Okay, good morning everybody welcome to the session post quantum cryptography 3 So it's the final day of the conference. So I hope you've been enjoying yourself so far for those of you who were really awake and Keeping an eye on the program once upon a time This was called post quantum cryptography 1 because there was post quantum 1 post quantum 2 post quantum 1 post quantum 2 But now it's post quantum 3 So we have three talks in this session the first two will be online and the third one will be live here in person The first talk is watermarking PRFs against quantum adversaries by Fuyiki Kitagawa and I will let him also announce his co-author So please go ahead Can you see my thrice? Yes So thank you for the introduction. I'm Fuyiki from NTT and this is a joint work with Ryo Nishimaki from NTT I'm talking I'm going to talk about watermarking PRF against quantum adversaries So I will start with what is software watermarking so in software watermarking We can embed a mark into a program In the way that if the mark is removed the functionality of the program is also destroyed The purpose of software watermarking is proving ownership preventing illegal copies and so on So in software watermarking we can deal with only un-runnable programs So if a program is runnable the mark can be easily removed by simply running the description of the original program So for this reason many previous works have focused on watermarking cryptographic programs So especially most of them studied watermarking PRF Where we can embed the mark into the evaluation circuit of the PRF So PRF is one of the simplest cryptopremative But at the same time it is sufficient for realizing many other crypt programs and cryptoprematives Also some recent works found an interesting application of watermarking crypt programs to quantum crypto So by combining it with quantum money we can construct secure software raising which is a variant of copy protection So in this work we study watermarking PRF against quantum adversaries More concretely our goal is to propose a watermarking scheme Such that even if a quantum adversaries generates a quantum program in order to remove the embedded mark We can correctly extract the embedded mark And this is our result. So first we define watermarking PRF against quantum adversaries Especially we define unremovability which is the main security notion of watermarking PRF Against adversaries who output quantum programs Also we construct watermarking PRF against quantum adversaries Concretely we propose two constructions The first one is secret extractable scheme based on AWE And the other one is public extractable scheme based on IO So here secret extractable means that we need secret extraction key in order to extract the embedded mark And on the other hand public extractable means that we don't need any secret information in order to extract the embedded mark So anyone can extract the embedded mark So our construction methodology for achieving these constructions is highly general So it can be extended to watermarking other primitives such as public key encryption So this is our result And I will talk about the technical overview of this work So the biggest issue we have to deal with is that quantum programs are inherently state for programs So this program was pointed out by Jandery in the context of traitor tracing against quantum adversaries So in classical traitor tracing or classical watermarking We usually assume that pilot programs are stateless programs So this assumption is reasonable since we can rewind pilot programs into their original state if those pilot programs are classical programs However, in general, it is impossible to rewind quantum programs into their original state So we have to deal with quantum programs as state for programs So we have to define our unremovability notion and we have to construct our scheme by taking this stateful nature of quantum programs into consideration Fortunately for the differential work we can use Jandery's technique developed in the context of traitor tracing against quantum adversaries However, for the construction work we cannot use Jandery's traitor tracing technique So we propose new extraction method So hereafter, I will talk about the technical details of our work So I will start with the definition of quantum watermarking against quantum adversaries So the syntax we use in this work is essentially the same as single key traceable PRF introduced by Goyal et al And it consists of four algorithms Gen, Ibar, Mark and Extract The Gen algorithm and Ibar algorithm form standard PRF except that the Gen algorithm also output extraction key xk together with the PRF key And the Mark algorithm takes us into PRF key and the Mark M and output Mark evaluation circuit C' And finally, the extraction algorithm takes us into extraction key and quantum program psi and output Mark M So we require functionality preserving for watermarking PRF which is corresponding to the correctness notion of watermarking PRF And functionality preserving requires that the Mark T evaluation circuit C' has almost the same functionality as the original evaluation circuit So this is the syntax and functionality preserving of watermarking PRF against quantum adversaries And now I move on to the security and unremoveability So the definition of watermarking PRF is the same as single key traceable PRF So the definition of unremoveability is roughly as follows So we generate Mark T evaluation circuit C' from PRF key and Mark M and we give it to an adversary and adversary generates a quantum program psi Then unremoveability requires that no adversary can generate a quantum program psi such that psi is a good quantum program in the sense that its functionality is close to the original evaluation circuit But the extraction algorithm fails to extract M Of course, to make this definition rigorous, we have to define the notion of good quantum program more concretely So basically in this work, we define good quantum program as the program that breaks with PRF security as done by Guadalcan But when we do this, we have to take the stateful nature of quantum programs into consideration So the problem is as follows So to check whether a quantum program is a good quantum program or not, we have to measure the advantage of the quantum program for breaking weak PRF security However, such a measurement process