Automatic generation of sigma-protocols

  • Authors:
  • Endre Bangerter;Thomas Briner;Wilko Henecka;Stephan Krenn;Ahmad-Reza Sadeghi;Thomas Schneider

  • Affiliations:
  • Bern University of Applied Sciences, Biel-Bienne, Switzerland;Abraxas Informatik AG, Zürich, Switzerland;Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany;Bern University of Applied Sciences, Biel-Bienne, Switzerland and University of Fribourg, Switzerland;Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany;Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany

  • Venue:
  • EuroPKI'09 Proceedings of the 6th European conference on Public key infrastructures, services and applications
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Efficient zero-knowledge proofs of knowledge (ZK-PoK) are basic building blocks of many cryptographic applications such as identification schemes, group signatures, and secure multi-party computation. Currently, first applications that essentially rely on ZK-PoKs are being deployed in the real world. The most prominent example is the Direct Anonymous Attestation (DAA) protocol, which was adopted by the Trusted Computing Group (TCG) and implemented as one of the functionalities of the cryptographic chip Trusted Platform Module (TPM). Implementing systems using ZK-PoK turns out to be challenging, since ZK-PoK are significantly more complex than standard crypto primitives (e.g., encryption and signature schemes). As a result, the designimplementation cycles of ZK-PoK are time-consuming and error-prone. To overcome this, we present a compiler with corresponding languages for the automatic generation of sound and efficient ZK-PoK based on Σ-protocols. The protocol designer using our compiler formulates the goal of a ZK-PoK proof in a high-level protocol specification language, which abstracts away unnecessary technicalities from the designer. The compiler then automatically generates the protocol implementation in Java code; alternatively, the compiler can output a description of the protocol in LATEX which can be used for documentation or verification.