Public data can be authenticated via TLS from trustworthy websites, while private data, such as user profiles, is generally restricted. Users cannot share their username and password to access private data (e.g., addresses) from restricted sites (e.g., utility companies). DECO (CCS 2020) presents a TLS 1.2-based solution that facilitates data liberation without imposing excessive trust assumptions or requiring server-side modifications. In our previous work, DIDO (ISPEC 2023), we proposed an optimized solution for TLS 1.3 websites. We addressed several open problems, including support for X25519 key exchange, the design of round-optimal three-party key exchange, the architecture of 2 PC for TLS 1.3 key scheduling, and circuit design optimized for 2 PC. Our implementation was tested on real-world websites. In this work, DIDO+, we provide a comparison with recent concurrent efforts and offer additional details about DIDO. We also present the NIZK proofs utilized in three-party key exchange under malicious settings. Finally, we introduce a new protocol called selective disclosure, which allows for the disclosure of specific portions of plaintext to the verifier, instead of the entirety.

Chameleon hash (CH) function differs from a classical hash function in a way that a collision can be found with the knowledge of a trapdoor secret key. CH schemes have been used in various cryptographic applications such as sanitizable signatures and redactable blockchains. In this work, we reconstruct CH to ensure advanced security and usability. Our contributions are four-fold. First, we propose the first CH scheme, which supports full security, meaning the inclusion of both full indistinguishability and full collision-resistance. These two properties are required in the strongest CH security model in the literature. We achieve this by our innovative design of removing the CH public key during the computation of the hash value. Second, we investigate the security of CH in the multi-party setting and introduce the new properties of claimability and deniability under this setting. Third, we present and implement two instantiations of our CH scheme: an ECC-based one and a post-quantum lattice-based one. Our implementation demonstrates their practicality. Finally, we discuss the possible use cases in the blockchain.

Abstract In most threshold Elliptic Curve Digital Signature Algorithm (ECDSA) signatures using additively homomorphic encryption, the zero-knowledge (ZK) proofs related to the ciphertext or the message space are the bottleneck in terms of bandwidth as well as computation time. In this paper, we propose a compact ZK proof for relations related to the Castagnos–Laguillaumie (CL) encryption, which is 33% shorter and 29% faster than the existing work in PKC 2021. We also give new ZK proofs for relations related to homomorphic operations over the CL ciphertext. These new ZK proofs are useful to construct a bandwidth-efficient universal composable-secure threshold ECDSA without compromising the proactive security and the non-interactivity. In particular, we lowered the communication and computation cost of the key refresh algorithm in the Paillier-based counterpart from $O(n^3)$ to $O(n^2)$. Considering a 5-signer setting, the bandwidth is better than the Paillier-based counterpart for up to 99, 95 and 35% for key generation, key refreshment and pre-signing, respectively.

Threshold ECDSA receives interest lately due to its widespread adoption in blockchain applications. A common building block of all leading constructions involves a secure conversion of multiplicative shares into additive ones, which is called the multiplicative-to-additive (MtA) function. MtA dominates the overall complexity of all existing threshold ECDSA constructions. Specifically, O(n2) invocations of MtA are required in the case of n active signers. Hence, improvement of MtA leads directly to significant improvements for all state-of-the-art threshold ECDSA schemes.