Auditable Credential Anonymity Revocation Based on Privacy-Preserving Smart Contracts

Abstract

Anonymity revocation is an essential component of credential issuing systems since unconditional anonymity is incompatible with pursuing and sanctioning credential misuse. However, current anonymity revocation approaches have shortcomings with respect to the auditability of the revocation process. In this paper, we propose a novel anonymity revocation approach based on privacy-preserving blockchain-based smart contracts, where the code self-execution property ensures availability and public ledger immutability provides auditability. We describe an instantiation of this approach, provide an implementation thereof and conduct a series of evaluations in terms of running time, gas cost and latency. The results show that our scheme is feasible and efficient.

R. Li and Q. Wang were supported by the National Science Foundation of China under Grant No. 11601220.

A Appendix A

This appendix gives an informal security proof of credential tracing and identity tracing for the concrete instantiation described in Sect. 5.

Theorem 1

The credential tracing of our scheme is auditable under the following assumptions that the TEE is a secure enclave, the DDH assumption holds, the fair blind signature scheme is signature traceable and the blockchain meets the property of liveness.

Proof

Given a valid identity, say $\xi ^{\upsilon }_{0}$, there are four possible ways for an adversary to obtain its corresponding credential (signature) $\varSigma _{0}$ without being audited. (i) An adversary has successfully accessed the private key $x_t$ which is stored in the TEE. Thus, the adversary can locally calculate the elliptic-curve exponentiation (see Eqs. (1) and (2)) to conduct the complete tracing activity without interacting with the blockchain. (ii) As mentioned in sub-protocol six of credential tracing, the contract TEE sends the tracing resulting $outp_{new}^{t}$ and $state_{new}^{t}$ to the tracer through a DDH-based secure channel. A compromised secure channel makes an adversary free to lift anonymity with auditability. (iii) An adversary has successfully forged a valid signature $\varSigma _{0}^{\star }$ independently from the blockchain, where $\varSigma _{0}^{\star }$ meets the conditions: $\varSigma _{0}^{\star } \ne \varSigma _{0}$ and $1 \leftarrow {\mathsf {Match}}_{\mathsf {sig}}(\varSigma _{0}, \varSigma _{0}^{\star })$. (iv) An adversary called the smart contract $\widehat{contract}$ and successfully hid the invoked transactions from the inspector.

Scenario (i) contradicts our assumption that the TEE provides an isolated secure environment. The proof of Scenario (ii) is done by contradiction. Suppose that there exists an adversary ${\mathcal {A}}$ that compromised the secure channel with success probability ${\mathsf {Adv}_{{{\mathcal {A}}}}^{\mathrm {sc}}}$, where ${\mathsf {Adv}_{{{\mathcal {A}}}}^{\mathrm {sc}}}$ is not negligible. Then, based on ${\mathsf {Adv}_{{{\mathcal {A}}}}^{\mathrm {sc}}}$ of the adversary ${\mathcal {A}}$, we can construct another adversary ${\mathcal {B}}$ to solve DDH problem with non-negligible advantage ${\mathsf {Adv}_{{{\mathcal {A}}}}^{\mathrm {ddh}}}$. However, it contradicts the DDH assumption. Scenario (iii) indicates two properties: an adversary has successfully forged a signature and the forged signature and the original signature can be linked to one identity. These properties violate the unforgeability and signature traceability of fair blind signature scheme, which was proved secure by Abe [1]. Liveness [16] guarantees that the submitted transactions will eventually be included in the ledger. For Scenario (4), if an adversary can successfully hide the invoked transaction, that indicates the transaction does not eventually appear in the ledger, which contradicts our assumption that the blockchain meets the liveness property.

Theorem 2

The identity tracing of our scheme is auditable under the following assumptions that the TEE is a secure enclave, the DDH assumption holds, the fair blind signature scheme is session traceable and the blockchain meets the property of liveness.

Proof

Given a valid credential (signature), say $\varSigma _{0}$, there are four possible ways for an adversary to illegally obtain the corresponding identity $\xi ^{\upsilon }_{0}$ without being audited. An adversary has successfully (i) accessed the TEE, (ii) compromised the DDH-based secure channel, (iii) linked one credential to more than one identity and (iv) damaged the liveness of blockchain. Scenario (i), (ii) and (iv) in Theorem 2 are the same as Theorem 1. Thus, this part of proof is omitted here. Scenario (iii) violates the unforgeability and the session traceability of fair blind signature scheme, which was proved secure by Abe [1].