3
$\begingroup$

I realise there are homomorphic signatures for short messages, for instance with RSA encryption we have a signature scheme where $S(m_1 m_2) = S(m_1)S(m_2)$.

I would like to know if there's a signature scheme where the messages may be linear additive combinations of the basis vectors $(v_1, \dots, v_n)$ and where, if $v$ is in the subspace spanned by the basis vectors $(v_1, \dots, v_m)$ and the signatures $S(v_1), \dots, S(v_m)$ are known, it is possible to construct $S(v)$ from them.

$\endgroup$
3
  • 1
    $\begingroup$ What security properties do you want these signatures to satisfy? Because the usual unforgeability property is pretty trivially broken if the attacker knows the signatures for the basis vectors. $\endgroup$ Feb 28, 2018 at 1:35
  • $\begingroup$ Also, I edited your question to format the math symbols better and to (hopefully) clarify the phrasing. Could you please check to see that I haven't introduced any mistakes while doing so? If you find any, feel free to fix them and/or to revert my edits. Thanks! $\endgroup$ Feb 28, 2018 at 1:43
  • 1
    $\begingroup$ An attacker should be able to create any signature from the subspace, but no others- thanks!. $\endgroup$ Feb 28, 2018 at 3:01

1 Answer 1

2
$\begingroup$

The following papers constructs linearly homomorphic signature schemes.

Pairing based signatures:

Lattice-based signatures:

$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.