Two-tier signatures, strongly unforgeable signatures, and Fiat-Shamir without random oracles

  • Authors:
  • Mihir Bellare;Sarah Shoup

  • Affiliations:
  • Department of Computer Science and Engineering, University of California San Diego, La Jolla, CA;Department of Computer Science and Engineering, University of California San Diego, La Jolla, CA

  • Venue:
  • PKC'07 Proceedings of the 10th international conference on Practice and theory in public-key cryptography
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

We provide a positive result about the Fiat-Shamir (FS) transform in the standard model, showing how to use it to convert threemove identification protocols into two-tier signature schemes with a proof of security that makes a standard assumption on the hash function rather than modeling it as a random oracle. The result requires security of the starting protocol against concurrent attacks. We can show that numerous protocols have the required properties and so obtain numerous efficient two-tier schemes. Our first application is a two-tier scheme based transform of any unforgeable signature scheme into a strongly unforgeable one. (This extends Boneh, Shen and Waters [8] whose transform only applies to a limited class of schemes.) The second application is new one-time signature schemes that, compared to one-way function based ones of the same computational cost, have smaller key and signature sizes.