Digital multisignature schemes for authenticating delegates in mobile code systems

Based on the newly introduced d-decisional Diffie-Hellman (d-DDH) intractable problem, a signature scheme and a multi-signature scheme are proposed. The main method in the constructions is a transformation of a knowledge proof on the equality of two discrete logarithms. The two schemes are proved secure in the random oracle model and the security reductions to the d-DDH problem are tight. Moreover, one can select different d for different security demand of applications. Thus the schemes are secure, efficient and practical.

Efficient identity-based RSA multisignatures

In this paper, we describe efficient forgery and full-key recovery attacks on the ℓ-IC− signature scheme recently proposed at PKC 2007. This cryptosystem is a multivariate scheme based on a new internal quadratic primitive which avoids some drawbacks of previous multivariate schemes: the scheme is extremely fast since it requires one exponentiation in a finite field of medium size and the public key is shorter than in many multivariate signature schemes. Our attacks rely on the recent cryptanalytic tool developed by Dubois et al. against the SFLASH signature scheme. However, the final stage of the attacks requires the use of Gröbner basis techniques to conclude to actually forge a signature (resp. to recover the secret key). For the forgery attack, this is due to the fact that Patarin’s attack is much more difficult to mount against ℓ-IC. The key recovery attack is also very efficient since it is faster to recover equivalent secret keys than to forge.KeywordsSignature SchemeTotal BreakForgery AttackBilinear EquationTrivial RelationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Security of Analysis Liu's Signature Scheme

Multivariate Cryptography is one of the alternatives to guarantee the security of communication in the post-quantum world. One major drawback of such schemes is the huge size of their keys. In [PB10] Petzoldt et al. proposed a way how to reduce the public key size of the UOV scheme by a large factor. In this paper we extend this idea to the Rainbow signature scheme of Ding and Schmidt [DS05]. By our construction it is possible to reduce the size of the public key by up to 62%.KeywordsMultivariate CryptographyRainbow Signature SchemeKey Size Reduction

Forward-secure multisignature and blind signature schemes

Multivariate cryptography is one of the main candidates to guarantee the security of communication in a post quantum era. While multivariate signature schemes are very fast and require only modest computational resources, the key sizes of such schemes are quite large. In [17] Petzoldt et al. proposed a way to use Linear Recurring Sequences (LRS’s) for the key generation of the Unbalanced Oil and Vinegar (UOV) signature scheme by which they were able to reduce the public key size of this scheme by a factor of 7. In this paper we describe a modification of their scheme, which enables us not only to reduce the public key size, but also to speed up the verification process of the UOV scheme by a factor of 5.KeywordsMultivariate CryptographyUOV Signature SchemeKey Size ReductionFast Verification

In this paper, we provide a new multi-signature scheme that is proven secure in the plain public key model. Our scheme is practical and efficient according to computational costs, signature size and security assumptions. At first, our scheme matches the single ordinary discrete logarithm based signature scheme in terms of signing time, verification time and signature size. Secondly, our scheme requires only two rounds of interactions and each signer needs nothing more than a certified public key to produce the signature, meaning that our scheme is compatible with existing PKIs. Thirdly, our scheme has been proven secure in the random oracle model under standard discrete logarithm (DL) assumption. It outperforms a newly proposed multi-signature scheme by Bagherzandi, Cheon and Jarecki (BCJ scheme) in terms of both computational costs and signature size.

The new signature scheme presented by the authors in [13] is the first signature scheme based on the discrete logarithm problem that gives message recovery. The purpose of this paper is to show that the message recovery feature is independent of the choice of the signature equation and that all ElGamal-type schemes have variants giving message recovery. For each of the six basic ElGamal-type signature equations five variants are presented with different properties regarding message recovery, length of commitment and strong equivalence. Moreover, the six basic signature schemes have different properties regarding security and implementation. It turns out that the scheme proposed in [13] is the only inversionless scheme whereas the message recovery variant of the DSA requires computing of inverses in both generation and verification of signatures. In general, message recovery variants can be given for ElGamal-type signature schemes over any group with large cyclic subgroup as the multiplicative group of GF(2n) or elliptic curve over a finite field. The present paper also shows how to integrate the DLP-based message recovery schemes with secret session key establishment and ElGamal encryption. In particular, it is shown that with DLP-based schemes the same functionality as with RSA can be obtained. However, the schemes are not as elegant as RSA in the sense that the signature (verification) function cannot at the same time be used as the decipherment (encipherment) function.

As a variation of ordinary digital signature scheme, a proxy signature scheme enables a proxy signer to sign messages on behalf of the original signer. Proxy multi-signature is an extension of the basic proxy signature primitive, and permits two or more entities to delegate their signing capabilities to some other entity. Many identity-based proxy multi signature (IBPMS) schemes using bilinear pairings have been proposed. But the relative computation cost of the pairing is approximately more than ten times of the scalar multiplication over elliptic curve group. In order to save the running time and the size of the signature, in this paper, we propose an IBPMS scheme without bilinear pairings. We also prove the security of our scheme against adaptive chosen message attack under random oracle model. With the running time being saved greatly, our scheme is more applicable than the previous related schemes for practical applications.KeywordsDigital signatureIdentity-based cryptographyProxy-multi signatureElliptic curve discrete log problem

