# Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder

1. why it's rare to be seen?
2. what aspect is it mainly used?
3. what's the difference between implicit signature and explicit signature?

P.S. I want a detailed answer, better give some examples of implicit signatures

-
What exactly do you mean by an implicit signature? I couldn't find a good definition. –  CodesInChaos Dec 15 '13 at 14:32
oh, I happen to see this notes in here (in paragraph 3 of section 5.2 ) –  T.B Dec 15 '13 at 15:15

Actually, I never heard of the notation of an implicit signature before. However, when looking at MQV, there is a quantity which is denoted as an implicit signature, which is nicely described here:

The MQV elliptic curve key agreement method is used to establish a shared secret between parties who already possess trusted copies of each other’s static public keys. Both parties still generate dynamic public and private keys and then exchange public keys. However, upon receipt of the other party’s public key, each party calculates a quantity called an implicit signature using its own private key and the other party’s public key. The shared secret is then generated from the implicit signature. The term implicit signature is used to indicate that the shared secrets do not agree if the other party’s public key is not employed, thus giving implicit verification that the public secret is generated by the public party.

Nevertheless, this only seems to be a terminology in context of MQV and not a common concept.

Edit (a more general justification of the wording)

A generic way to realize an authenticated key exchange (AKE) from Diffie-Hellman is to execute a Diffie-Hellman key exchange and to sign all the communication sent between the parties, i.e., party Alice and Bob own a key pair of some secure digital signature scheme each (where the authentic public verification key is known to the other party) and every party signs each sent message using its private signing key. Such an AKE protocol is sometimes also referred to as Signed Diffie-Hellman. I assume that this sometimes may also be referred to a as explicit signature, since every party computes explicit signatures for the messages and the construction is generic, i.e., every secure digital signature scheme such as ECDSA may be used.

MQV also assumes the possession of trusted copies of the other parties static public key ($A$ of Alice and $B$ of Bob in the referenced link). The respective secrets $a$ and $b$ are used in steps $3$ and $4$ (in the link) and the respective quantities $S_a$ and $S_b$ seem to be denoted as implicit signature sometimes, since they are no explicit digital signature schemes involved, but messages $3$ and $4$ achieve the same goal. Namely, the messages $3$ and $4$ prove to party Bob and Alice respectively, that the respective secret ($a$ and $b$) corresponding to the authentic public key is known to the sender of message $3$ and $4$ respectively.

-
you mean that there is no definition of implicit signature, it's just a saying the author give? –  T.B Dec 16 '13 at 9:33
@Alex yes, it seems to me that this is just "wording" used by the authors. –  DrLecter Dec 16 '13 at 9:35
@Alex I edited the answer to add some more justification for the use of the wording, i.e., explicit vs. implicit signatures. –  DrLecter Dec 31 '13 at 9:26
Thanks, it's more complete than before. –  T.B Dec 31 '13 at 10:24