\documentclass[fleqn,xcolor={usenames,dvipsnames}]{beamer}
\usepackage{appendixnumberbeamer}
\usepackage{amsmath}
\usepackage{multimedia}
\usepackage{wrapfig}
\usepackage[utf8]{inputenc}
\usepackage{framed,color,ragged2e}
\usepackage[absolute,overlay]{textpos}
\usetheme[progressbar=frametitle]{metropolis}
%\setbeamertemplate{navigation symbols}{\insertframenumber/\inserttotalframenumber}
\setbeamersize{description width=1em}
\setbeamertemplate{section in toc}[sections]
\setbeamertemplate{footline}{}
\usepackage{xcolor}
\usepackage[normalem]{ulem}
\usepackage{listings}
\usepackage{adjustbox}
\usepackage{array}
\usepackage{bbding}
\usepackage{relsize}
\usepackage{graphicx}
\usepackage{tikz,eurosym,calc}
\usetikzlibrary{tikzmark}
\usetikzlibrary{shapes,arrows,arrows.meta}
\usetikzlibrary{positioning,patterns}
\usetikzlibrary{calc}

\usepackage{fontspec}
\IfFontExistsTF{IBM Plex Sans}{\setsansfont{IBM Plex Sans}}{}
\IfFontExistsTF{IBM Plex Serif}{\setmainfont{IBM Plex Serif}}{}

\definecolor{blue}{rgb}{0,0.4,1}
\newcommand{\orange}[1]{{\color{orange}#1}}
\newcommand{\TODO}[1]{\orange{TODO: #1}}

\makeatletter
\setbeamercolor{framesubtitle}{fg=mDarkTeal}
\defbeamertemplate*{frametitle}{myframetitle}{%
    \nointerlineskip
    \begin{beamercolorbox}[%
        wd=\paperwidth,%
        sep=0pt,%
        leftskip=\metropolis@frametitle@padding,
        rightskip=\metropolis@frametitle@padding,
        ]{frametitle}%
        \metropolis@frametitlestrut@start
        \quad\insertframetitle%%%%%%%%%%%%%%%%%%%%%%
        \nolinebreak
        \metropolis@frametitlestrut@end
    \end{beamercolorbox}\par
    \usebeamerfont{framesubtitle}%
    \usebeamercolor[fg]{framesubtitle}%
    \vskip3pt
    \hspace*{-0.5\metropolis@frametitle@padding}%
    \insertframesubtitle
}
\makeatother
\setbeamertemplate{frametitle}[myframetitle]

\newcommand{\Section}[2]{\section[#1\newline\scriptsize{#2}]{#1}}

\input{definitions}

\title{Are you old enough to buy this?}
\subtitle{Zero-Knowledge Age Restriction for GNU Taler}

\author{Özgür Kesim}
\institute{FU Berlin}
\date{December 29, 2022}

%TODO: \titlegraphic{\centering\includegraphics[width=0.5\textwidth]{images/hip2022.jpg}}


\begin{document}

%\justifying

\begin{frame}
  \titlepage
\end{frame}

\section*{Prolog}%{Who am I, what do I want and who pays for all this?}

\begin{frame}{Who am I}
	Özgür Kesim,
	\begin{itemize}
		\item security consultant for 20+ years,
		\item PhD candidate at FU Berlin,
		\item member of GNU Taler dev-team.
	\end{itemize}


	\vfill
	\url{oec-taler@kesim.org} \hfill \url{@oec@mathstodon.xyz} \hfill

\end{frame}

\begin{frame}{What to expect}
	\small
	\begin{description}
		\item<1->[Deliverable]~\\
			Present a solution to age restriction and its integration in GNU Taler.
			\vfill
		\item<2->[Side-Channel]~\\
			Show concepts from cryptography by example:

			Zero-Knowledge protocol, Security Game and Security Proof

			This will be technical.
			\vfill
		\item<3->[Non-goals]~\\
			\begin{itemize}
				\item[] \underline{Rigorous} introduction into GNU Taler
				\item[] Demos
			\end{itemize}
	\end{description}
\end{frame}


\begin{frame}{Sponsors}
	\centering\begin{columns}[T]
		\column{0.5\textwidth}
		\centering NGI Pointer program of the European Commission\\[2em]

		\centering\includegraphics[width=0.7\textwidth]{images/ngi-ap3.png}

		\column{0.5\textwidth}
		\centering Project \textit{Concrete Contracts} in the
		\textit{KMU-innovativ} programm\\[2em]

		\centering\includegraphics[width=0.9\textwidth]{images/bmbf-english.jpg}
	\end{columns}
\end{frame}

\begin{frame}{Chapters}
	\tableofcontents[pausesections,hideallsubsections]
\end{frame}


\section[Introduction\newline\scriptsize Age Restriction in E-commerce]{Introduction}

\begin{frame}{Youth protection}

	Broad consensus in society about the necessity to protect minors from
	harmful content.

	\vfill

	Also wanted from policy makers:\\[1em]
	\begin{quote}
		11. Member states should encourage the \textbf{use of
		conditional access tools} by content and service providers in
		relation to content harmful to minors, \textbf{such as
		age-verification systems}, ...
	\end{quote}
	
	\tiny
	From the
	\href{https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=0900001680645b44}
	{\textit{Recommendation Rec (2001) 8 of the Committee of
	Ministers to member states on self-regulation concerning cyber
	content}} of the Council of Europe.

