Say I have an element $g$ of a cyclic group. Are there homomorphic signature schemes that allow deriving signatures of $g^{ax+by}$ from signatures of $g^a$ and $g^b$?

  • 1
    $\begingroup$ Such a signature scheme cannot exist for the traditional notion of unforgeability, since it would be trivial to forge new signatures. By definition, you shouldn't be able to produce a valid signature of $g^{ax+by}$ from signatures of $g^a$ and $g^b$ without the secret key. $\endgroup$
    – lamontap
    Apr 3 at 13:32
  • $\begingroup$ @lamontap Thank you for your comment. $\endgroup$
    – Adam54
    Apr 12 at 21:50
  • $\begingroup$ I seem to have misled you with my previous comment. I just realized that homomorphic signatures actually are a thing. They just adapt the unforgeability game to being unable to forge a signature for a message that is not a linear combination of previously signed messages. $\endgroup$
    – lamontap
    Apr 16 at 15:19


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.