Redactable Signatures for Tree-Structured Data: Definitions and Constructions

Brzuska, Christina; Busch, Hauke; Dagdelen, Oezguer; Fischlin, Marc; Franz, Martin; Katzenbeisser, Stefan; Manulis, Mark; Onete, Cristina; Andreas, Peter; Poettering, Bertram; Schröder, Dominique

doi:10.1007/978-3-642-13708-2_6

Cited by 79 publications

(84 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The work whose definition is closest to what we envision is the recent work on redacted signatures of Chang et al [22] and Brzuska et al [16] (see also Naccache [44, p. 63] and Boneh-Freeman [13,12] 4 ). However, there is a subtle, but fundamental difference between their definition and the privacy notion we are aiming for.…”

Section: Related Workmentioning

confidence: 78%

“…Earlier work in this area [34,17,19,16] only considered weaker privacy requirements using more complex definitions. The simplicity and breadth of Definition 2.4 is one of our key contributions.…”

Section: Security: Unforgeabilitymentioning

confidence: 99%

“…Early work on quotable signatures [53,34,43,42,31,18,22,16] supports quoting from a single document, but does not achieve the privacy or unforgeability properties we are aiming for. For example, if simple quoting of messages is all that is desired, then the following folklore solution would suffice: simply sign the Merkle hash of a document.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Computing on Authenticated Data

Ahn

Boneh

Camenisch

et al. 2012

Theory of Cryptography

View full text Add to dashboard Cite

In tandem with recent progress on computing on encrypted data via fully homomorphic encryption, we present a framework for computing on authenticated data via the notion of slightly homomorphic signatures, or P -homomorphic signatures. With such signatures, it is possible for a third party to derive a signature on the object m from a signature of m as long as P (m, m ) = 1 for some predicate P which captures the "authenticatable relationship" between m and m. Moreover, a derived signature on m reveals no extra information about the parent m.Our definition is carefully formulated to provide one unified framework for a variety of distinct concepts in this area, including arithmetic, homomorphic, quotable, redactable, transitive signatures and more. It includes being unable to distinguish a derived signature from a fresh one even when given the original signature. The inability to link derived signatures to their original sources prevents some practical privacy and linking attacks, which is a challenge not satisfied by most prior works.Under this strong definition, we then provide generic constructions for all univariate and closed predicates, and specific efficient constructions for a broad class of natural predicates such as quoting, subsets, weighted sums, averages, and Fourier transforms. To our knowledge, these are the first efficient constructions for these predicates (excluding subsets) that provably satisfy this strong security notion.

show abstract

Section: Related Workmentioning

confidence: 78%

Section: Security: Unforgeabilitymentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Computing on Authenticated Data

Ahn

Boneh

Camenisch

et al. 2012

Theory of Cryptography

View full text Add to dashboard Cite

show abstract

“…More distantly related to our work is the notion of "redactable" signatures [24,16,15,3,22,21,10,8,7]. These schemes have the property that given a signature on a message, anyone can derive a signature on subsets of the message.…”

Section: Introductionmentioning

confidence: 99%

Linearly Homomorphic Signatures over Binary Fields and New Tools for Lattice-Based Signatures

Boneh

Freeman

2011

Lecture Notes in Computer Science

164

163

View full text Add to dashboard Cite

Abstract. We propose a linearly homomorphic signature scheme that authenticates vector subspaces of a given ambient space. Our system has several novel properties not found in previous proposals:• It is the first such scheme that authenticates vectors defined over binary fields; previous proposals could only authenticate vectors with large or growing coefficients.• It is the first such scheme based on the problem of finding short vectors in integer lattices, and thus enjoys the worst-case security guarantees common to lattice-based cryptosystems.Our scheme can be used to authenticate linear transformations of signed data, such as those arising when computing mean and Fourier transform or in networks that use network coding. Our construction gives an example of a cryptographic primitive -homomorphic signatures over F2 -that can be built using lattice methods, but cannot currently be built using bilinear maps or other traditional algebraic methods based on factoring or discrete log type problems. Security of our scheme (in the random oracle model) is based on a new hard problem on lattices, called k-SIS, that reduces to standard average-case and worstcase lattice problems. Our formulation of the k-SIS problem adds to the "toolbox" of lattice-based cryptography and may be useful in constructing other latticebased cryptosystems.As a second application of the new k-SIS tool, we construct an ordinary signature scheme and prove it k-time unforgeable in the standard model assuming the hardness of the k-SIS problem. Our construction can be viewed as "removing the random oracle" from the signatures of Gentry, Peikert, and Vaikuntanathan at the expense of only allowing a small number of signatures.

show abstract

“…However, not even all schemes are private, e.g. for the scheme by Kundu and Bertino [22] attacks on transparency and privacy [7] and one attacking structural integrity [29] have been given.…”

Section: Definition 2 (Contingency:) Contingency Describes the Verifmentioning

confidence: 99%

Contingency Revisited: Secure Construction and Legal Implications of Verifiably Weak Integrity

Pöhls

2013

Trust Management VII

View full text Add to dashboard Cite

Abstract. Digital signatures are by far the most prominent mechanisms to detect violations of integrity. When signing rights are delegated, the integrity protection is gradually weaker as the delegatee's actions are not considered integrity violations. Taken to an extreme, delegating the right to undetectably change everything to everyone will achieve a property called contingency. Contingency was introduced as the "dual of integrity" in 2009 by Rost and Pfitzmann in German [26] and later translated into English in 2011 [4]. Contingency describes the exact opposite of integrity: the provable absence of integrity. Following this line of privacy research, this paper gives the first rigorous definition of contingency and presents a cryptographic protocol build upon a transparent sanitizable signature scheme. Hence, contingency is a verifiable statement that the signer explicitly desired that the integrity status of data is not verifiable. We analyze legal implications and applications of contingent information.

show abstract

Redactable Signatures for Tree-Structured Data: Definitions and Constructions

Cited by 79 publications

References 8 publications

Computing on Authenticated Data

Computing on Authenticated Data

Linearly Homomorphic Signatures over Binary Fields and New Tools for Lattice-Based Signatures

Contingency Revisited: Secure Construction and Legal Implications of Verifiably Weak Integrity

Contact Info

Product

Resources

About