I'm trying to understand the following signature scheme (Camenisch-Lysanskaya):
Key generation: $n = pq$ special RSA modulus, $a, b, c \in QR_n$. $PK = (n, a, b, c), SK = p$.
Signing algorithm:
- $m$ message.
- $e$ random prime number (with some for this question unimportant length restriction).
- $s$ random number with very big length (unimportant for my question).
- Compute $v^e \equiv a^m b^s c \bmod n$. Output $(e,s,v)$.
Verification algorithm: Check that $v^e \equiv a^m b^s c \bmod n$ and check the length restriction of $e$.
I don't see why this is a valid signing algorithm. The secret key is not used for signing (or calculating $e$ or $s$). So everyone could make a signature like this and not just the one who created the public key.
Edit: If I understand it right, it's all about the hard computation of a $v$ and $e$ if you just have $a^m b^s c$. But how does it help there to know the factorization of $n$?