Sequential Aggregate Signature Scheme Research Articles

Code-based Sequential Aggregate Signature Scheme

This paper proposes the first code-based quantum immune sequential aggregate signature (SAS) scheme and proves the security of the proposed scheme in the random oracle model. Aggregate signature (AS) schemes and sequential aggregate signature schemes allow a group of potential signers to sign different messages respectively, and all the signatures of those users on those messages can be aggregated into a single signature such that the size of the aggregate signature is much smaller than the total size of all individual signatures. Because of the aggregation of many signatures into a single short signature, AS and SAS schemes can reduce bandwidth and save storage; moreover, when a SAS is verified, not only the valid but also the order in which each signer signed can be verified. AS and SAS schemes can be applied to traffic control, banking transaction and military applications. Most of the existing AS and SAS schemes are based either on pairing or Rivest–Shamir–Adleman (RSA), and hence, can be broken by Shor’s quantum algorithm for Integer Factoring Problem (IFP) and Discrete Logarithm Problem (DLP). There are no quantum algorithms to solve syndrome decoding problems. Hence, code-based cryptography is seen as one of the promising candidates for post-quantum cryptography. This paper shows how to construct quantum immune sequential aggregate signatures based on coding theory. Specifically, we construct our scheme with the first code based signature scheme proposed by Courtois, Finiasz and Sendrier (CFS). Compared to the CFS signature scheme without aggregation, the proposed sequential aggregate signature scheme can save about 90% storage when the number of signers is asymptotically large.

Atomic cross-chain settlement model for central banks digital currency

Current securities settlement systems employ various strategies to manage risks in settlement effectively. However, exchanging and verifying information between the market participants and intermediaries is time consuming.In addition, the back office and coordination costs are very high. To address such challenges, blockchain technology has attracted the attention of researchers due to its potential as a new settlement system. In this study, we propose a blockchain-based settlement system using cross-chain atomic swaps that can be implemented for the central banks digital currency (CBDC). The proposed model adds an administrator ledger to the system to remove settlement failure and improve efficiency in market management. Along with our settlement system, we also propose a new lattice-based sequential aggregate signature scheme generally known for its advantage on resisting future quantum attacks. Proof-of-concept experiments with the proposed system were conducted to analyze the effect of numerous variables in the blockchain ecosystem on the settlement system.

Extraction Security of Sequential Aggregate Signatures

Aggregate signature schemes enable anyone to compress many signatures into one. Besides the unforgeability of aggregate signature, another property called aggregate extraction sometimes is useful. In sequential aggregate signature schemes, the aggregate signature is computed incrementally by the signers. We introduce extraction security in the sequential context which can be seen as an analogy of aggregate extraction introduced by Boneh et al. in CRYPTO 2003. In addition to the practical meaning, it also has benefits in the construction of hierarchical identity-based signatures as we will point out. We study several well known aggregate signature schemes and prove some of them satisfy extraction security.

A unified framework of identity-based sequential aggregate signatures from 2-level HIBE schemes

Identity-based sequential aggregate signature (IBSAS for short) schemes, introduced by Boldyreva et al. [CCS 2007], allow a large quantity of signers to generate one signature sequentially, in which these messages as well as their order can be attested by employing their identities. In such a scheme, storage space and bandwidth overhead can be reduced. To our best knowledge, though many concrete IBSAS schemes have been constructed in literature, none of them is constructed under a standard computational hardness assumption and unforgeable under the standard model. The problem of how to construct such schemes is still open. Latterly, Gentry et al. [PKC 2018] proposed a unified construction of SAS (i.e., abbreviated form of sequential aggregate signature) schemes by employing trapdoor permutation and ideal ciphers. Motivated by the above problem and hints, here we study how to construct IBSAS schemes in a new unified perspective. By employing 2-level HIBE (i.e., abbreviated form of hierarchical identity-based encryption) schemes, we present unified construction of IBSAS schemes and give a rigorous proof of their unforgeability. The unified construction is then instantiated to get a concrete IBSAS scheme, which has existential unforgeability under the standard model using a standard computational hardness assumption (i.e., the CDH assumption). An extra fruit is that it can be used to construct an existentially unforgeable IBSAS scheme using the Learning with Errors problem, which is constructed under a lattice hardness assumption for the first time. In the end, we show a detailed performance comparison among our schemes and previous ones.

Data Storage Mechanism Based on Blockchain with Privacy Protection in Wireless Body Area Network.

