# Tag Info

6

Look at group signatures (but use one of the more modern schemes; they are proven secure). The signature can be applied to a running counter, or a random challenge. Group signatures also give you a lot of "management" options which can be useful depending on the application. If you don't need them, then you can use ring signatures (but the verifier has to ...

4

The outputs must exhibit additive homomorphism such that some operation on $f(a)$ and $f(b)$ will equal $f(a+b)$. Because $f$ is mandated to be nondeterministic, I assume that the requirement be that $f(a) \odot f(b)$ be some possible output $f(a+b)$ (for some computable operation $\odot$). If so, there must be some further requirement; here's one $f$ ...

4

The function $f$ is part of the input to $\mathsf{Verify}$, because the goal of homomorphic signatures is to compute authenticated functions on signed messages. In particular, given a message $z$ and a signature $\sigma_z$, we want to not only verify that $\sigma_z$ is a valid signature for $z$, but moreover that $z$ is the output of some function $f$ ...

3

Concerning your very broad question: Wikipedia can tell you about homomorphic signatures. However, its application is quite specific, and I have no idea if it fits your scenario/requirements. The homomorphic property has direct consequences for the signatures: It can not achieve existential unforgeability, because this contradicts the homomorphic property (...

2

There are some possible advantages to threshold signing. First, it enables a more flexible setting where the key can be divided into $n$ parts and any subset of $t$ can be used to sign. Second, you can go from holding a single key in one place to distributing it and back without making any changes. Third, you can achieve a type of proactive security by ...

2

There are two major families of signature schemes that bear some resemblance what you described. Code-based signatures: Courtois–Finiasz–Sendrier, or CFS The CFS family of signature schemes is based on code-based cryptography first introduced by Robert McEliece in 1978 and dualized by Niederreiter. We work with binary linear codes, of length $n$ and rank $... 2 First start with some notation. Say we have a plaintext space$P$which forms a group. And an encryption function which goes from the plaintext space to the ciphertext space, say$E : P\to C$.$E$is homomorphic if$E$forms a group homomorphism, i.e. given$E(x)$and$E(y)$for$x,y\in P$we can efficiently construct$E(x\cdot y)$without the private key, ... 1 Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. (M,s′), that validates with Alice's public key? That would be troubling if Bob could sign anything verifiable by Alice's key (on behalf Alice). if there is a simpler and more efficient method available if there is only one signer. I am mainly ... 1 If I understand you correctly, you want that given$\mathit{pk}, \mathit{pk}'$, one can publicly decide whether or not$\mathit{sk} < \mathit{sk}'$(lexicographically) for the corresponding secret keys. Such a signature scheme would inherently be insecure. This is because given your public key$\mathit{pk}^*$, anyone would be able to run a binary ... 1 Let me try to rephrase your question in a way for which I might have an answer: Is there a way for Alice to give Bob a "limited signing key" (LSK) such that: Bob can freely generate up to$n\$ keys (or other messages) and sign them using the LSK issued by Alice; anyone can verify that these keys/messages were signed by an LSK that was issued by ...

1

Anybody can run any of the usual generators for asymmetric primitives as many times as they want. And they can do this without compromising the security of the private key. Generally the trust of a key pair by a user is however not in the private key, but in the public key or certificate around the public key. Now you could embed a signed token in the ...

Only top voted, non community-wiki answers of a minimum length are eligible