On Designated Verifier Signature Schemes.

Full text

Page 1

On Designated Verifier Signature Schemes
Michal Rjaˇ sko and Martin Stanek
Department of Computer Science
Faculty of Mathematics, Physics and Informatics
Comenius University
Mlynsk´ a dolina, 842 48 Bratislava, Slovak Republic
{rjasko,stanek}@dcs.fmph.uniba.sk
Abstract. Designated verifier signature schemes allow a signer to convince only the designated
verifier that a signed message is authentic. We define attack models on the unforgeability property
of such schemes and analyze relationships among the models. We show that the no-message
model, where an adversary is given only public keys, is equivalent to the model, where an
adversary has also oracle access to the verification algorithm. We also show a separation between
the no-message model and the chosen-message model, where an adversary has access to the
signing algorithm. Furthermore, we present a modification of the Yang-Liao designated verifier
signature scheme and prove its security. The security of the modified scheme is based on the
computational Diffie-Hellman problem, while the original scheme requires strong Diffie-Hellman
assumption.
1Introduction
Standard digital signature schemes allow a signer to sign messages, so that everyone can verify
the authenticity of the messages. In addition, digital signature schemes have a non-repudiation
property, which guarantees that a signer cannot lie about messages he has signed. However,
sometimes the non-repudiation property is not needed in practice. Moreover there are cases
where this property is undesired. For example the signer should not present signatures to other
parties when signing personal health records, income summary, or an offer of a tenderer in
e-auction system. Jakobsson et al. [4] introduced the concept of designated verifier signature
(DVS for short) schemes which make it possible to a signer A to convince the designated
verifier B that a message he signed is authentic. However, neither A nor the designated
verifier B can convince any other party of authenticity of that message. This is achieved by
ability of B to generate indistinguishable signatures from those produced by A. Thus no one
else can tell whether the signature was created by A or B.
Even though the signer ambiguity exists in the designated verifier signature schemes,
it does not prevent an attacker E eavesdropping on the line between A and B to get the
signature before B receives it. In this case, E can be convinced with high probability that
the signature was issued by A. To overcome this problem, Jakobsson et al. [4] defined a
notion of strong designated verifier. In strong designated verifier signature scheme everyone
can generate signatures indistinguishable (for everyone except B) from those produced by
A. The strong DVS property can be achieved by encrypting the designated verifier signature
with B’s public key. This makes the signature indistinguishable from a random string.
Our contribution. Besides the (strong) designated verifier property, DVS schemes should
provide unforgeability, a property known from the standard digital signature schemes. This
property guarantees, that nobody except A and B can forge a valid signature of some (pre-
viously unsigned) message. We analyze several different models of unforgeability for the DVS

Page 2

schemes. Based on the resources accessible to an attacker, we differentiate between these
models:
– No-message attack – an adversary is given only public keys of A and B.
– Chosen-message attack – an adversary is given public keys and access to the signing oracle.
– Check attack – an adversary is given public keys and access to the B’s verification oracle.
The first two models are well known for the standard digital signatures. The check attack
model can be defined only in the DVS settings.
In Section 3 we analyze relationships among these models. In particular, we show that the
check model is equivalent to the no-message model. We also present a separation between the
no-message model and chosen-message model. We show that this separation holds in both
standard and strong DVS setting.
In Section 4 we analyze the Yang-Liao scheme [13], which is provably unforgeable in the
no-message model under the strong Diffie-Hellman (DH for short) assumption. We modify
this scheme so that the modified scheme is provably unforgeable in the check model under
the computational DH assumption. Hence, we weaken the assumption needed for provable
security of the scheme. Moreover, we show that the modified Yang-Liao scheme has the
strong designated verifier property. The modified scheme and its analysis use the results of
Cash et al. [1] regarding the twin DH problem (the equivalence of the strong variant of twin
DH problem and the computational DH problem).
Related work. To date, numerous designated verifier signature schemes have been proposed,
such as [4,6,10,13]. There are also several modifications of the standard designated veri-
fier signature schemes like universal DVS schemes [3,11,12,14] and multi-designated verifier
signature schemes [2,5,9].
Formal definitions of security notions for the DVS schemes are considered in [7,8]. They
formally define unforgeability, non-delegatability, non-transferability and disavowability. The
non-delegatability notion guarantees that A and B cannot delegate their ability to generate
signatures to the third party without giving the third party their secret keys. The non-
transferability is another name for the designated verifier property defined in [4,10] or also in
this paper. The disavowability guarantees, that A cannot disavow signatures issued by itself
(with respect to the designated verifier B).
Cash et al. [1] define the twin DH problem and its variants. They show that the strong twin
DH problem is equivalent to the computational DH problem. Thus, one can modify various
schemes based on the strong DH assumption, so that the resulting scheme is secure under the
computational DH assumption. As an example they modify the ElGamal encryption scheme,
so that the resulting scheme is secure under the computational DH assumption in the random
oracle model.
2Preliminaries
Let H be a hash function with range Zq. By x
x from the set S. Concatenation of two binary strings m1,m2∈ {0,1}∗is denoted as m1||m2.
We assume that from m1||m2it is possible to uniquely determine the strings m1and m2for
all m1,m2∈ {0,1}∗.
A function f is negligible if for every polynomial p(·) there exists N such that for every
n > N it holds that f(n) <
$← S we denote a uniform random selection of
1
p(n). Negligible functions are denoted as negl(·).
2

