Malleable Signatures: New Definitions and Delegatable Anonymous Credentials

Abstract

A signature scheme is malleable if, on input a message and a signature, it is possible to efficiently compute a signature on a related message, for a transformation that is allowed with respect to this signature scheme. In this paper, we first provide new definitions for malleable signatures that allow us to capture a broader range of transformations than was previously possible. We then give a generic construction based on malleable zero-knowledge proofs that allows us to construct malleable signatures for a wide range of transformation classes, with security properties that are stronger than those that have been achieved previously. Finally, we construct delegatable anonymous credentials from signatures that are malleable with respect to an appropriate class of transformations (that we show our malleable signature supports). The resulting instantiation satisfies a stronger security notion than previous schemes while also scaling linearly with the number of delegations.

Towards a New Paradigm for Privacy and Security in Cloud Services

“…Well known ABC systems are for instance the multishow system Idemix [5] and the one-show system U-Prove [29]. Recently also some alternative approaches for ABC systems from malleable signature schemes [6,9] and a variant of structure-preserving signatures [22] have been proposed.…”

Delegatable Functional Signatures

“…Constructing delegatable anonymous credentials out of malleable signatures has very recently been investigated by Chase et al [23]. However, the authors only consider one fixed set of allowable transformations per malleable signature scheme and do not allow the signer to restrict malleability (per message) nor does their system allow any way to restrict delegation.…”

Key-Versatile Signatures and Applications: RKA, KDM and Joint Enc/Sig

“…The EXT game includes a possibly non-PT test of membership in the range of the family, but we will ensure that adversaries (who must remain PT) do not perform this test. Our definition of simulatability follows [35,1,34]. Those definitions were for general signatures, not F-keyed ones, and one difference is that our simulator can set only the auxiliary parameters, not the full parameters, meaning it does not set fp.…”

“…The claims established about the construction are however different, with [43] establishing leakage resilience and unforgeability of the signature and our work showing simulatability and key-extractability. The technique of [43] was also used by [34] to construct malleable signatures. Going back further, the first NIZK-based signature scheme was that of [11].…”

“…Our simulatability condition, adapting [35,1,34], asks for a trapdoor allowing the creation of simulated signatures given only the message and public key, even when the secret key underlying this public key is adversarially chosen. Our key-extractability condition, adapting [35], asks that, using the same trapdoor, one can extract from a valid signature the corresponding secret key, even when the public key is adversarially chosen.…”