Next: JareckiLysyanskayaEDCF, Previous: CachinKursawePetzoldShoupRBC, Up: Classes [Contents][Index]

The two classes of this subsection are concrete instantiations of Barnett and Smart’s VTMF primitive [BS03]. More formally, the authors specify four different protocols:

- Key Generation Protocol
- Verifiable Masking Protocol
- Verifiable Re-masking Protocol
- Verifiable Decryption Protocol

Each protocol uses low-level operations on an appropriately chosen algebraic
group *G*. The choice of this group is crucial to the security of the
card encoding scheme and thus also to the security of high-level operations
on cards resp. stacks.

There are just a few methods and members of these classes that might be of
general interest for an application programmer, e.g. the methods of the key
generation protocol. The other stuff is only used internally by high-level
operations of `SchindelhauerTMCG`

. Therefore this manual omits the
description of such internal functions and members.

- Class:
**BarnettSmartVTMF_dlog** This class implements the discrete logarithm instantiation of the VTMF primitive in the field

*{\bf Z}/p{\bf Z}*, where*p*is a large prime number. The mathematical computations are performed in the finite cyclic subgroup*G*of prime order*q*such that*p = kq + 1*holds for some*k\in {\bf Z}*. The security relies on the DDH assumption in*G*, i.e., the distribution*\{g^a, g^b, g^{ab}\}*is computationally indistinguishable from*\{g^a, g^b, g^c\}*, where*g*is a generator of*G*and*a, b, c*are chosen at random from*{\bf Z}_q*. Currently, this well-established assumption is believed to hold, if*p*and*q*are chosen according to the predefined security parameters of LibTMCG.- Member of BarnettSmartVTMF_dlog:
*mpz_t***p** This is the public prime number

*p*which defines the underlying finite field*{\bf Z}/p{\bf Z}*.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***q** This is the public prime number

*q*which defines the underlying cyclic group*G*.*G*is a subgroup of*{\bf Z}/p{\bf Z}*and is exactly of order*q*.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***g** This is the fixed public generator

*g*of the underlying group*G*.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***k** This is a public integer

*k*such that*p = kq + 1*holds.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***h** This is the common public key

*h = \prod_{i=1}^k h_i*which contains the public keys*h_i*of each player*P_i*. Note that in the above formula*k*denotes the number of players.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***h_i** This is the public key

*h_i*of this player instance.

- Constructor on BarnettSmartVTMF_dlog:
**BarnettSmartVTMF_dlog***(*`const unsigned long int`

fieldsize`=TMCG_DDH_SIZE`

,`const unsigned long int`

subgroupsize`=TMCG_DLSE_SIZE`

,`const bool`

canonical_g_usage`=false`

,`const bool`

initialize_group`=true`

) This constructor creates a new VTMF instance. That means, the primes

*p*and*q*are randomly and uniformly chosen such that they have length`fieldsize`bit and`subgroupsize`bit, respectively. Further, either a generator*g*for the unique subgroup of order*q*is chosen at random or, if`canonical_g_usage`is set`true`

, the generator*g*is chosen in a verifiable way (cf. FIPS 186-3 A.2.3). If the arguments are omitted, then`fieldsize`,`subgroupsize`and`canonical_g_usage`are set to their default values`TMCG_DDH_SIZE`

,`TMCG_DLSE_SIZE`

, and`false`

, respectively. The argument`initialize_group`should be always set`true`

. Depending on`fieldsize`and`subgroupsize`the group generation is a very time-consuming task that should be taken into account by the application designer.

- Constructor on BarnettSmartVTMF_dlog:
**BarnettSmartVTMF_dlog***(*`std::istream&`

in,`const unsigned long int`

fieldsize`=TMCG_DDH_SIZE`

,`const unsigned long int`

subgroupsize`=TMCG_DLSE_SIZE`

,`bool`

canonical_g_usage`=false`

,`const bool`

precompute`=true`

) This constructor initializes the VTMF instance from a correctly formatted input stream

`in`. For example, such a stream can be generated by calling the method`PublishGroup`

of an already created instance. The arguments`fieldsize`,`subgroupsize`, and`canonical_g_usage`are stored for later following usage, e.g. by the method`CheckGroup`

as explained below. The argument`precompute`should be always set`true`

. If these arguments are omitted, then they are set to the default values`TMCG_DDH_SIZE`

,`TMCG_DLSE_SIZE`

,`false`

, and`true`

respectively.

- Method on BarnettSmartVTMF_dlog:
*bool***CheckGroup***()* This method checks whether

*p*and*q*have appropriate sizes with respect to the bit lengths given during the initialization of the corresponding instance. Further, it checks whether*p*has the correct form (i.e.*p = kq +1*), whether*p*and*q*are probable prime, and whether*g*is a generator of the subgroup*G*. If`canonical_g_usage`is set`true`

during the call of constructor, then it additionally checks whether*g*was generated in a verifiable way (cf. FIPS 186-3 A.2.3). It returns`true`

, if all of these checks have been passed successfully.

- Method on BarnettSmartVTMF_dlog:
*void***PublishGroup***(*`std::ostream&`

out) This method exports all necessary group parameters of

*G*to the given output stream`out`, so other VTMF instances of*G*can be initialized, e.g. with the second constructor of`BarnettSmartVTMF_dlog`

.

- Method on BarnettSmartVTMF_dlog:
*void***KeyGenerationProtocol_GenerateKey***()* This method generates a VTMF key pair and stores the numbers internally for a later following usage. It must be called before any other part of the key generation protocol is executed. Otherwise, the produced results are wrong.

