5
$\begingroup$

I'm actually searching some particular primitive compatible with Groth-Sahai commitment.

I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{SigCom}$ such that it takes as input the commitment key $\mathtt{ck}$ , the signing key $\mathtt{sk}$ and a commitment $\mathtt{c}$ and outputs a committed signature $\mathtt{c}_\sigma$ with a (Groth-Sahai) proof $\pi$ that certifies the signature committed is the signature of the value (in the commitment of the input).

I've found this article. It does exactly what I want except that the value are on a precise type $\left(G^m, H^m\right)$, and it's too restrictive for me.

If you know a more general result (or something that fit with two group elements without any relation between them), it would be good for me.

Improve this question
$\endgroup$
11
  • $\begingroup$ see this paper aswell: link.springer.com/chapter/10.1007/978-3-642-14623-7_12 It has the same message space so it might still be too restrictive though. Maybe you could clarify your restrictions? $\endgroup$
    – joakimb
    Jun 19, 2021 at 7:51
  • $\begingroup$ I would like to have something very general which can consider each vector of group elements as message. $\endgroup$
    – Ievgeni
    Jun 29, 2021 at 9:23
  • $\begingroup$ Without having studied the details of the paper I linked, it does not seem that any party actually has to know neither $m$ nor $H^m$, which should then satisfy your requirements. Also, the authors state that the scheme can be instantiated for $G_1 = G_2$, which seems in line with your general setting. $\endgroup$
    – joakimb
    Jun 30, 2021 at 9:05
  • $\begingroup$ $H$ is fixed, then only few vectors can be signed. For example $(G, H^2)$ can't be signed. $\endgroup$
    – Ievgeni
    Jun 30, 2021 at 9:07
  • $\begingroup$ you are not actually signing $H^m$ in section 4 of the linked paper, the value only exists. But instead, have a look at section 5 of the linked paper. It proposes a scheme for signing vectors of group elements, which seems to be what you need $\endgroup$
    – joakimb
    Jun 30, 2021 at 9:15

1 Answer 1

Reset to default
0
$\begingroup$

The paper Structure-Preserving Signatures and Commitments to Group Elements presents a commitment scheme for committing to (vectors of) group elements, and a signature scheme which outputs signatures (on vectors of group elements) as group elements. Composing these two should be straightforward for your needs.

Improve this answer
$\endgroup$
1
  • $\begingroup$ No, because, Sigcom takes as input a commitment, then it's not a simple composition. $\endgroup$
    – Ievgeni
    Jul 1, 2021 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.