Wireless body area networks (WBANs) are expected to play a vital role in the field of patient-health monitoring shortly. They provide a convenient way to collect patient data, but they also bring serious problems which are mainly reflected in the safe storage of the collected data. The privacy and security of data storage in WBAN devices cannot meet the needs of WBAN users. Therefore, this paper adopts blockchain technology to store data, which improves the security of the collected data. Moreover, a storage model based on blockchain in WBAN is proposed in our solution. However, blockchain storage brings new problems, for example, that the storage space of blockchain is small, and the stored content is open to unauthorized attackers. To solve the problems above, this paper proposed a sequential aggregate signature scheme with a designated verifier (DVSSA) to ensure that the user’s data can only be viewed by the designated person and to protect the privacy of the users of WBAN. In addition, the new signature scheme can also compress the size of the blockchain storage space.

Certificateless Sequential Aggregate Signature Scheme on NTRU Lattice

Having the advantages of certificateless signature and the aggregate signature at the same time, certificateless aggregate signature has been widely applied in e-business, e-government and software security since it was proposed in 2007. Although a number of certificateless aggregate signature schemes have been proposed, all of them are based on the classic number theory problem, which are no longer secure in the quantum era. In this paper, a certificateless sequential aggregate signature over number theory research unit lattice is proposed, which is proven to be secure in random oracle model. Moreover, we extend the new scheme into an efficient certificatebased sequential aggregate signature which is also secure in quantum era.

FAS: Forward secure sequential aggregate signatures for secure logging

Audit logs are an elemental part of computer systems due to their forensic value. Safeguarding audit logs on a physically unprotected machine are a challenging work, especially in the presence of active adversaries. Forward security is necessary for such a logging system. In this paper, we propose a new Forward secure sequential Aggregate Signature (FAS) scheme with optimal storage and communication for keys and signatures. To the best of our knowledge, our FAS scheme is the only scheme that has constant-sized public and secret keys as well as constant-sized aggregate signatures. Our proposed scheme supports aggregation of consecutive signatures by a third party. We prove the security of our proposed scheme under the hardness of factoring assumption, in the random oracle model.

Lattice-based sequential aggregate signatures with lazy verification

This paper proposes the first lattice-based sequential aggregate signature (SAS) scheme with lazy verification that is provably secure in the random oracle model. As opposed to large integer factoring and discrete logarithm based systems, the security of the construction relies on worst-case lattice problem, namely, under the small integer solution (SIS) assumption. Generally speaking, SAS schemes enable any group of signers ordered in a chain to sequentially combine their signatures such that the size of the aggregate signature is much smaller than the total size of all individual signatures. Unlike prior such proposals, the new scheme does not require a signer to retrieve the keys of other signers and verify the aggregate-so-far before adding its own signature, and the signer can add its own signature to an unverified aggregate and forward it along immediately, postponing verification until load permits or the necessary public keys are obtained. Indeed, the new scheme does not even require a signer to know the public keys of other signers.

Sequential Aggregate Signatures and Multisignatures in the Plain Public Key Model

At Eurocrypt’06, Lu et al. presented the first Sequential aggregate signature (SAS) provably secure without random oracles. The draw back of their scheme is that users need long public keys and the security model makes the Knowledge of secure key (KOSK) assumption. We present the first SAS scheme, which the user needs short public keys and the security is proven without random oracles, in the plain public key model. We also present the first Multisignature (MS) scheme in the plain public key model, which the security is proven without random oracles.

Sequential aggregate signatures with short public keys without random oracles

The notion of aggregate signature has been motivated by applications and it enables any user to compress different signatures signed by different signers on different messages into a short signature. Sequential aggregate signature, in turn, is a special kind of aggregate signature that only allows a signer to add his signature into an aggregate signature in sequential order. This latter scheme has applications in diversified settings such as in reducing bandwidth of certificate chains and in secure routing protocols. Lu, Ostrovsky, Sahai, Shacham, and Waters (EUROCRYPT 2006) presented the first sequential aggregate signature scheme in the standard model. The size of their public key, however, is quite large (i.e., the number of group elements is proportional to the security parameter), and therefore, they suggested as an open problem the construction of such a scheme with short keys.In this paper, we propose the first sequential aggregate signature schemes with short public keys (i.e., a constant number of group elements) in prime order (asymmetric) bilinear groups that are secure under static assumptions in the standard model. Furthermore, our schemes employ a constant number of pairing operations per message signing and message verification operation. Technically, we start with a public-key signature scheme based on the recent dual system encryption technique of Lewko and Waters (TCC 2010). This technique cannot directly provide an aggregate signature scheme since, as we observed, additional elements should be published in a public key to support aggregation. Thus, our constructions are careful augmentation techniques for the dual system technique to allow it to support sequential aggregate signature schemes. We also propose a multi-signature scheme with short public parameters in the standard model.