\end{frame}

\begin{frame}{Age restriction in E-commerce}

	\begin{description}[<+->]
		\item[Problem:]~\\[1em]
			Verification of minimum age requirements in e-commerce.\\[2em]

		\item[Common solutions:]

		\begin{tabular}{l<{\onslide<3->}c<{\onslide<4->}cr<{\onslide}}
			& \blue{Privacy} & \tikzmark{topau} \blue{Ext. authority}& \\[\medskipamount]
			1. ID Verification     & bad   & required & \\[\medskipamount]
			2. Restricted Accounts & bad   & required & \\[\medskipamount]
			3. Attribute-based     & good  & required &\tikzmark{bottomau} \\[\medskipamount]
		\end{tabular}
	\end{description}

\uncover<5->{
	\begin{tikzpicture}[overlay,remember picture]
	\draw[orange,thick,rounded corners]
		($(pic cs:topau) +(0,0.5)$) rectangle ($(pic cs:bottomau) -(0.3, 0.2)$);
	\end{tikzpicture}
	\begin{center}
	\bf Principle of subsidiarity is ignored
	\end{center}
}
\end{frame}


\begin{frame}{Principle of Subsidiarity}
\begin{center}\large
	Functions of government\\
	---such as granting and restricting rights---\\
	should be performed\\
	{\it at the lowest level of authority possible},\\
	as long as they can be performed {\it adequately}.
\end{center}
\vfill
\uncover<2->{
	For age-restriction, the lowest level of authority is:\\
	\begin{center}\Large
	Parents, guardians and caretakers
	\end{center}
}
\end{frame}

\begin{frame}{Our goal}
A design and implementation of an age restriction scheme\\
with the following properties:
\pause
\begin{enumerate}[<+->]
	\item It ties age restriction to the \textbf{ability to pay} (not to ID's),
	\item maintains the \textbf{anonymity of buyers},
	\item maintains \textbf{unlinkability of transactions},
	\item aligns with the \textbf{principle of subsidiarity},
	\item is \textbf{practical and efficient}.
\end{enumerate}

\end{frame}

\begin{frame}{Teaser}
	\centering \includegraphics[height=0.9\textheight]{images/wallet-age.png}
\end{frame}

\Section{The quest for a solution to age restriction}{A journey through cryptic territory}

\begin{frame}{Basic assumption and ideas}
	\small
	Assumption: Bank accounts are under control of adults/guardians.

	\vfill
	Sketch of scheme, independent of payment service protocol:

	\begin{columns}
		\column{7cm}
	\begin{enumerate}
		\item<2->  \textit{Guardians} \textbf{commit} to a maximum age
		\item<4->  \tikzmark{sstart}\textit{Minors} \textbf{attest} their adequate age
		\item<6->  \textit{Merchants} \textbf{verify} the attestations
		\item<7->  \textit{Minors} \textbf{derive} age commitments from existing ones
		\item<9->  \textit{Exchanges} \textbf{compare} the derived age commitments
		\item<10-> \tikzmark{send}{\large \texttt{GOTO}} 2.
			\begin{tikzpicture}[overlay, remember picture]
				\draw[line width=1pt,->] 
						([shift=({-6mm, 1mm})]pic cs:send) to
						([shift=({-1cm, 1mm})]pic cs:send) to
						([shift=({-1cm, 1mm})]pic cs:sstart) to
						([shift=({-6mm, 1mm})]pic cs:sstart);
			\end{tikzpicture}
	\end{enumerate}
		\column{4.5cm}
		\begin{center}
		\fontsize{7pt}{7pt}\selectfont
	\begin{tikzpicture}[scale=.5]
		\uncover<2->{
			\node[circle,minimum size=15pt,fill=blue!15]  at (140:3) (Guardian) {$\Guardian$};
			\draw[->] (Guardian)   to [out=50,in=130, loop] node[above]
				{$\Commit$} (Guardian);
		}
		\uncover<3->{
			\node[circle,minimum size=15pt,fill=black!15] at (  0:0) (Client) {$\Child$};
			\draw[,|->] (Guardian) to node[above,sloped,align=left]
				{{\scriptsize }} (Client);
		}
		\uncover<4->{
			\draw[->,blue] (Client)   to [out=-125,in=-190, loop] node[below,left]
				{\blue{$\Attest$}} (Client);
		}
		\uncover<5->{
			\node[circle,minimum size=15pt,fill=black!15] at (  0:4) (Merchant) {$\Merchant$};
			\draw[blue,|->] (Client)   to node[sloped, above]
				{\blue{\scriptsize }} (Merchant);
		}
		\uncover<6->{
			\draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above]
				{\blue{$\Verify$}} (Merchant);
		}
		\uncover<7->{
			\draw[->,orange] (Client)   to [out=-35,in=-100, loop] node[below]
				{\orange{$\Derive$}} (Client);
		}
		\uncover<8->{
			\node[circle,minimum size=15pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$};
			\draw[orange,|->] (Client)   to node[sloped,above,align=left]
				{\orange{\scriptsize }} (Exchange);
		}
		\uncover<9->{
			\draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above]
				{\orange{$\Compare$}} (Exchange);
		}
	\end{tikzpicture}
		\end{center}
	\end{columns}
\end{frame}


\begin{frame}{Specification of the Function Signatures}
\small 
Searching for functions \uncover<2->{with the following signatures}
\begin{align*}
	&\bf \Commit\uncover<2->{:
		&(\age, \omega) &\mapsto (\commitment, \pruf)
		&\scriptstyle \N_\Age \times \Omega &\scriptstyle \to \Commitments\times\Proofs,
		}
	\\
	%FIXME: This is how Attest was defined in the orignal paper (_with_) commitment!
	%&\bf \Attest\uncover<3->{:
	%	&(\minage, \commitment, \pruf) &\mapsto \attest
	%	&\scriptstyle \N_\Age\times\Commitments\times\Proofs &\scriptstyle \to \Attests \cup \{\Nil\},
	%	}
	%\\
	&\bf \Attest\uncover<3->{:
		&(\minage, \pruf) &\mapsto \attest
		&\scriptstyle \N_\Age\times\Proofs &\scriptstyle \to \Attests \cup \{\Nil\},
		}
	\\
	&\bf \Verify\uncover<4->{:
		&(\minage, \commitment, \attest) &\mapsto b
		&\scriptstyle \N_\Age\times\Commitments\times\Attests &\scriptstyle \to \Z_2,
		}
	\\
	&\bf \Derive\uncover<5->{:
		&(\commitment, \pruf, \omega) &\mapsto (\commitment', \pruf', \blinding)
		&\scriptstyle \Commitments\times\Proofs\times\Omega &\scriptstyle \to \Commitments\times\Proofs\times\Blindings,
		}
	\\
	&\bf \Compare\uncover<6->{:
		&(\commitment, \commitment', \blinding) &\mapsto b
		&\scriptstyle \Commitments\times\Commitments\times\Blindings &\scriptstyle \to \Z_2,
		}
\end{align*}
	\uncover<7->{
		with $\Omega, \Proofs, \Commitments, \Attests, \Blindings$
		sufficiently large sets.\\[1em]
	}
	%\uncover<8->{
	%	The blindings $\beta$ ensure that only the Exchange can compare commitments.\\[1em]
	%}
	\uncover<8->{
		We will define basic and security requirements later.\\[1em]
	}

