Novel efficient identity-based signature on lattices

Generic Construction of Forward-Secure Revocable Identity-Based Signature and Lattice-Based Instantiations

“…We mainly compare security and storage overhead through two tables. We compare the security of our six schemes ("Con.1+ [28,29]," "Con.2+ [28]," "Con.3+ [28,29]," "Con.1+ [30,31]," "Con.2+ [30]," and "Con.3+ [30,31]") with other RIBS schemes in Table 1, in terms of whether it has forward security (FS), whether it is signing key exposure resistance (SKER), whether it is under the standard model or the random oracle model (SD/RO), whether it is existential unforgeability or strong unforgeability (SU/EU), whether it is resistant to quantum attacks (RQA), whether it is adaptive or not adaptive, and what difcult problems (DPs) are these schemes based on. We list in Table 2 space cost of our six schemes and other RIBS schemes in terms of mpk(|mpk|sk I D (|sk I D |)), uk t (|uk t |), and signature (|S|).…”

“…Tis is because the underlying HIBS scheme [28] does not apply lattice basis delegation [35]. As shown in "Con.1+ [30,31]," "Con.1+ [30]" and "Con.3+ [30,31]," we then used the technique of [30] and the lattice basis delegation [31] to reduce the size of the signature as well as the system master key to a constant size. |sk I D |( °Zm×m ) |uk t |( °Zm×m ) |S|( °Zm q ) XWW20 [13] O(l) O( 1) O(L) O(1) XWW20 [14] O(l) O( 1) O(L) O(1) XWZ22 [15] O(l) O( 1) O(L) O(1) Con.1+ [28,29] O(l + log T) O(log T) O(L) O(l) Con.1+ [30,31] O( 1) O(log T) O(L) O(1) Con.2+ [28] O(l + log T) O(log T) O(L) O(l + log T) Con.2+ [30] O( 1) O(log T) O(L) O(1) Con.3+ [28,29] O(l + log T) O(log T) O(L) O(l) Con.3+ [30,31] O( 1) O(log T) O(L) O(1)…”

“…In addition, the instantiations of Construction 2 and Construciton 3 are represented by "Con.2+ [28]" and "Con.3+ [28,29]," respectively). To reduce the storage overhead of instantiation, we further replace the above HIBS scheme with the HIBS scheme of Tian et al [30] and the above IBS scheme with the IBS scheme of Chen et al [31] (represented by "Con.1+ [30,31]," "Con.2+ [30]," and "Con.3+ [30,31]," respectively). Next, we take Con.1+ [28,29] as an example to introduce the detailed requirement and parameter settings:…”