Ghislain

Florent Nicolas Alexia

Charline Neals

Keywords: Cryptographie à Clé Publique, Protocoles Homomorphes, Anonymat, Vote Electronique, Calculs Multipartites Public-Key Cryptography, Homomorphic Protocols, Anonymity, E-voting, Multiparty Computation

Avec l'utilisation massive du stockage dématérialisé, l'homomorphisme est devenu l'une des propriétés les plus largement employées en cryptologie. Dans cette thèse, nous allons étudier comment l'utiliser dans des protocoles multi-utilisateurs concrets qui nécessitent non seulement de la confidentialité, mais aussi de l'anonymat, de l'authentification ou encore de la vérifiabilité. Pour cela, nous utilisons des schémas homomorphes de chiffrement, de signature numérique et de preuves à divulgation nulle de connaissances, mais, à chaque fois, nous devrons limiter leurs capacités de malléabilité pour atteindre le niveau de sécurité préalablement défini.

Tout d'abord, l'aspect confidentiel est abordé au travers de l'étude de calculs sur des bases de données externalisées. Être capable d'appliquer des fonctions sur des données chiffrées sans avoir à les télécharger pour les déchiffrer entièrement est permet de profiter de la puissance de calcul du serveur qui est généralement supérieure à celle du client. Cela peut être également indispensable lorsqu'une société sans droit d'accès à une base de données de clients souhaite obtenir le résultat d'un calcul. La quantité d'information apprise ne doit pas être supérieure à celle contenue dans le résultat du calcul. Nous proposons pour cela un schéma de chiffrement décentralisé qui permet d'évaluer des fonctions quadratiques sur les données externalisées tout en ayant un contrôle des opérations grâce à un groupe d'inspecteurs.

Cependant, la confidentialité des données n'est pas toujours la propriété la plus recherchée pour un système car elle ne protège pas l'identité de l'expéditeur. Pour le vote électronique, chaque bulletin chiffré doit être associé à un électeur afin de vérifier que celui-ci était autorisé à voter, mais après la phase de vote, l'anonymat doit être assuré. Pour cela une solution est de mélanger plusieurs fois l'urne de sorte que, au moment du dépouillement, qui correspond au déchiffrement, aucun lien entre le vote et l'électeur ne puisse être fait. C'est le fonctionnement d'un réseau de serveurs-mélangeurs dont nous proposons une nouvelle construction basée sur des signatures linéairement homomorphes avec un coût de vérification de l'urne finale indépendant du nombre de mélanges. Ce protocole est donc d'autant plus efficace que le nombre de mélanges augmente et représente un progrès par rapport aux constructions déjà connues.

Dans certains cas, avoir un anonymat parfait permettrait l'utilisation malveillante d'un système et la cryptologie doit aussi tenir compte de ces abus potentiels. La troisième contribution de cette thèse consiste en la proposition du premier protocole d'accréditation anonyme multiautorités traçable : un utilisateur demande une accréditation auprès d'une autorité émettrice et peut l'utiliser pour accéder à un système tout en restant anonyme. En cas d'abus, une autorité juge peut lever l'anonymat et retrouver un utilisateur malveillant grâce au traçage. De plus, ce protocole, tout en étant aussi efficace que les précédents pour une seule autorité émettrice, permet d'agréger des accréditations d'autorités émettrices distinctes pour avoir une accréditation de taille optimale .

Covid-19.

The pandemic spreads across the world and teleworking is currently the norm. We log in every morning to check our mailbox, we connect to the VPN to work on the intranet, we save all the files on the cloud and finally, we meet colleagues and family on virtual meetings. We are more than ever dependent on the Internet and all its features. Even children are attending classes from home and people living in dead zones suffer the most from this situation. The Internet is essential and the need to improve privacy is huge in all our uses of electronic devices.

How can we guarantee privacy whereas being connected is more and more essential?

One solution is to study and propose scenarios integrating privacy by design. This thesis explores this field and makes its contribution to cloud computation, electronic voting and anonymous authentication.

Classical Cryptography

Cryptography is a very large field but first, let us start with some historical notions that will be useful for the full understanding of this thesis.

Confidentiality

Historically, the aim of cryptology was to protect confidentiality of communications. The first propositions to hide a message were to encrypt it by transforming it in a secret manner in order to make it incomprehensible. The hidden message can then travel safely to the receiver who applies at his turn secret transformations to recover the original message. A non-encrypted, and thus understandable, message is called in clear.

However, Kerckhoff's principles (1883) [START_REF] Kerckhoffs | La cryptographie militaire, ou les chiffres usités en temps de guerre, avec un nouveau procédé de déchiffrement applicable aux systèmes à double clef[END_REF] state that the security must not rely on secret transformations but instead, must rely on public transformations (so that the mechanism can fall in the hands of the adversary) with the use of a key that shall remain secret (must not go in the hands of the adversary).

To that end, an encryption scheme is defined as the set of three algorithms. The algorithm EKeygen describes the construction of the key, the algorithm Encrypt details the steps to encrypt. It outputs a hidden message called ciphertext. Finally, the algorithm Decrypt allows to recover the original message.

In fact, encryption schemes are divided in two categories depending if the same key is used to both encrypt and decrypt (symmetric encryption) or if the scheme provides two keys (asymmetric encryption): a public one to encrypt so that anyone can encrypt a message with it and a secret one to decrypt so that only the owner of the key can recover the message. This thesis exclusively focuses on the latter case, also called public-key cryptography as it allows a particular user to receive messages from several users while being the only one possessing the tool to decrypt them and thus, being the only one responsible for his security.

Especially, an encryption schemes is said secure if an attacker can not deduce one bit of information on a clear from its corresponding ciphertext.

The most famous public-key cryptosystem still in use was developed by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] in 1978. To generate the keys, one needs to choose a large number n product of two primes p and q and two numbers e and d such that e • d = 1 mod φ(n). The public key is (n = pq, e) while the secret key is the decomposition (p, q) of n with the private element d. To encrypt a message m ∈ Z * p , one computes the ciphertext c = m e mod n. Whereas to decrypt, one recovers the message with c d = (m e ) d = m 1 mod n.

Authentication

How can Bob be sure he is receiving a message from Alice and not from Eve pretending to be Alice? In our digital world, one needs to be careful about phishing and other attempts of false impersonations. A way to avoid that is to add an authentication process and to check the supposed identity of the user. While confidentiality is mainly achieved with encryption, authentication is mainly achieved thanks to digital signatures.

Similarly to an encryption scheme, a digital signature scheme is made up of three algorithms. The algorithm SKeygen generates the signing key (must be kept secret) and the verification key (public). The algorithm Sign creates a signature from a message and the signing key while the algorithm Verif verifies a signature given a message and a verification key. If this last algorithm outputs 1, the signature is said valid. We will use these algorithms a lot all along this manuscript, most of the time enhanced with special properties.

To illustrate, the RSA signature is composed of the algorithm SKeygen using the same numbers n, p, q, e, d such that n = pq and ed = 1 mod φ(n) as for the RSA algorithm EKeygen but this time, the signing key is (p, q, d) and the verification key is (n, e). To sign a message m, one needs to compute σ = H(m) d mod n with H a full domain hash function. Thus, if we compute σ e , we can verify the signature σ was correct by recovering or not the message as σ e = (H(m) d ) e = H(m) 1 mod n.

Classically, a signature scheme is said secure if an attacker cannot forge a new valid signature even if he previously saw valid ones.

Provable Security

The first definition and proof of security dates back to Shannon [START_REF] Shannon | Communication theory of secrecy systems[END_REF] in 1949. In his article, he defines the notion of perfect secrecy in the sense of information theory and gives the example of the One-Time Pad scheme which is perfectly secure. However, this scheme is not convenient as the size of the key needs to be at least equal to the size of the message.

To avoid this limitation, security proofs are no longer necessarily made in the sense of information theory but are most often reductions of mathematical problems for which the complexity is widely accepted.

For example, the RSA encryption scheme is based on the factoring problem: given a very large number product of two prime numbers n = pq, the goal is to find the two prime factors p and q. The decomposition being part of the secret key of the encryption scheme, breaking the problem directly breaks the security of RSA.

In this manuscript, we will use two other mathematical problems often used in cryptography defined on a group G generated by g. The Discrete Logarithm (DL) problem is, given an element X of G, to find the exponent x such that X = g x . The other is the Computational Diffie-Hellman (CDH) problem [START_REF] Diffie | New directions in cryptography[END_REF] (1976): given two elements X = g x and Y = g y of G, the goal is to compute Z = g xy . For these two problems, the bigger is the number of elements in G, the more difficult is the problem. The security of cryptographic schemes is thus usually defined with a security parameter configuring the size of the group. Then, we make the assumption that the problem is difficult and if attacks are improved or found, it is possible to adapt the level of security with the security parameter.

A variant of the CDH problem is the Decisional Diffie-Hellman (DDH) problem: given three elements X = g x , Y = g y and Z of a cyclic group, the goal is this time to decide if Z = g xy or not. It is at the core of the El Gamal cryptosystem [START_REF] Elgamal | A public key cryptosystem and a signature scheme based on discrete logarithms[END_REF] (1984), the second main public-key encryption scheme that we will use a lot all along this manuscript.

Advanced Security Goals

The cryptographic world where Alice and Bob are discussing secretly together is not relevant anymore. We live in a connected world where some scenarios imply to deal with thousands of users while still achieving some kind of security. There are users and servers, different access rights for each of them and sometimes there are various authorities at the same time having different abilities. As the number of persons involved increases and the technologies are improving, more specific definitions of security notions are necessary. In this section, we broach the advanced and modern thematic to improve the privacy of users by a better control of his data or guarantees on sensitive systems.

A Multi-User World. Working in a multi-user setting means having to consider different roles for each user. An honest user follows the protocol, an honest-but-curious user follows the protocol but tries to retrieve information from the communications he sees passing by and finally a malicious user tries to actively attack the protocol. If several users try to attack together with a common goal, we talk about collusion but an attacker can also corrupt others. Some schemes allow a limited number of collusions/corruptions, i.e. they are proven safe until this threshold is reached.

Privacy in a World of Information. For the scenarios studied in this manuscript, we will consider Uma, a user who wants to protect her privacy while wishing to take advantage of the technological advances of her time. She therefore uses a cloud to store her data but would like to allow a company to study her records, such as allowing it to do statistical studies of cancers on her medical record but only if the company is forced by the system to recover only this information and nothing more. Uma would also like to vote electronically at the next election but requests that anonymity is guaranteed as well as the result of the election. Finally, Uma would like to be able to log in anonymously while being properly authenticated to a system. She accepts that, in return, if she misuses and abuses the system, her anonymity may be revoked by a judge.

All of these scenarios require new and more complex security concepts than the one historically used. Cryptology should not be a hindrance to the use of new technological advances.

Decentralization

Decentralized Cryptography is one of the main directions of research in cryptography, especially in a concurrent environment of multi-user applications, where there is no way to trust any authority. Recently, the rise of blockchain's applications also showed the importance of decentralized applications. However, the blockchain mainly addresses the decentralized validation of transactions, but it does not help in decentralizing computations. For the computational purpose, though general solutions can be achieved via multi-party computation, reasonably efficient solutions only exist for a limited number of protocols, as decentralization usually adds design constraints to protocols: in broadcast encryption [START_REF] Fiat | Broadcast encryption[END_REF], the decentralized protocol in [START_REF] Duong Hieu Phan | Decentralized dynamic broadcast encryption[END_REF] is much less efficient than the underlying original protocol [START_REF] Naor | Revocation and tracing schemes for stateless receivers[END_REF]; in attribute-based encryption [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], the decentralized scheme [START_REF] Chase | Improving privacy and security in multiauthority attribute-based encryption[END_REF] implies some constraints on the access control policy, that are removed in [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF], but at the cost of using bilinear groups of composite order with 3 prime factors, etc...

In the last decade, the most active research direction was about computing over encrypted data, with the seminal papers on Fully Homomorphic Encryption (FHE) [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] and on Functional Encryption (FE) [BSW11, GKP + 13, GGH + 13]. FE was generalized to the case of multiuser setting via the notion of multi-input/multi-client FE [GGG + 14, GGJS13, GKL + 13]. It is of practical interest to consider the decentralization for FHE and FE without need of trust in any authority. In FE, the question in the multi-client setting was recently addressed by Chotard et al. [CDG + 18a] for the inner product function and then improved in [ABKW19, CDG + 18b], where all the clients agree and contribute to generate the functional decryption keys, there is no need of central authority anymore. Note that, in FE, there are efficient solutions for quadratic functions [START_REF] Gay | Functional encryption for quadratic functions, and applications to predicate encryption[END_REF][START_REF] Elisabetta | Practical functional encryption for quadratic functions with applications to predicate encryption[END_REF] but actually, only linear function evaluations can be decentralized as none of the methods to decentralize linear schemes seems to apply, and no new method has been proposed so far.

Anonymity

Sometimes confidentiality is not the most desired property for a system as it does not protect the sender or the receiver. In 1981, Chaum wrote the first article [START_REF] David | Untraceable electronic mail, return addresses, and digital pseudonyms[END_REF] proposing a scheme able to hide the participants of a communication.

A user is anonymous when his name is either not known or not given. In practice, the anonymity is defined as the property to not be identifiable within a set. Hence, the anonymity notion can be obtained throught an unlinkability property. In the next two sections we will see use-cases of anonymity addressed in this thesis.

Electronic voting

There are mainly three ways to construct electronic voting schemes: from blind signatures, from additively homomorphic encryption and from shuffles performed by mix-networks. The first method requires to have interactions during the voting phase: the voter needs to communicate with an authority so that, she can blindly sign his vote. The second method requires to make a proof at the time of the vote that the ballot is a valid one (e.g. the ballot is the encryption of 0 or 1 but nothing else). The last one is the solution studied in this thesis.

A shuffle of ciphertexts is a set of ciphertexts of the same plaintexts but in a permuted order such that it is not possible to trace back the senders after decryption. It can be used as a building block to anonymously send messages: if several servers perform a shuffle successively, nobody can trace the messages. More precisely, one honest mix-server suffices to mask the order of the ciphertexts even if all the other ones are dishonest. Moreover increasing the number of mix-servers leads to a safer protocol but also increases its cost. The succession of shuffles constitutes the notion of a mix-net protocol introduced by Chaum [START_REF] David | Untraceable electronic mail, return addresses, and digital pseudonyms[END_REF], with applications to anonymous emails, anonymous routing, but also eletronic voting.

Anonymous authentication

In an anonymous credential scheme, a user asks an organization (a credential issuer) for a credential on an attribute, so that he can later claim its possession, even multiple times, but in an anonymous and unlinkable way.

Usually, a credential on one attribute is not enough and the user needs credentials on multiple attributes. Hence the interest in attribute-based anonymous credential schemes (ABC in short): depending on the construction, the user receives one credential per attribute or directly for a set of attributes. One goal is to be able to express relations between attributes (or at least selective disclosure), with one showing. As attributes may have different meanings (e.g. a university delivers diploma while a city hall delivers a birth certificat), there should be several credential issuers. Besides multi credential issuers, it can be useful to have a multi-show credential system to allow a user to prove an arbitrary number of times one credential still without breaking anonymity. For that, the showings are required to be unlinkable to each other.

Traceability

Nevertheless, with perfect anonymity comes the threat of malicious use of the system as it is not possible to identify anyone, even in case of misbehavior. Thus, in tracing scheme, one takes advantage of computational anonymity to find guilty members who can be at any level: a guilty sender of an encrypted message, a guilty signer, a guilty verifyer or a guilty authority. Collusions between users with different parts can also help to combine powers.

Here comes the traitor-tracing schemes [START_REF] Chor | Tracing traitors[END_REF][START_REF] Chor | Tracing traitors[END_REF] with application to group signatures, group encryption [START_REF] Libert | Traceable group encryption[END_REF], broadcast encryption, inner-product functional encryption [START_REF] Thanh Do | Traceable inner product functional encryption[END_REF] or identity-based encryption [START_REF] Blazy | Anonymous identity based encryption with traceable identities[END_REF]. When the number of traitors is not bounded, the scheme is said fully traceable. To identify a culprit, one can add a new authority possessing a secret or one can request public traceability and in such a case, no secret is needed: everyone can find a traitor in case of misbehavior.

However, finding a guilty is not enough. When someone is declared guilty one needs to have guarantees against defamation of users or authorities. In particular, the exculpability property ensures that no coalition of authorities can convincingly accuse an innocent user in a group signature scheme. After finding a traitor and having the guarantee of its culpability, one can eventually revoke him but revokability is usually a more difficult property to achieve. When it is not possible, a solution is to combine traceability with decentralization. Hence, even a malicious authority cannot defame a user easily, its ability to judge or revoke being shared among parties.

Homomorphism

The presented scenarios require to develop new cryptographic tools. Secret sharing techniques allow decentralization by replacing an authority by a group of members. Indeed, thanks to 1 -Introduction Shamir [START_REF] Shamir | How to share a secret[END_REF], it is possible to decompose a secret key s in parts so that s = i s i , each user U i of a group possesses s i a fragment of the secret and is not able to decrypt a ciphertext alone. However, they can decrypt by playing with the other members of the group which implicitly reconstruct the secret s = i s i .

All along this manuscript we will use another key ingredient: the homomorphism.

Homomorphic Encryptions

For some generic encryption scheme, if we modify a ciphertext it becomes a completely random string and the content is lost as it is not decryptable anymore even with the secret key. Not being able to manipulate ciphertexts is called non-malleability. For a long time, this property ensured the security of encryption schemes: either we know the secret key and we can find the message again or we do not know it and all the operations we can do will not help. However, with the RSA encryption scheme, if we multiply two encryptions of m 1 and m 2 together, we obtain the ciphertext of the message m 1 × m 2 : if c 1 = m e 1 mod n and c 2 = m e 2 mod n then c 1 • c 2 = (m 1 × m 2 ) e mod n. A cryptosystem with such property is said to be multiplicatively homomorphic as one can operate on the clears by multiplication. With the Paillier cryptosystem [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF], if we multiply two encryptions of m 1 and m 2 together, we obtain the ciphertext of the message m 1 + m 2 . This scheme is thus additively homomorphic.

The homomorphism property can be of great interest: if Alice and Bob want to give a common gift to Charlie but none of them want to tell how much he gave. They both encrypt the amount with an additively homomorphic scheme and can, thanks to the property of homomorphism, multiply their two encryptions together and send the result to Charlie. She will be able to decrypt it and the message will correspond directly to the sum of the two amounts.

Another common usage of homomorphism with encryption is for refreshing a ciphertext: by multiplying an encryption of 1 by a ciphertext of m, encrypted with a multiplicatively homomorphic scheme, one can obtain a new encryption of m thanks to the usage of the neutral element 1 for the multiplication. The new ciphertext while still encrypting the same message can be indistinguishable from the original one. A similar relation can be obtained with an encryption of 0 and an additively homomorphic scheme.

Generically, an encryption scheme in which making an operation on ciphertexts is equivalent to encrypting the result of a "twin operation" on the clears is called homomorphic. The seminal paper of Gentry [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] published in 2009 combines for the first time both multiplicative and additive properties, and thus, allows the evaluatation of any function on ciphertexts. This scheme is called fully homomorphic encryption (FHE).

Homomorphic Signatures

Similarly to homomorphic encryption, one can define homomorphic signatures. The notion dates back to Rivest in a series of talks [START_REF] Rivest | Two signature schemes[END_REF] and Johnson et al. [START_REF] Johnson | Homomorphic signature schemes[END_REF], with notions in [ABC + 12].

They can help for computations on certified data. For example, Alice has n grades m i all individualy signed into σ i on a remote server. Later, the server is asked to perform an authenticated computation of a mean of the data. Thus, it computes σ = f (σ 1 , . . . , σ n ) possible thanks to homomorphism and M = f (m 1 , . . . , m n ) and publishes the result (M, σ). Then, anyone can check that the server correctly applied f to the data by verifying that σ is a valid signature.

The linearly-homomorphic signatures, that allow to sign vector sub-spaces, were introduced in [START_REF] Boneh | Signing a linear subspace: Signature schemes for network coding[END_REF], with several follow-ups by Boneh and Freeman [START_REF] Boneh | Linearly homomorphic signatures over binary fields and new tools for lattice-based signatures[END_REF][START_REF] Boneh | Homomorphic signatures for polynomial functions[END_REF]. With a linearly homomorphic signature scheme, from a signature σ 1 on the message m 1 and σ 2 a signature on the message m 2 , it is possible to compute for all α, β, the signature σ = ασ 1 + βσ 2 , a valid signature on the message m = αm 1 + βm 2 .

As for encryption, a signature scheme can also be multiplicatively homomorphic: with the RSA signature, if we compute σ 1 ×σ 2 = (m 1 •m 2 ) d mod n, this is a valid signature of the message m 1 • m 2 from two valid signatures σ 1 of m 1 and σ 2 of m 2 . Even if this scheme illustrated the homomorphism, it is, as presented, not secure.

Security with Homomorphism

The security of an homomorphic scheme is different and needs to be strengthen. For example, an attacker seeing a signature of a message m, could simply forge the signature of m + m, which would break the basic notion of security. He does not know the keys but he is able to compute a valid signature of a new message (here m + m).

With the RSA signature scheme above, an attacker can forge any message of his choice: if an attacker asks the signature σ = (m • r e ) d mod n, this is a valid signature of the message m • r e . However with that, the attacker can forge the signature σ * = σ/r which is a valid signature of m while the signer does not know m.

To include the malleability in the security, we will require that it is not possible for an attacker to provide a signature outside the space generated by the signatures already given. A similar change in the security definition is of course needed for all the homomorphic schemes and thus, encryption ones.

Homomorphic Zero-Knowledge Proofs

The last kind of schemes we will intensively use in this thesis is the zero-knowledge proofs. They were introduced for the first time by Goldwasser, Micali and Rackoff [START_REF] Goldwasser | The knowledge complexity of interactive proof-systems (extended abstract)[END_REF] in 1985.

A zero-knowledge proof is a protocol where a prover knowing a witness w makes a proof that a statement x ∈ L is true to a verifier. The zero-knowledge property implies that the verifier does not learn more than the fact is true or false and nothing about the witness. In 1986, Goldreich, Micali and Wigderson [START_REF] Goldreich | How to prove all NP-statements in zero-knowledge, and a methodology of cryptographic protocol design[END_REF] shows that any language in NP possess zero-knowledge proofs.

For example, Bob can make a proof of Diffie-Hellman tuple to Alice: Alice thanks to the proof can verify if the tuple (X = g x , Y = g y , Z) is or not a Diffie-Hellman (if Z = g xy or not) but she will not learn any of the exponents involved. The language is this case is the set of Diffie-Hellman tuples and the witness of Bob can be the pair of scalars x and y.

The showing of a proof can be interactive or non-interactive if the verifier after having received elements from the prover can check the proof latter without any further interaction with the prover. Moreover, the zero-knowledge proofs is said of statements if it proves a relation (as a proof of Diffie-Hellman tuple), or of knowledge if it proves the knowledge of a witness: when Bob wants to authenticate himself to a system, he needs to show he knows the password. A non-interactive zero-knowledge proof of knowledge is also called signature of knowledge.

With the Groth-Sahai [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF] scheme, it is possible to combine together different proofs into a unique one. This property can be viewed as an homomorphic property: the combinations of the proofs creates a proof of a relation of statements.

In this thesis, zero-knowledge proofs will be used sometimes enhanced of the homomorphic property to prove that a ciphertext is correctly construted or for authentication.

Contributions

This thesis studies the usage of the homomorphic property in concrete multi-users protocols requiring not only confidentiality but also anonymity, authentication or verifiability. Homomorphic encryption schemes, homomorphic digital signatures and homomorphic zero-knowledge proofs will be used together to create new protocols, but, each time, restrictions will be applied to limit the possible malleability.

The results presented in this manuscript come from two published papers (co-authored with Duong Hieu Phan and David Pointcheval) and one paper still in reviewing process (co-authored with David Pointcheval).

First, we will present a decentralized encryption scheme that allows the controlled evaluation of quadratic polynomials on outsourced data. Then, we will describe a new method to build mixnetworks from linearly homomorphic signatures allowing a verification which is cost-independent of the number of servers. Finally, we will detail a new traceable multi-authority anonymous credential protocol. After defining the security, the schemes are proved to achieve the desired level of security. Below, we detail the contributions.

Decentralized Evaluation of Quadratic Polynomials on Encrypted Data [HPP19].

In this paper, we revisit the Boneh-Goh-Nissim (BGN) [START_REF] Boneh | Evaluating 2-DNF formulas on ciphertexts[END_REF] cryptosystem, and the Freeman's variant [START_REF] Mandell | Converting pairing-based cryptosystems from compositeorder groups to prime-order groups[END_REF], that allow evaluation of quadratic polynomials, or any 2-DNF formula. Whereas the BGN scheme relies on integer factoring for the trapdoor in the composite-order group, and thus possesses only one pair of public/secret keys, the Freeman's scheme can handle multiple users with one general setup that just needs a pairingbased algebraic structure to be defined. We show that it can be efficiently decentralized, with an efficient distributed key generation algorithm, without any trusted dealer, but also efficient distributed decryption and distributed re-encryption, in a threshold setting.

To motivate our work, we focus on some real-life applications of computations on encrypted data, without central authority which only require evaluations of quadratic polynomials so that specific target users can get the result in clear, by running re-encryption in a distributed manner under the keys of the target users.

This paper has been published in the proceedings of the conference ISC in 2019.

Linearly-Homomorphic Signatures and Scalable Mix-Nets [HPP20].

In this article, we propose a new approach for proving correct shuffling of signed ElGamal ciphertexts: the mix-servers can simply randomize individual ballots, namely the ciphertexts, the signatures, and the verification keys, with an additional global proof of constant size. This technique can be seen as an improvement of signatures on randomizable ciphertexts [START_REF] Blazy | Signatures on randomizable ciphertexts[END_REF] which however does not allow updates of the verification keys. This previous approach excluded anonymity because of the invariant verification keys.

The computational complexity for each mix-server is linear in the number of ballots and the overhead after each shuffle can be updated to keep it constant-size. Thus, the final proof implies just a constant-size overhead and the verification is also linear in the number of ballots, but independent of the number of rounds of mixing. This leads to a new highly scalable technique.

Our construction relies on Groth-Sahai proofs with pairings [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF] and a new computational assumption that holds in the generic bilinear group model. We avoid the proof of an explicit permutation on all the ciphertexts (per mixing step) but the appropriate properties of the Mix-Nets are deeply guaranteed using linearly-homomorphic signature schemes with new features, that are of independent interest. This paper has been published in the proceedings of the conference PKC in 2020.

Traceable Multi-Authority Anonymous Credentials [HP20].

Following the path of aggregate signatures [START_REF] Canard | Anonymous credentials from (indexed) aggregate signatures[END_REF], our first contribution is the formalization of an aggregate signature scheme with randomizable tags (ART-Sign) for which we propose a practical construction. With such a primitive, two signatures of different messages under different keys can be aggregated only if they are associated to the same tag. In our case, tags will eventually be like pseudonyms, but with some properties which make them ephemeral (hence EphemerId scheme) and randomizable, even when they are associated to the same user.

However our goal is to obtain a compact ABC system, which is our second contribution: the EphemerId scheme generates keys for users, they will use for authentication. Public keys being randomizable, multiple authentications using the same key will remain unlinkable. In addition, these public keys will be used as (randomizable) tags with the above ART-Sign scheme when the credential issuer signs an attribute. Thanks to aggregation, multiple credentials for different attributes and from several credential issuers but under the same tag, and thus the same user, can be combined into a unique compact (constant-size) credential.

About security, whereas there exists a scheme proven in the universal composability (UC) framework [START_REF] Camenisch | Composable and modular anonymous credentials: Definitions and practical constructions[END_REF], for our constructions we consider a game-based security model for ABC inspired from [START_REF] Fuchsbauer | Structure-preserving signatures on equivalence classes and constant-size anonymous credentials[END_REF]. As we support different credential issuers, we additionally consider malicious credential issuers, with adaptive corruptions, and collusion with malicious users. However, the keys need to be honestly generated, thus our proofs hold in the certified key setting. As for all the recent ABC schemes, our constructions will rely on signature schemes proven in the bilinear generic group model.

Our last contribution is traceability, in the same vein as group signatures: whereas showings are anonymous, a tracing authority owns tracing keys, and thus is able to link a credential to its owner. In such a case, we also consider malicious tracing authorities, with the non-frameability guarantee. Because the previous constructions ([CL13], [START_REF] Vergnaud | Comment on 'Attribute-Based Signatures for Supporting Anonymous Certification' by N. Kaaniche and M. Laurent (ESORICS 2016)[END_REF]) are broken, our scheme is the first traceable attribute-based anonymous credential scheme.

invertible matrices of size n (for the above matrix product ×), which is also called the general linear group. We will use the tensor product: for two vectors a

= (a 1 , a 2 , • • • , a n ) ∈ Z n p and b = (b 1 , b 2 , • • • , b m ) ∈ Z m p , the tensor product a ⊗ b is the vector (a 1 b, • • • , a n b) = (a 1 b 1 , • • • , a 1 b m , a 2 b 1 , • • • , a 2 b m , • • • , a n b m ) ∈ Z mn p ; and for two matrices A ∈ M m,n (Z p ) and B ∈ M m ,n (Z p ), A =    a 1 . . . a m    B =    b 1 . . . b m    A ⊗ B =       a 1 ⊗ b 1 a 1 ⊗ b 2 . . . a m ⊗ b m       ∈ M mm ,nn (Z p ).
The bilinearity of the tensor product gives:

for A, A ∈ M m,n (Z p ) and B, B ∈ M m ,n (Z p ), (A + A ) ⊗ (B + B ) = (A ⊗ B) + (A ⊗ B ) + (A ⊗ B ) + (A ⊗ B )
We will also use the following important relation between matrix product and tensor product:

for A ∈ M m,k (Z p ), A ∈ M k,n (Z p ), B ∈ M m ,k (Z p ), and B ∈ M k ,n (Z p ), (A × A ) ⊗ (B × B ) = (A ⊗ B) × (A ⊗ B ).
Projections. In order to continue with matrix properties and linear applications, a projection π in a space of dimension n is a linear function such that π • π = π. Any projection of rank 1 can be represented by the matrix P = B -1 U n B, where U n is the canonical projection and B is the change of basis matrix:

U n =      0 . . . 0 0 . . . 0 . . . 0 0 0 . . . 0 1      B =       p 1 . . . p n-1 b      
where K = p 1 , . . . , p n-1 is the kernel of the projection and b the image. Given two projections π 1 and π 2 of rank 1, that are represented by

P 1 = B -1 1 U n B 1 and P 2 = B -1 2 U n B 2 , respectively, the tensor product π = π 1 ⊗ π 2 is represented by P = P 1 ⊗ P 2 , that is equal to (B -1 1 U n B 1 ) ⊗ (B -1 2 U n B 2 ) = (B -1 1 ⊗ B -1 2 ) × (U n ⊗ U n ) × (B 1 ⊗ B 2 ) = (B 1 ⊗ B 2 ) -1 × U n 2 × (B 1 ⊗ B 2 ).
The associated change of basis matrix is thus B = B 1 ⊗ B 2 . In dimension 2:

B 1 = p 1 b 1 and B 2 = p 2 b 2 , then B = B 1 ⊗ B 2 =      p 1 ⊗ p 2 p 1 ⊗ b 2 b 1 ⊗ p 2 b 1 ⊗ b 2      , hence, the image of π = π 1 ⊗ π 2 is spanned by b = b 1 ⊗ b 2 , while {p 1 ⊗ p 2 , p 1 ⊗ b 2 , b 1 ⊗ p 2 } is a basis of the kernel. But, as explained below, p 1 ⊗ r 2 + r 1 ⊗ p 2 , for r 1 , r 2 $ ← Z 2
p , provides a uniform sampling in ker(π):

ker(π) = {(x 1 + x 2 ) • p 1 ⊗ p 2 + y 2 • p 1 ⊗ b 2 + y 1 • b 1 ⊗ p 2 , x 1 , x 2 , y 1 , y 2 ∈ Z p } = {p 1 ⊗ (x 2 • p 2 + y 2 • b 2 ) + (x 1 • p 1 + y 1 • b 1 ) ⊗ p 2 , x 1 , x 2 , y 1 , y 2 ∈ Z p }.
Cryptographic Notations. All along this manuscript, κ will be the security parameter. In all the public-key cryptographic primitives, keys will implicitly include the global parameters and secret keys will include the public keys.

Bilinear Group Setting.

A bilinear group generator G is an algorithm that takes a security parameter κ as input, and outputs a tuple (G 1 , G 2 , G T , p, g, g, e) such that G 1 = g and G 2 = g are cyclic groups of prime order p (a κ-bit prime integer), and e : G 1 × G 2 → G T is an admissible pairing:

• e is bilinear: for all a, b ∈ Z p , e(g a , g b ) = e(g, g) ab ;

• e is efficiently computable (in polynomial-time in κ);

• e is non-degenerated: e(g, g) = 1. Furthermore, the bilinear setting (G 1 , G 2 , G T , p, g, g, e) is said symmetric when G 1 = G 2 and asymmetric when G 1 = G 2 and of • Type 1: if there exist two efficiently computable isomorphisms from G 1 to G 2 and conversely from G 2 to G 1 ;

• Type 2: if there only exists an efficiently computable isomorphism from G 2 to G 1 ;

• Type 3: if there is no efficiently computable isomorphism between G 1 and G 2 .

In this thesis, we will only use asymmetric pairing of type 3 and denote in Fraktur font elements of G 2 for the sake of clarity.

Provable Security

Correctly evaluate the security of a system is challenging and fundamental. Especially because it is always possible to attack a system: it suffices to try all the possible secrets until finding the correct one. This method is called the brute-force attack. However, it takes time and sometimes more efficient attacks can be found. Moreover knowing precisely the powers of an attacker is often impossible: what does he intend to do, how much power or how long does he have? Therefore, the goal becomes to modelize the interactions between some adversary and the system so that a real attacker would have less power than the idealized/considered one. This is usually achieved by upper bounding the data he has access to and formalized by an experiment representing the desired security as a game between an attacker and an implicit challenger playing as wanted by the system.

With the current computational power available, one considers an attack to be infeasible if it requires 2 128 computational steps to break the system and one says that a cryptosystem provides κ bits of security if it requires 2 κ elementary operations to be broken. Hence, the goal becomes to prove that the attacker winning the experiment has to perform at least this number of operations.

After having defined the attacker and the security model we want to achieve, the proof usually consists in hybrid games where the first one corresponds to the interactions between the attacker and the system and each step of the proof shows that this intermediate experiment is equivalent to the next one until the final experiment corresponds to the desired security or a difficult mathematical problem. Usually at the end, one can tell if the attacker can break the system if he is also able to break this well-known hard problem.

For that, it can be easier to make proofs in the Random Oracle Model (ROM) [START_REF] Bellare | Random oracles are practical: A paradigm for designing efficient protocols[END_REF] in which hash functions used in a scheme are considered as an ideal random oracle. Hence, the randomness is considered as perfect.

Another possible model to help in the study of the security is the Generic Group Model (GGM) [START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF]: if the attacker has access to group elements, then he can just make linear combinations of them and nothing else. For example, if the attacker knows A and B such that A = g a and B = g b then the attacker can obtain C = g αa+βb for any α and β but cannot have D = g d with d not in relation with a and b. In fact, this corresponds to an idealization of the group structure as the attacker can not exploit any special structure of the representation of the group elements. Similarly, the Generic Bilinear Group Model (GBGM) adds the idealization of the pairing operation.

Finally, security proofs in the Common Reference String Model [START_REF] Damgård | Efficient concurrent zero-knowledge in the auxiliary string model[END_REF] assume that a string crs, known by all the participants before the begining of the scheme, exists and was honestly generated.

Of course, the best model is the Standard Model where no idealization of the system is made but difficult to achieve.

Computational Assumptions

As introduced in the previous chapter, in an asymmetric bilinear setting (G 1 , G 2 , G T , p, g, g, e), or just in a simple group G, we can make assumptions that will help in the establishment of the security proofs of the cryptographic schemes.

The most famous one is the Discrete Logarithm (DL) Assumption:

Definition 1 -Discrete Logarithm (DL) Assumption In a group G of prime order p, it states that for any generator g, given y = g x , it is computationally hard to recover x.

There exists a variant of the DL assumption when having two groups G 1 , G 2 : Definition 2 -Symmetric External Discrete Logarithm (SEDL) Assumption In groups G 1 and G 2 of prime order p, it states that for any generators g and g of G 1 and G 2 respectively, given f = g x and f = g x , it is computationally hard to recover x.

The second most famous assumption is the Decisional Diffie-Hellman (DDH) assumption: Definition 3 -Decisional Diffie-Hellman (DDH) Assumption In a group G of prime order p, it states that for any generator g, the two following distributions are computationally indistinguishable:

D dh (g) = {(g, g x , h, h x ); h $ ← G, x, $ ← Z p } D 4 $ (g) = {(g, g x , h, h y ); h $ ← G, x, y, $ ← Z p }.
More precisely, the advantage Adv ddh G (A) of an adversary A against the Decisional Diffie-Hellman (DDH) problem in G is defined by:

Pr A(g, g x , g y , g xy ) = 1|x, y $ ← Z p -Pr A(g, g x , g y , g z ) = 1|x, y, z $ ← Z p .
The DDH problem in G is said (t, ε)-hard if for any advantage A running within time t, its advantage Adv ddh G (A) is bounded by ε. We also denote by Adv ddh G (t) the best advantage any adversary can get within time t.

It is well-known, using an hybrid argument, or the random-self-reducibility, that the DDH assumption implies the Decisional Multi Diffie-Hellman (DMDH) assumption: Definition 4 -Decisional Multi Diffie-Hellman (DMDH) Assumption In a group G of prime order p, it states that for any generator g and for any constant n ∈ N, the two following distributions are computationally indistinguishable:

D n mdh (g) = {(g, (g x i ) i , h, (h x i ) i ); h $ ← G, (x i ) i $ ← Z n p } D 2n+2 $ (g) = {(g, (g x i ) i , h, (h y i ) i ); h $ ← G, (x i ) i , (y i ) i $ ← Z n p }.

