title="One-Way Accumulators: A Decentralized Alternative to Digital Signatures",
booktitle="Advances in Cryptology --- EUROCRYPT '93",
year="1994",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="274--285",
abstract="This paper describes a simple candidate one-way hash function which satisfies a quasi-commutative property that allows it to be used as an accumulator. This property allows protocols to be developed in which the need for a trusted central authority can be eliminated. Space-efficient distributed protocols are given for document time stamping and for membership testing, and many other applications are possible.",
isbn="978-3-540-48285-7"
}
@INPROCEEDINGS{6956581,
author={Ben Sasson, Eli and Chiesa, Alessandro and Garman, Christina and Green, Matthew and Miers, Ian and Tromer, Eran and Virza, Madars},
booktitle={2014 IEEE Symposium on Security and Privacy},
title={Zerocash: Decentralized Anonymous Payments from Bitcoin},
year={2014},
volume={},
number={},
pages={459-474},
doi={10.1109/SP.2014.36}}
@article{doi:10.1137/0220068,
author = {Blum, Manuel and De Santis, Alfredo and Micali, Silvio and Persiano, Giuseppe},
title = {Noninteractive Zero-Knowledge},
journal = {SIAM Journal on Computing},
volume = {20},
number = {6},
pages = {1084-1118},
year = {1991},
doi = {10.1137/0220068},
URL = {https://doi.org/10.1137/0220068},
eprint = {https://doi.org/10.1137/0220068},
abstract = { This paper investigates the possibility of disposing of interaction between prover and verifier in a zero-knowledge proof if they share beforehand a short random string.Without any assumption, it is proven that noninteractive zero-knowledge proofs exist for some number-theoretic languages for which no efficient algorithm is known.If deciding quadratic residuosity (modulo composite integers whose factorization is not known) is computationally hard, it is shown that the NP-complete language of satisfiability also possesses noninteractive zero-knowledge proofs. }
}
@article{RABIN1983256,
title = {Transaction protection by beacons},
journal = {Journal of Computer and System Sciences},
volume = {27},
number = {2},
pages = {256-267},
year = {1983},
issn = {0022-0000},
doi = {https://doi.org/10.1016/0022-0000(83)90042-9},
abstract = {Protocols for implementing contract signing, confidential disclosures, and certified mail in an electronic mail system are proposed. These transactions are provably impossible without a trusted intermediary. However, they can be implemented with just a small probability of a participant cheating his partner, by use of a beacon emitting random integers. Applications include privacy protection of personal information in data banks, as well as the protection of business transactions.}
}
@InProceedings{merkle,
author="Merkle, Ralph C.",
editor="Pomerance, Carl",
title="A Digital Signature Based on a Conventional Encryption Function",
booktitle="Advances in Cryptology --- CRYPTO '87",
year="1988",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="369--378",
abstract="A new digital signature based only on a conventional encryption function (such as DES) is described which is as secure as the underlying encryption function -- the security does not depend on the difficulty of factoring and the high computational costs of modular arithmetic are avoided. The signature system can sign an unlimited number of messages, and the signature size increases logarithmically as a function of the number of messages signed. Signature size in a `typical' system might range from a few hundred bytes to a few kilobytes, and generation of a signature might require a few hundred to a few thousand computations of the underlying conventional encryption function.",
isbn="978-3-540-48184-3"
}
@InProceedings{10.1007/978-3-642-02384-2_17,
author="Maurer, Ueli",
editor="Preneel, Bart",
title="Unifying Zero-Knowledge Proofs of Knowledge",
booktitle="Progress in Cryptology -- AFRICACRYPT 2009",
year="2009",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="272--286",
abstract="We present a simple zero-knowledge proof of knowledge protocol of which many protocols in the literature are instantiations. These include Schnorr's protocol for proving knowledge of a discrete logarithm, the Fiat-Shamir and Guillou-Quisquater protocols for proving knowledge of a modular root, protocols for proving knowledge of representations (like Okamoto's protocol), protocols for proving equality of secret values, a protocol for proving the correctness of a Diffie-Hellman key, protocols for proving the multiplicative relation of three commitments (as required in secure multi-party computation), and protocols used in credential systems.",
abstract="Can two potentially dishonest players play a fair game of poker without using any cards---for example, over the phone? This paper provides the following answers:1No. (Rigorous mathematical proof supplied.)2Yes. (Correct and complete protocol given.)",
isbn="978-1-4684-6686-7",
doi="10.1007/978-1-4684-6686-7_5",
url="https://doi.org/10.1007/978-1-4684-6686-7_5"
}
@article{blum1983coin,
title={Coin flipping by telephone a protocol for solving impossible problems},
author={Blum, Manuel},
journal={ACM SIGACT News},
volume={15},
number={1},
pages={23--27},
year={1983},
publisher={ACM New York, NY, USA}
}
@InProceedings{blindsig,
author="Chaum, David",
editor="Chaum, David
and Rivest, Ronald L.
