Multi‐key homomorphic authenticators

Abstract

Homomorphic authenticators (HAs) enable a client to authenticate a large collection of data elements m1,. .. , mt and outsource them, along with the corresponding authenticators, to an untrusted server. At any later point, the server can generate a short authenticator σ f,y vouching for the correctness of the output y of a function f computed on the outsourced data, i.e., y = f (m1,. .. , mt). Recently researchers have focused on HAs as a solution, with minimal communication and interaction, to the problem of delegating computation on outsourced data. The notion of HAs studied so far, however, only supports executions (and proofs of correctness) of computations over data authenticated by a single user. Motivated by realistic scenarios (ubiquitous computing, sensor networks, etc.) in which large datasets include data provided by multiple users, we study the concept of multi-key homomorphic authenticators. In a nutshell, multi-key HAs are like HAs with the extra feature of allowing the holder of public evaluation keys to compute on data authenticated under different secret keys. In this paper, we introduce and formally define multi-key HAs. Secondly, we propose a construction of a multi-key homomorphic signature based on standard lattices and supporting the evaluation of circuits of bounded polynomial depth. Thirdly, we provide a construction of multi-key homomorphic MACs based only on pseudorandom functions and supporting the evaluation of low-degree arithmetic circuits. Albeit being less expressive and only secretly verifiable, the latter construction presents interesting efficiency properties.

The Simplest Multi-key Linearly Homomorphic Signature Scheme

“…We remove the tools that are network-coding related and use a simple trick to obtain the multi-key features. While this technique is known and implicitly used in other works (e.g., [13,26]), here we make a clear explanation of it and show that a natural application of this technique already brings with a non-trivial construction. Performance-wise, mklhs only requires operations in the base curve for computing signatures or evaluating functions over authenticated data, while signature verification requires a product of pairings.…”

“…In other words, the "combined" signature can be used to verify that what the cloud outputs to the verifier is indeed the answer to the desired computation on the database (and not some random authenticated record). Existing MKHS constructions are based on lattice techniques [13], zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARK) [23], or creative yet convoluted compilers [14,26]. In this work, we take multi-key homomorphic signatures as a case of study and propose a new scheme that we consider conceptually simpler than all existing proposals.…”

“…Agrawal et al [1] expand the horizon of applications by considering multisource signatures in the context of network coding. A few years later, Fiore et al [13] formalize the concept of multi-key homomorphic authenticators and provided the first constructions of a multi-key homomorphic signature scheme (MKHS) and of a multi-key homomorphic MAC. The MKHS in [13] is designed for boolean circuits of bounded depth and can be seen as a (non-trivial) extension of the FHS scheme in [18].…”

“…A few years later, Fiore et al [13] formalize the concept of multi-key homomorphic authenticators and provided the first constructions of a multi-key homomorphic signature scheme (MKHS) and of a multi-key homomorphic MAC. The MKHS in [13] is designed for boolean circuits of bounded depth and can be seen as a (non-trivial) extension of the FHS scheme in [18]. A limitation of this work is that the proposed MKHS scheme is not unforgeable if corrupted parties take part to the computation.…”

An Efficient HPRA-Based Multiclient Verifiable Computation: Transform and Instantiation

“…Moreover, current MIFE schemes have prohibitively large overhead. Fiore et al [20] built a multikey homomorphic authenticator (multikey HA), allowing multiple clients to authenticate and outsource a large collection of data, together with the corresponding authenticators, to a malicious server. Backes et al [12] added a crucial efficiency property for the verification of multikey HAs.…”