The exact security of digital signatures-how to sign with RSA and Rabin

  • Authors:
  • Mihir Bellare;Phillip Rogaway

  • Affiliations:
  • Department of Computer Science and Engineering, University of California at San Diego, La Jolla, CA;Department of Computer Science, University of California at Davis, Davis, CA

  • Venue:
  • EUROCRYPT'96 Proceedings of the 15th annual international conference on Theory and application of cryptographic techniques
  • Year:
  • 1996

Quantified Score

Hi-index 0.01

Visualization

Abstract

We describe an RSA-based signing scheme which combines essentially optimal efficiency with attractive security properties. Signing takes one RSA decryption plus some hashing, verification takes one RSA encryption plus some hashing, and the size of the signature is the size of the modulus. Assuming the underlying hash functions are ideal, our schemes are not only provably secure, but are so in a tight way-- an ability to forge signatures with a certain amount of computational resources implies the ability to invert RSA (on the same size modulus) with about the same computational effort. Furthermore, we provide a second scheme which maintains all of the above features and in addition provides message recovery. These ideas extend to provide schemes for Rabin signatures with analogous properties; in particular their security can be tightly related to the hardness of factoring.