Practical Round-Optimal Blind Signatures in the Standard Model from Weaker Assumptions

Abstract

International audienceAt Crypto'15 Fuchsbauer, Hanser and Slamanig (FHS) presented the first standard-model construction of efficient round-optimal blind signatures that does not require complexity leveraging. It is conceptually simple and builds on the primitive of structure-preserving signatures on equivalence classes (SPS-EQ). FHS prove the unforgeability of their scheme assuming EUF-CMA security of the SPS-EQ scheme and hardness of a version of the DH inversion problem. Blindness under adversarially chosen keys is proven under an interactive variant of the DDH assumption.We propose a variant of their scheme whose blindness can be proven under a non-interactive assumption, namely a variant of the bilinear DDH assumption. We moreover prove its unforgeability assuming only unforgeability of the underlying SPS-EQ but no additional assumptions as needed for the FHS scheme

Mercurial Signatures for Variable-Length Messages

“…Our construction of variable-length mercurial signatures uses the fixed-length mercurial signature scheme of [15] as a building block and is proven secure (under the variants of unforgeability and origin-hiding above) assuming (1) the security of the underlying mercurial signature scheme and (2) the ABDDH + assumption, which was introduced in [21] and is reminiscent of the decisional Diffie-Hellman assumption for Type III bilinear pairings.…”

“…Unforgeability of MS X holds under a variant of the asymmetric bilinear decisional Diffie-Hellman assumption (ABDDH + ) introduced by Fuchsbauer et al [21].…”

Critical perspectives on provable security: Fifteen years of "another look" papers

“…Similarly, the papers [147,146] present efficient blind signature schemes which, the papers' titles promise, are proven secure in the "standard model." However, both blind signature schemes employ the "structure-preserving signature scheme on equivalence classes" from [148].…”

“…The only known security proof for the latter scheme is in the generic group model. Thus, the use of the word "standard" to describe the security assumptions in [147,146] is misleading. This model consists of an encryption oracle and a decryption oracle.…”

Efficient Signatures on Randomizable Ciphertexts

“…Besides the first attribute-based anonymous credential scheme for which the complexity of showing is independent of the number of attributes [FHS19], ECS have also been used to build very efficient blind signatures with minimal interaction between the signer and the user that asks for the signature [FHS15,FHKS16], revocable anonymous credentials [DHS15], as well as efficient constructions [FGKO17,DS18] of both access-control encryption [DHO16] and dynamic group signatures [BSZ05].…”