itself might destroy the quantum program So if we once confirmed that a quantum program is a good quantum program, the post-measurement program state might not be a good quantum program anymore So in order to avoid this issue, in this work, we use the notion of live quantum programs introduced by Gendry as a notion of good quantum programs This notion of live quantum programs is defined by using projective implementation also introduced by Gendry So after talking about some background on quantum programs, I will introduce projective implementation and the notion of live quantum programs So the success probability of a quantum program for breaking weak PRF security is defined as follows So let dwprf be a distribution that generates random input b, random input x, random output y0, and correct output y1 of the input x, and output bxyb This distribution dwprf is roughly corresponding to the security game of weak PRF security So the success probability of a quantum program for breaking weak PRF security is the probability that given x and yb, the quantum program correctly guesses the bit b where bxyb is generated from the distribution dwprf So here, this quantum program psi can be seen as a superposition of many quantum programs with different success probabilities with respect to the distribution dwprf In other words, we can decompose psi with respect to the distribution dwprf More concretely, we can write psi as a summation of summation p alpha p psi p where psi p is a quantum program with success probability p with respect to the distribution dwprf And summation p alpha p squared is equal to 1. So given this background, I will introduce projective implementation and the notion of live quantum programs So as I said, a quantum program can be seen as a superposition of many quantum programs Then projective implementation is a measurement process that measures the success probability of one of those quantum programs contained in the superposition So concretely, it is defined as follows So suppose we have a quantum program psi which can be written as summation p alpha p psi p Then if we apply projective implementation for dwprf, we obtain outcome p with probability alpha p squared And by applying this projective implementation, the program state psi is collapsed into another quantum program psi p Which is a quantum program with success probability p So as the name suggests, projective implementation is projected. So if we apply projective implementation for dwprf again, we obtain outcome p with probability 1 So this is projective implementation And by using this project implementation, we can define the notion of live quantum programs A quantum program psi is live quantum program. If the result p of projective implementation dwprf is significantly greater than 1 half So by defining so, if we once confirmed that a quantum program is a live quantum program, then we can confirm that the post-measurement state is surely has high success probability And also, for classical programs, this notion of live quantum program is the same as a classical notion of good programs such as the one used by Guadaleta in the context of traceable prf So by using this notion of live quantum program, we can restate our definition of unlimited mobility as follows So suppose we generate a Mach-Tibalation circuit C prime from prf key and Mach m and we give it to an adversary and adversary generates quantum program psi Then unlimited mobility guarantees that no adversary can generate a quantum program psi such that psi is a live quantum program, but the extraction algorithm fails to extract m So this is the definition of quantum watermarking, watermarking prf against quantum adversaries So next, so given this definition, I will talk about how we realize quantum watermarking prf against quantum adversaries So our goal is to realize a watermarking prf scheme such that even if an adversary generates quantum program in order to remove our embedded mark, as long as the quantum program is a live quantum program, we can correctly extract the embedded Mach m So usually in watermarking, we extract the embedded mark by applying several tests on success probability and observing the results However, in the case of quantum watermarking, the set of applicable tests is highly limited compared to the classical watermarking This is because due to the stateful nature, tests can destroy a quantum program So concretely, the difficulty we have to deal with is as follows In watermarking, an embedded mark is chosen from super polynomial size set So in this case, we couldn't extract the embedded mark in one shot, we have to extract the embedded mark in a bit by bit manner And in order to realize such a bit by bit manner extraction process, we need to realize a test TI for every eye such that each test TI can be used to extract the ice bit of the mark and each TI does not destroy the quantum program So if some test TI destroys the quantum program, we couldn't extract the rest bit of the embedded mark So the technical challenge in this work is to realize such a test TI So in the rest of my talk, I will talk about my main technical idea for realizing these tests So our main idea is to use what we call reverse projective property of projective implementation, which can be explained as follows Let D fail be the distribution that generates BXY from the distribution DWPRF and outputs 1-BXY So we call that DWPRF is a distribution corresponding to the weak PRF security gain Then projective implementation for this distribution D fail is a measurement that measures failure probability of a quantum program This is roughly because projective implementation for D fail measures the probability that the outcome of a quantum program is not B given XY Then consider the following situation So suppose we have quantum program psi, which can be written as summation p alpha p psi p And also suppose we apply projective implementation for DWPRF, namely we measure success probability of the quantum program and we obtain the outcome p So in this case, the quantum program is collapsed into another quantum program psi p, which is a quantum program with success probability p From the projective property of projective implementation, if we apply projective implementation for DWPRF again to the quantum program, we obtain outcome p with probability 1 So here the reverse projective property says