We devise multi-party computation protocols for general secure function evaluation with the property that each party is only required to communicate with a small number of dynamically chosen parties. More explicitly, starting with n parties connected via a complete and synchronous network, our protocol requires each party to send messages to (and process messages from) at most polylog(n) other parties using polylog(n) rounds. It achieves secure computation of any polynomial-time computable randomized function f under cryptographic assumptions, and tolerates up to $({1\over 3} - \epsilon) \cdot n$ statically scheduled Byzantine faults. We then focus on the particularly interesting setting in which the function to be computed is a sublinear algorithm: An evaluation of f depends on the inputs of at most q=o(n) of the parties, where the identity of these parties can be chosen randomly and possibly adaptively. Typically, q=polylog(n). While the sublinear query complexity of f makes it possible in principle to dramatically reduce the communication complexity of our general protocol, the challenge is to achieve this while maintaining security: in particular, while keeping the identities of the selected inputs completely hidden. We solve this challenge, and we provide a protocol for securely computing such sublinear f that runs in polylog(n)+O(q) rounds, has each party communicating with at most q ·polylog(n) other parties, and supports message sizespolylog(n) ·(l+n), where l is the parties' input size. Our optimized protocols rely on a multi-signature scheme, fully homomorphic encryption (FHE), and simulation-sound adaptive NIZK arguments. However, we remark that multi-signatures and FHE are used to obtain our bounds on message size and round complexity. Assuming only standard digital signatures and public-key encryption, one can still obtain the property that each party only communicates with polylog(n) other parties. We emphasize that the scheduling of faults can depend on the initial PKI setup of digital signatures and the NIZK parameters.

A digital signature is essential in verifying the reliability of people and data over networks, such as through web server certificates, authentication, and blockchain technologies. In blockchain, multi-signature signature schemes have recently attracted attention for reducing the amount of data in transactions. While such schemes support only a single message, Interactive Aggregate Signatures (IAS), an extended Schnorr multi-signature scheme, supports some messages under the plain public key model. However, there are three problems with this scheme in certain use cases.

Infrastructure monitoring systems, such as bridge, tunnel, railway, and so on, are applications which adopt wireless sensor networks (WSNs). Generally, a typical WSN consists of one sink node and sensor nodes. Each sensor node creates a route between itself and the sink node to send sensing data. If attackers succeed to inject fake data or fake route information during a process to create its route, critical problems may occur. For example, the sink node cannot collect sensing data, sensor nodes cannot receive commands from the sink node, and looped routes might be created. To prevent attackers from injecting fake route information, secure routing protocols with authentication tools, such as digital signatures, have been proposed. In this paper, we focus on ISDSR that is a multi hop secure routing protocol. ISDSR guarantees route information that contains a collection of nodes storing a travel path of the received packet. Sensor nodes need more computational processes to generate signatures and to verify signatures comparing with standard multi hop routing protocols, such as AODV and DSR, by applying secure routing protocols to WSNs. In order to run secure routing protocols on a sensor node, developers have to evaluate performances on low performance devices. How long do calculation times take to generate a signature and to verify a signature? How many length of a generated signature does a packet need? To evaluate these performances on real devices, we implement both the signature algorithm of ISDSR as a multi-signature scheme and an RSA-based signature algorithm as a standard signature scheme on a Raspberry Pi. Then, we conduct experiments to measure round trip times including calculation times between two nodes and packet sizes.

Formal models and security proofs are especially important for multisignatures: in contrast to threshold signatures, no precise denitions were ever provided for such schemes, and some proposals were subsequently broken. In this paper, we formalize and implement a variant of multi-signature schemes, Accountable-Subgroup Multisignatures (ASM). In essence, ASM schemes enable any subgroup,S, of a given group,G, of potential signers, to sign eciently a message M so that the signature provably reveals the identities of the signers in S to any verier. Specically, we provide: 1. The rst formal model of security for multisignature schemes that explicitly includes key generation (without relying on trusted third parties); 2. A protocol, based on Schnorr’s signature scheme [Sch91], that is both provable and ecient: Only three rounds of communication are required per signature. The signing time per signer is the same as for the single-signer Schnorr scheme, regardless of the number of signers. The verication time is only slightly greater than that for the single-signer Schnorr scheme. The signature length is the same as for the single-signer Schnorr scheme, regardless of the number of signers. Our proof of security relies on random oracles and the hardness of the Discrete Log Problem.

Digital signature with proxy delegation, which is a secure ownership enforcement tool, allows an original signer to delegate signature rights to a third party called proxy, so that the proxy can sign messages on behalf of the original signer. In today’s modern society, many applications use this mechanism. Several types of delegations are quite prevalent and the delegation of signing authority is one of them. In a traditional digital signature scheme, signer transmits signature along with message for verification, which leads to additional communication, computation cost and requires extra bandwidth. To resolve these issues, in this paper, we present an efficient ID-based proxy signature scheme with message recovery using bilinear pairings. Because of the message recovery feature, the proxy signer need not send the message to the verifier, so that the proposed scheme reduces the bandwidth requirement and communication cost. Our proposed scheme is proven secure against existential forgery under adaptively chosen message and identity attacks in the random oracle model (ROM) with the assumption that the Computational Diffie-Hellman Problem (CDHP) is intractable. We compare our scheme with related schemes. The efficiency analysis shows that the scheme is computationally efficient. Thus the proposed ID-based proxy signature scheme is secure and efficient both in terms of computation and communication costs than the related existing schemes.