A Lossy Identification Scheme Using the Subgroup Decision Assumption

Lossy Identification Schemes from Decisional RSA

“…This is because our scheme needs no modular exponentiation in its response algorithm. Moreover, the size of public keys of our scheme is smaller than that of the DCR-based scheme of [12], and is as same as integer factoring-based schemes by [2]. These facts suggest that our scheme is one of the most efficient schemes among lossy identification schemes based on the integer factoring-based assumptions.…”

“…In this paper, we have proposed a new construction of lossy identification scheme based on the decisional RSA assumption. Our decisional RSA-based scheme ID DRSA has the efficient response algorithm Resp as well as the DCRbased scheme ID DCR in [12], because Resp executes one modular addition and one modular multiplication but no modular exponentiation. Note that other lossy identification schemes based on integer factoring-based assumptions in [2] need modular exponentiation in their response algorithms.…”

“…In this section, we describe definitions and notions which are used in this paper. The descriptions follow those in the literature [3,12].…”

“…Following their work, Abdalla, Ben Hamouda and Pointcheval [2] constructed lossy identification schemes from the several integer factoring-based cryptographic assumptions, such as the -hiding assumption [6], the QR assumption, the RSA assumption and the DCR assumption [19]. Hasegawa and Isobe [12] proposed a lossy identification scheme by using the subgroup decision assumption [4]. They also proposed another lossy identification scheme based on the DCR assumption by applying the construction of the subgroup decision-based scheme.…”

“…Our lossy identification scheme based on the decisional RSA assumption has an efficient response algorithm as well as the DCR-based scheme by [12]. This is because our scheme needs no modular exponentiation in its response algorithm.…”