Pseudorandom signatures

Abstract

Abstract. We develop a three-level hierarchy of privacy notions for (unforgeable) digital signature schemes. We first prove mutual independence of existing notions of anonymity and confidentiality, and then show that these are implied by higher privacy goals. The top notion in our hierarchy is pseudorandomness: signatures with this property hide the entire information about the signing process and cannot be recognized as signatures when transmitted over a public network. This implies very strong unlinkability guarantees across different signers and even different signing algorithms, and gives rise to new forms of private public-key authentication. We show that one way towards pseudorandom signatures leads over our mid-level notion, called indistinguishability: such signatures can be simulated using only the public parameters of the scheme. As we reveal, indistinguishable signatures exist in different cryptographic settings (e.g. based on RSA, discrete logarithms, pairings) and can be efficiently lifted to pseudorandomness deploying general transformations using appropriate encoding techniques. We also examine a more direct way for obtaining pseudorandomness for any unforgeable signature scheme. All our transformations work in the standard model. We keep public verifiability of signatures in the setting of system-wide known public keys. Some results even hold if signing keys are disclosed to the adversary -given that signed messages have high entropy.

Oblivious PAKE: Efficient Handling of Password Trials

“…In order to enable encoding of PAKE messages using IHME with passwords as indices we apply our second building block, namely admissible encoding [19,21,29]. Briefly, a function F : S → R is an -admissible encoding for (S, R) with |S| > |R| when for all uniformly distributed r ∈ R, the distribution of the inverse transformation I F (r) is -statistically indistinguishable from the uniform distribution over S. We refer to [21,29] or Appendix A for more details.…”

“…Briefly, a function F : S → R is an -admissible encoding for (S, R) with |S| > |R| when for all uniformly distributed r ∈ R, the distribution of the inverse transformation I F (r) is -statistically indistinguishable from the uniform distribution over S. We refer to [21,29] or Appendix A for more details. I F enables us to map PAKE messages into the IHME message space where necessary.…”

“…we use the inverse of encoding (3) : 1) : Z q → G and I F (3,1) follows the specification from [29,Lemma 12] with prime |q | = (λ) > 2|N | to meet IHME requirements.…”