Tightly-Secure Signatures from Chameleon Hash Functions

We study a scheme of Bai and Galbraith (CT-RSA’14), also known as TESLA. TESLA was thought to have a tight security reduction from the learning with errors problem (LWE) in the random oracle model (ROM). Moreover, a variant using chameleon hash functions was lifted to the quantum random oracle model (QROM). However, both reductions were later found to be flawed and hence it remained unresolved until now whether TESLA can be proven to be tightly secure in the (Q)ROM.

In this paper, we present three digital signature schemes with tight security reductions in the random oracle model. Our first signature scheme is a particularly efficient version of the short exponent discrete log-based scheme of Girault et al. (J Cryptol 19(4):463---487, 2006). Our scheme has a tight reduction to the decisional short discrete logarithm problem, while still maintaining the non-tight reduction to the computational version of the problem upon which the original scheme of Girault et al. is based. The second signature scheme we construct is a modification of the scheme of Lyubashevsky (Advances in Cryptology--ASIACRYPT 2009, vol 5912 of Lecture Notes in Computer Science, pp 598---616, Tokyo, Japan, December 6---10, 2009. Springer, Berlin, 2009) that is based on the worst-case hardness of the shortest vector problem in ideal lattices. And the third scheme is a very simple signature scheme that is based directly on the hardness of the subset sum problem. We also present a general transformation that converts what we term $$lossy $$lossy identification schemes into signature schemes with tight security reductions. We believe that this greatly simplifies the task of constructing and proving the security of such signature schemes.

A unified framework of identity-based sequential aggregate signatures from 2-level HIBE schemes

From the birth of the blockchain technology, multisignatures attract much attention as a tool for handling blockchain transactions. Concerning the application to the blockchain, multisignatures with public-key aggregation, which can compress public keys of signers to a single public key, is preferable to the standard multisignature because the public keys and the signature used in a transaction are stored to verify the transaction later. Several multisignature schemes with public key aggregation are proposed, however, there are no known schemes having a tight security reduction. We propose a first multisignature with public-key aggregation whose security is proven to be tightly secure under the DDH assumption in the random oracle model. Our multisignature is based on the DDH-based multisignature by Le, Yang, and Ghorbani, however, our security proof is different from theirs. The idea of our security proof originates from another DDH-based multisignature by Le, Bonnecaze, and Gabillon whose security proof is tightly one. By tailoring their security proof to a setting which admits the public-key aggregation, we can prove the tight security of our multisignature.

We introduce a new and very weak security notion for signature schemes called target randomness security. In contrast to previous security definitions we focus on signature schemes with (public coin) probabilistic signature generation where the randomness used during signature generation is exposed as part of the signature. To prove practical usefulness of our notion we present a new signature transformation for mapping target randomness secure signature schemes to weakly secure signature schemes. It is well-known that, using chameleon hash functions, the resulting weakly secure scheme can then be turned into a fully secure one. Our transformation outputs signature schemes that in general produce signatures with l elements, where l is the bit length of the input randomness. We present an instantiation of a target randomness secure signature scheme based on the RSA assumption and show that after applying our new signature transformation to this scheme, we can accumulate the l signature elements into a single element. This results in a new efficient RSA-based signature scheme. In contrast to traditional security definitions, all signature schemes obtained with our transformation enjoy strong security, i.e. they remain secure even if the adversary outputs a new signature on a previously queried message. In our proofs, we rely on the prefix-based technique introduced by Hohenberger and Waters at Crypto'09. However, using a precise analysis we are able decrease the security loss in proofs relying on the prefix-based technique. This result may be of independent interest.

