out=50,in=130, loop] node[above] 97 {$\Commit$} (Guardian); 98 \draw[->,blue] (Client) to [out=-125,in=-190, loop] node[below,left] 99 {\blue{$\Attest$}} (Client); 100 \draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above] 101 {\blue{$\Verify$}} (Merchant); 102 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 103 {\orange{$\Derive$}} (Client); 104 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 105 {\orange{$\Compare$}} (Exchange); 106 107 \draw[orange,|->] (Client) to node[sloped,above,align=left] 108 {\orange{\scriptsize }} (Exchange); 109 \draw[blue,|->] (Client) to node[sloped, above] 110 {\blue{\scriptsize }} (Merchant); 111 \draw[,|->] (Guardian) to node[above,sloped,align=left] 112 {{\scriptsize }} (Client); 113 \end{tikzpicture} 114 \end{center} 115 } 116 \end{columns} 117 \vfill 118 \end{frame} 119 120 121 \begin{frame}{Formal Function Signatures} 122 \small 123 Searching for functions \uncover<2->{with the following signatures} 124 \begin{align*} 125 &\bf \Commit\uncover<2->{: 126 &(\age, \omega) &\mapsto (\commitment, \pruf) 127 &\scriptstyle \N_\Age \times \Omega &\scriptstyle \to \Commitments\times\Proofs, 128 } 129 \\ 130 &\bf \Attest\uncover<3->{: 131 &(\minage, \commitment, \pruf) &\mapsto \attest 132 &\scriptstyle \N_\Age\times\Commitments\times\Proofs &\scriptstyle \to \Attests \cup \{\Nil\}, 133 } 134 \\ 135 &\bf \Verify\uncover<4->{: 136 &(\minage, \commitment, \attest) &\mapsto b 137 &\scriptstyle \N_\Age\times\Commitments\times\Attests &\scriptstyle \to \Z_2, 138 } 139 \\ 140 &\bf \Derive\uncover<5->{: 141 &(\commitment, \pruf, \omega) &\mapsto (\commitment', \pruf', \blinding) 142 &\scriptstyle \Commitments\times\Proofs\times\Omega &\scriptstyle \to \Commitments\times\Proofs\times\Blindings, 143 } 144 \\ 145 &\bf \Compare\uncover<6->{: 146 &(\commitment, \commitment', \blinding) &\mapsto b 147 &\scriptstyle \Commitments\times\Commitments\times\Blindings &\scriptstyle \to \Z_2, 148 } 149 \end{align*} 150 \uncover<7->{ 151 with $\Omega, \Proofs, \Commitments, \Attests, \Blindings$ 152 sufficiently large sets.\\[1em] 153 Basic and security requirements are defined later.\\[2em] 154 } 155 156 \scriptsize 157 \uncover<2->{ 158 Mnemonics:\\ 159 $\Commitments=$ \textit{c$\Commitments$mmitments}, 160 $\commitment=$ \textit{Q-mitment} (commitment), 161 $\Proofs=$ \textit{$\Proofs$roofs}, 162 } 163 \uncover<3->{ 164 $\pruf=$ \textit{$\pruf$roof},\\ 165 $\Attests=$ \textit{a$\Attests$testations}, 166 $\attest=$ \textit{a$\attest$testation}, 167 } 168 \uncover<5->{ 169 $\Blindings=$ \textit{$\Blindings$lindings}, 170 $\blinding=$ \textit{$\blinding$linding}. 171 } 172 \end{frame} 173 174 \begin{frame}{Age restriction} 175 \framesubtitle{Naïve scheme} 176 \begin{center} 177 \begin{tikzpicture}[scale=.85] 178 \node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 179 \node[circle,minimum size=20pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 180 \node[circle,minimum size=20pt,fill=black!15] at ( 0:4) (Merchant) {$\Merchant$}; 181 \node[circle,minimum size=20pt,fill=blue!15] at (140:3) (Guardian) {$\Guardian$}; 182 183 \draw[->] (Guardian) to [out=50,in=130, loop] node[above] 184 {$\Commit$} (Guardian); 185 \draw[->,blue] (Client) to [out=-125,in=-190, loop] node[below,left] 186 {\blue{$\Attest$}} (Client); 187 \draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above] 188 {\blue{$\Verify$}} (Merchant); 189 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 190 {\orange{$\Derive$}} (Client); 191 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 192 {\orange{$\Compare$}} (Exchange); 193 194 \draw[orange,|->] (Client) to node[sloped,above,align=left] 195 {\orange{\scriptsize }} (Exchange); 196 \draw[blue,|->] (Client) to node[sloped, above] 197 {\blue{\scriptsize }} (Merchant); 198 \draw[,|->] (Guardian) to node[above,sloped,align=left] 199 {{\scriptsize }} (Client); 200 \end{tikzpicture} 201 \end{center} 202 \end{frame} 203 204 \begin{frame}{Achieving Unlinkability} 205 \begin{columns} 206 \column{3cm} 207 \begin{center} 208 \fontsize{8pt}{9pt}\selectfont 209 \begin{tikzpicture}[scale=.65] 210 \node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$}; 211 \node[circle,minimum size=20pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 212 213 \draw[->,orange] (Client) to [out=-35,in=-100, loop] node[below] 214 {\orange{$\footnotesize \Derive()$}} (Client); 215 \draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above] 216 {\orange{$\footnotesize \Compare()$}} (Exchange); 217 218 \draw[orange,|->] (Client) to node[sloped,above,align=left] 219 {\orange{\tiny \uncover<2->{$(\commitment_i,\commitment_{i+1})$}}} (Exchange); 220 \end{tikzpicture} 221 \end{center} 222 223 \column{9cm} 224 Simple use of $\Derive()$ and $\Compare()$ is problematic. 225 226 \begin{itemize} 227 \item<2-> Calling $\Derive()$ iteratively generates sequence 228 $(\commitment_0, \commitment_1, \dots)$ of commitments. 229 \item<2-> Exchange calls $\Compare(\commitment_i, \commitment_{i+1}, .)$ 230 \item[$\implies$]\uncover<3->{\bf Exchange identifies sequence} 231 \item[$\implies$]\uncover<3->{\bf Unlinkability broken} 232 \end{itemize} 233 \end{columns} 234 \end{frame} 235 236 \begin{frame}{Achieving Unlinkability} 237 Define cut\&choose protocol \orange{$\DeriveCompare$}, 238 using $\Derive()$ and $\Compare()$.\\[0.5em] 239 \uncover<2->{ 240 Sketch: 241 \small 242 \begin{enumerate} 243 \item $\Child$ derives commitments $(\commitment_1,\dots,\commitment_\kappa)$ 244 from $\commitment_0$ \\ 245 by calling $\Derive()$ with blindings $(\beta_1,\dots,\beta_\kappa)$ 246 \item $\Child$ calculates $h_0:=H\left(H(\commitment_1, \beta_1)||\dots||H(\commitment_\kappa, \beta_\kappa)\right)$ 247 \item $\Child$ sends $\commitment_0$ and $h_0$ to $\Exchange$ 248 \item $\Exchange$ chooses $\gamma \in \{1,\dots,\kappa\}$ randomly 249 \item $\Child$ reveals $h_\gamma:=H(\commitment_\gamma, \beta_\gamma)$ and all $(\commitment_i, \beta_i)$, except $(\commitment_\gamma, \beta_\gamma)$ 250 \item $\Exchange$ compares $h_0$ and 251 $H\left(H(\commitment_1, \beta_1)||...||h_\gamma||...||H(\commitment_\kappa, \beta_\kappa)\right)$\\ 252 and evaluates $\Compare(\commitment_0, \commitment_i, \beta_i)$. 253 \end{enumerate} 254 \vfill 255 Note: Scheme is similar to the {\it refresh} protocol in GNU Taler. 256 } 257 \end{frame} 258 259 \begin{frame}{Achieving Unlinkability} 260 With \orange{$\DeriveCompare$} 261 \begin{itemize} 262 \item $\Exchange$ learns nothing about $\commitment_\gamma$, 263 \item trusts outcome with $\frac{\kappa-1}{\kappa}$ certainty, 264 \item i.e. $\Child$ has $\frac{1}{\kappa}$ chance to cheat. 265 \end{itemize} 266 \vfill 267 Note: Still need Derive and Compare to be defined. 