A General Framework for Redactable Signatures and New Constructions

Abstract

A redactable signature scheme (RSS) allows removing parts of a signed message by any party without invalidating the respective signature. State-of-the-art constructions thereby focus on messages represented by one specific data-structure, e.g., lists, sets or trees, and adjust the security model accordingly. To overcome the necessity for this myriad of models, we present a general framework covering arbitrary data-structures and even more sophisticated possibilities. For example, we cover fixed elements which must not be redactable and dependencies between elements. Moreover, we introduce the notion of designated redactors, i.e., the signer can give some extra information to selected entities which become redactors. In practice, this often allows to obtain more efficient schemes. We then present two RSSs; one for sets and one for lists, both constructed from any EUF-CMA secure signature scheme and indistinguishable cryptographic accumulators in a black-box way and show how the concept of designated redactors can be used to increase the efficiency of these schemes. Finally, we present a black-box construction of a designated redactor RSS by combining an RSS for sets with non-interactive zero-knowledge proof systems. All the three constructions presented in this paper provide transparency, which is an important property, but quite hard to achieve, as we also conceal the length of the original message and the positions of the redactions.

Efficient Invisible and Unlinkable Sanitizable Signatures

“…Miyazaki et al [32] also considered "invisible sanitizable signatures" which is actually a different primitive known as redactable signatures [15] as discussed in [10]. Extensions of sanitizable signatures such as the multi-sanitizer setting [12] and a setting where the modification capabilities of the sanitizer are limited [11] were considered.…”

“…Extensions of sanitizable signatures such as the multi-sanitizer setting [12] and a setting where the modification capabilities of the sanitizer are limited [11] were considered. Other primitives related to sanitizable signatures include homomorphic signatures [27,26], redactable signatures [15,35,5], and proxy signatures [37,36,34].…”

HCI Patterns for Cryptographically Equipped Cloud Services

“…Overview. Redactable signatures, also known as malleable signatures, provide a means for, within given boundaries, redacting parts or field blocks from digitally signed digital documents, without the signature losing its validity [11]. In applications employing redactable signatures, one signer signs a digital document, from which a second user is able to redact some information (redacting in the sense of suppressing or "blacking out"), keeping in mind that redaction rules apply, i.e., not all fields are redactable.…”

Towards Authenticity and Privacy Preserving Accountable Workflows

“…Informally, redactable signatures [31,38,48] allow to sign documents, where certain predefined parts can later be blacked out (or cloaked) without signer interaction and without invalidating the signature. A redactable signature scheme (RSS) is a tuple of efficient algorithms (KeyGen, Sign, Verify, Redact), which are defined as follows (using the notation of [19]):…”

“…See [19] for a formal security model. Besides these properties, the security model for RSS has been refined and extended several times.…”