Cryptographic Primitives

In this section we introduce the homomorphic blocks at the core of this thesis. Each time the primitive will be presented in its simplest form with its corresponding security definition and, after that, homomorphic properties will be utilized to enhance it. Hence, the notations will be fixed and already existing constructions given.

The first part focuses on the definition of an encryption scheme then, the second one describes a signature scheme and the last one concerns zero-knowledge proofs.

(Homomorphic) Encryption

We begin with the most famous crytographic primitive: encryption. In this thesis we only use Public-Key Encryption schemes:

Definition 5 -Public-Key Encryption Scheme A public-key encryption scheme consists of the following algorithms: A user with the pair (sk, pk) of secret-public keys can publish pk to everyone likely to send him a message. However, sk needs to be stored in a safe place.

A public-key encryption scheme if said correct is for all message m and (sk, pk) ← EKeygen(κ),

Decrypt(sk, Encrypt(pk, m)) = m.
Example 6 (El Gamal Cryptosystem). To illustrate, the El Gamal encryption scheme (1984) is composed of the three algorithms (EKeygen, Encrypt, Decrypt) defined on a cyclic group G = g of prime order p with:

El Gamal Encryption Scheme [ElG84] EKeygen(κ): Given a security parameter κ, it chooses x $ ← Z p and outputs the public key pk = g -x and the private key sk = x.

Encrypt(pk, m):

To encrypt a message M ∈ G using public key pk, it chooses r $ ← Z p and outputs the ciphertext

C = (M • pk r , g r ) ∈ G 2 . Decrypt(sk, C): Given C = (c 1 , c 2 ) and the private key sk, it computes c 1 • c sk 2 .
The scheme is correct as

c 1 • c sk 2 = M • pk r • (g r ) sk = M • g -skr+rsk = M .
Security. The security of a public encryption scheme can be defined by different levels (from the weakest to the strongest):

IND-CPA: the older is the semantic security, a.k.a. Indistinguishability Under Chosen-Plaintext Attacks. Informally, it means that an attacker can not find which message is encrypted after receiving a ciphertext of one of the two messages of its choice;

IND-CCA: the Indistinguishability Under adaptive Chosen-Ciphertext Attacks is similar to the previous scenario except that the attacker has access to an oracle answering the decryption of encrypted messages. The only restriction is that the attacker can not request the decryption of the challenge ciphertext.

IND-CCA ⇒ IND-CPA

Let us now formally define the semantic security for a public-key encryption scheme. The attack is done in two steps, and so the adversary outputs a state s to resume the process in the second step: Definition 7 -IND-CPA Let E = (EKeygen, Encrypt, Decrypt) be an encryption scheme.

Let us denote Exp ind-cpa-b E (A) the experiment defined by:

Exp ind-cpa-b E (A): (sk, pk) ← EKeygen(κ) (s, m 0 , m 1 ) ← A(pk) C ← Encrypt(pk, m b ) b ← A(s, C) return b
The advantage Adv ind-cpa E (A) of an adversary A against indistinguishability under chosen plaintext attacks

(IND-CPA) is Pr[Exp ind-cpa-1 E (A) = 1] -Pr[Exp ind-cpa-0 E (A) = 1].
An encryption scheme E is said (t, ε) -IND-CPA if for any adversary A running within time t, its advantage Adv ind-cpa E (A) is bounded by ε and we denote by Adv ind-cpa E (t) the best advantage any adversary A can get within time t.

For example, the El Gamal cryptosystem is IND-CPA secure under the DDH assumption.

Homomorphic Encryption Scheme

An encryption scheme is said partially homomorphic or homomorphic within a group (G, ) if one can define an additional algorithm taking as input two ciphertexts C on implicit message m and C on implicit message m and producing a ciphertext C on the message m m . For a multiplicative group (G, •), this algorithm is usually denoted Multiply(C, C ) whereas for an additive group (G, +), it is denoted Add(C, C ).

If the scheme is at the same time additively (meaning having an Add algorithm as defined above) and multiplicatively (meaning having an Multiply algorithm as defined above) homomorphic then, one can evaluate any function on ciphertexts and the scheme is said fully homomorphic.

Example 8 (El Gamal Cryptosystem). The El Gamal encryption scheme as presented in Example 6 is homomorphic in (G, •) as one can define an algorithm Multiply:

Multiply(C, C ): Given two El Gamal ciphertexts C = (c 1 , c 2 ) and C = (c 1 , c 2 ), it outputs C = (c 1 • c 1 , c 2 • c 2 ).
This works as:

C = ((M • pk r ) • (M • pk r ), g r • g r ) = ((M • M ) • pk r+r , g r+r ) = Encrypt(pk, M • M ).
However, by changing the message space from G to Z p and by defining the encryption of m ∈ Z p by Encrypt(pk, m) = (g m • pk r , g r ). The scheme becomes homomorphic in (Z p , +):

Add(C, C ): Given two El Gamal ciphertexts C = (c 1 , c 2 ) and C = (c 1 , c 2 ), it outputs C = (c 1 • c 1 , c 2 • c 2 ).
We will often use this El Gamal version in this manuscript.

Security. An homomorphic encryption scheme can be IND-CPA secure however, IND-CCA2 can not be achieved. Indeed, the attacker chooses two messages m 0 , m 1 and sends them to the challenger, the challenger chooses Freeman Cryptosystem.

To evaluate 2-DNF formulae on encrypted data, Boneh-Goh-Nissim described a cryptosystem [START_REF] Boneh | Evaluating 2-DNF formulas on ciphertexts[END_REF] in 2005 that supports additions, one multiplication layer, and additions again. They used a bilinear map on a composite-order group and the secret key is the factorization of the order of the group. Unfortunately, composite-order groups require huge orders, since the factorization must be difficult, with costly pairing evaluations.

In order to improve the efficiency on this cryptosystem, Freeman in [START_REF] Mandell | Converting pairing-based cryptosystems from compositeorder groups to prime-order groups[END_REF] proposed a system on prime-order groups, using a similar property of noise that can be removed, with the general definition of subgroup decision problem:

Freeman's Cryptosystem [START_REF] Mandell | Converting pairing-based cryptosystems from compositeorder groups to prime-order groups[END_REF] EKeygen(κ): Given a security parameter κ, it generates (G, H, G T , p, g, h, e) ← G(κ), two subgroups G 1 ⊂ G, H 1 ⊂ H and three homomorphisms π 1 , π 2 , π T such that G 1 , H 1 are contained in the kernels of π 1 , π 2 respectively and e(π 1 (g), π 2 (h)) = π T (e(g, h)).

Finally, it outputs the public key pk = (G, G 1 , H, H 1 , G T , e, g, h) and the private key sk = (π 1 , π 2 , π T );

Encrypt(pk, m): To encrypt a message m using public key pk, one picks g

1 $ ← G 1 and h 1 $ ← H 1 ,

and outputs the ciphertext (C

A , C B ) = (g m • g 1 , h m • h 1 ) ∈ G × H; Decrypt(sk, C): Given C ∈ G (resp. ∈ H or ∈ G T ), it outputs m ← log π 1 (g) (π 1 (C)) (resp. log π 2 (h) (π 2 (C)) or log π T (e(g,h)) (π T (C))).
Freeman's scheme also has homomorphic properties:

Add(C, C ): Given two ciphertexts C and C of G (resp. of H or of G T ), it chooses g 1 ∈ G 1 and h 1 ∈ H 1 and outputs the ciphertext C = C • C • g 1 (resp. C = C • C • h 1 or C = C • C • e(g 1 , h) • e(g, h 1 )); Multiply(C, C ): Given a ciphertext C ∈ G and C ∈ H, it outputs the ciphertext C = e(C, C ) • e(g 1 , h) • e(g, h 1 ).
This scheme is secure under the subgroup decision problem which informally means that an attacker can not distinguish elements of the subgroup G 1 ⊂ G from elements of G and as well as elements of the subgroup H 1 ⊂ H from elements of H.

(Homomorphic) Signature

After having described the encryption schemes with their homomorphic variant, we will now present the signature schemes following the same structure. First, we provide the general definition with an example and the security requirement. Then, we extend the signature schemes to their homomorphic version.

In their seminal article [DH76], Diffie and Hellman described a digital signature scheme as a "digital phenomenon with the same properties as a written signature. It must be easy for anyone to recognize the signature as authentic, but impossible for anyone other than the legitimate signer to produce it": Definition 9 -Digital Signature Scheme A signature scheme consists of the following algorithms: SKeygen(κ): Given a security parameter κ, it outputs the (public) verification key vk with the associated (private) signing key sk;

Sign(sk, m): Given a signing key and a message m, it outputs the signature σ;

VerifSign(vk, m, σ): Given a verification key vk, a message m and a signature σ, it outputs 1 if σ is a valid signature relative to vk, and 0 otherwise.

A signature scheme is said correct is for all message m and for all (sk, vk) ← SKeygen(κ), VerifSign(vk, m, Sign(sk, m)) = 1.

Example 10 (Schnorr Signature Scheme). Let G = g be a cyclic group of prime order p and H : {0, 1} * × G → Z p be a hash function. The Schnorr signature scheme (1989) is composed of the three algorithms (SKeygen, Sign, VerifSign) with:

Schnorr Signature Scheme [Sch90] SKeygen(κ): Given a security parameter κ, it outputs the signing key sk = x $ ← Z * p and the verification key vk = g x ; Sign(sk, m): Given a signing key sk and a message m ∈ {0, 1} * , it chooses a $ ← Z p and computes r = g a , c = H(m, r) and s = a + cx mod p. The signature is then σ = (s, c); VerifSign(vk, m, σ): Given a verification key vk, a message m and a signature σ = (s, c), it computes r = g s • vk -c and outputs 1 if c = H(m, r), and 0 otherwise.

The scheme is correct as

H(m, r) = H(m, g s • vk -c ) = H(m, g s-xc ) = H(m, g a ).
Security. The security of a signature scheme was defined for the first time by Goldwasser et al. [START_REF] Goldwasser | A digital signature scheme secure against adaptive chosen-message attacks[END_REF] and is called the unforgeability. As for encryption, one can distinguished different levels of attackers (from the weakest scheme to the safest):

EUF: a scheme is said to be Existentially Unforgeable (EUF) if an attacker can not succeed in forging the signature of one message, even not of his choice;

SUF: a scheme is said to be Strong Unforgeable (SUF) if an attacker can not succeed in forging the signature of one message, even not of his choice;

Let us now formally define the universal unforgeability for a signature scheme:

Definition 11 -EUF-CMA Let Σ = (SKeygen, Sign, VerifSign) be a signature scheme and A an attacker against it having access to the signing oracle Sign(sk, •). Let us denote Exp euf-cma (1 κ ) the experiment defined by:

Exp euf-cma (1 κ ): (sk, vk) ← SKeygen(κ) (m * , σ * ) ← A Sign(sk,•) (vk) return m * "new" ∧ VerifSign(vk, m * , σ * )
The advantage Adv euf-cma (A) of an adversary A against existential unforgeability under chosen-message attacks is

Adv euf-cma (A) = | Pr[Exp euf-cma (1 κ ) = 1]|.
A signature scheme Σ is said t-EUF-CMA secure if for any adversary A running in time t polynomial in κ and making a number of signing queries also polynomial in κ, its advantage Adv euf-cma E(A) is negligible.

By replacing m * "new" by (m * , σ * ) "new" in the definition above, we obtain the formal definition of the Strong Unforgeability.

Homomorphic Signature Schemes

In this part, we will provide the informal notions of the homomorphic signature schemes as a more detailed presentation of the specific linearly homomorphic signatures will be done in the Chapter 4. The concept dates back to Desmedt [START_REF] Desmedt | Computer security by redefining what a computer is[END_REF] in 1993.

Similarly to encryption, a signature scheme is said homomorphic in (G, •) if one can define an additional algorithm: MultiplySign(vk, (ω i , m i , σ i ) i=1 ): Given a public key vk and tuples of weights ω i and signed messages m i in σ i , it outputs a signature σ on the message m = i=1 m ω i i .

Example 12 (Libert et al. [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF] Signature Scheme). In their article, Libert et al. [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF] introduce a new signature scheme proven in the standard model with messages in M ∈ G n , for a cyclic group (G, ×) of prime order p and some n ∈ poly(κ):

One-Time Linearly Homomorphic Signature Scheme [LPJY13] SKeygen(κ, n): Given a security parameter κ and the dimension n, it generates (G, G T , p, g, e) ← G(κ) a symmetric bilinear setting of prime order p. Then, it choses generators h, g z , g r , h z

$ ← G. For i = 1 to n, it picks χ i , γ i , δ i $ ← Z p and computes g i = g χ i z g γ i r , h i = h χ i z h δ i . The signing key is sk = {χ i , γ i , δ i } n i=1 and the verification key is vk = (g z , h r , h z , h, {g i , h i } n i=1 );
Sign(sk, M ): Given a signing key sk = {χ i , γ i , δ i } n i=1 and a vector-message M = (M i ) i ∈

G n , it outputs the signature σ = (z, r, u) with

z = n i=1 M -χ i i , r = n i=1 M -γ i i , u = n i=1 M -δ i i ;
VerifSign(vk, M , σ): Given a verification key vk, a vector-message M = (M i ) i and a signature σ, it outputs 1 if M = 1 G n T and σ = (z, r, u) satisfies

1 G T = e(g z , z) • e(g r , r) • n i=1 e(g i , M i ), 1 G T = e(h z , z) • e(h, u) • n i=1 e(h i , M i ).
Their scheme was inspired by the one-time structure-preserving signature of Abe et al.[AFG + 10] and is multiplicatively homomorphic as one can define a MultiplySign algorithm:

MultiplySign(vk, (ω i , M i , σ i ) i=1 ): Given a public key vk and tuples of weights ω i ∈ Z p and signed messages M i in σ i = (z i , r i , u i ), it outputs the signature σ = (z, r, u) with:

z = i=1 z ω i i , r = i=1 r ω i i , u = i=1 u ω i i ;
The output of this algorithm is a valid signature on the vector M = i=1 M ω i i . In fact, as for El Gamal, the signature scheme can be seen as a linearly homomorphic one as the message can be m = (m 1 , . . . , m n ) ∈ Z n p such that M = (g m 1 , . . . , g mn ).

Security. Similarly to homomorphic encryption, the security of homomorphic signatures needs to be specified. Indeed, if one can evaluate any function of previously seen signatures of messages, an attacker can forged any message of his choice. Informally, the security will require that an attacker can not forge a message outside an authorized space. For example, the Libert et al. scheme defined above considers that a signature σ = σ α 1 • σ β 2 is not a forgery if the attacker previously asked for the signatures σ 1 and σ 2 . The attacker needs to provide a signature outside any linear combination of previously asked signatures.

Aggregate Signature Schemes

In 2001, Boneh, Lynn and Shacham propose a new signature scheme [START_REF] Boneh | Short signatures from the Weil pairing[END_REF] that was extended firstly in 2007 by Bellare, Namprempre and Neven [START_REF] Bellare | Unrestricted aggregate signatures[END_REF] and then, in 2018 by Boneh, Drijvers and Neven [START_REF] Boneh | Compact multi-signatures for smaller blockchains[END_REF]. These extensions allow aggregation of multiple messages signed by multiple users. Hence, their signature is constant-size. Moreover, the verification is also constant-time when the same message is signed by all the users (multi-signature). Since this is the most interesting case for us, we focus on it.

BLS Aggregate Signature Scheme

Let G = g be a cyclic group of prime order p and H : {0, 1} * → G * be a full-domain hash function. The BLS signature scheme is composed of the three algorithms (SKeygen, Sign, VerifSign) with:

Boneh-Lynn-Shacham Signature Scheme [START_REF] Boneh | Short signatures from the Weil pairing[END_REF] SKeygen(κ): Given a security parameter κ, it chooses sk $ ← Z p and outputs (sk, vk = g sk );

Sign(sk, m): Given a signing key sk and a message m ∈ {0, 1} * , it outputs the signature σ = H(m) sk ;

VerifSign(vk, m, σ): Given a verification key vk, a message m and a signature σ, it outputs 1 if and only if (g, vk, H(m), σ) is a Diffie-Hellman tuple.

Given N tuples (vk i , σ i , m i ), it is possible to aggregate the signatures into a unique one σ = σ i . To verify σ, one needs to check that:

e(g, σ) = i e(vk i , H(m i )).
However, this scheme is sensitive to the rogue public-key attack if all the message m i are the same. In 2018, Boneh, Drijvers and Neven proposed a scheme to solve this issue.

BDN Multi-Signature Scheme

Let MSparam = (G 1 , G 2 , G T , p, g, g, e) ← G(κ) be an asymmetric pairing setting and let H 0 : {0, 1} * → G 1 and H 1 : {0, 1} * → Z p be two full-domain hash functions. Since the aggregated verification key can be precomputed, verification just consists of two pairing evaluations.

(Homomorphic) Proof

A zero-knowledge proof (ZK) [START_REF] Goldwasser | The knowledge complexity of interactive proof-systems (extended abstract)[END_REF] is a protocol between two players: a Prover and a Verifier where the prover needs to convince the verifier of a given statement without revealing any other information that the truth of this statement. The prover knowing a witness w and a statement s provides a proof π that the verifier, given the statement s, accepts or rejects.

Informally, a zero-knowledge proof must satisfy the three properties:

Completeness: if the prover and the verifier follow the protocol, the verifier always accepts;

Soundness: a false proof is rejected with a probability of at least 1/2; Zero-knowledge: whatever the verifier learns, he could have learned by himself without any interaction with the prover.

Moreover, the zero-knowledge proof is said non-interactive (NIZK) if the prover simply sends a proof π and, later, the verifier can verify π without any more information from the prover.

To achieve that, the classical method uses commitment schemes: the prover first commits some random values and receives a challenge from the verifier, then the prover sends his response.

A commitment scheme ensures that a user committing a value m such that Com = Commit(m) reveals no information about m (hiding property) but prevents the user from modifying m later: there is only one way to open the commitment (binding property).

In particular, a commitment scheme is said perfectly hiding (resp. perfectly blinding) if the hiding property (resp. blinding property) is true independently of the power of the attacker and computationally if it relies on a computational assumption.

Example 13. To prove (g, h, A = g x , B = h x ) is a Diffie-Hellman tuple with a Schnorr-like zero-knowledge proof, the prover first chooses r $ ← Z p and sends the commitments U = g r and V = h r to the verifier that answers a challenge c ∈ Z p . The prover constructs its response s = r -x • c mod p and the verifier checks whether both U = g s • A c and V = h s • B c hold.

To make the proof non-interactive, one can use the Fiat-Shamir heuristic with c generated by a hash function on the statement (g, h, A, B) and commitment (U, V ). The proof eventually consists of (c, s). From this proof, one can compute the candidates for (U, V ), and check whether the hash value gives back c.

Groth-Sahai Proofs

Let (G 1 , G 2 , G T , p, g, g, e) ← G(κ) be an asymmetric pairing setting. We recall the Groth-Sahai methodology [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF] to prove a Diffie-Hellman tuple in G 2 (because it will be used in G 2 later). As the Groth-Sahai proofs are randomizable [BCC + 09], we will also present how to randomize a Diffie-Hellman proof of (g, g , A, A ) and how to update it into a new one for (g, g , A, A ).

First, we set a tuple (v

1,1 , v 1,2 , v 2,1 , v 2,2 ) ∈ G 4 1 , such that (v 1,1 , v 1,2 , v 2,1 , g × v 2,2
) is not a Diffie-Hellman tuple. Then, given a Diffie-Hellman tuple (g, g , A, A ) in G 2 , knowing the witness α ∈ Z p such that A = g α and A = g α , one first commits α:

Com = (c = v α 2,1 • v µ 1,1 , d = v α 2,2 • g α • v µ 1,2 )
for a random µ $ ← Z p , and one sets Θ = g µ and Ψ = A µ , which satisfy:

e(c, g) = e(v 2,1 , g ) • e(v 1,1 , Θ) e(d, g) = e(v 2,2 • g, g ) • e(v 1,2 , Θ) e(c, A) = e(v 2,1 , A ) • e(v 1,1 , Ψ ) e(d, A) = e(v 2,2 • g, A ) • e(v 1,2 , Ψ )
The proof proof = (Com, Θ, Ψ ), when it satisfies the above relations, guarantees that (g, g , A, A ) is a Diffie-Hellman tuple.

Security. This proof is zero-knowledge, under the DDH assumption in G 1 : by switching

(v 1,1 , v 1,2 , v 2,1 , g × v 2,2
) into a Diffie-Hellman tuple, one can simulate the proof, as the commitment becomes perfectly hiding.

Efficiency. To verify the proof, instead of checking the four equations independently, one can apply a batch verification [BFI + 10], and pack them in a unique one with random scalars

x 1,1 , x 1,2 , x 2,1 , x 2,2 $ ← Z p : e(c x 1,1 d x 1,2 , g x 2,1 A x 2,2 ) = e(v x 1,1 2,1 (v 2,2 • g) x 1,2 , g x 2,1 A x 2,2 ) × e(v x 1,1 1,1 v x 1,2 1,2 , Θ x 2,1 Ψ x 2,2 )
One thus just has 3 pairing evaluations.

Updating the Diffie-Hellman proof. The interesting property of Groth-Sahai proofs is that it is possible from a Diffie-Hellman proof for (g, g , A, A ) to generate the Diffie-Hellman proof for (g, g = g α , A, A = A α ) just knowing the incremental witness α , whereas the new witness shoud be αα , but is unknown to the prover: from the Diffie-Hellman proof proof = (Com, Θ, Ψ ) for (g, g , A, A ) where

Com = (c = v α 2,1 v µ 1,1 , d = v α 2,2 v µ 1,2 g α ) Θ = g µ Ψ = A µ
one can compute the proof proof for (g, g = g α , A, A = A α ), with µ $ ← Z p and:

Com = (c α • v µ 1,1 , d α • v µ 1,2 ) Θ = Θ α • g µ Ψ = Ψ α • A µ
One implicitly updates α into αα and µ into α µ + µ . In particular, one can remark that if α = 1, this simply randomizes the original proof.

Chapter

Decentralized Evaluation of Quadratic Polynomials on Encrypted Data

This chapter is based on the paper [START_REF] Hébant | Decentralized evaluation of quadratic polynomials on encrypted data[END_REF] published in the proceedings of the International Conference on Information Security, ISC 2019. In 2005, Boneh, Goh and Nissim [START_REF] Boneh | Evaluating 2-DNF formulas on ciphertexts[END_REF] proposed a nice solution for quadratic polynomials evaluation. However, their solution relies on a composite-order elliptic curve and thus on the hardness of the integer factoring. This possibly leads to a distributed solution, but that is highly inefficient. Indeed, no efficient multi-party generation of distributed RSA modulus is known, except for 2 parties. Catalano and Fiore [START_REF] Catalano | Using linearly-homomorphic encryption to evaluate degree-2 functions on encrypted data[END_REF] introduced an efficient technique to transform a linearly-homomorphic encryption into a scheme able to evaluate quadratic operations on ciphertexts. They are able to support decryption of a large plaintext space after the multiplication. However, as in Kawai et al. [KMH + 19] which used this technique to perform proxy re-encryption, they only consider a subclass of degree-2 polynomials where the number of additions of degree-2 terms is bounded by a constant. This is not enough for most of the applications and we do not try to decentralize these limited protocols.

Chapter content

In 2010, Freeman [START_REF] Mandell | Converting pairing-based cryptosystems from compositeorder groups to prime-order groups[END_REF] proposed a conversion from composite-order groups to prime-order groups for the purpose of improving the efficiency. In Section 3.1, we show Freeman's conversion allows multi-user setting, since a common setup can handle several keys and we show it is well-suited for distributed evaluation of 2-DNF formulae. However, it is not enough to have an efficient distributed setup. One also needs to distribute any use of the private keys in the construction: for decryption and re-encryption. Unfortunately, Freeman's generic description with projection matrices does not directly allow the design of a decentralized scheme, i.e., with efficient distributed (threshold) decryption without any trusted dealer. We thus specify in Section 3.2 particular projections, with well-chosen private and public keys. Finally, in Section 3.3, we propose two more applications that are related to the group testing and the consistency model in machine learning.

Related Work. In a previous and independent work, Attrapadung et al. [AHM + 18] proposed an efficient two-level homomorphic encryption in prime-order groups. They put forward a new approach that avoids Freeman's transformation from BGN encryption. Interestingly, our work shows this scheme falls into Freeman's framework because their construction is similar to the simplified non-decentralized version of our scheme which is obtained from BGN via a Freeman transformation with a particular choice of projections. The concrete implementations in [AHM + 18] show that such a scheme is quite efficient, which applies to our construction, and even to the distributed construction as each server, for a partial decryption, essentially has to perform a decryption with its share. In another unpublished work [START_REF] Culnane | Universally verifiable MPC with applications to IRV ballot counting[END_REF], Culnane et al. considered a universally verifiable MPC protocol in which one of the two steps is to distribute the key generation in somewhat homomorphic cryptosystems. However, as we mentioned above, Freeman's generic description with projection matrices, as considered in [START_REF] Culnane | Universally verifiable MPC with applications to IRV ballot counting[END_REF], does not lead to an efficient distributed decryption. In short, our result bridges the gap between the objective of decentralization as in [START_REF] Culnane | Universally verifiable MPC with applications to IRV ballot counting[END_REF] and the efficiency goal as in [AHM + 18].

Freeman's Approach

Notations

In this section, for a generator g of a cyclic group G = g , we use the implicit representation [a] of any element h = g a ∈ G and by extension we will use the "bracket" notations, which makes use of the matrix properties over the exponents defined in Chapter 2, that are scalars in Z p when G is a cyclic group of order p. See Figure 3.1 for more details about the "brackets".

• For x ∈ Z p , A ∈ M m,n (Z p ): [x] = g x , [A] = g A = (g a ij ) ij • For x ∈ Z p , A, B ∈ M m,n (Z p ), X ∈ M n,n (Z p ), Y ∈ M m ,m (Z p ): x • [A] = g xA [A] • X = g AX Y • [A] = g YA [A] [B] = [A + B] • For A ∈ M m,n (Z p ), B ∈ M m ,n (Z p ): [A] 1 • [B] 2 = [A ⊗ B] T Figure 3.1: Bracket Notations
In case of bilinear groups, we also define, for

A ∈ M m,n (Z p ) and B ∈ M m ,n (Z p ), [A] 1 • [B] 2 = [A ⊗ B] T ,
which can be evaluated with pairing operations between G 1 and G 2 group elements.

Freeman's Scheme with Projections

The main goal of Freeman's approach was to generalize the BGN cryptosystem to any hardsubgroup problems, which allows applications to prime-order groups under the classical Decisional Diffie-Hellman or Decisional Linear assumptions, with high gain in efficiency.

We now present a variant of Freeman's cryptosystem allowing multiple users, without the twin ciphertexts (in G and H). Since we will work in groups G 1 , G 2 , and G T , the algorithms EKeygen, Encrypt and Decrypt will take a sub-script s to precise the group G s in which they operate, but the Setup is common.

Multi-User Freeman's Cryptosystem Setup(κ): Given a security parameter κ, it runs and outputs param

= (G 1 , G 2 , G T , p, g 1 , g 2 , e) ← G(κ). EKeygen s (param): For s ∈ {1, 2}, it chooses B s $ ← GL 2 (Z p ), let P s = B -1
s U 2 B s and p s ∈ ker(P s ) \ {0}, and outputs the public key pk s = [p s ] s and the private key sk s = P s .

From (pk 1 , sk 1 ) ← EKeygen 1 (param) and (pk 2 , sk 2 ) ← EKeygen 2 (param), one can consider pk T = (pk 1 , pk 2 ) and sk T = (sk 1 , sk 2 ), which are associated public and private keys in G T , as we explain below.

Encrypt s (pk s , m, A s ): For s ∈ {1, 2}, to encrypt a message m ∈ Z p using public key pk s and

A s = [a] s ∈ G 2 s , it chooses r $ ← Z p and outputs the ciphertext C s = (m • [a] s r • [p s ] s , [a] s ) ∈ G 2 s × G 2 s . For s = T , with A s = ([a 1 ] 1 , [a 2 ] 2 ), it sets [a] T = [a 1 ] 1 • [a 2 ] 2 ∈ G 4 T , chooses [r 1 ] 1 $ ← G 2 1 , [r 2 ] 2 $ ← G 2 2 , and outputs C T = (m•[a] T [p 1 ] 1 •[r 2 ] 2 [r 1 ] 1 •[p 2 ] 2 , [a] T ) ∈ G 4 T ×G 4 T . Decrypt s (sk s , C s ): For s ∈ {1, 2}, given C s = ([c s,1 ] s , [c s,2 ] s ) and sk s = P s , it lets C s = ([c s,1 ] s • P s , [c s,2 ] s • P s ). For s = T , it computes C T = ([c T,1 ] T • (P 1 ⊗ P 2 ), [c T,2 ] T • (P 1 ⊗ P 2 )).
In both cases, it outputs the logarithm of the first component of c s,1 in base the first component of c s,2 .

With the algorithms defined above, we have three encryption schemes E s : (Setup, EKeygen s , Encrypt s , Decrypt s ) for s = 1, 2 or T , with a common Setup.

Remark. We note that in Freeman's cryptosystem, ciphertexts contain encryptions of m in both G 1 and G 2 to allow any kind of additions and multiplication. But one could focus on one ciphertext only when the formula to be evaluated is known.

Proposition 14. For s ∈ {1, 2, T }, E s is correct. Proof. For s = 1, 2: [c s,2 ] s • P s = [a] s • P s = [aP s ] s [c s,1 ] s • P s = (m • [a] s r • [p s ] s ) • P s = m • [a] s • P s r • [p s ] s • P s = m • [aP s ] s r • [p s P s ] s = m • [aP s ] s r • [0] s = m • [aP s ] s For s = T : [c T,2 ] T • (P 1 ⊗ P 2 ) = [a] T • (P 1 ⊗ P 2 ) = [a(P 1 ⊗ P 2 )] T [c T,1 ] T • (P 1 ⊗ P 2 ) = (m • [a] T [p 1 ] 1 • [r 2 ] 2 [r 1 ] 1 • [p 2 ] 2 ) • (P 1 ⊗ P 2 ) = m • [a(P 1 ⊗ P 2 )] T ([p 1 ] 1 • [r 2 ] 2 ) • (P 1 ⊗ P 2 ) ([r 1 ] 1 • [p 2 ] 2 ) • (P 1 ⊗ P 2 ) = m • [a(P 1 ⊗ P 2 )] T [p 1 ⊗ r 2 ] T • (P 1 ⊗ P 2 ) [r 1 ⊗ p 2 ] T • (P 1 ⊗ P 2 ) = m • [a(P 1 ⊗ P 2 )] T [p 1 P 1 ⊗ r 2 P 2 ] T [r 1 P 1 ⊗ p 2 P 2 ] T = m • [a(P 1 ⊗ P 2 )] T [0 ⊗ r 2 P 2 ] T [r 1 P 1 ⊗ 0] T = m • [a(P 1 ⊗ P 2 )] T In both cases, C s,1 = [c s,1 ] s = m • [c s,2 ] s = m • C s,2
. Whatever the size of the vectors, one discrete logarithm computation is enough to extract m.

As already explained above, the encryption process masks the message by an element in the kernel of a certain projection. The secret key is the corresponding projection P s which later removes this mask. In the Decrypt algorithm, C s is a Diffie-Hellman tuple (whatever the group under consideration), the discrete logarithm of one component is enough to decrypt, since the plaintext is the common exponent.

One can note that matrices B 1 and B 2 are drawn independently, so the keys in G 1 and G 2 are independent. For any pair of keys (pk

1 = [p 1 ] 1 , pk 2 = [p 2 ]
2 ), one can implicitly define a public key for the target group. To decrypt in the target group, both private keys sk 1 = P 1 and sk 2 = P 2 are needed. Actually, one just needs P 1 ⊗ P 2 to decrypt:

C T = ([c T,1 ] T • (P 1 ⊗ P 2 ), [c T,2 ] T • (P 1 ⊗ P 2 )
), but P 1 ⊗ P 2 and (P 1 , P 2 ) contain the same information and the latter is more compact.

Homomorphic Properties

As BGN, Freeman cryptosystem also allows additions, one multiplication layer, and additions: we detail the homomorphic functions below.

Add(C s , C s ): Given two ciphertexts C s = ([c s,1 ] s , [c s,2 ] s ), C = ([c s,1 ] s , [c s,2 ] s ) in one of G 2 1 × G 2 1 , G 2 2 × G 2 2 , G 4 T × G 4 T , if [c s,2 ] s = [c s,2 ] s , it outputs ([c s,1 ] s [c s,1 ] s , [c s,2 ] s ), otherwise it outputs ⊥. Multiply(C 1 , C 2 ): Given two ciphertexts C 1 = ([c 1,1 ] 1 , [c 1,2 ] 1 ) ∈ G 2 1 × G 2 1 and C 2 = ([c 2,1 ] 2 , [c 2,2 ] 2 ) ∈ G 2 2 × G 2 2 , it outputs C T = ([c 1,1 ] 1 • [c 2,1 ] 2 , [c 1,2 ] 1 • [c 2,2 ] 2 ) ∈ G 4 T × G 4 T . Randomize s (pk s , C s ): Given a ciphertext C s = ([c s,1 ] s , [c s,2 ] s ), for s ∈ {1, 2} and a public key pk s = [p s ] s , it chooses α, r $ ← Z p and outputs (α • ([c s,1 ] s r • [p s ] s ), α • [c s,2 ] s ); while for s = T and a public key pk T = ([p 1 ] 1 , [p 2 ] 2 ), it chooses α $ ← Z p , [r 1 ] 1 $ ← G 2 1 and [r 2 ] 2 $ ← G 2 2 , and outputs (α • ([c T,1 ] T [p 1 ] 1 • [r 2 ] 2 [r 1 ] 1 • [p 2 ] 2 ), α • [c T,2 ] T ).
Instead of performing a systematic randomization of ciphertexts as proposed by Freeman each time an Add or a Multiply is computed, we create a specific function Randomize usable at any time, when more privacy is required.

Let us check the correctness of the three homomorphic functions:

Proposition 15. Add and Multiply are correct.

Proof. Let us first consider the addition operations:

• For s = 1, 2:

Add(Encrypt s (pk s , m, [a] s ; r), Encrypt s (pk s , m , [a] s ; r )) = ([ma + rp s ] s • [m a + r p s ] s , [a] s ) = ([(m + m )a + (r + r )p s ] s , [a] s ) = Encrypt s (pk s , m + m , [a] s ; r + r )
• For s = T :

Add(Encrypt T (pk T , m, ([a 1 ] 1 , [a 2 ] 2 ); r 1 , r 2 ), Encrypt T (pk T , m , ([a 1 ] 1 , [a 2 ] 2 ); r 1 , r 2 )) = ([m([a 1 ] 1 • [a 2 ] 2 ) + r 1 ⊗ p 2 + p 1 ⊗ r 2 ] T • [m ([a 1 ] 1 • [a 2 ] 2 ) + r 1 ⊗ p 2 + p 1 ⊗ r 2 ] T , [a 1 ] 1 • [a 2 ] 2 ) = ([(m + m )([a 1 ] 1 • [a 2 ] 2 ) + (r 1 + r 1 ) ⊗ p 2 + p 1 ⊗ (r 2 + r 2 )] T , [a 1 ] 1 • [a 2 ] 2 ) = Encrypt T (pk T , m + m , ([a 1 ] 1 , [a 2 ] 2 ); r 1 + r 1 , r 2 + r 2 )
About multiplication, we can see that

Multiply(Encrypt 1 (pk 1 , m 1 , [a 1 ] 1 ; r 1 ), Encrypt 2 (pk 2 , m 2 , [a 2 ] 2 ; r 2 )) = ([m 1 a 1 + r 1 p 1 ] 1 • [m 2 a 2 + r 2 p 2 ] 2 , [a 1 ] 1 • [a 2 ] 2 ) = ([(m 1 a 1 + r 1 p 1 ) ⊗ (m 2 a 2 + r 2 p 2 )] T , [a 1 ] 1 • [a 2 ] 2 ) = ([m 1 a 1 ⊗ m 2 a 2 + m 1 a 1 ⊗ r 2 p 2 + r 1 p 1 ⊗ m 2 a 2 + r 1 p 1 ⊗ r 2 p 2 ] T , [a 1 ] 1 • [a 2 ] 2 ) = ([m 1 a 1 ⊗ m 2 a 2 + m 1 a 1 ⊗ r 2 p 2 + r 1 p 1 ⊗ (m 2 a 2 + r 2 p 2 )] T , [a 1 ] 1 • [a 2 ] 2 ) = ([m 1 m 2 (a 1 ⊗ a 2 ) + p 1 ⊗ (r 1 m 2 a 2 + r 1 r 2 p 2 ) + (r 2 m 1 a 1 ) ⊗ p 2 ] T , [a 1 ] 1 • [a 2 ] 2 ) = Encrypt T (pk T , m 1 m 2 , ([a 1 ] 1 , [a 2 ] 2 ); m 1 r 2 a 1 , m 2 r 1 a 2 + r 1 r 2 p 2 ) Proposition 16. For s ∈ {1, 2, T }, Randomize s is correct, with α = 1. Proof. For s ∈ {1, 2}: Randomize s (pk s , Encrypt s (pk s , m, [a] s ; r), α, r ) = ([α(ma + rp s + r p s )] s , [αa] s ) = ([m(αa) + α(r + r )p s ] s , [αa] s ) = Encrypt s (pk s , m, [αa] s ; α(r + r ))
Since r is uniformly distributed, the mask of the first component of the ciphertext is uniformly distributed, as in a fresh ciphertext, while with α = 1, the basis in the second component remains unchanged. In addition, the random α also randomizes the basis [αa] s , in the second component of the ciphertext, but computationally only, under the DDH assumption in G s .

For s = T :

Randomize T (pk T , Encrypt T (pk T , m, ([a 1 ] 1 , [a 2 ] 2 ); r), α, r 1 , r 2 ) = (α • (m • [a] T [p 1 ] 1 • [r 2 ] 2 [r 1 ] 1 • [p 2 ] 2 [p 1 ] 1 • [r 2 ] 2 [r 1 ] 1 • [p 2 ] 2 , [a] T ), ([αa 1 ] 1 , [αa 2 ] 2 )) = (α • (m • [a] T [p 1 ] 1 • [r 2 + r 2 ] 2 [r 1 + r 1 ] 1 • [p 2 ] 2 ), ([αa 1 ] 1 • [αa 2 ] 2 )) = Encrypt T (pk T , m, ([αa 1 ] 1 , [αa 2 ] 2 ); α(r 2 + r 1 ), α(r 2 + r 2 ))
Again, since r 1 and r 2 are uniformly distributed, the mask of the first component of the ciphertext is uniformly distributed, as in a fresh ciphertext. In addition, the random α randomizes the basis in the second component of the ciphertext, but computationally only, under the DDH assumption in both G 1 and G 2 .

