Twin signatures: an alternative to the hash-and-sign paradigm

  • Authors:
  • David Naccache;David Pointcheval;Jacques Stern

  • Affiliations:
  • Gemplus Card International, Issy-les-Moulineaux, France;École Normale Supérieure, Paris cedex, France;École Normale Supérieure, Paris cedex, France

  • Venue:
  • CCS '01 Proceedings of the 8th ACM conference on Computer and Communications Security
  • Year:
  • 2001

Quantified Score

Hi-index 0.00

Visualization

Abstract

This paper introduces a simple alternative to the hash-and-sign paradigm, from the security point of view but for signing short messages, called twinning. A twin signature is obtained by signing twice a short message by a signature scheme. Analysis of the concept in different settings yields the following results: We prove that no generic algorithm can efficiently forge a twin DSA signature. Although generic algorithms offer a less stringent form of security than computational reductions in the standard model, such successful proofs still produce positive evidence in favor of the correctness of the new paradigm.We prove in standard model an equivalence between the hardness of producing existential forgeries (even under adaptively chosen message attacks) of a twin version of a signature scheme proposed by Gennaro, Halevi and Rabin and the Flexible RSA Problem.We consequently regard twinning as an interesting alternative to hash functions for eradicating existential forgery in signature schemes.