Sequential aggregate signatures with lazy verification from trapdoor permutations

Sequential aggregate signature schemes allow n signers, in order, to sign a message each, at a lower total cost than the cost of n individual signatures. We present a sequential aggregate signature scheme based on trapdoor permutations (e.g., RSA). Unlike prior such proposals, our scheme does not require a signer to retrieve the keys of other signers and verify the aggregate-so-far before adding its own signature. Indeed, we do not even require a signer to know the public keys of other signers!Moreover, for applications that require signers to verify the aggregate anyway, our schemes support lazy verification: a signer can add its own signature to an unverified aggregate and forward it along immediately, postponing verification until load permits or the necessary public keys are obtained. This is especially important for applications where signers must access a large, secure, and current cache of public keys in order to verify messages. The price we pay is that our signature grows slightly with the number of signers.We report a technical analysis of our scheme (which is provably secure in the random oracle model), a detailed implementation-level specification, and implementation results based on RSA and OpenSSL. To evaluate the performance of our scheme, we focus on the target application of BGPsec (formerly known as Secure BGP), a protocol designed for securing the global Internet routing system. There is a particular need for lazy verification with BGPsec, since it is run on routers that must process signatures extremely quickly, while being able to access tens of thousands of public keys. We compare our scheme to the algorithms currently proposed for use in BGPsec, and find that our signatures are considerably shorter than nonaggregate RSA (with the same sign and verify times) and have an order of magnitude faster verification than nonaggregate ECDSA, although ECDSA has shorter signatures when the number of signers is small.

Efficient attribute based sequential aggregate signature for wireless sensor networks

Wireless sensor networks (WSNs) are broadly applied in real scenarios, such as remote environmental monitoring and target tracking. However, data can be easily compromised by the adversary. Although attribute based signature (ABS) scheme is an important cryptographic primitive which provides a powerful way for users to control their privacy. When the number of users involved in the system becomes huge, the computational and storage overhead will grow large so that existing ABS schemes are insufficient for WSNs. In order to reduce the communication and computational cost of ABS to make it more suitable for WSNs, we propose an efficient attribute based sequential aggregate signature (EABSAS) scheme which allows a set of sensor nodes to sign on different messages, combine and compress them into a short signature which can greatly decrease the storage space. Through extensive analysis, we demonstrate that our EABSAS scheme can achieve the existential unforgeability to keep the data integrity, and significantly reduces computation and communication overhead than existing competing approaches.

ID-Based Sequential Aggregate Signatures

An aggregate signature provides a method for combining n signatures of n different messages from n different signers into one signature of unit length. The main benefit of such schemes is that they allow bandwidth and computational savings. There exist several trials for the construction of ID-based aggregate signature schemes so far. Unfortunately, the computational complexity and (or) signature length of these schemes grow linearly with the number of signers. This paper focuses on the solution of these problems and proposes a new ID-based sequential aggregate signature scheme based on IB-mRSA. It is compatible with RSA and has the fixed signature length. The security analysis shows that it is secure in the random oracle model with the assumption of classical RSA.

New Multiparty Signature Schemes for Network Routing Applications

We construct two new multiparty digital signature schemes that allow multiple signers to sequentially and non-interactively produce a compact, fixed-length signature. First, we introduce a new primitive that we call ordered multisignature (OMS) scheme, which allows signers to attest to a common message as well as the order in which they signed. Our OMS construction substantially improves computational efficiency and scalability over any existing scheme with suitable functionality. Second, we design a new identity-based sequential aggregate signature scheme, where signers can attest to different messages and signature verification does not require knowledge of traditional public keys. The latter property permits savings on bandwidth and storage as compared to public-key solutions. In contrast to the only prior scheme to provide this functionality, ours offers improved security that does not rely on synchronized clocks or a trusted first signer. We provide formal security definitions and support the proposed schemes with security proofs under appropriate computational assumptions. We focus on applications of our schemes to secure network routing, but we believe that they will find other applications as well.