Threshold signature schemes for ElGamal variants

Kim, Sung-Wook; Kim, Jihye; Cheon, Jung Hee; Ju, Seongho

doi:10.1016/j.csi.2011.01.004

Cited by 11 publications

(3 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In group-oriented cryptography, there are two basic adversarial models: static and adaptive. In the static model, the adversary fixes a subset of participants that she wants to corrupt before the protocol starts [3,4]. In the adaptive model, the adversary waits for an appropriate time during the protocol execution.…”

Section: Introductionmentioning

confidence: 99%

A Fully Adaptively Secure Threshold Signature Scheme Based on Dual-Form Signatures Technology

Gan

2021

Security and Communication Networks

View full text Add to dashboard Cite

In t , n threshold signature schemes, any subset of t participants out of n can produce a valid signature, but any fewer than t participants cannot. Meanwhile, a threshold signature scheme should remain robust and unforgeable against up to t − 1 corrupted participants. This nonforgeability property is that even an adversary breaking into up to t − 1 participants should be unable to generate signatures on its own. Existential unforgeability against adaptive chosen message attacks is widely considered as a standard security notion for digital signature, and threshold signature should also follow this accordingly. However, there are two special attack models in a threshold signature scheme: one is the static corruption attack and the other is the adaptive corruption attack. Since the adaptive corruption model appears to better capture real threats, designing and proving threshold signature schemes secure in the adaptive corruption model has been focused on in recent years. If a threshold signature is secure under adaptive chosen message attack and adaptive corruption attack, we say it is fully adaptively secure. In this paper, based on the dual pairing vector spaces technology, we construct a threshold signature scheme and use Gerbush et al.’s dual-form signatures technology to prove our scheme, which is fully adaptively secure in the standard model, and then compare it to other schemes in terms of the efficiency and computation.

show abstract

Section: Introductionmentioning

confidence: 99%

A Fully Adaptively Secure Threshold Signature Scheme Based on Dual-Form Signatures Technology

Gan

2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Harn [10] combined a modified ElGamal scheme and Shamir's secret sharing into a (t, n) threshold signature scheme. Kim et al [11] extended Harn's scheme to all ElGamal variants.…”

Section: Introductionmentioning

confidence: 99%

“…In general, there are four types of threshold signatures, which can be described as follows. The threshold signature in traditional PKC has been studied in . Desmedt and Frankel proposed the first ( t , n ) threshold signature scheme based on the Rivest–Shamir–Adleman assumption and Shamir's secret sharing.…”

Section: Introductionmentioning

confidence: 99%

Simulatable and secure certificate‐based threshold signature without pairings

Wang

Chang

Harn

2013

Security Comm Networks

View full text Add to dashboard Cite

We propose the notion and define the security model of a certificate‐based threshold signature. The model is a general model that allows both the master secret key and user secret keys to be determined and distributed to the corresponding participators. Furthermore, the model can be easily converted into an identity‐based (ID‐based) threshold signature model to solve the key escrow problem and can be converted into a certificateless threshold signature model. In addition, we propose a secure and efficient certificate‐based threshold signature scheme. Compared with previous ID‐based threshold signature and certificateless threshold signature, our scheme requires no computation of pairings and no trusted dealer. In addition, in our proposed scheme, unlike most schemes that require all members to jointly generate a certificate or a signature, it only requires t or more than t members to generate a certificate or a signature. Our proposed scheme can detect dishonest participants as well. Therefore, our scheme is more practical than existing schemes. We show that our scheme is existentially unforgeable against adaptive chosen message attacks under the discrete logarithm assumption. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract