1
$\begingroup$

One more type means one-more DL, one-more DHP, etc. I find many papers do the EUF-CMA security proof in this way. Is it necessary? What is the difference between proof based on one-more type assumption and one based on non-one-more type assumption? Is the one based on one-more type assumption stronger?

$\endgroup$
  • $\begingroup$ Please note that it takes time to read, correct and answer questions on the Cryptography site. It would be wise to thoroughly review questions before posting them here, and then to keep them posted afterwards. $\endgroup$ – Maarten Bodewes Oct 19 at 9:21
1
$\begingroup$

One more type assumptions are a better fit for blind signature schemes since they fit their security model (e.g. receive valid but anonymous coins from a bank where you should not be able to spend more than you received). Indeed they are stronger when compared to other types of assumptions (eg. DLOG). However there have been proofs of security based on the dlog such as the proof of Pointcheval Stern on the Okamoto Schnorr blind signature unforgeability in https://www.di.ens.fr/david.pointcheval/Documents/Papers/2000_joc.pdf where the situation is better explained.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.