that if we apply projective implementation for D fail and measure failure probability of a quantum program after applying projective implementation for DWPRF, we obtain outcome 1-B with probability 1 And most importantly, this application of projective implementation for D fail after projective implementation for DWPRF does not affect the quantum program So in other words, as a post-measurement state after applying a projective implementation for D fail reminds psi p So this is reverse projective property So we can prove this reverse project property by using the fact that project implementation for DWPRF and project implementation for D fail consists of exactly the same set of operators and the only difference between these two measurements is labels of those operators So by combining this reverse projective property with the standard projective property We can obtain the following key facts So suppose we have a live quantum program So this means that if we apply projective implementation for DWPRF and measure the success probability of the quantum program, we obtain outcome 1 over 2 plus epsilon for some inverse polynomial epsilon Then our key factor says that as long as we apply projective implementation for DWP-RF or projective implementation for DFA, the quantum program remains live. The quantum program is not destroyed. And every time we apply projective implementation for DWP-RF, we obtain outcome one over two plus epsilon. And every time we apply projective implementation for DFA, we obtain outcome one over two minus epsilon. So in short, this key factor says that as long as we measure only success probability and failure probability, we can measure those two values successfully without destroying the quantum program. So this is our key factor. And finally, I will talk about how we realize our extraction method by using this key factor. So our extraction method uses a test of TI with the following properties for every eye. So suppose we generate marked evaluation circuit C prime from PRF key and mark M, and we give it to an adversary and the adversary generates a live quantum program. Then this test of TI has the property that if the ice bit of the immediate mark MI is equal to zero, from the B of the adversary, this test TI looks like projective implementation for DWP-RF, which is a measurement on success probability. And on the other hand, if MI is equal to one, from the B of the adversary, this test TI looks like a projective implementation for DFA, which is a measurement on failure probability. So if TI satisfies these properties, from our key fact, the outcome of TI is one over two plus epsilon if MI is equal to zero. And the outcome of TI is one over two minus epsilon if MI is equal to one. So we can extract the MI by applying this test TI and observing whether the result is greater than one half or not. And also, from our key fact, TI does not destroy the quantum program. This is because TI looks like either one of projective implementation for DWP-RF or projective implementation for DFA, both of which do not destroy the quantum program. And as a result, we can apply this test TI for every eye, and we can correctly extract the every bit of the mark. So due to the time restriction, I couldn't talk about how we actually realized such a test TI in this work. So if you're interested in this part, please check our paper. So this is a summary of my talk. So in this work, we define watermarking PRF against quantum adversaries. And we also construct quantum watermarking PRF against quantum adversaries. We propose two constructions. The first one is secret extraction scheme based on the DWP assumption. And the other one is public extraction scheme based on LIO. So our construction methodology is highly general, and it can be extended to watermarking as a primitive such as public encryption. So this is the end of my talk. Thank you very much. Okay, thank you. Are there any questions? If people have questions, please come to the microphone. If there's people who have questions on Zulip, I will look at that as well. Any questions so far? So I do have one question. So you worked at if the adversary outputs a quantum program. So if the adversary outputs a classical program, does your notion then collapse to the known classical notion? Or do you still have some differences there? Yeah, exactly. Our notion is victory stronger than a classical program. So if we restrict our attention to the adversary that only classical programs or definition implies classical watermarking PRF. Right. But is it potentially stronger in the sense that if you have a classical program and you satisfy the old definition, do you then still satisfy your new definition given that it's a classical program? Yes, exactly. Okay. Any other questions? Nothing on Zulip. Okay, if not, then let's thank the speaker again. Thank you very much.


The scene of the crime is presented by Billy Johnson Jr. Attorney-at-Law. Today on the scene of the crime we look into an 11 year old missing person's case of Glenberg Keith Osborn. Osborn disappeared from the Weddington Plaza in Pikeville in March 2006 and is still considered a missing person today. In March of 2006, Post 9 receives a call from the family of Glenberg Keith Osborn, reporting the missing. We had our detectives, I think some of our troopers went out. Around that time frame we located Mr. Osborn's vehicle and went to Plaza here in Colrun. During that time frame a lot of people was interviewed and at this point we believe there is people that's still around who can assist us on this case. However, for whatever reason they haven't came forward as of now. The case remains open and Kentucky State Police need the community's help to solve it. We still work as an open investigation, however the case is cold due to the lack of information we received over the years. If you or anyone you know has any information about the case of Glenberg Keith Osborn, please contact Kentucky State Police at the number on your screen. It's been almost 10 years now since we started on this case. It's an old six case and it's been a while and we've not received any Bible tips that will assist us on this case. However, the family needs some answers on this case and anybody out there for any information that can assist us, call. We will get on as soon as we can. Reporting in Pikeville, I'm Polly Hopkins with EKB News.


