A Tightly Secure DDH-based Multisignature with Public-Key Aggregation

Abstract

From the birth of the blockchain technology, multisignatures attract much attention as a tool for handling blockchain transactions. Concerning the application to the blockchain, multisignatures with public-key aggregation, which can compress public keys of signers to a single public key, is preferable to the standard multisignature because the public keys and the signature used in a transaction are stored to verify the transaction later. Several multisignature schemes with public key aggregation are proposed, however, there are no known schemes having a tight security reduction.We propose a first multisignature with public-key aggregation whose security is proven to be tightly secure under the DDH assumption in the random oracle model. Our multisignature is based on the DDH-based multisignature by Le, Yang, and Ghorbani, however, our security proof is different from theirs. The idea of our security proof originates from another DDH-based multisignature by Le, Bonnecaze, and Gabillon whose security proof is tightly one. By tailoring their security proof to a setting which admits the public-key aggregation, we can prove the tight security of our multisignature.

A New Pairing-Based Two-Round Tightly-Secure Multi-Signature Scheme with Key Aggregation

“…Our scheme improves upon the tightly secure schemes [10], [26] by being a two-round scheme supporting key aggregation while being based on a standard computational problem. The signature length is shorter than that of [10], [26].…”

“…Following MuSig, several multi-signature schemes supporting key aggregation have been proposed [4], [7], [10], [14], [20]. Unlike the early multi-signature schemes, these schemes are shown secure in the plain public-key model [2] with key aggregation, which requires security to hold for maliciously generated keys (i.e., rouge-key attacks).…”

“…This approach is used in the DDH-based multi-signature scheme, such as Fukumitsu at el. 's proposal [10] and Takemure's proposal [25]. The former realizes a tight-security scheme in three rounds; on the other hand, the latter realizes a two-round scheme although with a smaller reduction loss i.e., it is not tightly secure.…”

“…Fukumitsu et al [10] improved upon [26] by proposing a tightly secure multi-signature scheme supporting key aggregation. Their idea is based on an earlier (non-tight) multi-signature scheme by Le et al [14], but uses the second Katz-Wang approach to obtain tight security.…”

“…Given that both schemes require three-round protocols, whether we can achieve tight security in just two rounds or less remains an open question. Furthermore, as [10] is based on the weaker DDH problem, as opposed to [26], which is based on the co-CDH problem, it remains to be seen whether we can support key aggregation for a scheme relying on a computational problem. In this paper, we address this, i.e., we ask the question: Can a two-round tightly-secure multi-signature scheme with compact signatures (and aggregated keys) be constructed from a standard computational assumption?…”