I want to apply homomorphic signature instead of homomorphic encryption in Provable data possession. So I want to know about homomorphic signature and homomorphic encryption.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
closed as too broad by D.W., rath, e-sushi, figlesquidge, DrLecter Jan 16 '14 at 9:16
There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.
First start with some notation. Say we have a plaintext space $P$ which forms a group. And an encryption function which goes from the plaintext space to the ciphertext space, say $E : P\to C$.
$E$ is homomorphic if $E$ forms a group homomorphism, i.e. given $E(x)$ and $E(y)$ for $x,y\in P$ we can efficiently construct $E(x\cdot y)$ without the private key, where $\cdot$ is the group operation in $P$. That would be homomorphic encryption.
Homomorphic signatures are very close, but instead we have a signature function, $S$. Then, given two valid signatures $S(x)$ and $S(y)$, we should be able to construct a signature of $S(x\cdot y)$ efficiently without the private key.
Concerning your very broad question: Wikipedia can tell you about homomorphic signatures.
However, its application is quite specific, and I have no idea if it fits your scenario/requirements. The homomorphic property has direct consequences for the signatures: It can not achieve existential unforgeability, because this contradicts the homomorphic property (with signature $S(m)$ you can create signature $S(m+m)$, in additive notation). Furthermore, common signatures use cryptographic hash functions to reduce the size of the signature to a fixed length. For homomorphic signatures you can not do this, because the cryptographic hash function does not preserve any structure.
Additionally, the proposed scheme on the wiki page is really not practical: At first, you need to fix the input size at key generation and you need a pairing friendly group (okay, we can do that). The signing algorithm is quite fast (just normal elliptic curve operations). But the signature verification is REALLY slow since it requires $D$ pairing operations, and $D$ can be quite large (The "hash" input is a vector space with $D$ dimensions). Even though the signature itself is relatively short, the verification key is also quite large ($2D+1$ points on the elliptic curve).