Identification of Bad Signatures in Batches

Abstract

Abstract. The paper addresses the problem of bad signature identification in batch verification of digital signatures. The number of generic tests necessary to identify all bad signatures in a batch instance, is used to measure the efficiency of verifiers. The divide-and-conquer verifier DCVα(x, n) is defined. The verifier identifies all bad signatures in a batch instance x of the length n by repeatedly splitting the input into α sub-instances. Its properties are investigated. In particular, probability distributions for the number of generic tests necessary to identify one, two and three bad signatures, are derived. The average numbers of GT tests necessary to identify bad signatures ranging from 1 to 16 are obtained from computer simulation. Further, a Hamming verifier (HV) is defined which allows to identify a single bad signature in a batch of the length n = 2 k − 1 using k + 2 tests. HV is generalised into the two-layer Hamming verifier (2HV). Given a batch instance of the length 2 k − 2, the 2HV verifier identifies a single bad signature using k + 2 tests and two bad signatures in expense of 3k + 3 tests. The work is concluded by comments about a general model for verification codes identifying t bad signatures and the design of verifiers using combinatorial structures.

Group Testing and Batch Verification

“…The first two are by Pastuszak et al [30,29]. They consider a generic Batch function for a signature scheme and study the divide-andconquer method of finding bad signatures in [29].…”

“…The first two are by Pastuszak et al [30,29]. They consider a generic Batch function for a signature scheme and study the divide-andconquer method of finding bad signatures in [29]. The divide-and-conquer verifier was originally described in [27] under the name cut and choose, and is referred to binary splitting in the group testing literature.…”

“…This approach is an instance of well-known non-adaptive group testing algorithms based on cover-free, separable and disjunct matrices, discussed in §2.3.1. A limitation of [30,29] is that either the number of bad signatures in a batch, or a bound on the number of bad signatures is required a priori. This is common to most group testing algorithms as well.…”

“…Thus CFF are id-codes, and the d-separable property defined in 2.3.1 is both necessary and sufficient for an id-code. The construction of id-codes put forward in Pastuszak et al [29] is a cover-free family with some additional constraints on the number of nonzero row and column entries. Using their construction gives the following ISF.…”

“…, 153 were used when investigating the practical performance of the binary splitting method. In Pastuszak et al [29], choices of n ∈ [16,1024] are used to give the average number of tests for the binary splitting method when d = 1, . .…”