Enhanced Aggregate Signatures from Pairings

An aggregate signature (AS) scheme combines multiple signatures which is generated by many different users into a single one. This feature is very beneficial for diminishing storage cost, bandwidth and verification cost. Many previous attempts have been made for designing AS schemes, while the former security models have not clearly addressed coalition attacks, and most of the existing AS schemes cannot resist these kinds of attacks. In this study, the authors provide a modified security model of certificateless AS (CLAS) schemes and then give a new CLAS scheme. The security of their present scheme can be rigorously proved based on the computational Diffie-Hellman assumption in the random oracle model. Furthermore, their scheme can resist such coalition attacks, i.e. an AS in their scheme is valid iff all single signatures used to generate the AS are valid.

Cryptanalysis and improvement of a certificateless aggregate signature scheme

Safe and efficient collection of users’ electronic consumption data is a basic function of the smart grid. Anonymous aggregate signature is a fine option to realize this feature, which can not only reduce the computing cost of the data center (DC) but also protect the user’s identity information from leaking. The security proofs of all known identity-based aggregate signature (IBAS) schemes were completed in the random oracle model (ROM). Regrettably, these schemes are not necessarily secure in real life. In this article, we first propose the system model and security demands of an identity-based designated verifier anonymous aggregate signature (IB-DVAAS) scheme for smart grids. We then come up with a concrete scheme, only the designated DC can check the validity of an aggregate signature, but it cannot recognize the real identity of the signers. Next, we display the security proofs in the standard model. Finally, we conduct an analysis on performance for six aggregate signature schemes. Only three pairing operations are required and hash-to-point operations are not used, the calculation cost of the new scheme is lower than that of other schemes.

An aggregate signature refers to a signature, by which n signatures σ1,...,σn corresponding to n messages m1,...,mn and n users u1,...,un can be transformed into a single short signature . Besides, anyone can be convinced by the single short signature that the n messages m1,...,mn were definitely signed by the n users u1,...,un correspondingly. The concept of certificateless cryptography is proposed, so as to settle the key escrow problem in ID‐based cryptography and eliminate the demand for certificates in certified cryptography. A certificateless signature scheme was proposed by Chen et al. in 2014, which was extended into a certificateless aggregate signature scheme. In this paper, two attacks are firstly provided, so as to indicate that the certificateless signature scheme is insecure against a Type I adversary and a Type II adversary. And then, it is demonstrated that the certificateless aggregate signature scheme is not able to achieve the security levels they claimed due to the weaknesses of the certificateless signature scheme. Copyright © 2016 John Wiley & Sons, Ltd.

Aggregate signature is widely used in special occasions where the signatures on many different messages generated by many different users need to be compressed into one single signature. This paper presents an efficient certificate-based aggregate signature (CBAS) scheme from bilinear pairing. In the random oracle model, the new scheme is proven existentially unforgeable against adaptive chosen message attacks under the computational Diffie-Hellman assumption. The signature verification of the new scheme only needs constant pairing computations, which improves the efficiency of communication and computation, and it is more suitable for the applications in resource-constrained network environment.

Aggregate signatures are digital signatures where n signers sign n individual documents and can aggregate individual signatures into a single short signature. Although aggregate signatures are expected to enhance the security of network applications, the capability and the security of aggregate signatures have not yet been discussed when the signatures are generated by a group of signers whose relationships are expressed as network. In this paper, we take into account the fact that various network applications can be mathematically idealized as network called network graphs, and discuss the properties of aggregate signatures on network graphs. We show that it is difficult to apply aggregate signatures to the network graphs. More precisely, we show that sequential aggregate signatures Eurocrypt 2004 are incompatible with the network graphs and also general aggregate signatures Crypto 2003 are broken by some generic attack. Additionally, we propose two generic approaches to overcoming the problems: restricting the number of signers and utilizing ring homomorphism, and give a security proof of aggregate signatures in each of these approaches.