268 \end{frame} 269 270 \begin{frame}{Refined scheme} 271 272 \begin{tikzpicture}[scale=.8] 273 \node[circle,minimum size=25pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 274 \node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$}; 275 \node[circle,minimum size=25pt,fill=black!15] at ( 0:5) (Merchant) {$\Merchant$}; 276 \node[circle,minimum size=25pt,fill=blue!15] at (130:3) (Guardian) {$\Guardian$}; 277 278 \draw[orange,<->] (Client) to node[sloped,below,align=center] 279 {\orange{$\DeriveCompare$}} (Exchange); 280 \draw[blue,->] (Client) to node[sloped, below] 281 {\blue{$(\attest_\minage, \commitment)$}} (Merchant); 282 283 \draw[->] (Guardian) to [out=150,in=70, loop] node[above] 284 {$\Commit(\age)$} (Guardian); 285 \draw[->] (Guardian) to node[below,sloped] 286 {($\commitment$, $\pruf_\age$)} (Client); 287 \draw[->,blue] (Client) to [out=-50,in=-130, loop] node[below] 288 {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client); 289 \draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below] 290 {\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant); 291 \end{tikzpicture} 292 \end{frame} 293 294 \begin{frame}{Achieving Unlinkability} 295 \scriptsize 296 $\DeriveCompare : \Commitments\times\Proofs\times\Omega \to \{0,1\}$\\ 297 \vfill 298 $\DeriveCompare(\commitment, \pruf, \omega) =$ 299 \begin{itemize} 300 \it 301 \itemsep0.5em 302 \item[$\Child$:] 303 \begin{enumerate} 304 \scriptsize 305 \itemsep0.3em 306 \item for all $i \in \{1,\dots,\kappa\}: 307 (\commitment_i,\pruf_i,\beta_i) \leftarrow \Derive(\commitment, \pruf, \omega + i)$ 308 \item $h \leftarrow \Hash\big(\Hash(\commitment_1,\beta_1)\parallel\dots\parallel\Hash(\commitment_\kappa,\beta_\kappa) \big)$ 309 \item send $(\commitment, h)$ to $\Exchange$ 310 \end{enumerate} 311 \item[$\Exchange$:] 312 \begin{enumerate} 313 \setcounter{enumi}{3} 314 \scriptsize 315 \itemsep0.3em 316 \item save $(\commitment, h)$ \label{st:hash} 317 \item $\gamma \drawfrom \{1,\dots ,\kappa\}$ 318 \item send $\gamma$ to $\Child$ 319 \end{enumerate} 320 \item[$\Child$:] 321 \begin{enumerate} 322 \setcounter{enumi}{6} 323 324 \scriptsize 325 \itemsep0.3em 326 \item $h'_\gamma \leftarrow \Hash(\commitment_\gamma, \beta_\gamma)$ 327 \item $\mathbf{E}_\gamma \leftarrow \big[(\commitment_1,\beta_1),\dots, 328 (\commitment_{\gamma-1}, \beta_{\gamma-1}), 329 \Nil, 330 (\commitment_{\gamma+1}, \beta_{\gamma+1}), 331 \dots,(\commitment_\kappa, \beta_\kappa)\big]$ 332 \item send $(\mathbf{E}_\gamma, h'_\gamma)$ to $\Exchange$ 333 \end{enumerate} 334 \item[$\Exchange$:] 335 \begin{enumerate} 336 \setcounter{enumi}{9} 337 \scriptsize 338 \itemsep0.3em 339 \item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}: h_i \leftarrow \Hash(\mathbf{E}_\gamma[i])$ 340 \item if $h \stackrel{?}{\neq} \HashF(h_1\|\dots\|h_{\gamma-1}\|h'_\gamma\|h_{\gamma+1}\|\dots\|h_{\kappa-1})$ return 0 341 \item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}$: 342 if $0 \stackrel{?}{=} \Compare(\commitment,\commitment_i, \beta_i)$ return $0$ 343 \item return 1 344 \end{enumerate} 345 \end{itemize} 346 \end{frame} 347 348 \begin{frame}{Basic Requirements} 349 350 Candidate functions 351 \[ (\Commit, \Attest, \Verify, \Derive, \Compare) \] 352 must first meet \textit{basic} requirements: 353 354 \begin{itemize} 355 \item Existence of attestations 356 \item Efficacy of attestations 357 \item Derivability of commitments and attestations 358 \end{itemize} 359 \end{frame} 360 361 \begin{frame}{Basic Requirements} 362 \framesubtitle{Formal Details} 363 364 \begin{description} 365 \item[Existence of attestations] 366 {\scriptsize 367 \begin{align*} 368 \Forall_{\age\in\N_\Age \atop \omega \in \Omega}: 369 \Commit(\age, \omega) =: (\commitment, \pruf) 370 \implies 371 \Attest(\minage, \commitment, \pruf) = 372 \begin{cases} 373 \attest \in \Attests, \text{ if } \minage \leq \age\\ 374 \Nil \text{ otherwise} 375 \end{cases} 376 \end{align*}} 377 \item[Efficacy of attestations] 378 {\scriptsize 379 \begin{align*} 380 \Verify(\minage, \commitment, \attest) = \ 381 \begin{cases} 382 1, \text{if } \Exists_{\pruf \in \Proofs}: \Attest(\minage, \commitment, \pruf) = \attest\\ 383 0 \text{ otherwise} 384 \end{cases} 385 \end{align*}} 386 387 {\scriptsize 388 \begin{align*} 389 \forall_{n \leq \age}: \Verify\big(n, \commitment, \Attest(n, \commitment, \pruf)\big) = 1. 390 \end{align*}} 391 \item[etc.] 392 \end{description} 393 \end{frame} 394 395 \begin{frame}{Requirements} 396 \framesubtitle{Details} 397 398 \begin{description} 399 \item[Derivability of commitments and proofs:]~\\[0.1em] 400 {\scriptsize 401 Let \begin{align*} 402 \age & \in\N_\Age,\,\, \omega_0, \omega_1 \in\Omega\\ 403 (\commitment_0, \pruf_0) & \leftarrow \Commit(\age, \omega_0),\\ 404 (\commitment_1, \pruf_1, \blinding) & \leftarrow \Derive(\commitment_0, \pruf_0, \omega_1). 405 \end{align*} 406 We require 407 \begin{align*} 408 \Compare(\commitment_0, \commitment_1, \blinding) = 1 \label{req:comparity} 409 \end{align*} 410 and for all $n\leq\age$: 411 \begin{align*} 412 \Verify(n, \commitment_1, \Attest(n, \commitment_1, \pruf_1)) &% 413 = 414 \Verify(n, \commitment_0, \Attest(n, \commitment_0, \pruf_0)) 415 \end{align*}} 416 \end{description} 417 \end{frame} 418 419 \begin{frame}{Security Requirements} 420 Candidate functions must also meet \textit{security} requirements. 421 Those are defined via security games: 422 \begin{itemize} 423 \item Game: Age disclosure by commitment or attestation 424 \item[$\leftrightarrow$] Requirement: Non-disclosure of age 425 \vfill 426 427 \item Game: Forging attestation 428 \item[$\leftrightarrow$] Requirement: Unforgeability of 429 minimum age 430 \vfill 431 432 \item Game: Distinguishing derived commitments and attestations 433 \item[$\leftrightarrow$] Requirement: Unlinkability of 434 commitments and attestations 435 436 \end{itemize} 437 \vfill 438 439 Meeting the security requirements means that adversaries can win 440 those games only with negligible advantage. 441 \vfill 442 Adversaries are arbitrary polynomial-time algorithms, acting on all 443 relevant input. 444 \end{frame} 445 446 \begin{frame}{Security Requirements} 447 \framesubtitle{Simplified Example} 448 449 \begin{description} 450 \item[Game $\Game{FA}(\lambda)$---Forging an attest:]~\\ 451 {\small 452 \begin{enumerate} 453 \item $ (\age, \omega) \drawfrom \N_{\Age-1}\times\Omega $ 454 \item $ (\commitment, \pruf) \leftarrow \Commit(\age, \omega) $ 455 \item $ (\minage, \attest) \leftarrow \Adv(\age, \commitment, \pruf)$ 456 \item Return 0 if $\minage \leq \age$ 457 \item Return $\Verify(\minage,\commitment,\attest)$ 458 \end{enumerate} 459 } 460 \vfill 461 \item[Requirement: Unforgeability of minimum age] 462 {\small 463 \begin{equation*} 464 \Forall_{\Adv\in\PPT(\N_\Age\times\Commitments\times\Proofs\to \N_\Age\times\Attests)}: 465 \Probability\Big[\Game{FA}(\lambda) = 1\Big] \le \negl(\lambda) 466 \end{equation*} 467 } 468 \end{description} 469 \end{frame} 470 471 472 \begin{frame}{Solution: Instantiation with ECDSA} 473 % \framesubtitle{Definition of Commit} 474 475 \begin{description} 