Functional Signatures from Indistinguishability Obfuscation

Abstract

In PKC 2014, Boyle, Goldwasser, and Ivan introduced a cryptographic primitive called functional signatures. In a functional signature scheme, in addition to a master key that can be used to sign any message, there are signing keys for a function f, which allow one to sign any message in the range of f. In the same paper, Boyle et al. pointed out that in order to obtain a functional signature scheme with short signatures, we must either rely on non-falsifiable assumptions (as in their succinct non-interactive arguments of knowledge construction) or make use of non black-box techniques.

In this paper, we diverge from succinct non-interactive arguments of knowledge (SNARKs). We provide a construction of functional signature scheme satisfying both function privacy and succinctness under the existence of indistinguishability obfuscation for all polynomial-size circuits and one-way functions for the first time. Additionally, our scheme is under weaker assumption than SNARK-type assumptions for a class of functions and the size of signatures are independent of f, f(m),  and m.

This research is supported by the National Natural Science Foundation of China (Grant No. 60970139) and the Strategic Priority Program of Chinese Academy of Sciences (Grant No. XDA06010702).

Appendices

A Signature Schemes

Definition 4

A signature scheme for a message space $\mathcal {M}$ is a tuple $\mathsf {(Gen,~Sign,}~\mathsf {Verify):}$

• $\mathsf {Gen(1}^k)\rightarrow \mathsf {(sk,vk)}$: the key generation algorithm is a probabilistic, polynomial-time algorithm which takes as input a security parameter $1^k$, and outputs a signing and verification key pair $\mathsf {(sk,vk)}$.

• $\mathsf {Sign(sk},m)\rightarrow \sigma$: the signing algorithm is a probabilistic polynomial time algorithm which is given the signing key $\mathsf {sk}$ and a message $m\in \mathcal {M}$ and outputs a string $\sigma$ which we call the signature of m.

• $\mathsf {Verify(vk},m,\sigma ) \rightarrow \{0,1\}$: the verification algorithm is a polynomial time algorithm which, given the verification key $\mathsf {vk}$, a message m, and signature $\sigma$, return 1 or 0 indicating whether the signature is valid.

Correctness: We call a signature scheme correct if

$\forall (\mathsf {sk,vk})\leftarrow \mathsf {Gen}(1^k),\forall m\in \mathcal {M},\forall \sigma \leftarrow \mathsf {Sign(sk,}m), \mathsf {Verify(vk,}m,\sigma )\rightarrow 1$

Unforgeability Under Chosen Message Attack:

A signature scheme is unforgeable under chosen message attack if the winning probability of any probabilistic polynomial time adversary in the following game is negligible in the security parameter:

• The challenger samples a signing, verification key pair $\mathsf {(sk,vk)}\leftarrow \mathsf {Gen}(1^k)$ and gives $\mathsf {vk}$ to the adversary.

• The adversary requests signatures from the challenger for a polynomial number of messages. In round i, the adversary chooses $m_i$ based on $m_1,\sigma _1,\ldots ,m_{i-1},\sigma _{i-1}$, and receives $\sigma _i\leftarrow \mathsf {Sig(sk,}m_i).$

• The adversary outputs a signature $\sigma ^{*}$ and a message $m^{*}$ and wins if $\mathsf {Verify(vk,}m^{*},\sigma ^{*})\rightarrow 1$ and the adversary has not previously received a signature of $m^{*}$ from the challenger.

B The Proof of Theorem 3

Proof

In our functional signature scheme, we use indistinguishability obfuscation, signature scheme, one-way functions, puncturable PRFs. In the follow, we prove signature scheme and puncturable PRFs can be constructed if one-way function exists.

Lemma 1

[24] Under the assumption that one-way functions exist, there exists a signature scheme which is secure against existential forgery under adaptive chosen message attacks by polynomial-time algorithms.

Lemma 2

[5, 9, 17, 22] If one-way functions exist, then for all efficiently computable functions $\ell (\lambda )$ and $n(\lambda )$, there exists a puncturable PRF family that maps $\ell (\lambda )$ bits to $n(\lambda )$ bits.

Based on $\mathsf {lemmas}$ 1, 2, we can conclude that our functional signature scheme is under the assumptions of indistinguishability obfuscation and one-way functions. And if exists a PPT algorithm $\mathrm {D}$ , $\forall f\in \mathcal {F},m^{*} \in \mathcal {M}$, $\mathrm {D}$ can decide whether $m^{*}$ is in the range of f, then in the proof of selective unforgeability, the verification time is polynomial time. Therefore, if there exists a PPT algorithm $\mathrm {D}$, given the message $m^{*} \in \mathcal {M}$, $f\in \mathcal {F}$ and the domain of f, $\mathrm {D}$ can decide whether $m^{*}$ is in the range of f, then our functional signature scheme verification time is under falsifiable assumptions.