Signature schemes based on the strong RSA assumption

Gennaro introduced the notion of multi-trapdoor commitments which is a stronger form of trapdoor commitment schemes at CRYPTO 2004. Multi-trapdoor commitments have several cryptographic applications. For example, Gennaro proposed a conversion that makes a non-interactive multi-trapdoor commitment scheme into a noninteractive and reusable non-malleable commitment scheme and a compiler that transforms any proof of knowledge into concurrently nonmalleable one. Gennaro gave constructions of multi-trapdoor commitments, but they rely on stronger assumptions, such as the strong RSA assumption, the q-strong Diffie-Hellman assumption. In this paper, we propose a non-interactive multi-trapdoor commitment scheme from the standard RSA assumption. Thus, as a corollary of our result, we obtain a non-interactive and reusable non-malleable commitment scheme from the standard RSA assumption. Our scheme is based on theHohenberger-Waters signature scheme proposed at CRYPTO2009. Several non-interactive and reusable non-malleable commitment schemes (in the common reference string model) have been proposed, but all of them rely on stronger assumptions (e.g., strong RSA).

Recently, Boneh and Boyen proposed a new provably secure short signature scheme under the q-strong Diffie-Hellman assumption without random oracles. This scheme is based on bilinear map which is different from Cramer-Shoup signature scheme (which is based on the strong RSA assumption). However, Tan TC[17] showed that Boneh- Boyen scheme is subjected to key substitution attacks in the multi-user setting. In this paper, we propose a new signature scheme. We prove that the proposed scheme is provably secured against existential forgery under adaptive chosen message attack in the standard model and also secure against key substitution attacks.

The hash-and-sign RSA signature is one of the most elegant and well known signatures schemes, extensively used in a wide variety of cryptographic applications. Unfortunately, the only existing analysis of this popular signature scheme is in the random oracle model, where the resulting idealized signature is known as the RSA Full Domain Hash signature scheme (RSA-FDH). In fact, prior work has shown several “uninstantiability” results for various abstractions of RSA-FDH, where the RSA function was replaced by a family of trapdoor random permutations, or the hash function instantiating the random oracle could not be keyed. These abstractions, however, do not allow the reduction and the hash function instantiation to use the algebraic properties of RSA function, such as the multiplicative group structure of ℤ n * . n. In contrast, the multiplicative property of the RSA function is critically used in many standard model analyses of various RSA-based schemes. Motivated by closing this gap, we consider the setting where the RSA function representation is generic (i.e., black-box) but multiplicative, whereas the hash function itself is in the standard model, and can be keyed and exploit the multiplicative properties of the RSA function. This setting abstracts all known techniques for designing provably secure RSA-based signatures in the standard model, and aims to address the main limitations of prior uninstantiability results. Unfortunately, we show that it is still impossible to reduce the security of RSA-FDH to any natural assumption even in our model. Thus, our result suggests that in order to prove the security of a given instantiation of RSA-FDH, one should use a non-black box security proof, or use specific properties of the RSA group that are not captured by its multiplicative structure alone. We complement our negative result with a positive result, showing that the RSA-FDH signatures can be proven secure under the standard RSA assumption, provided that the number of signing queries is a-priori bounded.

We describe a short signature scheme that is strongly existentially unforgeable under an adaptive chosen message attack in the standard security model. Our construction works in groups equipped with an efficient bilinear map, or, more generally, an algorithm for the Decision Diffie-Hellman problem. The security of our scheme depends on a new intractability assumption we call Strong Diffie-Hellman (SDH), by analogy to the Strong RSA assumption with which it shares many properties. Signature generation in our system is fast and the resulting signatures are as short as DSA signatures for comparable security. We give a tight reduction proving that our scheme is secure in any group in which the SDH assumption holds, without relying on the random oracle model.

We propose new signature schemes we call mAggSig to achieve sensor authentication and data integrity in Wireless Sensor Networks. mAggSig blends both properties of mediate signatures and aggregate signatures. The proposed schemes are secure under the standard RSA assumption in the random oracle model. We analyze our proposed schemes and estimate the overhead by implementation.

Fine-grained forward-secure signature schemes without random oracles

As a variation of ordinary digital signature scheme, a proxy signature scheme enables a proxy signer to sign messages on behalf of the original signer. Proxy multi-signature is an extension of the basic proxy signature primitive, and permits two or more entities to delegate their signing capabilities to some other entity. Many identity-based proxy multi signature (IBPMS) schemes using bilinear pairings have been proposed. But the relative computation cost of the pairing is approximately more than ten times of the scalar multiplication over elliptic curve group. In order to save the running time and the size of the signature, in this paper, we propose an IBPMS scheme without bilinear pairings. We also prove the security of our scheme against adaptive chosen message attack under random oracle model. With the running time being saved greatly, our scheme is more applicable than the previous related schemes for practical applications.KeywordsDigital signatureIdentity-based cryptographyProxy-multi signatureElliptic curve discrete log problem

A server-aided verification signature scheme consists of a digital signature scheme and a server-aided verification protocol. By executing the server-aided verification protocol with the server, one can perform the verification of signatures with less computational cost compared to the original verification algorithm. This mechanism is therefore indispensable for low-power devices such as smart cards. The contributions of this paper are manyfold. Firstly, we introduce and define the existential unforgeability of server-aided verification signatures. We prove that the new notion includes the existing security requirements in server-aided verification signatures. Then, we analyze the Girault-Lefranc scheme in Asiacrypt 2005 and show that their scheme can be made secure in our model, but the computational cost is more than the claimed in the original scheme. After that, we propose the first server-aided verification BLS, which is existentially unforgeable in the random oracle model under the Bilinear Diffie-Hellman assumption. Finally, we consider the collusion and adaptive chosen message attack in server-aided verification signatures. For the first time in the literature, the security of server-aided verification signatures against such attacks is defined. We provide a concrete construction of a server-aided verification BLS secure against the collusion and chosen message attack.