Proof. The semantic security for ciphertexts in G T comes from the fact that:

Encrypt T (pk T , m, ([a 1 ] 1 , [a 2 ] 2 )) = Multiply(Encrypt 1 (pk 1 , m, [a 1 ] 1 ), Encrypt 2 (pk 2 , 1, [a 2 ] 2 )) = Multiply(Encrypt 1 (pk 1 , 1, [a 1 ] 1 ), Encrypt 2 (pk 2 , m, [a 2 ] 2 ))
Indeed, with this relation, each ciphertext in G 1 can be transformed into a ciphertext in G T (idem with a ciphertext in G 2 ). Let A be an adversary against

IND-CPA of E T , in G T .
Game G 0 : In the first game, the simulator plays the role of the challenger in the experiment Exp ind-cpa-0

E T (A)
, where b = 0: S(κ):

• param = (G 1 , G 2 , G T , p, g 1 , g 2 , e) ← Setup(κ) • (sk 1 , pk 1 ) ← EKeygen 1 (param),(sk 2 , pk 2 ) ← EKeygen 2 (param) • m 0 , m 1 , [a] 1 , [a] 2 ← A(param, (pk 1 , pk 2 )) • C T = Encrypt T ((pk 1 , pk 2 ), m 0 , ([a] 1 , [a] 2 )) • β ← A(param, (pk 1 , pk 2 ), C T ) We are interested in the event E: b = 1. By definition, Pr G 0 [E] = Pr Exp ind-cpa-0 E T (A) = 1 .
Game G 1 : The simulator interacts with a challenger in Exp ind-cpa-0 E 1 (A), where b = 0. It thus first receives param, pk 1 from that challenger, generates pk 2 by himself to provide (pk T = (pk 1 , pk 2 )) to the adversary. The latter sends back (m 0 , m 1 , [a] 1 , [a] 2 ), from which it sends (m 0 , m 1 , [a] 1 ) to the challenger. It gets back

C 1 = Encrypt 1 (pk 1 , m 0 , [a] 1 ). It can compute the ciphertext C T = Multiply(C 1 , Encrypt 2 (pk 2 , 1, [a 2 ] 2 ))
, to be sent to the adversary. This game is perfectly indistinguishable from the previous one:

Pr G 1 [E] = Pr G 0 [E].
Game G 2 : The simulator interacts with a challenger in Exp ind-cpa-1

E 1 (A), where b = 1: Pr G 2 [E] -Pr G 1 [E] ≤ Adv ind-cpa E 1 (t + t m + t e ),
where t m is the time for one multiplication and t e the time for one encryption.

Game G 3 : In this final game, the simulator plays the role of the challenger in the experiment

Exp ind-cpa-1

E T (A)
, where b = 1. This game is perfectly indistinguishable from the previous one:

Pr G 3 [E] = Pr G 2 [E]. One can note, that in this last game, Pr G 3 [E] = Pr Exp ind-cpa-1 E T (A) = 1 , hence Pr Exp ind-cpa-1 E T (A) = 1 -Pr Exp ind-cpa-0 E T (A) = 1 ≤ Adv ind-cpa E T (t + t m + t e ),
which concludes the proof, since it works exactly the same way for G 2 .

Re-Encryption

We have three efficient encryption schemes able to compute homomorphic operations and supporting multiple users. When a result should be available to a unique user, a classical technique called proxy re-encryption [START_REF] Blaze | Divertible protocols and atomic proxy cryptography[END_REF] is to re-encrypt to this target user: this is a virtual decryption followed by encryption under the new key. With Freeman's approach, and our formalism, this is just a change of basis in the exponents: we can re-encrypt a message encrypted under a private key pk a into another encryption for a private key pk b by using a special secret key called re-encryption key rk a→b .

Below we describe REKeygen s that creates the re-encryption key from the secret keys and REEncrypt s the function to re-encrypt a ciphertext, but under a different basis.

REKeygen s (sk a s , sk b s ): For s = 1, 2, from two different secret keys sk a s = P s and sk b s = P s associated respectively to the two public keys pk a s and pk b s , compute

B s , B s ∈ GL 2 (Z p ) such that P s = B -1
s UB s and P s = B s -1 UB s and output

rk a→b s = R s = B -1
s B s the secret re-encryption key. From the re-encryption keys

rk a→b 1 = R 1 ← REKeygen 1 (sk a 1 , sk b 1 ) and rk a→b 2 = R 2 ← REKeygen 2 (sk a 2 , sk b 2 ), we will consider rk a→b T = (rk a→b 1 , rk a→b 2 ), as the matrix R T actually is R 1 ⊗ R 2 . REEncrypt s (rk a→b s , C s ): To re-encrypt a ciphertext C = ([c s,1 ] s , [c s,2 ] s ): • for s = 1, 2, output ([c s,1 ] s • rk a→b s , [c s,2 ] s • rk a→b s ); • for s = T , output ([c T,1 ] T • (rk a→b 1 ⊗ rk a→b 2 ), [c T,2 ] T • (rk a→b 1 ⊗ rk a→b 2 )).
We stress that the basis a is modified with the re-encryption process, into aR s or a(R 1 ⊗R 2 ), which could leak some information about the re-encryption key. But as explained above, the randomization process can provide a new ciphertext that computationally hides it, under DDH assumptions. However, this requires this basis a to be part of the ciphertext as it cannot be a constant.

Correctness of Re-Encryption.

The correctness of the re-encryption is based on a change of basis that transforms an element in the kernel of P s in an element in the kernel of P s : let p ∈ ker(P s ) and p ∈ ker(P s ) because ker(P s ) and ker(P s ) are of dimension 1 in

Z 2 p , there exist a, b, k ∈ Z p , such that p = k • (a, b) and a , b , k ∈ Z p , such that p = k • (a , b ). We have: p • rk = p • B -1 B = k(1, 0)B = k(a , b ) ⇒ p • rk = kk -1 p = r p
for some r ∈ Z p and with that, the correctness follows, where

rk a→b s is denoted R s : for s ∈ {1, 2}, REEncrypt s (rk a→b s , Encrypt s (pk a s , m, a, r)) = ([c s,1 ] s • rk a→b s , [c s,2 ] s • rk a→b s ) = ([maR s + rp s R s ] s , [aR s ] s ) = ([maR s + rr p s ] s , [aR s ] s ) = Encrypt s (pk b s , m, aR s ; rr ) For s = T , REEncrypt T (rk a→b T , Encrypt T (pk a T , m, a; r 1 , r 2 )) = ([c T,1 ] T • (rk a→b 1 ⊗ rk a→b 2 ), [c T,2 ] T • (rk a→b 1 ⊗ rk a→b 2 )) = ([(ma + p 1 ⊗ r 2 + r 1 ⊗ p 2 ) • (R 1 ⊗ R 2 )] T , [a • (R 1 ⊗ R 2 )] T ) = ([ma(R 1 ⊗ R 2 ) + p 1 R 1 ⊗ r 2 R 2 + r 1 R 1 ⊗ p 2 R 2 ] T , [a • (R 1 ⊗ R 2 )] T ) = ([ma(R 1 ⊗ R 2 ) + r 1 p 1 ⊗ r 2 R 2 + r 1 R 1 ⊗ r 2 p 2 ] T , [a • (R 1 ⊗ R 2 )] T ) = ([ma(R 1 ⊗ R 2 ) + p 1 ⊗ r 1 r 2 R 2 + r 2 r 1 R 1 ⊗ p 2 ] T , [a • (R 1 ⊗ R 2 )] T ) = Encrypt T (pk b T , m, a(R 1 ⊗ R 2 ); r 2 r 1 R 1 , r 1 r 2 R 2 )

Verifiability

When a ciphertext is randomized or re-encrypted by a third party, one may want to be sure the content is kept unchanged. Verifiability is thus an important property we can efficiently achieve, with classical zero-knowledge proofs of discrete logarithm relations à la Schnorr. Such linear proofs of existence for k scalars that satisfy linear relations generally consist of a commitment c, a challenge e ∈ Z p and the response r ∈ Z k p (see Preliminaries 2.4.3). The non-interactive variant just contains e and r, and thus k + 1 scalars.

Example 19. Let M ∈ M 2 (Z p ) and ([x] s , [y] s ), ([x ] s , [y ] s ) ∈ G 2
s . We will make the zeroknowledge proof of existence of M such that both

[y] s = [x] s • M and [y ] s = [x ] s • M, where [x] s , [y] s , [x ]
s and [y ] s are public, but the prover knows M. This is the classical zero-knowledge proof of equality of discrete logarithms with matrices.

The prover chooses

M $ ← M 2 (Z p ) and sends the commitments [c] s = [x] s • M and [c ] s = [x ] s • M to the verifier that answers a challenge e ∈ Z p . The prover constructs its response R = M -eM in M 2 (Z p ) and the verifier checks whether both [c] s = [x] s • R e[y] s and [c ] s = [x ] s • R e[y ] s , in G 2 s .
To make the proof non-interactive, one can use the Fiat-Shamir heuristic with e generated by a hash function (modeled as a random oracle) on the statement

([x] s , [y] s ), ([x ] s , [y ] s ) and commitments ([c] s , [c ] s ).
The proof eventually consists of (e, R).

From this proof, one can compute the candidates for ([c] s , [c ] s ), and check whether the hash value gives back e.

Before entering into the details of the relations to be proven, for each function of our encryption scheme, we rewrite the EKeygen s and REKeygen s algorithms to prepare the verifiability of Decrypt s and REEncrypt s . These new EKeygen s and REKeygen s algorithms consist of the original EKeygen s and REKeygen s but with more elements in the output: they both output a public version of the produced secret key plus a zero-knowledge proof of the correctness of the keys. This significantly simplifies the relations to be proven afterwards for Decrypt s and REEncrypt s . At the end of this section, we prove that adding those elements do not compromise the security of the encryption scheme.

EKeygen s for Verifiability.

While the secret key is the projection P s , the verification key vsk s consists of [P s ] s :

EKeygen s (param): For s ∈ {1, 2}. It chooses B s $ ← GL 2 (Z p ), lets P s = B -1
s U 2 B s and p s ∈ ker(P s ) \ {0} and outputs the public key pk s = [p s ] s , the private key sk s = P s and vsk s = [P s ] s a verifiable public version of the secret key with the proof π s :

{∃sk s ∈ M 2 (Z p ), vsk s = [0] s ∧ vsk s = [1] s • sk s ∧ pk s • sk s = [0] s }.
The proof π s guarantees that all the keys are well-formed: vsk s is the exponentiation of a 2 × 2-matrix sk s , for which the discrete logarithm of pk s is in the kernel. Hence, sk s is not full rank, and vsk s = [0] s proves that sk s is of dimension 1: a projection. As a consequence, π s consists of 5 scalars of Z p , using the above non-interactive zero-knowledge technique à la Schnorr.

From (vsk 1 , vsk 2 ), we consider

vsk T = vsk 1 •vsk 2 . It satisfies vsk T = [P 1 ⊗P 2 ] T if (vsk 1 , vsk 2 ) = ([P 1 ] 1 , [P 2 ] 2 ).
REKeygen s for Verifiability.

As above, while the secret re-encryption key is an invertible change of basis matrix rk a→b

{∃rk a→b s ∈ M 2 (Z p ),∃λ ∈ Z p , vrk s = [0] s ∧ vrk a→b s = [1] s • rk a→b s ∧ pk b s = pk a s • rk a→b s ∧ [r ] s = λ • [r 12 ] s ∧ [r 21 ] s = λ • [r 11 ] s ∧ [r ] s = [r 22 ] s } It outputs (rk a→b s , vrk a→b s , [r ] s , π a→b s ).
The proof π a→b s guarantees that vrk a→b s is well-formed and, since in M 2 (Z p ), the matrices are 0, or of rank 1 as a projection, or invertible: π a→b s first checks it is not 0, and then not of rank 1 either, as vrk a→b Similarly as for vsk s , from (vrk 1 , vrk 2 ), we consider

vrk T = vrk 1 • vrk 2 . So that, vrk T = [R 1 ⊗ R 2 ] T if (vrk 1 , vrk 2 ) = ([R 1 ] 1 , [R 2 ] 2 ).
Now, we explain for each function, the relations to be proven:

The function Randomize s .

It takes a ciphertext

C s = ([c s,1 ] s , [c s,2
] s ) encrypted with a public key pk s and produces a ciphertext

C s = ([c s,1 ] s , [c s,2
] s ) such that:

• for s ∈ {1, 2} and pk s = [p s ] s , it exists α, r ∈ Z p such that:

[c s,1 ] s = α • ([c s,1 ] s r • [p s ] s ) ∧ [c s,2 ] s = α • [c s,2 ] s • for s = T and pk T = ([p 1 ] 1 , [p 2 ] 2 ), it exists α ∈ Z p , r 1 , r 2 ∈ Z 2 p such that: [c T,1 ] T = α • ([c T,1 ] T [p 1 ] 1 • [r 2 ] 2 [r 1 ] 1 • [p 2 ] 2 ) ∧ [c T,2 ] T = α • [c T,2 ] T
These relations are equivalent to the linear relations:

• for s ∈ {1, 2}, it exists α, r ∈ Z p such that:

[c s,1 ] s = α • [c s,1 ] s r • [p s ] s ∧ [c s,2 ] s = α • [c s,2 ] s • for s = T , it exists α ∈ Z p , r 1 , r 2 ∈ Z 2 p such that: [c T,1 ] T = α • [c T,1 ] T [p 1 ] T • r 2 r 1 • [p 2 ] T ∧ [c T,2 ] T = α • [c T,2 ] T
These proofs consist of 3 scalars of Z p for s ∈ {1, 2}, and 6 scalars of Z p for s = T .

The functions Add and Multiply.

They are public and deterministic thus everyone can check the operations.

The function Decrypt s .

It takes a ciphertext

C s = ([c s,1 ] s , [c s,2 ] s
) encrypted with a public key pk s and produces its decryption m such that:

• for s ∈ {1, 2} and pk s = [p s ] s , it exists sk s = P s ∈ M 2 (Z p ) such that:

[p s ] s • P s = [0] s ∧ P s = 0 ∧ [c s,1 ] s • P s = m • [c s,2 ] s • P s • for s = T and pk T = ([p 1 ] 1 , [p 2 ] 2 ), it exists sk T = (P 1 , P 2 ) ∈ M 2 (Z p ) 2 such that: [p 1 ] 1 • P 1 = [0] 1 ∧ [p 2 ] 2 • P 2 = [0] 2 ∧ P 1 = 0 ∧ P 2 = 0 ∧ [c T,1 ] T • (P 1 ⊗ P 2 ) = m • [c T,2 ] T • (P 1 ⊗ P 2 )
Instead of proving these relations, the prover will use vsk s for s ∈ {1, 2, T } produced by EKeygen s for verifiability and will make the proof of the relations:

• for s ∈ {1, 2}, it exists sk s = P s ∈ M 2 (Z p ) such that:

[vsk s ] s = [1] s • P s ∧ ([c s,1 ] s m • [c s,2 ] s ) • P s = [0] s • for s = T , it exists sk T = (P 1 , P 2 ) ∈ M 2 (Z p ) 2 such that: [vsk T ] T = [1] T • (P 1 ⊗ P 2 ) ∧ ([c T,1 ] T m • [c T,2 ] T ) • (P 1 ⊗ P 2 ) = [0] T
The linear proofs consist of 5 scalars of Z p for s ∈ {1, 2} and 17 scalars of Z p for s = T .

The function REEncrypt s .

It takes a ciphertext

C s = ([c s,1 ] s , [c s,2
] s ) encrypted with a public key pk a s and produces a ciphertext C s = ([c s,1 ] s , [c s,2 ] s ) encrypted with a public key pk b s such that:

• for s ∈ {1, 2}, it knows rk a→b s = R s ∈ GL 2 (Z p ) such that:

([c s,1 ] s , [c s,2 ] s ) = ([c s,1 ] s • R s , [c s,2 ] s • R s ) ∧ pk b s = pk a s • R s • for s = T , pk a T = (pk a 1 , pk a 2 ), pk b T = (pk b 1 , pk b 2 ) and vrk T = ([R 1 ] 1 • [R 2 ] 2 ), it knows rk a→b T = (R 1 , R 2 ) ∈ GL 2 (Z p ) 2 such that: ([c T,1 ] T , [c T,2 ] T ) = ([c T,1 ] T • (R 1 ⊗ R 2 ), [c T,2 ] T • (R 1 ⊗ R 2 )) ∧ pk b T = (pk b 1 , pk b 2 ) = (pk a 1 • R 1 , pk a 2 • R 2 )
Instead of proving these relations, the prover will use vrk s for s ∈ {1, 2, T } produced by REKeygen s for verifiability and will make the proof of the relations below:

• for s ∈ {1, 2}, it knows rk a→b s = R s ∈ M 2 (Z p ) such that: ([c s,1 ] s , [c s,2 ] s ) = ([c s,1 ] s • R s , [c s,2 ] s • R s ) ∧ vrk a→b s = [1] s • R s • for s = T , it knows rk a→b T = (R 1 ⊗ R 2 ) ∈ M 4 (Z p ) such that: ([c T,1 ] T , [c T,2 ] T ) = ([c T,1 ] T • (R 1 ⊗ R 2 ), [c T,2 ] T • (R 1 ⊗ R 2 )) ∧ vrk a→b T = [1] T • (R 1 ⊗ R 2 )
This proof needs 5 scalars of Z p for s ∈ {1, 2} and 17 scalars of Z p for s = T .

Proposition 20. For s ∈ {1, 2}, E s with verifiability is still secure. More precisely, for any adversary A running within time t,

Adv ind-cpa Es (A) ≤ 4 × Adv ddh Gs (t).
Proof. The modified EKeygen s also outputs vsk s and a zero-knowledge proof π s . This implies that some games need to be added before the first game in the security proof of E s for Theorem 17: Game G 0 : In the first game, the simulator plays the role of the challenger in the experiment Exp ind-cpa-0 Es (A), where b = 0: S(κ):

• param = (G 1 , G 2 , G T , p, g 1 , g 2 , e) ← Setup(κ) • (sk s , pk s , vsk s , π s ) ← EKeygen s (param) • m 0 , m 1 , [a] s ← A(param, pk s ) • C s = (m 0 • [a] s r • [p s ] s , [a] s ) ← Encrypt s (pk s , m 0 , [a] s ) • b ← A(param, pk s , C s ) We are interested in the event E: b = 1. By definition, Pr G 0 [E] = Pr Exp ind-cpa-0 Es (A) = 1 .
Game G 1 : The first modification is to replace π s by its simulation, possible thanks to the zero-knowledge property. This game is statistically indistinguishable from the previous one, under the statistical zero-knowledge property of the proof à la Schnorr in the Random Oracle Model.

Game G

Pr G 2 [E] = Pr G 1 [E].
Game G 3 : The simulator now receives a random tuple (

[a] s , [b] s ): Pr G 3 [E] -Pr G 2 [E] ≤ Adv ddh Gs (t)
. In this game, there is no information in vsk s anymore and the zero-knowledge proofs are simulated. In the original proof, sk s is never used, thus we can plug the games from the original proof here. To finish the proof we need to unravel the games of vsk s and π s in order to have: Game G 4 : S(κ):

• param = (G 1 , G 2 , G T , p, g 1 , g 2 , e) ← Setup(κ) • (sk s , pk s , vsk s , π s ) ← EKeygen s (param) • m 0 , m 1 , [a] s ← A(param, pk s ) • C s = (m 1 • [a] s r • [p s ] s , [a] s ) ← Encrypt s (pk s , m 0 , [a] s ) • b ← A(param, pk s , C s ) the experiment Exp ind-cpa-1 Es (A).
Hence, we have:

Pr Exp ind-cpa-1 Es (A) = 1 -Pr Exp ind-cpa-0 Es (A) = 1 ≤ 4 × Adv ddh Gs (t).
Corollary 21. E T with verifiability is still secure.

Proof. Similarly to the previous proof, the zero-knowledge proofs are replaced by their simulations. Then, vsk 1 and vsk 2 are replaced by random matrices in M 2 (G 1 ) and M 2 (G 2 ) respectively. Thus, vsk T is also a random matrix.

Distributed Decryption

When a third-party performs the decryption, it is important to be able to prove the correct decryption, which consists of zero-knowledge proofs, as described in the previous Section 3.1.6. However, this is even better if the decryption process can be distributed among several servers, under the assumption that only a small fraction of them can be corrupted or under the control of an adversary.

To decrypt a ciphertext in G s with s ∈ {1, 2}, one needs to compute

([c s,1 ] s • sk s , [c s,2 ] s • sk s ).
In a Shamir's like manner [START_REF] Shamir | How to share a secret[END_REF], one can perform a t-out-of-n threshold secret sharing by distributing sk s such that sk s = i∈I λ I,i sk s,i with I ⊂ {1, . . . , n} a subset of t users, and for all i ∈ I, λ I,i ∈ Z p and sk s,i is the secret key of the party P i .

For s = T and with just the distribution of sk 1 and sk 2 , it is also possible to perform a distributed decryption, using the relation sk 1 ⊗ sk 2 = (sk 1 ⊗ 1) × (1 ⊗ sk 2 ). One can thus make a two round decryption, first in G 1 and then in G 2 .

Remark. Because the operations to decrypt or re-encrypt are the same, one can make distributed re-encryption in the same vein: in our applications, computations will be performed on data encrypted under a controller's key, where the controller is actually a pool of controllers with a distributed decryption key. The latter will be used to re-encrypt the result under the targer end-user's key. However, in this scheme, the secret key must be a projection matrix, which is not easy to generate at random: for this key generation algorithm, a trusted dealer is required, which is not ideal when nobody is trusted. This is the goal of the rest of the chapter, to show that we can optimize this generic construction, and distribute everything without any trusted dealer.

Optimized Version

We presented the translation of Freeman's approach with projection matrices. This indeed leads to a public-key encryption scheme that can evaluate quadratic polynomials in Z p , under the DDH assumption. However, because the secret key must be a projection matrix, the distributed generation, while possible, is not as efficient as one can expect. We thus now propose a particular instantiation of projections, which allows very compact keys and ciphertexts.

Instantiation

While in the generic transformation of Freeman, the secret key belongs to the whole projection matrix space, our particular instantiation of projections means that the secret key will belong to a proper sub-space of the projection matrix space. In addition, this will allow to generate keys in a distributed manner, without any trusted dealer.

Indeed, it is possible to reduce by a factor two the size of the keys: for s ∈ {1, 2}, the secret key is just one scalar and the public key one group element in G s . For the keys, we will consider orthogonal projections on (1, x) , for any x ∈ Z p . Thus, sk s can simply be described by x ∈ Z p , which is enough to define the projection. The public key pk s can simply be described by g -x s ∈ G s , which is enough to define (g -x s , g s ), as (-x, 1) is a vector in the kernel of the projection, to add noise that the secret key will be able to remove.

More precisely, we can describe our optimized encryption schemes, for s ∈ {1, 2, T }, as E s : (Setup, EKeygen s , Encrypt s , Decrypt s ) with a common Setup (as the index s indicates the group, in this section, elements of G 2 will not be denoted in Fraktur font):

Setup(κ): Given a security parameter κ, it runs and outputs

param = (G 1 , G 2 , G T , p, g 1 , g 2 , e) ← G(κ).
EKeygen s (param): For s ∈ {1, 2}. It chooses x s $ ← Z p and outputs the public key pk s = g -xs s and the private key sk s = x s . From (pk 1 , sk 1 ) ← EKeygen 1 (param) and (pk 2 , sk 2 ) ← EKeygen 2 (param), one can consider pk T = (pk 1 , pk 2 ) and sk T = (sk 1 , sk 2 ), which are associated public and private keys in G T .

Encrypt s (pk s , m): For s ∈ {1, 2}, to encrypt a message m ∈ Z p using public key pk s , it chooses r $ ← Z p and outputs the ciphertext

C s = (c s,1 = g m s • pk r s , c s,2 = g r s ) ∈ G 2 s .
For s = T , to encrypt a message m ∈ Z p using public key pk T = (pk 1 , pk 2 ), it chooses r 11 , r 12 , r 21 , r 22 $ ← Z 4 p and outputs the ciphertext

C T =      c T,1 = e(g 1 , g 2 ) m • e(g 1 , pk 2 ) r 11 • e(pk 1 , g 2 ) r 21 , c T,2 = e(g 1 , g 2 ) r 11 • e(pk 1 , g 2 ) r 22 , c T,3 = e(g 1 , pk 2 ) r 12 • e(g 1 , g 2 ) r 21 , c T,4 = e(g 1 , g 2 ) r 12 +r 22      ∈ G 4 T Decrypt s (sk s , C s ): For s ∈ {1, 2}, given C s = (c s,1 , c s,2
) and the private key sk s , it computes d = c s,1 • c sks s,2 and outputs the logarithm of d in basis g s . For s = T , given

C T = (c T,1 , c T,2 , c T,3 , c T,4 ) and sk T = (sk 1 , sk 2 ), it computes d = c T,1 •c sk 2 T,2 •c sk 1 T,3 •c sk 1 •sk 2 T,4
and outputs the logarithm of d in basis e(g 1 , g 2 ).

In G 1 and G 2 , this is actually the classical ElGamal encryption. We essentially extend it to G T , to handle quadratic operations:

Add(C s , C s ) just consists of the component-wise product in G s ; Multiply(C 1 , C 2 ) for C 1 = (c 1,1 = g m 1 1 • pk r 1 1 , c 1,2 = g r 1 1 ) ∈ G 2 1 and C 2 = (c 2,1 = g m 2 2 • pk r 2 2 , c 2,2 = g r 2 2 ) ∈ G 2 2
, consists of the tensor product:

C T = (e(c 1,1 , c 2,1 ), e(c 1,1 , c 2,2 ), e(c 1,2 , c 2,1 ), e(c 1,2 , c 2,2 )) ∈ G 4
T Randomize s (pk s , C s ) is, as usual, the addition of a random ciphertext of 0 in the same group G s . For s ∈ {1, 2}: Given a ciphertext C s = (c s,1 , c s,2 ) with its public key pk s , it chooses r $ ← Z p and outputs (c s,1 • pk r s , c s,2 • g r s ); while for s = T , a public key pk T and a ciphertext (c T,1 , c T,2 , c T,3 , c T,4 ), it chooses r 11 , r 12 , r 21 , r 22

$ ← Z p and outputs (c T,1 • e(g 1 , pk 2 ) r 11 • e(pk 1 , g 2 ) r 21 , c T,2 • e(g 1 , g 2 ) r 11 • e(pk 1 , g 2 ) r 22 , c T,3 • e(g 1 , pk 2 ) r 12 • e(g 1 , g 2 ) r 21 , c T,4 • e(g 1 , g 2 ) r 12 +r 22 ).

Security Properties

Whereas the correctness directly comes from the correctness of Freeman's construction, presented in the Section 3.1, and verification is straightforward, the semantic security comes from the classical ElGamal encryption security, under the DDH assumptions, for the basic schemes in G 1 and G 2 : Theorem 22. For s ∈ {1, 2}, E s is IND-CPA under the DDH assumption in G s : for any adversary A running within time t, Adv ind-cpa

Es (A) ≤ 2 × Adv ddh Gs (t). Corollary 23. E T is IND-CPA under the DDH assumptions in G 1 or G 2 .
Proof. The semantic security for ciphertexts in G T comes from the fact that:

Encrypt T (pk T , m) = Multiply(Encrypt 1 (pk 1 , m), Encrypt 2 (pk 2 , 1)) = Multiply(Encrypt 1 (pk 1 , 1), Encrypt 2 (pk 2 , m))
Indeed, with this relation, each ciphertext in G 1 can be transformed into a ciphertext in G T (idem with a ciphertext in G 2 ). Let A be an adversary against

IND-CPA of E T , in G T .
Game G 0 : In the first game, the simulator plays the role of the challenger in the experiment Exp ind-cpa-0

E T (A)
, where b = 0:

• param = (G 1 , G 2 , G T , p, g 1 , g 2 , e) ← Setup(κ) • (sk 1 , pk 1 ) ← EKeygen 1 (param),(sk 2 , pk 2 ) ← EKeygen 2 (param) • m 0 , m 1 ← A(param, (pk 1 , pk 2 )); C T = Encrypt T ((pk 1 , pk 2 ), m 0 ) • β ← A(param, (pk 1 , pk 2 ), C T )
We are interested in the event

E: b = 1. By definition, Pr G 0 [E] = Pr Exp ind-cpa-0 E T (A) = 1 .
Game G 1 : The simulator interacts with a challenger in Exp ind-cpa-0

E 1 (A)
, where b = 0. It thus first receives param, pk 1 from that challenger, generates pk 2 by himself to provide (pk T = (pk 1 , pk 2 )) to the adversary. The latter sends back (m 0 , m 1 ) the simulators forwards to the challenger. It gets back C 1 = Encrypt 1 (pk 1 , m 0 ). It can compute C T = Multiply(C 1 , Encrypt 2 (pk 2 , 1)), to be sent to the adversary. This game is perfectly indistinguishable from the previous one:

Pr G 1 [E] = Pr G 0 [E].
Game G 2 : The simulator interacts with a challenger in Exp ind-cpa-1

E 1 (A), where b = 1: Pr G 2 [E] -Pr G 1 [E] ≤ Adv ind-cpa E 1 (t + 4 • t p + 4 • t e ),
where t p is the time for one pairing and t e the time for one exponentiation.

Game G 3 : In this final game, the simulator plays the role of the challenger in Exp ind-cpa-1 E T (A), where b = 1. This game is perfectly indistinguishable from the previous one:

Pr G 3 [E] = Pr G 2 [E].
One can note, that in this last game, Pr

G 3 [E] = Pr Exp ind-cpa-1 E T (A) = 1 , hence Adv ind-cpa E T (A) ≤ Adv ind-cpa E 1 (t + 4 • t p + 4 • t e ),
which concludes the proof, since it works exactly the same way for G 2 .

We stress that the security of E T only requires the DDH assumption in one of the two groups, and not the SXDH assumption (which means that the DDH assumption holds in both G 1 and G 2 ).

Decentralized Homomorphic Encryption

Our main motivation was a decentralized key generation and a distributed decryption in order to be able to compute on encrypted data so that nobody can decrypt intermediate values but the result can be provided in clear to a target user. We now show that our optimized construction allows both decentralized key generation without a trusted dealer and distributed decryption. They are both quite efficient. We also show this is possible to do proxy re-encryption in a distributed way, without any leakage of information.

Decentralized Key Generation

In fact, a classical decentralized t-out-of-n threshold secret sharing allows to generate the shares of a random element and it seems hard (if one expects efficiency) to use it to generate the shares of a structured matrix, such as projections required in the generic construction, because its elements are not independently random. In our specific construction, the secret keys in G 1 and G 2 are now one scalar and one can perform a classical t-out-of-n threshold secret sharing: each player i generates a random polynomial P i of degree t-1 in Z p [X], privately sends x i,j = P i (j) to player j, and publishes g -P i (0) s ; each player i then aggregates the values into sk i = j x j,i = P (i), for P = j P j , which leads to a share of x = P (0), and the public key is the product of all the public values.

Distributed Decryption

In order to decrypt C s = (c s,1 , c s,2 ) in G 1 or G 2 , each player in a sub-set of t players sends its contribution c sk i s,2 , that can be multiplied with Lagrange coefficients as exponents to obtain the mask c sk s,2 = pk -r s . To decrypt do not leak more than the decryption itself. Of course, classical verifiable secret sharing techniques can be used, for both the decentralized generation and the distributed decryption. This can allow, with simple Schnorr-like proofs of Diffie-Hellman tuples, universal verifiability.

C T = (c T,1 , c T,2 , c T,3 , c T,4 ) in G T ,

Distributed Re-encryption

Besides a distributed decryption, when outsourcing some computations on private information, a distributed authority may want to re-encrypt the encrypted result to a specific user, so that the latter can get the result in clear, and nobody else. More precisely, we assume the input data were encrypted under the keys pk 1 , pk 2 , and pk T = (pk 1 , pk 2 ), which leads, after quadratic evaluations, to a resulting ciphertext under the key pk T , for which the distributed authorities, knowing a t-out-of-n additive secret sharing (sk 1,i , sk 2,i ) i of (sk 1 , sk 2 ), will re-encrypt under PK T = (PK 1 , PK 2 ) for the target user. Of course, such a re-encryption can be performed using multi-party computation, but we will show an efficient way to do it.

We start with the re-encryption of

c s = (c s,1 = g m s • pk r s , c s,2 = g r s ): player i chooses r i $ ← Z p , computes α i = c sk s,i s,2 • PK r i s and β i = g r i
s , and outputs (α i , β i ). Then, anybody can compute, for the appropriate Lagrange coefficients λ i 's,

C s = (C s,1 = c s,1 × α λ i i = g m s pk r s g r•sks s • PK r s = g m s • PK r s , C s,2 = β λ i i = g r s )
with r = λ i r i , where the sum is on the t members available. For s = T , given a ciphertext c T = (c T,1 , c T,2 , c T,3 , c T,4 ), player i chooses u i $ ← Z p , and first computes and sends α 3,i = c sk 1,i T,4 • e(g 1 , g 2 ) -u i . With a linear combination for the appropriate Lagrange coefficients λ i 's, anybody can compute,

α 3 = α λ i 3,i = c sk 1 T,4 • e(g 1 , g 2 ) -u , with implicit u = λ i u i . Then each player i chooses r 11,i , r 12,i , r 21,i , r 22,i , v i $ ← Z p and computes α 1,i = c sk 2,i T,2 • e(PK 1 , g 2 ) r 21,i β i = e(g 1 , g 2 ) r 11,i +u i • e(PK 1 , g 2 ) r 22,i α 2,i = c sk 1,i T,3 • e(g 1 , PK 2 ) r 11,i γ i = e(g 1 , PK 2 ) r 12,i • e(g 1 , g 2 ) r 21,i +v i α 4,i = α sk 2,i 3 • e(PK 1 , g 2 ) v i δ i = e(g 1 , g 2 ) r 12,i +r 22,i
Again, with linear combinations for the appropriate Lagrange coefficients λ i 's, anybody can compute, with r jk = λ i r jk,i , for j, k ∈ {1, 2}, and v = λ i v i :

α 1 = c sk 2 T,2 • e(PK 1 , g 2 ) r 21 C T,2 = e(g 1 , g 2 ) r 11 +u • e(PK 1 , g 2 ) r 22 α 2 = c sk 1 T,3 • e(g 1 , PK 2 ) r 11 C T,3 = e(g 1 , PK 2 ) r 12 • e(g 1 , g 2 ) r 21 +v α 4 = c sk 1 sk 2 T,4 • e(g 1 , PK 2 ) u • e(PK 1 , g 2 ) v C T,4 = e(g 1 , g 2 ) r 12 +r 22 Then, C T,1 = c T,1 × α 1 α 2 α 4 = e(g 1 , g 2 ) m • e(g 1 , PK 2 ) r 11 +u • e(PK 1 , g 2 ) r 21 +v , so that the ciphertext C T = (C T,1 , C T,2 , C T,3 , C T,4 ) is a re-encryption of c T under PK T .
For random scalars, the re-encryption algorithms (which is just a one-round protocol in G 1 and G 2 , but 2-round in G T ) generate new ciphertexts under appropriate keys that look perfectly fresh. In addition, one can claim:

Theorem 24. The above distributed protocols for re-encryption do not leak additional information than the outputs of the non-distributed algorithms.

Proof. The goal of this proof is to show that the distributed protocol to re-encrypt a ciphertext under PK s does not leak more information than a direct encryption under PK s . For s ∈ {1, 2}, one is given

c s = Encrypt s (m, pk s ; r) = (c s,1 , c s,2 ) and C s = Encrypt s (m, PK s ; R) = (C s,1 , C s,2
), two ciphertexts of the same message m under pk s and PK s respectively. One can then note that

C s,1 /c s,1 = PK R s /pk r s = c sks s,2 /C SKs s,2 .
The Re-Encryption in G s , for s ∈ {1, 2}.

Game G 0 : In the first game, the simulator just receives c s = (c s,1 , c s,2 ), and plays the real protocol using the t-out-of-n distributed keys (sk s,i ) i to provide the keys to the corrupted users and to generate the values

α i = c sk s,i s,2 • PK r i s and β i = g r i
s , on behalf of the noncorrupted players. We assume that among t players, are honest and t -are corrupted. The latter are assumed to receive the secret keys sk s,i and to generate their own outputs (α i , β i ). The view of the attacker consists of the set of all the honest (α i , β i ).

Game G 1 : The simulator is now given c s = (c s,1 , c s,2 ) and C s = (C s,1 , C s,2 ) that encrypt the same message. We want, for the appropriate Lagrange coefficients

λ i C s,1 = c s,1 • α λ i i C s,2 = β λ i i .
Hence, the simulator can take, for all the honest players except the last one, r i

$ ← Z p to compute α i = c sk s,i s,2 • PK r i s and β i = g r i s .
For the last honest player, from all the honest-user shares and corrupted-user shares, one sets

α = (C s,1 /c s,1 • i = α -λ i i ) 1/λ β = (C s,2 • i = β -λ i i ) 1/λ .
Then, for the t players: α λ i i = c sks s,2 • PK r s and β λ i i = g r s , for r = λ i r i and with the implicit r = (Ri = λ i r i )/λ . So r = R. The view of the attacker remains exactly the same.

Game G 2 : In this game, the simulator also takes as input a Diffie-Hellman tuple (A = g r , B = PK r s ) with (g s , PK s ): it first derives enough independent pairs (A i , B i ) = (g x i s • A y i , PK x i s • B y i ), for random x i , y i , for all the non-corrupted players (excepted the last one), and computes

α i = c sk s,i s,2 • B i , β i = A i . Since (g s , PK s , A, B
) is a Diffie-Hellman tuple, the view is perfectly indistinguishable from the previous one.

