Unified, Minimal and Selectively Randomizable Structure-Preserving Signatures

Abstract

Abstract. We construct a structure-preserving signature scheme that is selectively randomizable and works in all types of bilinear groups. We give matching lower bounds showing that our structure-preserving signature scheme is optimal with respect to both signature size and public verification key size. State of the art structure-preserving signatures in the asymmetric setting consist of 3 group elements, which is known to be optimal. Our construction preserves the signature size of 3 group elements and also at the same time minimizes the verification key size to 1 group element. Depending on the application, it is sometimes desirable to have strong unforgeability and in other situations desirable to have randomizable signatures. To get the best of both worlds, we introduce the notion of selective randomizability where the signer may for specific signatures provide randomization tokens that enable randomization. Our structure-preserving signature scheme unifies the different pairingbased settings since it can be instantiated in both symmetric and asymmetric groups. Since previously optimal structure-preserving signatures had only been constructed in asymmetric bilinear groups this closes an important gap in our knowledge. Having a unified signature scheme that works in all types of bilinear groups is not just conceptually nice but also gives a hedge against future cryptanalytic attacks. An instantiation of our signature scheme in an asymmetric bilinear group may remain secure even if cryptanalysts later discover an efficiently computable homomorphism between the source groups.

Structure-Preserving Signatures from Type II Pairings

“…Recently Abe et al [6] investigated the symmetric setting (Type I) and found that the same lower bound of 3 group elements and 2 verification equations applies. They also presented a unified structure-preserving signature scheme working in all three types of settings and meeting this bound, which means a structure-preserving signature scheme with 3 group elements and 2 verification equations exists (and is the best construction published so far) in the Type II setting we investigate.…”

“…Structure-preserving signatures have been analyzed in the symmetric Type I setting [4] and in the fully asymmetric Type III setting [6], and in both cases it has been shown that a structure-preserving signatures requires at least 2 verification equations and 3 group elements in the signatures. It is thus natural to conjecture that 2 verification equations and 3 group elements would be needed in the intermediate Type II setting as well; and indeed this is the case if the messages belong to G 1 .…”

“…Prior work has explored lower bounds in the Type I and Type III settings, and established that 2 verification equations are required, and that signatures must consist of at least 3 group elements in both of those cases [4,6]. A third dimension of efficiency is the size of the verification key of the signature scheme.…”

Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption

“…Specifically, we propose a new concept of homomorphic PKE, which we call keyed-homomorphic public-key encryption (KH-PKE), that has the following properties: (1) in addition to a conventional public/decryption key pair (pk, sk d ), another secret key for the homomorphic operation (denoted by sk h ) is introduced, (2) homomorphic operations cannot be performed without using sk h , and (3) ciphertexts cannot be decrypted using only sk h . Interestingly, KH-PKE implies conventional homomorphic PKE, since the latter can be implemented by publishing sk h of KH-PKE.…”

“…In the signature context, Abe et al [1] considered selective randomizability, where a strongly unforgeable signature to be randomized with the help of a randomization token, and a randomizable signature is still existentially unforgeable.…”