Attacking and Repairing Batch Verification Schemes

Abstract

Batch verification can provide large computational savings when several signatures, or other constructs, are verified together. Several batch verification algorithms have been published in recent years, in particular for both DSA-type and RSA signatures. We describe new attacks on several of these published schemes. A general weakness is explained which applies to almost all known batch verifiers for discrete logarithm based signature schemes. It is shown how this weakness can be eliminated given extra properties about the underlying group structure. A new general batch verifier for exponentiation in any cyclic group is also described as well as a batch verifier for modified RSA signatures.

Group Testing and Batch Verification

“…We list a few examples, but omit details since the techniques in this work will apply to any scheme with batch verification. RSA* is an RSA-variant with batch verification presented by Boyd and Pavlovski [6]. DSA** is a signature scheme based on DSA, given by Naccache et al [27], which uses the small exponents test from [4].…”

Batch Verification of Short Signatures

“…In 1995 Laih and Yen proposed a new method for batch verification of DSA and RSA signatures [29], but the RSA batch verifier was broken five years later by Boyd and Pavlovski [6]. In 1998 Harn presented two batch verification techniques for DSA and RSA [22,23] but both were later broken [6,25,26].…”

“…In 1998 Harn presented two batch verification techniques for DSA and RSA [22,23] but both were later broken [6,25,26]. The same year, Bellare, Garay and Rabin took the first systematic look at batch verification [2] and presented three generic methods for batching modular exponentiations, called the random subset test, the small exponents test and the bucket test which are similar to the ideas from [35,29].…”

“…They showed how to apply these methods to batch verification of DSA signatures and also introduced a weaker form of batch verification called screening. In 2000 some attacks against different batch verification schemes, mostly ones based on the small exponents test and related tests, were published [6]. These attacks do not invalidate the proof of security for the small exponents test, but rather show how the small exponents test is often used in a wrong way.…”

Fast batch modular exponentiation with common-multiplicand multiplication

“…Batch verification, which is firstly introduced by Naccache et al [40], is used to verify multiple signatures simultaneously consuming less time than verifying total individual signatures. Successive research results have achieved improvements in terms of efficiency and security [1,3,4,5,8,9,21,27,51]. There also have been researches for batch signature schemes [22,42,53] and batch generation of exponentiations [10,39].…”