		\scriptsize
	\uncover<2->{
		Mnemonics:\\
		$\Commitments=$ \textit{c$\Commitments$mmitments},
		$\commitment=$ \textit{Q-mitment} (commitment),
		$\Proofs=$ \textit{$\Proofs$roofs},
	}
	\uncover<3->{
		$\pruf=$ \textit{$\pruf$roof},\\
		$\Attests=$ \textit{a$\Attests$testations},
		$\attest=$ \textit{a$\attest$testation},
	}
	\uncover<5->{
		$\Blindings=$ \textit{$\Blindings$lindings},
	 	$\blinding=$ \textit{$\blinding$linding}.
	}
\end{frame}

\begin{frame}{Naïve scheme}
	\begin{center}
	\begin{tikzpicture}[scale=.8]
		\node[circle,minimum size=20pt,fill=blue!15]  at (140:3) (Guardian) {$\Guardian$};
		\node[circle,minimum size=20pt,fill=black!15] at (  0:0) (Client) {$\Child$};
		\node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$};
		\node[circle,minimum size=20pt,fill=black!15] at (  0:4) (Merchant) {$\Merchant$};

		\draw[->] (Guardian)   to [out=50,in=130, loop] node[above]
			{$\Commit$} (Guardian);
		\draw[->,blue] (Client)   to [out=-125,in=-190, loop] node[below,left]
			{\blue{$\Attest$}} (Client);
		\draw[->,blue] (Merchant) to [out=50,in=130, loop] node[above]
			{\blue{$\Verify$}} (Merchant);
		\draw[->,orange] (Client)   to [out=-35,in=-100, loop] node[below]
			{\orange{$\Derive$}} (Client);
		\draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above]
			{\orange{$\Compare$}} (Exchange);

		\draw[,|->] (Guardian) to node[above,sloped,align=left]
			{\scriptsize ($\commitment$, $\pruf_\age$)} (Client);
		\draw[blue,|->] (Client)   to node[sloped, above]
			{\blue{\scriptsize($\minage$, $\commitment$, $\attest$) }} (Merchant);
		\draw[orange,|->] (Client)   to node[sloped,above,align=left]
			{\orange{\scriptsize($\commitment$, $\commitment'$, $\beta$) }} (Exchange);
	\end{tikzpicture}
	\end{center}
%	\pause{Why should $\Merchant$ trust those $\commitment$?  Will solve later.
%	\tiny (Hint: blind signature from $\Exchange$)}
\end{frame}

\begin{frame}{Problem of unlinkability}
	\begin{columns}
		\column{3cm}
		\begin{center}
		\fontsize{8pt}{9pt}\selectfont
		\begin{tikzpicture}[scale=.65]
			\node[circle,minimum size=20pt,fill=black!15] at ( 60:4) (Exchange) {$\Exchange$};
			\node[circle,minimum size=20pt,fill=black!15] at (  0:0) (Client) {$\Child$};

			\draw[->,orange] (Client)   to [out=-35,in=-100, loop] node[below]
				{\orange{$\footnotesize \Derive()$}} (Client);
			\draw[->,orange] (Exchange) to [out=50,in=130, loop] node[above]
				{\orange{$\footnotesize \Compare()$}} (Exchange);

			\draw[orange,|->] (Client)   to node[sloped,above,align=left]
				{\orange{\tiny \uncover<2->{$(\commitment_i,\commitment_{i+1})$}}} (Exchange);
		\end{tikzpicture}
		\end{center}

		\column{9cm}
	Simple use of $\Derive()$ and $\Compare()$ is problematic.

	\pause
	\begin{itemize}[<+->]
		\item Calling $\Derive()$ iteratively generates sequence 
			$(\commitment_0, \commitment_1, \dots)$ of commitments.
		\item Exchange calls $\Compare(\commitment_i, \commitment_{i+1},~.~)$ 
		\item[$\implies$]Exchange identifies sequence
		\item[$\implies$]{\bf Unlinkability broken}
	\end{itemize}
	\end{columns}
\end{frame}

\begin{frame}{Achieving Unlinkability}
	Given $\Derive()$ and $\Compare()$, define the Zero-Knowledge-protocol
	\orange{$\DeriveCompare$} as follows (sketch):

	\uncover<2->{
	\small
	Let $\kappa \in \N$ (say: $\kappa = 3$)
	\begin{itemize}[<+->]
		\item[$\Child$:]
			\begin{enumerate}
				\item generates $(\commitment_1,\dots,\commitment_\kappa)$ 
					and $(\beta_1,\dots,\beta_\kappa)$ from $\commitment_0$\\
					by calling $\kappa$ times $\Derive(\commitment_0, \pruf_0, \omega_i)$
				\item calculates $h_0:=H\left(H(\commitment_1, \beta_1)\parallel \dots\parallel H(\commitment_\kappa, \beta_\kappa)\right)$
				\item sends $\commitment_0$ and $h_0$ to $\Exchange$
			\end{enumerate}
		\item[$\Exchange$:] 
			\begin{enumerate}
				\item[4.] saves $\commitment_0$ and $h_0$ and sends $\Child$ random  $\gamma \in \{1,\dots,\kappa\}$
			\end{enumerate}
		\item[$\Child$:] 
			\begin{enumerate}
				\item[5.] reveals $h_\gamma:=H(\commitment_\gamma, \beta_\gamma)$ and all $(\commitment_i, \beta_i)$, except $(\commitment_\gamma, \beta_\gamma)$
			\end{enumerate}
		\item[$\Exchange$:] 
			\begin{enumerate}
				\item[6.] compares $h_0$ and 
			$H\left(H(\commitment_1, \beta_1)\parallel ...\parallel h_\gamma\parallel ...\parallel H(\commitment_\kappa, \beta_\kappa)\right)$
				\item[7.] evaluates $\Compare(\commitment_0, \commitment_i, \beta_i)$ for all $i \neq \gamma$.
			\end{enumerate}
	\end{itemize}
	\pause
	If all steps succeed, $\commitment_\gamma$ is the new commitment.
	}
\end{frame}

