Verifiably Encrypted Signatures Research Articles

Verifiably encrypted signatures with short keys based on the decisional linear problem and obfuscation for encrypted VES

Verifiably encrypted signatures (VES) are encrypted signatures under a public key of a trusted third party. We can verify their validity without decryption. VES has useful applications such as online contract signing and optimistic fair exchange. We propose a VES scheme that is secure under the decisional linear (DLIN) assumption in the standard model. We also propose new obfuscators for encrypted signatures (ES) and encrypted VES (EVES) that are secure under the DLIN assumption. All previous VES schemes in the standard model are either secure under standard assumptions (such as the computational Diffie–Hellman assumption) with large verification (or secret) keys or secure under non-standard dynamic $$q$$ -type assumptions (such as the $$q$$ -strong Diffie–Hellman extraction assumption) with short verification keys. Our scheme is the first VES scheme with short verification (and secret) keys secure under the DLIN assumption (standard assumption). We construct new obfuscators for ES/EVES as byproducts of our new VES scheme. They are more efficient than previous obfuscators with respect to public key size. Previous obfuscators for EVES are secure under non-standard assumption and use zero-knowledge (ZK) proof systems and Fiat–Shamir heuristics to obtain non-interactive ZK, i.e., its security is considered in the random oracle model. Thus, our scheme also has an advantage with respect to assumptions and the security model. Our new obfuscator for ES is obtained from our new obfuscator for EVES.

Sequential Aggregate Signatures, Multisignatures, and Verifiably Encrypted Signatures Without Random Oracles

We present the first aggregate signature, the first multisignature, and the first verifiably encrypted signature provably secure without random oracles. Our constructions derive from a novel application of a recent signature scheme due to Waters. Signatures in our aggregate signature scheme are sequentially constructed, but knowledge of the order in which messages were signed is not necessary for verification. The aggregate signatures obtained are shorter than Lysyanskaya et al.'s sequential aggregates and can be verified more efficiently than Boneh et al.'s aggregates. We also consider applications to secure routing and proxy signatures.

New Types of Verifiably Encrypted Signature Schemes

A verifiably encrypted signature scheme involves a signer, a verifier, and an adjudicator. It can convince a verifier that a given ciphertext is an encryption of signature on a given message. At a later stage on agreed or in case of dispute, the adjudicator can extract and give the signer's signature to the verifier. In existing verifiably encrypted signatures, the adjudicator is assumed to be a trusted third party who will not conspire with either of the two parties involved. Obviously, this assumption is naive. In this paper, we propose two new types of verifiably encrypted signature schemes. They can resolve the problem that the adjudicator may collaborate with the verifier. We also analyze the security of the proposed schemes.