ANONYMOUS MESSAGE AUTHENTICATION
Universally Composable Definition and Construction
Kazuki Yoneyama
The University of Electro-Communications, 1-5-1, Chofugaoka, Chofu-shi, Tokyo 182-8585, Japan
Keywords:
Anonymity, anonymous message authentication, universal composability, ring signature, group-certification
authority.
Abstract:
Recently, various casual communication tools which are run by a certain group (e.g., social network ser-
vice, blog and Wiki) are popularized. In such services, a member may want to inform some information to
other group members without exposing his identity. For this perpose, message authentication schemes which
guarantee anonymity of senders seem to be suitable. In this paper, we introduce a new anonymous message
authentication scheme using ring signature with a special certification authority, called group-certification au-
thority. Our scheme does not need any group manager to preserve the anonymity of the group member by
the property of ring signature. Therefore, our scheme is suitable to casual services where a strict operation
is not required by a system manager. Furthermore, we evaluate the security of our scheme in the universal
composability framework.
1 INTRODUCTION
Motivation. In our daily life, open blog services
are widely used. Blog is short for weblog, chrono-
logical publication of comments and thoughts on the
web. Usually, blog is operated by a certain group, and
members freely insert comments or contents. Then,
we consider the anonymity problem of group mem-
bers. That is, when each member of the group ed-
its the blog with a message which contains the target
part of edit and contents, the blog server can verify
whether the editor belongs to the group, but it should
not be able to distinguish a member from other mem-
bers. This property is reasonable for such services
because a member may want to inform some informa-
tion to group members without exposing his identity.
For this purpose, authentication schemes which
guarantee anonymity of senders seem to be suitable.
There are some previous papers (Schechter et al.,
1999; Boneh and Franklin, 1999; Nguyen and Safavi-
Naini, 2005; Nguyen, 2006) which study anonymous
authentication schemes. These schemes aim for the
authentication of the membership of users in some
group. However, for casual services like open blogs,
it is enough to authenticate the message of the sender.
So, we focus on the message authentication scheme
which guarantees anonymity of the sender.
Contribution. We introduce a special type message
authentication scheme which guarantees anonymity:
a sender belonging to a group sends an authenticated
message to a recipient. Then, the recipient verifies
that this message is sent by one of the group mem-
bers, but the recipient cannot distinguish the sender
from other group members. We call this scheme
anonymous message authentication scheme, obtained
from ring signature schemes. Ring signature-based
anonymous message authentication schemes have no
property of revoking members. However, in the case
of a small system blog within a very limited group
(e.g., laboratory) where the joining and revoking of
the members are very rare, ring signature is preferable
to group signature, because we do not need any group
manager in ring signature to preserve the anonymity
of the group members, in contrast to group signatures.
In an unauthenticated communication model, it is im-
possible to construct the anonymous message authen-
tication scheme by only using ring signature because
we cannot confirm whether verification keys which
are gone public are true keys of members. Thus, we
need to bind messages and signatures to “physical en-
tities” directly. We make the minimal set-up assump-
tion that parties have access to a “certification author-
ity (CA)” who registers party identities together with
verification keys. Since a verifier in ring signature
351
Yoneyama K. (2008).
ANONYMOUS MESSAGE AUTHENTICATION - Universally Composable Definition and Construction.
In Proceedings of the International Conference on Security and Cryptography, pages 351-354
DOI: 10.5220/0001916503510354
Copyright
c
 SciTePress

schemes verifies signatures by using the list of veri-
fication keys for the group from CA, our scheme as-
sumes that parties have access to “group CA (gCA)”
who records the list of verification keys for the group.
Furthermore, we evaluate the security of our
scheme with universal composability (UC) frame-
work which was introduced in (Canetti, 2001). The
advantage to traditional frameworks is that UC pro-
vides strong secure composability (i.e., the security
of a primitive which has UC security in a stand-alone
manner will always be preserved even when it is exe-
cuted concurrently with other unbounded number of
UC secure primitives in an adversarially controlled
manner).
