Zero-Knowledge Non-Revocation Authentication With Reduced Proof Size
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication mechanisms, such as EPID, require sending large amounts of data (approximately 894 bits per pair in the revocation list) to prove non-revocation, which becomes cumbersome as the number of revoked signatures increases, posing a significant drawback.
Innovation Solution
An authentication method that generates a signature using a pair (h, hX100) and provides a zero-knowledge proof with a single element Ci of the mathematical group, along with a character string, to demonstrate non-revocation, reducing the communication burden to 380 bits regardless of the revocation list size.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If three group elements are sent to prove non-revocation for each pair in the revocation list, then the proof of non-revocation is complete, but the communication size increases significantly with large revocation lists
Solution Approach 1:
The patent merges multiple group elements into a single group element by computing Ci = (hi^ai * ki)^A / (ai + X100) where hi and ki are components of the i-th revocation pair. This single Ci element replaces the traditional three group elements, reducing communication size while maintaining the ability to prove non-revocation through the zero-knowledge proof that X100 was used to generate Ci.
2Reliability
If three group elements are sent for each revocation pair, then authentication reliability is maintained, but information disclosure increases
Solution Approach 1:
The patent extracts only the essential information needed for verification by computing a single group element Ci that encapsulates the relationship between the revocation pair (hi, ki) and the secret X100. The zero-knowledge proof ensures that no additional information about X100 is disclosed, as the proof verifies only that X100 was used to generate Ci without revealing its value or other properties.
3Reliability
If revocation lists contain many pairs (hi, ki), then revocation coverage is improved, but the communication burden for proof increases linearly
Solution Approach 1:
The patent segments the revocation list into individual pairs (hi, ki) and processes each pair independently by computing a corresponding Ci element. This segmentation allows the system to handle large revocation lists efficiently, as each pair contributes only one group element to the total communication rather than three, reducing the linear growth rate of communication burden while maintaining comprehensive revocation coverage.
Data Source
AI summary
Method and device for authentication of non-revocation. A revocation list includes at least one pair extracted from a signature generated by a revoked entity, where hi is an element of a mathematical group and ki=hixi, where xi is a secret of the revoked entity. A first entity sends, to a second entity, to authenticate itself therewith: a signature generated by the first entity for this authentication; a character string; an element of the group for each pair in the revocation list; and a zero-knowledge proof that the first entity used a secret of this first entity and the character string to obtain the group element for each pair. The second entity rejects the first entity if the zero-knowledge proof is not valid or if, for at least one the pair, the group element is such that Ci=hiA, where A is a known value.