The Jerry of the circus. And run to see Patsy's news town. Well, of course. I should have thought of that. Hi, Mr. Randall. It looks like we're in for a big blow. I hope not, Bill. I noticed the wind coming up after lunch. There they go in their walk around now. Gee, I bet Ragn is glad to be working again. You think he missed it? Well, I'm sure he did.  I didn't bring him around to backyard during the show. Dogs are certainly funny. There he goes now. Gee, you're great. Hey, did you see that summer saw, Mr. Randall? Yeah, I can't say they did, son. Oh, gee, it shouldn't have missed it. I'm looking at those swings and ropes and trappings hanging from the top of the tent. Where? Oh, good night. Look at them swings. I'm afraid that wind's getting pretty heavy. Hey, what about Patsy's new trick? I know. That's what I'm doing around here during the show. Well, now let's see how Ragn is doing. He's most true. Here they come now. My golly, that dog jumps like... Patsy says he jumps like a kangaroo. He does as that. Pretty cute dog. He's getting to be quite an attraction. It was sure nice to get to let him work with fun. Oh, no, it wasn't. I don't put things into my show to be nice to people, much as I'd like to. After all, my first problem is to please the audience. So they have to come first. If I find something good, I put it in because I think the audience will like it. If the audience doesn't seem to like it. Then I guess Ragn is pretty good to still be allowed to work. Oh, no, no, no. Ragn, your act is over. I'm ashamed of you. Well, Mr. Randall thinks... He certainly knows how to beg forgiveness. It's almost... Well, sometimes I just think I can't say no to it. I can see how hard it must be. Where'd Bubbs go? Yes, he went right through the wagon to change. He often does when I'm here to pick up Ragn. Oh, gee, here comes Patsy now. Hi, Patsy. Hello. Oh, how are you, Mr. Randall? Fine, thank you. Patsy, how about that new act of yours? Yes, Mr. Randall. It's a pretty bad win. Oh, I've been winning wins before. I know, but don't you think it's a bad time to try out a new act? Well, you've announced it in the programs, haven't you? Oh, yes, but that doesn't matter. Oh, yes, it does. When you promised the public something, you've got to give it to them. Not if I risk hurting any of my performers. Oh, now, don't you worry, Mr. Randall. I have the nets, so there's no real danger. We've been in the business long enough to take any falls if necessary. Yes, but I don't want you to. She's pretty, isn't she? Ah, pretty and clever. And brave. Just kind of a little out there all by herself. And the guy from Mrs. Over. Well, she's taken off the road. Gee, the audience sure likes her. Yeah, of course they do. Yeah, I wonder what she thinks about when she lets go of those franches and turns in the air before catching on to the other rod? I asked her that once, Jerry. Oh, what did she say? She says she always wonders if she left the trapeze swinging straight. That's funny. Not a bit. It's the natural thing for her to think about. Well, why? Well, if she's left it perfectly straight, it'll surely be right for her return trip as she flies across that great empty space. Oh, of course. And if it's twisted, I suppose it might swing kind of uneven. And she'd probably miss. Well, he must be an awful lot to remember up there. And look, she does it so easy, just like flying. That's why she's the greatest little aerialist in the business. But she's been training at it since she was a baby. It must be time for that new trip. Yeah. Mr. Randall. Yes, Jerry? The wind's coming up again. Look at those trappings. I know. She's ready. What's wrong? Why is she waiting? Oh, nothing. She's just waiting for that trapeze to ride itself. Golly. There she goes. Mr. Randall, she slipped. Oh. Oh, jeez, she fell. Holly, look at her bot in that net. You're afraid of that? Yeah, but why, why even in rehearsal she never slipped? She took her fall nice, anyhow. I bet she did. She sure climbs up there fast. You know, you can't keep the audience waiting too long. She's going to try it again. Honest, I'm as scared as if I had to jump off that platform. I'm sort of nervous myself. There she goes. Gee whizzy. A summer song and a half turn. And another summer song. Oh. Oh, God.  I bet she feels terrible. And she couldn't help it that time, Jerry. That canvas top blew her trapeze off at an angle. Gee, Mr. Randall, don't you think she ought to stop trying? No, she can't now. It's too late. Well, what do you mean? Well, when you once start a trick in front of your audience, you have to keep on until you get it right. But when there's a where... No, it doesn't matter. Either you mustn't attempt a trick or else you must keep at it until you do it right. But that seems awful. Mr. Randall's right, Jerry. Oh, hello there, Mr. Bradley. I didn't see you. Gee, Patsy's having an awful time. Now, she's ready. Good. Two somersaults and two halved turns!  