Comparing two pairing-based aggregate signature schemes

Chatterjee, Sanjit; Hankerson, Darrel; Knapp, Edward; Menezes, Alfred

doi:10.1007/s10623-009-9334-7

Cited by 37 publications

(21 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Schnorr signatures are mentioned in this paper for illustrative purposes; although we contribute no results about Schnorr signatures, the history of their security models inspired this work. [7,8] min qs 1 n Fig. 3 qs, RO [14] tight Thm.…”

Section: Review Of Schnorr and Bls Signatures Notationmentioning

confidence: 99%

“…7 Fig. 1 Overview of our results for BLS and BGLS and how they compare to reductions in the single-user setting Although the BLS scheme was introduced for symmetric pairings, where G 1 = G 2 , we use the modified scheme due to Chatterjee et al [8] that also works for asymmetric pairings where no efficiently computable isomorphism from G 2 to G 1 is known ("type III" pairings).…”

Section: Review Of Schnorr and Bls Signatures Notationmentioning

confidence: 99%

See 1 more Smart Citation

Security of BLS and BGLS signatures in a multi-user setting

Lacharité

2017

Cryptogr. Commun.

View full text Add to dashboard Cite

Traditional single-user security models do not necessarily capture the power of real-world attackers. A scheme that is secure in the single-user setting may not be as secure in the multi-user setting. Inspired by the recent analysis of Schnorr signatures in the multi-user setting, we analyse Boneh-Lynn-Shacham (BLS) signatures and Boneh-GentryLynn-Shacham (BGLS) aggregate signatures in the multi-user setting. We obtain a tight reduction from the security of key-prefixed BLS in the multi-user model to normal BLS in the single-user model. We introduce a multi-user security model for general aggregate signature schemes, in contrast to the original "chosen-key" security model of BGLS that is analogous to the single-user setting of a signature scheme. We obtain a tight reduction from the security of multi-user key-prefixed BGLS to the security of multi-user key-prefixed BLS. Finally, we apply a technique of Katz and Wang to present a tight security reduction from a variant of multi-user key-prefixed BGLS to the computational co-Diffie-Hellman (co-CDH) problem. All of our results for BLS and BGLS use type III pairings.

show abstract

Section: Review Of Schnorr and Bls Signatures Notationmentioning

confidence: 99%

Section: Review Of Schnorr and Bls Signatures Notationmentioning

confidence: 99%

Security of BLS and BGLS signatures in a multi-user setting

Lacharité

2017

Cryptogr. Commun.

View full text Add to dashboard Cite

show abstract

“…A presence registration requires H(t i ) x , which is a BLS signature [9] on the epoch number t i . The security of BLS for Type-3 curves was proven by Chatterjee et al under an assumption they call Co-DHP*, which they show to be equivalent to Co-DHP [8] under a uniform generator assumption [12]. This signature is not, however, included in the PIR database, so the game would need to require that A's buddies are not compromised.…”

Section: Dp5: a Private Presence Servicementioning

confidence: 99%

DP5: A Private Presence Service

Borisov

Danezis

Goldberg

2015

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Users of social applications like to be notified when their friends are online. Typically, this is done by a central server keeping track of who is online and offline, as well as of all of the users' "buddy lists", which contain sensitive information. We present DP5, a cryptographic service that implements online presence indication in a privacy-friendly way. DP5 allows clients to register their online presence and query the presence of their list of friends while keeping this list secret. Besides presence, high-integrity status updates are supported, to facilitate key update and rendezvous protocols. While infrastructure services are required for DP5 to operate, they are designed to not require any long-term secrets and provide perfect forward secrecy in case of compromise. We provide security arguments for the indistinguishability properties of the protocol, as well as an evaluation of its scalability and performance.

show abstract

“…For Type-3 pairings, using Table-2 of [8], elements of G 1 and G 2 can be represented using 257 and 513 bits respectively. In contrast, the order of G 1 = G 2 for composite-order pairings is a product of at least three primes.…”

Section: Detailed Comparison To Existing Hibe Schemesmentioning

confidence: 99%

Efficient (Anonymous) Compact HIBE from Standard Assumptions

Ramanna

Sarkar

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We present two hierarchical identity-based encryption (HIBE) schemes, denoted as H1 and H2, from Type-3 pairings with constant sized ciphertexts. Scheme H1 achieves anonymity while H2 is non-anonymous. The constructions are obtained by extending the IBE scheme recently proposed by Jutla and Roy (Asiacrypt 2013). Security is based on the standard decisional Symmetric eXternal Diffie-Hellman (SXDH) assumption. In terms of provable security properties, previous direct constructions of constant-size ciphertext HIBE had one or more of the following drawbacks: security in the weaker model of selective-identity attacks; exponential security degradation in the depth of the HIBE; and use of non-standard assumptions. The security arguments for H1 and H2 avoid all of these drawbacks. These drawbacks can also be avoided by obtaining HIBE schemes by specialising schemes for hierarchical inner product encryption; the downside is that the resulting efficiencies are inferior to those of the schemes reported here. Currently, there is no known anonymous HIBE scheme having the security properties of H1 and comparable efficiency. An independent work by Chen and Wee describes a non-anonymous HIBE scheme with security claims and efficiency similar to that of H2; we note though that in comparison to H2, the Chen-Wee HIBE scheme has larger ciphertexts and less efficient encryption and decryption algorithms. Based on the current state-of-the-art, H1 and H2 are the schemes of choice for efficient implementation of (anonymous) HIBE constructions.

show abstract

Comparing two pairing-based aggregate signature schemes

Cited by 37 publications

References 39 publications

Security of BLS and BGLS signatures in a multi-user setting

Security of BLS and BGLS signatures in a multi-user setting

DP5: A Private Presence Service

Efficient (Anonymous) Compact HIBE from Standard Assumptions

Contact Info

Product

Resources

About