Game G 3 : In this game, the simulator now receives a random tuple (A, B), which makes all the (A i , B i ) independent random pairs, the rest is unchanged: under the DDH assumption in G s , the view is computationally indistinguishable.

Game G 4 : This is the final simulation, where all the honest shares (α i , β i ) are chosen at random, except the last ones (α , β ) that are still computed as above to complete the values using c s and C s : the view is perfectly indistinguishable from the previous one and does not leak information.

As a consequence, we have proven that there is a simulator (defined in the last game) that produces a view indistinguishable from the real view, with just the input-output pairs. This proves that nothing else leaks.

The Re-Encryption in G T .

The proof follows the same path as in the previous proof: one is given two ciphertexts c T = Encrypt T (m, (pk 1 , pk 2 ); r 11 , r 12 , r 21 , r 22 ) and

C T = Encrypt T (m, (PK 1 , PK 2 ); R 11 , R 12 , R 21 , R 22 )
of the same message m under pk T and PK T respectively. One needs to simulate all the α 1,i , α 2,i , α 3,i , α 4,i , β i , γ i , δ i for all the non-corrupted players. Since c T and C T encrypt the same message, and we want

C T,1 = c T,1 • α λ i 1,i • α λ i 2,i • α λ i 4,i C T,2 = β λ i i C T,3 = γ λ i i C T,4 = δ λ i i
the simulator can take, for all the honest players except the last one, r 11,i , r 12,i , r 21,i , r 22,i , u i , v i $ ← Z p to compute, in the first round:

α 3,i = c sk 1,i T,4 • e(g 1 , g 2 ) -u i α 3, $ ← G T α 3 = α λ i 3,i
and in the second round, for all but the last honest player

α 1,i = c sk 2,i T,2 • e(PK 1 , g 2 ) r 21,i β i = e(g 1 , g 2 ) r 11,i +u i • e(PK 1 , g 2 ) r 22,i α 2,i = c sk 1,i T,3 • e(g 1 , PK 2 ) r 11,i γ i = e(g 1 , PK 2 ) r 12,i • e(g 1 , g 2 ) r 21,i +v i α 4,i = α sk 2,i 3 • e(PK 1 , g 2 ) v i δ i = e(g 1 , g 2 ) r 12,i +r 22,i
and for the last honest player:

α 2, $ ← G T β = (C T,2 × i = β -λ i i ) 1/λ α 4, $ ← G T γ = (C T,3 × i = γ -λ i i ) 1/λ δ = (C T,4 × i = δ -λ i i ) 1/λ
which implies implicit values for r 11, , r 12, , r 21, , r 22, , u , v because the above system is invertible, where X, Y , and Z are the constant values introduced by c sk j T,i , for some i, j:

λ ×          log β log γ log δ log α 4, log α 3, log α 2,          =          0 0 0 X Y Z          +          1 0 0 -sk 1 1 0 0 sk 2 1 0 0 -1 0 1 0 1 0 0 0 0 0 0 sk 2, -1 0 0 0 0 1 0 1 0 0 0 0 0                    r 11, r 12, r 21, r 22, u v          
Then it is possible to set:

α 1, = (C T,1 /(c T,1 • α 2 α 4 ) × i = α -λ i 1,i ) 1/λ
. First, this is clear that the α 3,i 's do not leak anything as they contain random masks e(g 1 , g 2 ) -u i . Then, to prove that all the α 1,i , α 2,i , α 4,i , β i , γ i , δ i do not leak information, one can perform a similar proof as above for G s , by using the DDH assumption in both G 1 and G 2 . Indeed, each element is masked using a pair either (g r 2 , PK r 2 ) or (g r 1 , PK r 1 ), for some random r. If one wants to have an indistinguishability under the SXDH assumption (and thus only one DDH assumption in one group), one could add more masks. But this does not make sense to have one key compromised and not the other one, for the same user. Hence, we tried to make the re-encryption as efficient as possible.

We stress that for the re-encryption in G 1 or G 2 , one just needs the DDH assumption in this group G s . But for the re-encryption in G T , one needs the DDH assumption in both G 1 and G 2 (the so-called SXDH assumption). We could rely on only one of the two, by adding masking factors, but this does not really make sense for a user to have his private key sk 1 being compromised without sk 2 (or the opposite).

In addition, zero-knowledge proofs can be provided to guarantee the re-encryption is honestly applied: they just consist in proofs of representations, when g sk s,i s are all made public, for s ∈ {1, 2} and all indices i.

Efficiency

In the concrete case where we have n servers able to perform a distributed protocol as described above, each of them has two scalars corresponding to a secret key for the encryption in G 1 and a secret key for the encryption in G 2 . We recall that a ciphertext, in G 1 or G 2 , is composed of two group elements, and a ciphertext in G T is composed of four group elements. A recipient, that wants the result of either a decryption or a re-encryption with the help of t servers, has to perform a few exponentiations. The table below details the number of exponentiations for each player involved in the distributed protocols.

per server recipient distributed decryption in G 1 /G 2 1 t in G T 4 4t distributed re-encryption in G 1 /G 2 3 t in G T 13 7t

Applications

Boneh, Goh, and Nissim proposed two main applications to secure evaluation of quadratic polynomials: private information retrieval schemes (PIR) and electronic voting protocols. However, the use of our decentralized scheme for electronic voting is much more preferable than the BGN scheme, as there is no way to trust any dealer in such a use-case. We propose two more applications that are related to the group testing and the consistency model in machine learning.

Our applications are particularly useful in practice in a decentralized setting, as they deal with sensitive data. Interestingly, the use of distributed evaluation for quadratic polynomials in these applications is highly non-trivial and will be explained in the last section.

Encryption for Boolean Formulae

In this part, we detail the specific case of the evaluation of 2-DNF. First, as explained in [START_REF] Boneh | Evaluating 2-DNF formulas on ciphertexts[END_REF], a way to guarantee the ciphertexts are encryption of inputs in {0, 1}, the verification can be done with our scheme (or the one of BGN or Freeman) with the additional term Add j (Multiply(C x j , Add(C x j , C -1 )), multiplied by a random constant, so that it adds zero if inputs are correct, or it adds a random value otherwise. This introduces a quadratic term, just for the verification. This is at no extra cost if the Boolean formula is already quadratic, which will be the case of our applications.

Every Boolean formula can be expressed as a disjunction of conjunctive clauses (an OR of ANDs). This form is called disjunctive normal form (DNF) and, more precisely, k-DNF when each clause contains at most k literals. Thus, a 2-DNF formula over the variables x 1 , . . . ,

x n ∈ {0, 1} is of the form m i=1 ( i,1 ∧ i,2 ) with i,1 , i,2 ∈ {x 1 , x 1 , . . . , x n , x n }.
The conversion of 2-DNF formulae into multivariate polynomials of total degree 2 is simple:

given Φ(x 1 , . . . , x n ) = m i=1 ( i,1 ∧ i,2 ) a 2-DNF formula, define φ(x 1 , . . . , x n ) = m i=1 (y i,1 × y i,2
) where y i,j = i,j if i,j ∈ {x 1 , . . . , x n } or y i,j = (1i,j ) otherwise. In this conversion, a true literal is replaced by 1, and a false literal by 0. Then, an OR is converted into an addition, and an AND is converted into a multiplication. A NOT is just (1 -x) when x ∈ {0, 1}. φ(x 1 , . . . , x n ) is the multivariate polynomial of degree 2 corresponding to Φ(x 1 , . . . , x n ). As just said, this conversion works if for the inputs, we consider 1 ∈ Z p as true and 0 ∈ Z p as false, but for the output, 0 ∈ Z p is still considered as false whereas any other non-zero value is considered as true.

To evaluate the 2-DNF in an encrypted manner, we propose to encrypt the data and to calculate the quadratic polynomial corresponding to the 2-DNF as seen above by performing Adds and Multiplys. Because the result of the 2-DNF is a Boolean, when a decryption is performed, if the result is equal to 0, one can consider it corresponds to the 0-bit (false) and else, it corresponds to the 1-bit (true).

Hence, when encrypting bits, we propose two different encodings before encryption, depending on the situation: either the 0-bit (false) is encoded by 0 ∈ Z p and the 1-bit (true) is encoded by any non-zero integer of Z * p ; or the 0-bit (false) is encoded by 0 ∈ Z p and the 1-bit (true) is encoded by 1 ∈ Z p . With this second solution, it offers the possibility to perform one NOT on the data before Adds and Multiplys by the operation 1 -x. However, one has to be aware of making Randomize before decryption to mask the operations but also the input data in some situations: for example, if an Add is performed between three 1s, the result 3 leaks information and needs to be randomized.

Because one just wants to know whether the result is equal to 0 or the result is different from 0, we do not need to compute the logarithm: we can decrypt by just checking whether

c s,1 • c sks s,2 = 1 s or not (for s = T , if c T,1 • c sk 2 T,2 • c sk 1 T,3 • c sk 1 •sk 2 T,4 = 1 T ).

Group Testing on Encrypted Data

In this application we assume that a hospital collects some blood samples and wants to check which samples are positive or negative to a specific test. Group testing [START_REF] Dorfman | The detection of defective members of large populations[END_REF] is an efficient technique to detect positive samples with fewer tests in the case the proportion of positive cases is small. The technique consists in mixing some samples, and to perform tests on fewer mixes. More precisely, we denote X = (x ij ) the matrix of the mixes: x ij = 1 if the i-th sample is in the j-th mix, otherwise x ij = 0. The hospital then sends the (blood) mixes to a laboratory for testing them: we denote y j the result of the test on the j-th mix. If a patient (its sample) is in a mix with a negative result, he is negative (not infected). If a patient (its sample) is in a mix with a positive result, we cannot say anything. However, for well-chosen parameters, if a patient is not declared negative, he is likely positive. Thus, for a patient i, the formula that we want to evaluate is ¬F i (X, y), which means the patient's test is positive (infected) or not, for F i (X, y) = j (x ij ∧ ¬y j ). The latter is indeed true if there is a mix containing a i-th sample for which the test is negative, and this should claim patient i negative (false). The matrix X of the samples needs to be encrypted since the patient does not want the laboratory to know his result. Because of the sensitiveness of the data, the result of the tests needs to be encrypted too. But the patient will need access to his own result.

In this scenario, the hospital computes for all i, j, C x ij ∈ G 2 1 , the encryption of x ij , and the laboratory computes for all j, C y j ∈ G 2 2 , the encryption of y j . Then, they both send the ciphertexts to an external database. With our homomorphic encryption scheme, to compute ¬F i , we can publicly evaluate the following formula:

C i = Randomize(Add j (Multiply(C x ij , C y j )).
Anybody can publicly verify the computations and if it is correct, a pool of controllers perform a distributed re-encryption of the result of patient i under his key PK i . In this way, the patient cannot decrypt the database or the result of the tests directly, but only with the help of a pool of controller. The goal of the controllers is to limit access to the specific users only. Under an assumption about the collusions among the controllers, nobody excepted the users will have access to their own results.

Consistency Model on Encrypted Data

Another famous application is machine learning, where we have some trainers that fill a database and users who want to know a function of their inputs and the database. For privacy reasons, trainers do not want the users to learn the training set, and users do not want the trainers to learn their inputs. As in the previous case, we will involve a pool of distributed controllers to limit decryptions, but the controllers should not learn anything either.

Suppose a very large network of nodes in which some combinations should be avoided as they would result to failures. When a failure happens, the combination is stored in a database. And before applying a given combination, one can check whether it will likely lead to a failure, and then change. For example, the network can be a group of people where each of them can receive data. But, for some specific reasons, if a subgroup A of people is knowing a file a, the subgroup B must not have the knowledge of a file b. This case of application can be viewed as a consistency model [START_REF] Schapire | Computer science 511 -theoretical machine learning[END_REF] which can be formally described as: the input is a vector of states (each being either true or false), and if in the database all the j-th states are true a new input needs to have its j-th state to be true; if all the j-th states in the database are false, the new input needs to have its j-th state to be false; otherwise the j-th state can be either true or false. As a consequence, if we denote the i-th element of the database as a vector x i = (x ij ) j and the user's vector by y = (y j ), that vector y is said consistent with the database if the following predicate is true:

j (∧ i x ij ∧ y j ) ∨ (∧ i x ij ∧ y j ) ∨ (∨ i x ij ∧ ∨ i x ij ) . Let X j = ∧ i x ij , Y j = ∧ i x ij , and Z j = ∨ i x ij ∧ ∨ i x ij .
We define F(x 1 , . . . , x m , y) the formula we want to compute on the encrypted inputs:

F(x 1 , . . . , x m , y) = j (X j ∧ y j ) ∨ (Y j ∧ y j ) ∨ Z j .
By definition, X j , Y j , and Z j are exclusive, as X j means the literals are all true, Y j means the literals are all false, and Z j means there are both true and false literals. So we have: X j ∨Z j = Y j and Y j ∨ Z j = X j . Thus, we have

¬F(x 1 , . . . , x m , y) = j ((Y j ∨ y j ) ∧ (X j ∨ y j )) .
Now, we see how the encryption and the decryption is performed to obtain the result of an evaluation. First, we explain how the trainers can update the database, when adding a vector x m . The values X j are updated into X j as

X j = m i=1 x ij = m-1 i=1 x ij ∧ x mj = X j = m-1 i=1 x ij if x mj = true false otherwise
which is easy to compute for the trainer, since it knows x m in clear, even if X j is encrypted: the trainer can dynamically compute C X j the encryption of X j , when adding a new line in the database, by just making a Randomize if x mj is true (to keep the value X j unchanged), or by replacing the value by a fresh encryption of 0 otherwise. Similarly, the trainer can update C Y j , the encryption of Y j . On the user-side, he can compute C y j and C y j the encryptions of his inputs y j and y j respectively. Then, everyone and thus the controllers can compute:

C j = Randomize Add j Multiply(Add(C Y j , C y j ), Add(C X j , C y j )) .
Because of the Multiply, C Y j and C y j must be ciphertexts in G 1 , while C X j and C y j must be ciphertexts in G 2 . To allow a control of the final decryption, a pool of controllers re-encrypt for the user in a distributed way.

Chapter 4

Linearly-Homomorphic Signatures

This chapter introduces the building blocks of the two following ones: the Linearly-Homomorphic Signatures. For readability, it presents results coming from the two papers [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF][START_REF] Hébant | Traceable constant-size multi-authority credentials[END_REF]. The notion of homomorphic signatures dates back to [START_REF] Johnson | Homomorphic signature schemes[END_REF], with notions in [ABC + 12], but the linearly-homomorphic signatures, that allow to sign vector sub-spaces, were introduced in [BFKW09], with several follow-up by Boneh and Freeman [START_REF] Boneh | Linearly homomorphic signatures over binary fields and new tools for lattice-based signatures[END_REF][START_REF] Boneh | Homomorphic signatures for polynomial functions[END_REF] and formal security definitions in [START_REF] Mandell | Improved security for linearly homomorphic signatures: A generic framework[END_REF].

Chapter content

We begin in a first section with the formal definition of linearly-homomorphic signature scheme, then, we will introduce a new property for linearly-homomorphic signature scheme: the tag randomizability. It will be the key element in our use-cases. Finally, we provide the security definition, so-called unforgeability in case of signatures. In fact in the Preliminaries we presented a weaker version of LH-Sign scheme without any tag called One-Time. The first construction proposed in Section 4.2 is a One-Time linearly-homomorphic signature while the two other constructions in Section 4.3 and in Section 4.4 are full fledged (not one-time). In the last section 4.5, we provide two generic conversions from a One-Time scheme to a full fledged one.

Definition, Properties and Security

Our definition of linearly-homomorphic signature scheme is inspired by the formal definition from Libert et al. [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF], but with a possible private key associated to a tag: Definition 25 -Linearly-Homomorphic Signature Scheme (LH-Sign) A linearly-homomorphic signature scheme with messages in M ∈ G n , for a cyclic group (G, ×) of prime order p, some n ∈ poly(κ), and some tag set T , consists of the seven algorithms (Setup, SKeygen, NewTag, VerifTag, Sign, MultiplySign, VerifSign):

Setup(1 κ ): Given a security parameter κ, it outputs the global parameter param, which includes the tag space T ;

SKeygen(param, n): Given a public parameter param and an integer n, it outputs a key pair (sk, vk). We will assume that vk implicitly contains param and sk implicitly contains vk; NewTag(sk): Given a signing key sk, it outputs a tag τ and its associated secret key τ ;

VerifTag(vk, τ ): Given a verification key vk and a tag τ , it outputs 1 if the tag is valid and 0 otherwise;

Sign(sk, τ , M ): Given a signing key, a secret key tag τ and a vector-message M = (M i ) i ∈ G n , it outputs the signature σ under the tag τ ;

MultiplySign(vk, τ, (ω i , M i , σ i ) i=1 ): Given a public key vk, a tag τ and tuples of weights ω i ∈ Z p and signed messages M i in σ i , it outputs a signature σ on the vector M = i=1 M ω i i under the tag τ ;

VerifSign(vk, τ, M , σ): Given a verification key vk, a tag τ , a vector-message M and a signature σ, it outputs 1 if VerifTag(vk, τ ) = 1 and σ is also valid relative to vk and τ , and 0 otherwise.

Note that we talk about linearly homomorphic signature with combinations component-wise in the exponents as we will consider a multiplicative group (G, ×) and messages directly in G instead of Z p . Moreover, this definition is more related to the notion of linearly homomorphic structure preserving signatures as the evaluated function is not provided in input of the verification algorithm unlike definitions as in [START_REF] Gorbunov | Leveled fully homomorphic signatures from standard lattices[END_REF][START_REF] Catalano | On the security notions for homomorphic signatures[END_REF] where the evaluated function matters.

The tag in MultiplySign allows linear combinations of signatures under the same tag but excludes any operation between signatures under different tags. The latter exclusion will be formalized by the unforgeability. However, the former property is the correctness: for any keys (sk, vk) ← Keygen(param, n), for any tags (τ, τ ) ← NewTag(sk), if for i = 1, . . . , , σ i = Sign(sk, τ , M i ) are valid signatures and σ = MultiplySign(vk, τ, {ω i , M i , σ i } i=1 ) from some scalars ω i , then both VerifTag(vk, τ ) = 1

VerifSign(vk, τ, M , σ) = 1.

Our definition includes, but is more relaxed than, [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF] as we allow a secret key associated to the tag, hence the NewTag algorithm: in such a case, the signer can only sign a message on a tag he generated himself. When there is no secret associated to the tag, one can actually consider that τ = τ is enough to generate the signature (in addition to sk). Whereas the MultiplySign algorithm generates a signature under the same tag, we do not require to keep the same tag in the unforgeability notion below, this will allow our tag randomizability. However, we expect only signatures on linear combinations of messages already signed under a same tag, as we will formalize in the security notion.

Homomorphic Properties

From the definition of linearly homomorphic signature, we have the following property:

Property 26 (Message Homomorphism). Given several vector-messages with their signatures, MultiplySign generates the signature of any linear combination of the vector-messages. Property 27 (Tag Randomizability). For any vector-message M = (M i ) i ∈ G n , key pair (sk, vk) ← SKeygen(param, n), tag (τ , τ ) ← NewTag(sk), valid signature σ ← Sign(sk, τ , M ), and (τ , σ ) ← RandTag(vk, τ, M , σ) the two following distributions are indistinguishable:

In addition, one can introduce a new algorithm

D 0 = {(vk, τ, M , σ)} D 1 = {(vk, τ , M , σ )}.
Libert et al. [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF] proposed a LH-Sign construction which security relies on the Simultaneous Double Pairing assumption, which is implied by the linear assumption in the symmetric case. In our use cases, the tag will be linked to the identity of a user. Hence, the tags need to be randomizable to provide privacy. However, we do not know how to build it in the standard model. Thus, we choose to focus on constructions secure in the generic bilinear group model [START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF][START_REF] Boneh | Hierarchical identity based encryption with constant size ciphertext[END_REF][START_REF] Boyen | The uber-assumption family (invited talk)[END_REF].

Notations and Constraints

Since we will mainly work on sub-vector spaces of dimension 2 (in a larger vector space), we will denote σ = Sign(sk, (M , M )), with the verification check VerifSign(vk, σ, (M , M )) = 1, a signature that allows to derive a valid σ for any linear combinations of M and M . In general, σ can be the concatenation of σ 1 = Sign(sk, M ) and σ 2 = Sign(sk, M ), but some joint random coins may be needed, and some common elements can be merged (the tag).

We will also be interested in signing affine spaces: given a signature on M and N , one wants to limit signatures on M × N α and 1 × N β . This is possible by expanding the messages with one more component: for M = (g, M ) and N = (1, N ), linear combinations are of the form (g α , M α N β ). By imposing the first component to be g, one limits to α = 1, and thus to (g, M N β ) = M × N β , while by imposing the first component to be 1, one limits to α = 0, and

thus to (1, N β ) = N β .

Unforgeability

Whereas linear combinations are possible under the same tag, other combinations (non-linear or under different tags) should not be possible. This is the unforgeability notion.

Definition 28 -Unforgeability for LH-Sign For a LH-Sign scheme with messages in G n , for any adversary A that, given tags and signatures on messages (M i ) i under tags (τ i ) i both of its choice (for Chosen-Message Attacks), outputs a valid tuple (vk, τ, M , σ) with τ ∈ T , there must exist (ω i ) i∈I τ , where I τ is the set of messages already signed under some tag τ ∈ {τ i } i , such that M = i∈I τ M ω i i with overwhelming probability.

Again, because our version is relaxed compared to [LPJY13], we do not exclude the adversary to be able to generate valid signatures under new tags. The linear-homomorphism for signatures, also known as signatures on vector-spaces, requires that the adversary cannot generate a valid signature on a message outside the vector spaces spanned by the already signed messages. Tags are just a way to keep together vectors that define vector spaces. The adversary can rename a vector space with another tag, this is not a security issue. On the opposite, we will exploit this feature for unlinkability with the additional randomizability property on tags.

Our One-Time LH-Sign Scheme

As in [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF] and presented in the Example 12, we can consider a weaker notion of linearlyhomomorphic signature: a one-time linearly-homomorphic signature (OT-LH-Sign), where the set of tags is a singleton T = { }. In this case, the algorithms NewTag and VerifTag can be dropped, as well as the τ and τ .

We will consider a simplified variant of one-time linearly-homomorphic signature of Libert et al. [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF] that can only be proven in the generic bilinear group model even if their scheme was originally built in the standard model.

Our One-Time linearly-homomorphic signature scheme with messages in M ∈ G n 1 , for some n ∈ poly(κ) consists of the five algorithms (Setup, SKeygen, Sign, MultiplySign, VerifSign):

Our One-Time LH-Sign Scheme Setup(1 κ ): Given a security parameter κ, let (G 1 , G 2 , G T , p, g, g, e) be an asymmetric bilinear setting, where g and g are random generators of G 1 and G 2 respectively. We

set param = (G 1 , G 2 , G T , p, g, g, e);
SKeygen(param, n): Given the public parameters param, one randomly chooses sk i = s i $ ← Z p , for i = 1, . . . , n, which defines the signing key sk = (sk i ) n i=1 , and the verification key vk = (g i ) n i=0 for g i = g s i and g 0 = g;

Sign(sk, M = (M i ) i ): Given a signing key sk = (s i ) i and a vector-message M = (M i ) i ∈ G n 1 , one sets σ = n i=1 M s i i ∈ G 1 ; MultiplySign(vk, (ω i , M i , σ i ) i=1
): Given a verification key and tuples of weights ω i ∈ Z p and signed messages M i in σ i , it outputs σ = σ ω i i ;

VerifSign(vk, M = (M i ) i , σ): Given a verification key vk, a vector-message M , and a signature σ, one checks whether the equality e(σ, g 0 ) = n i=1 e(M i , g i ) holds or not.

If a message-signature is valid for a verification key vk, then it is also valid for the verification key vk = vk α , for any α, as e(σ, g 0 ) = n i=1 e(M i , g i ) implies e(σ, g α 0 ) = n i=1 e(M i , g α i ). However, for two different verification keys vk and vk , and signatures σ and σ of M :

n i=1 e(M i , g α i • g i β ) = n i=1 e(M i , g i ) α • e(M i , g i ) β = e(σ, g α 0 ) • e(σ , g 0 β ), so σ = σ α σ β is a valid signature of M under vk = vk α vk β if g 0 = g 0 .
Hence, one can ask for a similar property on the keys than on the messages:

Property 29 (Key Homomorphism). Given a vector-message with signatures under several keys, it is possible to generate the signature of this vector-message under any linear combination of the keys.

MultiplyKey(M , (ω i , vk i , σ i ) i=1 ): Given a message M and tuples of weights ω i ∈ Z p and signatures σ i of M under vk i , it outputs a signature σ of M under the verification key vk = i=1 vk ω i i .

Our scheme only supports the relaxed version:

Property 30 (Weak Key Homomorphism). Given a vector-message with signatures under several keys (with a specific restriction, as a common g 0 in our case), it is possible to generate the signature of this vector-message under any linear combination of the keys.

Eventually, one needs to prove the unforgeability of our scheme:

Theorem 31 (Unforgeability). Let us consider an adversary A in the generic bilinear group model. Given valid pairs (M j , σ j ) j under a verification key vk (M i 's possibly of adversary's choice, for Chosen-Message Attacks), when A produces a new valid pair (M , σ) under the same verification key vk, there exist (α j ) j such that M = j M α j j .

Proof. The adversary A is given (M j = (M j,i ) i , σ j ) j which contains group elements in G 1 , as well as the verification key vk = (g k ) k in G 2 . Note that in the generic bilinear group model, programmability of the encoding allows to simulate the signatures for chosen messages, which provides the security against Chosen-Message Attacks.

For any combination query, the simulator will consider the input elements as independent variables X j,i , V j , and S k to formally represent the discrete logarithms of M j,i and σ i in basis g, and g k in basis g 0 = g. As usual, any new element can be seen as a multivariate polynomial in these variables, of degree maximal 2 (when there is a mix between G 1 and G 2 group elements). If two elements correspond to the same polynomial, they are definitely equal, and the simulator will provide the same representation. If two elements correspond to different polynomials, the simulator will provide random independent representations. The view of the adversary remains unchanged unless the actual instantiations would make the representations equal: they would be equal with probability at most 2/p, when the variables are set to random values. After N combination queries, we have at most N 2 /2 pairs of different polynomials that might lead to a collision for a random setting with probability less than N 2 /p. Excluding such collisions, we can thus consider the polynomial representations only, denoted ∼. Then, for the output (M = (M k ) k , σ), one knows α k,j,i , β k,j , γ i,j , δ j , such that:

M k ∼ j,i α k,j,i X j,i + j β k,j V j σ ∼ j,i γ j,i X j,i + j δ j V j .
As ((M j,i ) i , σ j ) j and ((M k ) k , σ), are valid input and output pairs, we have the following relations between polynomials:

V j = i X j,i S i j,i γ j,i X j,i + j δ j V j = k   j,i α k,j,i X j,i + j β k,j V j   S k = k,j,i α k,j,i X j,i S k + k,j β k,j V j S k
Hence, the two polynomials are equal:

j,i γ j,i X j,i + j,i (δ j -α i,j,i )X j,i S i = k =i,j,i α k,j,i X j,i S k + k,j β k,j V j S k
which leads, for all i, j, to γ j,i = 0 and δ j = α i,j,i , and for k = i, α k,j,i = 0 and β k,j = 0. Hence,

M k ∼ j δ j X j,k and σ ∼ j δ j V j , which means that we have (δ j ) j such that M k = j M δ j j,k and σ = j σ δ j j .

FSH LH-Sign Scheme

In [START_REF] Libert | Linearly homomorphic structure-preserving signatures and their applications[END_REF], the authors proposed a full-fledged LH-Sign by adding a public tag during the signature. In our constructions, tags will be related to identities of users, and so, some kind of randomizability will be required for anonymity, which is not possible with their scheme. Instead, we will consider the scheme proposed in [START_REF] Fuchsbauer | Structure-preserving signatures on equivalence classes and constant-size anonymous credentials[END_REF], which is a full-fledged LH-Sign version of our previous scheme. We can describe it as follows, using our notations:

FSH LH-Sign Scheme Setup(1 κ ): Given a security parameter κ, let (G 1 , G 2 , G T , p, g, g, e) be an asymmetric bilinear setting, where g and g are random generators of G 1 and G 2 respectively. The set of tags is T = G 1 × G 2 . We then define param = (G 1 , G 2 , G T , p, g, g, e; T ); SKeygen(param, n): Given the public parameters param, one randomly chooses sk i = s i $ ← Z p , for i = 1, . . . , n, which defines the signing key sk = (sk i ) i , and the verification key vk = (g i ) n i=0 for g i = g s i and g 0 = g; NewTag(sk): It chooses a random scalar R $ ← Z p and sets τ = (τ 1 = g 1/R , τ 2 = g 1/R 0 ) and τ = R; VerifTag(vk, τ ): Given a verification key vk = (g i ) n i=0 and a tag τ = (τ 1 , τ 2 ), it checks whether e(τ 1 , g 0 ) = e(g, τ 2 ) holds or not; Sign(sk, τ , M = (M i ) i ): Given a signing key sk = (s i ) i and a vector-message M = (M i ) i ∈

G n 1 , together with some secret tag τ , one sets σ = ( i M s i i ) τ ;

MultiplySign(vk, τ, (ω i , M i , σ i ) i=1 ): Given a verification key vk, a tag τ and tuples of weights ω i ∈ Z p and signed messages M i in σ i , it outputs σ = σ ω i i ;

VerifSign(vk, τ, M = (M i ) i , σ): Given a verification key vk = (g i ) i , a vector-message M = (M i ) i , and a signature σ under the tag τ = (τ 1 , τ 2 ), one checks if the equalities e(σ, τ 2 ) = n i=1 e(M i , g i ) and e(τ 1 , g 0 ) = e(g, τ 2 ) hold or not.

When the secret keys for tags are all privately and randomly chosen, independently for each signature, unforgeability has been proven in [START_REF] Fuchsbauer | Structure-preserving signatures on equivalence classes and constant-size anonymous credentials[END_REF], under Chosen-Message Attacks, in the generic bilinear group model. The intuition is the following: first, under the Knowledge of Exponent Assumption [Dam92, HT98, Gro10], from a new pair (τ 1 , τ 2 ), on the input of either (g, g) or any other honestly generated pair (g, g 0 ), one can extract the common exponent 1/R in the two components. Then, one can see σ as the signature with the secret key (Rs i ) i , with the generator g 1/R 0 , instead of g 0 in the previous construction. However, if one knows two signatures σ and σ on M and M respectively, under the same tag τ = (τ 1 , τ 2 ) with private key τ , and the same key vk, then σ α σ β is a valid signature of M α M β , still under the same tag τ and the same key vk: this is thus a LH-Sign, where one can control the families of messages that can be combined.

Our LH-Sign has the tag randomizability property, with the algorithm RandTag defined by: RandTag(vk, τ, M , σ): Given a verification key vk, a tag τ = (τ 1 , τ 2 ) and a signature σ on a vector-message

M = (M i ) i ∈ G n 1 , it chooses µ ∈ Z * p and outputs τ = (τ 1/µ 1 , τ 1/µ
2 ) and adapts σ = σ µ . Indeed, from a signature σ on M under the tag τ = (τ 1 , τ 2 ) for the key vk, σ = σ µ is a new signature on M for the same key vk under the tag τ = (τ

1/µ 1 , τ 1/µ
2 ), perfectly unlinkable to τ , as this is a new random Diffie-Hellman tuple in basis (g, g 0 ) with τ = µτ , for g 0 in vk.

As already explained above, we will essentially work on sub-vector spaces of dimension 2: we will thus denote σ = (σ 1 , σ 2 ) = Sign(sk, τ , (M , M )), under the tag τ = (τ 1 , τ 2 ), where σ 1 = Sign(sk, τ , M ) and σ 2 = Sign(sk, τ , M ), for a common private key R = τ which led to τ = (τ 1 , τ 2 ).

Square Diffie-Hellman

This section is a preamble to the next one in which we will propose a new construction of LH-Sign scheme. We define here the useful building blocks: the Square Diffie-Hellman tuples, an extractability assumption that holds in the generic bilinear group model and two important theorems using Square Diffie-Hellman tuples.

Assumptions

We first begin be presenting the needed assumptions:

Definition 32 -Square Discrete Logarithm (SDL) Assumption In a group G of prime order p, it states that for any generator g, given y = g x and z = g x 2 , it is computationally hard to recover x.

Definition 33 -Decisional Square Diffie-Hellman (DSqDH) Assumption In a group G of prime order p, it states that for any generator g, the two following distributions are computationally indistinguishable:

D sqdh (g) = {(g, g x , g x 2 ), x $ ← Z p } D 3 $ (g) = {(g, g x , g y ), x, y $ ← Z p }.
It is worth noticing that the DSqDH Assumption implies the SDL Assumption: if one can break SDL, from g, g x , g x 2 , one can compute x and thus break DSqDH.

A fortiori, this implies indistinguishability between the two distributions

D sqdh (G) = {(g, g x , g x 2 ), g $ ← G, x $ ← Z p } D 3 $ (G) = {(g 1 , g 2 , g 3 ) $ ← G 3 }.
Below, for proofs, we will need to explicitly extract linear combinations, hence the additional assumption that holds in the generic bilinear group model:

Definition 34 -Extractability Assumption

The extractability assumption states that given n vectors (M j = (M j,i ) i ) j , for any adversary that produces a new vector M = (M i ) i such that M = j M α j j , there exists an extractor that outputs (α j ) j .

Proof for Square Diffie-Hellman Tuples

As an SqDH-tuple

(τ 1 = h, τ 2 = h τ , τ 3 = h τ 2 ) ∈ G 3
1 is a Diffie-Hellman tuple (τ 1 , τ 2 , τ 2 , τ 3 ), one can use a Schnorr-like proof:

• The prover chooses a random scalar r $ ← Z p , and sets and sends U ← τ r 1 , V ← τ r 2 ;

• The verifier chooses a random challenge e $ ← {0, 1} κ ;

• The prover sends back the response s = eτ + r mod p;

• The verifier checks whether both τ s 1 = τ e 2 × U and τ s 2 = τ e 3 × V .

This provides an interactive zero-knowledge proof of knowledge of the witness τ that (τ 1 , τ 2 , τ 3 ) is an SqDH-tuple.

Groth-Sahai Proof for Square Diffie-Hellman Tuples. If you just need a proof of validity of the tuple, this is possible, using the Groth-Sahai methodology [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF], to provide a noninteractive proof of Square Diffie-Hellman tuple: in the asymmetric pairing setting, one sets a reference string

(v 1,1 , v 1,2 , v 2,1 , v 2,2 ) ∈ G 4 2 , such that (v 1,1 , v 1,2 , v 2,1 , v 2,2
) is a Diffie-Hellman tuple. Given a Square Diffie-Hellman tuple (τ

1 = h, τ 2 = h τ , τ 3 = h τ 2 ) ∈ G 3 1 , one first commits τ : Com = (c = v τ 2,1 v µ 1,1 , d = v τ 2,2 g τ v µ 1,2
), for a random µ $ ← Z p , and one sets π 1 = τ µ 1 and π 2 = τ µ 2 , which satisfy

e(τ 1 , c) = e(τ 2 , v 2,1 ) • e(π 1 , v 1,1 ) e(τ 1 , d) = e(τ 2 , v 2,2 • g) • e(π 1 , v 1,2 ) e(τ 2 , c) = e(τ 3 , v 2,1 ) • e(π 2 , v 1,1 ) e(τ 2 , d) = e(τ 3 , v 2,2 • g) • e(π 2 , v 1,2 )
The proof proof = (c, d, π 1 , π 2 ), when it satisfies the above relations, guarantees that (τ 1 , τ 2 , τ 3 ) is a Square Diffie-Hellman tuple. This proof is furthermore zero-knowledge, under the DDH assumption in G 2 : by switching

(v 1,1 , v 1,2 , v 2,1 , g × v 2,2
) into a Diffie-Hellman tuple, one can simulate the proof using the trapdoor in the reference string. Moreover, one can apply a batch verification [BFI + 10], and pack them in a unique one with random scalars

x 1,1 , x 1,2 , x 2,1 , x 2,2 $ ← Z p : e(τ x 2,1 1 τ x 2,2 2 , c x 1,1 d x 1,2 ) = e(τ x 2,1 2 τ x 2,2 3 , v x 1,1 2,1 v x 1,2 2,2 g x 1,2 ) × e(π x 2,1 1 π x 2,2 2 , v x 1,1 1,1 v x 1,2 1,2 )
One thus just has to compute 13 exponentiations and 3 pairing evaluations for the verification, instead of 12 pairing evaluations.

In addition, the proof can be updated using ρ τ →τ such that τ = τ ρ τ →τ and randomized using

µ $ ← Z p : Com = (c = c • v µ 1,1 , d = d • v µ 1,2 ), in addition π 1 = π ρ τ →τ 1 • τ 1 µ and π 2 = π ρ τ →τ 2 • τ 2 µ .

Restricted Combinations of Vectors

When one wants to avoid any combination, and just allow to convert a signature of M into a signature of M α , while they are all of the same format, one can use expanded vectors (as in Section 4.1), by concatenating a vector that satisfies this restriction: from multiple distinct (non-trivial) Square Diffie-Hellman tuples (g i , g w i i , g

w 2 i i
), a linear combination that is also a Square Diffie-Hellman tuple cannot use more than one input tuple. We prove it in two different cases: with random and independent bases g i , but possibly public w i 's, or with a common basis g i = g, but secret w i 's.

We stress that in the first theorem, the w i 's are random and public (assumed distinct), but the bases g i 's are truly randomly and independently generated.

Theorem 35. Given n valid Square Diffie-Hellman tuples

(g i , a i = g w i i , b i = a w i i ), with w i , for random g i $ ← G * and w i $ ← Z * p , outputting (α i ) i=1,...,n such that (G = g α i i , A = a α i i , B = b α i i
) is a valid Square Diffie-Hellman, with at least two non-zero coefficients α i , is computationally hard under the DL assumption.

Intuitively, from Square Diffie-Hellman tuples where the exponents are known but random and the bases are also known and random, it is impossible to construct a new Square Diffie-Hellman tuple melting the exponents.

