I am new on cryptography and I have a question about the functional signature scheme. The notion was introduced in this paper.

In a functional signature scheme, there is a standard signature and verification key pair, as well as an algorithm to derive functional signature and verification keys, for any function f. The signature scheme allows signing any message m in the range of f.

Can anyone please tell if the resulted signature corresponds to the result of the function f over the data m or a signature of a message m corresponding by the function f?

  • $\begingroup$ Hi kawtar and welcome. Could you possibly think of a more specific title? Just "functional signatures" doesn't correspond with the much more specific question in the last section of your post. $\endgroup$ – Maarten Bodewes Sep 18 '18 at 0:12

A signature $\sigma$ created by $\mathrm{FS.Sign}(f,\mathit{sk}_f, m)$ is a signature on the value $m^* = f(m)$. You can see this because the verification algorithm just takes the signature $\sigma$ and the image $m^*$ as input and hence signature validity syntactically does not depend on $f$ or $m$. You can see this in Definition 3.1.

This is not only a syntax thing, however. If the scheme fulfills the property of "function privacy" (Section 3.1), a signature on $m^*$ is required to look independent of the function and pre-image used to create it. With details omitted, the property requires the following: Given a signature on $m^* = f_0(m_0) = f_1(m_1)$, the verifier cannot tell whether the signature was created by $\mathrm{FS.Sign}(f_0,\mathit{sk}_{f_0}, m)$ or by $\mathrm{FS.Sign}(f_1,\mathit{sk}_{f_1}, m_1)$.

I hope I understood your question correctly.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.