An aggregate signature is a single short string that convinces any verifier that, for all 1 ≤ i ≤ n, signer S i signed message M i , where the n signers and n messages may all be distinct. The main motivation of aggregate signatures is compactness. However, while the aggregate signature itself may be compact, aggregate signature verification might require potentially lengthy additional information – namely, the (at most) n distinct signer public keys and the (at most) n distinct messages being signed. If the verifier must obtain and/or store this additional information, the primary benefit of aggregate signatures is largely negated.This paper initiates a line of research whose ultimate objective is to find a signature scheme in which the total information needed to verify is minimized. In particular, the verification information should preferably be as close as possible to the theoretical minimum: the complexity of describing which signer(s) signed what message(s). We move toward this objective by developing identity-based aggregate signature schemes. In our schemes, the verifier does not need to obtain and/or store various signer public keys to verify; instead, the verifier only needs a description of who signed what, along with two constant-length “tags”: the short aggregate signature and the single public key of a Private Key Generator. Our scheme is secure in the random oracle model under the computational Diffie-Hellman assumption over pairing-friendly groups against an adversary that chooses its messages and its target identities adaptively.KeywordsSignature SchemeSecurity ProofRandom Oracle ModelAggregate SignatureSignature QueryThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Due to the limited energy of underwater wireless sensor network (UwWSN) and the need to protect node location privacy, aggregate signature (AGGS) scheme which can batch verification signature is proposed to meet these requirements. Due to moving at high speed and the limited bandwidth of communication in vehicular ad hoc network (VaNET), certificateless aggregate signature (CTLAS) with the private key being generated by the signer itself and PKG (Private Key Generator) is proposed to solve the above problems. Recently, Yang et al. proposes a CTLAS scheme which can be applied into VaNET and Hua proposes an AGGS scheme which can be applied into UwWSN. This paper shows that Yang et al.'s CTLAS scheme and Hua's AGGS scheme both are not secure. In Yang et al.'s CTLAS scheme, an attacker can forge a signature assume that the attacker cannot know the masker key of PKG but the attacker can replace the public key of the signer. In Hua's AGGS scheme, a malicious node can forge a signature for any nodes after the malicious node obtains a temporary key. As an improvement, this paper also proposes an improved method for Yang et al.'s scheme and Hua's scheme respectively.

Audit logs are an integral part of modern computer systems due to their forensic value. Protecting audit logs on a physically unprotected machine in hostile environments is a challenging task, especially in the presence of active adversaries. It is critical for such a system to have forward security and append-only properties such that when an adversary compromises a logging machine, she cannot forge or selectively delete the log entries accumulated before the compromise. Existing public-key-based secure logging schemes are computationally costly. Existing symmetric secure logging schemes are not publicly verifiable and open to certain attacks. In this article, we develop a new forward-secure and aggregate signature scheme called Blind-Aggregate-Forward (BAF) , which is suitable for secure logging in resource-constrained systems. BAF is the only cryptographic secure logging scheme that can produce publicly verifiable, forward-secure and aggregate signatures with low computation, key/signature storage, and signature communication overheads for the loggers, without requiring any online trusted third party support . A simple variant of BAF also allows a fine-grained verification of log entries without compromising the security or computational efficiency of BAF. We prove that our schemes are secure in Random Oracle Model (ROM). We also show that they are significantly more efficient than all the previous publicly verifiable cryptographic secure logging schemes.

An aggregate signature scheme is a primitive whereby each signer signs an individual document and combines them to compress data size. We propose an aggregate signature scheme which is an extension in two standpoints of structured signatures and ID-based signatures, i.e., we construct an identity-based structured aggregate signature scheme. The proposed scheme is expected to be used with consumer-generated media services. We prove the security of the proposed scheme with tight reduction under the computational Diffie-Hellman (CDH) assumption in the random oracle model. Tight reduction means that the cost of a reduction algorithm is independent of an adversary's capability, i.e., security is not downgraded by the adversary's capability. To the best of our knowledge, no structured signature scheme with tight reduction has been proposed to date because it contains complicated structures that make the reduction inefficient. Note that the security of our scheme captures the switching attack (CCS 2007, Boldyreva et al.) and the re-ordering attack (ISPEC 2007, Shao), which break several famous schemes.

