Delegatable Functional Signatures Michael Backes, Sebastian Meiser , Dominique Schröder Public Key Cryptography, March 7, 2016, Taipei
What is a malleable Signature? Alice (original signer) Alice signed this message! We introduce del egatable functi onal signatures We introduce del egatable functi onal signatures (DFS) which support the delegation of signing (DFS) which support the delegation of signing capabilities capabilities to to another another party, party, called called the the evaluator, with respect to a functionali ty F. In a evaluator, with respect to a functionali ty F. In a DFS, the signer of a message can choose an DFS, the signer of a message can choose an evaluator, specify how the evaluator can modify evaluator, specify how the evaluator can modify the signature without voiding its validity, allow the signature without voiding its validity, allow additional input, and decide how the evaluator additional input, and decide how the evaluator can can further further delegate delegate its its capabilities. capabilities. Technicall y, DFS unify several seemingl y Technicall y, DFS unify several seemingl y different different signature signature pri miti ves, pri miti ves, i ncluding i ncluding functional functional signatures signatures and and poli cy-based poli cy-based signatures (PKC '14), sanitizable signatures, signatures (PKC '14), sanitizable signatures, identity based signatures, and blind signatures. identity based signatures, and blind signatures. We characterize the instantiabil ity of DFS with We characterize the instantiabil ity of DFS with respect to the cor responding security noti ons of respect to the cor responding security noti ons of unforgeability and pri vacy. On the positi ve side unforgeability and pri vacy. On the positi ve side we show that pri vacy-fr ee D FS can be we show that pri vacy-fr ee D FS can be constructed constructed from from one- way one- way functions. functions. Further more, we show that unforgeable and Further more, we show that unforgeable and pri vate DFS can be constructed from doubl y- pri vate DFS can be constructed from doubl y- enhanced enhanced tr apdoor tr apdoor per mutations. per mutations. On On the the negative si de we show that the previ ous result negative si de we show that the previ ous result is opti mal regarding its underl ying assumptions is opti mal regarding its underl ying assumptions presenting presenting an an i mpossibility i mpossibility result result for for unforgeable unforgeable pri vate pri vate DFS DFS from from one- way one- way permutations. permutations. Alice signs a message with her secret key. Public verifiability means: a) Alice signed the message, or b) Alice signed the message and the message has been modified, s.t. … - … the resulting message still is in some relation to the signed message. - … all operations performed on the message were “valid”. Delegatable Functional Signatures – PKC 2016 – Sebastian Meiser 1
What is a malleable Signature? Alice (original signer) Alice signed… some related message..?! We introduce del egatable functi onal signatures (DFS) which support the delegation of signing capabilities to another party, called the evaluator, with respect to a functionali ty F. In a DFS, the signer of a message can choose an evaluator, specify how the evaluator can modify the signature without voiding its validity, allow additional input, and decide how the evaluator can further delegate its capabilities. Technicall y, DFS unify several seemingl y different signature pri miti ves, i ncluding functional signatures and poli cy-based signatures (PKC '14), sanitizable signatures, identity based signatures, and blind signatures. We characterize the instantiabil ity of DFS with respect to the cor responding security noti ons of unforgeability and pri vacy. On the positi ve side we show that pri vacy-fr ee D FS can be constructed from one- way functions. Alice signs a message with her secret key. Further more, we show that unforgeable and pri vate DFS can be constructed from doubl y- enhanced tr apdoor per mutations. On the negative si de we show that the previ ous result is opti mal regarding its underl ying assumptions presenting an i mpossibility result for unforgeable pri vate DFS from one- way permutations. Public verifiability means: a) Alice signed the message, or b) Alice signed the message and the message has been modified, s.t. … - … the resulting message still is in some relation to the signed message. - … all operations performed on the message were “valid”. Delegatable Functional Signatures – PKC 2016 – Sebastian Meiser 2
(Malleable) Signature Primitives Homomorphic Signatures Classical Signatures Rerandomizable Signatures Redactable Signatures Proxy Signatures Identity-based Signatures Sanitizable Signatures Blind Signatures [BGI] Functional Digital Signatures PKC’15 Policy-based Signatures [BF] Goal: Generalization and simplification of primitives and notions Delegatable Functional Signatures – PKC 2016 – Sebastian Meiser 3
Delegatable Functional Signatures Alice Bob Inc. Charlie Ltd. (original signer) (evaluator) (evaluator) Alice signed 𝑡𝑙 𝑡𝑙′ this message or allowed it! We introduce delegatable functional signatures We introduce delegatable functional signatures We introduce delegatable functional signatures 𝑛, 𝜏 (DFS) which support the delegation of signing (DFS) which support the delegation of signing (DFS) which support the delegation of signing capabilities to another party, called the evaluator, capabilities to another party, called the evaluator, capabilities to another party, called the evaluator, with respect to a functionality F. In a DFS, the with respect to a functionality F. In a DFS, the with respect to a functionality F. In a DFS, the signer of a message can choose an evaluator, signer of a message can choose an evaluator, signer of a message can choose an evaluator, specify how the evaluator can modify the specify how the evaluator can modify the specify how the evaluator can modify the signature without voiding its validity, allow signature without voiding its validity, allow signature without voiding its validity, allow additional input, and decide how the evaluator additional input, and decide how the evaluator additional input, and decide how the evaluator can further delegate its capabilities. Technically, can further delegate its capabilities. Technically, can further delegate its capabilities. Technically, DFS unify several seemingly different signature DFS unify several seemingly different signature DFS unify several seemingly different signature primitives, including functional signatures and primitives, including functional signatures and primitives, including functional signatures and policy-based signatures (PKC'14), sanitizable policy-based signatures (PKC'14), sanitizable policy-based signatures (PKC'14), sanitizable signatures, identity based signatures, and blind signatures, identity based signatures, and blind signatures, identity based signatures, and blind signatures. signatures. signatures. We characterize the instantiability of DFS with We characterize the instantiability of DFS with We characterize the instantiability of DFS with respect to the corresponding security notions of respect to the corresponding security notions of respect to the corresponding security notions of unforgeability and privacy. On the positive side unforgeability and privacy. On the positive side unforgeability and privacy. On the positive side we show that privacy-free DFS can be we show that privacy-free DFS can be we show that privacy-free DFS can be constructed constructed constructed from from from one-way one-way one-way functions. functions. functions. Furthermore, we show that unforgeable and Furthermore, we show that unforgeable and Furthermore, we show that unforgeable and private DFS can be constructed from doubly- private DFS can be constructed from doubly- private DFS can be constructed from doubly- enhanced enhanced enhanced trapdoor trapdoor trapdoor permutations. permutations. permutations. On On On the the the negative side we show that the previous result is negative side we show that the previous result is negative side we show that the previous result is optimal regarding its underlying assumptions optimal regarding its underlying assumptions optimal regarding its underlying assumptions presenting an impossibility result for unforgeable presenting an impossibility result for unforgeable presenting an impossibility result for unforgeable private DFS from one-way permutations. private DFS from one-way permutations. private DFS from one-way permutations. 𝒈′ 𝒈 𝑞𝑙 𝑞𝑙 Alice signs a message and chooses how the message can be modified by which evaluator (Bob) and decides what Bob can further delegate, if at all. Bob modifies the message/signature pair, chooses how it can be further modified and by whom (Charlie). Delegatable Functional Signatures – PKC 2016 – Sebastian Meiser 4
Recommend
More recommend