Proof. Up to a guess, which is correct with probability greater than 1/n 2 , we can assume that α 1 , α 2 = 0. We are given a discrete logarithm challenge Z, in basis g. We will embed it in either g 1 or g 2 , by randomly choosing a bit b: Proof of the lemma. Up to a guess, which is correct with probability greater than 1/n, we can assume that α 1 = 0. We are given a square discrete logarithm challenge (g, Z 1 = g z , Z 2 = g z 2 ), in basis g. We set a 1 ← Z 1 , b 1 ← Z 2 , and randomly choose w i $ ← Z p , for i = 2, . . . , n to set (a i ← g w i , b i ← a w i i ). We then output (g, a i , b i ), i = 1, . . . , n, to the adversary which outputs (α i ) i=1,...,n and α such that α 1 z + n i=2 α i w i = α. At this stage, we solve the square discrete logarithm problem by returning z = (αn i=2 α i w i )/α 1 mod p.

• if b = 0: set X = Z,
Proof of the theorem. Again, up to a guess, which is correct with probability greater than 1/n, we can assume that α 1 = 0. We are given a square discrete logarithm challenge (g, Z 1 = g z , Z 2 = g z 2 ), in basis g. We set a 1 ← Z 1 , a 2 ← Z 2 , and randomly choose w i $ ← Z p , for i = 2, . . . , n to set (a i ← g w i , b i = a w i i ). We then output (g, a i , b i ), i = 2, . . . , n, to the adversary that outputs

(α i ) i=1,...,n such that (G = g α i , A = a α i i = G w , B = b α i i = A w )
for some unknown w. We thus have the following relations:

n i=1 α i • w = α 1 z + n i=2 α i w i n i=1 α i • w 2 = α 1 z 2 + n i=2 α i w 2 i which leads to α 1 z + n i=2 α i w i 2 = α 1 + n i=2 α i × α 1 z 2 + n i=2 α i w 2 i .
If we denote T = n i=2 α i w i , U = n i=2 α i , and V = n i=2 α i w 2 i , that can be computed from above scalars, we have (α

1 z + T ) 2 = (α 1 + U ) • (α 1 z 2 + V ),

and thus

U α 1 z 2 -2T α 1 z + (α 1 + U )V -T 2 = 0 mod p.
Using Lemma 37 on the n -1 tuples (g, a i , b i ), for i = 2, . . . , n, the probability that T = n i=2 α i w i = 0 is negligible, unless one can break the SDL Assumption. So we have T = 0, with two cases:

1. If U = 0 then, because computing square roots in Z p is easy, one can solve the above quadratic equation for z that admits solutions, and obtain two solutions for z. By testing which one satisfies g z = Z 1 , one can find out the correct z and thus solve the SDL problem.

2. If U = 0, one can compute z = (α 1 V -T 2 )/(2T α 1 ) mod p and thus solve the SDL problem.

Randomizable Tags

As in the Definition 27, we can randomize the tags together with the messages: but just in a computational way, and not in a statistical way. Indeed, from a message-signature (M , σ) for a tag τ = (τ 1 , τ 2 , τ 3 , π), one can derive the signature for the message M = M α for the tag τ = (τ α 1 , τ α 2 , τ α 3 , π ), where π can be adapted from π and α. The triple (τ α 1 , τ α 2 , τ α 3 ) in the tag is not uniformly random, as w has not changed, but it is computationally unlinkable to (τ 1 , τ 2 , τ 3 ) under the DDH assumption.

SqDH LH-Sign Scheme

In this section, we provide a generic transformation to convert a OT-LH-Sign to LH-Sign, using Square Diffie-Hellman tuples (g, g w i , g w 2 i ) for the tags. We thus obtain a new construction of linearly homomorphic signature with randomizable tags.

A First Generic Conversion

First Generic Conversion from OT-LH-Sign to LH-Sign Let Σ = (Setup, SKeygen, Sign, MultiplySign, VerifSign) be a OT-LH-Sign, we complete it into Σ = (Setup , SKeygen , NewTag , VerifTag , Sign , MultiplySign , VerifSign ) as follows:

Setup

MultiplySign (vk, τ, {ω i , M i , σ i } i=1 ): It simply computes σ = i σ ω i i and τ = (w, h = i h ω i );
VerifSign (vk, τ = (w, h), M , σ): It first extends M into M with the Square Diffie-Hellman tuple (h, h w , h w 2 ) and checks whether VerifSign(vk, M , σ) = 1 or not.

One can note that the MultiplySign provides a signature under a new tag τ , but this is still consistent with the definition of the LH-Sign. However, randomizability of the tag is not possible.

Theorem 38. If Σ is OT-LH-Sign then Σ is LH-Sign under the DL assumption and the extractability assumption (Definition 34).

Proof. Since the tags are fully public, any NewTag -query is answered by a random pair (w i , g i ), and a Sign -query is answered by simply forwarding a Sign-query to the Σ security game. Receiving the forgery (vk, τ = (w, G), M , σ), one first generates M from M and τ and checks the validity, which means, according to the unforgeability of Σ, that there exist (α i ) i such that M = M i α i . The above extractability assumption provides these coefficients (α i ) i . If we just keep the 3 last components of each extended messages and the tags, we have square Diffie-Hellman triples (g i , a i = g w i i , b i = a w i i ) i , for random g i and w i (but possibly equal when the same tag is used several times), and the triple (G = g α i i , A = G w = a α i i , B = A w = b α i i ) extracted from the forgery. By combining the identical tags together, and so by summing in β j the α i 's that correspond to the same triples (g i , a i , b i ), we have (G = g

β j j , A = G w = a β j j , B = A w = b β j j )
, for random and distinct triples (g j , a j , b j ) j . From Theorem 35, under the DL assumption, at most one coefficient is non-zero: none or β J , and so at most one tag is represented: none or (g J , a J , b J ). Hence M is either (1, . . . , 1) or

M α i i for i such that (g i , a i , b i ) = (g J , a J , b J ).

A Second Generic Conversion

Second Generic Conversion from OT-LH-Sign to LH-Sign Let Σ = (Setup, SKeygen, Sign, MultiplySign, VerifSign) be a OT-LH-Sign, we complete it into Σ = (Setup , SKeygen , NewTag , VerifTag , Sign , MultiplySign , VerifSign ) as follows:

Setup (1 κ ): It runs Setup(1 κ ) to obtain param and adds the tag space param = (param, G 3 × Π). Note that we need the group G to be extended to a bilinear setting (G, G 2 , G T , p, g, g, e) for the proofs;

SKeygen (param , n): It runs SKeygen(param, n + 3); NewTag (sk): It chooses a random scalar w $ ← Z * p and sets τ = w and τ = (g, g w , g w 2 , π), where π is a zero-knowledge proof of valid square Diffie-Hellman tuple for (g, g w , g w 2 ); VerifTag (vk, τ ): It checks the proof π on (g, g w , g w 2 ); Sign (sk, τ = w, M ): It extends M into M with the three additional components (g, g w , g w 2 ), and signs it as σ = Sign(sk, M );

MultiplySign (vk, τ = (τ 1 , τ 2 , τ 3 , π), {ω i , M i , σ i } i=1 ): It computes σ = i σ ω i i , ω = i ω i and τ = (τ 1 , τ ω 2 , τ ω 3 , π
) with π the updated proof of valid square Diffie-Hellman tuple;

VerifSign (vk, τ = (τ 1 , τ 2 , τ 3 , π), M , σ): It first checks whether VerifTag (vk, τ ) = 1 or not, if the tag is valid, it extends M into M with τ and checks whether VerifSign(vk, M , σ) = 1 or not.

Note that for the MultiplySign to be possible, one needs an homomorphic zero-knowledge proof of valid square Diffie-Hellman tuple, as the Groth-Sahai techniques [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF] allow in a bilinear setting: let

(v 1,1 , v 1,2 , v 2,1 , v 2,2 ) ∈ G 4
2 be a Diffie-Hellman tuple, for a Square Diffie-Hellman tuple (g,

A = g w , B = A w ) ∈ G 3 one can generate a commitment of w, Com = (c = v w 2,1 v µ 1,1 , d = v w 2,2 v µ 1,2 g w ) ∈ G 2 2
, and the proofs proof = (Θ = g µ , Ψ = A µ ) ∈ G 2 . The proof π thus consists of the pair (Com, proof), and is homomorphic. It is well-known to be perfectlysound, and for the zero-knowledge property, one just has to switch from the Diffie-Hellman tuple

(v 1,1 , v 1,2 , v 2,1 , v 2,2 ) to a random tuple (v 1,1 , v 1,2 , v 2,1 , v 2,2
) because they are computationally indistinguishable under the DDH assumption in G 2 , or statistically indistinguishable in the generic group model. The latter assumption will be required for the security analysis below.

Theorem 39. If Σ is OT-LH-Sign then Σ is LH-Sign, in the generic group model.

Proof. Let us consider an adversary that asks several tags (τ i ) i and signatures (σ i ) i on messages (M i ) i and tags of its choice, and eventually produces a forgery (τ, M , σ) with probability ε. A forgery means that • the tag is valid, and so the proof π is accepted;

• the signature is valid;

• M is not in the spans of the messages signed under the same tag.

First, as the signature Σ is based on the OT-LH-Sign Σ thanks to the concatenation of the message and (τ 1 , τ 2 , τ 3 ) in the tags, we know that necessarily M (the completion of M with the triple in the tag) is a linear combination of the extended messages involved in the signing queries, unless one has broken the unforgeability of Σ, which can just happen with negligible probability.

As a consequence, the triple (τ 1 , τ 2 , τ 3 ) in the tag of the forgery is a linear combination of the Square Diffie-Hellman triples in the signing queries, with probability ε = ε -negl():

• either (τ 1 , τ 2 , τ 3 ) is not a Square Diffie-Hellman tuple;

• or (τ 1 , τ 2 , τ 3 ) is a Square Diffie-Hellman tuple.

In the former case, where (τ 1 , τ 2 , τ 3 ) is not a Square Diffie-Hellman tuple, then we break the perfect soundness of Groth-Sahai proofs, as all the proofs for the honest tags have been generated honestly. Hence, the latter case should happen with probability greater than ε" = ε -negl(): (τ 1 , τ 2 , τ 3 ) is both a linear combination of the input triples but still a Square Diffie-Hellman tuple, with probability greater than ε . Then, the Theorem 36 shows that (τ 1 , τ 2 , τ 3 ) is one of the input triples to a power α (or possibly (1, 1, 1)). However, to apply this theorem, we are given random Square Diffie-Hellman tuples as input and we should be able to generate the proofs of validity. To this aim, we switch the Groth-Sahai proofs in perfectly hiding mode: we replace a Non Diffie-Hellman tuple by a Diffie-Hellman tuple in the CRS, which is statistically indistinguishable to a generic adversary, as its probability to make the difference is N/p 2 , where N is the number of group operations. So after this switch, from a list of Square Diffie-Hellman tuples, we simulate the proofs, and the adversary outputs a tuple (τ 1 , τ 2 , τ 3 ) that is both a linear combination of the input triples but still a Square Diffie-Hellman tuple, with probability greater than ε -N/p 2 . As we are considering a forgery, several tags should be involved, which is excluded by the Theorem 36: ε is negligible, and so ε is negligible too.

Universal Tag

Whereas only messages signed under the same tag can be combined, a message signed under the tag τ 0 = (1, 1, 1, π), where π = (1, 1, 1) is a proof for w = 0 with µ = 0 in the commitment Com, can be combined with any message. Such a tag (1, 1, 1, π), which was not in T , is a universal tag. Indeed, multiplied to any Square Diffie-Hellman tuple, this is still a Square Diffie-Hellman tuple. This does not contradict the Theorems 35 and 36, as they only deal with non-trivial Square Diffie-Hellman triples. MixNet This chapter is based on the paper [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF] In the two main techniques of Mix-Networks, Furukawa and Sako [START_REF] Furukawa | An efficient scheme for proving a shuffle[END_REF] make proofs of permutation matrices and Neff [START_REF] Krawczyk | A verifiable secret shuffle and its application to e-voting[END_REF] considers polynomials which remain identical with a permutation of the roots. The former approach with proof of permutation matrices is more classical, with many candidates. Groth and Lu [START_REF] Groth | A non-interactive shuffle with pairing based verifiability[END_REF] proposed the first non-interactive zero-knowledge (NIZK) proof of shuffle without random oracles, using Groth-Sahai proofs with pairings [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF] but under an hypothesis proven in the generic bilinear group model. Even with that, computations are still very expensive because the overhead proof is linear in N n, where n is the number of ciphertexts and N the number of mixing rounds. In addition, they needed a Common Reference String (CRS) linear in n. More recently, Fauzi et al. [START_REF] Fauzi | An efficient pairingbased shuffle argument[END_REF] proposed a new pairing-based NIZK shuffle argument to improve the computation for both the prover and the verifier, and improved the soundness of the protocol. However they still had a CRS linear in the number of ciphertexts, and the soundness holds in the generic bilinear group model.

In this chapter we apply the construction of OT-LH-Sign and LH-Sign seen in the previous chapter to build a new mix-network. In our shuffle, each ciphertext C i (encrypted vote in the ballot, in the context of electronic voting) is signed by its sender and the mix-server randomizes the ciphertexts {C i } and permutes them into the set {C i } in a provable way. The goal of the proof is to show the existence of a permutation Π from {C i } to {C i } such that for every i, C Π(i) is a randomization of C i . Then, the output ciphertexts can be mixed again by another mix-server. The unforgeability of the signature schemes will essentially provide the soundness of the proof of correct mixing: only permutations of ballots will be possible.

In a first step, we provide a high-level description of our construction to give the intuitions of our new method. However, this high-level presentation suffers several issues which are detailed. Then, the second section 5.2 provides the solutions with the full scheme. At this point, the global proof of mixing, after several mix-servers, is linear (and verification thus has a linear cost) in the number of mix-servers. Therefore in a third step 5.3, we explain how to obtain a constant-time overhead for the proof to publish, and thus for the verification. We detail the security analysis in Section 5.4 with the three parts: soundness, unlinkability and correctness. Eventually, we conclude with some applications in Section 5.5.

Our Scheme: General Description

We first provide a high-level description of our mix-net in Figure 5.1. As said above, the goal of this presentation is just for the intuition: there are still many problems, that will be highlighted and addressed in the next sections. We need two signature schemes:

• any OT-LH-Sign scheme (Setup,Keygen,Sign,MultiplySign,VerifSign), with additional MultiplyKey, that will be used to sign ElGamal ciphertexts in G 1 : the ciphertexts C i and the signatures σ i belong to G 1 and are verified with the user' verification keys vk i = (g k ) k in G 2 ;

• and any LH-Sign with randomizable tag scheme (Setup

U i generates:      C i ← Encrypt(EK, M i ) User's ballot encryption σ i,0 ← Sign(sk i , C 0 ) User's signature on randomization σ i,1 ← Sign(sk i , C i ) User's ballot signature BBox (0) = (C i , σ i,0 , σ i,1 , vk i , Σ i , τ i ) i Mix (j-th mix-server, for i = 1, . . . , n) From BBox (j-1) = (C i , σ i,0 , σ i,1 , vk i , Σ i , τ i ) i , S j makes,

for all i:

Randomization of the ballot:

C i = C i • C 0 γ j,i σ * i,1 = MultiplySign(vk i , {(γ j,i , C 0 , σ i,0 ), (1, C i , σ i,1
)}) Randomization of the keys: Each user U i generates a pair (sk i , vk i ) ← Keygen() to sign vectors in G 1 . U i first encrypts his message M i under an ElGamal encryption scheme, with encryption key EK and signs it to obtain the signed-encrypted ballot (C i , σ i,1 ) under vk i . Obviously, some guarantees are needed.

vk i = (vk i ) α j Σ * i = MultiplySign * (VK, τ i , (α j , vk i , Σ i )) (VK, τ i , vk i , Σ i ) = RandTag * (VK, τ i , vk i , Σ * i ) Adaptation of the signatures: σ i,0 = MultiplyKey(C 0 , (α j , vk i , σ i,0 )) σ i,1 = MultiplyKey(C 1 , (α j , vk i , σ * i,1 )) BBox (j) = (C Π(i) , σ Π(i),0 , σ Π(i),1 , vk Π(i) , Σ Π(i) , τ Π(i) ) i
In order to be sure that a ballot is legitimate, all the verification keys must be certified by the system (certification authority CA) that signs vk i under SK, where (SK, VK) ← Keygen * (), into Σ i . Then, anyone can verify the certified keys (vk i , Σ i ) i are valid under the system verification key VK. Since we want to avoid combinations between verification keys, we use LH-Sign with randomizable tags to sign the verification keys with a tag τ i per user U i .

Because of encryption, M i is protected, but this is not enough as it will be decrypted in the end. One also needs to guarantee unlinkability between the input and output ballots to guarantee anonymity of users. As the ballot boxes contain the ciphertexts, as well as the verification keys, the ballots must be transformed in an unlinkable way, then they can be output in a permuted way.

To have C i unlinkable to C i , C i must be a randomization of C i . With an ElGamal encryption, it is possible to randomize a ciphertext by multiplying by an encryption of 1. Thus, anyone can compute an encryption C 0 of 1, and as we use an OT-LH-Sign scheme, from a signature σ i,0 of C 0 under the user's key, one can adapt σ i,1 by using the message homomorphism (Property 26) with MultiplySign to obtain σ * i,1 . In the same way, vk i and τ i must be randomizations of respectively vk i and τ i . If vk i = vk α i , its signature must be derived from Σ i with MultiplySign * and τ i is obtained with the randomizable tag (Property 27) with RandTag * . Eventually, as we change the verification key, σ i,0 and σ i,1 must be adapted, which is possible thanks to the weak key homomorphism (Property 30) with MultiplyKey.

Then one generates a random permutation Π to output a new ballot-box with permuted randomized ballots (vk

Π(i) , Σ Π(i) , C Π(i) , σ Π(i),0 , σ Π(i),1 ) i .

Difficulties

The above high-level scheme gives intuitions of our main approach. However, to get the required security, we still face a few issues that will be explained below and which motivate the full scheme described in the next section.

Expanded Vectors. From the signatures σ i,0 and σ i,1 with an OT-LH-Sign scheme, anyone can compute σ = MultiplySign(vk i , {(α, C 0 , σ i,0 ), (β, C i , σ i,1 )}) for any α, β. As explained in Section 4.1, we can impose β = 1 and the right format of C i .

Non-Trivial Transformation. The weak key homomorphism allows to randomize vk i into vk i = vk α i but, with our scheme, VerifSign(vk α i , C i , σ i,1 ) is valid for any α = 0 if and only if VerifSign(vk i , C i , σ i,1 ) is valid. This provides a link between vk i and vk i . To solve this issue, we introduce a randomizer vk 0 , as for the ciphertext. This is a special vector also signed by CA to randomize vk i in a non-trivial way: vk i = (vk i • vk δ i 0 ) α . We will thus also have the signature Σ i,0 of vk 0 and the signature Σ i,1 (instead of Σ i ) of vk i , both under the same tag τ i to allow combinations.

Legitimate Ballots. Whereas all the ballots must be signed, nothing prevents a mix-server from deleting a ballot or from adding a ballot signed by a legitimate user (that owns a valid key vk i ). If one first checks that the number of ballots is kept unchanged, it is still possible that a ballot is replaced by a new legitimate ballot. Since we will consider honest and corrupted users (and so honest and corrupted ballots), four cases are possible: one replaces an honest or corrupted ballot by another honest or corrupted one. Our scheme will not provide guarantees against the replacement of a corrupted ballot by another corrupted ballot. Nonetheless, by adding a zero-knowledge proof of Diffie-Hellman tuple between the products of the verification keys before and after the mix, we can avoid all the other cases involving honest users.

Multiple Servers. After the last round, one gets a proof that the output ballot-box contains a permutation of randomized ciphertexts from the input ballot-box. However, the last mixserver could start from the initial ballot-box instead of the previous one, and then know the permutation. This would break anonymity, as soon as the last mix-server is dishonest. We will ask the mix-servers to sign their contributions to prove the multiple and independent permutations: each mix-server j generates the Diffie-Hellman proofs from BBox (j-1) to BBox (j) , and signs them. We will then detail this solution in the next section, which will provide a proof linear in the number of ballots and in the number of mix-servers (because of the multiple signature). Thereafter, with specific multi-signature, one can become independent of the number of mix-servers.

Our Scheme: Full Description

With all the previous remarks and explanations, we can now provide the full description of our scheme which is given in Figure 5.2.

Keys. As we will sign expanded ciphertexts of dimension 4 (see below), each user needs a secret-verification key pair (sk i , vk i ) ← Keygen(param, 4) in Z 4 p × G 5 2 . With our OT-LH-Sign, the first element of vk i is common for all the users and initialized to g 0 = g. Then, one also needs a signature Σ i = (Σ i,0 , Σ i,1 ) with our LH-Sign from the certification authority of the pair (vk 0 , vk i ) where vk 0 = (1, 1, g 0 , 1, 1) is used to make the non-trivial transformation on vk i during the mixes. This signature is signed by the authority possessing (SK, VK) ← Keygen * (param , 5) in Z 5 p × G 6 1 with a specific tag τ i per user. Eventually, each mix-server has a pair of (standard) signature scheme (SK j , VK j ) ← SKeygen() just to sign with SSign its mixing contribution. The keys VK and (VK j ) j , as well as EK = h = g d ∈ G 1 and the random $ ← G 1 , are assumed to be known to everybody.

As we are using El Gamal ciphertexts, the ciphertext for randomization is C 0 = (g, h), the trivial encryption of 1 = g 0 , with random coin equal to 1.

Initial ballots. Each user encrypts his message M

i under EK to obtain C i = (a i , b i ).
With the remarks we already made, one needs to expand ,g,h). The addition of the first element is due to the affine space we want in the signature σ i (see Section 4.1) and the second element is because we randomize the third position of vk i with vk 0 = (1, 1, g 0 , 1, 1) and because the first position of vk i is used for the verification but not to sign (the last four elements of vk i are used to sign). Finally, σ i = (σ i,0 , σ i,1 ) is simply the OT-LH-Sign of (C 0 , C i ) under the signing key sk i .

C i into C i = (g, i , a i , b i ) and C 0 into C 0 = (1,

Mix.

To make a mix, the j-th mix-server computes the randomized verification keys

vk i = (vk i • vk δ i 0 ) α , the randomized ciphertexts C i = C i • C γ i
0 and the randomized tags

τ i = τ 1/µ i i
, and updates the signatures σ i and Σ i , thanks to the properties of the signatures. The random scalar α is common to all the ballots, but γ i , δ i , µ i are independent random scalars for each ballot. Then, the mix-server chooses a permutation Π and sets the j-th ballot-box BBox (j) with all the randomized and permuted ballots (C Π(i) , Π(i) , σ Π(i) , vk Π(i) , Σ Π(i) , τ Π(i) ) i . As already explained, the mix-server also needs to make a proof proof (j) from BBox (j-1) to BBox (j) , to guarantee the proper relations between the products of the verification keys and the products of the messages, and signs it in sig (j) . Finally, the output of the mix contains BBox (j) and (proof (k) , sig (k) ) j k=1 the set of proofs and mix-server signatures of the previous mixes until the j-th mix.

CA = Certificate Authority, U i = User i , S j = Mix-Server j MixSetup(1 κ ): Let param = (G 1 , G 2 , G T , p, g, g, e) ← Setup(1 κ ) and param = {param, T = G 2 × G 1 }; Let NIZK DH -param ← NIZK DH -Setup(1 κ ) and Sparam ← SSetup(1 κ ); Let (DK = d, EK = h = g d ) ← EKeygen(1 κ ) and C 0 = (1, , g, h) for $ ← G 1 ; It outputs Mix-param = (param , NIZK DH -param, Sparam, EK, ).

MixKeygen(Mix-param):

CA: SK= (S 1 , S 2 , S 3 , S 4 , S 5 ) $ ← Z 5 p , VK = (g, g S 1 , g S 2 , g S 3 , g S 4 , g S 5 ) and for each user

U i , τi = R i $ ← Z p , τ i = (τ i,1 = g 1/R i , τ i,2 = g 1/R i ) vk 0 = (1, 1, g 0 = g, 1, 1) S j : { (SK j , VK j ) ← SKeygen() U i : sk i = (u i , v i , x i , y i ) $ ← Z 4 p , vk i = (g 0 = g, f i = g u i 0 , l i = g v i 0 , g i = g x i 0 , h i = g y i 0 ) Σ i = Σ i,0 = g S 3 τi , Σ i,1 = (g S 1 0 f S 2 i l S 3 i g S 4 i h S 5 i ) τi MixInit(sk i , M i , vk i , Σ i , τ i ): U i chooses r i $ ← Z p and i $ ← G 1 and computes C i = (a i = g r i , b i = h r i M i ) C i = (g, i , a i , b i ) σ i = (σ i,0 = v i g x i h y i , σ i,1 = g u i v i i a x i i b y i i ) It outputs B i = (C i , i , σ i , vk i , Σ i , τ i ). BBox (0) = (B i ) N i=1 Mix(SK j , BBox (j-1) , (proof (k) , sig (k) ) j-1 k=1 , Π j ): From BBox (j-1) = (C i , i , σ i , vk i , Σ i , τ i ) i , (proof (k) , sig (k) ) j-1 k=1 , S j chooses α $
← Z p and for each ballot i, γ i , δ i , µ i $ ← Z p and computes MixVerif(BBox (0) , BBox (N ) , (proof (k) , sig (k) ) N k=1 ) : After N mixes, the input of the verifier is: and F = f i = g 0 u i the product of the second element of the user's verification key on all the input ballots and output ballots. If the input and output ballot-boxes contain the same ballots (with the same secret u i ), then F = F α , with g 0 = g α 0 . Hence one adds a proof of Diffie-Hellman tuple for (g 0 , g 0 , F, F ) as described in Preliminaries 2.4.3. Together with the verification that there is the same number of ballots in the input and output of the mix, we will show that the same (honest) users are represented in the two ballot-boxes. Since we cannot allow multiple ballots from the same user, we have the guarantee that the same messages from all the honest users are represented in the two ballot-boxes.

a i = a i • g γ i b i = b i • h γ i i = i • γ i σ i,1 = σ i,1 • σ γ i i,0 • i δ i σ i,0 = σ i,0 • δ i g 0 = g α 0 f i = f α i l i = (l i • g δ i 0 ) α g i = g α i h i = h α i Σ i,1 = (Σ i,1 • Σ i,0 δ i ) αµ i Σ i,0 = Σ αµ i i,0 τ i,1 = τ 1/µ i i,1 τ i,2 = τ 1/µ i i,2 proof (j) = NIZK DH -Proof((g 0 , g 0 , f i , f i ) ∧ (g, h, a i / a i , b i / b i )) sig (j) = SSign(SK j , proof (j) ) S j outputs BBox (j) = (C Π j (i) , Π j (i) , σ Π j (i) , vk Π j (i) , Σ Π j (i) , τ Π j (i) ) i ,(proof (k) , sig (k) ) j k=1
BBox (0) = (C i , σ i,1 , vk i , Σ i,1 , τ i,1 ) n i=1 BBox (N ) = (C i , σ i,1 , vk i , Σ i,1 , τ i,1 ) n i=1 , (proof (k) , sig (k) ) N k=1 It outputs 1 if: n = n , the (vk i ) i are all distinct ∀k, NIZK DH -Verif(proof (k) ) = 1 SVerif(VK k , proof (k) , sig (k) ) = 1 and ∀i, VerifSign(vk i , C i , σ i,1 ) = 1 = VerifSign * (VK, τ i , vk i , Σ i,1 ) VerifSign(vk i , C i , σ i,1 ) = 1 = VerifSign * (VK, τ i , vk i , Σ i,1 )
The additional proof of Diffie-Hellman tuple for (g, h, a i / a i , b i / b i ) will limit the exchange of ballots for corrupted users, as the products of the plaintexts must remain the same:

M i = M i . Since we already know these products will be the same for honest users, this products must be the same from corrupted users. This will limit the impact of the attack of Cortier-Smyth [START_REF] Cortier | Attacking and fixing helios: An analysis of ballot secrecy[END_REF].

With these two Diffie-Hellman proofs, the output ballots are a permutation of the input ones. We could use any non-interactive zero-knowledge proofs of Diffie-Hellman tuples (NIZK DH -Setup, NIZK DH -Proof, NIZK DH -Verif) and any signature (SSetup, SSign, SVerif) to sign the proofs but the next section will provide interesting choices, from the length point of view.

Verification. The complete verification process, after N mix-servers, is presented in Figure 5.3. After all the mixes are done, it just requires the input ballot-box BBox (0) , the output ballot-box BBox (N ) , and the signed proofs (proof (k) , sig (k) ), for k = 1, . . . , N without the elements that were useful for randomization only. The verifier checks the number of input ballots is the same as the number of output ballots, the verification keys (the f i 's) in input ballots are all distinct, the signatures σ i,1 , σ i,1 , Σ i,1 and Σ i,1 are valid on individual input and output tuples (equations recalled in 5.4) and all the proofs proof (k) with the signatures sig (k) are valid with NIZK DH -Verif and SVerif respectively. For that, we suppose that the statement is included in each zero-knowledge proof. Thus, even if the intermediate ballot-boxes are not given to the verifier, it is still possible to perform the verification.

Scalability

Constant-Size Proof

From Figure 5.3, one can note that our mix-net provides a quite compact proof, as it just requires BBox (0) and BBox (N ) , and the signed proofs (proof (k) , sig (k) ), for k = 1, . . . , N . The size is thus linear in n and N . This is the same for the verification complexity.

Whereas the linear complexity in n cannot be avoided, as the ballot-box must be transferred, the part linear in N could be avoided. Indeed, each proof proof (j) ensures the relations from the j -1-th ballot-box to the j-th ballot-box. The global chain of proofs ensures the relations from the initial ballot-box to the last ballot-box. From the soundness point on view, a compact global proof would be enough. But for privacy, one wants to be sure that multiple mix-servers contributed, to get unlinkability as soon as one server is honest.

To avoid the dependence in N , one can use Groth-Sahai proofs [GS08] (see 2.4.3 for details) to combine together the proofs into a unique one as already used in Chase et al. [START_REF] Chase | Malleable proof systems and applications[END_REF]. However, to be sure that all the mix-servers contributed: each mix-server does as above, but also receives a partial proof proof (j-1) from the initial ballot-box to the j -1-th ballot-box and, thanks to the homomorphic properties of the Groth-Sahai proof, updates it into proof (j) , to prove the relation from the initial ballot-box and the j-th ballot-box, as shown in 2.4.3 for the Diffie-Hellman proof between the products of the keys (the proof is similar for the product of the ciphertexts but with G 1 and G 2 swapped). At the end of the mixing steps, one has the same elements as above, plus the global proof proof (N ) . All the mix-servers can now verify the proofs and the contributions of all the servers. Only this global proof can be kept, but signed by all the servers: using the multi-signature of Boneh-Drijvers-Neven [START_REF] Boneh | Compact multi-signatures for smaller blockchains[END_REF], that is recalled in 2.4.2, the size of the signature msig keeps constant, whatever the number of mix-servers. Hence, after multiple mixing steps, the size of the mixing proof (with the input and output ballot-boxes) remains constant.

Efficiency

We consider VK and (VK j ) j are long-term keys known to everybody, as well as EK and . However, for fair comparison, we do not consider vk i as long-term keys, and consider them as part of the input of the verifier. But we insist that the f i 's in the input ballot-box must be all distinct.

Size of Verifier's Input:

The verifier receives:

(C i , σ i,1 , vk i , Σ i,1 , τ i ) n i=1 (C i , σ i,1 , vk i , Σ i,1 , τ i ) n i=1 (proof (N ) , msig (N ) )
As the first element g 0 of vk i is common to all the users (as well as g 0 of vk i ), the set of all the users' verification keys is represented by 4 × n + 1 elements of G 2 . Then, all input or output ballots contains 2 × 5n elements from G 1 and 2 × (6n + 1) elements from G 2 . The global proof proof (N ) is just 4 elements of G 1 and 4 elements of G 2 and msig one element in G 2 . Hence, the full verifier's input contains: 10n + 4 elements of G 1 , 12n + 6 elements of G 2 , whatever the number of mix-servers.

Verifier's Computation. Using batch verification [CHP07, BFI + 10, HHK + 17], the verifier only needs to make 8n + 7 pairing evaluations to verify together all the signatures σ i,1 , σ i,1 , Σ i,1 , Σ i,1 , τ i , τ i , 6 pairing evaluations to verify proof (N ) and 2 pairing evaluations to verify msig.

With some specific choices of the bases for the batch verification, as presented in Figure 5.4, one can improve to 8n + 14 pairing evaluations for the global verification. This has to be compared to the 4n + 1 pairing evaluations that have anyway to be performed to verify the signatures in the initial ballot-box.

σ i,0 1 = e(σ -1 i,0 , g 0 ) e(g, g i ) e(h, h i ) e( , l i ) σ i,0 1 = e(σ -1 i,0 , g 0 ) e(g, g i ) e(h, h i ) e( , l i ) Σ i,0 e(τ i,2 , Σ i,0 ) = e(g 3 , g 0 ) Σ i,0 e(τ i,2 , Σ i,0 ) = e(g 3 , g 0 ) σ i,1 e(σ i,1 , g 0 ) = e(g, f i ) e(a i , g i ) e(b i , h i ) e( i , l i ) 3n +2 σ i,1 e(σ i,1 , g 0 ) = e(g, f i ) e(a i , g i ) e(b i , h i ) e( i , l i ) +3n +1 τ i e(τ i,2 , g) = e(g, τ i,1 ) +0 τ i e(τ i,2 , g) = e(g, τ i,1 ) +0 Σ i,1 e(g 1 , g 0 ) e(τ i,2 , Σ i,1 ) = e(g 2 , f i ) e(g 3 , l i ) e(g 4 , g i ) e(g 5 , h i ) +n +4 Σ i,1 e(τ i,2 , Σ i,1 ) e(g -1 1 , g 0 ) = e(g 2 , f i ) e(g 3 , l i ) e(g 4 , g i ) e(g 5 , h i ) +n msig e(H 0 (proof (N ) ), avk) = e(g, msig) +1 proof (N ) with F = i f i ,F = i f i , A = i a i / a i and B = i b i / b i : e(c x 1,1 d x 1,2 , g x 2,1 F x 2,2 ) = e(v x 1,1 2,1 (v 2,2 • g) x 1,2 , g x 2,1 F x 2,2 )e(v x 1,1 1,1 v x 1,2 1,2 , Θ x 2,1 Ψ x 2,2 ) +3 e(g x 2,1 A x 2,2 , c x 1,1 d x 1,2 ) = e(g x 2,1 B x 2,2 , v x 1,1 2,1 (v 2,2 • g) x 1,2 )e(θ x 2,1 ψ x 2,2 , v x 1,1 1,1 v x 1,2 1,2 ) +3 = 8n +14
Figure 5.4: Verification Cost. One can remark that several pairings have common bases g, g 1 , g 2 , g 3 , g 4 , g 5 and g 0 = g, which can be combined together in order to decrease the number of pairings to be computed for the verification.

Security Analysis

Let us now formally prove the two security properties: the soundness means the output ballotbox contains a permutation of randomizations of the input ballot-box and privacy means one cannot link an input ciphertext to an output ciphertext, as soon as one mix-server is honest.

We stress that we are in a particular case where users have private signing keys, and ballots are signed. Unfortunately these keys allow to trace the ballots: with sk i = (u i , v i , x i , y i ) and g 0 , one can recover vk i , which contradicts privacy for this ballot. They might also allow to exchange some ballots, which contradicts soundness for these ballots. As a consequence, we do not provide any guarantee to corrupted users, whose keys have been given to the adversary (or even possibly generated by the adversary), but we expect honest users to be protected:

• soundness for honest users means that all the plaintexts of the honest users in the input ballot-box are in the output ballot-box;

• privacy for honest users means that ballots of honest users are unlinkable from the input ballot-box to the output ballot-box.

Proof of Soundness

As just explained, we first study the soundness of our protocol, but for honest users only, in the certified key setting, where all the users must prove the knowledge of their private keys before getting their verification keys vk i certified by the Certification Authority in Σ i .

Definition 40 -Soundness for Honest Users A mix-net M is said sound for honest users in the certified key setting, if any PPT adversary A has a negligible success probability in the following security game:

1. The challenger generates the certification keys (SK, VK) and the encryption keys (DK, EK);

The adversary A then

• decides on the corrupted users I * and generates itself their keys (vk i ) i∈I * ;

• proves its knowledge of the secrete keys to get the certifications Σ i on vk i , for i ∈ I * ;

• decides on the set I of the (honest and corrupted) users that will generate a ballot;

• generates the ballots (B i ) i∈I * for the corrupted users but provides the messages (M i ) i∈I\I * for the honest users;

3. The challenger generates the keys of the honest users (sk i , vk i ) i∈I\I * and their ballots (B i ) i∈I\I * . The initial ballot-box is thus defined by BBox = (B i ) i∈I ;

4. The adversary mixes BBox in a provable way into (BBox , proof).

The adversary wins if MixVerif(BBox, BBox , proof) = 1 but {Decrypt * (BBox)} = {Decrypt * (BBox )}, where Decrypt * extracts the plaintexts (using the decryption key DK), but ignores ballots of non-honest users (using the private keys of honest users) and sets of plaintexts can have repetitions.

One can note that this security game does not depend on the mixing steps, but just considers the global mixing, from the input ballot-box BBox to the output ballot-box BBox . The proof proof contains all the elements for proving the honest behavior. In our case, this is just the two Diffie-Hellman proofs.

Theorem 41 (Soundness for Honest Users of Our Mix-Net). Our mix-net protocol is sound for honest users, in the certified key setting, assuming the unforgeability against Chosen-Message Attacks of the LH-Sign and OT-LH-Sign signature schemes and the SEDL assumption.

Proof. For proving this theorem, we will assume the verification is successful (MixVerif(BBox, BBox , proof) = 1) and show that for all the honest ballots, in the input and output ballot-boxes, there is a permutation from the input ones to the outputs ones. And we do it in two steps: first, honest keys vk i in the output ballot-box are permuted randomizations of the honest keys vk i in the input ballot-box; then we prove it for the plaintexts.