\begin{frame}{Achieving Unlinkability}%{Certainty trade-off}
	
	With \orange{$\DeriveCompare$}
	\begin{itemize}
		\item $\Exchange$ learns nothing about $\commitment_\gamma$ or $H(\commitment_\gamma)$,
		\item trusts outcome with $\frac{\kappa-1}{\kappa}$ certainty,
		\item i.e. $\Child$ has $\frac{1}{\kappa}$ chance to cheat.
		\item<2->[$\implies$] \textbf{Gives us unlinkability at the price of (adjustable) uncertainty!}
	\end{itemize}

	\vfill
	\uncover<3->{Notes:
		\begin{itemize}
			\item similar to the cut\&choose {\it refresh} protocol in GNU Taler
			\item still need to define $\Derive()$ and $\Compare()$.
		\end{itemize}
	}
\end{frame}

\begin{frame}{Refined scheme}
	\begin{center}
	\begin{tikzpicture}[scale=.8]
		\node[circle,minimum size=25pt,fill=blue!15]  at (130:3) (Guardian) {$\Guardian$};
		\node[circle,minimum size=25pt,fill=black!15] at (  0:0) (Client)   {$\Child$};
		\node[circle,minimum size=25pt,fill=black!15] at (  0:5) (Merchant) {$\Merchant$};
		\node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$};

		\uncover<2-3,8->{
			\draw[->] (Guardian)   to [out=150,in=70, loop] node[above]
				{$\Commit(\age)$} (Guardian);
		}
		\uncover<3,8->{
			\draw[->] (Guardian)   to node[below,sloped]
				{($\commitment$, $\pruf_\age$)} (Client);
		}

		\uncover<4-6,8->{
			\draw[->,blue] (Client)   to [out=-50,in=-130, loop] node[below]
				% FIXME: This is in the original paper:
				% {\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client);
				{\blue{$\Attest(\minage, \pruf_{\age})$}} (Client);
			}
		\uncover<5-6,8->{
			\draw[blue,->] (Client)   to node[sloped, below]
				{\blue{$(\attest_\minage, \commitment)$}} (Merchant);
			}
		\uncover<6,8->{
			\draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below]
				{\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant);
		}
		\uncover<7,8->{
			\draw[orange,<->] (Client)   to 
			node[sloped,below,align=center] {\orange{$\commitment \mapsto \commitment_\gamma$}}
			node[sloped,above,align=center] {\orange{$\DeriveCompare$}} (Exchange);
		}

	\end{tikzpicture}
	\end{center}
\end{frame}


\begin{frame}{Sensible solutions}
	Quest for functions should lead to \textit{sensible} solutions.

	\pause
	F. e. $\Verify()$ should not simply always return \texttt{true}.

	\pause
	We need more requirements.
\end{frame}

% \begin{frame}{Achieving Unlinkability}
% 	\scriptsize
% 	$\DeriveCompare : \Commitments\times\Proofs\times\Omega \to \{0,1\}$\\
% 	\vfill
% 	$\DeriveCompare(\commitment, \pruf, \omega) =$
% \begin{itemize}
% \it
% 	\itemsep0.5em
% 	\item[$\Child$:]
% 		\begin{enumerate}
% 				\scriptsize
% 			\itemsep0.3em
% 			\item for all $i \in \{1,\dots,\kappa\}:
% 				(\commitment_i,\pruf_i,\beta_i) \leftarrow \Derive(\commitment, \pruf, \omega + i)$
% 			\item $h \leftarrow \Hash\big(\Hash(\commitment_1,\beta_1)\parallel\dots\parallel\Hash(\commitment_\kappa,\beta_\kappa) \big)$
% 			\item send $(\commitment, h)$ to $\Exchange$
% 		\end{enumerate}
% 	\item[$\Exchange$:]
% 		\begin{enumerate}
% 			\setcounter{enumi}{4}
% 				\scriptsize
% 			\itemsep0.3em
% 			\item save $(\commitment, h)$ \label{st:hash}
% 			\item $\gamma \drawfrom \{1,\dots ,\kappa\}$
% 			\item send $\gamma$ to $\Child$
% 		\end{enumerate}
% 	\item[$\Child$:]
% 		\begin{enumerate}
% 			\setcounter{enumi}{7}
% 
% 				\scriptsize
% 			\itemsep0.3em
% 			\item $h'_\gamma \leftarrow \Hash(\commitment_\gamma, \beta_\gamma)$
% 			\item $\mathbf{E}_\gamma \leftarrow \big[(\commitment_1,\beta_1),\dots,
% 				(\commitment_{\gamma-1}, \beta_{\gamma-1}),
% 				\Nil,
% 				(\commitment_{\gamma+1}, \beta_{\gamma+1}),
% 				\dots,(\commitment_\kappa, \beta_\kappa)\big]$
% 			\item send $(\mathbf{E}_\gamma, h'_\gamma)$ to $\Exchange$
% 		\end{enumerate}
% 	\item[$\Exchange$:]
% 		\begin{enumerate}
% 			\setcounter{enumi}{10}
% 				\scriptsize
% 			\itemsep0.3em
% 			\item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}: h_i \leftarrow \Hash(\mathbf{E}_\gamma[i])$
% 			\item if $h \stackrel{?}{\neq} \HashF(h_1\|\dots\|h_{\gamma-1}\|h'_\gamma\|h_{\gamma+1}\|\dots\|h_{\kappa-1})$ return 0
% 			\item for all $i \in \{1,\dots,\kappa\}\setminus\{\gamma\}$:
% 				if $0 \stackrel{?}{=} \Compare(\commitment,\commitment_i, \beta_i)$ return $0$
% 			\item return 1
% 		\end{enumerate}
% \end{itemize}
% \end{frame}