476 \item[To Commit to age (group) $\age \in \{1,\dots,\Age\}$]~\\ 477 \begin{enumerate} 478 \item<2-> Guardian generates ECDSA-keypairs, one per age (group): 479 \[\langle(q_1, p_1),\dots,(q_\Age,p_\Age)\rangle\] 480 \item<3-> Guardian then \textbf{drops} all private keys 481 $p_i$ for $i > \age$: 482 \[\Big \langle(q_1, p_1),\dots, 483 (q_\age, p_\age), 484 (q_{\age +1}, \red{\Nil}),\dots, 485 (q_\Age, \red{\Nil})\Big\rangle\] 486 487 \begin{itemize} 488 \item $\Vcommitment := (q_1, \dots, q_\Age)$ is the \textit{Commitment}, 489 \item $\Vpruf_\age := (p_1, \dots, p_\age, \Nil,\dots,\Nil)$ is the \textit{Proof} 490 \end{itemize} 491 \vfill 492 \item<4-> Guardian gives child $\langle \Vcommitment, \Vpruf_\age \rangle$ 493 \vfill 494 \end{enumerate} 495 \end{description} 496 \end{frame} 497 498 \begin{frame}{Instantiation with ECDSA} 499 \framesubtitle{Definitions of Attest and Verify} 500 501 Child has 502 \begin{itemize} 503 \item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $, 504 \item (some) private-keys $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$. 505 \end{itemize} 506 \begin{description} 507 \item<2->[To \blue{Attest} a minimum age $\blue{\minage} \leq \age$:]~\\ 508 Sign a message with ECDSA using private key $p_\blue{\minage}$ 509 \end{description} 510 511 \vfill 512 513 \uncover<3->{ 514 Merchant gets 515 \begin{itemize} 516 \item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $ 517 \item Signature $\sigma$ 518 \end{itemize} 519 \begin{description} 520 \item<4->[To \blue{Verify} a minimum age $\minage$:]~\\ 521 Verify the ECDSA-Signature $\sigma$ with public key $q_\minage$. 522 \end{description} 523 } 524 \vfill 525 \end{frame} 526 527 \begin{frame}{Instantiation with ECDSA} 528 \framesubtitle{Definitions of Derive and Compare} 529 Child has 530 $\Vcommitment = (q_1, \dots, q_\Age) $ and 531 $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$. 532 \begin{description} 533 \item<2->[To \blue{Derive} new $\Vcommitment'$ and $\Vpruf'$:] 534 Choose random $\beta\in\Z_g$ and calculate 535 \small 536 \begin{align*} 537 \Vcommitment' &:= \big(\beta * q_1,\ldots,\beta * q_\Age\big),\\ 538 \Vpruf' &:= \big(\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil\big) 539 \end{align*} 540 Note: $ (\beta p_i)*G = \beta*(p_i*G) = \beta*q_i$\\ 541 \scriptsize $\beta*q_i$ is scalar multiplication on the elliptic curve. 542 \end{description} 543 544 \vfill 545 \uncover<3->{ 546 Exchange gets $\Vcommitment = (q_1,\dots,q_\Age)$, $\Vcommitment' = (q_1', \dots, q_\Age')$ and $\beta$ 547 \begin{description} 548 \item[To \blue{Compare}, calculate:] 549 \small 550 $(\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)$ 551 \end{description} 552 \vfill 553 } 554 \end{frame} 555 556 \begin{frame}{Instantiation with ECDSA} 557 558 Functions 559 (Commit, Attest, Verify, Derive, Compare)\\ 560 as defined in the instantiation with ECDSA\\[0.5em] 561 \begin{itemize} 562 \item meet the basic requirements,\\[0.5em] 563 \item also meet all security requirements.\\ 564 Proofs by security reduction, details are in the paper. 565 \end{itemize} 566 567 \end{frame} 568 569 570 \begin{frame}{Instantiation with ECDSA} 571 \framesubtitle{Full definitions} 572 \scriptsize 573 574 \begin{align*} 575 \Commit_{E,\FDHg{\cdot}}(\age, \omega) &:= \Big\langle 576 \overbrace{(q_1,\ldots,q_\Age)}^{= \Vcommitment},\; 577 \overbrace{(p_1,\ldots,p_\age, \Nil,\ldots,\Nil)}^{= \Vpruf \text{, length }\Age} 578 \Big\rangle\\ 579 \Attest_{E,\HashF}(\bage, \Vcommitment, \Vpruf) &:= 580 \begin{cases} 581 \attest_\bage := \Sign_{E,\HashF}\big(\bage,\Vpruf[\bage]\big) & \text{if } \Vpruf[\bage] \stackrel{?