A new implementation of a redactable blockchain is proposed: a construction where trusted authorities can change past blocks without invalidating the blockchain and without needing a hard fork. Like previous works, it uses a chameleon hash function—a special kind of hash function where it is possible to compute collisions efficiently if a trapdoor is known. One problem with most chameleon hash functions is that collision-resistance and security are invalidated or severely weakened if a collision is publicized. It turns out that redacting a blockchain in existing constructions reveals collisions. Previous works dealt with this using public-key encryption schemes and non-interactive zero-knowledge proofs to achieve what is known as Enhanced or Full Collision-Resistance. Here instead, we propose a simpler and hopefully faster construction. We use a subset of chameleon hash schemes where the trapdoor also allows for first-preimage computation. We build a redactable blockchain using this stronger property where redactions do not expose collisions.KeywordsRedactable blockchainChameleon hashPost-quantum cryptography

Identity-based proxy signature (IDBPSE) has attracted many researchers and scholars since it can simplify key management procedure of certificate-based public key setting. Recently, some IDBPSE schemes are constructed in the standard model. However, most of them have very loose security reductions. And they cannot resist the attack from the delegator and have low computational efficiency. In this study, a novel and efficient IDBPSE scheme is constructed, and we also prove its security based on the computational Diffie–Hellman assumption. Compared with other existing IDBPSE schemes, our scheme has two main advantages: tight security reduction and more complete security including resisting the delegator attack. And our scheme has more efficient performance including less computational cost and shorter signature size than most of existing similar IDBPSE schemes. What is more, our scheme does not require secure channels to transfer delegation keys, but other identity-based proxy signature schemes need.

Kakvi and Kiltz (EUROCRYPT'12) proposed the first tight security reduction for RSA full domain hash signature scheme (RSA-FDH) with public exponent e < N1/4 in the random oracle (RO) model, and they left an open problem which called for a tightly secure RSA-FDH for N1/4 < e < N. In this paper, we consider the improved RSA (iRSA) trapdoor functions, introduced by Cao (Science in China'01), are functions that the security can be strictly proved to be equivalent to the factoring. We show that iRSA-FDH has a tight security reduction for e < N. Technically we construct iRSA lossy trapdoor functions, and then we apply the lossiness of the iRSA trapdoor functions to obtain tight security reductions for iRSA-FDH in the RO model. Finally, we propose a tightly secure blind signature scheme based on our iRSA lossy trapdoor functions in the RO model.

Identity-based signatures (IBS) can be verified using the signer identity information as the public key, and hence, there is no need for certificate management that proves the corresponding public key ownership. Unfortunately, none of the existing IBS schemes has security proven as tight as the discrete logarithm (DL) problem, the hardest problem in the cyclic group setting, under the standard EUF-CMA security model. Recently, the introduction of proving security in the algebraic group model (AGM), where the adversary’s computation is algebraic, enables some ordinary signature schemes to be proven tightly reducible under DL assumption and EUF-CMA. To date, however, it remains unknown whether IBS schemes can also be proven as secure as the DL problem in the AGM. Achieving tight security in IBS schemes under standard EUF-CMA is challenging, due to the need to take extra precautions against adaptive queries on user private keys by the adversary. In this work, we show, for the first time, an IBS scheme with tight security under DL assumption and EUF-CMA in the AGM. The scheme features a minimal signature size of two group elements, with a reduction loss factor of two.

Lattice-based cryptographic scheme is constructed based on hard problems on a lattice such as the short integer solution (SIS) problem and the learning with error (LWE). However, the cryptographic scheme based on SIS or LWE is inefficient since the size of the key is too large. Thus, most cryptographic schemes use the variants of LWE and SIS with ring and module structures. Albrecht and Deo showed that there is a reduction from module-LWE (M-LWE) to ring-LWE (R-LWE) in the polynomial ring by handling the error rate and modulus. However, unlike the LWE problem, the SIS problem does not have an error rate, but there is the upper bound β on the norm of the solution of the SIS problem. In this paper, we propose the two novel reductions related to module-SIS (M-SIS) and ring-SIS (R-SIS) on a polynomial ring. We propose (i) the reduction from R-SIS q k ,m k ,β k to R-SIS q , m,β and (ii) the reduction from M-SIS to R-SIS under norm constraint of R-SIS. Combining these two results implies that R-SIS for a specified modulus and number samples is more difficult than M-SIS under norm constraints of R-SIS, which provides the range of possible module ranks for M-SIS. From the reduction we propose, contrary to the widely known belief, our result shows that there is a possibility that the security parameters of M-SIS may be less secure when it reduces to R-SIS for the theoretical reasons presented in this paper. Therefore, when generating parameters on an M-SIS structure, the theoretical security level over R-SIS also should also be checked at the same time.

