BLS Short Digital Signatures

Related Concepts

Digital Signature Schemes; Random Oracle Model

Background

It is well known that a digital signature scheme (DSS) that produces signatures of length $\ell$ can have security at most ${2}^{\ell}$. In other words, it is possible to forge a signature on any message in time $O({2}^{\ell})$ just given the public key. It is natural to ask whether we can construct signatures with such security, i.e., signatures of length $\ell$ where the best algorithm for creating an existential forgery (with constant success probability) under a chosen message attack takes time $O({2}^{\ell})$. Concretely, is there a signature scheme producing 80-bit signatures where creating an existential forgery (with probability 1/2) takes time approximately ${2}^{80}$?

Theory

DSS signatures and Schnorr signatures provide security $O({2}^{\ell})$ with signatures that are $4\ell$-bits long. These signatures can be shortened [1] to about $3.5\ell$-bits without much affect on security....