A CDH-based strongly unforgeable signature without collision resistant hash function

  • Authors:

  • Takahiro Matsuda;Nuttapong Attrapadung;Goichiro Hanaoka;Kanta Matsuura;Hideki Imai

  • Affiliations:

  • Institute of Industrial Science, The University of Tokyo, Tokyo, Japan;Research Center for Information Security, National Institute of Advanced Industrial, Science and Technology, Tokyo, Japan;Research Center for Information Security, National Institute of Advanced Industrial, Science and Technology, Tokyo, Japan;Institute of Industrial Science, The University of Tokyo, Tokyo, Japan;Research Center for Information Security, National Institute of Advanced Industrial, Science and Technology, Tokyo, Japan and Faculty of Science and Engineering, Chuo University, Tokyo, Japan

  • Venue:
  • ProvSec'07 Proceedings of the 1st international conference on Provable security
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Unforgeability of digital signatures is closely related to the security of hash functions since hashing messages, such as hash-and-sign paradigm, is necessary in order to sign (arbitrarily) long messages. Recent successful collision finding attacks against practical hash functions would indicate that constructing practical collision resistant hash functions is difficult to achieve. Thus, it is worth considering to relax the requirement of collision resistance for hash functions that is used to hash messages in signature schemes. Currently, the most efficient strongly unforgeable signature scheme in the standard model which is based on the CDH assumption (in bilinear groups) is the Boneh-Shen-Waters (BSW) signature proposed in 2006. In their scheme, however, a collision resistant hash function is necessary to prove its security. In this paper, we construct a signature scheme which has the same properties as the BSW scheme but does not rely on collision resistant hash functions. Instead, we use a target collision resistant hash function, which is a strictly weaker primitive than a collision resistant hash function. Our scheme is, in terms of the signature size and the computational cost, as efficient as the BSW scheme.