To formulate our scheme and these settings in UC
framework, we first formulate a new ideal anonymous
message authentication functionality F
aAUTH
as an
extension of the ideal message authentication func-
tionality F
AUTH
in (Canetti, 2004), and assume a ring
signature scheme and a group-certification authority
which are represented by an ideal ring signature func-
tionality F
rSIG
in (Yoneyama and Ohta, 2007) and a
new ideal group-certification authority functionality
F
gCA
. Next, we show that our anonymous message
authentication scheme realizes F
aAUTH
given ideal
access to F
rSIG
and F
gCA
(i.e., (F
rSIG
, F
gCA
)-hybrid
model).
2 PRELIMINARIES
In this section, we will present the intuitive frame-
work of ring signature schemes, group-certification
authority and our anonymous message authentication
scheme. For the formal UC definition, readers refer
to (Canetti, 2001).
Ring Signature. Ring signature schemes permit any
party to generate a signing key and a verification key.
A signer chooses group members from parties who
generate keys and makes public their verification
keys without the group manager. Let M
all
be the set
of parties who generate their keys, and L
all
be the
list of their verification keys. Furthermore, let M
be a subset of M
all
with n elements of M, and L be
the list of verification keys of the group members in
M. Also, a signature of a message is generated by a
signer of the group M. Though any party can verify
the signature using L as a verifier, he cannot identify
the signer in M.
Group-Certification Authority. In general, a rudi-
mentary certification authority guarantees binding be-
tween a single party’s identity with previously regis-
tered value. However, our scheme requires guaran-
teeing binding between a group’s identity with the list
of the group’s verification keys. Therefore, we sup-
pose that there is a group-certification authority gCA
which guarantees the connection between a group M
and the list of the group’s verification keys L.
Anonymous Message Authentication. Our anony-
mous message authentication scheme is based on ring
signature schemes with gCA. Ring signature is used
for binding a sender’s message m with the group M
to which the sender belongs. Furthermore, by using
gCA, the recipient can obtain the list of verification
keys L which are generated by the group members.
Therefore, our scheme guarantees the following three
properties:
• Group Authenticity the recipient is able to verify
that the message m is certainly sent by a member
of the group M because a party who does not be-
long to M cannot generate a valid signature from
the property of ring signature.
• Anonymity of Sender the recipient cannot iden-
tify the sender from other members of the group
M because signature verification in ring signature
only needs a set of a message, a signature and a
list of verification keys as inputs.
• No trusted Third Party our scheme does not
need the group manager who manages group, e.g.,
joining and revoking members, because ring sig-
nature also does not need the group manager.
3 FORMULATING NEW
FUNCTIONALITIES
In this section, we will define a new ideal function-
ality F
aAUTH
which represents anonymous message
authentication schemes and a new group-certification
authority functionality F
gCA
based on the ideal mes-
sage authentication functionality F
AUTH
and the ideal
certification authority functionality F
CA
in (Canetti,
2004) respectively.
3.1 Anonymous Message Authentication
Functionality F
aAUTH
The essential difference between F
aAUTH
and F
AUTH
is output to a recipient in the Receiving Message
phase. When each party behaves correctly, F
aAUTH
provides the name of the group to which the sender
belongs instead of the name of an entity to the recip-
ient. As F
AUTH
, F
aAUTH
does not ensure the revoca-
tion property of recorded data because this is able to
SECRYPT 2008 - International Conference on Security and Cryptography
352

Functionality F
aAUTH
Sending Message: On input (“Send”, sid, P
j
, m, M) from party P
i
, verify that P
i
∈ M. If not, ignore the input. Else,
send (“Sent”, sid, M, P
j
, m) to the adversary.
Receiving Message: On input (“Send”,sid, P
j
′
, m
′
) from the adversary, verify that P
i
is uncorrupted. If not, send
(“Sent”,sid, M, m
′
) to party P
j
′
. Else, send (“Sent”,sid, M, m) to party P
j
.
Figure 1: Anonymous message authentication functionality F
aAUTH
.