Oh, you're too crazy. You're too crazy, Mr. Randall. Oh, you're too crazy. Oh, you're too crazy, Mr. Randall. Gee, Patsy. Now, quiet, quiet, Jerry. Quiet. Quiet. That's how loud. I'm sorry. You should be quiet, rags. Oh, you're many bellicors. That was something. Aren't you proud of her, Mr. Randall? She's a grand little trooper, fine performer. Of course, I'm proud of her, Jerry. A gifted little lady. A youth. Youth. How wonderful it is to be young with the whole world at your feet. Here she comes now. Oh, Patsy, you were wonderful. Yeah, nice work, Patsy. Oh, Mr. Randall, I'm so sorry. I missed it twice. Well, I haven't done a thing like that in so long. My dear child, it was all right. That wind blowing, all those trappings around is beyond me. You made the performance at all at a long new turn. Oh, but twice to fall. I feel terrible. Let me be the first to congratulate you, Miss Patsy, for a truly great performance. While in the face of great adversity, you never for a moment lost faith. Mr. Bradley? Mr.  What's that? Oh, yes. Of course, Jerry. Oh, you see, even my faithful friend Lulu is at my heels already. Alas, I fear the years are taking their toll. Oh, he's a dear. And I'm afraid he's getting pretty old with this kind of life. I just want for... Oh, well. For what, Mr. Randall? I'm afraid I can't tell you. It's personal regarding only Mr. Bradley and his son. And I'm afraid this will be the last season I'll be able to let him stay. Oh, Mr. Randall, but Mr. Bradley... Yeah, I know, my boy. But remember what I told you about the public. They are the first to be considered. Oh, but they love him. See? This is a big... Well, you're right, Patsy. He's a grand old trooper. And I'm proud to have him with us. Jerry! Jerry! Yeah? What is it? Oh, my boy. You need some help. The wind's doing some damage. And the horse is a nervous. He's with us. I'll be right there. Hey, goodbye, Mr. Randall. I got some work to do. Oh, goodbye, Jerry. He's a great little kid, that. Jerry? Oh, he surely is. I'm thrilled to death when there's something he can do. Patsy. Yes, Mr. Randall? I want to thank you for your nice performance this afternoon. Oh, but I... You didn't let me down and you didn't let the audience down. Oh, but Mr. Randall... Yeah, I know. I think you didn't give a finished performance. That wasn't your fault. I know that, but still... As a matter of fact, you know this business well enough to know the advantage of falling now and then. Oh, you mean it makes the audience think the trick is harder? And when you finally do it, they think they've seen something more difficult than it really is. That's it. I've never gone in for fooling the public that way. Lots of sure folks do it as a matter of routine. Yes, I know. But when it happens, because of things we can't help... You mean that it made it even more exciting for the folks? Exactly. I was too upset to think about that, I guess. Now, so you see? Now, you just stop worrying and get to your dressing room wagon and rest. Thanks, Mr. Randall. You know, I think you're one of the nicest people in the world. Well, that's it. And I'm proud to be working for you. Goodbye. Well, I'll be. Mr. Randall. Mr. Randall. Oh, well, Johnny, what's the matter? The catastrophe has just occurred. I... Well, now take it easy, old man. It can't be as bad as it looks. Oh, but it is the worst. For what I have always feared has befallen me. No, no, no, Johnny, please. What's this all about?  Oh, yeah, yes, of course. Funny, of course. My mind a little while ago. Oh, he's here today. What do you mean? He lives here in Jackson City, and he's... You mean he's out in the audience? Yes, yes. Out there. It's the first time he's ever... It's ever happened. Oh, but why would he be here in this... the afternoon? No, that's right.  Perhaps he had a day off. But he takes his work so seriously. Oh, but that's all quite beside the point. What am I to do? What do you mean? Well, I can't... No, I just can't go on again, Mr. Randall. Right now, since Johnny, you'll never recognize you're not in that crazy costume and that face painted on you. No, no, of course not. But the Shakespearean act. That I cannot do. I don't see how he could possibly recognize you. Oh, but he will. Oh, you don't understand, Mr. Randall. Dick was brought up in the theater. His whole boyhood was backstage. He knows my old Shakespearean role. Almost as well as I do. Oh, I think hearing you in those lines would... Are you sure, Mr. Randall? He couldn't fail to recognize me. He knows how I read every line I've ever played. See, he was brought up hearing me rehearse from the moment he woke up till he fell asleep in my dressing room at night. Ah, Francis. I don't know what to say. Could you... Would you let the boy go on? Oh, please. He knows enough of the lines. And after all, it's a matinee. No, and most are children. They wouldn't appreciate the act as much as the adult audience anyway. May heaven shower you with blessings, Mr. Randall. Jack, run over to the horse tent and tell Zary to come here as quick as possible. Yes, Mr. Randall. Oh, thank you, Mr. Randall. I'll never forget this as long as I live. No, that's all right, Johnny. Now, you don't think there's any danger of this happening again? Oh, no, no, I'm sure there isn't. You see, now that he's caught the show, he won't come again. And of course, once we leave Jackson City behind us... There's no danger of his recognizing her name in the program? No, no, Mr. Randall. You see, I didn't give you my true name. It's John B. Grayson. Not the Great Grayson. Bradley was my mother's name, sir. Where I can hardly believe my ears. The Great Grayson, a clown in my circus. But you'll never breathe a word of this. On my word of honor. He's gone, Mr. Randall. Jerry left the horse tent a few minutes ago. Well, find him. Get all the men to search the grounds at once. Jerry must be found. He's got to go on and Johnny Bradley's placed in 15 minutes.


I think it is so important to talk to our children about coronavirus because they're hearing about it, whether we want them to or not, they're hearing about it either in school, on the playground, or on social media. So we need to first find out what they already know, what they've heard, and then take it from there and provide them education in a calm, honest way. And it's important to let them know that healthcare providers, scientists, are really looking for ways to treat the coronavirus and they're looking for vaccines. Let them know that a lot of what they see around them is people preparing and the school closings and the things going online. It's really just to be extra prepared and it's important to be prepared whenever there's a illness around. I mean, we should be taking the same precautions with the flu.


This talk is about group signatures and more from misogynists and lettuces, generic, simple and efficient. It's a work by Yifu Lai, Ward Bulance, Samuel Dobson, Shuichi Katsumata, Federico Pintore, and Yifu Lai is giving the talk. Hi everyone, I'm Yifu Lai. Today I'm going to present this work with joint work with Warbillons, Samuel Dobson and Shuichi Katsumata and Federico Pintore. Firstly, we talk about the idea of group signature skin. Intuitively, a group signature is required any member in the group, like a company or a school or a government agent. Anyone, any member in this group can sign anonymously for the group on behalf of the group. But in case we abuse this anonymity, there is a special identity called group manager who can open the signature from the group, which means that he can know who is the signer and provides the proof for the opening result. And there are three following requirements for the group signature. The first one is anonymity. Of course, given a signature from any two people chosen by the adversary, it is possible to tell from which of the two. And if the adversary has access to the opening oracle, then it is called CCA anonymity, otherwise it's called CPA anonymity. It's quite similar to the public key encryption. And the other one is unforgeability. Any colluding members, we cannot forge a signature, not trace into any one of them. So if the opener is also corrupt, then it is called unforgeability, otherwise it's just called unforgeability. And the last one is traceability. Fairly signatures should be able to open to one and only one user in the group. It cannot be opened to more than two users. So we also give a brief history of group signatures. It's firstly proposed by Chong Feng Hayes and by using RSA and GOP assumptions. And it's later, the security notion is later formalized in these two walks, profile with framework using verifiable MDCCA, PKE, and use signature scheme based on trapdoor permutation functions. And it is so-called the site and input paradigm. And there has been a lot of applications and reward deployment by using group signatures like the direct anonymous attestation in his private CID, a variety of application in blockchain and cryptocurrency studies. And there has been a lot of post content proposal after 2010, mainly donated by latest instance. And recently several proposal has achieved logarithmic property where the signature size is logarithmic in the number of member, which means that even though your group is very, very large, your signature size still can be very compact. But most of them are latest instance and they use some new technique from latest cryptography. So, of course, this kind of technique cannot be applied to, like, say, ISA journey cryptography. So can we have an ISA journey group signature scheme that is competitive enough among other post content proposals? The answer is, of course, yes, that's why I'm here. But what's the difficulty is that the standard sign-in encryption technique requires the CCA for a firewall encryption scheme because we mainly need to use the decretion oracle in CCA GAN to answer the opening oracle in the anonymity GAN. And we also require MIZK for the ciphertext and the plaintext relation. But unfortunately, we don't have this kind of seen the practical tool in ISA journeys with some standard assumptions. This is because, like, SIDH or CSI, they all use, like, share secret key exchange to obtain encryption. They hash the share value and ask the padding to encrypt the message. So because we use that hash function here, we cannot have an efficient MIZK for this relation. So our solution is that we construct a new, verifiable MNDCP APK with unlike-extractable MIZK, which unlike-extractable means that if you are given a proof, then we can, like, by observing the render oracle, then you can extract the secret witness from your proof. But our PKE here is weakly decretable, which means that the message space of our PKE should be, like, small, like, polynomial size in lambda. But it is good enough to give us the following contribution. The first one, we present a new practical framework for group signatures based on group actions. We also give ISA journey and latest instantiations. And the signature size is logarithmic. We also provide tightly secure variants for our two instantiations. And it is also the first group signature from ISA journey and the only logarithmic one because there are some concurrent works. And the ISA journey instantiation has the smallest signature size in the literature among other postcompton proposals. But in this call, talk will mainly focus on the ISA journey instantiation here. And this is a simple comparison without the ISA journey station. And we have the most compact signature size and the best security guarantee for the users. So this is the super high level of our