A study of pairing-based anonymous authentication systems and their applications

Recently, user authentication systems have been widely adopted in network service systems to permit only valid users to access to their services. In these systems, the Service Providers (SPs) can identify the users, record their behaviors at the services, and extract their profiles, which may cause a serious privacy problem. One cryptographic solution for this privacy problem is the use of a group signature scheme. In this scheme, the user can sign a digital message on behalf of the group. Then, the verifier can verify the signature anonymously. Another solution is the use of the anonymous credential system. This system allows an issuer to issue a certificate containing the specified attributes of the user. Using this certificate, the user can anonymously convince the possession of the certificate to the verifier, where the selected attributes can be disclosed without revealing any other information about the user’s privacy. Previously, RSA-based group signature schemes and anonymous credential systems have been proposed to construct anonymous authentication systems. However, the RSA-based constructions consume a high cost computation time. On the other hand, pairing-based schemes using the Elliptic Curve Cryptography (ECC) can achieve more practical solutions due to the much shorter signature. Thus, the pairing-based anonymous authentication systems should be desired. In this thesis, firstly, we propose a pairing-based anonymous IEEE802.1X authentication system using a pairing-based group signature scheme for wireless LANs. Since any user identity is not revealed at the authentication, Internet Service Providers (ISPs) cannot collect any personal information. As an efficient revocable group signature scheme, we adopt the Verifier-Local Revocation (VLR) type one with some modifications for use of the fast pairing computation. We show the implementation of the proposal and evaluation results, and the practicality of our system in up to 1,000 revoked users. Secondly, we propose a pairing-based group signature scheme with an efficient revocation check. The previously proposed VLR group signature scheme can reduce loads of signers by concentrating the process of user revocations into the verifiers. Since the revocation process needs a lot of computations, the VLR scheme is suitable for users (signers) using mobile terminals that are usual in mobile environments. However, because the pairing computation is necessary for each of the revoked users in this scheme, it suffers from the linear complexity of the number of revoked users. In our proposed scheme, this load at verifiers is reduced based on the observation that the product of pairings can be computed faster than the separated pairings. Our experimental results show that our scheme reduces the verification time by 10% from the original one. Thirdly, we propose a pairing-based anonymous attribute authentication system suitable for the electronic identification. Currently, the electronic identity (eID) such as an eID card has often been used for the identification. The eID is usually issued by a trusted organiza-