2
$\begingroup$

Boneh et al. [1] describe an aggregate signature scheme, which allows signature aggregation of $n$ distinct messages from $n$ distinct users into a single short signature. In their description, they quite clearly state that it is necessary that the messages are different to the ensure the security of the protocol. (They also list other counter-measures.)

However, while the abstract of the paper may suggest that also the users (i.e., the used keypairs) are different, this "requirement" does not get clear for me studying the remainder of the paper. So basically my question is if it is required that the users are different or if the scheme remains secure when, e.g., a single user (with a single keypair) produces signatures for $n$ different messages which are then aggregated.

[1] Boneh, Dan, et al. "Aggregate and verifiably encrypted signatures from bilinear maps." International conference on the theory and applications of cryptographic techniques. Springer, Berlin, Heidelberg, 2003. http://crypto.stanford.edu/~dabo/papers/aggreg.pdf

$\endgroup$

1 Answer 1

1
$\begingroup$

You have to look in details the security game defined in the paper page 6 (in particular the pararaph Response):

Finally, $\mathcal{A}$ outputs $k − 1$ additional public keys $PK_2,...,PK_k$. Here $k$ is at most $N$, a game parameter. These keys, along with the initial key PK1, will be included in $\mathcal{A}$’s forged aggregate. $\mathcal{A}$ also outputs messages $M_1,...,M_k$; and, finally, an aggregate signature $\sigma$ by the $k$ users, each on his corresponding message.

It means the adversary could generates all the key except one. Then it means one user can have access to all except one the secret keys, the scheme remains secure.

Of course, if someone has access to the $n$ secret keys, he can generate all the aggregate keys corresponding to the keys he want by correctness of the scheme.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.