Generic security-amplifying methods of ordinary digital signatures

Abstract

Digital signatures are one of the most fundamental primitives in cryptography. In this paper, three new paradigms are proposed to obtain signatures that are secure against existential forgery under adaptively chosen message attacks (fully-secure, in short), from any weakly-secure signature. These transformations are generic, simple, and provably secure in the standard model. In the first paradigm, based on a weakly-secure signature scheme, the construction of a fully-secure signature scheme requires one-time signature additionally. However, the other two are built only on weakly-secure signatures. To the best of our knowledge, it is observed for the first time in this paper that two weakly-secure signature schemes are sufficient to construct a fully-secure signature scheme.

Based on the new proposed paradigms, several efficient instantiations without random oracles are also presented. We also show that these fully-secure signature schemes have many special interesting properties in application.

Introduction

Digital signature plays a central role in cryptography. The standard definition on the security of signature scheme was given by Goldwasser et al. [18]. Compared to the standard security model [18], there are also many weak security models. In fact, in terms of the goals and resources of the adversary, many security models can be formed. However, signatures in these weak security models, such as existentially unforgeable against generic chosen message attack (or, weak chosen message attack) [5], [18], are not sufficient in many practical applications. In this paper, the signatures that is secure against weak chosen message attack are called weakly-secure signatures. In this security model, the adversary is required to submit all signature queries before the signer’s public key is published.

Obviously, because of the limitation of signature queries, the signature that is provably secure in this weak model will be insecure in many practical applications. There are many attempts to design practical and provably secure signature schemes in the standard security model [18]. These methods can be divided into two categories, namely, concrete construction method and generic construction method.

There are many concrete constructions of signature schemes based on some standard assumptions, such as discrete logarithm problem [28], [30], computational Diffie–Hellman problem [6], [17], [34], factoring problem [3]. Some constructions based on other assumptions [29], [36] have also been proposed. Though they are efficient, their security can only be proven in the random oracle model. As we know, Canetti et al. [9] has showed that some popular cryptosystems previously proved secure in the random oracle are actually insecure when the random oracle is instantiated by any real-world hash functions. Over the last decades, several signature schemes were proposed in the standard model based on some stronger complexity assumptions such as [5], [8], [12], [16], [20]. Among them, the most efficient schemes are based on the Strong-RSA assumption [12], [16] and q-strong Diffie–Hellman (q-SDH) assumption [5], which are cryptographically stronger than the computational Diffie–Hellman and RSA assumptions.

There are also many generic constructions of signatures based on the basic cryptographic primitive, such as (trapdoor) one-way functions [1], [22]. Many generic constructions from other cryptographic protocols have also been proposed, such as non-interactive zero-knowledge [19], [11], [15]. Among them, the most famous one is the Fiat–Shamir (FS) transform [15]. However, its security relies on the random oracle model. To avoid the usage of random oracle model, from the Σ protocol, Cramer and Damgård [11] gave another generic transformation. However, this conversion method is not practical because it used the authentication tree. Very recently, Bellare and Shoup [4] showed a simple transform for the construction of standard and strongly secure signatures from the Σ protocol, using the tool of two-tier signatures.

Firstly, we present three new paradigms to transform any weakly-secure signature schemes into fully-secure signature schemes. More precisely, these three paradigms are called sequential composition with one-time signature, sequential composition method, and parallel composition method, respectively. To the best of our knowledge, it is observed for the first time in our paper that only two weakly-secure signature schemes are required to get fully-secure signatures. Therefore, this paper makes contributions towards the goal to obtain efficient constructions with standard assumptions. Motivated from the results of [23], Huang et al. [21] showed how to construct a strongly unforgeable signature from a weakly secure signature and Li et al. [24] showed two generic construction methods to get an unforgeable signature scheme from a weakly-secure signature scheme. Thus, these results have interest from both theoretical and practical perspective. More specifically, these three paradigms are described as follows:

• Sequential composition with one-time signature: This paradigm requires one weak signature scheme and an ordinary one-time signature. Key pair of the weak signature scheme is generated in key generation algorithm and used to sign the public key of one-time signature, which is generated in signing algorithm.

• Sequential composition (of weak signatures): This paradigm requires two weak signature schemes sequentially. Key pair in the first weak signature scheme is generated in key generation algorithm. During signing algorithm, another key pair of weak signature is generated. The first secret key is used to sign the other public key, and the other secret key is used to sign a message.

• Parallel composition (of weak signatures): Two weak signature schemes are also required in this paradigm, however, both of their key pairs should be generated in key generation algorithm, and used to sign two random and related messages.

We also show several efficient instantiations without random oracles converted from two weakly-secure signature schemes. The first two paradigm are very efficient in key generation compared to the last. However, the signing algorithm of the last paradigm is more efficient. There is a coincidence that, when instantialized from weak signature scheme [16], the construction will be similar to twin signature scheme [26]. In fact, the last paradigm can be viewed as generalization and extension of the twin signature scheme [26]. Recently, another notion called strongly existential unforgeability was concerned by many contributions, such as [7], [21], [33].

In Section 2, the definitions of variant signatures are given. Then, two previous instantiations of weakly-secure signature schemes are reviewed in Section 3. In Section 4, three generic transformations techniques are proposed. In Section 5, several instantiations from sequential composition with one-time signature scheme are presented. In Section 6, instantiations from sequential composition method are given. In Section 7, we show the two instantiations from parallel composition method. The conclusion is given in Section 8.