Functionality F
gCA
Resister Key: On first input (“Register”, sid, v
i
) from party P
i
, forward (“Registered”, sid, v
i
) to the adversary. On
input “OK” from the adversary, verify that this is the first request from P
i
. If not, ignore the input. Else, record
M
all
← M
all
∪ {P
i
} and L
all
← L
all
∪ {v
i
}.
Retrieve Key: On input (“Retrieve”,sid, M) from party P
j
, forward (“Retrieve”,sid, P
j
, M) to the adversary. On input
“OK” from the adversary, verify that M ⊆ M
all
. If not, output (“Retrieve”, sid, ⊥). Else, output (“Retrieve”, sid, L).
Figure 2: Group-certification authority functionality F
gCA
.
be considered as an optional property. Figure 1 shows
the functionality F
aAUTH
.
Here, we show several notable points of formula-
tion of F
aAUTH
.
Guaranteeing Anonymity of Sender. When a
sender P
i
is uncorrupted and belongs to the group M,
F
aAUTH
sends (“Sent”,sid, M, m) to party P
j
. Then,
though P
j
recognizes that P
i
belongs to the group
M, P
j
cannot distinguish P
i
from other members of
M. Therefore, F
aAUTH
guarantees anonymity of the
sender.
Group Authenticity. When a sender P
i
is uncor-
rupted and does not belong to the group M, F
aAUTH
ignores the input of P
i
. This formulation means
that an invalid sender, i.e., non-member of the group
M, cannot succeed to be authenticated. Therefore,
F
aAUTH
guarantees the property of rejecting such an
invalid sender.
3.2 Group-Certification Authority
Functionality F
gCA
Next, We define group-certification authority func-
tionality F
gCA
. F
gCA
is obtained from an extension
of F
CA
in (Canetti, 2004). To adapt to the setting
of anonymous message authentication scheme, F
gCA
outputs a list of verification keys instead of a verifi-
cation key directly. F
gCA
accepts only first registered
values, and does not allow for modification or “revo-
cation”. Such more advanced features are of course
useful, but are not necessary for our basic use. We
stress that F
gCA
does not perform any checks on the
registered value; it simply acts as a public bulletin
board. (In particular, no “proof of possession of sign-
ing key”is required.) Figure 2 shows the functionality
F
gCA
.
4 REALIZING F
aAUTH
GIVEN
RING SIGNATURE WITH GCA
In this section, we present our anonymous message
authentication scheme, called RAMA, given a UC se-
cure ring signature scheme. Also, we assume that
parties can access to gCA in our scheme. This as-
sumption is considered as an ideal access to F
rSIG
(Yoneyama and Ohta, 2007) and F
gCA
in the UC
framework. Then, we claim that RAMA securely re-
alizes F
aAUTH
in the (F
rSIG
, F
gCA
)-hybrid model.
4.1 Ring Signature-based Anonymous
Message Authentication Protocol
RAMA
Here, we show our scheme, called RAMA. RAMA
stands for “Ring signature-based anonymousmessage
authentication”. Therefore, in the basic definition,
this protocol is based on ring signature schemes with
gCA, and, in the UC definition, that realizes F
aAUTH
in the (F
rSIG
, F
gCA
)-hybrid model. Figure 3 shows the
protocol RAMA.
The unforgeability property of the ring signature
guarantees the group authenticity property of RAMA
because an invalid sender which is not a member of
the group cannot forge a signature which is accepted
by recipients. Also, the anonymity property of the
ring signature guarantees the anonymity of sender
ANONYMOUS MESSAGE AUTHENTICATION - Universally Composable Definition and Construction
353

Protocol RAMA
For all P
′
∈ M, in the first activation, P
′
sends (“KeyGen”, sid
rSIG
) to F
rSIG
, and obtains (“Verification Algorithms”,
sid
rSIG
, RV
′
) from F
rSIG
. P
′
sets v
′
= RV
′
sends (“Register”, sid
gCA
, v
′
) to F
gCA
.
Sending Message. When party P
i
is activated with input (“Send”, sid, P
j
, m, M), party P
i
does:
1. P
i
checks P
i
∈ M. If not, then P
i
halts. Else, sets m
′
= (m, P
j
).
