One-More Assumptions Do Not Help Fiat-Shamir-type Signature Schemes in NPROM

Fukumitsu, Masayuki; Hasegawa, Shingo

doi:10.1007/978-3-030-40186-3_25

Cited by 4 publications

(5 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On the other hand, Fischlin and Fleischhacker [12] showed that Sch cannot be proven to be secure without the programmability. This impossibility was strengthened by [15,17,18,19]. Kiltz, Masny and Pan [28] also summarized the impossibility results on the programmability for generic Fiat-Shamir-type signatures including Sch.…”

Section: Related Workmentioning

confidence: 99%

On Multi-user Security of Schnorr Signature in Algebraic Group Model

Fukumitsu

Hasegawa

2023

IJNC

Self Cite

View full text Add to dashboard Cite

The security of Schnorr signature Sch has been widely discussed so far. Recently, Fuchsbauer, Plouviez and Seurin gave a tight reduction that proves EUF-CMA of Sch in the random oracle (ROM) with the algebraic group model (AGM) from the discrete logarithm (DL) assumption at EUROCRYPT 2020. Kiltz, Masny and Pan considered multi-user security of Sch at CRYPTO 2016, whereas Fuchsbauer et al. considered the single-user security only. More precisely, Kiltz et al. constructed a tight reduction from EUF-CMA to MU-EUF-CMA. Combining these two results will likely enable us to construct a tight reduction that proves MU-EUF-CMA security of Sch in AGM+ROM from DL assumption.Against such an intuition, we show an impossibility on proving MU-EUF-CMA of Sch in AGM+ROM only by combining them in this paper. To estimate our impossibility result, we also discuss why the result by Fuchsbauer et al. cannot be applied to MU-EUF-CMA setting. Our result therefore suggests that we are required to develop a new proof technique beyond the algebraic reduction or to find a new form of public keys other than that considered in our impossibility, in order to show MU-EUF-CMA of Sch in AGM+ROM.

show abstract

Section: Related Workmentioning

confidence: 99%

On Multi-user Security of Schnorr Signature in Algebraic Group Model

Fukumitsu

Hasegawa

2023

IJNC

Self Cite

View full text Add to dashboard Cite

show abstract

“…The first one is that M also obtains any hash value from the external random oracle as well as R. The meta-reductions such as [11], [12], [18] are categorized in this type. We refer to this type of meta-reductions as the NPROM-NPROM model.…”

Section: Our Contributionsmentioning

confidence: 99%

“…Meta-reductions in this type do not employ the idea using the HVZK because M cannot use the programming technique of the random oracle. Instead, M constructed in [11], [12], [18] utilized the abilities of the signing oracle emulated by R to simulate F . To make the assumed reduction R have the ability to simulate the signing oracle, one has to consider the cma or sma forger in the statement of the impossibility.…”

Section: Our Contributionsmentioning

confidence: 99%

“…To make matters worse, we now consider an impossibility result from the interactive cryptographic assumption via a non-restricted reduction. The meta-reductions in [11], [12], [18] run R multiple times to succeed in the utilization of the ability of R. Such a multiple running of R by M seems not to directly employ the security from interactive assumptions. This is because interactive assumptions including the OM-DL assumption generally have a limit on the number of times of the access to the oracle supposed by the assumption, and each R can access the oracle at most such times.…”

Section: Our Contributionsmentioning

confidence: 99%

“…This is because the results by [2], [3] considered a non-tight reduction for the security proofs, whereas these impossibility results hold only for tight and some constrained reductions like generic or algebraic reductions. For the impossibility result which concerns a non-tight reduction, Fukumitsu and Hasegawa [18] showed that the generalized OM assumption [19], which is a generalization of the OM-DL assumption, seems not to imply the euf-cma security of several Fiat-Shamir-type signature schemes. Non-tight reductions are considered in their result, however, they only considered a vanilla reduction which only can invoke a forger once and is prohibited to rewind it.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Impossibility on the Schnorr Signature from the One-More DL Assumption in the Non-Programmable Random Oracle Model

Fukumitsu

Hasegawa

2021

IEICE Trans. Fundamentals

Self Cite

View full text Add to dashboard Cite

The Schnorr signature is one of the representative signature schemes and its security was widely discussed. In the random oracle model (ROM), it is provable from the DL assumption, whereas there is negative circumstantial evidence in the standard model. Fleischhacker, Jager, and Schröder showed that the tight security of the Schnorr signature is unprovable from a strong cryptographic assumption, such as the One-More DL (OM-DL) assumption and the computational and decisional Diffie-Hellman assumption, in the ROM via a generic reduction as long as the underlying cryptographic assumption holds. However, it remains open whether or not the impossibility of the provable security of the Schnorr signature from a strong assumption via a non-tight and reasonable reduction. In this paper, we show that the security of the Schnorr signature is unprovable from the OM-DL assumption in the non-programmable ROM as long as the OM-DL assumption holds. Our impossibility result is proven via a non-tight Turing reduction.

show abstract

Black-Box Use of One-Way Functions is Useless for Optimal Fair Coin-Tossing

Maji

Wang

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

One-More Assumptions Do Not Help Fiat-Shamir-type Signature Schemes in NPROM

Cited by 4 publications

References 40 publications

On Multi-user Security of Schnorr Signature in Algebraic Group Model

On Multi-user Security of Schnorr Signature in Algebraic Group Model

Impossibility on the Schnorr Signature from the One-More DL Assumption in the Non-Programmable Random Oracle Model

Black-Box Use of One-Way Functions is Useless for Optimal Fair Coin-Tossing

Contact Info

Product

Resources

About