}{\neq} \Nil\\ 582 \Nil & \text{otherwise} 583 \end{cases}\\ 584 % 585 \Verify_{E,\HashF}(\bage, \Vcommitment, \attest) &:= \Ver_{E,\HashF}(\bage, \Vcommitment[\bage], \attest)\\ 586 % 587 \Derive_{E, \FDHg{\cdot}}(\Vcommitment, \Vpruf, \omega) &:= 588 \Big\langle(\beta * q_1,\ldots,\beta * q_\Age), 589 (\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil), \beta \Big\rangle \\ 590 & \text{ with } \beta := \FDHg{\omega} \text{ and multiplication } \beta p_i \text{ modulo } g \nonumber\\ 591 % 592 \Compare_E(\Vcommitment, \Vcommitment', \beta) &:= 593 \begin{cases} 594 1 & \text{if } (\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)\\ 595 0 & \text{otherwise} 596 \end{cases} 597 \end{align*} 598 \end{frame} 599 600 601 \begin{frame}{Reminder: GNU Taler Fundamentals} 602 \begin{center} 603 \begin{tikzpicture}[scale=.55] 604 \node[circle,fill=black!10] at (3, 4) (Exchange) {$\Exchange$}; 605 \node[circle,fill=black!10] at (0, 0) (Customer) {$\Customer$}; 606 \node[circle,fill=black!10] at (6, 0) (Merchant) {$\Merchant$}; 607 608 \draw[<->] (Customer) to [out=65,in=220] node[sloped,above] {\sf withdraw} (Exchange); 609 \draw[<->] (Customer) to [out=45,in=240] node[sloped,below] {\sf refresh} (Exchange); 610 \draw[<->] (Customer) to node[sloped, below] {\sf purchase} (Merchant); 611 \draw[<->] (Merchant) to node[sloped, above] {\sf deposit} (Exchange); 612 \end{tikzpicture} 613 \end{center} 614 615 \vfill 616 \begin{itemize} 617 \item Coins are public-/private key-pairs $(C_p, c_s)$. 618 \item Exchange blindly signs $\FDH(C_p)$ with denomination key $d_p$ 619 \item Verification: 620 \begin{eqnarray*} 621 1 &\stackrel{?}{=}& 622 \mathsf{SigCheck}\big(\FDH(C_p), D_p, \sigma_p\big) 623 \end{eqnarray*} 624 \scriptsize($D_p$ = public key of denomination and $\sigma_p$ = signature) 625 626 \end{itemize} 627 \end{frame} 628 629 \begin{frame}{Integration with GNU Taler} 630 \framesubtitle{Binding age restriction to coins} 631 632 To bind an age commitment $\commitment$ to a coin $C_p$, instead of 633 signing $\FDH(C_p)$, $\Exchange$ now blindly signs 634 \begin{center} 635 $\FDH(C_p, \orange{H(\commitment)})$ 636 \end{center} 637 638 \vfill 639 Verfication of a coin now requires $H(\commitment)$, too: 640 \begin{center} 641 $1 \stackrel{?}{=} 642 \mathsf{SigCheck}\big(\FDH(C_p, \orange{H(\commitment)}), D_p, \sigma_p\big)$ 643 \end{center} 644 \vfill 645 \end{frame} 646 647 \begin{frame}{Integration with GNU Taler} 648 \framesubtitle{Integrated schemes} 649 \fontsize{8pt}{9pt}\selectfont 650 \begin{tikzpicture}[scale=.9] 651 \node[circle,minimum size=25pt,fill=black!15] at ( 0:0) (Client) {$\Child$}; 652 \node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$}; 653 \node[circle,minimum size=25pt,fill=black!15] at ( 0:5) (Merchant) {$\Merchant$}; 654 \node[circle,minimum size=25pt,fill=blue!15] at (130:3) (Guardian) {$\Guardian$}; 655 656 \draw[<->] (Guardian) to node[sloped,above,align=center] 657 {{\sf withdraw}\orange{, using}\\ $\FDH(C_p\orange{, H(\commitment)})$} (Exchange); 658 \draw[<->] (Client) to node[sloped,below,align=center] 659 {{\sf refresh} \orange{ + }\\ \orange{$\DeriveCompare$}} (Exchange); 660 \draw[<->] (Client) to node[sloped, below] 661 {{\sf purchase} \blue{+ $(\attest_\minage, \commitment)$}} (Merchant); 662 \draw[<->] (Merchant) to node[sloped, above] 663 {{\sf deposit} \orange{+ $H(\commitment)$}} (Exchange); 664 665 \draw[->] (Guardian) to [out=70,in=150, loop] node[above] 666 {$\Commit(\age)$} (Guardian); 667 \draw[->] (Guardian) to node[below,sloped] 668 {($\commitment$, $\pruf_\age$)} (Client); 669 \draw[->,blue] (Client) to [out=-50,in=-130, loop] node[below] 670 {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client); 671 \draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below] 672 {\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant); 673 \end{tikzpicture} 674 \end{frame} 675 676 \begin{frame}{Instantiation with Edx25519} 677 Paper also formally defines another signature scheme: Edx25519.\\[1em] 678 679 \begin{itemize} 680 \item Scheme already in use in GNUnet, 681 \item based on EdDSA (Bernstein et al.), 682 \item generates compatible signatures and 683 \item allows for key derivation from both, private and public keys, independently. 684 \end{itemize}~\\[1em] 685 686 Current implementation of age restriction in GNU Taler uses Edx25519. 687 \end{frame} 688 689 690 \begin{frame}{Age Restrictions based on KYC} 691 Subsidiarity requires bank accounts being owned by adults. 692 \begin{itemize} 693 \item Scheme can be adapted to case where minors have bank accounts 694 \begin{itemize} 695 \item Assumption: banks provide minimum age 696 information during bank 697 transactions. 698 \item Child and Exchange execute a variant of 699 the cut\&choose protocol. 700 \end{itemize} 701 \end{itemize} 702 \end{frame} 703 704 705 \begin{frame}{Discussion} 706 \begin{itemize} 707 \item Our solution can in principle be used with any token-based payment scheme 708 \item GNU Taler best aligned with our design goals (security, privacy and efficiency) 709 \item Subsidiarity requires bank accounts being owned by adults 710 \begin{itemize} 711 \item Scheme can be adapted to case where minors have bank accounts 712 \begin{itemize} 713 \item Assumption: banks provide minimum age 714 information during bank 715 transactions. 716 \item Child and Exchange execute a variant of 717 the cut\&choose protocol. 718 \end{itemize} 719 \end{itemize} 720 \item Our scheme offers an alternative to identity management systems (IMS) 721 \end{itemize} 722 \end{frame} 723 724 725 \begin{frame}{Related Work} 726 \begin{itemize} 727 \item Current privacy-perserving systems all based on attribute-based credentials (Koning et al., Schanzenbach et al., Camenisch et al., Au et al.) 728 \item Attribute-based approach lacks support: 729 \begin{itemize} 730 \item Complex for consumers and retailers 731 \item Requires trusted third authority 732 \end{itemize} 733 \vfill 734 \item Other approaches tie age-restriction to ability to pay ("debit cards for kids") 735 \begin{itemize} 736 \item Advantage: mandatory to payment process 737 \item Not privacy friendly 738 \end{itemize} 739 \end{itemize} 740 \end{frame} 741 742 743 \begin{frame}{Conclusion} 744 Age restriction is a technical, ethical and legal challenge. 745 746 Existing solutions are 747 \begin{itemize} 748 \item without strong protection of privacy or 749 \item based on identity management systems (IMS) 750 \end{itemize} 751 \vfill 752 753 Our scheme offers a solution that is 754 \begin{itemize} 755 \item based on subsidiarity 756 \item privacy preserving 757 \item efficient 758 \item an alternative to IMS 759 \end{itemize} 760 \end{frame} 761