Efficient forward secure identity-based shorter signature from lattice

Highlights

• We propose an efficient forward secure identity-based signature scheme from lattice assumption.

• The signing secret key size and the signature length of our scheme are much shorter and invariant.

• We prove that our scheme is unforgeability in the random oracle model.

• We extend our scheme to a forward secure identity-based signature scheme in the standard model.

Abstract

All regular cryptographic schemes rely on the security of the secret key. However, with the explosive use of some relatively insecure mobile devices, the key exposure problem has become more aggravated. In this paper, we propose an efficient forward secure identity-based signature (FSIBS) scheme from lattice assumption, with its security based on the small integer solution problem (SIS) in the random oracle model. Our scheme can guarantee the unforgeability of the past signatures even if the current signing secret key is revealed. Moreover, the signature size and the secret key size of our scheme are unchanged and much shorter. To the best of our knowledge, our construction is the first FSIBS scheme based on lattice which can resist quantum attack. Furthermore, we extend our FSIBS scheme to a forward secure identity-based signature scheme in the standard model.

Introduction

Identity-based signature (IBS) was first introduced by Shamir [1] in 1984. It belongs to a type of public key cryptography. In an IBS scheme, any known information of a user’s identity can be used as a public key, and the corresponding signing secret key is issued by a trusted Key Generation Center (KGC). Identity-based signature can reduce the complexity and the cost for managing the Public Key Infrastructure (PKI). Until now, most identity-based signatures [2], [3], [4], [5], [6], [7] have been proposed using groups with bilinear pairings or the quadratic residuosity.

However, Shor [8] pointed out that discrete logarithm and prime factorization problems can be solved by a quantum computer in polynomial time. It means that once quantum computer comes into reality, all of the existing public key algorithms will be broken. In order to resist quantum computer attack, there has been a rapid growth in post-quantum cryptography recently. In particular, the lattice-based cryptographic primitive is attractive due to its security on the worst-case hardness of lattice problems under a quantum reduction. Moreover, the computational cost of lattice-based cryptography is every simple and suitable for low power devices. Recently, lattice-based cryptographic schemes have been very fruitful in applications, such as digital signatures [9], [10], [11], (hierarchical) identity-based encryption (H)IBE [12], a fully homomorphic cryptosystem [13] and a new kind of LWE cryptosystem using ideal lattices [14].

As far as our knowledge is concerned, the security of all modern identity-based signature schemes wholly depends on the assumption that the signing secret keys are absolutely secure. However, once a signing secret key is exposed, the security of past and future signatures will be compromised. Furthermore, key exposure seems more likely to occur with the explosive use of mobile and unprotected devices in lots of cryptographic systems. It is much more convenient for an attacker to intrude a user’s storage space to obtain his signing secret key than to get the signing secret key only by solving some actual cryptographic hard problem. Consequently, exposure of signing secret key is a severe threat to identity-based signatures. How to provide the protection against key exposure in identity-based signatures is an important and interesting issue, which needs researchers’ more attention.

Forward-secure signature is one of the most promising solutions to guarantee security of signature against key exposure. In a non-interactive forward-secure signature scheme, the whole lifetime is divided into T time periods labeled from 1 to T. At the end of time period i, the user computes a new signing secret key ${\mathit{SK}}_{i+1}$ for the next time period using update algorithm with the input ${\mathit{SK}}_i$, and finally deletes the old signing secret key ${\mathit{SK}}_i$. Thus a forward secure signature scheme guarantees that exposure of signing secret key at time period i will not compromise on the security of system for any prior time period.

Forward-secure signature was first proposed by Anderson [15]. Bellare and Miner [16] further presented a practical scheme and formalized the definitions of forward-secure signature and its security. A large number of research papers about forward-secure signatures [17], [18], [19], [20], [21], [22], [23], [24] have been proposed so far. Compared with forward-secure signature, the research on forward-secure identity-based signature (FSIBS) seems to be much less active. Liu et al. [25] proposed the first FSIBS scheme, however, they did not provide the security definition and formal security proof. Therefore the construction of FSIBS scheme with provable security is still worthwhile research. Recently, Yu et al. [26] formalized the definition and security notion for FSIBS scheme, but it needs a lot of bilinear pairing operations, to some extent, which maybe too hard for some mobile devices with limited computational capacity. Ebri’s research work [27] has proposed an efficient general construction of FSIBS and refined the definition of FSIBS. Additionally, in the scheme the users can freely specify time periods over which their signing secret keys evolve. However, their work did not refer to lattice-based cryptography which can resist quantum attack in the post-quantum cryptographic era.

In this paper, we combine forward security with identity-based signature to propose the first lattice-based forward-secure identity-based signature scheme. And in the random oracle model, we prove our scheme is unforgeable against chosen message and adaptively chosen identity attacks even on a quantum computer. Thus, key-exposure does not affect the security of signatures generated in previous time periods. Our second contribution is an extension to FSIBS in the standard model. The update algorithm in our extension scheme is constructed with an inspiration of the scheme in [28]. Moreover, we employ the technique in [29] for delegating a short lattice basis that has the advantage of keeping the lattice dimension unchanged, thus the signing secret key size and the signature size of our schemes are both invariant and much shorter.

The rest of this paper is organized as follows. We introduce the preliminaries of our work in Section 2, including lattice definitions and hard assumptions. We give the formal definition of FSIBS scheme and its security notions in Section 3. We give our formal FSIBS scheme from lattice assumption, its security analysis and efficiency comparison in Section 4. We extend our scheme to a FSIBS scheme in the standard model in Section 5. Finally, we conclude our work in Section 6.