We present a quantumly secure identity-based signature scheme based on the standard short integer solution problem, featuring tight security reductions in the quantum and classic random oracle models. The scheme has short signatures. Each signature contains a single lattice vector plus a single bit. Compared to the existing tightly secure, short lattice identity-based signature schemes by Pan and Wagner (PQCrypto’21), our scheme has a shorter signature size (around 30% shorter), stronger unforgeability, relies on a weaker assumption, and has detailed proof in the quantum random oracle model.

Homomorphic signatures can provide a credential of a result which is indeed computed with a given function on a data set by an untrusted third party like a cloud server, when the input data are stored with the signatures beforehand. Boneh and Freeman in EUROCRYPT2011 proposed a homomorphic signature scheme for polynomial functions of any degree, however the scheme is not based on the normal short integer solution (SIS) problems as its security assumption. In this paper, we show a homomorphic signature scheme for quadratic polynomial functions those security assumption is based on the normal SIS problems. Our scheme constructs the signatures of multiplication as tensor products of the original signature vectors of input data so that homomorphism holds. Moreover, security of our scheme is reduced to the hardness of the SIS problems respect to the moduli such that one modulus is the power of the other modulus. We show the reduction by constructing solvers of the SIS problems respect to either of the moduli from any forger of our scheme.

In the actual applications, an adversary can break the security of cryptography scheme through various leakage attacks (e.g. side-channel attacks, cold-boot attacks, etc.), even the continuous leakage attacks. That is, a practical cryptography scheme must maintain its claimed security in the continuous leakage setting. However, the previous constructions on the leakage-resilient identity-based encryption (IBE) scheme could tolerate a leakage that is bounded, and cannot resist the continuous leakage attacks. In order to further achieve the better security, a novel method to build the continuous leakage-resilient IBE scheme with tight security is presented in this paper, and the scheme’s security is proved, in the standard model, based on a stronger security assumption that depends on the number of queries made by the adversary. In addition, our proposal has several advantages over previous such constructions, e.g. shorter public parameters, higher communication efficiency, tight security, etc.

Chameleon-hash functions, introduced by Krawczyk and Rabin (NDSS’00), are trapdoor collision-resistant hash functions parametrized by a public key. If the corresponding secret key is known, arbitrary collisions for the hash function can be found efficiently. Chameleon-hash functions have prominent applications in the design of cryptographic primitives, such as lifting non-adaptively secure signatures to adaptively secure ones. Recently, this primitive also received a lot of attention as a building block in more complex cryptographic applications, ranging from editable blockchains to advanced signature and encryption schemes. We observe that, in latter applications, various different notions of collision-resistance are used, and it is not always clear if the respective notion really covers what seems intuitively required by the application. Therefore, we revisit existing collision-resistance notions in the literature, study their relations, and by means of selected applications discuss which practical impact different notions of collision-resistance might have. Moreover, we provide a stronger, and arguably more desirable, notion of collision-resistance than what is known from the literature (which we call full collision-resistance). Finally, we present a surprisingly simple, and efficient, black-box construction of chameleon-hash functions achieving this strong notion of full collision-resistance.

Simulation-sound trap-door commitment (SSTC) schemes are an essential ingredient for making non-malleable and universally composable protocols. In previous work, the SSTC schemes and their variants are all constructed in the same framework based on digital signatures. In this paper, we provide new constructions of SSTC schemes using encryption, which is somewhat surprising, because of the tight relationship between SSTC and digital signature schemes. Although our constructions require a few rounds of interactions between a committer and a receiver and the notion of public-key encryption could be stronger than digital signature, the resulting instantiations are much more efficient than these based on digital signature schemes. In particular, we present an efficient SSTC scheme under the CDH assumption in the bilinear groups, with a tight security reduction and short public key parameters, and the first efficient SSTC scheme under the factoring assumption. Our interactive SSTC schemes inherit properties of the non-interactive version of SSTC schemes to construct non-malleable and universally composable protocols.KeywordsSignature SchemeCommitment SchemeDigital Signature SchemeChallenge CiphertextDecryption OracleThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.