\section*{Requirements}

\begin{frame}{Basic Requirements}
	\label{fr:basicRequirements}
	Candidate functions 
	\[ (\Commit, \Attest, \Verify, \Derive, \Compare) \]
	must meet \textit{basic requirements}:

	\begin{itemize}
		\item Existence of attestations
		\item Efficacy of attestations
		\item Derivability of commitments and attestations
	\end{itemize}
	\pause
	More details in the published paper and \hyperlink{fr:detailedBasicRequirements}{Appendix}.
\end{frame}	

\begin{frame}{Security Requirements}
	Candidate functions must also meet \textit{security requirements},
	defined via security games:
	\vfill
	{
	\small
	\pause
	\hspace*{-1em}\begin{tabular}{rp{9cm}}
		\bf Requirement:& Unforgeability of minimum age\pause\\
		\bf $\leftrightarrow$\hfill Game:& Forging an attestation\pause\\[0.5em]
		\bf Requirement: & Non-disclosure of age \pause\\
		\bf$\leftrightarrow$\hfill Game: & Age disclosure by commitment or attestation \pause\\[0.5em]
		\bf Requirement:& Unlinkability of commitments and attestations\pause\\
		\bf $\leftrightarrow$\hfill Game:& Distinguishing derived commitments and attestations
	\end{tabular}
	}
	\vfill

	\pause
	Meeting the security requirements means that adversaries can win
	those games only with negligible advantage.
	\vfill
	\pause
	Adversaries are arbitrary polynomial-time algorithms, acting on all
	relevant input.
\end{frame}

\begin{frame}{Security Requirements}{Simplified Example}

	\begin{description}[<+->]
		\item[Game $\Game{FA}$: Forging an attest]~\\
		{\small
		\begin{enumerate}
			\item $ (\age, \omega)	\drawfrom	\N_{\Age-1}\times\Omega $
			\item $ (\commitment, \pruf)	\leftarrow	\Commit(\age, \omega) $
			\item $ (\minage, \attest) \leftarrow \Adv(\age, \commitment, \pruf)$
			\item Return 0 if $\minage \leq \age$
			\item Return $\Verify(\minage,\commitment,\attest)$
			\item[]~\\[0.5em] Adversary $\Adv$ wins the game, if $\Game{FA}$ returns 1.
		\end{enumerate}
		}
		\vfill
		\item[Requirement: Unforgeability of minimum age]
			{\small
			\begin{equation*}
				\Forall_{\Adv\in\PPT(\N_\Age\times\Commitments\times\Proofs\to \N_\Age\times\Attests)}:
				\Probability\Big[\Game{FA} = 1\Big] \le \negl
			\end{equation*}
			}
	\end{description}

%	\pause
%	Note: This example does not take $\Derive()$ into account.
\end{frame}

\begin{frame}{Our task}
	\large
	Finding functions
	\[ (\Commit, \Attest, \Verify, \Derive, \Compare) \]
	that meet the basic and security requirements.
\end{frame}

\section*{A solution}


\begin{frame}{Instantiation with ECDSA}
	We propose a solution based on ECDSA.

	Think: One key-pair per age group.

\end{frame}

\begin{frame}{Definition of Commit with ECDSA}%{Definition of Commit}

	\begin{description}
		\item[To \blue{Commit} to age group $\age \in \{1,\dots,\Age\}$]~\\
		\begin{enumerate}[<+->]
			\item Guardian generates ECDSA-keypairs, one per age group:
				\[\langle(q_1, p_1),\dots,(q_\Age,p_\Age)\rangle\]
			\item Guardian then \textbf{drops} all private keys
				$p_i$ for $i > \age$:
				\[\Big \langle(q_1, p_1),\dots, 
					(q_\age, p_\age), 
					(q_{\age +1}, \red{\Nil}),\dots, 
					(q_\Age, \red{\Nil})\Big\rangle\]
			\item[] then set \begin{itemize}
					\setlength{\itemindent}{5em}
					\item[\bf Commitment:] $\Vcommitment := (q_1,~\dots~\dots~\dots~,q_\Age)$
					\item[\bf Proof:] $\Vpruf_\age := (p_1, \dots, p_\age, \Nil,\dots,\Nil)$
				\end{itemize}
				\vfill
			\item Guardian gives child $\langle \Vcommitment, \Vpruf_\age \rangle$
				\vfill
		\end{enumerate}
	\end{description}
\end{frame}

\begin{frame}{Attest and Verify with ECDSA}
	Child has 
	\begin{itemize}
		\item ordered public-keys $\Vcommitment = (q_1, \dots~\dots~\dots, q_\Age) $,
		\item (some) private-keys $\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$.
	\end{itemize}
	\begin{description}
		\item<2->[To \blue{Attest} a minimum age (group) $\blue{\minage} \leq \age$:]~\\
			Sign a message with ECDSA using private key
			$p_\blue{\minage}$.  The signature $\sigma_\blue{\minage}$ is the
			attestation.
	\end{description}