2. P
i
sends (“Retrieve”, sid
gCA
, M) to F
gCA
, and obtains (“Retrieve”, sid
gCA
, L). Also, P
i
sends (“Sign”,
sid
rSIG
, m
′
, L) to F
rSIG
, and obtains (“Signature”, sid
rSIG
, m
′
, L, σ) from F
rSIG
. Finally, P
i
sends
(sid, M, m, σ) to party P
j
.
Receiving Message. When party P
j
is activated with input (sid, M, m, σ), party P
j
does:
1. P
j
sets m
′
= (m, P
j
).
2. P
j
verifies that a pair (M, L) is recorded. If not, P
j
sends (“Retrieve”, sid
gCA
, M) to F
gCA
, and obtains
(“Retrieve”, sid
gCA
, L). Then, if L = ⊥, P
j
derives (“Verified”, sid
rSIG
, m
′
, 0), i.e., rejects the signature,
outputs nothing. Else, P
j
records a pair (M, L).
3. P
j
sends (“Verify”, sid
rSIG
, m
′
, σ, L) to F
rSIG
, and obtains (“Verified”, sid
rSIG
, m
′
, f ) from F
rSIG
. If f = 1,
P
j
outputs (“Sent”, sid, M, m) and halts. Else, P
j
outputs nothing.
Figure 3: Ring signature-based anonymous message authentication protocol RAMA.
property of RAMA because a recipient cannot dis-
tinguish the sender with other members of the group
while the recipient is able to authenticate that the
message is certainly sent by a member of the group.
Theorem 4.1 Protocol RAMA securely realizes
F
aAUTH
in the (F
rSIG
, F
gCA
)-hybrid model.
[Proof Idea.] Let A be an adversary in the
(F
rSIG
, F
gCA
)-hybrid model. The proof outline is that
for any A we can construct a simulator S such that any
environment Z cannot successfully distinguish the in-
teraction with A and parties running RAMA in the
(F
rSIG
, F
gCA
)-hybrid model from the interaction with
S and parties for F
aAUTH
in the ideal model. Simula-
tor S runs simulated copy of A and the interface for
A . Then, S forwards all instructions from Z to A and
back. The detail of the proof will be shown in the full
paper.
5 PRACTICAL APPLICATION
Here, we consider casual applications, more specif-
ically, open blog services, Wiki and social network
services. Especially, we pick up a blog that is pro-
moted by a small group (e.g., a laboratory) and al-
lows members to freely insert comments or contents.
In this setting, the case of no group manager is handy
to promote for such a small system than the case of
a group manager because the change of permission is
not frequent. Therefore, our scheme is quite suitable
for such services. Because the UC security guarantees
strongly composable security under concurrent exe-
cution environments among any other protocols, the
security of our scheme provides elimination of loads
to prove security of these applications.
REFERENCES
Boneh, D. and Franklin, M. K. (1999). Anonymous Authen-
tication with Subset Queries. In ACM Conference on
Computer and Communications Security 1999, pages
113–119.
Canetti, R. (2001). Universally Composable Security: A
New Paradigm for Cryptographic Protocols. In FOCS
2001, pages 136–145.
Canetti, R. (2004). Universally Composable Signatures,
Certification and Authentication. In CSFW 2004,
pages 219–233.
Nguyen, L. (2006). Efficient Dynamic k-Times Anonymous
Authentication. In VIETCRYPT 2006, pages 81–98.
Nguyen, L. and Safavi-Naini, R. (2005). Dynamic k-Times
Anonymous Authentication. In ACNS 2005, pages
318–333.
Schechter, S., Parnell, T., and Hartemink, A. (1999).
Anonymous Authentication of Membership in Dy-
namic Groups. In Financial Cryptography 1999,
pages 184–195.
Yoneyama, K. and Ohta, K. (2007). Ring Signatures: Uni-
versally Composable Definitions and Constructions.
In ASIACCS 2007, pages 374–376.
SECRYPT 2008 - International Conference on Security and Cryptography
354