Structure-Preserving Signatures from Type II Pairings

Abe, Masayuki; Groth, Jens; Ohkubo, Miyako; Tibouchi, Mehdi

doi:10.1007/978-3-662-44371-2_22

Cited by 25 publications

(40 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…At the same time, an isomorphic copy of H can be publicly computed in the target group Gt , i.e., anyone can compute e(H(X), g). 1 Second, when generated in trapdoor mode, for two given group elements g, h e G such that h = gz, the trapdoor allows one to write every H(X) as gcx (z) for a degree-d polynomial cx (z).…”

Section: O U R Contrib U Tio Nmentioning

confidence: 99%

Homomorphic signatures with sublinear public keys via asymmetric programmable hash functions

Catalano

Fiore

Nizzardo

2017

Des. Codes Cryptogr.

View full text Add to dashboard Cite

We introduce the notion of asymmetric programmable hash functions (APHFs, for short), which adapts Programmable hash functions, introduced by Hofheinz and Kiltz (Crypto 2008, Springer, 2008, with two main differences. First, an APHF works over bilinear groups, and it is asymmetric in the sense that, while only secretly computable, it admits an isomorphic copy which is publicly computable. Second, in addition to the usual programmability, APHFs may have an alternative property that we call programmable pseudorandomness. In a nutshell, this property states that it is possible to embed a pseudorandom value as part of the function's output, akin to a random oracle. In spite of the apparent limitation of being only secretly computable, APHFs turn out to be surprisingly powerful objects. We show that they can be used to generically implement both regular and linearly-homomorphic signature schemes in a simple and elegant way. More importantly, when instantiating these generic construc-tions with our concrete realizations of APHFs, we obtain: (1) the first linearly-homomorphic signature (in the standard model) whose public key is sub-linear in both the dataset size and the dimension of the signed vectors; (2) short signatures (in the standard model) whose public key is shorter than those by Hofheinz-Jager-Kiltz (Asiacrypt 2011, Springer, 2011 and essentially the same as those by Yamada et al. (CT-RSA 2012, Springer, 2012.

show abstract

Section: O U R Contrib U Tio Nmentioning

confidence: 99%

Homomorphic signatures with sublinear public keys via asymmetric programmable hash functions

Catalano

Fiore

Nizzardo

2017

Des. Codes Cryptogr.

View full text Add to dashboard Cite

show abstract

“…Second, and more importantly, there are attacks on the scheme if the membership tests are omitted. For example, given a valid signed message (M, (R, S)), one can easily 5 select a second point 5 Given R ∈ G2, one computes R1 = ψ(R) and selects arbitrary R 2 ∈ G3 with R 2 = R · R −1…”

Section: Comparisonsmentioning

confidence: 99%

Type 2 Structure-Preserving Signature Schemes Revisited

Chatterjee

Menezes

2015

Advances in Cryptology -- ASIACRYPT 2015

View full text Add to dashboard Cite

Abstract. At CRYPTO 2014, Abe et al. presented generic-signer structure-preserving signature schemes using Type 2 pairings. According to the authors, the proposed constructions are optimal with only two group elements in each signature and just one verification equation. The schemes beat the known lower bounds in the Type 3 setting and thereby establish that the Type 2 setting permits construction of cryptographic schemes with unique properties not achievable in Type 3.In this paper we undertake a concrete analysis of the Abe et al. claims. By properly accounting for the actual structure of the underlying groups and subgroup membership testing of group elements in signatures, we show that the schemes are not as efficient as claimed. We present natural Type 3 analogues of the Type 2 schemes, and show that the Type 3 schemes are superior to their Type 2 counterparts in every aspect. We also formally establish that in the concrete mathematical structure of asymmetric pairing, all Type 2 structure-preserving signature schemes can be converted to the Type 3 setting without any penalty in security or efficiency, and show that the converse is false. Furthermore, we prove that the Type 2 setting does not allow one to circumvent the known lower bound result for the Type 3 setting. Our analysis puts the optimality claims for Type 2 structure-preserving signature in a concrete perspective and indicates an incompleteness in the definition of a generic bilinear group in the Type 2 setting.

show abstract

“…Ghadafi [25] gave a structure-preserving variant of the Camenisch-Lysyanskaya signature scheme [15] that is secure under an interactive assumption in the Type-III setting. Abe et al [7] constructed a scheme in the Type-II setting (where there is an efficiently computable isomorphism from the second source group to the first) which contains only 2 group elements. Chatterjee and Menezes [17] revisited the work of [7] and showed that Type-III constructions outperform their Type-II counterparts.…”

Section: Introductionmentioning

confidence: 99%

“…Abe et al [7] constructed a scheme in the Type-II setting (where there is an efficiently computable isomorphism from the second source group to the first) which contains only 2 group elements. Chatterjee and Menezes [17] revisited the work of [7] and showed that Type-III constructions outperform their Type-II counterparts. [17] also gave constructions in Type-III setting meeting the 3 group element lower bound.…”

Section: Introductionmentioning

confidence: 99%

Short Structure-Preserving Signatures

Ghadafi

2016

Topics in Cryptology - CT-RSA 2016

View full text Add to dashboard Cite

Abstract. We construct a new structure-preserving signature scheme in the efficient Type-III asymmetric bilinear group setting with signatures shorter than all existing schemes. Our signatures consist of 3 group elements from the first source group and therefore have shorter size than all existing schemes as existing ones have at least one component of the signature in the second source group whose elements bit size is at least double their first group counterparts. Besides enjoying short signatures, our scheme is fully re-randomizable which is a useful property for many applications. Our result also constitutes a proof that the impossibility of unilateral structure-preserving signatures in the Type-III setting result of Abe et al. (Crypto 2011) does not apply to constructions in which the message space is dual in both source groups. Besides checking the well-formedness of the message, verifying a signature in our scheme requires checking 2 Pairing Product Equations (PPE) and require the evaluation of only 5 pairings in total which matches the best existing scheme and outperforms many other existing ones. Reducing the number of pairings in the verification equations is very important when combining structure-preserving signature schemes with Groth-Sahai proofs as the number of pairings required for verifying Groth-Sahai proofs for PPE equations grows linearly with the number of pairing monomials in the source equations. We give some examples of how using our new scheme instead of existing ones improves the efficiency of some existing cryptographic protocols such as direct anonymous attestation and group signature related constructions.

show abstract

Structure-Preserving Signatures from Type II Pairings

Cited by 25 publications

References 31 publications

Homomorphic signatures with sublinear public keys via asymmetric programmable hash functions

Homomorphic signatures with sublinear public keys via asymmetric programmable hash functions

Type 2 Structure-Preserving Signature Schemes Revisited

Short Structure-Preserving Signatures

Contact Info

Product

Resources

About