	\vfill

	\uncover<3->{
	Merchant gets 
	\begin{itemize}
		\item ordered public-keys $\Vcommitment = (q_1, \dots, q_\Age) $
		\item Signature $\sigma_\blue{\minage}$
	\end{itemize}
	\begin{description}
		\item<4->[To \blue{Verify} a minimum age (group) \blue{$\minage$}:]~\\
			Verify the ECDSA-Signature $\sigma_\blue{\minage}$ with public key $q_\blue{\minage}$.
	\end{description}
	}
	\vfill
\end{frame}

\begin{frame}{Derive and Compare with ECDSA}
	Child has 
	$\Vcommitment = (q_1, \dots, q_\Age) $ and 
	$\Vpruf = (p_1, \dots, p_\age, \Nil, \dots, \Nil)$.
	\begin{description}
		\item<2->[To \blue{Derive} new $\Vcommitment'$ and $\Vpruf'$:]
			Choose random $\beta\in\Z_g$ and calculate
			\small
			\begin{align*}
				\Vcommitment' &= \big(q'_1,~\ldots~\ldots~\ldots~,q'_\Age\big) &&:= \big(\beta * q_1,\ldots~\ldots,\beta * q_\Age\big) ,\\
				\Vpruf' &= \big(p'_1,\ldots,p'_\age, \Nil, \ldots, \Nil\big) &&:= \big(\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil\big)
			\end{align*}
			\uncover<3->{
				\small
			Note:
			\begin{itemize}
				\item $\beta*q_i$ is scalar multiplication on the elliptic curve.
				\item $p'_i*G$ = $(\beta p_i)*G = \beta*(p_i*G)  = \beta*q_i = q'_i$
				\item[$\implies$] {\bf $p'_i$ actually \textit{is} private key to $q'_i$}
			\end{itemize}
			}
	\end{description}

		\vfill
	\uncover<4->{
		Exchange gets $\Vcommitment = (q_1,\dots,q_\Age)$, $\Vcommitment' = (q_1', \dots, q_\Age')$ and $\beta$
	\begin{description}
		\item[To \blue{Compare}, calculate:]
			\small
		$(\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)$
	\end{description}
	\vfill
	}
\end{frame}

\begin{frame}{Instantiation with ECDSA}

	Functions
	(Commit, Attest, Verify, Derive, Compare)\\
	as defined in the instantiation with ECDSA\\[0.5em]
	\begin{itemize}
		\item meet the basic requirements,\\[0.5em]
		\item also meet all security requirements.\\
	\end{itemize}

	Security proofs by reduction, details are in the paper.
\end{frame}


\begin{frame}{Example: Proof of Unforgeability}
	\begin{columns}
	\column{0.4\textwidth}
		\begin{minipage}{\textwidth}
		\tiny
		\begin{description}
			\item[Game $\Game{FA}$: Forging an attest]~\\
			 1. $(\age, \omega)	\drawfrom	\N_{\Age-1}\times\Omega $\\
			 2. $(\commitment, \pruf)	\leftarrow	\Commit(\age, \omega) $\\
			 3. $(\minage, \attest) \leftarrow \Adv(\age, \commitment, \pruf)$\\
			 4. Return 0 if $\minage \leq \age$\\
			 5. Return $\Verify(\minage,\commitment,\attest)$\\
			\vfill
		\item[Requirement:]~\\
			$\Forall_{\Adv}: \Probability\Big[\Game{FA} = 1\Big] \le \negl$
		\end{description}
		\end{minipage}
	\column{0.7\textwidth}
		Proof by reduction:
		\pause
		\small
		\begin{enumerate}[<+->]
			\item Adversary wins if $1 = \Verify(\minage,\commitment,\attest)$.
			\item That means: $\sigma$ was a valid ECDSA-signature, validated with $q_m$.
			\item But adversary does not have the private key $p_m$ to $q_m$.
			\item[$\implies$] So winning this game would require to existentially forge
				the signature, which is negligible.
		\end{enumerate}

	\end{columns}
\end{frame}

\begin{frame}{Instantiation with Edx25519}
	But... isn't ECDSA considered to be difficult to implement correctly?

	\pause
	We also formally define another signature scheme, Edx25519:\\[1em]

	\begin{itemize}
		\item based on EdDSA (Bernstein et al.),
		\item generates compatible signatures,
		\item allows for key derivation from both, private and public keys, independently and 
		\item is already in use in GNUnet.
	\end{itemize}~\\[1em]

	Current implementation of age restriction in GNU Taler uses Edx25519.
\end{frame}


% \begin{frame}{Instantiation with ECDSA}
% 	\framesubtitle{Full definitions}
% 	\scriptsize
% 
% \begin{align*}
% 	\Commit_{E,\FDHg{\cdot}}(\age, \omega) &:= \Big\langle
% 		\overbrace{(q_1,\ldots,q_\Age)}^{= \Vcommitment},\;
% 		\overbrace{(p_1,\ldots,p_\age, \Nil,\ldots,\Nil)}^{= \Vpruf \text{, length }\Age}
% 		\Big\rangle\\
% 	\Attest_{E,\HashF}(\bage, \Vcommitment, \Vpruf) &:=
% 		\begin{cases}
% 			\attest_\bage := \Sign_{E,\HashF}\big(\bage,\Vpruf[\bage]\big) & \text{if } \Vpruf[\bage] \stackrel{?}{\neq} \Nil\\
% 			\Nil & \text{otherwise}
% 		\end{cases}\\
% %
% 	\Verify_{E,\HashF}(\bage, \Vcommitment, \attest) &:= \Ver_{E,\HashF}(\bage, \Vcommitment[\bage], \attest)\\
% %
% 	\Derive_{E, \FDHg{\cdot}}(\Vcommitment, \Vpruf, \omega) &:=
% 		\Big\langle(\beta * q_1,\ldots,\beta * q_\Age),
% 		     (\beta p_1,\ldots,\beta p_\age,\Nil,\ldots,\Nil), \beta \Big\rangle \\
% 		     & \text{ with } \beta := \FDHg{\omega} \text{ and multiplication } \beta p_i \text{ modulo } g \nonumber\\
% %
% 	\Compare_E(\Vcommitment, \Vcommitment', \beta)	&:=
% 		\begin{cases}
% 			1 & \text{if } (\beta * q_1, \ldots , \beta * q_\Age) \stackrel{?}{=} (q'_1,\ldots, q'_\Age)\\
% 			0 & \text{otherwise}
% 		\end{cases}
% \end{align*}
% \end{frame}

