A Unified Framework for Trapdoor-Permutation-Based Sequential Aggregate Signatures

Abstract

We give a framework for trapdoor-permutation-based sequential aggregate signatures (SAS) that unifies and simplifies prior work and leads to new results. The framework is based on ideal ciphers over large domains, which have recently been shown to be realizable in the random oracle model. The basic idea is to replace the random oracle in the full-domain-hash signature scheme with an ideal cipher. Each signer in sequence applies the ideal cipher, keyed by the message, to the output of the previous signer, and then inverts the trapdoor permutation on the result. We obtain different variants of the scheme by varying additional keying material in the ideal cipher and making different assumptions on the trapdoor permutation. In particular, we obtain the first scheme with lazy verification and signature size independent of the number of signers that does not rely on bilinear pairings. Since existing proofs that ideal ciphers over large domains can be realized in the random oracle model are lossy, our schemes do not currently permit practical instantiation parameters at a reasonable security level, and thus we view our contribution as mainly conceptual. However, we are optimistic tighter proofs will be found, at least in our specific application.

Fast and Secure Updatable Encryption

“…Using larger groups would not only carry a significant performance penalty, but also force us to construct custom large blocklength block ciphers. Although this can be done (and has been for RSA groups [GOR18], where our approach would not work), the analysis is tricky.…”

A Short Server-Aided Certificateless Aggregate Multisignature Scheme in the Standard Model

“…In contrast to aggregate signature, multisignature scheme allows multisigners to jointly sign only one message. This scheme was first introduced in [36], and then it has been the topic of many other works such as [25,[37][38][39][40][41][42][43], to name a few. At ACM CCS'01, Micali el al.…”

“…That means it needs rounds to generate a multisignature, is the size of the aggregating set. In [4], each signer needs to broadcast a value to ( − 1) other signers and receives ( − 1) values from ( − 1) other signers before generating multisignature as in usual noninteractive scheme [40][41][42]. In our scheme, in the first round, PKG relies on the description of the aggregating set and messages to compute four elements and sends them to signers, all signers then based on these values to generate aggregate multisignature as in usual noninteractive scheme [40][41][42].…”

Extraction Security of Sequential Aggregate Signatures

“…Applications of aggregate signature schemes include the Secure Border Gateway protocol [ 2 ] , vehicular Ad‐Hoc network [ 3 ] , certificate chains in public‐key infrastructures. A number of aggregate signature schemes have been proposed [ 4 – 12 ] . The scheme in Ref.…”