Permutation of Honest Keys. We first modify the security game by using the unforgeability against Chosen-Message Attacks of the LH-Sign signature scheme: we are given VK, and ask the Tag-oracle and the Signing-oracle to obtain Σ i on all the verification keys vk i and vk 0 . The rest remains unchanged. Note that because of the proof of knowledge of the private keys sk i before getting vk i certified, one can also extract them. Actually, one just needs to extract u i for all the corrupted users. Then one knows all the legitimate u i 's (for honest and corrupted users).

Under the unforgeability of the signature scheme (Setup * , Keygen * , NewTag * , RandTag * , VerifTag * , Sign * , MultiplySign * , VerifSign * ), for any output ballot with verification key vk j there exists a related legitimate verification key vk i such that vk j = vk α i i × vk z i 0 , for some scalars z i , and α i . Since in our construction vk i = (g 0 , f i , l i , g i , h i ) and vk 0 = (1, 1, g 0 , 1, 1), and vk j = (g 0 , f j , l j , g j , h j ) and vk 0 = (1, 1, g 0 , 1, 1) with a common g 0 for all the keys, α i is a common scalar α: vk j = (vk i × vk δ i 0 ) α and vk 0 = vk α 0 . As a consequence, all the keys in the output ballot-box are derived in a similar way from legitimate keys (signed by the Certification Authority): u j = u i remains unchanged. However this does not means they were all in the input ballot-box: the adversary could insert a ballot with a legitimate verification key vk i , which was not in the initial ballot-box.

The verification process also includes a Diffie-Hellman proof for the tuple (g 0 , g 0 , i f i , j f j ). This means that i u i are the same on the input ballots and the output ballots. As one additionally checks the numbers of input ballots and output ballots are the same, the adversary can just replace an input ballot by a new one: if N is the set of new ballots and D the set of deleted ballots, the sums must compensate:

D u i = N u i .
The second game uses the SEDL assumption and the simulation-soundness of the proof of knowledge of sk i (in the certified key setting): Let us be given a tuple (g, f = g u , g, f = g u ), as input of a SEDL challenge in G 2 and G 1 : the simulator will guess an honest user i * that will be deleted, and implicitly sets u i * = u, with f i * , which allows it to use f = g u i * in the signature of C i * on the first component g, while all the other scalars are chosen by the simulator (v i * , x i * , y i * ), as well as all the other honest user' keys, the authority signing keys, and, for all the corrupted users, the secret element u i can be extracted at the certification time (using the extractor from the zero-knowledge proof of knowledge) while the zero-knowledge simulator is used for i * , thanks to the simulation-soundness.

If some honest user is deleted in the output ballot-box, with probability greater than 1/n, this is i * : as shown above, D u i = N u i , so u i * = N u i -D\{i * } u i , which breaks the symmetric external discrete logarithm assumption.

Permutation of Honest Ballots. The last game uses the unforgeability of the OT-LH-Sign signature scheme under Chosen-Message Attacks: the simulator receives one verification key vk, that will be assigned at a random honest user i * , whereas all the other keys are honestly generated. The simulator also generates (SK, VK) and (DK, EK), as well as all signatures Σ i and the honest ballots (with a signing query for σ i * ). Then, the adversary outputs a proven mix of the ballot-box. We have just proven that there exists a bijection Π from I into J such that vk Π(i) = (vk i × vk δ i 0 ) α for some scalar δ i , for all the honest users i among the input users in I. From the signature verification on the output tuples,

C Π(i) is signed under vk Π(i) in σ Π(i),1 , for every i: e(σ Π(i),1 , g 0 ) = e(g, f α i ) • e( Π(i) , l α i g αδ i 0 ) • e(a Π(i) , g α i ) • e(b Π(i) , h α i )
, and since the same α appears in g 0 = g α 0 , then for every i, we have

e(σ Π(i) , g 0 ) = e(g, f i ) • e( Π(i) , l i g δ i 0 ) • e(a Π(i) , g i ) • e(b Π(i) , h i ) = e(g, f i ) • e( Π(i) , l i ) • e(a Π(i) , g i ) • e(b Π(i) , h i ) • e( δ i Π(i) , g 0 ) and so σ Π(i) / δ i Π(i) is a signature of C Π(i) = (g, Π(i) , a Π(i) , b Π(i)
) under vk i : under the unforgeability assumption of the signature scheme, C Π(i * ) is necessarily a linear combination of the already signed vectors under vk i * , which are C i * and C 0 , with some coefficients u, v: a

Π(i * ) = a u i * g v , b Π(i * ) = b u i * h v , and g = g u 1 v . Hence, u = 1, which means that C Π(i * ) is a randomization of C i * .
We stress that for this property to hold, each key vk i must appear at most once in the ballots, otherwise some combinations would be possible. Hence the test that all the f i 's are distinct in the input ballot-box.

We stress that this proposition only guarantees permutation of ciphertexts for honest users. There is indeed no formal guarantee for corrupted users whose signing keys are under the control of a mix-server. The latter could indeed replace the ciphertexts of some corrupted users, by some other ciphertexts under the same identity or even under the identity of another corrupted user. One can note that replacing ciphertexts (and plaintexts) even for corrupted users is not that easy because of the additional Diffie-Hellman proof on the ciphertexts, which implies M i = M i where the first product is over all the messages M i in BBox and the second product is over all the messages M i in BBox . However, this property is more for the privacy, as we will see below. As a consequence, our result that guarantees a permutation on the honest ballots is optimal. We cannot guarantee anything for the users that share their keys with the mix-servers.

Proof of Privacy: Unlinkability

After proving the soundness, we have to prove the anonymity (a.k.a. unlinkability), which can also be seen as zero-knowledge property. More precisely, as for the soundness, privacy will only be guaranteed for honest users.

Definition 42 -Privacy for Honest Users A mix-net M is said to provide privacy for honest users in the certified key setting, if any PPT adversary A has a negligible advantage in guessing b in the following security game:

1. The challenger generates the certification keys (SK, VK) and the encryption keys (DK, EK);

The adversary A then

• decides on the corrupted users I * and generates itself their keys (vk i ) i∈I * ;

• proves its knowledge of the secret keys to get the certifications Σ i on vk i , for i ∈ I * ;

• decides on the corrupted mix-servers J * and generates itself their keys (VK j ) j∈J * ;

• decides on the set J of the (honest and corrupted) mix-servers that will make mixes;

• decides on the set I of the (honest and corrupted) users that will generate a ballot;

• generates the ballots (B i ) i∈I * for the corrupted users but provides the messages (M i ) i∈I\I * for the honest users;

3. The challenger generates the keys of the honest mix-servers (SK j ,VK j ) j∈J \J * the keys of the honest users (sk i , vk i ) i∈I\I * and their ballots (B i ) i∈I\I * .

The initial ballot-box is thus defined by BBox = (B i ) i∈I . The challenger randomly chooses a bit b $ ← {0, 1} and then enters into a loop for j ∈ J with the attacker:

• let I * j-1 be the set of indices of the ballots of the corrupted users in the input ballot-box BBox (j-1) ;

• if j ∈ J * , A builds itself the new ballot-box BBox (j) with the proof proof (j) ;

• if j ∈ J * , A provides two permutations Π j,0 and Π j,1 of its choice, with the restriction they must be identical on I * j-1 , then the challenger runs the mixing with Π j,b , and provides the output (BBox (j) , proof (j) );

In the end, the adversary outputs its guess b for b. The experiment outputs 1 if b = b and 0 otherwise.

Contrarily to the soundness security game, the adversary can see the outputs of all the mixing steps to make its decision, hence the index j for the mix-servers. In addition, some can be honest, some can be corrupted. We will assume at least one is honest.

Moreover, the privacy proof of our Mix-Net protocol will depend on a new assumption: First, let us define some kind of credential as follows for a scalar u and a basis g ∈ G 1 , with g ∈ G 2 , r, t ∈ Z p : Cred(u, g; g, r, t) = g, g t , g r , g tr+u , g, g t , g u Definition 43 -Unlinkability Assumption In groups G 1 and G 2 of prime order p, for any g ∈ G 1 and g ∈ G 2 , it states that the distributions D g,g (u, u) and D g,g (u, v) are computationally indistinguishable, for any u, v ∈ Z p :

D g,g (u, v) = (Cred(u, g; g, r, t), Cred(v, g; g , r , t )); g $ ← G 2 , r, t, r , t $ ← Z p
Intuitively, as we can write the credential as, where × stands for the element-wise product,

Cred(u, g; g, r, t) = g g , g g t , g g t r × 1 g u , g u
the third component is an ElGamal ciphertext of the g u , which hides it, and makes indistinguishable another encryption g u from an encryption of g v while, given (g, g u ) and (g , g v ), one cannot guess whether u = v, under the DDH assumption in G 2 . However the pairing relation allows to check consistency: e(g rt+u , g) = e(g r , g t ) • e(g, g u ) = e(g r , g t ) • e(g, g) u e(g r t +v , g ) = e(g r , g t ) • e(g, g v ) = e(g r , g t ) • e(g, g ) v

Because of the independent group elements g and g = g s in the two credentials, this assumption clearly holds in the generic bilinear group model, as one would either need to compare u = v or equivalently rt = r t , whereas combinations only lead to e(g, g) to the relevant powers rt, sr t , as well as u and sv, for an unknown s.

Theorem 44. Our Mix-Net protocol provides privacy for honest users, in the certified key setting, if (at least) one mix-server is honest, under our unlinkability assumption (see Definition 5.4.2), and the DDH assumptions in both G 1 and G 2 .

Proof. This proof will follow a series of games (G i ) i , where we study the advantage Adv i of the adversary in guessing b. We start from the real security game and conclude with a game where all the ballots are random, independently from the permutations. Hence, the advantage will be trivially 0.

Game G 0 : This is the real game, where the challenger (our simulator) generates SK and VK for the certification authority signature, and randomly chooses d $ ← Z p to generate the encryption public key EK = h = g d . One also sets vk 0 = (1, 1, g 0 = g A , 1, 1) and C 0 = Encrypt EK (1) = (g, h) expanded into C 0 = (1, , C 0 ) with the noise parameter $ ← G 1 . Actually, A = 1 in the initial step, when the user encrypts his message M i , but since the shuffling may happens after several other shuffling iterations, we have the successive exponentiations to multiple α (in A) for vk 0 . The attacker A chooses the set of the initial indices of the corrupted users I * and the set of the initial indices of the corrupted mix-servers J * , provides their verification keys ((vk i ) i∈I * , (VK j ) j∈J * ) together with an extractable zero-knowledge proof of knowledge of sk i .

From I and J , one generates the signing keys for the honest mix-servers j ∈ J \J * , and set J to the index of the last honest mix-server. For each i ∈ I, one chooses

τ i = R i $ ← Z p and sets τ i = (τ i,1 = g 1/R i , τ i,2 = g 1/R i ). For each honest user i ∈ I\I * , one randomly chooses u i , v i , x i , y i , r i , ρ i $ ← Z p to generate vk i = (g 0 = g, f i = g u i 0 , l i = g v i 0 , g i = g x i 0 , h i = g y i 0
), and eventually generates all the signatures Σ i of (vk i , vk 0 ) under SK with respect to the tag τ i (using SK and (τ i ) i ).

For the corrupted users, the simulator directly receives the set of ballots (B i = (C i , σ i , vk i , Σ i , τ i )) i∈I * while for the honest users, it receives (M i ) i∈I\I * and computes

C i = Encrypt EK (M i ) = (a i = g r i , b i = h r i M i ) C i = (g, i = ρ i , C i )
and the signature σ i of (C i , C 0 ) under sk i . The input ballot-box is then BBox (0) = {(B i ) i∈I } including the ballots of the honest and corrupted users. Let I * 0 = I * be the set of the initial indices of the corrupted users.

The simulator randomly chooses b $ ← {0, 1} and now begins the loop of the mixes: depending if the mix-server j is corrupted or not, the simulator directly receives (BBox (j) , proof (j) ) from the adversary or receives (Π j,0 , Π j,1 ). In the latter case, one first checks if Π j,0

I * j-1 = Π j,1 I * j-1
using the honest secret keys to determine I * j-1 . Then, the simulator randomly chooses global α $ ← Z p and individual γ i , δ i , µ i $ ← Z p for all the users, as an honest mixserver would do, to compute

vk i = (g 0 = g α 0 , f i = f α i , l i = (l i • g δ i 0 ) α , g i = g α i , h i = h α i ) = (vk i • vk δ i 0 ) α vk 0 = (1, 1, g 0 , 1, 1) = vk α 0 C i = (g, i = i • γ i 0 , a i = a i • g γ i 0 , b i = b i • h γ i 0 ) = C i • C 0 γ i σ i = (σ i,0 = σ i,0 • 0 δ i , σ i,1 = σ i,1 • σ γ i i,0 • i δ i ) Σ i = (Σ i,0 = Σ αµ i i,0 , Σ i,1 = (Σ i,1 • Σ δ i i,0 ) αµ i ) τ i = (τ i,1 = τ 1/µ i i,1 , τ i,2 = τ 1/µ i i,2 )
and sets BBox (j) = (B Π j,b (i) ) i . Eventually, the simulator computes the proof proof (j) for (g 0 , g 0 , f i , f i ) and (g, h, a i / a i , b i / b i ), and signs it using SK j .

After the full loop on all the mix-servers, the adversary outputs its guess b :

Adv G 0 = Pr G 0 [b = b].
One important remark is that under the previous soundness result, which has exactly the same setup, the input ballot-box for the last honest mix-server necessarily contains a randomization of the initial honest ballots (the adversary against the soundness is the above adversary together with the honest simulator up to its last honest round, that does not need any secret). Only the behavior of this last honest mix-server will be modified below.

Game G 1 : We first switch the Diffie-Hellman proofs for (g 0 , g 0 , f i , f i ) to the zero-knowledge setting: if the input ballot-box for the last honest mix-server is not a randomization of the initial honest ballots, that can be tested using the decryption key, one has built a distinguisher between the settings of the zero-knowledge proofs. In this new setting, one can use the zero-knowledge simulator that does not use α. Under the zero-knowledge property,

Adv G 0 < Adv G 1 + negl().
Game G 2 : We also switch the proofs for (g, h, a i / a i , b i / b i ) to the zero-knowledge setting: as above, the distance remains negligible. In this new setting, one can use the authority from a proof of knowledge of sk i , our simulator has access to sk i = (u i , v i , x i , z i ) for all the corrupted users. The mixing step consists in updating the ciphertexts, the keys and the signatures, and we show how to do it without using α such that g 0 = g α 0 but, instead, just g 0 , sk i , C 0 = (1, , g, h) and the individual random coins γ i , δ i : from B i a received ballot of a corrupted user, one can compute vk i = (g 0 , g 0 u i , g 0 v i +δ i , g 0 x i , g 0 y i ) and

C i = C i • C γ i
0 , and then the signatures σ i and Σ i using the signing keys, and choosing τ i $ ← Z p . This simulation is perfect for the corrupted users:

Adv G 1 (j) = Adv G 0 (j) .
Game G 2 (j): We now modify the simulation of the honest ballots. In this game, we choose random d, e $ ← Z p for h = g d and = g e . Then we have simulated C i = (g, i = r i , a i = g r i , b i = h r i ) the ciphertext in BBox (0) and we can set C i = (g, i = r i , a i = g r i , b i = h r i ) the ciphertext in BBox (j) for known random scalars r i , r i $ ← Z p , where r i is actually r i + γ i : γ i is the accumulation of all the noises. All the signatures are still simulated using the signing keys (and τ i = R i $ ← Z p ), with g 0 = g α 0 for a random scalar α. This simulation is perfectly the same as above:

Adv G 2 (j) = Adv G 1 (j) .
Before continuing, we study the format of the initial and randomized ballots: by denoting σ i the initial signature in BBox (0) and σ i the signature to generate in BBox (j) , we have the following relations:

e(σ i,0 , g 0 ) = e(g, g i h i d l i e ) e(σ i,1 , g 0 ) = e(g, f i (g i h i d l i e ) r i ) e(σ i,0 , g 0 ) = e(g, g i h i d l i e ) e(σ i,1 , g 0 ) = e(g, f i (g i h i d l i e ) r i )
If we formally denote σ i,0 = g t i and σ i,1 = g s i , then we have

g 0 t i = g i h i d l i e and g 0 s i = f i (g i h i d l i e ) r i = f i g 0 t i r i which implies s i = u i + t i r i .
Similarly, if we formally denote σ i,0 = g t i and σ i,1 = g s i , and set α as the product of all the α's and δ i as aggregation of all the δ i 's (with α's) in the previous rounds plus this round, from

g 0 αt i = g 0 t i = g i h i d l i e = g i α h i αd (l i g δ i 0 ) αe g 0 αs i = g 0 s i = f i (g i h i d l i e ) r i = f α i (g α i h α i d (l i g δ i 0 ) αe ) r i
we also have g 0 t i = (g i h i d l e i )g δ i e 0 and g 0

s i = f i (g i h d i l e i ) r i g eδ i r i 0
which implies s i = u i + t i r i . As consequence:

σ i,1 = g u i • (g r i ) t i = g u i • a i t i and σ i,1 = g u i • (g r i ) t i = g u i • a i t i
Game G 3 (j): Let us randomly choose scalars u i , r i , r i , t i , t i and α, then, from (g, g 0 ), we can set

g 0 ← g α 0 , a i ← g r i , σ i,1 ← a t i i g u i , f i ← g u i 0 , as well as a i ← g r i , σ i,1 ← a i t i g u i , f i ← g 0 u i .
Then, one additionally chooses x i , y i $ ← Z p and sets

g i ← g x i 0 h i ← g y i 0 l i ← (g t i 0 /(g i h d i )) 1/e C i ← (g, a e i , a i , a d i ) g i ← g 0 x i h i ← g 0 y i l i ← (g 0 t i /(g i h i d )) 1/e C i ← (g, a i e , a i , a i d )
By construction:

g t i 0 = g i h d i l e i , g 0 t i = g i h i d l i e , and
σ i,1 = a t i i g u i = g t i r i × g u i σ i,1 = a i t i g u i = g t i r i × g u i
With σ i,0 ← g t i and σ i,0 ← g t i , σ i and σ i are valid signatures of (C i , C 0 ) and (C i , C 0 ) respectively. Then, the verification keys vk i = (g 0 , f i , l i , g i , h i ) and vk i = (g 0 , f i , l i , g i , h i ) are

VerifSign * (VK, τ i , vk i , Σ i,1 ) = 1: First one can remark that VerifSign(vk i , C 0 , σ i,0 ) = 1 because e(σ i,0 , g 0 ) = e(σ i,0

• δ i , g 0 ) α = e(σ i,0 , g 0 ) α • e( δ i , g 0 ) α = e(1, f i ) α e( , l i ) α e(g, g i ) α e(h, h i ) α • e( δ i , g 0 ) α = e(1, f i )e(g, g i )e(h, h i ) • e( , l i ) α e( , g δ i 0 ) α = e(1, f i )e(g, g i )e(h, h i ) • e( , l α i • g δ i α 0 ) = e(1, f i )e(g, g i )e(h, h i )e( , l i )
Now, one can check VerifSign(vk i , C i , σ i,1 ) = 1 with the help of the previous computation:

e(σ i,1 , g 0 ) = e(σ i,1 , g α 0 ) = e(σ i,1 • σ γ i i,0 • i δ i , g α 0 ) = e(σ i,1 , g 0 ) α • e(σ γ i i,0 , g α 0 ) • e( i δ i , g α 0 ) = e(g, f i ) α e( i , l i ) α e(a i , g i ) α e(b i , h i ) α • e(σ γ i i,0 , g α 0 ) • e( i δ i , g α 0 ) = e(g, f i )e( i , l α i )e(a i , g i )e(b i , h i ) • e(σ γ i i,0 , g α 0 ) • e( i δ i , g α 0 ) = e(g, f i )e(a i , g i )e(b i , h i ) • e(σ γ i i,0 , g α 0 ) • e( i , l α i )e( δ i i • γ i δ i , g α 0 ) = e(g, f i )e(a i , g i )e(b i , h i ) • e(σ γ i i,0 , g α 0 ) • e( i , l α i )e( δ i i , g α 0 )e( γ i δ i , g α 0 ) = e(g, f i )e(a i , g i )e(b i , h i ) • e(σ γ i i,0 , g α 0 ) • e( i , l α i • g αδ i 0 )e( i • γ i δ i , g α 0 ) = e(g, f i )e(a i , g i )e(b i , h i ) • e(σ γ i i,0 , g α 0 ) • e( i , l i )e( γ i δ i , g α 0 ) = e(g, f i )e( i , l i )e(a i , g i )e(b i , h i ) • e(σ γ i i,0 , g α 0 ) • e( γ i δ i , g α 0 ) = e(g, f i )e( i , l i )e(a i , g i )e(b i , h i ) • e((σ i,0 δ i ) γ i , g α 0 ) = e(g, f i )e( i , l i )e(a i , g i )e(b i , h i ) • e(σ i,0 , g α 0 ) γ i = e(g, f i )e( i , l i )e(a i , g i )e(b i , h i ) • e(1, f i ) γ i e( , l i ) γ i e(g, g i ) γ i e(h, h i ) γ i = e(g, f i )e( i , l i )e(a i , g i )e(b i , h i ) • e(1 γ i , f i )e( γ i , l i )e(g γ i , g i )e(h γ i , h i ) = e(g, f i )e( i • γ i , l i )e(a i • g γ i , g i )e(b i • h γ i , h i ) = e(g, f i )e( i , l i )e(a i , g i )e(b i , h i )
About the tags, one can see e(g, τ i,1 ) = e(g, τ

1/µ i i,1 ) = e(g, τ i,1 ) 1/µ i = e(τ i,2 , g) 1/µ i = e(τ 1/µ i i,2 , g) = e(τ i,2 , g).
For the certification, setting VK = (g i ) 6

i and τi = R i , one has τ i = R i µ i and:

e(τ i,2 , Σ i,1 ) = e(g 1/(R i µ i ) , (Σ i,1 • Σ i,0 δ i ) αµ i ) = e(g, Σ 1/R i i,1 ) α • e(g, Σ 1/R i i,0 ) δ i α = e(g 1 , g 0 ) α e(g 2 , f i ) α e(g 3 , l i ) α e(g 4 , g i ) α e(g 5 , h i ) α • e(g, Σ 1/R i i,0 ) δ i α = e(g 1 , g 0 )e(g 2 , f i )e(g 4 , g i )e(g 5 , h i ) • e(g 3 , l α i )e(g, Σ 1/R i i,0
) δ i α = e(g 1 , g 0 )e(g 2 , f i )e(g 4 , g i )e(g 5 , h i ) • e(g 3 , l α i )e(g 3 , g δ i α 0 ) = e(g 1 , g 0 )e(g 2 , f i )e(g 4 , g i )e(g 5 , h i ) • e(g 3 , l α i g δ i α 0 ) = e(g 1 , g 0 )e(g 2 , f i )e(g 3 , l i )e(g 4 , g i )e(g 5 , h i )

Randomization

In this part, we prove that a randomized ballot is a correct randomization of a ballot. A ballot B i for a user U i can be parametrized by (sk i , M i ) the secret key of the user and his message: B i (sk i , M i ) = (C i , σ i , vk i , Σ i , τ i ). The three elements (C i , vk i , τ i ) need to be proved indistinguishable from fresh ones but (σ i , Σ i ) are two deterministic signatures depending on the three previous elements.

A fresh ciphertext C i is of the form (g, i , g r i , h r i M i ) with i random in G 1 and r i random in Z p . The outputted ciphertext is

C i = C i • C γ j,i 0 = (g, i , g r i , h r i M i ) with i = i • γ j,
i and r i = r i + γ j,i . Thus, C i is perfectly indistinguishable from a fresh ciphertext.

For the tag, τ i = (g 1/R i , g 1/R i ) and τ i = τ 1/µ i i thus we have τ i = (g 1/R i , g 1/R i ) with R i = R i µ i which also corresponds to a fresh tag in a perfectly indistinguishable way.

About the verification key, we have vk 0 = (1, 1, g 0 , 1, 1), vk i = (g 0 , g u i 0 , g v i 0 , g x i 0 , g y i 0 ) for sk i = (u i , v i , x i , y i ), and vk i = (vk i • vk δ i 0 ) α thus, vk i = (g 0 , g 0 u i , g 0 v i , g 0 x i , g 0 y i ) with g 0 = g α 0 and v i = v i + δ i which is indistinguishable from a fresh verification key under the DDH in G 2 .

Applications

We now discuss use-cases of mix-nets: electronic voting and anonymous routing. In both cases, a mix-server can, on the fly, perform individual verifications and randomization of ballots, as well as the product of the f i 's and the ciphertexts adaptively until the ballots are all sent. Eventually, at the closing time for a vote or at the end of a time lapse for routing, one just has to do and sign global proof of Diffie-Hellman tuples, and then output the ballots in a permuted order.

Electronic Voting

Our mix-net fits well the case of e-voting because after the multiple mixing steps, all the mixservers can perform a second round to sign in a compact way the constant-size proof, certifying each of their contributions. The input size as well as the computation cost of the verifier are both independent on the number of mixing steps. To our knowledge it is the first scheme with this very nice property.

About security, as explained, soundness and privacy are guaranteed for the honest users only: honest users are sure that their votes are randomized in the output ballot-box, and their inputoutput ballots are unlinkable. This is of course the most important requirements. However, since the u i 's are used to guarantee that no ballots are deleted or inserted, this is important those values to be unknown to the mix-server.

In the Section 4.4, we proposed a construction that uses Square Diffie-Hellman tuples (g r , A i = g w i r , B i = A w i i ) as tags to add in any one-time linearly homomorphic signature to obtain a linearly homomorphic signature with randomizable tags. Then, one can use A j = ( A i ) α instead of f j and ( f i ) α , in the Diffie-Hellman tuple, to guarantee the permutation of the verification keys. Only the privacy of the w i 's is required to guarantee the soundness. Even if the tag can be randomized just in a computational way and not in a statistical way, this is enough for our mix-net application. We can also exploit the universal tag to optimize our construction of mix-net. Indeed, instead of having Σ i,0 the LH-Sign of vk 0 for each user, it is possible to have Σ 0 = Sign * (SK, w, vk 0 ) and still be able to randomize vk i and adapt its signature Σ i,1 keeping the tag τ i per user.

The proof that M i = M i is actually never used in the previous security proofs, as it counts for privacy in e-voting only. Indeed, in our privacy security game we let the adversary choose the messages of the honest users. In a voting scheme, the adversary could not choose them and would like to learn the vote of a target voter. The first mix-server could take the vote (ciphertext) of this voter and ask several corrupted voters to duplicate this vote. The bias in the tally would reveal the vote of the target voter: the proof on the products of the plaintexts avoids this modification during the mixing. This does not exclude the attack of Cortier-Smyth [START_REF] Cortier | Attacking and fixing helios: An analysis of ballot secrecy[END_REF] if the votes are publicly sent, as the corrupted voters could simply use the ciphertext for their own ballots.

Message Routing

Another important use case of mix-nets is in routing protocols where the mix-servers are proxy servers guaranteeing that no one can trace a request of a message. In this scenario, it is not possible to perform a second round on the mix-servers to obtain the multi-signature and the efficiency is thus linear in the number of mixing steps. It is still an open problem to avoid the second round while maintaining the independence in the number of mix-servers.

Chapter

Anonymous Credentials

This chapter is based on the paper [START_REF] Hébant | Traceable constant-size multi-authority credentials[END_REF] under submission. The most recent papers on attribute-based anonymous credential schemes are [START_REF] Fuchsbauer | Structure-preserving signatures on equivalence classes and constant-size anonymous credentials[END_REF][START_REF] Sanders | Efficient redactable signature and application to anonymous credentials[END_REF]. The former proposes the first constant-size credential to prove k-of-N attributes, with computational complexity in O(N -k) for the prover and in O(k) for the verifier. However, it only works for one credential issuer (K = 1). The latter one improves this result by enabling multiple showings of relations (r) of attributes. All the other known constructions allow, at best, selective (s) disclosures of attributes.

Chapter content

In [START_REF] Canard | Anonymous credentials from (indexed) aggregate signatures[END_REF], Canard and Lescuyer use aggregate signatures to construct an ABC system. It is thus the closest to our approach. Instead of having tags, their signatures take indices as input. We follow a similar path but we completely formalize this notion of tag/index with an EphemerId scheme. To our knowledge, aggregate signatures are the only way to deal with multiple credential issuers but still allowing to show a unique compact credential for the proof of possession of attributes coming from different credential issuers. However, the time-complexity of a prover during a verification depends on the number k of shown attributes. We solve this issue at the cost of a larger key for the credential issuers (but still in the same order as [START_REF] Fuchsbauer | Structure-preserving signatures on equivalence classes and constant-size anonymous credentials[END_REF][START_REF] Sanders | Efficient redactable signature and application to anonymous credentials[END_REF]) and a significantly better showing cost for the prover (also better than [START_REF] Fuchsbauer | Structure-preserving signatures on equivalence classes and constant-size anonymous credentials[END_REF][START_REF] Sanders | Efficient redactable signature and application to anonymous credentials[END_REF]).

After precising some notations and reviewing classical definitions in Section 2.1, we informally describe, in Section 6.1, the two important primitives that we will use in our construction of anonymous credentials: the EphemerId and ART-Sign schemes. In Section 6.2, we provide their full definitions and a concrete instantiation. From there, we will be able to define and construct, in Section 6.3, our ABC scheme from EphemerId and ART-Sign schemes. The full instantiation is given in Section 6.4. Traceability is defined and instantiated in Section 6.5. Finally, related work is discussed in Section 6.6.

Overview of our New Primitives

The usual way to perform authentication is by presenting a certified public key and proving ownership of the associated private key with a zero-knowledge proof of knowledge. The certified public key is essentially the signature by a Certification Authority (CA) on a public key and an identity pair, with a standard signature scheme. In case of attribute-based authentication, the attribute is signed together with the public key in the certificate. The latter thus signs two objects, with different purpose, the public key associated to a private key, and the identity or an attribute.

In the same vein as labelled encryption schemes, we define tag-based signatures to dissociate the user-key which will be a provable tag and Attr which will be the signed message (attribute or identity). This flexibility will allow randomizability of one without affecting the other, leading to anonymous credentials.

Notations. In this chapter, vectors will be denoted between brackets [. . .] and unions will be concatenations: [a, b] ∪ [a, c] = [a, b, a, c], keeping the ordering. On the other hand, sets will be denoted between braces {. . .}, with possible repetitions: {a, b}∪{a, c} = {a, a, b, c} as in [START_REF] Sanders | Efficient redactable signature and application to anonymous credentials[END_REF], but without ordering.

Tag-based Signatures

For a pair (τ , τ ), where τ is a tag and τ corresponds to the secret part of the tag, one can define a new primitive called tag-based signature, where we assume all the used tags τ to be valid (either because they are all valid, or their validity can be checked):

Tag-based Signatures

A tag-based signatures consists of the algorithms:

Setup(1 κ ): Given a security parameter κ, it outputs the global parameter param, which includes the message space M and the tag space T ;

Keygen(param): Given a public parameter param, it outputs a key pair (sk, vk); GenTag(param): Given a public parameter param, it generates a witness-word pair (τ , τ );

Sign(sk, τ, m): Given a signing key sk, a tag τ , and a message m, it outputs the signature σ under the tag τ ;

VerifSign(vk, τ, m, σ): Given a verification key vk, a tag τ , a message m and a signature σ, it outputs 1 if σ is valid relative to vk and τ , and 0 otherwise.

The security notion would expect no adversary able to forge, for any honest pair (sk, vk), a new signature for a pair (τ, m), for a valid tag τ , if the signature has not been generated using sk and the tag τ on the message m. Generically, τ can be sk and τ can be vk, then this is just a classical signature of m. Another case is when τ = τ , and then this can just be a classical signature of the message-pair (τ, m).

However more subtil situations can be handled: in our use-cases, τ will be a word for some language L representing the authorized users and τ a witness (for τ ∈ L). According to the language L, which can be a strict subset of the whole set T , one may have to prove the actual membership τ ∈ L (the validity of the tag) for the validity of the signature. It might be important in the unforgeability security notion. On the other hand, one may also have to prove the knowledge of the witness τ , in an interactive and zero-knowledge way for authentication.

The latter can be performed, using the interactive protocol (ProveKTag(τ ), VerifKTag(τ )). This will be useful for the freshness in the authentication process. The former can also be proven using an interactive protocol (ProveVTag(τ ), VerifVTag(τ )). However this verification can also be non-interactive or even public, without needing any private witness. The only requirement is that this proof or verification of membership should not reveal the private witness involved in the proof of knowledge, as the witness will be used for authentication. Now the tag and the message are two distinct elements in the signature, we will introduce new properties for each of them:

• randomizable tags: if τ can be randomized, but still with an appropriate zero-knowledge proof of knowledge of τ , one can get anonymous credentials, where τ is a randomizable public key and an attribute is signed;

• aggregate signatures: one can aggregate signatures generated for different messages (attributes), even different keys (multi-authority) but all on the same tag τ .

By combining both properties, we will provide a compact scheme of attribute-based anonymous credentials. When a trapdoor allows to link randomized tags, one gets traceability.

Signatures with Randomizable Tags

As tags are seen as words in some language L, randomizable tags will make sense for random-self reducible languages [START_REF] Tompa | Random self-reducibility and zero knowledge interactive proofs of possession of information[END_REF]: the word τ defined by a witness τ and some additional randomness r can be derived into another word τ associated to τ and r (either r only or both τ and r are uniformly random). When randomizing τ into τ , one must be able to keep track of the change from to update τ to τ and the signatures. Formally, we will require to have the three algorithms:

RandTag(τ ): Given a tag τ as input, it outputs a new tag τ and the randomization link ρ τ →τ ;

DerivWitness(τ , ρ τ →τ ): Given a witness τ (associated to the tag τ ) and a randomization link between τ and a tag τ as input, it outputs a witness τ for the tag τ ;

DerivSign(vk, τ, m, σ, ρ τ →τ ): Given a valid signature σ on tag τ and message m, and ρ τ →τ the randomization link between τ and another tag τ , it outputs a new signature σ on the message m and the new tag τ . Both signatures are under the same key vk.

From a valid witness-word pair (τ , τ ) ← GenTag(param), if (τ , ρ) ← RandTag(τ ) and τ ← DerivWitness(τ , ρ) then (τ , τ ) should also be a valid witness-word pair.

In addition, for compatibility with the tag and correctness of the signature scheme, we require that for all honestly generated keys (sk, vk) ← Keygen(param), all messages m, and all tags (τ , τ ) ← GenTag(param), if σ ← Sign(sk, τ, m), (τ , ρ) ← RandTag(τ ) and σ ← DerivSign(vk, τ, m, σ, ρ), then the algorithm VerifSign(vk, τ , m, σ ) should output 1.

For privacy reasons, in case of probabilistic signatures, it will not be enough to just randomize the tag, but the random coins too: RandSign(vk, τ, m, σ): Given a valid signature σ on tag τ and message m, it outputs a new signature σ on the same message m and tag τ .

Correctness extends the above one, where the algorithm VerifSign(vk, τ , m, σ ) should output 1 with σ ← RandSign(vk, τ , m, σ ). One additionally expects unlinkability: the following distributions are (computationally) indistinguishable, for any vk and m (possibly chosen by the adversary), where for i = 0, 1, (τ i , τ i ) ← GenTag(1 κ ), σ i ← Sign(sk, τ i , m), (τ i , ρ i ) ← RandTag(τ i ), σ i ← DerivSign(vk, τ i , m, σ i , ρ i ) and σ i ← RandSign(vk, τ i , m, σ i ):

D 0 = {(m, vk, τ 0 , σ 0 , τ 0 , σ 0 , τ 1 , σ 1 , τ 1 , σ 1 )} D 1 = {(m, vk, τ 0 , σ 0 , τ 1 , σ 1 , τ 1 , σ 1 , τ 0 , σ 0 )}.

Aggregate Signatures

Boneh et al. [START_REF] Boneh | Aggregate and verifiably encrypted signatures from bilinear maps[END_REF] remarked it was possible to aggregate the BLS signature [BLS01], we will follow this path, but for tag-based signatures, with possible aggregation only between signatures with the same tag, in a similar way as the indexed aggregated signatures [START_REF] Canard | Anonymous credentials from (indexed) aggregate signatures[END_REF]. We will even consider aggregation of public keys, which can either be a simple concatenation or a more evolved combination as in [START_REF] Boneh | Compact multi-signatures for smaller blockchains[END_REF]. Hence, an aggregate (tag-based) signature scheme (Aggr-Sign) is a signature scheme with the algorithms:

Aggregate Signature Scheme An aggregate (tag-based) signature scheme (Aggr-Sign) is a signature scheme with the algorithms: AggrKey({vk j } j=1 ): Given verification keys vk j , it outputs an aggregated verification key avk;

AggrSign(τ, (vk j , m j , σ j ) j=1 ): Given signed messages m j in σ j under vk j and the same tag τ , it outputs a signature σ on the message-set M = {m j } j=1 under the tag τ and aggregated verification key avk.

We remark that keys can evolve (either in a simple concatenation or a more compact way) but messages also become sets. While we will still focus on signing algorithm of a single message with a single key, we have to consider verification algorithms on message-sets and for aggregated verification keys. In the next section, we combine aggregation with randomizable tags, and we will handle verification for message-sets.

Correctness of an aggregate (tag-based) signature scheme requires that for any valid tagpair (τ , τ ) and honestly generated keys (sk j , vk j ) ← Keygen(param), if σ j = Sign(sk j , τ, m j ) are valid signatures for j = 1, • • • , , then for both key avk ← AggrKey({vk j } j=1 ) and signature σ = AggrSign(τ, (vk j , m j , σ j ) j=1 ), the verification VerifSign(avk, τ, {m j } j=1 , σ) should output 1.

Aggregate Signatures with Randomizable Tags

After the informal presentation of our new primitive, we describe the full definition of aggregate signature scheme with randomizable tags. We will then provide a concrete construction that we will extend to attribute-based anonymous credentials. While the compactness of the credentials will exploit the aggregation of signature, as in [START_REF] Canard | Anonymous credentials from (indexed) aggregate signatures[END_REF], privacy will rely on the randomizability of the tags. However, their specific format will allow more compact anonymous credentials.