and Sherman, Alan T.",
title="Blind Signatures for Untraceable Payments",
booktitle="Advances in Cryptology",
year="1983",
publisher="Springer US",
address="Boston, MA",
pages="199--203",
abstract="Automation of the way we pay for goods and services is already underway, as can be seen by the variety and growth of electronic banking services available to consumers. The ultimate structure of the new electronic payments system may have a substantial impact on personal privacy as well as on the nature and extent of criminal use of payments. Ideally a new payments system should address both of these seemingly conflicting sets of concerns.",
isbn="978-1-4757-0602-4"
}
@article{bellare2003one,
title={The One-More-RSA-Inversion Problems and the Security of Chaum's Blind Signature Scheme.},
author={Bellare, Mihir and Namprempre, Chanathip and Pointcheval, David and Semanko, Michael},
journal={Journal of Cryptology},
volume={16},
number={3},
year={2003},
publisher={Springer}
}
@inproceedings{sander1999auditable,
title={Auditable, anonymous electronic cash},
author={Sander, Tomas and Ta-Shma, Amnon},
booktitle={Annual International Cryptology Conference},
pages={555--572},
year={1999},
organization={Springer}
}
@InProceedings{10.1007/978-3-540-89255-7_15,
author="Camenisch, Jan
and Chaabouni, Rafik
and shelat, abhi",
editor="Pieprzyk, Josef",
title="Efficient Protocols for Set Membership and Range Proofs",
booktitle="Advances in Cryptology - ASIACRYPT 2008",
year="2008",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="234--252",
abstract="We consider the following problem: Given a commitment to a value $\sigma$, prove in zero-knowledge that $\sigma$ belongs to some discrete set $\Phi$. The set $\Phi$ can perhaps be a list of cities or clubs; often $\Phi$ can be a numerical range such as [1,220]. This problem arises in e-cash systems, anonymous credential systems, and various other practical uses of zero-knowledge protocols.",
isbn="978-3-540-89255-7"
}
@inproceedings{paillier1999public,
title={Public-key cryptosystems based on composite degree residuosity classes},
author={Paillier, Pascal},
booktitle={International conference on the theory and applications of cryptographic techniques},
title="Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based",
booktitle="Advances in Cryptology -- CRYPTO 2013",
year="2013",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="75--92",
abstract="We describe a comparatively simple fully homomorphic encryption (FHE) scheme based on the learning with errors (LWE) problem. In previous LWE-based FHE schemes, multiplication is a complicated and expensive step involving ``relinearization''. In this work, we propose a new technique for building FHE schemes that we call the approximate eigenvector method. In our scheme, for the most part, homomorphic addition and multiplication are just matrix addition and multiplication. This makes our scheme both asymptotically faster and (we believe) easier to understand.",
title="How To Prove Yourself: Practical Solutions to Identification and Signature Problems",
booktitle="Advances in Cryptology --- CRYPTO' 86",
year="1987",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="186--194",
abstract="In this paper we describe simple identification and signature schemes which enable any user to prove his identity and the authenticity of his messages to any other user without shared or public keys. The schemes are provably secure against any known or chosen message attack if factoring is difficult, and typical implementations require only 1{\%} to 4{\%} of the number of modular multiplications required by the RSA scheme. Due to their simplicity, security and speed, these schemes are ideally suited for microprocessor-based devices such as smart cards, personal computers, and remote control systems.",
abstract = {We present a practical probabilistic algorithm for testing large numbers of arbitrary form for primality. The algorithm has the feature that when it determines a number composite then the result is always true, but when it asserts that a number is prime there is a provably small probability of error. The algorithm was used to generate large numbers asserted to be primes of arbitrary and special forms, including very large numbers asserted to be twin primes. Theoretical foundations as well as details of implementation and experimental results are given.}
}
@article{damgard2003,
author = {Damgård, Ivan and Jurik, Mads and Nielsen, Jesper},
year = {2003},
month = {04},
pages = {371-385},
title = {A generalization of Paillier’s public-key system with applications to electronic voting},
volume = {9},
journal = {International Journal of Information Security},
author = {Ma, Huanyu and Han, Shuai and Lei, Hao},
title = {Optimized Paillier’s Cryptosystem with Fast Encryption and Decryption},
year = {2021},
isbn = {9781450385794},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3485832.3485842},
doi = {10.1145/3485832.3485842},
