A Constant-Size Signature Scheme with a Tighter Reduction from the CDH Assumption

Abstract

We present a constant-size signature scheme under the CDH assumption. It has a tighter security reduction than any other constant-size signature scheme with a security reduction to solving some intractable search problems. Hofheinz, Jager, and Knapp (PKC 2012) presented a constant-size signature scheme under the CDH assumption with a reduction loss of O(q), where q is the number of signing queries. They also proved that the reduction loss of O(q) is optimal in a black-box security proof. To the best of our knowledge, no constant-size signature scheme has been proposed with a tighter reduction (to the hardness of a search problem) than that proposed by Hofheinz et al., even if it is not re-randomizable. We remark that our scheme is not re-randomizable. We achieve the reduction loss of O(q/d), where d is the number of group elements in a public key.

Short Lattice Signature Scheme with Tighter Reduction under Ring-SIS Assumption

“…We revisit DM14 [18] and apply two ideas to reduce reduction loss of DM14: considering multiple tag collisions and changing the construction of tag sets by applying Kajita et al's reduction technique [27]. Concerning tight security reductions, Kajita et al [27] present a signature scheme with the tightest security reduction among known constant-size signature schemes secure under the computational Diffie-Hellman (CDH) assumption. They first construct a signature scheme, satisfying a security notion denoted as existentially unforgeable against extended random-message attacks (EUF-XRMA).…”

“…Next, to further reduce the reduction loss, we use the reduction technique of Kajita et al [27]. In their technique, by reducing the domain of the tag, the reduction loss can be greatly reduced in exchange for the public key length.…”

“…By constructing the tag from a random message, it is not necessary to send the tag with the signature, which leads to slightly smaller signatures. When applying [27], note that the parameters in the lattice setting are different. In particular, the number of signature queries is polynomial in the discrete logarithm setting, but exponential in the lattice setting.…”

“…We demonstrate the following lemma to prove the security of our signature scheme later in this paper. This lemma is almost the same as Lemma 1 in [27], but its parameters are different from those of [27] to match the lattice setting. The proof of [27] cannot directly apply to this lemma, so we show the proof of this lemma here.…”

Revocable One-Time Ring Signature from Pairings

“…Thus, using lRS can solve this problem as double voting (double signing) can be detected easily, and anyone only can vote once in the system. Beside e-voting systems, lRS can also apply in other actual scenarios, such as ad hoc network authentication [4], blockchain-based applications [5,6], and cryptocurrencies (Monero [7]). But in some actual transactions based on ring signature, when a ring signer has committed an offence, such as money laundering, online extortion, and terrorist financing, the authority needs to find out who is the actual signer among the ring members.…”