construction here. As you may know, if you have a relation and a statement and witness W, and if you have MISDK for this relation, or in our instance, we use SCAM protocol and Fiat-Schemier transform, you can have a signature scheme. And by example, it is spent by all proof relation. All proof relation means that there's a bunch of statements here and your witness is only for one of them. And if you have MISDK for this relation, you can have a written signature. It doesn't matter if you don't know what's written signature. And the next one, we add PK encryption relation here. We add the ciphertext to encrypt the index here and then with randomness R and we add R into the witness here. So we add ciphertext into the statement and add randomness R into the witness. And if you have unlike extractable relation MISDK for this relation, then you can have a group signature with CCA anonymity. And the final one is to have full unforgeability and we have to have MISDK relation for the decryption relation, which means the relation between the plaintext and the ciphertext and the key relation, which means the public key relation and the decryption key relation. And remarked that the PKE here we only require INDCPA. So a sigma protocol for a relation is a three move interactive protocol among a poof with the secret witness and the firefighter with the statement. They do commit, commitment, challenge and response and the firefighter accept or not because the shape is like a sigma. So it is called a sigma protocol. And we recall the definition of group actions. A group acts on a set by an action if it has identity and compatibility. And of course to have a cryptography construction, we need the hardness assumption here if you are given the operation of the action, GX and X, it is still difficult to recover G. For example, let M be a natural number, let G to be ZN and X to be the cyclic group of order M, define GX to be X to DG. The hardness here is based on the discrete logarithm of this cyclic group. And I start joining station we are taken from seaside together with the optimization given by BKV19 with the efficient sampling method. So we have a group action GX on a set, a super single curve, and we have a spatial curve that's called E0. That is a super single curve and well known can be taken from this set. And this is called group action in first problem, if you are given SE0 where SE is sample from the group G, it is hard to recover as the secret isogenic. And the final definition is the group action base PKE. There are two groups G and GM both acting on the same set X and GM contains the message space M acts on X by a public action. And the other action is given by the key generation algorithm. It is part of the public key of the encryption scheme and related to the secret key here. And we define the action, the encryption of message N is the cybertext is M acts on R acts on X PKE by the public action and the public key action respectively. We use the randomness R here. And we do not specify the decryption relation here but we of course we require the correctness. And we also assume the PKE is IND CPA secure. For example, we can also construct this so-called GA PKE instantiation from ISO journey by using CSI again. And remark that we require the message space to be small like a polynomial in lambda. This is because we have to to decrypt we decrypt by enumerating elements in the message space. Otherwise you return if you know such message form you return perp. And harness the this PKE is IND CPA based on the traditional CSI problem. And finally we can talk about our technical overview. We start from the OR proof or say the OR relation taken by BKP 20. Firstly, there is a statement OR relation we stated before. There is a bunch of statement here and you'll have a secret witness for one of them. And the verification key will be this bunch of statement here and the witness will be your secret signing key for each member. So we will do this by using SIGMA protocol. So firstly, the proofer produce a bunch of ISO journey and group actions and shuffle them and obtain a set. This is the commitment of the proofer. The next is challenge. Challenge is either zero or one. If a challenge is zero, then the proofer provide these bunch of school elements. And the proofer file just recomputes these sets, these elements and see whether the set he compute is identical to the one given by the proofer. If the challenge is one, then the proofer just provide SI plus SI prime. And by acting on XO, the proofer file will check whether this will fall into the set given by the proofer. If so, accept otherwise reject. And this is a SIGMA protocol. So the next step is we add the encryption relation into this relation. And the key idea is we concatenate and shuffle two proofs together. Recall that we have a cipher text now to encrypts the secret message I and to gather with the random SR. So we do something similar here and something and the information in blue, which means it's public like negative one, negative two, negative one. And this common statement here, cipher text one, cipher text two, cipher text n, they are public. And the proofer do group actions again with two n distinct group elements and obtain a set again and shuffle them together. So the pro challenge is also either zero or one here. If challenge is zero, then the proofer provide these two n group elements and for a fire recompute this power and see whether these two sets are identical. And if challenge is one, the proofer also provide si plus si prime, but he also provide r plus r i prime here. And by acting on the public set element, different taken from the public key from the