## Anonymous Fingerprinting with Direct Non-Repudiation (2000)

Citations: | 6 - 1 self |

### BibTeX

@INPROCEEDINGS{Pfitzmann00anonymousfingerprinting,

author = {Birgit Pfitzmann and Ahmad-reza Sadeghi},

title = {Anonymous Fingerprinting with Direct Non-Repudiation},

booktitle = {},

year = {2000},

pages = {401--414},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

Fingerprinting schemes support copyright protection by enabling the merchant of a data item to

### Citations

583 | Efficient Signature Generation by Smart Cards - Schnorr - 1991 |

493 |
Undeniable signature
- Chaum, Antwerpen
- 1990
(Show Context)
Citation Context ...that a dissolved company did not leave such information to its legal successors. The difference is similar to that between normal digital signatures (direct non-repudiation) and undeniable signatures =-=[CA90]-=- (signer needed in trial). In this paper, we remedy this problem. The new construction is coin-based again and equally efficient as the previous one. The new part is based on methods from coin tracing... |

285 | Collusion-secure fingerprinting for digital data - Boneh, Shaw - 1995 |

226 | Untraceable off-line cash in wallets with observers
- Brands
(Show Context)
Citation Context ... M 2 ). Let m j g i 1 g 2 = h 1 g 2 be the value typically signed in Brands' scheme), M j M 1 M 2 , and N j mM . This N is the common input to the blind signing protocol (essentially from [CP93]). In =-=[Bra94]-=-, an additional value is included in the hashing; we use pk text in that place. The resulting protocol is shown in Figure 2. B RC z / N x w 2R Z q a / g w mod p s 2R Z q /\Gamma z; a; b \Gamma\Gamma\G... |

136 | An efficient off-line electronic cash system based on the representation problem
- Brands
- 1993
(Show Context)
Citation Context ... value i as the original m, and also that the delayed verification of pk text works. In [Bra94], Brands only works with two generators g 1 ; g 2 , while we use four. However, in the underlying report =-=[Bra93]-=- the same assumptions are made and heuristically explained for any number of generators g 1 ; : : : ; g n , and coin systems with more than two generators have also been presented in [BGK95, FTY98]. T... |

134 | A secure, robust watermark for multimedia - Cox, Kilian, et al. - 1996 |

109 | Securing Threshold Cryptosystems against Chosen Ciphertext Attack
- SHOUP, GENNARO
- 2002
(Show Context)
Citation Context ... signature. However, in our scenario the adversary interacts with the bank as blind signer, in addition to the random oracle. This gives the same problems with exponential rewinding as in [PS96c] and =-=[SG98]-=-, Section 2.4. It may be interesting to investigate how to modify either the proof techniques or the scheme so that some proof of this type goes through, but for the moment we had to make the stronger... |

77 | Trustee-based tracing extensions to anonymous cash and the making of anonymous change - Brickell, Gemmel, et al. - 1995 |

68 | Digital payment systems with passive anonymity-revoking trustees - Camenisch, Maurer, et al. - 1997 |

58 | Asymmetic Fingerprinting - Pfitzmann, Schunter - 1996 |

36 | Fingerprinting long forgiving messages - Meadows, Blakley, et al. - 1986 |

33 |
Moni Naor. Tracing traitors
- Chor, Fiat
- 1994
(Show Context)
Citation Context ... pseudonym instead of a real identity. In the context of 1 fingerprinting a distinction can be made whether one fingerprints the actual data item or a key for decrypting it. The latter, introduced in =-=[CFN94], is typic-=-ally called "traitor tracing." Here we deal with anonymous asymmetric data fingerprinting with collusion tolerance. 1 Anonymous fingerprinting was introduced in [PW97b], but only a construct... |

28 | Asymmetric fingerprinting for larger collusions - Pfitzmann, Waidner - 1997 |

24 |
Jan-Hendrik Evertse, Jeroen van de Graaf, and RenĂ© Peralta. Demonstrating Possession of a Discrete Logarithm Without Revealing It
- Chaum
- 1987
(Show Context)
Citation Context ...-knowledge proof of knowledge of the values i; j; k; y such that the public values, i.e., h 1 ; h 3 ; enc; M 1 ; M 2 fulfill the prescribed equations. This can be done by using a simple protocol from =-=[CEG88] for i and-=- the specific "indirect discourse proof" from [FTY96] for the remaining parameters. However, there is also a general efficient technique for proving low-degree polynomial relations in expone... |

13 |
Pedersen: Wallet Databases with Observers
- Chaum, P
- 1993
(Show Context)
Citation Context ...oding (M 1 ; M 2 ). Let m j g i 1 g 2 = h 1 g 2 be the value typically signed in Brands' scheme), M j M 1 M 2 , and N j mM . This N is the common input to the blind signing protocol (essentially from =-=[CP93]-=-). In [Bra94], an additional value is included in the hashing; we use pk text in that place. The resulting protocol is shown in Figure 2. B RC z / N x w 2R Z q a / g w mod p s 2R Z q /\Gamma z; a; b \... |

12 | Protocols for Collusion-Secure Asymmetric Fingerprinting - Biehl, Meyer - 1997 |

6 | Moti Yung: Secure and Efficient Off-Line Digital Money - Franklin - 1993 |

5 |
Yiannis Tsiounis, Moti Yung: "Indirect Discourse Proofs": Achieving Efficient Fair Off-Line E-cash
- Frankel
- 1996
(Show Context)
Citation Context ...ed in trial). In this paper, we remedy this problem. The new construction is coin-based again and equally efficient as the previous one. The new part is based on methods from coin tracing, concretely =-=[FTY96]-=-, in particular a technique we call delayed verifiable encryption. However, on the one hand the similarity is only at the technical level: recall that we do not require a trusted third party, otherwis... |

4 |
Security Proofs for Signature Schemes, Eurocrypt
- Pointcheval, Stern
- 1996
(Show Context)
Citation Context ...e joint distribution with the other variables as the values h output by the adversary. Now, if the scenario is non-interactive, one can still prove the desired theorem by using the forking lemma from =-=[PS96b]-=- if one includes h into the hashing in the Schnorr signature. However, in our scenario the adversary interacts with the bank as blind signer, in addition to the random oracle. This gives the same prob... |

3 | Yiannis Tsiounis, and Moti Yung. Anonymity control in e-cash systems - Davida, Frankel - 1997 |

2 | Yiannis Tsiounis, Moti Yung: Fair Off-Line e-Cash Made Easy - Frankel - 1998 |

2 |
Ahmad-Reza Sadeghi: Coin-Based Anonymous Fingerprinting; Eurocrypt '99, LNCS 1592
- Pfitzmann
- 1996
(Show Context)
Citation Context ...sion tolerance. 1 Anonymous fingerprinting was introduced in [PW97b], but only a construction using general theorems like "every NP-language has a zero-knowledge proof system" was presented =-=there. In [PS99]-=-, an explicit construction based on digital coins was shown. It is fairly efficient in the sense that all operations are efficient computations with modular multiplications and exponentiations; howeve... |

1 | Moti Yung: On the Security of ElGamal based Encryption; 1st International Workshop on Practice and Theory in Public Key Cryptography (PKC 98), LNCS 1431, SpringerVerlag, Berlin 1998, 117-134. A Proof of Knowledge of Simultaneous Discrete Logarithm For the - Tsiounis |