Signatures from Sequential-OR Proofs

Fischlin, Marc; Harasser, Patrick; Janson, Christian

doi:10.1007/978-3-030-45727-3_8

Cited by 20 publications

(18 citation statements)

References 53 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a second application of our multi-input reprogrammability result, we show QROM-security of the non-interactive OR-proof introduced by Liu, Wei and Wong [12], further analyzed by Fischlin, Harasser and Janson [10]. While the well-known (interactive) OR-proof by Cramer, Damgård and Schoenmakers [7] is a Σ-protocol and thus the results from [9] apply, the inherently non-interactive OR-proof by Liu et al does not is not obtained as the FS transformation of a Σ-protocol (though in some sense it is "close" to being of this form).…”

Section: Introductionmentioning

confidence: 71%

“…Indeed, [12] shows security of the sequential OR in the (classical) ROM. [10] go a step further and show security in the (classical) non-programmable ROM. Here we show that our multi-input version of the measure-and-reprogram result (as a matter of fact the 2-input version) implies security in the QROM.…”

Section: Sequential or Proofsmentioning

confidence: 97%

“…Furthermore, we assume that the triples (a, c, z) produced by the simulator S ZK (x) are always accepted by the verifier even for instances x ∈ L, and that a has minentropy γ. 10 Then for any q such that (q 2 + 1) • e 2 • (5q) 6 < |C| and 2 γ /(5q) 3 > 2, there exists a q-query dishonest prover that succeeds with probability q 2 /|C| in producing a valid FS[Σ]-proof for an instance x ∈ L.…”

Section: Tightness Of the Reductionsmentioning

confidence: 99%

“…A second application of our multi-input version of the measure-and-reprogram result is to the OR-proof as introduced by Liu, Wei and Wong [12] and further analyzed by Fischlin, Harasser and Janson [10]. This is an alternative (noninteractive) proof for proving existence/knowledge of (at least) one of two witnesses without revealing which one, compared to the well known technique by Cramer, Damgård and Schoenmakers [7].…”

Section: Sequential or Proofsmentioning

confidence: 99%

See 3 more Smart Citations

The Measure-and-Reprogram Technique 2.0: Multi-round Fiat-Shamir and More

Don

Fehr

Majenz

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We revisit recent works by Don, Fehr, Majenz and Schaffner and by Liu and Zhandry on the security of the Fiat-Shamir (FS) transformation of Σ-protocols in the quantum random oracle model (QROM). Two natural questions that arise in this context are: (1) whether the results extend to the FS transformation of multi-round interactive proofs, and (2) whether Don et al.'s O(q 2 ) loss in security is optimal.Firstly, we answer question (1) in the affirmative. As a byproduct of solving a technical difficulty in proving this result, we slightly improve the result of Don et al., equipping it with a cleaner bound and an even simpler proof. We apply our result to digital signature schemes showing that it can be used to prove strong security for schemes like MQDSS in the QROM. As another application we prove QROM-security of a noninteractive OR proof by Liu, Wei and Wong.As for question (2), we show via a Grover-search based attack that Don et al.'s quadratic security loss for the FS transformation of Σ-protocols is optimal up to a small constant factor. This extends to our new multiround result, proving it tight up to a factor depending on the number of rounds only, i.e. is constant for constant-round interactive proofs.

show abstract

Section: Introductionmentioning

confidence: 71%

Section: Sequential or Proofsmentioning

confidence: 97%

Section: Tightness Of the Reductionsmentioning

confidence: 99%

Section: Sequential or Proofsmentioning

confidence: 99%

See 2 more Smart Citations

The Measure-and-Reprogram Technique 2.0: Multi-round Fiat-Shamir and More

Don

Fehr

Majenz

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The other type of the meta-reduction is that M can simulate the random oracle for R. Fischlin, Harasser, and Janson [25] used this type of meta-reduction implicitly to show the impossibility of the security of a signature scheme yielded from a parallel-OR protocol, under some cryptographic assumption as long as the same assumption holds. They succeeded in the simulation of F by allowing M to use the programming technique.…”

Section: Our Contributionsmentioning

confidence: 99%

Impossibility on the Schnorr Signature from the One-More DL Assumption in the Non-Programmable Random Oracle Model

Fukumitsu

Hasegawa

2021

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

The Schnorr signature is one of the representative signature schemes and its security was widely discussed. In the random oracle model (ROM), it is provable from the DL assumption, whereas there is negative circumstantial evidence in the standard model. Fleischhacker, Jager, and Schröder showed that the tight security of the Schnorr signature is unprovable from a strong cryptographic assumption, such as the One-More DL (OM-DL) assumption and the computational and decisional Diffie-Hellman assumption, in the ROM via a generic reduction as long as the underlying cryptographic assumption holds. However, it remains open whether or not the impossibility of the provable security of the Schnorr signature from a strong assumption via a non-tight and reasonable reduction. In this paper, we show that the security of the Schnorr signature is unprovable from the OM-DL assumption in the non-programmable ROM as long as the OM-DL assumption holds. Our impossibility result is proven via a non-tight Turing reduction.

show abstract