- Method on BarnettSmartVTMF_dlog:
*void***KeyGenerationProtocol_PublishKey***(*`std::ostream&`

out) This method exports the public part

*h_i*of the generated VTMF key pair to the given output stream`out`. Further, it appends a non-interactive zero-knowledge proof of knowledge (NIZK) which shows that the instance knows the secret part*x_i*such that*h_i \equiv g^{x_i} \pmod{p}*holds. Due to the non-interactive nature of this proof the method has to be called only once while the computed output can be reused multiple times if necessary.

- Method on BarnettSmartVTMF_dlog:
*bool***KeyGenerationProtocol_UpdateKey***(*`std::istream&`

in) This method reads the public part of a VTMF key and the NIZK from the input stream

`in`. It appends the key to the common public key and returns`true`

, if the given proof was sound. Otherwise,`false`

is returned.

- Method on BarnettSmartVTMF_dlog:
*bool***KeyGenerationProtocol_RemoveKey***(*`std::istream&`

in) This method reads the public part of a VTMF key and the corresponding NIZK from the input stream

`in`. It removes the key from the common public key and returns`true`

, if the key was previously appended by`KeyGenerationProtocol_UpdateKey`

as explained above.

- Method on BarnettSmartVTMF_dlog:
*void***KeyGenerationProtocol_Finalize***()* This method must be called after any update (

`KeyGenerationProtocol_UpdateKey`

) or removal (`KeyGenerationProtocol_RemoveKey`

) has been performed on the common public key.

- Destructor on BarnettSmartVTMF_dlog:
**~BarnettSmartVTMF_dlog***()* This destructor releases all occupied resources.

- Member of BarnettSmartVTMF_dlog:

- Subclass of
`BarnettSmartVTMF_dlog`

:**BarnettSmartVTMF_dlog_GroupQR** This subclass implements the discrete logarithm instantiation of the VTMF primitive in the field

*{\bf Z}/p{\bf Z}*, where*p*is a large prime number. The mathematical computations are performed in a special finite cyclic subgroup*G*(quadratic residues modulo*p*) of prime order*q*, where*p = 2q + 1*holds. The security also relies on the DDH assumption w.r.t.*G*, i.e., the distribution*\{g^a, g^b, g^{ab}\}*is computationally indistinguishable from*\{g^a, g^b, g^c\}*, where*g*is a generator of*G*and*a, b, c*are chosen at random from*{\bf Z}_q*. Currently, this well-established assumption is believed to hold, if*p*and*q*are chosen according to the predefined security parameters of LibTMCG.- Member of BarnettSmartVTMF_dlog:
*mpz_t***p** This is the public prime number

*p*which defines the underlying finite field*{\bf Z}/p{\bf Z}*.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***q** This is the public prime number

*q*which defines the underlying cyclic group*G*.*G*denotes the unique subgroup of quadratic residues modulo*p*which is exactly of order*q*, if*p = 2q + 1*holds.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***g** This is the fixed public generator

*g*of the underlying group*G*.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***k** This integer is fixed here by

*k = 2*.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***h** This is the common public key

*h = \prod_{i=1}^k h_i*which contains the public keys*h_i*of each player*P_i*. Note that in the above formula*k*denotes the number of players.

- Member of BarnettSmartVTMF_dlog:
*mpz_t***h_i** This is the public key

*h_i*of this player instance.

- Constructor on BarnettSmartVTMF_dlog_GroupQR:
**BarnettSmartVTMF_dlog_GroupQR***(*`const unsigned long int`

fieldsize`=TMCG_DDH_SIZE`

,`const unsigned long int`

exponentsize`=TMCG_DLSE_SIZE`

) This constructor creates a new VTMF instance. That means, the safe prime

*p*is randomly and uniformly chosen such that it has a length of`fieldsize`bit. Further, the generator*g*is initially set up by*2*and then shifted bybit positions, according to the procedure described by Koshiba and Kurosawa (see`fieldsize`-`exponentsize`*Short Exponent Diffie-Hellman Problems*, PKC 2004, LNCS 2947). If the arguments of the constructor are omitted, then`fieldsize`and`exponentsize`are set to their default values`TMCG_DDH_SIZE`

and`TMCG_DLSE_SIZE`

, respectively. Depending on`fieldsize`and`exponentsize`the group generation is a very time-consuming task that should be taken into account by the application designer.

- Constructor on BarnettSmartVTMF_dlog_GroupQR:
**BarnettSmartVTMF_dlog_GroupQR***(*`std::istream&`

in,`const unsigned long int`

fieldsize`=TMCG_DDH_SIZE`

,`const unsigned long int`

exponentsize`=TMCG_DLSE_SIZE`

) This constructor initializes the VTMF instance from a correctly formatted input stream

`in`. For example, such a stream can be generated by calling the method`PublishGroup`

of an already created instance. The arguments`fieldsize`and`exponentsize`are stored for later following usage, e.g. by the method`CheckGroup`

as explained below. If these arguments are omitted, then they are set to the default values`TMCG_DDH_SIZE`

and`TMCG_DLSE_SIZE`

, respectively.

- Method on BarnettSmartVTMF_dlog_GroupQR:
*bool***CheckGroup***()* This method checks whether

*p*and*q*have appropriate sizes with respect to the bit lengths given during the initialization of the corresponding instance. Further, it checks whether*p*has the correct form (i.e.*p = 2q +1*), whether*p*and*q*are probable prime, and whether*g*is a generator of the subgroup*G*. It returns`true`

, if all of these checks have been passed successfully.

- Destructor on BarnettSmartVTMF_dlog_GroupQR:
**~BarnettSmartVTMF_dlog_GroupQR***()* This destructor releases all occupied resources.

- Member of BarnettSmartVTMF_dlog:

Next: JareckiLysyanskayaEDCF, Previous: CachinKursawePetzoldShoupRBC, Up: Classes [Contents][Index]