Anonymous Ephemeral Identities

As our randomizable tags will be used as ephemeral identities (ephemeral key pairs), we denote them EphemerId: Definition 46 -EphemerId Scheme An EphemerId scheme consists of the algorithms:

Setup(1 κ ): Given a security parameter κ, it outputs the global parameter param, which includes the tag space T ;

GenTag(param): Given a public parameter param, it outputs a tag τ and its secret part τ ;

(ProveVTag(τ ), VerifVTag(τ )): This (possibly interactive) protocol corresponds to the verification of the tag τ . At the end of the protocol, the verifier outputs 1 if it accepts τ as a valid tag and 0 otherwise; RandTag(τ ): Given a tag τ as input, it outputs a new tag τ and the randomization link ρ τ →τ between τ and τ ;

DerivWitness(τ , ρ τ →τ ): Given a witness τ (associated to the tag τ ) and a link between the tags τ and τ as input, it outputs a witness τ for the tag τ ;

(ProveKTag(τ ), VerifKTag(τ )): This optional interactive protocol corresponds to the proof of knowledge of τ . At the end of the protocol, the verifier outputs 1 if it accepts the proof and 0 otherwise.

The security notions are the usual properties of zero-knowledge proofs for the two protocols (ProveKTag(τ ), VerifKTag(τ )) and (ProveVTag(τ ), VerifVTag(τ )), with zero-knowledge and soundness. But the RandTag must also randomize the tag τ within an equivalence class, in an unlinkable way:

• Correctness: the language L ⊂ T might be split in equivalence classes (denoted ∼, with possibly a unique huge class), then for any τ issued from GenTag and τ ← RandTag(τ ), we must have τ ∼ τ ;

• Soundness: the verification process for the validity of the tag should not accept an invalid tag (not in the language);

• Knowledge Soundness: in case of the optional proof of knowledge, extraction of the witness should be possible when the verifier accepts the proof with non-negligible probability;

• Zero-knowledge: the proof of validity and the proof of knowledge should not reveal any information about the witness;

• Unlinkability: for any pair (τ 1 , τ 2 ) issued from GenTag, the two distributions {(τ 1 , τ 2 , τ 1 , τ 2 )} and {(τ 1 , τ 2 , τ 2 , τ 1 )}, where τ 1 ← RandTag(τ 1 ) and τ 2 ← RandTag(τ 2 ), must be (computationally) indistinguishable.

In the case of unique equivalence class for τ , one can expect perfect unlinkability. In case of multiple equivalence classes for τ , these classes should be computationally indistinguishable to provide unlinkability.

Aggregate Signatures with Randomizable Tags

We can now provide the formal definition of an aggregate signature scheme with randomizable tags, where some algorithms exploit compatibility between the EphemerId scheme and the signature scheme:

Definition 48 (Unforgeability for ART-Sign). An ART-Sign scheme is said unforgeable if, for any adversary A that, given signatures σ i for tuples (τ i ,vk i , m i ) of its choice but for τ i and vk i issued from the GenTag and Keygen algorithms respectively (for Chosen-Message Attacks), outputs a tuple (avk, τ, M , σ) where both τ is a valid tag and σ is a valid signature w.r.t. (avk, τ, M ), there exists a subset J of the signing queries with a common tag τ ∈ {τ i } i such that τ ∼ τ , ∀j ∈ J, τ j = τ , avk is an aggregated key of {vk j } j∈J , and M = {m j } j∈J , with overwhelming probability.

Since there are multiple secrets, we can consider corruptions of some of them:

• OCorruptTag(τ ), for (τ , τ ) ∈ TList, outputs τ ;

• OCorrupt(vk), for (sk, vk) ∈ KList, outputs sk.

The forgery should not involve a corrupted key (but corrupted tags are allowed). Note again that all the tags are valid (either issued from GenTag or verified). In the unforgeability security notion, some limitations might be applied to the signing queries: one-time queries (for a given tag-key pair) or a bounded number of queries.

Unlinkability.

Randomizability of both the tag and the signature are expected to provide anonymity, with some unlinkability property:

Definition 49 (Unlinkability for ART-Sign). An ART-Sign scheme is said unlinkable if, for any avk and M , no adversary A can distinguish the distributions D 0 and D 1 , where for i = 0, 1, we have

(τ i , τ i ) ← GenTag(1 κ ), (τ i , ρ i ) ← RandTag(τ i ), σ i is any valid signature of M under τ i and vk, σ i ← DerivSign(avk, τ i , M , σ i , ρ i ) and σ i ← RandSign(avk, τ i , M , σ i ): D 0 = {(M , avk, τ 0 , σ 0 , τ 0 , σ 0 , τ 1 , σ 1 , τ 1 , σ 1 )} D 1 = {(M , avk, τ 0 , σ 0 , τ 1 , σ 1 , τ 1 , σ 1 , τ 0 , σ 0 )}.

One-Time ART-Sign Scheme with Square Diffie-Hellman Tags (SqDH)

Our construction will provide an aggregate signature with randomizable tags based on the second linearly homomorphic signature scheme of 4.5.2.

Description of the EphemerId Scheme.

With tags in T = G 3 1 , in an asymmetric bilinear setting (G 1 , G 2 , G T , p, g, g, e), and τ is a Square Diffie-Hellman tuple (h, h τ , h

τ 2 ), one can define the SqDH EphemerId scheme:

EphemerId Scheme Setup(1 κ ): Given a security parameter κ, let (G 1 , G 2 , G T , p, g, g, e) be an asymmetric bilinear setting, where g and g are random generators of G 1 and G 2 respectively. The set of tags is VerifSign(avk, τ, M , σ): Given a valid tag τ = (τ 1 , τ 2 , τ 3 ), an aggregated verification key avk = [avk j ] and a message-set M = [m j ], with both for each j, avk j = VK j ∪[VK j,i ] i and m j = [m j,i ] i , and a signature σ, one checks if the following equality holds or not, where n j = #{VK j,i }:

T = G 3 1 . We then define param = (G 1 , G 2 , G T , p,
e(σ, g) = e   τ 1 , j VK j,1 n j × i VK j,i,1 • VK j,i,2 m j,i   × e   τ 2 , j VK j,2 n j   × e   τ 3 , j VK j,3 n j   .
In case of similar public keys in the aggregation (a unique index j), avk = VK ∪ [VK i ] i and verification becomes, where n

= #{VK i }, e(σ, g) = e τ 1 , VK 1 n × n i=1 VK i,1 • VK i,2 M i × e (τ 2 , VK 2 n ) × e (τ 3 , VK 3 n ) .
Recall that the validity of the tag has to be verified, either with a proof of knowledge of the witness (as it will be the case in the ABC scheme, or with the proof π = proof(τ : τ = (h, h τ , h τ 2 )) (see 4.4 for the Groth-Sahai [GS08] proof).

Security of the One-Time SqDH-based ART-Sign Scheme.

As argued in [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF], the signature scheme defined above is unforgeable in the generic group model [START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF], if signing queries are asked at most once per tag-index pair: Theorem 50. The One-Time SqDH-based ART-Sign is unforgeable with one signature only per index, for a given tag, even with adaptive corruptions of keys and tags, in the generic group model.

Proof. As argued in [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF], when the bases of the tags are random, even if the exponents are known, the signature that would have signed messages M = (g, g m 1 , . . . , g, g mn ) is an unforgeable linearly-homomorphic signature. This means it is only possible to linearly combine signatures with the same tag. As issued signatures are on pairs (g, g m i ), under a different pair of keys for each such signed pair (whether they are from the same global signing key SK or not, as we exclude repetitions for an index), which can be seen as tuples (1, 1, . . . , g, g m i , . . . , 1, 1), completed with 1's, the invariant generators g imply coefficients 0 and 1 in the linear combination: all the pairs (g, g m i ) have been signed under the same tag. This proves unforgeability, even with corruptions of the tags, but without repetitions of tag-index. One can also consider corruptions of the signing keys, as they are all independent: one just needs to guess under which key will be generated the forgery. About unlinkability, it relies on the DSqDH assumption, but between credentials that contain the same messages at the same shown indices (the same message-vector M ):

Theorem 51. The One-Time SqDH-based ART-Sign, with message-vectors, is unlinkable under the DSqDH assumption.

Proof. As already noticed, the tags are randomizable among all the square Diffie-Hellman triples with the same exponent, which are indistinguishable from random triples in G 3 1 , so for any pair of tags (τ i , τ i ) ← GenTag(1 κ ), for i = 0, 1, when randomized into τ i respectively, the distributions (τ 0 , τ 1 , τ 0 , τ 1 ) and (τ 0 , τ 1 , τ 1 , τ 0 ) are indistinguishable under the DSqDH assumption. For any avk and M , the signatures are deterministic and unique for a tag τ , so they are functions (even if not efficiently computable) of (avk, τ, M ), so the distributions (M , avk, τ 0 , σ 0 , τ 1 , σ 1 , τ 0 , σ 0 , τ 1 , σ 1 ) and (M , avk, τ 0 , σ 0 , τ 1 , σ 1 , τ 1 , σ 1 , τ 0 , σ 0 ) are also indistinguishable under the DSqDH assumption. No need of randomization of the signatures.

Bounded ART-Sign Scheme with Square Diffie-Hellman Tags (SqDH)

The above signature scheme limits to one-time signatures: only one signature can be generated for a given tag-index, otherwise signatures can be later forged on any message for this index, by linearity: the vector space spanned by (g, g m ) (in case of just one signature issued for one index) is just (g α , g αm ) and the constraint of g for the first component implies α = 1; on the other hand, the vector space spanned by (g, g m ) and (g, g m ) (in case of two signatures issued for one index) is G × G, and even the constraint of g for the first component does not limit anything for the second component.

This will be enough for our ABC application, as one usually has one attribute value for a specific kind of information (age, city, diploma, etc), but in practice this implies the signer to either keep track of all the indices already signed for one tag or to sign all the messages at once. We provide another kind of combinations, that could be applied on our SqDH signature scheme that will have interesting application to an ABC scheme.

Description of the Bounded SqDH-based ART-Sign Scheme.

We propose here an alternative where the limitation is on the total number n of messages signed for each tag by each signer:

Bounded SqDH-based ART-Sign Scheme Setup(1 κ ): It extends the above EphemerId-setup with the set of messages M = Z p ; Keygen(param, n): Given the public parameters param and a length n, it outputs the signing and verification keys

sk j = [ t, u, v, s 1 , . . . , s 2n-1 ] $ ← Z 2n+2 p , vk j = g sk j = [ T, U, V, S 1 , . . . , S 2n-1 ] ∈ G 2n+2 2 .
Sign(sk j , τ, m): Given a signing key sk j = [t, u, v, s 1 , . . . , s 2n-1 ], a message m ∈ Z p and a public tag τ = (τ 1 , τ 2 , τ 3 ), it outputs the signature

σ = τ t+ 2n-1 1 s m 1 × τ u 2 × τ v 3 .
AggrKey({vk j } j ): Given verification keys vk j , it outputs the aggregated verification key avk = [vk j ] j ;

AggrSign(τ, (vk j , m j,i , σ j,i ) j,i ): Given tuples of verification key vk j , message m j,i and signature σ j,i all under the same tag τ , it outputs the signature σ = j,i σ j,i of the concatenation of the messages verifiable with avk ← AggrKey({vk j } j );

DerivSign(avk, τ, M , σ, ρ τ →τ ): Given a signature σ on tag τ and a message-set M , and ρ τ →τ the randomization link between τ and another tag τ , it outputs σ = σ ρ τ →τ ;

RandSign(avk, τ, M , σ): The scheme being deterministic, it returns σ;

VerifSign(avk, τ, M , σ): Given a valid tag τ = (τ 1 , τ 2 , τ 3 ), an aggregated verification key avk = [vk j ] j and a message-set M = [m j ] j , with for each j, m j = [m j,i ] i , and a signature σ, one checks if the following equality holds or not, where n j = #{m j,i }:

e(σ, g) = e   τ 1 , j T n j j × 2n-1 =1 S i m j,i j,   × e   τ 2 , j U n j j   × e   τ 3 , j V n j j  
Recall that the validity of the tag has to be verified, as for the other version.

Security of the Bounded SqDH-based ART-Sign Scheme.

The linear homomorphism of the signature from [HPP20] still allows combinations. But when the number of signing queries is at most 2n per tag, the verification of the signature implies 0/1 coefficients only:

Theorem 52. The bounded SqDH-based ART-Sign is unforgeable with a bounded number of signing queries per tag, even with adaptive corruptions of keys and tags, in both the generic group model and the random oracle model.

Proof. As argued in [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF] and recalled in Theorem 35, when the bases of the tags are random, even if the exponents are known, the signature that would have signed messages M = (g m 1 , . . . , g m 2n-1 ), for m ∈ Z p , is an unforgeable linearly-homomorphic signature. This means it is only possible to linearly combine signatures with the same tag. We fix the limit to n signatures σ i queried on distinct messages m i , for i = 1, . . . , n under vk j : one can derive the signature σ = σ α i i on g i α i m 1 i , . . . , g i α i m 2n-1 i . Whereas the forger claims this is a signature on g i a 1 i , . . . , g i α i a n i , on n j ≤ n values a 1 , . . . , a n j , as one cannot combine more than n attributes. Because of the constraint on τ 2 , we additionally have α i = n j mod p:

n i=1 α i m i = n j i=1 a i mod p for = 0, . . . , 2n -1
Let us first move on the left hand side the elements a k ∈ {m i }, with only n ≤ n j new elements, we assume to be the first ones, and we note

β i = α i if m i ∈ {a k } and β i = α i -1 if m i ∈ {a k }: n i=1 β i m i = n i=1
a i mod p for = 0, . . . , 2n -1

We thus have the system n i=1

β i m i + n i=1 γ i a i = 0 mod p for = 0, . . . , 2n -1, with γ i = -1
This is a system of 2n equations with at most n + n ≤ 2n unknown values β i 's and γ i 's, and the Vandermonde matrix is invertible: β i = 0 and γ i = 0 for all index i. As a consequence, the vector (α i ) i only contains 0 or 1 components.

This proves unforgeability, even with corruptions of the tags, but with a number of signed messages bounded by n. One can also consider corruptions of the signing keys, as they are all independent: one just needs to guess under which key will be generated the forgery. About unlinkability, it relies on the DSqDH assumption, with the same proof as the previous one-time scheme, except we can consider un-ordered message-sets M : Theorem 53. The bounded SqDH-based ART-Sign, with message-sets, is unlinkable.

A slightly more compact scheme is described in Appendix B.

Multi-Authority Anonymous Crendentials

In this section, we first define an anonymous attribute-based credential scheme, in the certified key setting (we assume a Certification Authority that first checks the knowledge of the secret keys before certifying public keys. The latter are then always checked before used by any players in the system). We assume that an identity id is associated (and included) to any vk, which is in turn included in sk. Then, we will show how to construct such a scheme based on EphemerId and ART-Sign schemes.

Definition

Our general definition supports multiple users (U i ) i and multiple credential issuers (CI j ) j :

Definition 54 -Anonymous Credential An anonymous credential system is defined by the following algorithms:

Setup(1 κ ): It takes as input a security parameter and outputs the public parameters param;

CIKeyGen(ID): It generates the key pair (sk, vk) for the credential issuer with identity ID;

UKeyGen(id): It generates the key pair (usk, uvk) for the user with identity id;

(CredObtain(usk, vk, a), CredIssue(uvk, sk, a)): A user with identity id (associated to (usk, uvk)) runs CredObtain to obtain a credential on the attribute a from the credential issuer ID (associated to (sk, vk)) running CredIssue. At the end of the protocol, the user receives a credential σ;

CredAggr(usk, {(vk j , a j , σ j )} j ): It takes as input a secret key usk of a user and a list of credentials (vk j , a j , σ j ) and outputs a credential σ of the aggregation of the attributes;

(CredShow(usk, {(vk j ,a j )} j , σ),CredVerify({(vk j ,a j )} j ): In this two-party protocol, a user with identity id (associated to (usk, uvk)) runs CredShow and interacts with a verifier running CredVerify to prove that he owns a valid credential σ on {a j } j issued respectively by credential issuers ID j (associated to (sk j , vk j )).

Security Model

The security model of anonymous credentials was already defined in various papers. We follow [FHS19, San20], with multi-show unlinkable credentials, but considering multiple credential issuers. Informally, the scheme needs to have the three properties:

• Correctness: the verifier must accept any credential obtained by an aggregation of honestly issued credentials on attributes;

• Unforgeability: the verifier should not accept a credential on a set of attributes for which the user did not obtain all the individual credentials for himself;

• Anonymity: credentials shown multiple times by a user should be unlinkable, even for the credential issuers. This furthermore implies that credentials cannot be linked to their owners.

For the two above security notions of unforgeability and anonymity, one can consider malicious adversaries able to corrupt some parties. We thus define the following lists: HU the list of honest user identities, CU the list of corrupted user identities, similarly we define HCI and CCI Intuitively, the adversary wins the security game if it manages to prove its ownership of a credential, on behalf of a corrupted user id ∈ CU whereas this user did not ask the attributes to the honest credential issuers. Note that attributes from the corrupted credential issuers can be generated by the adversary itself, using the secret keys.

Definition 56 (Anonymity). An anonymous credential scheme is said anonymous if, for any polynomial time adversary A having access to O = {OHCI, OCCI, OHU, OCU, OObtain, OShow}, Adv ano

(A) = | Pr[Exp ano-1 A (1 κ ) = 1] -Pr[Exp ano-0 A (1 κ ) = 1]| is negligible where Exp ano-b A (1 κ ): param ← Setup(1 κ ) (id 0 , id 1 , {(ID j , a j )} j ) ← A O (param) If for some ID j , (ID j , a j ) ∈ Att[id 0 ] ∩ Att[id 1 ], then return 0 (CredShow(usk b , {a j } j , σ), A()) b * ← A O () If id 0 ∈ CU or id 1 ∈ CU, then return 0 Return b *
First, note that we do not hide the attributes nor the issuers during the showing, but just the user, as we want to prove their ownership by the anonymous user. Intuitively, the adversary wins the security game if it can distinguish showings from users id 0 and id 1 of its choice, on the same set of attributes {(ID j , a j )} j , even after having verified credentials from the two identities, as it has access to the oracle OShow. Note that contrarily to [START_REF] Sanders | Efficient redactable signature and application to anonymous credentials[END_REF], unless the attributes contain explicit ordering (as it will be the case with our first construction), we are dealing with unlinkability as soon as the sets of attributes are the same for the two players (with the second construction).

Anonymous Credential from EphemerId and ART-Sign Scheme

Let E be an EphemerId scheme and S art an ART-Sign scheme, one can construct an anonymous attribute-based credential scheme. The user's keys will be tag pairs and the credentials will be ART-Sign signatures on both the tags and the attributes. Since the signature is aggregatable and the tag is randomizable, the user can anonymously show any aggregation of credentials:

Anonymous Credential from EphemerId and ART-Sign Scheme Setup(1 κ ): Given a security parameter κ, it runs S art .Setup and outputs the public parameters param which includes all the parameters; CIKeyGen(ID): Credential issuer CI with identity ID, runs S art .Keygen(param) to obtain his key pair (sk, vk); UKeyGen(id): User U with identity id, runs E.GenTag(param) to obtain his key pair (usk, uvk). In the case witnesses are required for the signatures, (usk, uvk) are provided to the credential issuers;

(CredObtain(usk, a), CredIssue(uvk, sk, a)): User U with identity id and key-pair (usk, uvk) asks the credential issuer CI for a credential on attribute a: σ = S art .Sign(sk, uvk, a);

CredAggr(usk, {(vk j , a j , σ j )} j ): Given credentials σ j on attributes (ID j , a j ) under the same user key uvk, it outputs the signature σ = S art .AggrSign(uvk, {(vk j , a j , σ j )} j ) on the set of attributes {a j } j under uvk and the aggregated verification key avk of all the vk j ;

(CredShow(usk, {(vk j , a j )} j , σ), CredVerify({(vk j , a j )} j ): User U randomizes his public key (uvk , ρ) = E.RandTag(uvk) and computes the aggregated key avk =

• OShow(id, {(ID j , a j )} j ): If id / ∈ HU or {(ID j , a j )} j ) ⊂ Att[id], B outputs ⊥. Otherwise, id is associated to (usk, uvk) and each ID j is associated to (sk j , vk j ). Furthermore, for each (ID j , a j ), there is σ j such that (ID j , a j , σ j ) ∈ Cred [id]. Then B first randomizes the key uvk with (uvk , ρ) = E.RandTag(uvk), computes the aggregated key avk = S art .AggrKey({vk j } j ) and adapts the secret key usk = E.DerivWitness(usk, ρ). From the obtained credentials σ j , it computes the aggregated signature σ = S art .AggrSign(uvk, {(vk j , a j , σ j )} j ), adapts it: σ = S art .DerivSign(avk, uvk, {a j } j , σ, ρ), and randomizes it: σ = S art .RandSign(avk, uvk , {a j } j , σ ). B outputs (avk, {a j } j , uvk , σ ) and makes the E.ProveKTag(usk ) part of the interactive proof of ownership.

Eventually, the adversary A runs a showing for {(vk j , a j )} j , with a credential (avk, {a j } j , uvk * , σ * ) and a proof of knowledge of usk * associated to uvk * : in case of success, B outputs the signature (avk, {a j } j , uvk * , σ * ).

In case of validity of the showing, except with negligible probability,

• from the knowledge soundness of the EphemerId scheme, this means there is id ∈ CU, associated to (usk, uvk), with uvk ∼ uvk * ;

• from the unforgeability of the aggregate signature with randomizable tags, all the tags a j 's have been signed for uvk and vk. These individual credentials have thus been issued either by the adversary on behalf of a corrupted credential issuer ID j ∈ CCI or from an oracle query to ID j for id.

This is thus a legitimate showing with overwhelming probability: B win with negligible probability. Hence, the adversary A can only win with negligible probability.

As explained above, the security relies on both the soundness of the EphemerId scheme and the unforgeability of the aggregate signature with randomizable tags. In our construction, the witness is not needed for signing, and unforgeability of the ART-Sign holds even if the witnesses are all known to the adversary. Hence, corruption of users would just help to run the proof of knowledge of the witnesses, and corruption of credential issuers for the issuing of credentials, which would not help for forgeries (in the above security model). Of course, we also have to take care of the way keys are generated and the number of signatures that will be issued to guarantee the unforgeability.

Theorem 58. Assuming EphemerId is zero-knowledge and ART-Sign is unlinkable, the generic construction is an anonymous attribute-based credential scheme, in the certified key model.

Proof. From the unlinkability of the ART-Sign, the tuple (avk, M , τ , σ ) does not leak any information about the initial tag τ . Hence, a credential does not leak any information about uvk b . In addition, if the proof of knowledge of the witness is zero-knowledge, it does not leak any information about uvk b either.

SqDH-based Anonymous Credentials

Thanks to our aggregated signatures that tolerate corruptions of users and signers, we will be able to consider corruptions of users and credential issuers, and even possible collusions. In the first construction, we consider attributes where the index i determines the topic (age, city, diploma) and the exact value is encoded in a i ∈ Z * p (possibly H(m) ∈ Z * p if the value is a large bitstring), or 0 when empty. The second construction will not require any such ordering on the attributes. Free text will be possible.

The Basic SqDH-based Anonymous Credential Scheme

The basic construction directly follows the instantiation of the above construction with the SqDH-based ART-Sign: Basic SqDH-based ART-Sign Scheme Setup(1 κ ): Given a security parameter κ, let (G 1 , G 2 , G T , p, g, g, e) be an asymmetric bilinear setting, where g and g are random generators of G 1 and G 2 respectively. We then define param = (G 1 , G 2 , G T , p, g, g, e, H), where H is an hash function in G 1 ;

CIKeyGen(ID): Credential issuer CI with identity ID, generates its keys for n kinds of attributes

sk j = ( SK j = [ t, u, v ], SK j,i = [ r i , s i ] i ) $ ← Z 3+2n p , vk j = ( VK j = [ g t , g u , g v ], VK j,i = [ g r i , g s i ] i ) ∈ G 3+2n 2 .
More keys for new attributes can be generated on-demand: by adding the pair [r, s] $ ← Z 2 p to the secret key and [g r , g s ] to the verification key, the keys can works on n + 1 kinds of attributes; UKeyGen(id): User U with identity id, sets h = H(id) ∈ G * 1 , generates its secret tag τ $ ← Z * p jointly with CA and computes τ = (h, h τ , h τ 2 ) ∈ G 3 1 : usk = τ and uvk = τ = (h, h τ , h τ 2 );

(CredObtain(usk, a i ), CredIssue(uvk, sk, a i )): User U with identity id and uvk = (τ 1 , τ 2 , τ 3 ) asks to the credential issuer CI for a credential on the attribute a i : σ = τ t+r i +a i s i 1 × τ u 2 × τ v 3 . The credential issuer uses the appropriate index i, making sure this is the first signature for this index; CredAggr(usk, {(VK j , VK j,i , a j,i , σ j,i )} j,i ): Given credentials σ j,i on attributes (ID j , a j,i ) under the same user key uvk, it outputs the signature σ = j,i σ j,i ;

(CredShow(usk, {(VK j , VK j,i , a j,i )} j,i , σ), CredVerify({(VK j , VK j,i , a j,i )} j,i ): First, user U randomizes his public key with a random ρ $ ← Z * p into uvk = (τ ρ 1 , τ ρ 2 , τ ρ 3 ), concatenates the keys avk = ∪ j ([VK j ] ∪ [VK j,i ] i ), and adapts the signature σ = σ ρ . Then it sends the anonymous credential (avk, {a j,i } j,i , uvk , σ ) to the verifier. The latter first checks the freshness of the credential with a proof of ownership and validity of uvk using a Schnorr-like interactive proof and then verifies the validity of the credential: with n j = #{VK j,i }:

e(σ, g) = e   τ 1 , j VK j,1 n j × i VK j,i,1 • VK j,i,2 a j,i   × e   τ 2 , j VK j,2 n j   × e   τ 3 , j VK j,3 n j   .
We stress that for the unforgeability of the signature, generator h for each tag must be random, and so it is generated as H(id), with a hash function H in G 1 that we model as a random oracle in the security proof. This way, the credential issuers will automatically know the basis for each user. There is no privacy issue as this basis is randomized when used in an anonymous credential. Moreover, the user needs his secret key τ to be random. Therefore, he jointly generates τ with the Certification Authority (see Appendix A). During the showing of a credential, the user has to prove the knowledge of the witness for the validity of the tag. This Again, we stress that for the unforgeability of the signature, generator h for each tag and τ must be random. And the credential issuer should provide at most n attributes per user, even if in this construction, we can consider an exponential number N of attributes per credential issuer, as a j,i is any scalar in Z * p . More concretely, a j,i can be given as the output of a hash function into Z p from any bitstring. At the showing time, for proving the ownership of k attributes (possibly from K different credential issuers), the users has to perform k -1 multiplications in G 1 to aggregate the credentials into one, and 4 exponentiations in G 1 for randomization, but just one group element for G 1 is sent, as anonymous credential, plus an interactive Schnorr-like proof of SqDH-tuple with knowledge of usk (see 4.4: 2 exponentiations in G 1 , 2 group elements from G 1 , and a scalar in Z p ); whereas the verifier first has to perform 4 exponentiations and 2 multiplications in G 1 for the proof of validity/knowledge of usk, and less than 2n • (K + 3k) multiplications in G 2 , 2n • k exponentiations in G 2 and 3 pairings to check the credential.

In the particular case of just one credential issuer with verification key vk = (T, U, V, [S i ] 2n-1 i=1 ), the verification of the credential σ on the k attributes {a i } just consists of e(σ, g) = e τ 1 , T k 2n-1 =1 S i a i × e τ 2 , U k × e τ 3 , V k .

The communication is of constant size (one group element in G 1 ). We stress that n is just a limit of the maximal number of attributes issued by the credential issuer for one user but the universe of the possible attributes is exponentially large, and there is no distinction between the families of attributes.

Traceable Anonymous Credentials

As the SqDH-based ART-Sign schemes provide computational unlinkability only, it opens the door for possible traceability in case of abuse, with anonymous but traceable tags: Definition 59 -Traceable EphemerId This is an extension of an EphemerId scheme with a modified GenTag algorithm and an additional TraceId one:

GenTag(1 κ ): Given a security parameter 1 κ , it outputs the user-key pair (usk,uvk) and the tracing key utk;

TraceId(utk, uvk ): Given the tracing key utk associated to uvk and a public key uvk , it outputs a proof π of whether uvk ∼ uvk or not.

JudgeId(uvk, uvk , π): two public keys and a proof, the judge checks the proof π and outputs 1 if it is correct.

Providing the tracing keys to a tracing authority during the key generation for the users will allow traceability.

Traceable Anonymous Credentials

For traceability, we need an additional player: the tracing authority. During the user's key generation, this tracing authority will either be the certification authority, or a second authority, that also has to certify user's key uvk once it has received the tracing key utk.

In case of abuse of a credential σ under anonymous key uvk , a tracing algorithm outputs the initial uvk and id, with a proof a correct tracing. A new security notion is quite important: non-frameability, which means that the tracing authority should not be able to declare guilty a wrong user: only correct proofs are accepted by the judge. We consider a non-interactive

Traceable SqDH-based Anonymous Credentials

With our Square Diffie-Hellman based EphemerId scheme where uvk = τ = (h, h τ , h τ 2 ) in an asymmetric bilinear setting (G 1 , G 2 , G T , p, g, g, e) where g and g are random generators of G 1 and G 2 respectively, usk = τ and utk = g τ . The latter tracing key indeed allows to check whether τ ∼ τ or not: e(τ 1 , utk) = e(τ 2 , g) and e(τ 2 , utk) = e(τ 3 , g). If one already knows the tags are valid (SqDH tuples), this is enough to verify whether e(τ 1 , utk) = e(τ 2 , g) holds or not. But we provide the complete proof, as it is already quite efficient: in order to prove it, the TraceId algorithm can use a Groth-Sahai proof as shown in 6.5.3 that proves, in a zero-knowledge way, the existence of utk such that e(τ 1 , utk) = e(τ 2 , g) e(τ 2 , utk) = e(τ 3 , g) e(τ 1 , utk) = e(τ 2 , g) e(τ 2 , utk) = e(τ 3 , g).

The first line proves that utk is the good tracing key for uvk = τ , and the second line shows it applies to uvk = τ too. These are the equations verified by JudgeId algorithm. This can also be a proof of innocence of id with key uvk if the first line is satisfied while the second one is not. With such a proof, the tracing authority cannot frame a user. We thus have a secure traceable anonymous credential scheme. Note however that, since we let the user choose the secret key τ in GenTag, one user could decide to use the same as another user. Either the tracing authority first checks that, using the new tracing key on all the previous tags, and reject, or this is considered a collusion of users, and at the tracing time, both users will be accused.

Groth-Sahai Proof for Square Diffie-Hellman Tracing

For the proof of tracing, one wants to show τ ∼ τ , where τ is the reference tag for a user (certified at the registration time). With the tracing key utk = g τ , one needs to show e(τ 1 , utk) = e(τ 2 , g) e(τ 2 , utk) = e(τ 3 , g) e(τ 1 , utk) = e(τ 2 , g) e(τ 2 , utk) = e(τ 3 , g) but without revealing utk ∈ G 2 . This is equivalent, for random α 1 , α 2 , α 1 , α 2 $ ← Z p , to have: e(T 1 , utk) = e(T 2 , g) with

T 1 = τ 1 α 1 • τ 2 α 2 • τ 1 α 1 • τ 2 α 2 T 2 = τ 2 α 1 • τ 3 α 2 • τ 2 α 1 • τ 2 α 2
One can commit utk: as above, with the reference string (v The random values α 1 , α 2 , α 1 , α 2 can be either chosen by the verifier in case of interactive proof, or set from H(τ 1 , τ 2 , τ 3 , τ 1 , τ 2 , τ 3 ).

1,1 , v 1,2 , v 2,1 , v 2,2 ) ∈ G 4 2 , such that (v 1,1 , v 1,2 , v 2,1 , v 2,

Related Work

On Figure 6.1, we provide some comparisons with the most efficient ABC schemes, where the column "P" (for policy) indicates whether the scheme just allows selective disclosure of attributes (s) or relations between attributes (r). The column "T" (for traceability) checks whether traceability is possible or not. Then, "|CI key|" gives the size of the keys (public keys of the credential issuers) required to verify the credentials, "|Show|" is the communication bandwidth during a show, while "Prover" and "Verifier" are the computational cost during a show, for the prover and the verifier respectively. Bandwidths are in number of elements G 1 , G 2 , G T and Z p . Computations are in number of exponentiations in G 1 , G 2 and G T , and of pairings. We ignore multiplications. We denote N the global number of attributes owned by a user, k the number of attributes he wants to show and K the number of credential issuers involved in the issuing of the credentials. In the first table, we focus on the particular case of proving a credential with k attributes, among N attributes issued from 1 credential issuer. Our first scheme, from Section 6.4.1, is already the most efficient, but this is even better for a larger K, as shown in the second table. But this is for a limited number of attributes. Our second scheme, from Section 6.4.2 has similar efficiency, but with less limitations on the attributes. Note that both schemes have a constant-size communication for the showing of any number of attributes, and the computation cost for the prover is almost constant too (as we ignore multiplications).

Canard-Lescuyer Scheme. In 2013, Canard and Lescuyer proposed a traceable attributebased anonymous credential scheme [START_REF] Canard | Protecting privacy by sanitizing personal data: a new approach to anonymous credentials[END_REF], based on sanitizable signatures: "Protecting privacy by sanitizing personal data: a new approach to anonymous credentials". The intuition consists in allowing the user to "sanitize" the global credentials issued by the credential issuer, in order to keep visible only the required attributes. Then for unlinkability, the signatures are encrypted under an ElGamal encryption scheme.

Unfortunately, we found an attack in their scheme. The public key contains g $ ← G 1 and g $ ← G 2 , and the ElGamal secret key is α $ ← Z p , the tracing key. The public encryption key is h = g α , but they also need h = g α to be published for some verifications.

With this value h, anybody can break the semantic security of the ElGamal encryption, and then break the privacy of the anonymous credential.

Chapter

Conclusion

This thesis proposed new protocols integrating privacy by design and made its contribution to decentralization, electronic voting and anonymous authentication.

We have first presented in chapter 3 a new decentralized encryption scheme. It makes possible for a company to study encrypted databases of users by authorizing evaluations of quadratic polynomials on them, while at the same time, maintaining a level of security by controlling the computations. Hence, the company is forced by the system to recover only the result of the evaluation and nothing more.

Then, we studied in chapter 4 the linearly homomorphic signatures with two particular schemes. They feature tag randomizability, a property of great interest in our use-cases. While the first scheme only has one class of equivalence for tags and thus, ensures perfect anonymity, we proposed a second one with multiple classes so that a user can be anonymous within it. Both are proven secure in the Generic Bilinear Group Model and building such a scheme remains an issue in the standard model. Without the tag randomizability property, linearly homomorphic signature constructions are already known but the tag is usually hashed which is not compatible with randomizability.

Thanks to the LH-Sign scheme with randomizable tags, we constructed two schemes:

• A new method to build mix-networks,

• A new traceable multi-authority anonymous credential protocol.

The mix-networks scheme presented in chapter 5 followed a totally new approach compared to the previously known solutions. We avoided the proof of an explicit permutation on all the ciphertexts (per mixing step) extensively using the linearly-homomorphic signature schemes with tag randomizability. That made the proof of correctness implicit.

The computational complexity for each mix-server is linear in the number of ballots. The final proof implies just a constant-size overhead and the verification is also linear in the number of ballots, but independent of the number of rounds of mixing. This led to a highly scalable technique.

Finally, the anonymous credential protocol presented in chapter 6 is multi-user -a user can anonymously show a constant-size credential coming from several credential issuers -and for the first time traceable: the anonymity may be revoked by a judge in case of abuse.

While we optimized the size of a credential for a showing, the credential issuers needs to send the attributes individually. Whereas with redactable signatures it is possible to send one signature on all the attributes and then, redact some of them. One open problem is then to find a signature scheme including both properties: aggregatable and redactable. This could lead to more efficient scheme by improving the memory cost of a user.

All of the studied scenarios required new and more complex security concepts than the already existing ones. We used the homomorphic property of encryptions a lot, signatures and even zero-knowledge proofs but each time the malleability needed to be controlled.

We also recall that the validity of the tag has to be verified, as before, for the signature to be considered valid.

Security of the Bounded SqDH-based ART-Sign Scheme 2.

The linear homomorphism of the signature from [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF] still allows combinations. But when the number of signing queries is at most n per tag, the verification of the signature implies 0/1 coefficients only, with overwhelming probability: Theorem 60. The bounded SqDH-based ART-Sign defined above is unforgeable with a bounded number of signing queries per tag, even with adaptive corruptions of keys and tags, in both the generic group model and the random oracle model, as soon as q n H p, where q H is the number of hash queries and p the order of the group (the output of the hash function).

Proof. As argued in [START_REF] Hébant | Linearly-homomorphic signatures and scalable mix-nets[END_REF], when the bases of the tags are random, even if the exponents are known, the signature that would have signed messages M = (g m 1 , . . . , g m n ), for m ∈ Z p , is an unforgeable linearly-homomorphic signature. This means it is only possible to linearly combine signatures with the same tag: from up to n signatures σ i on distinct messages m i , for i = 1, . . . , n under vk j , one can derive the signature σ = σ α i i on g i α i m 1 i , . . . , g i α i m n i .

Whereas the forger claims this is a signature on g i a 1 i , . . . , g i α i a n i , on n j values a 1 , . . . , a n j . Because of the constraint on τ 2 , we have α i = n j mod p:

. , n

Let us first move on the left hand side the elements a k ∈ {m i }, with only n ≤ n j new elements, we assume to be the first ones, and we note β i = α i if m i ∈ {a k } and or

β i = α i -1 if m i ∈ {a k }: n i=1 β i m i = n i=1
a i mod p for = 0, . . . , n

Our goal is to prove that n = 0 and the α i 's are only 0 or 1. So, first, let us assume that n = 0: there is no new element. The matrix (m i ) i, , for i = 1, . . . , n and = 0, . . . , n -1 is a Vandermonde matrix, that is invertible: hence the unique possible vector (β i ) is the zero-vector. As a consequence, the vector (α i ) i only contains 0 or 1 components. Now, we assume n = 1: there is exactly one element a 1 ∈ {m i }. We can move it on the left side:

β 0 a 1 + n i=1
βm i = 0 mod p for = 0, . . . , n, with β 0 = -1

Again, the matrix (m i ) i, , for i = 0, . . . , n where we denote m 0 = a 1 , and = 0, . . . , n, is a Vandermonde matrix, that is invertible: hence the unique possible vector (β i ) is the zero-vector, which contradicts the fact that β 0 = -1. Eventually, we assume n > 1: there are at least two elements a k ∈ {m i }. We can move a 1 on the left side:

β 0 a 1 + n i=1 βm i = n i=2
a i mod p for = 0, . . . , n, with β 0 = -1 Again, because of the invertible matrix, for the n -1 elements on the right hand side, there is a unique possible vector (β i ), and the probability for β 0 = -1 is negligible, as the new elements a k are random (if they are issued from a hash value): probability 1/p for each possible choice on the n -1 < n attributes on the right hand side. Hence, as soon as q n H p, the probability for a combination to allow β 0 = -1 is negligible.

