# is the functional signature result relies on f(x) or on x where x is a message and f is a function?

I am new on cryptography and I have a question about the functional signature scheme. The notion was introduced in this paper.

In a functional signature scheme, there is a standard signature and verification key pair, as well as an algorithm to derive functional signature and verification keys, for any function f. The signature scheme allows signing any message m in the range of f.

Can anyone please tell if the resulted signature corresponds to the result of the function f over the data m or a signature of a message m corresponding by the function f?

• Hi kawtar and welcome. Could you possibly think of a more specific title? Just "functional signatures" doesn't correspond with the much more specific question in the last section of your post. – Maarten Bodewes Sep 18 '18 at 0:12

A signature $\sigma$ created by $\mathrm{FS.Sign}(f,\mathit{sk}_f, m)$ is a signature on the value $m^* = f(m)$. You can see this because the verification algorithm just takes the signature $\sigma$ and the image $m^*$ as input and hence signature validity syntactically does not depend on $f$ or $m$. You can see this in Definition 3.1.
This is not only a syntax thing, however. If the scheme fulfills the property of "function privacy" (Section 3.1), a signature on $m^*$ is required to look independent of the function and pre-image used to create it. With details omitted, the property requires the following: Given a signature on $m^* = f_0(m_0) = f_1(m_1)$, the verifier cannot tell whether the signature was created by $\mathrm{FS.Sign}(f_0,\mathit{sk}_{f_0}, m)$ or by $\mathrm{FS.Sign}(f_1,\mathit{sk}_{f_1}, m_1)$.