Digital signatures provide authenticity and nonrepudiation. They are a standard cryptographic primitive with many applications in higher-level protocols. Groups featuring a computable bilinear map are particularly well suited for signature-related primitives. For some signature variants the only construction known uses bilinear maps. Where constructions based on, e.g., RSA are known, bilinear-map-based constructions are simpler, more efficient, and yield shorter signatures. We describe several constructions that support this claim.
First, we present the Boneh-Lynn-Shacham (BLS) short signature scheme. BLS signatures with 1024-bit security are 160 bits long, the shortest of any scheme based on standard assumptions. Second, we present Boneh-Gentry-Lynn-Shacham (BGLS) aggregate signatures. In an aggregate signature scheme it is possible to combine n signatures on n distinct messages from n distinct users into a single aggregate that provides nonrepudiation for all of them. BGLS aggregates are 160 bits long, regardless of how many signatures are aggregated. No construction is known for aggregate signatures that does not employ bilinear maps. BGLS aggregates give rise to verifiably encrypted signatures, a signature variant with applications in contract signing.
Third, we present Boneh-Boyen-Shacham (BBS) group signatures. Group signatures provide anonymity for signers. Any member of the group can sign messages, but the resulting signature keeps the signer's identity secret. Only the group manager can trace the signature, undoing its anonymity, using a special trapdoor. BBS group signatures are 1443 bits long, shorter than any previous scheme by an order of magnitude. The signing operation is also an order of magnitude more efficient than in previous schemes.
Finally, we consider variants and extensions of the BBS group signature scheme, including a group signature with a novel revocation mechanism that we call verifier-local revocation (VLR). In a VLR group signature, messages announcing the revocation of some users need only be processed by the verifiers; the signers are stateless. We present the Boneh-Shacham VLR group signature scheme, which has signatures even shorter than in BBS.
Cited By
- Bichsel P, Camenisch J, Neven G, Smart N and Warinschi B Get shorty via group signatures without encryption Proceedings of the 7th international conference on Security and cryptography for networks, (381-398)
- Chatterjee S, Hankerson D and Menezes A On the efficiency and security of pairing-based protocols in the type 1 and type 4 settings Proceedings of the Third international conference on Arithmetic of finite fields, (114-134)
- Katz J and Lindell A Aggregate message authentication codes Proceedings of the 2008 The Cryptopgraphers' Track at the RSA conference on Topics in cryptology, (155-169)
- Bellare M, Namprempre C and Neven G Unrestricted aggregate signatures Proceedings of the 34th international conference on Automata, Languages and Programming, (411-422)
Index Terms
- New paradigms in signature schemes
Recommendations
New convertible undeniable signature schemes
EUROCRYPT'96: Proceedings of the 15th annual international conference on Theory and application of cryptographic techniquesUndeniable signatures are like ordinary digital signatures, except that testing validity of a signature requires interaction with the signer. This gives the signer additional control over who will benefit from being convinced by a signature, and is ...
Identity-based strong designated verifier signature schemes: Attacks and new construction
A strong designated verifier signature scheme makes it possible for a signer to convince a designated verifier that she has signed a message in such a way that the designated verifier cannot transfer the signature to a third party, and no third party ...
New multi-proxy multi-signature schemes
A new kind of proxy signature schemes is first proposed: multi-proxy multi-signature schemes. In multi-proxy multi-signature schemes, an original group of signers can authorize a group of proxy signers under the agreement of all singers both in the ...