proofer, from the opener, then the provider can check whether this element will fall into the set of the committee decipher text here, CTI prime, this set. If so, accept otherwise, he rejects. So the next step is to we need to make the proof to be logarithmic. We use student random number generator, Merkel tree and commitment skin. Here the proofer, he use two n distinct group elements. And here we just use two, two elements here with s prime and r prime. And then the proofer do the commitment with randomness beats one to beats n. And then the proofer apply Merkel tree and obtain a root. This root will be the commitment of the sigma protocol. And all randomness s prime, s prime, r prime and beats one to beats n, they are all generated by a, to the random number generator by a single seed. And the challenge is also either zero or one here. And if challenge is one, the proofer now just provide a seed and the firefighter recompute is all randomness and compute whether the firefighter can obtain the same root. Now, if the challenge is one, then the proofer provide the randomness be for the commitment skin and the path of the Merkel tree lead to the root and the firefighter just check whether this additional information can lead to the same root. If so, accept otherwise, he rejects. So, in this, in this signal protocol, we can have online extractability, which means that if you obtain a proof, we can obtain the we can extract the secret witness by observing the random oracle. And we do this by modeling our should remember generator commitment skin and Merkel tree as a random oracle. And the reason we can do this because the challenge is the side space is just to, and the response can one of the response, the C here can be obtained by observing the random oracle because we model the pseudo random generator as a random oracle. And I'll repeat the secret protocol we mentioned before lambda time the interactive protocol will has two to the lambda security strengths. And by using fiat chemo first transform, it can be non interactive. So the proof, roughly speaking, the unlike stability and I'm this period will give us CCNality. And with harness assumption of the action, it gives us unfortunately, not but not the full unfortunately. And remark that we have a cipher text here in the statement. So the manager just who on the secret key the decryption key of this public in commission. So he can the manager can just open the signature by using the decryption key now. So it suffices to construct an IDK for the decryption relation and the key relation to have traceability and for on for jeopardy. And we specify the relation here and by using the similar method we mentioned before we can obtain a magic for this relation. And the proof of now the open or say the opener the manager provide the proof for the opening result using this and IDK, then we will you can have traceability and for on for stability. And with other results, like we, we further reduce the signature size by using the on balance challenge space, which means that because you can see when challenge is zero, then the proof adjust profile see which is much smaller than the response for challenge one a bunch of stuff here. So we use more zero challenge than one, then we can have a more compact signature size. So we give the APK for latest instantiation by using Linda Fiker framework. So we don't, the message space can be large here. And we also reduce the signature size for our latest in this instantiation by using get back a brace method. So we specify the criteria secure fire and by using the so called cat one measure, the unfortunately reduction loss is simply one half. In January in the other work it is, he has a quadratic loss followed by a square loss. And of course, in our, in our first year is just a constant concrete it is 0.5 to 0.6 kilobytes, but the signing key and for a fake verification process will be slowed down by a factor of two. So it is quite a cheap, quite a cheap. So finally, in this war, as we mentioned before, we present the most secure, the most secure group signature among the group signature proposals. And I saw the instance has the smallest, the most compact signature size in the literature. And this is a free summary of a few of our contributions. Like we mentioned before, we present a new framework from global teacher by using corrections with it's attorney and ladies instantiation achieving all idea of security properties. And the proof the framework is logarithmic the size is very compact. And we also provide a tightly secure variant for our two instantiations. And we propose the first group signature from us our journeys and the only logarithmic one. And this is the work we present. Hope you find this is interesting. Thank you for listening. Do we have any questions. I've seen some other ring signature constructions where the verifier is logarithmic. Sorry, the signature size logarithmic but the verifier is actually linear. Is your construction like this or is the verify also logarithmic. You mean the verification key. The ver, the verification time for the signature verification kind for the signature and the perfect chance for signature you have to do. The computational cost of the verifier I think is the question. Yeah, exactly. Oh yeah, it is you need to do if the there are members in the group, then you have to do and times. You have to do and times group actions check. Okay, so there's not like, like in some constructions there's like a succinct representation of the group of users that then the verify users to save time, but it's not like that. Yep. Okay, thanks very much. Any other questions. Then let's thank the speaker again.