标准模型下的新的基于身份的短签名方案New identity-based short signature without random oracles

Procedia Engineering 15 (2011) 3445 – 34491877-7058 © 2011 Published by Elsevier Ltd.doi:10.1016/j.proeng.2011.08.645Available online at vailable online at Procedia EngineeringProcedia Engineering 00 (2011) 000–000 /locate/procediaOpen access under CC BY -NC-ND license.3446 Leyou Zhang et al. / Procedia Engineering 15 (2011) 3445 – 3449that it would be more efficient if there was no need for such a binding [6]. It is called identity-based cryptography. Identity-based encryption (IBE) was introduced firstly in [6]. The first identity-based signature(IBS) scheme was proposed by Shamir[6], but the size of generated signature is quite large, which has 2048 bits when one utilizes a 1024-bit RSA modulus. Guillou and Quisquater [7] improved Shamir’s scheme and shortened the signature size to 1184 bits when one uses 1024-bit RSA modulus and 160-bit hash function. Boneh and Franklin [8] founded that bilinear pairings on elliptic curves could be used to make ID-based encryption scheme possible and practical. Now, many IBS schemes [10-16] are proposed based on bilinear pairings. These signatures generated by [10-16] are much shorter and simpler than signatures from schemes in [7,9], which achieve approximately 320-bit size. However, these schemes are provable secure in the random oracles model. Many results have shown that security in the random oracle model does not imply the security in the real world. Security in the standard model usually provides a higher security level than security in the random oracle model. The well known construction of IBS in the standard model was proposed in [17]. It is based on the Waters’s scheme[18]. So the public keys size is much larger than the previous schemes. In addition, the size of the proposed scheme achieves 480 bits. Our Contributions A natural extension of the efforts is to provide a more efficient scheme. We propose a new scheme in this paper. Our scheme contains some desirable features over the previous works, such as constructed in standard model and short public keys and private keys. In addition, The size of signature achieves 320 bits, which is more efficient than the existing schemes. Under the n -CDH assumption, our scheme is provably secure against selective-identity and message attack. 2.Preliminaries2.1. Hardness AssumptionDefinition 1 (n -Exponent Computational Diffie-Hellman Problem) Given a groupG of prime order p with generator g and elements g α,2g α,L ,ng αG ∈, where is selected uniformly at random from αp Z and n ≥ 1, the n -CDH problem in G is to compute 1n g α+.Definition 2 We say that the (t ,)n -CDH assumption holds in a group G , if no adversary running in time at most t can solve the n -CDH problem in G with probability at least .εε2.2. Security DefinitionAn IBS scheme is secure if it satisfies two requirements, Correctness and Existential Unforgeability.The standard notion of security for a signature scheme is called existential unforgeability under a chosen message attack [12-17], which is defined using the following game between a challenger and an adversary A:Inti : The adversary first outputs the challenge identity .***1(,,)n ID v v = Setup The challenger runs algorithm KeyGen to obtain a public key PK and a private key SK . The adversary A is given PK .Queries Proceeding adaptively, A requests signatures on at most s q messages of his choice 1M ,L ,s q M ∈ {0, 1}, under PK. The challenger responds to each query with a signature .(,Sign M σ=)SK i i Forgery A outputs a pair (M ,) and wins the game if (1) M is not any of (σ1M , ,s q M ); (2)Verify (PK ,M ,)=Valid .σDefinition 3 A signature scheme is (t ,) existentially unforgeable under a weak adaptive chosen message attack if no probabilistic polynomial time(running in time at most t ) adversary has a non-negligible advantage in the above game. εε3. Our new construction3447 Leyou Zhang et al. / Procedia Engineering 15 (2011) 3445 – 34493448Leyou Zhang et al. / Procedia Engineering 15 (2011) 3445 – 34493449Leyou Zhang et al. / Procedia Engineering 15 (2011) 3445 – 3449AcknowledgmentThis work is partially supported by the Nature Science Foundation of China under grant (60970119, 60803149), the National Basic Research Program of China(973) under grant 2007CB311201 and the Fundamental Research Funds for the Central Universities of China.References[1] Bellare M., Neven G.. Multi-signatures in the plain public-key model and a general forking lemma. In proceedings of the13th ACM Conference on Computer and Communication Security, 2006, pp. 390-398.[2] Barr K., Asanovic K.. Energy aware lossless data compression. ACM Transactions on Computer Systems, 2006, 24(3): 250-291.[3] Tso R., Gu C., Okamoto T. and Okamoto E.. Efficient ID-based digital signatures with message recovery. In proceedings ofthe 6th international conference on cryptology and network security (CANS 2007), LNCS 4586, 2007, pp.47-59.[4] Zhang F., Susilo W., and Mu Y.. Identity-based partial message recovery signatures (or How to shorten ID-based signatures).In proceedings of FC’05, LNCS 3570, 2005, pp.45-56.[5] Boneh D., Lynn B. and Shacham H.. Short signatures from the Weil pairing. In proceedings of Advances in cryptology –CRYPTO’01, LNCS 2248, 2001, 514-532.[6] Shamir A. . Identity-based Cryptosystems and Signature Schemes. In proceedings of Advances in Cryptology-CRYPTO,LNCS 196,1984, pp. 47-53.[7] Guillou L.C. and Quisquater J.J., A‘paradoxical’ identitybased signature scheme resulting from zero-knowledge. In proceedings of Crypto’88, LNCS 403, 1988, pp. 216-231.[8] Boneh D., Franklin M.. Identity Based Encryption from the Weil Pairing. In proceedings of Advances in Cryptology-CRYPTO, LNCS 2139, 2001, pp. 213-229.[9] Gentry C.. Practical identity-based encryption without random oracles. In proceedings of Advances in Cryptology-EUROCRYPT, LNCS 4404, 2006, pp. 445-464.[10] Cha J.C. and Cheon J.H., An identity-based signature from gap diffie-hellman groups, Cryptology ePrint Archive,Report2002/018, 2002.[11] Hess F., Efficient identity based signature schemes based on pairings, In Proceedings of 9th workshop on selected areas in Cryptography - SAC 2002, LNCS 2595, 2002, pp. 310-324.[12] Paterson K.G., Id-based signatures from pairings on elliptic curves, Cryptology ePrint Archive, Report 2002/004, 2002.[13] Smart N.P., An identity based authenticated key agreement protocol based on the weil pairing, Electronic Letters, 38(13),2002, pp.630–632.[14] Yi X, An Identity-Based Signature Scheme from the Weil Pairing, IEEE Communications Letters, Vol. 7(2), 2003, pp. 76-78.[15] Cha J.C. and Cheon J.H., An identity-based signature from gap Diffie-Hellman groups. In proceedings of PKC 2003,LNCS 2567, 2003, pp. 18-30.[16] X. G Cheng, J. M Liu, and X.M Wang, Identity-based aggregate and verifiably encrypted signatures from bilinear pairing,In proceedings of ICCSA 2005, LNCS 3483, 2005, pp. 1046-1054[17] Paterson K. G., Schuldt J. C. N.. Efficient identity-based signatures secure in the standard. In proceedings of ACISP 2006,LNCS 4058, 2006, pp. 207-222.[18] Waters B.. Efficient identity-based encryption without random oracles. In proceedings of EUROCRYPT 2005, LNCS 3494,2005, pp. 114-127.。