Nyberg–Rueppel proposed a signature scheme [1] which is of the message recovery type (see digital signature scheme) and based on the discrete logarithm problem. The following gives a typical interpretation of the Nyberg–Rueppel signature scheme.
Key generation: a prime numberp, a prime factor q of p−1, an element g of orderq in the group of integers modulo p, a secret key \( x ({\it0}<x<q) \) . The public key consists of p, q, g, and \( y=g^x {\rm mod} p \) (see also modular arithmetic).
Signing: for message m, compute \( r=m\cdot g^k \) mod p, ŕ = r mod q, s=−k−r′·x mod q, and output (r,s). Verification: verify s <q, compute r’=r mod q, and check that gs·yr′·r=m.
However, it is advised to apply some redundant function R to a message m and use R( \( \emph {m} \) ) instead of m. The reason is as follows: if a valid signature (r,s) for m is given, then \( (r, s+t {\rm mod} q) \) is a valid signature for \( m\cdot g^t\) mod q. Therefore by using R(m) instead of m, one can neglect the...
This is a preview of subscription content, log in via an institution to check access.
References
Nyberg, K. and R.A. Rueppel (1995). “Message recovery for signature schemes based on the discrete logarithm problem.” Advances in Cryptology—EUROCRYPT'94, Lecture Notes in Computer Science, vol. 950, ed. A. De Santis. Springer, Berlin, 182–193.
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 International Federation for Information Processing
About this entry
Cite this entry
Sako, K. (2005). Nyberg–Rueppel Signature Scheme. In: van Tilborg, H.C.A. (eds) Encyclopedia of Cryptography and Security. Springer, Boston, MA . https://doi.org/10.1007/0-387-23483-7_283
Download citation
DOI: https://doi.org/10.1007/0-387-23483-7_283
Publisher Name: Springer, Boston, MA
Print ISBN: 978-0-387-23473-1
Online ISBN: 978-0-387-23483-0
eBook Packages: Computer ScienceReference Module Computer Science and Engineering