abstract = {In this paper, we propose a new optimization for the Paillier’s additively homomorphic encryption scheme (Eurocrypt’99). At the heart of our optimization is a well-chosen subgroup of the underlying , which is used as the randomness space for masking messages during encryption. The size of the subgroup is significantly smaller than that of , leading to faster encryption and decryption algorithms of our optimization. We establish the one-wayness and semantic security of our optimized Paillier scheme upon those of an optimization (i.e., “Scheme 3”) made by Paillier in Eurocrypt’99. Thus, our optimized scheme is one-way under the partial discrete logarithm (PDL) assumption, and is semantically secure under the decisional PDL (DPDL) assumption. On the other hand, we present a detailed analysis on the concrete security of our optimized scheme under several known methods. To provide 112-bit security, our analysis suggests that a 2048-bit modulus N and a well-chosen subgroup of size 448-bit would suffice. We compare our optimization with existing optimized Paillier schemes, including the Jurik’s optimization proposed by Jurik in his Ph.D. thesis and the Paillier’s optimization in Eurocrypt’99. Our experiments show that, – the encryption of our optimization is about 2.7 times faster than that of the Jurik’s optimization and is about 7.5 times faster than that of the Paillier’s optimization; – the decryption of our optimization is about 4.1 times faster than that of the Jurik’s optimization and has a similar performance with that of the Paillier’s optimization.},
author = {Shafagh, Hossein and Hithnawi, Anwar and Droescher, Andreas and Duquennoy, Simon and Hu, Wen},
title = {Talos: Encrypted Query Processing for the Internet of Things},
year = {2015},
isbn = {9781450336314},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2809695.2809723},
doi = {10.1145/2809695.2809723},
abstract = {The Internet of Things, by digitizing the physical world, is envisioned to enable novel interaction paradigms with our surroundings. This creates new threats and leads to unprecedented security and privacy concerns. To tackle these concerns, we introduce Talos, a system that stores IoT data securely in a Cloud database while still allowing query processing over the encrypted data. We enable this by encrypting IoT data with a set of cryptographic schemes such as order-preserving and partially homomorphic encryption. In order to achieve this in constrained IoT devices, Talos relies on optimized algorithms that accelerate order-preserving and partially homomorphic encryption by 1 to 2 orders of magnitude. We assess the feasibility of Talos on low-power devices with and without cryptographic accelerators and quantify its overhead in terms of energy, computation, and latency. With a thorough evaluation of our prototype implementation, we show that Talos is a practical system that can provide a high level of security with a reasonable overhead. We envision Talos as an enabler of secure IoT applications.},
booktitle = {Proceedings of the 13th ACM Conference on Embedded Networked Sensor Systems},
pages = {197–210},
numpages = {14},
keywords = {homomorphic encryption, cloud computing, data security, internet of things, computing on encrypted data},
author = {Brickell, Ernest F. and Chaum, David and Damg\r{a}rd, Ivan and Graaf, Jeroen van de},
title = {Gradual and Verifiable Release of a Secret},
year = {1987},
isbn = {3540187960},
publisher = {Springer-Verlag},
address = {Berlin, Heidelberg},
abstract = {Protocols are presented allowing someone with a secret discrete logarithm to release it, bit by bit, such that anyone can verify each bit's correctness as they receive it. This new notion of release of secrets generalizes and extends that of the already known exchange of secrets protocols. Consequently, the protocols presented allow exchange of secret discrete logs between any number of parties.The basic protocol solves an even more general problem than that of releasing a discrete log. Given any instance of a discrete log problem in a group with public group operation, the party who knows the solution can make public some interval I and convince anyone that the solution belongs to I , while releasing no additional information, such as any hint as to where in I the solution is.This can be used directly to release a discrete log, or to transfer it securely between different groups, i.e. prove that two instances are related such that knowledge of the solution to one implies knowledge of the solution to the other.We show how this last application can be used to implement a more efficient release protocol by transferring the given discrete log instance to a group with special properties. In this scenario, each bit of the secret can be verified by a single modular squaring, and unlike the direct use of the basic protocol, no interactive proofs are needed after the basic setup has been done.Finally, it is shown how the basic protocol can be used to release the factorization of a public composite number.},
booktitle = {A Conference on the Theory and Applications of Cryptographic Techniques on Advances in Cryptology},
booktitle="Advances in Cryptology --- EUROCRYPT '96",
year="1996",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="387--398",
abstract="In this paper, we address the question of providing security proofs for signature schemes in the so-called random oracle model [1]. In particular, we establish the generality of this technique against adaptively chosen message attacks. Our main application achieves such a security proof for a slight variant of the El Gamal signature scheme [4] where committed values are hashed together with the message. This is a rather surprising result since the original El Gamal is, as RSA [11], subject to existential forgery.",