The existing certificateless aggregate signature schemes have problems in terms of security and efficiency: some schemes are not secure, which does not satisfy the claimed unforgeability, others are secure, but the calculation and communication cost are large. Based on the comprehensive consideration of security and efficiency, this paper designs a new certificateless aggregate signature scheme without bilinear pairing, proves the security of the scheme under the random oracle model and computational Diffie-Hellman problem. The new scheme not only overcomes the security problem of the existing scheme, but also has a fixed length of aggregate signature. The user does not need to exchange a large amount of information when performing single signature, so that users can dynamically join the aggregate signature.

Aggregate signature (AS) allows non-interactively condensing multiple individual signatures into a compact one. Besides faster verification, it is useful to reduce storage and bandwidth, and is especially attractive for blockchain and cryptocurrency. In this work, we first demonstrate the subtlety of achieving AS from general groups, by a concrete attack that actually works against the natural implementations of AS based on almost all the variants of DSA and Schnorr's. Then, we show that aggregate signature can be de- rived from the -signature scheme proposed by Yao, et al. To the best of our knowledge, this is the first aggregate signature scheme from general elliptic curves without bilinear maps (in particular, the secp256k1 curve used by Bitcoin). The security of aggregate -signature is proved based on a new assumption proposed and justified in this work, referred to as non-malleable discrete-logarithm (NMDL), which might be of independent interest. When applying the resultant aggregate -signature to Bitcoin, the storage volume of signatures reduces about 49.8%, and the signature verification time can even reduce about 72%. Finally, we specify in detail the application of the proposed AS scheme to Bitcoin, with the goal of maximizing performance and compatibility. We adopt a Merkle-Patricia tree based implementation, and the resulting system is also more friendly to segregated witness and provides better protection against transaction malleability attacks.

In Eurocrypt 2007, Camenisch, Hohenberger and Pedersen introduced the notion of multi-signer batch verification and proposed several efficient and practical batch verification schemes for signatures, including a very efficient batch verification scheme for a multi-signer setting without random oracles. This scheme is the most efficient in comparison with other existing schemes, but it can be applied only to the multi-signer setting. We observe that amongst all existing batch verification schemes, the fastest scheme for a single-signer setting is based on the BLS short signature whose proof need resort to random oracles. It is clear that batch verification for a single-signer setting is as important as for multi-signer scenarios in some applications, especially where the system has only a single signer, such as a secure time-stamping server or a certificate generation server. However, to our knowledge, the efficient batch verification of short signatures in a single-signer setting without random oracles is a challenging open problem. In this paper, we propose a new signature scheme from Gentry IBE that is as efficient as the BLS short signature scheme in batch verification. We are able to prove its security without random oracles. Our signature is approximately 320 bits in length, and a verification requires only two pairings for verifying n signatures from a single signer.

An identity-based multisignature scheme and an identity-based aggregate signature scheme are proposed in this paper. They are both from m-torsion groups on super-singular elliptic curves or hyper-elliptic curves and based on the recently proposed identity-based signature scheme of Cha and Cheon. Due to the sound properties of m-torsion groups and the base scheme, it turns out that our schemes are very simple and efficient. Both schemes are proven to be secure against adaptive chosen message attack in the random oracle model under the normal security notions with the assumption that the Computational Diffie-Hellman problem is hard in the m-torsion groups.

We propose new signature schemes we call mAggSig to achieve sensor authentication and data integrity in Wireless Sensor Networks. mAggSig blends both properties of mediate signatures and aggregate signatures. The proposed schemes are secure under the standard RSA assumption in the random oracle model. We analyze our proposed schemes and estimate the overhead by implementation.