Efficient unlinkable sanitizable signatures from signatures with re‐randomizable keys

Abstract

In a sanitizable signature scheme the signer allows a designated third party, called the sanitizer, to modify certain parts of the message and adapt the signature accordingly. Ateniese et al. (ESORICS 2005) introduced this primitive and proposed five security properties which were formalized by Brzuska et al. (PKC 2009). Subsequently, Brzuska et al. (PKC 2010 suggested an additional security notion, called unlinkability which says that one cannot link sanitized message-signature pairs of the same document. Moreover, the authors gave a generic construction based on group signatures that have a certain structure. However, the special structure required from the group signature scheme only allows for inefficient instantiations. Here, we present the first efficient instantiation of unlinkable sanitizable signatures. Our construction is based on a novel type of signature schemes with re-randomizable keys. Intuitively, this property allows to re-randomize both the signing and the verification key separately but consistently. This allows us to sign the message with a re-randomized key and to prove in zero-knowledge that the derived key originates from either the signer or the sanitizer. We instantiate this generic idea with Schnorr signatures and efficient Σ-protocols, which we convert into non-interactive zero-knowledge proofs via the Fiat-Shamir transformation. Our construction is at least one order of magnitude faster than instantiating the generic scheme of Brzuska et al. with the most efficient group signature schemes. Definition of Sanitizable SignaturesThe following definition of sanitizable signature schemes is taken in verbatim from [BFF + 09, BFLS10]. Definition 1 (Sanitizable Signature Scheme).A sanitizable signature scheme SanS = (KGen sig , KGen san , Sign, Sanit, Verify, Proof, Judge) consists of seven algorithms:Key Generation. There are two key generation algorithms, one for the signer and one for the sanitizer. Both create a pair of keys, a private and the corresponding public key:and (sk san , pk san ) ← KGen san (1 κ ).Signing. The signing algorithm takes as input a message m ∈ {0, 1} * , a signer secret key sk sig , a sanitizer public key pk san , as well as a description Adm of the admissible modifications to m by the sanitizer and outputs a signature σ. We assume that Adm can be recovered from any signature:σ ← Sign(m, sk sig , pk san , Adm).Sanitizing. The sanitizing algorithm takes as input a message m ∈ {0, 1} * , a description Mod of the desired modifications to m, a signature σ, the signer's public key pk sig , and a sanitizer secret key sk san . It modifies the message m according to the modification instruction Mod and outputs a new signature σ for the modified message m = Mod(m) or possibly ⊥ in case of an error:{(m , σ ), ⊥} ← Sanit(m, Mod, σ, pk sig , sk san ).Verification. The verification algorithm takes as input a message m, a candidate signature σ, a signer public key pk sig , as well as a sanitizer public key pk san and outputs a bit b:b ← Verify(m, σ, pk sig , pk san ).Proof. The p...

Efficient Invisible and Unlinkable Sanitizable Signatures

“…This variant of accountability is mutually exclusive with transparency. Several existing works [7,17,29,9] proposed schemes that are both transparent and unlinkable. Recently, Krenn et al [28] propose the "strong" versions of unforgeability, (non-interactive public) accountability, and transparency.…”

Unlinkable and Strongly Accountable Sanitizable Signatures from Verifiable Ring Signatures

“…The authors give a generic unlinkable scheme based on group signatures. In 2016, Fleischhacker et al [21] give a more efficient construction based on signatures with re-randomizable keys.…”

“…We also design an efficient secure VRS scheme under the DDH assumption in the random oracle model. The definition of accountability for SS given in [8,9,21] considers that the signer can prove the origin of a signature (signer or sanitizer) by using a proof algorithm such that:…”

“…Since the scheme of Brzuska et al and GUSS uses group/ring signatures for groups of two users, GUSS is much more practical for an equivalent level of genericity. Fleischhacker et al [21]. This scheme is based on signatures with re-randomizable keys.…”

“…As in [21], for the sake of clarity, we do not distinguish between elements of G and elements of Z * p . We consider the best instantiation of the scheme of Fleischhacker et al given in [21]. In Appendix A, we give a detailed complexity evaluation of our schemes.…”