As a conclusion, one can only combine initial messages with a weight 1 (or 0). This proves unforgeability, even with corruptions of the tags, but with a number of signed messages bounded by n, and random messages (issued from a hash function). One can also consider corruptions of the signing keys, as they are all independent: one just needs to guess under which key will be generated the forgery. Unlinkability remains unchanged.

  Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Confidentiality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.3 Provable Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Advanced Security Goals . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.1 Decentralization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 Traceability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Homomorphism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.1 Homomorphic Encryptions . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.2 Homomorphic Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.3 Security with Homomorphism . . . . . . . . . . . . . . . . . . . . . . . . 1.3.4 Homomorphic Zero-Knowledge Proofs . . . . . . . . . . . . . . . . . . . 1.4 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 Organization of the Manuscript . . . . . . . . . . . . . . . . . . . . . .

  EKeygen(κ): Given a security parameter κ, it outputs the public key pk with the associated private key sk;Encrypt(pk, m): Given a message m and a public key pk, it outputs the ciphertext C;Decrypt(sk, C): Given a ciphertext C and a secret key sk, it outputs a message m.

  b $ ← {0, 1} and encrypts m b into C b . The attacker receiving C b simply computes C = C b × C b and asks the decryption to obtain m = 2 • m b . Finding the right b = b is then easy.

  s , the verification key vrk a→b s consists of [rk a→b s ] s . However, in order to prove the matrix rk a→b s is invertible, one can show it is non-zero, and not of rank 1, which would mean that vrk a→b s would consist of a Diffie-Hellman tuple: REKeygen s (sk a s , sk b s ): For s = 1, 2, from two different secret keys sk a s = P s and sk b s = P s associated respectively to the two public keys pk a s and pk b s , it computes B s , B s ∈ M 2 (Z p ) 2 such that P s = B -1 s UB s and P s = B s -1 UB s . Let rk a→b s s B s be the secret re-encryption key, vrk a→b s = [rk a→b s ] s be a verifiable public version of the re-encryption key and [r ] s = λ • [r 12 ] s where λ is such that r 21 = λ • r 11 (with r 11 , r 12 , r 21 , r 22 the components of rk a→b s , and π a→b s :

s

  is not a Diffie-Hellman tuple. The two checks vrk a→b s = [0] s and [r ] s = [r 22 ] s are just simple verifications, thus π a→b s needs 6 scalars of Z p as a proof à la Schnorr.

2 :

 2 Now the simulator takes as input a Diffie-Hellman tuple ([a] s , [b] s ), with b = r • a for some scalar r, and emulates EKeygen s by defining vsk s the matrix defined by the two vectors ([a] s , [b] s ). Thanks to the Diffie-Hellman tuple this corresponds to the matrix of a projection, and thus this game is perfectly indistinguishable from the previous one:

  RandTag associated to a new property for linearly-homomorphic signature schemes: RandTag(vk, τ, M , σ): Given a verification key vk, a tag τ and a signature σ on a vectormessage M = (M i ) i ∈ G n , it outputs a new tag τ and σ a new signature on the new tag τ of M still valid under the verification key vk.

  and randomly choose v $ ← Z p and set Y = g v • if b = 1: set Y = Z, and randomly choose u $ ← Z p and set X = g u

  (1 κ ): It runs Setup(1 κ ) to obtain param and adds the tag space param = (param, Z * p × G * ); SKeygen (param , n): It runs SKeygen(param, n + 3); NewTag (sk): It chooses a random scalar w $ ← Z * p and a random group element h $ ← G, and sets τ = τ = (w, h); VerifTag (vk, τ ): It checks whether τ = (w, h) ∈ Z * p × G or not; Sign (sk, τ = (w, h), M ): It extends M into M with the three additional components (h,h w ,h w 2 ) and signs it as σ = Sign(sk, M );

  published in the proceedings of the International Conference on Practice and Theory of Public-Key Cryptography, PKC 2020.Chapter content5.1 Our Scheme: General Description . . . . . . . . . . . . . . . . . . . . 62 5.2 Our Scheme: Full Description . . . . . . . . . . . . . . . . . . . . . . . 64 5.3 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 5.3.1 Constant-Size Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 5.3.2 Efficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 5.4 Security Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 5.4.1 Proof of Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 5.4.2 Proof of Privacy: Unlinkability . . . . . . . . . . . . . . . . . . . . . . . 71 5.4.3 Proof of Correctness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 5.5 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 5.5.1 Electronic Voting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 5.5.2 Message Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Figure 5 . 1 :

 51 Figure 5.1: High-Level Description (Insecure Scheme)

Figure 5 . 2 :

 52 Figure 5.2: Detailed Shuffling of ElGamal Ciphertexts

Figure 5 . 3 :

 53 Figure 5.3: Detailed Verification of Shuffling

  g, g, e; T ); GenTag(param): Given a public parameter param, it randomly chooses a generator h $ ← G * 1 and outputs τ $ ← Z * p and τ= (h, h τ , h τ 2 ) ∈ G 3 1 .ProveVTag(τ ), VerifVTag(τ ): The prover constructs the proof π = proof(τ : τ = (h, h τ , h τ 2 )) (see 4.4 for the Groth-Sahai [GS08] proof). The verifier outputs 1 if it accepts the proof and 0 otherwise. RandTag(τ ): Given a tag τ as input, it chooses ρ τ →τ $ ← Z p and constructs τ = τ ρ τ →τ the derived tag. It outputs (τ , ρ τ →τ ).

  2 ) is a Diffie-Hellman tuple, one computesCom = (c = v λ 2,1 v µ 1,1 , d = v λ 2,2 v µ 1,2 × utk), for random λ, µ $ ← Z p , and one sets π 1 = T λ 1 and π 2 = T µ 1 , which should satisfy e(T 1 , c) = e(π 1 , v 2,1 ) • e(π 2 , v 1,1 ) e(T 1 , d) = e(T 2 , g) • e(π 1 , v 2,2 ) • e(π 2 , v 1,2 )

  p for = 0, . .

  , . . . , vk N }, sk i , m): Given N verification keys vk i , a signing key sk i and a message m, it outputs σ i = H 0 (m) sk i .

	Boneh-Drijvers-Neven Multi-Signature Scheme [BDN18]
	MSKeygen(MSparam): Given the global parameter MSparam, it chooses sk $ ← Z p and
	outputs (sk, vk = g sk );
	MSKeyAgg({vk 1 , . . . , vk N }): Given N verification keys vk i , it outputs the aggregated ver-
	ification key avk = N i=1 vk	H 1 (vk i ,{vk 1 ,...,vk N }) i	;
	MSSign({vk 1 From all the individual signatures σ i , any combiner (who can be one of the signers)
	computes the multi-signature msig = N j=1 σ	H 1 (vk j ,{vk 1 ,...,vk N }) j	;
	MSVerif(avk, m, msig): Given a verification key avk, a message m and a signature msig, it
	outputs 1 if and only if e(g, msig) = e(H 0 (m), avk).

3.1 Freeman's Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

	3.1.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
	3.1.2 Freeman's Scheme with Projections . . . . . . . . . . . . . . . . . . . . . 27
	3.1.3 Homomorphic Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 28
	3.1.4 Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
	3.1.5 Re-Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
	3.1.6 Verifiability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
	3.1.7 Distributed Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
	3.

2 Optimized Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

	3.2.1 Instantiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
	3.2.2 Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
	3.2.3 Decentralized Homomorphic Encryption . . . . . . . . . . . . . . . . . . 40
	3.2.4 Efficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
	3

.3 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

	3.3.1 Encryption for Boolean Formulae . . . . . . . . . . . . . . . . . . . . . . 44
	3.3.2 Group Testing on Encrypted Data . . . . . . . . . . . . . . . . . . . . . 44
	3.3.3 Consistency Model on Encrypted Data . . . . . . . . . . . . . . . . . . . 45

Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

  Tag-based Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 6.1.2 Signatures with Randomizable Tags . . . . . . . . . . . . . . . . . . . . 83 6.1.3 Aggregate Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Anonymous Ephemeral Identities . . . . . . . . . . . . . . . . . . . . . . 85 6.2.2 Aggregate Signatures with Randomizable Tags . . . . . . . . . . . . . . 85 6.2.3 One-Time ART-Sign Scheme with Square Diffie-Hellman Tags (SqDH) . 87 6.2.4 Bounded ART-Sign Scheme with Square Diffie-Hellman Tags (SqDH) . . 90 Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 6.3.2 Security Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 6.3.3 Anonymous Credential from EphemerId and ART-Sign Scheme . . . . . . 94

	6.1 Overview of our New Primitives . . . . . . . . . . . . . . . . . . . . . 82
	6.1.1 6.2 Aggregate Signatures with Randomizable Tags . . . . . . . . . . . . 84
	6.2.1 6.3 Multi-Authority Anonymous Crendentials . . . . . . . . . . . . . . . 92
	6.3.1 6.4 SqDH-based Anonymous Credentials . . . . . . . . . . . . . . . . . . . 96
	6.4.1 The Basic SqDH-based Anonymous Credential Scheme . . . . . . . . . . 97
	6.4.2 A Compact SqDH-based Anonymous Credential Scheme . . . . . . . . . 98
	6.5 Traceable Anonymous Credentials . . . . . . . . . . . . . . . . . . . . 99
	6.5.1 Traceable Anonymous Credentials . . . . . . . . . . . . . . . . . . . . . 99
	6.5.2 Traceable SqDH-based Anonymous Credentials . . . . . . . . . . . . . . 100
	6.5.3 Groth-Sahai Proof for Square Diffie-Hellman Tracing . . . . . . . . . . . 100
	6.6

  Comparison of different ABC systems.

				k-of-N attributes from K = 1 credential issuer
	Scheme	P T	|CI key|	|Show|	Prover	Verifier
			G 1 , G 2	G 1 , G 2 , (G T ), Z p	exp., pairings	exp., pairings
	[CL11]	s	1, 1	16, 2, (4), 7	16G 1 + 2G 2 + 10G T ,	12G 1 + 20G T ,
					18 + k	18 + k
	[FHS19]	s	0, N	8, 1, 2	9G 1 + 1G 2 , 0	4G 1 , k + 4
	[San20]	r 0, 2N + 1	2, 2, (1), 2	(2(N -k)+2)G 1	(k+1)G 1 + 1G T ,
					+2G 2 , 1	5
	Sec. 6.4.1 s	0, 2k + 3	3, 0, 1	6G 1 , 0	4G 1 + kG 2 , 3
	Sec. 6.4.2 s 0, 2N + 2	3, 0, 1	6G 1 , 0	4G 1 + 2NG 2 , 3
			k = 1-of-N attribute from K credential issuers
	Scheme Scheme	|CI key|	|Show|	Prover	Verifier
		G 1 , G 2	G 1 , G 2 , (G T ), Z p	exp., pairings	exp., pairings
	[CL11]	K×(1, 1)	16, 2, (4), 7	16G 1 + 2G 2 + 10G T ,	12G 1 + 20G T ,
					18 + k	18 + k
	[FHS19]	K ×(0, N )	K ×(8, 1, 2)	K ×(9G 1 + 1G 2 , 0)	K ×(4G 1 , k + 4)
	[San20]	K ×(0, 2N + 1) K ×(2, 2, (1), 2) K ×((2(N -k)+2)G 1 K ×((k+1)G 1 +
					+2G 2 , 1)	1G T , 5)
	Sec. 6.4.1	K ×(0, 2k + 3)	3, 0, 1	6G 1 , 0	4G 1 + kG 2 , 3
	Sec. 6.4.2 K ×(0, 2N + 2)	3, 0, 1	6G 1 , 0	4G 1 + 2KNG 2 , 3
			Figure 6.1:

-Decentralized Evaluation of Quadratic Polynomials on Encrypted Data

-Linearly-Homomorphic Signatures Chapter

-Anonymous Credentials

-Anonymous Credentials proof of tracing, produced by the TraceId algorithm and verified by anybody using the JudgeId algorithm. This proof could be interactive.

B -Another Bounded SqDH-Based ART-Sign

Acknowledgments

Acknowledgments v

5 -MixNet zero-knowledge simulator that does not use i γ i . Under the zero-knowledge property, Adv G 1 < Adv G 2 + negl().

Security Properties

Theorem 17. For s ∈ {1, 2}, E s is IND-CPA under the DDH assumption in G s : for any adversary A running within time t, Adv ind-cpa Es (A) ≤ 2 × Adv ddh Gs (t).

Proof. We denote by Adv ind-cpa Es (A) the advantage of A against E s . We assume the running time of A is bounded by t.

Game G 0 : In this first game, the simulator plays the role of the challenger in the experiment Exp ind-cpa-0 Es (A), where b = 0: S(κ): Game G 4 : The simulator now receives a Diffie-Hellman tuple ([p] s , [r] s ), with r = r • p for some scalar r:

Game G 5 : In this game, the simulator can perfectly emulate the challenger in the experiment Exp ind-cpa-1 Es (A), where b = 1: This game is perfectly indistinguishable from the previous one:

One can note, that in this last game, Pr G 5 [E] = Pr Exp ind-cpa-1

which concludes the proof.

Corollary 18. E T is IND-CPA under the DDH assumptions in G 1 or G 2 . More precisely, for any adversary A running within time t,

where t m is the time for one multiplication and t e the time for one encryption.

We set g 1 ← X(= g u ), g 2 ← Y (= g v ), with either u or v unknown, and randomly choose β i ∈ Z p , for i = 3, . . . , n to set g i ← g β i . Eventually, we randomly choose w i , for i = 1, . . . , n and output (g i , a i = g w i i , b i = a w i i ) together with w i , to the adversary which outputs (α i ) i=1,...,n such that (G = g α i i , A = a α i i = G w , B = b α i i = A w ) for some unknown w. We thus have the following relations:

i , that can be computed, we deduce that:

We consider two cases:

which can be determined by checking whether the equality below holds or not:

One can note that case (1) and case (2) are independent of the bit b.

• If the case (1) happens, but b = 0, one aborts. If b = 1 (which holds with probability 1/2 independently of the case) then we can compute v = -(V -2U w 1 + T w 2 1 )/(α 2 (w 2 1w 2 2 )) mod p which is the discrete logarithm of Z in the basis g.

• Otherwise, the case (2) appears. If b = 1 one aborts. If b = 0 (which holds with probability 1/2 independently of the case), v is known and we have α

In the second scenario, the basis is common (for all i, g i = g), but the w i 's are secret, still random and thus assumed distinct.

Theorem 36. Given n valid Square Diffie-Hellman tuples (g,

is a valid Square Diffie-Hellman, with at least two non-zero coefficients α i , is computationally hard under the SDL assumption.

Lemma 37. Given any fixed value α ∈ Z p and n valid Square Diffie-Hellman tuples (g, a i = g w i , b i = a w i i ), for any g ∈ G and random w i ∈ Z p , outputting (α i ) i=1,...,n such that α = n i=1 α i w i , with at least one non-zero coefficient α i , is computationally hard under the SDL assumption.

Game G 3 : In this game, we do not know anymore the decryption key, and use the indistinguishability of the encryption scheme (which relies on the Decisional Diffie-Hellman assumption): in an hybrid way, we replace the ciphertexts C i of the honest users by an encryption of 1:

Game G 4 : This corresponds to C i = (a i = g r i , b i = h r i ). But now we can know d, but is random: under the DDH assumption, we can replace the random value i = ρ i by i = r i . Ultimately, we set

Game G 5 : In this game, one can first extract the keys of the corrupted users during the certification phase. Then, all the honest mix-servers generate random signing keys sk i , random tags τ i , and random encryptions C i of 1, for all the honest users (the one who do not correspond to the extracted keys), and generate the signatures using the signing keys SK and sk i , but still behave honestly for the ballots of the corrupted users. Then, they apply the permutations Π j,b on the randomized ballots.

Lemma 45 (Random Ballots for Honest Users). Under the Unlinkability Assumption (see Definition 5.4.2) and DDH assumption in G 2 , the view is computationally indistinguishable:

In this last game, the i-th honest user is simulated with initial and output (after each honest mixserver) ciphertexts that are random encryptions of 1, and initial and output signing keys (and thus verification keys vk i and vk i ) independently random. As a consequence, permutations Π j,b are applied on random ballots, which is perfectly indistinguishable from applying Π j,1-b (as we have restricted the two permutations to be identical on ballots of corrupted users): Adv G 5 = 0. Which leads to Adv 0 ≤ negl().

Proof of Lemma 45. In the above sequences of games, from G 0 to G 4 , we could have checked whether the honest vk i 's in the successive ballot-boxes are permutations of randomized honest initial keys, just using the secret keys of the honest users. So, we can assume in the next hybrid games, from G 0 (j) to G 8 (j), for j = N, . . . , 1 that the input ballots in BBox (j-1) contain proper permutations of randomized honest initial keys, as nothing is modified before the generation of this ballot-box. In the following series of hybrid games, for index j, the honest mix-servers up to the j -1-th round play as in G 4 and from the j + 1-th round, they play as in G 5 . Only the behavior of the j-th mix-server is modified: starting from an honest behavior. Hence, G 0 (N ) = G 4 .

Game G 0 (j): In this hybrid game, we assume that the initial ballot-box has been correctly generated (with

for all the honest users), and mixing steps up to BBox (j) have been honestly generated (excepted the zeroknowledge proofs that have been simulated). The next rounds are generated at random by honest mix-servers: random signing keys sk i and random ciphertexts C i = (g, i = r i , a i = g r i , b i = h r i ), with random r i , and then correct signatures, using SK and sk i . The following sequence of games will modify the randomization of BBox (j-1) into BBox (j) if the j-th mix-server is honest.

Game G 1 (j): We now start modifying the randomization of the ballots by the j-th mix-server, for the corrupted users. As we assumed the signatures Σ i provided by the certification 5 -MixNet correctly related for the secret keys (u i , v i , x i , y i ). From l i = (g t i 0 /(g i h d i )) 1/e = g (t i -x i -dy i )/e 0 : we have v i = (t i -x i -dy i )/e. From l i = (g 0 t i /(g i h i d )) 1/e = g 0 (t i -x i -dy i )/e : we have

Using the signing key SK, we can complete and sign vk i (with random R i ) and vk i (with random R i , which implicitly defines µ i ). As shown above, this perfectly simulates the view of the adversary for the honest ballots in the initial ballot-box BBox (0) , with B i = (C i , σ i , vk i , Σ i , τ i ) and a randomized version in the updated ballot-box BBox (j) , with

Game G 4 (j): Let us be given Cred(u i , g; g 0 , r i , t i ) and Cred(u i , g; g 0 , r i , t i ), for random u i $ ← Z p , which provide all the required inputs from the first part of the simulation in the previous game (before choosing x i , y i ). They all follow the distribution D g,g 0 (u i , u i ). As we do not need to know α to randomize ballots for corrupted users, we can thus continue the simulation as above, in a perfectly indistinguishable way:

Game G 5 (j): Let us be given two credentials of u i and u i , Cred(u i , g; g 0 , r i , t i ) and Cred(u i , g;

Inputs follow the distribution D g,g 0 (u i , u i ) and we do as above. Under the Unlinkability Assumption (see Definition 5.4.2) the view is computationally indistinguishable:

Game G 6 (j): We receive a Multi Diffie-Hellman tuple (g 0 , g i , h i , g 0 , g i , h i ) $ ← D 6 mdh (g 0 ). So we know all the scalars, except x i , y i and α, which are implicitly defined by the input challenge. Then, by choosing t i , t i $ ← Z p , we can define l i , l i as in the previous game, and the ciphertexts and signatures are generated honestly with random scalars r i , r i

We do the simulation as above. The view of the adversary is indistinguishable under the DDH assumption in G 2 : Adv G 6 (j) < Adv G 7 (j) + negl().

In this game, vk

for random t i and t i , it is thus also random, and u i is chosen at random. Game G 8 (j): We now choose at random the signing keys sk i = (u i , v i , x i , y i ) and sk i = (u i , v i , x i , y i ) in order to sign the ciphertexts:

With this last game, one can see that G 8 (1) = G 5 . Furthermore, for each round j = N, . . . , 1, we have

Proof of Correctness

For the reader convenience, we also show the correctness of our mix-net: if the input ballot box is correct and the mix-servers follow the protocol then the verifier outputs 1.

If the initial ballot-box

) n i=1 and the proof of each mix-servers are (proof (k) , σ (k) ) N k=1 . If all the mix-servers follow the protocol then n = n and for all k, NIZK DH -Verif(proof (k) ) = 1 and SVerif(VK j , proof (k) , σ (k) ) = 1. Let α k be the witness of the proof proof (k) and α = N k=1 α k . One needs to verify if VerifSign(vk i , C i , σ i,1 ) = 1 and Definition 47 -Aggregate Signatures with randomizable tags (ART-Sign) An ART-Sign scheme, associated to an EphemerId scheme E = (Setup, GenTag, (ProveVTag, VerifVTag), RandTag, DerivWitness) consists of the algorithms (Setup, Keygen, Sign, AggrKey, AggrSign, DerivSign, RandSign, VerifSign):

Setup(1 κ ): Given a security parameter κ, it runs E.Setup and outputs the global parameter param, which includes E.param with the tag space T , and extends it with the message space M;

Keygen(param): Given a public parameter param, it outputs a key-pair (sk,vk);

Sign(sk, τ, m): Given a signing key, a valid tag τ , and a message m ∈ M, it outputs the signature σ;

AggrKey({vk j } j=1 ): Given verification keys vk j , it outputs an aggregated verification key avk;

AggrSign(τ, (vk j , m j , σ j ) j=1 ): Given signed messages m j in σ j under vk j and the same valid tag τ , it outputs a signature σ on the message-set M = {m j } j=1 under the tag τ and aggregated verification key avk;

VerifSign(avk, τ, M , σ): Given a verification key avk, a valid tag τ, a message-set M and a signature σ, it outputs 1 if σ is valid relative to avk and τ , and 0 otherwise;

DerivSign(avk, τ, M , σ, ρ τ →τ ): Given a signature σ on a message-set M under a valid tag τ and aggregated verification key avk, and the randomization link ρ τ →τ between τ and another tag τ , it outputs a signature σ on the message-set M under the new tag τ and the same key avk;

RandSign(avk, τ, M , σ): Given a signature σ on a message-set M under a valid tag τ and aggregated verification key avk, it outputs a new signature σ on the message-set M and the same tag τ .

We stress that all the tags must be valid. Moreover, using algorithms from E, tags are randomizable at any time, and signatures adapted and randomized, even after an aggregation: avk and M can either be single key and message or aggregations of keys and messages. One can remark that only protocol (ProveVTag, VerifVTag) from E is involved in the ART-Sign scheme, as one just needs to check the validity of the tag, not the ownership. The latter will be useful in anonymous credentials with fresh proof of ownership.

Unforgeability.

In the Chosen-Message Unforgeability security game, the adversary has unlimited access to the following oracles, with lists KList and TList initially empty:

• OGenTag() outputs the tag τ and keeps track of the associated witness τ , with (τ , τ ) appended to TList;

• OKeygen() outputs the verification key vk and keeps track of the associated signing key sk, with (sk, vk) appended to KList;

• OSign(τ, vk, m), for (τ, τ ) ∈ TList and (sk, vk) ∈ KList, outputs Sign(sk, τ, m).

It should not be possible to generate a signature that falls outside the range of DerivSign, RandSign, or AggrSign: DerivWitness(τ , ρ τ →τ ): The derived witness remains unchanged: τ = τ .

Valid tags are Square Diffie-Hellman pairs in G 1 :

The randomization does not affect the exponents, hence there are p -1 different equivalence classes L x , for all the non-zero exponents x ∈ Z * p , and correctness is clearly satisfied within equivalence classes. The validity check (see 4.4) is sound as the Groth-Sahai commitment is in the perfectly binding setting. Such tags also admit an interactive Schnorr-like zero-knowledge proof of knowledge of the exponent τ for (ProveKTag(τ ), VerifKTag(τ )) which also provides extractability (knowledge soundness). Under the DSqDH and DL assumptions, given the tag τ , it is hard to recover the exponent τ = x. The tags, after randomization, are uniformly distributed in the equivalence class, and under the DSqDH-assumption, each class is indistinguishable from

1 , and thus one has unlinkability.

Description of the One-Time SqDH-based ART-Sign Scheme.

The above EphemerId scheme can be extended into an ART-Sign scheme where implicit vector messages are signed. As the aggregation can be made on signatures of messages under the same tag but from various signers, the description is given for signers indexed by j and one-component messages indexed by (j, i). However, the scheme needs to be state-full as there is the limitation for a signer j not to sign more than one message by index (j, i) for a given tag: a signer must use two different indices to sign two messages for one tag.

One-Time SqDH-based ART-Sign Scheme Setup(1 κ ): It extends the above setup with the set of messages M = Z p ; Keygen(param): Given the public parameters param, it outputs the signing and verification keys

Note that one could dynamically add new SK j,i and VK j,i to sign implicit vector messages:

Sign(sk j,i , τ, m): Given a signing key sk j,i = [t, u, v, r, s], a message m ∈ Z p and a public tag τ = (τ 1 , τ 2 , τ 3 ), it outputs the signature

AggrKey({vk j,i } j,i ): Given verification keys vk j,i , it outputs the aggregated verification key avk = [avk j ] j , with avk j = VK j ∪ [VK j,i ] i for each j;

AggrSign(τ, (vk j,i , m j,i , σ j,i ) j,i ): Given tuples of verification key vk j,i , message m j,i and signature σ j,i all under the same tag τ , it outputs the signature σ = j,i σ j,i of the concatenation of the messages verifiable with avk ← AggrKey({vk j,i } j,i );

DerivSign(avk, τ, M , σ, ρ τ →τ ): Given a signature σ on tag τ and a message-set M , and ρ τ →τ the randomization link between τ and another tag τ , it outputs σ = σ ρ τ →τ ;

RandSign(avk, τ, M , σ): The scheme being deterministic, it returns σ;

for the honest/corrupted credential issuers. For a user identity id, we define Att[id] the list of the attributes of id and Cred[id] the list of his individual credentials obtained from the credential issuers. All these lists are initialized to the empty set. For both unforgeability and anonymity, the adversary has unlimited access to the oracles: • OCU(id, uvk) corresponds to the corruption of a user with identity id and optionally public key uvk. If the user does not exist yet (i.e. id / ∈ HU ∪ CU), it creates a new corrupted user with public key uvk by adding id to CU. Otherwise, if id ∈ HU, it removes id from HU and adds it to CU and outputs usk and all the associated credentials Cred[id];

• OObtIss(id, ID, a) corresponds to the issuing of a credential from a credential issuer with identity ID (associated to (sk, vk)) to a user with identity id (associated to (usk, uvk)) on the attribute a. If id / ∈ HU or ID / ∈ HCI, it outputs ⊥. Otherwise, it runs σ ← (CredObtain(usk, id),CredIssue(uvk, sk, a)) and adds (ID,a) to Att[id] and (ID,a,σ) to Cred[id];

• OObtain(id, ID, a) corresponds to the issuing of a credential from the adversary playing the role of a malicious credential issuer with identity ID (associated to vk) to an honest user with identity id (associated to (usk, uvk)) on the attribute a. If id / ∈ HU or ID / ∈ CCI, it outputs ⊥. Otherwise, it runs CredObtain(usk, a) and adds (ID, a) to Att[id] and (ID, a, σ) to Cred[id];

• OIssue(id, ID, a) corresponds to the issuing of a credential from an honest credential issuer with identity ID (associated to (sk, vk)) to the adversary playing the role of a malicious user with identity id (associated to uvk) on the attribute a. If id / ∈ CU or ID / ∈ HCI, it outputs ⊥. Otherwise, it runs CredIssue(uvk, sk, a) and adds (ID, a) to Att[id] and (ID, a, σ) to Cred[id];

• OShow(id, {(ID j , a j )} j ) corresponds to the showing by an honest user with identity id (associated to (usk,uvk)) of a credential on the set {(ID j , a j )} j ⊂ Att[id]. If id / ∈ HU, it outputs ⊥. Otherwise, it runs CredShow(usk,{(vk j , a j )} j , σ) with the adversary playing the role of a malicious verifier.

Definition 55 (Unforgeability). An anonymous credential scheme is said unforgeable if, for any polynomial time adversary adversary A having access to O = {OHCI, OCCI, OHU, OCU, OObtIss, OIssue, OShow},

If ∃id ∈ CU, ∀j, either ID j ∈ CCI, or ID j ∈ HCI and (ID j , a j ) ∈ Att[id], then return 0 Return b S art .AggrKey({vk j } j ). Then, it adapts the secret key usk = E.DerivWitness(usk, ρ) as well as the aggregated signature σ = S art .DerivSign(avk, uvk, {a j } j , σ, ρ) and randomizes it: σ = S art .RandSign(avk, uvk , {a j } j , σ ). Finally, it sends to the verifier V the anonymous credential (avk, {a j } j , uvk , σ ). The verifier first checks the freshness of the credential with a proof of ownership of uvk using the interactive protocol (E.ProveKTag(usk ), E.VerifKTag(uvk )) and then verifies the validity of the credential with S art .VerifSign(avk, uvk , {a j } j , σ ).

If one considers corruptions, when one corrupts a user, his secret key is provided, when one corrupts a credential issuer, his secret key is provided.

By replacing all the algorithms by their instantiations for the proposed constructions of EphemerId and ART-Sign schemes, we obtain our constructions of anonymous attribute-based credential schemes. The SqDH construction uses an aggregate signature with (public) randomizable tag, and unforgeability holds even if the witnesses are known. As a consequence, this construction allows corruption of the Credential Issuers and of the users.

Theorem 57. Assuming EphemerId achieves knowledge soundness and ART-Sign is unforgeable, the generic construction is an unforgeable attribute-based credential scheme, in the certified key model.

Proof. Let A be an adversary against the unforgeability of our anonymous credential scheme. We build an adversary B against the unforgeability of the ART-Sign. As we are in the certified key model, even for the corrupted players, the simulator knows the secret keys, as they can be extracted at the certification time. Our adversary B runs the unforgeability security game of the ART-Sign, and answers the oracle queries asked by A as follows: is thus an interactive protocol. In this construction, we can consider a polynomial number n of attributes per credential issuer, where a i is associated to key vk j,i of the Credential Issuer CI j . Again, to keep the unforgeability of the signature, the credential issuer should provide at most one attribute per key vk j,i for a given tag. At the showing time, for proving the ownership of k attributes (possibly from K different credential issuers), the users has to perform k -1 multiplications in G 1 to aggregate the credentials into one, and 4 exponentiations in G 1 for randomization, but just one element from G 1 is sent, as anonymous credential, plus an interactive Schnorr-like proof of SqDH-tuple with knowledge of usk (see 4.4: 2 exponentiations in G 1 , 2 group elements from G 1 , and a scalar in Z p ); whereas the verifier first has to perform 4 exponentiations and 2 multiplications in G 1 for the proof of validity/knowledge of usk, and less than 3k multiplications and k exponentiations in G 2 , and 3 pairings to check the credential. While this is already better than [START_REF] Canard | Anonymous credentials from (indexed) aggregate signatures[END_REF], we can get a better construction.

A Compact SqDH-based Anonymous Credential Scheme

Instead of having a specific key VK j,i for each family of attributes a j,i , and thus limiting to one issuing per family of attributes for each user, we can use the bounded SqDH-based ART-Sign, with free-text attributes: we consider 2n -1 keys, where n is the maximum number of attributes issued for one user by a credential issuer, whatever the attributes are:

Bounded SqDH-based ART-Sign Scheme Setup(1 κ ): Given a security parameter κ, let (G 1 , G 2 , G T , p, g, g, e) be an asymmetric bilinear setting, where g and g are random generators of G 1 and G 2 respectively. We then define param = (G 1 , G 2 , G T , p, g, g, e, H), where H is an hash function in G 1 ;

CIKeyGen(ID): Credential issuer CI with identity ID, generates its keys for n maximum attributes per user

UKeyGen(id): User U with identity id, sets h = H(id) ∈ G * 1 , generates its random secret tag τ $ ← Z * p jointly with CA and computes τ = (h, h τ , h τ 2 ) ∈ G 3 1 : usk = τ and uvk = τ = (h, h τ , h τ 2 );

(CredObtain(usk, a), CredIssue(uvk, sk, a)): User U with identity id and uvk = (τ 1 , τ 2 , τ 3 ) asks to the credential issuer CI for a credential on the attribute a: σ = τ

Note that a ∈ Z * p , so it can be a hash value of the actual free-text attribute;

CredAggr(usk, {(vk j , a j,i , σ j,i )} j,i ): Given credentials σ j,i on attributes (ID j , a j,i ) under the same user key uvk, it outputs the signature σ = j,i σ j,i ;

(CredShow(usk, {(vk j , a j,i )} j,i , σ), CredVerify({(vk j , a j,i )} j,i ): First, a user U randomizes his public key with a random ρ $ ← Z * p , uvk = (τ ρ 1 , τ ρ 2 , τ ρ 3 ), concatenates the keys avk = ∪ j [vk j ], and adapts the signature σ = σ ρ . Then it sends the anonymous credential (avk, {a j,i } j,i , uvk , σ ) to the verifier. The latter first checks the freshness of the credential with a proof of ownership and validity of uvk using a Schnorr-like interactive proof and then verifies the validity of the credential: with n j = #{a j,i }:

Appendix

A Joint Generation of Square Diffie-Hellman Tuples

As already explained, for the unlinkability property to hold in the anonymous credential protocol, we need the user secret key usk = τ random. Of course, this could be done with generic two-party computation, between the user and the Certification Authority.

• The user chooses τ1 $ ← Z p and computes (A 1 = h τ1 , B 1 = A τ1 1 ).

• On its side, the Certification Authority chooses τ2 $ ← Z p and computes

It then sends and certifies τ = (h, A, B) together with τ2 so that the user can compute τ = τ1 + τ2 .

Appendix

B Another Bounded SqDH-Based ART-Sign

We can slightly reduce the parameters of the bounded SqDH-based ART-Sign, but with some limitations on the number of attributed to be signed. It relies on a hash function, modelled as a random oracle in the security analysis.

Description of the Bounded SqDH-based ART-Sign Scheme 2.

We thus propose here a second version, still with the limitation on the total number of messages signed for each tag, but the public keys are twice smaller:

Bounded SqDH-based ART-Sign Scheme 2 Setup(1 κ ): It extends the above EphemerId-setup with the set of messages M = {0, 1} * , but also a hash function H into Z p ;

Keygen(param, n): Given the public parameters param and a length n, it outputs the signing and verification keys

Sign(sk j , τ, m): Given a signing key sk j = [t, u, v, s 1 , . . . , s n ], a message m ∈ Z p and a public tag τ = (τ 1 , τ 2 , τ 3 ), it outputs the signature

AggrKey({vk j } j ): Given verification keys vk j , it outputs the aggregated verification key avk = [vk j ] j ;

AggrSign(τ, (vk j , m j,i , σ j,i ) j,i ): Given tuples of verification key vk j , message m j,i and signature σ j,i all under the same tag τ , it outputs the signature σ = j,i σ j,i of the concatenation of the messages verifiable with avk ← AggrKey({vk j } j );

DerivSign(avk, τ, M , σ, ρ τ →τ ): Given a signature σ on tag τ and a message-set M , and ρ τ →τ the randomization link between τ and another tag τ , it outputs σ = σ ρ τ →τ ;

RandSign(avk, τ, M , σ): The scheme being deterministic, it returns σ;

VerifSign(avk, τ, M , σ): Given a valid tag τ = (τ 1 , τ 2 , τ 3 ), an aggregated verification key avk = [vk j ] j and a message-set M = [m j ] j , with for each j, m j = [m j,i ] i , and a signature σ, one checks if the following equality holds or not, where n j = #{m j,i }:

ABSTRACT

With the massive use of dematerialized storage, homomorphism has become one of the most widely used properties in cryptology. In this thesis we will study how to use it in concrete multi-users protocols requiring not only confidentiality but also anonymity, authentication or verifiability. Homomorphic encryption schemes, homomorphic digital signatures and homomorphic zero-knowledge proofs will be used together, but each time restricted to achieve the desired level of security. First, the confidential aspect is studied for computations on large outsourced databases. Being able to apply functions on encrypted data without having to download and decrypt it entirely may be essential and allows to take advantage of the computational power of the server. This can also be interesting when a third-party company without right-access to the database wants to obtain the result of a computation. However, some guarantees on the learned information need to be taken. To this end, we present a decentralized encryption scheme that allows controlled evaluation of quadratic functions on outsourced data thanks to a group of controllers. However, sometimes confidentiality of the data is not the most desired property for a system as it does not protect the sender. For electronic voting, each encrypted ballot must be associated with its voter to verify that he is allowed to vote. After the voting phase, anonymity is achieved by shuffling so that, during the count, which corresponds to the decryption, no link between votes and voters can be made. We propose a new construction of mix-network based on linearly homomorphic signatures which allows for the first time a verification which is cost-independent of the number of mix-servers. This scalable mix-net improves the efficiency compared to already known constructions, especially with an increasing number of shuffles. Nevertheless, with perfect anonymity comes the threat of malicious use of the system. Cryptology must consider these possible abuses and we propose the first multi-authority anonymous credential protocol with traceability property: a user asks a credential issuer for a credential and uses it to access a system while remaining anonymous. In case of abuse, an authority can revoke anonymity and trace a malicious user. The scheme is as efficient as the previously known credential schemes while achieving the multi-credential issuer functionality.

KEYWORDS

Public-Key Cryptography Homomorphic Protocols Anonymity E-voting Multi-party Computation