Threshold Signatures, Multisignatures and Blind Signatures Based on the Gap-Diffie-Hellman-Group Signature Scheme

Abstract

Abstract. We propose a robust proactive threshold signature scheme, a multisignature scheme and a blind signature scheme which work in any Gap Diffie-Hellman (GDH) group (where the Computational DiffieHellman problem is hard but the Decisional Diffie-Hellman problem is easy). Our constructions are based on the recently proposed GDH signature scheme of Boneh et al. [8]. Due to the instrumental structure of GDH groups and of the base scheme, it turns out that most of our constructions are simpler, more efficient and have more useful properties than similar existing constructions. We support all the proposed schemes with proofs under the appropriate computational assumptions, using the corresponding notions of security.

Another look at non-standard discrete log and Diffie-Hellman problems

“…After t queries to the challenge oracle (where t is chosen by the solver) and at most t − 1 queries to the discrete log oracle, the solver must find the discrete logs of all t elements Y i . (4) The ("static" or "one-sided") One-More Diffie-Hellman Problem (1MDHP) as first formulated by Boldyreva [8] (her version was slightly different, see Remark 1 below). The solver is given an element X ∈ G, an oracle that can solve the DHP for the given X and arbitrary Y ∈ G, and a challenge oracle that produces random group elements Y i .…”

“…In [8] Boldyreva proposed the following blind signature scheme (also based on BLS signatures [10]). Suppose that Alice wants a signer S to help her sign a message m. She first hashes the message, chooses a random r, and sends H(m)g r to S. The signer has public key X ∈ G and private key x, i.e, X = g x .…”

“…The definition of 1MDHP in [8] is slightly different from the one in §2. Namely, the solver is required to give the solution to the one-sided DHP only for a subset of the values produced by the challenge oracle that is greater in number than the number of queries to the DHP oracle.…”

Threshold Anonymous Password-Authenticated Key Exchange Secure against Insider Attacks

“…Recently, Shin et al, [23] proposed an anonymous PAKE (VEAP) protocol that provides the most efficiency in terms of computation and communication costs. Unlike the previous ones, the VEAP protocol is constructed from the blind signature scheme [3], [5]. We summarized the previous works in Table 1.…”

“…4.1. However, the actual constructions (including their efficiency) of ThresholdVEAP and TAP + are different since the former's core primitive is the PAKE protocol [1] and the latter's is the blind signature scheme [3], [5].…”