\section{Integration with GNU Taler}

\begin{frame}{GNU Taler}{https://www.taler.net}
	\label{fr:GnuTaler}
	\begin{columns}
		\column{4cm}
		\fontsize{8pt}{9pt}\selectfont
	\begin{tikzpicture}[scale=.55]
		\node[circle,fill=black!10] at (3, 4) (Exchange) {$\Exchange$};
		\node[circle,fill=black!10] at (0, 0) (Customer) {$\Customer$};
		\node[circle,fill=black!10] at (6, 0) (Merchant) {$\Merchant$};

		\draw[<->] (Customer)   to [out=65,in=220] node[sloped,above] {\sf withdraw} (Exchange);
		\draw[<->] (Customer)   to [out=45,in=240] node[sloped,below] {\sf refresh} (Exchange);
		\draw[<->] (Customer)   to node[sloped, below] {\sf purchase} (Merchant);
		\draw[<->] (Merchant) to node[sloped, above] {\sf deposit} (Exchange);
	\end{tikzpicture}
		\column{8cm}
		\begin{itemize}
			\item Protocol suite for online payment services
			\item Based on Chaum's \hyperlink{fr:reminderBlindSignature}{blind signatures}
			\item Taxable, efficient, free software
			\item Allows for change and refund
			\item Privacy preserving: anonymous and unlinkable payments
		\end{itemize}
	\end{columns}

	\vfill
	\uncover<2->{
	\begin{itemize}
		\item Coins are public-/private key-pairs $(C_p, c_s)$.
		\item Exchange \hyperlink{fr:reminderBlindSignature}{blindly signs} $H(C_p)$ with denomination key $d_p$
		\item Verification:
		\begin{eqnarray*}
			1  &\stackrel{?}{=}&
			\mathsf{SigCheck}\big(H(C_p), D_p, \sigma_p\big)
		\end{eqnarray*}
		\scriptsize($D_p$ = public key of denomination and $\sigma_p$ = signature)

	\end{itemize}
	}
\end{frame}

\begin{frame}{Integration with GNU Taler}{Binding age restriction to coins}
	\label{fr:bindingToCoins}

	To bind an age commitment $\commitment$ to a coin $C_p$, instead of
	blindly signing \[ H(C_p), \]
	$\Exchange$ now \hyperlink{fr:reminderBlindSignature}{blindly signs}
	\[ H\left(C_p\parallel\orange{H(\commitment)}\right) \]

	\vfill
	Therefore, verfication of a coin now requires $H(\commitment)$, too:
	\[
		1  \stackrel{?}{=}
		\mathsf{SigCheck}\big(H\left(C_p\parallel\orange{H(\commitment)}\right), D_p, \sigma_p\big)
	\]
	\vfill
\end{frame}

\begin{frame}{Integration with GNU Taler}
	\framesubtitle{Integrated schemes}
	\fontsize{8pt}{9pt}\selectfont
	\begin{tikzpicture}[scale=.9]
		\node[circle,minimum size=25pt,fill=black!15] at (  0:0) (Client)   {$\Child$};
		\node[circle,minimum size=25pt,fill=black!15] at ( 60:5) (Exchange) {$\Exchange$};
		\node[circle,minimum size=25pt,fill=black!15] at (  0:5) (Merchant) {$\Merchant$};
		\node[circle,minimum size=25pt,fill=blue!15]  at (130:3) (Guardian) {$\Guardian$};

		\draw[<->] (Guardian)   to  node[sloped,above,align=center]
			{{\sf withdraw}\orange{, using}\\ $H(C_p\orange{\parallel H(\commitment)})$} (Exchange);
		\draw[<->] (Client)   to node[sloped,below,align=center]
			{{\sf refresh} \orange{ + }\\ \orange{$\DeriveCompare$}} (Exchange);
		\draw[<->] (Client)   to node[sloped, below]
			{{\sf purchase} \blue{+ $(\attest_\minage, \commitment)$}} (Merchant);
		\draw[<->] (Merchant) to node[sloped, above]
			{{\sf deposit} \orange{+ $H(\commitment)$}} (Exchange);

		\draw[->] (Guardian)   to [out=70,in=150, loop] node[above]
			{$\Commit(\age)$} (Guardian);
		\draw[->] (Guardian)   to node[below,sloped]
			{($\commitment$, $\pruf_\age$)} (Client);
		\draw[->,blue] (Client)   to [out=-50,in=-130, loop] node[below]
			{\blue{$\Attest(\minage, \commitment, \pruf_{\age})$}} (Client);
		\draw[->,blue] (Merchant) to [out=-50,in=-130, loop] node[below]
			{\blue{$\Verify(\minage, \commitment, \attest_{\minage})$}} (Merchant);
	\end{tikzpicture}
\end{frame}

\begin{frame}{Age restriction in the wallet}
	\centering \includegraphics[height=0.9\textheight]{images/wallet-age.png}
\end{frame}

\include{gnu}

\begin{frame}{Interested in GNU Taler?}
	We are looking for developers, testers, users!

	\begin{description}
		\item[Intro:] \url{https://taler.net}
		\item[Learn:] \url{https://docs.taler.net}
		\item[Develop:] \url{https://git.taler.net}, \url{https://bugs.taler.net}
	\end{description}
\end{frame}

\section{Discussion \& Conclusion}

\begin{frame}{Discussion}
	\begin{itemize}[<+->]
		\item Our solution can in principle be used with any token-based payment scheme
		\item[] However, GNU Taler best aligned with our design goals
			(security, privacy and efficiency).

		\item Subsidiarity requires bank accounts being owned by adults.
		\item[] However, scheme can be adapted to cases of
			\begin{itemize}
			\item minors have bank accounts
			\item peer-to-peer payments
			\item[] Hint: Know-Your-Customer (KYC) and adapted
				withdraw protocol.
			\end{itemize}
		\item Our scheme offers an alternative to identity management systems (IMS)
	\end{itemize}
\end{frame}

% \begin{frame}{Related Work}
% 	\begin{itemize}
% 		\item Current privacy-perserving systems all based on
% 			attribute-based credentials (Koning et al.,
% 			Schanzenbach et al., Camenisch et al., Au et al.)
% 
% 		\item Attribute-based approach lacks support: 
% 			\begin{itemize}
% 				\item Complex for consumers and retailers
% 				\item Requires trusted third authority
% 			\end{itemize}
% 		\vfill
% 		\item Other approaches tie age-restriction to ability to pay ("debit cards for kids")
% 			\begin{itemize}
% 				\item Advantage: mandatory to payment process
% 				\item Not privacy friendly
% 			\end{itemize}
% 	\end{itemize}
% \end{frame}

\begin{frame}{Conclusion}
	Age restriction is a technical, ethical and legal challenge.

	\pause
	Existing solutions are
	\begin{itemize}
		\item without strong protection of privacy or
		\item based on identity management systems (IMS)
	\end{itemize}
	\vfill

	\pause
	Our scheme offers a solution that
	\begin{itemize}
		\item aligns with subsidiarity
		\item preserves privacy
		\item is efficient
		\item and an alternative to IMS
	\end{itemize}
\end{frame}


\begin{frame}{}
	\large
	\begin{center}
		{\Huge \textbf{Thank you!}}\\
	Questions?
	\end{center}

	\begin{center}
		\texttt{oec-taler@kesim.org}\\
		\texttt{@oec@mathstodon.xyz}
	\vfill
	{Interested in GNU Taler?}
	\begin{description}
		\item[Intro:] \url{https://taler.net}
		\item[Learn:] \url{https://docs.taler.net}
		\item[Develop:] \url{https://git.taler.net}, \url{https://bugs.taler.net}
	\end{description}
	\end{center}
\end{frame}

\appendix

\begin{frame}{Taler Overview}
	\hspace*{-3em}\includegraphics[width=\paperwidth]{images/taler-overview-blue.png}
\end{frame}

\begin{frame}{Basic Requirements - Details}
	\label{fr:detailedBasicRequirements}
	{\scriptsize \it back to \hyperlink{fr:basicRequirements}{Basic Requirements}}
	\begin{description}[<+->]
		\item[Existence of attestations]
			{\scriptsize
			\begin{align*}
				\Forall_{\age\in\N_\Age \atop \omega \in \Omega}:
				\Commit(\age, \omega) =: (\commitment, \pruf)
				\implies 
				\Attest(\minage, \commitment, \pruf) =
				\begin{cases}
					\attest \in \Attests, \text{ if } \minage \leq \age\\
					\Nil \text{ otherwise}
				\end{cases}
			\end{align*}}
		\item[Efficacy of attestations]
			{\scriptsize
			\begin{align*}
				\Verify(\minage, \commitment, \attest) = \
				\begin{cases}
					1, \text{if } \Exists_{\pruf \in \Proofs}: \Attest(\minage, \commitment, \pruf) = \attest\\
					0 \text{ otherwise}
				\end{cases}
			\end{align*}}

			{\scriptsize
			\begin{align*}
				\forall_{n \leq \age}: \Verify\big(n, \commitment, \Attest(n, \commitment, \pruf)\big) = 1.
			\end{align*}}

			...
		\item[Derivability of commitments and attestations]...
	\end{description}

	\pause
	More details in the published paper.
\end{frame}

\begin{frame}{Reminder: RSA blind signature}
	\label{fr:reminderBlindSignature}
	\small
	In RSA, a public key $(e, N)$ and private key $(d, N)$ have the property
		\[ x^{ed} = x \mod N \]

	\pause
	Bob (B) creates a blind signature of a message $m$ for Alice (A):
	\begin{itemize}[<+->]
		\item[A:]
			\begin{itemize}
				\item chooses random integer $b$
				\item calculates $m' := m*b^e$ {\hfill \scriptsize \textit{(blinding)}}
				\item sends $m'$ to B.
			\end{itemize}
		\item[B:]
			\begin{itemize}
				\item signs $m'$, by calculating 
					$\sigma' := (m')^d \mod N$ {\hfill \scriptsize \textit{(B doesn't learn $m$)}}
				\item sends $\sigma'$ to A.
				\item[] \scriptsize Note: $(m')^d = (m*b^e)^d = m^d*b^{ed} = m^d*b \mod N$
			\end{itemize}
		\item[A:]\begin{itemize}
				\item unblinds $\sigma'$ by calculating 
			\[ \sigma := \sigma'*b^{-1} (= m^d) \]
			\item[$\implies$]$\sigma$ is a valid RSA signature to message $m$.
		\end{itemize}
	\end{itemize}
	\hfill \tiny back to \hyperlink{fr:GnuTaler}{\textit{taler}} or \hyperlink{fr:bindingToCoins}{\textit{binding}}
\end{frame}

%\begin{frame}{Requirements}
%	\framesubtitle{Details}
%
%	\begin{description}
%		\item[Derivability of commitments and proofs:]~\\[0.1em]
%		{\scriptsize
%		Let \begin{align*}
%			\age & \in\N_\Age,\,\, \omega_0, \omega_1 \in\Omega\\
%			(\commitment_0, \pruf_0) & \leftarrow \Commit(\age, \omega_0),\\
%			(\commitment_1, \pruf_1, \blinding) & \leftarrow  \Derive(\commitment_0, \pruf_0, \omega_1).
%		\end{align*}
%		We require
%		\begin{align*}
%			\Compare(\commitment_0, \commitment_1, \blinding) = 1 \label{req:comparity}
%		\end{align*}
%		and for all $n\leq\age$:
%		\begin{align*}
%					\Verify(n, \commitment_1, \Attest(n, \commitment_1, \pruf_1)) &%
%					=
%					\Verify(n, \commitment_0,  \Attest(n, \commitment_0,  \pruf_0))
%		\end{align*}}
%	\end{description}
%\end{frame}

\end{document}