Direct Anonymous Attestation (DAA) is a scheme that enables the remote authentication of a Trusted Platform Module (TPM) while preserving the user's privacy. A TPM can prove to a remote party that it is a valid TPM without revealing its identity and without linkability. In the DAA scheme, a TPM can be revoked only if the DAA private key in the hardware has been extracted and published widely so that verifiers obtain the corrupted private key. If the unlinkability requirement is relaxed, a TPM suspected of being compromised can be revoked even if the private key is not known. However, with the full unlinkability requirement intact, if a TPM has been compromised but its private key has not been distributed to verifiers, the TPM cannot be revoked. Furthermore, a TPM cannot be revoked from the issuer, if the TPM is found to be compromised after the DAA issuing has occurred. In this paper, we present a new DAA scheme called Enhanced Privacy ID (EPID) scheme that addresses the above limitations. While still providing unlinkability, our scheme provides a method to revoke a TPM even if the TPM private key is unknown. This expanded revocation property makes the scheme useful for other applications such as for driver's license. Our EPID scheme is efficient and secure in the same security model as DAA, i.e. in the random oracle model under the strong RSA assumption and the decisional Diffie-Hellman assumption.

We introduce the notion of hierarchical group signatures. This is a proper generalization of group signatures, which allows multiple group managers organized in a tree with the signers as leaves. When opening a signature a group manager only learns to which of its subtrees, if any, the signer belongs.We provide definitions for the new notion and construct a scheme that is provably secure given the existence of a family of trapdoor permutations. We also present a construction which is relatively practical, and prove its security in the random oracle model under the strong RSA assumption and the DDH assumption.

提出了一个组件级的细粒度属性证明方案,用于向远程依赖方证明用户平台满足某种安全属性.与现有的远程证明方案相比,组件属性远程证明具有一定的语义和属性表述性等优势.该方案不但证明粒度细和扩展性强,而且属性证书的颁发、验证和撤销实现简单;本方案以组件承诺的方法保证属性证明的真实性,采用零知识证明实现平台组件的隐私性.基于强RSA假设,在Random Oracle模型下可被证明是安全的.实现的原型系统实验结果表明,组件属性证明是一种灵活、实用、高效的证明,对系统性能没有影响.

Smartmeters report the current electricity consumption over the internet back to their energy providers. Finely-sampled power consumption enables the energy provider to learn the habits of the customer's household in which the smart meter is installed. This paper presents a protocol which preserves customer privacy but also allows the detection of unregistered smart meters and prevents spamming and replay attacks. A trusted-third-party is not needed. This protocol, whose security proof relies on the strong RSA assumption and the random oracle model, is based on zero-knowledge techniques. The protocol has been implemented on different hardware platforms and benchmark results are given.

Authentication is an important aspect for security in any cryptographic application. For Wireless Sensor Networks (WSN), authentication of a message is a vital concern. Authentication is provided through digital signature, and the cost of signing a message is a crucial factor due to the resource constraint nature of a sensor mote. So, there is a need to optimize the cost of computations, involved in the digital signature. In this paper, we present a Pairing-Free Identity Based digital Signature (PF-IBS) algorithm for WSN. PF-IBS is proven secure in terms of existential UnForgeability in the random oracle model against Adaptive Chosen Message Attack (UF-PF-IBS-ACMA). For the performance evaluation of the PF-IBS algorithm, the experimental setup includes MICAz sensor mote with TinyOS and RELIC-Toolkit cryptographic library. The results are gathered with the help of an emulator AVRORA.

One of the most efficient post-quantum signature schemes is Rainbow whose hardness is based on the multivariate quadratic polynomial (MQ) problem. ELSA, a new multivariate signature scheme proposed at Asiacrypt 2017, has a similar construction to Rainbow. Its advantages, compared to Rainbow, are its smaller secret key and faster signature generation. In addition, its existential unforgeability against an adaptive chosen-message attack has been proven under the hardness of the MQ-problem induced by a public key of ELSA with a specific parameter set in the random oracle model. The high efficiency of ELSA is derived from a set of hidden quadratic equations used in the process of signature generation. However, the hidden quadratic equations yield a vulnerability. In fact, a piece of information of these equations can be recovered by using valid signatures and an equivalent secret key can be partially recovered from it. In this paper, we describe how to recover an equivalent secret key of ELSA by a chosen message attack. Our experiments show that we can recover an equivalent secret key for the claimed 128-bit security parameter of ELSA on a standard PC in 177 s with 1326 valid signatures.

A two-party authenticated key exchange (AKE) protocol allows each of the two parties to share a common secret key over insecure channels, even in the presence of active adversaries who can actively control and modify the exchanged messages. To capture the malicious behaviors of the adversaries, there have been many efforts to define security models. Amongst them, the extended Canetti–Krawczyk (eCK) security model is considered one of the strongest security models and has been widely adopted. In this paper, we present a simple construction of a pairing-based eCK-secure AKE protocol in the standard model. Our protocol can be instantiated with a suitable signature scheme (i.e., an existentially unforgeable signature scheme against adaptive chosen message attacks). The underlying assumptions of our construction are the decisional bilinear Diffie–Hellman assumption and the existence of a pseudorandom function. Note that the previous eCK-secure protocol constructions either relied on random oracles for their security or used somewhat strong assumptions, such as the existence of strong-pseudorandom functions, target collision-resistant functions, etc., while our protocol construction uses fewer and more-standard assumptions in the standard model. Furthermore, preserving the same security argument, our protocol can be instantiated with any appropriate signature scheme that comes in the future with better efficiency.