Page 3

The Diffie-Hellman assumption. Let G be a group of order q, g be a generator of G and
x,y ∈ Zq. Let dh(X,Y ) denote a solution for Diffie-Hellman problem, i.e.
dh(X,Y ) := Z,
where X = gx,Y = gyand Z = gxy.
Let dhp(X,Y,Z) denote a predicate dhp(X,Y,Z) := (dh(X,Y )
Hellman assumptions are assumptions about hardness of the following problems:
?= Z). Standard Diffie-
– Decisional DH – distinguishing between tuples (gx,gy,gxy) and (gx,gy,gz) for z
– Computational DH – computing dh(X,Y ) for random X,Y
– Strong DH – computing dh(X,Y ) for random X,Y , with oracle access to the predicate
dhp(X,·,·)
– Gap DH – computing dh(X,Y ) for random X,Y , with oracle access to the predicate
dhp(·,·,·)
By hardness we mean impossibility to solve the problems with non-negligible probability
in the probabilistic polynomial time. Note the difference between strong DH problem and
gap DH, where an adversary is given access to the full decision oracle dhp(·,·,·) (instead of
decision oracle with the first input fixed – dhp(X,·,·)). Clearly, the computational DH is the
weakest assumption and the gap DH is the strongest assumption. A natural ambition is to
construct cryptographic schemes that depend on the weakest possible assumptions.
$← Zq
The Twin Diffie-Hellman assumption. Recently, Cash, Kiltz and Shoup [1] defined a so called
Twin Diffie-Hellman problem, which is equivalent in its “strong” variant to the computational
DH problem. Using this fact, one can modify various schemes (such as hashed ElGamal), so
that they can be proved to be secure under computational DH assumption, instead of strong
DH assumption.
Let 2dh(X1,X2,Y ) denote a solution for twin Diffie-Hellman problem, i.e.
2dh(X1,X2,Y ) := (dh(X1,Y ),dh(X2,Y )).
By 2dhp(X1,X2,Y,Z1,Z2) we denote a predicate
2dhp(X1,X2,Y,Z1,Z2) := (2dh(X1,X2,Y )
?= (Z1,Z2)).
We consider several twin Diffie-Hellman assumptions about hardness of the following prob-
lems:
– Decisional twin DH – distinguishing between the following tuples: (gx1,gx2,gy,gx1y,gx2y)
and (gx1,gx2,gy,gz1,gz2) for z1,z2
– Twin DH – computing 2dh(X1,X2,Y ) for random X1,X2,Y
– Strong twin DH – computing 2dh(X1,X2,Y ) for random X1,X2,Y , with oracle access to
the predicate 2dhp(X1,X2,·,·,·)
The main result of [1] is stated in the following proposition.
$← Zq
Proposition 1. The computational DH assumption holds if and only if the strong twin DH
assumption holds.
3

Page 4

3Security definitions
A designated verifier signature scheme is a protocol with two participants Alice (A) and Bob
(B). Alice wants to construct a signature σ of some message m, such that only Bob can
verify the validity of σ. Moreover, Bob cannot convince any other party of σ’s validity. The
designated verifier property is thus an ability of Bob to generate indistinguishable signatures
of m, so that no one else can distinguish, whether the signature σ is created by A or B.
Definition 1 (Designated verifier signature scheme). Let M be some fixed message
space (usually M = {0,1}∗). A designated verifier signature scheme (DVSS) for two partici-
pants A and B is a tuple ?Gen,Sig,Vrf,Sim? of polynomial algorithms, where
– Gen(1n) is a probabilistic algorithm, which takes on input a security parameter 1nand
outputs a tuple of keys (pkA,skA,pkB,skB), where pkA,skAare public and private keys of
A and pkB,skBare public and private keys of B.
– Sig(m,skA,pkB) is a probabilistic algorithm that takes on input a message m ∈ M, A’s pri-
vate key and B’s public key, and outputs a signature σ, denoted as σ ← Sig(m,skA,pkB).
– Vrf(m,σ,skB,pkA) is a deterministic algorithm, which takes on input a message m, sig-
nature σ, B’s private key and A’s public key. It outputs a bit b = 1 if σ is a valid signature
of m, otherwise it outputs b = 0. If the message m is not needed for the verification pro-
cedure we say that the scheme has “message recovery” property (we’ll see example of such
a scheme in the Section 4).
– Sim(m,pkA,skB) is a probabilistic algorithm producing signatures indistinguishable from
those produced by Sig(·,skA,pkB). In some cases (e.g. the definition of strong designated
verifier) we need the Sim algorithm with different set of inputs – instead of the secret key
skB, it takes B’s public key pkB. We denote this modified algorithm as Sim?(m,pkA,pkB).
In addition, for every n, every tuple (pkA,skA,pkB,skB) generated by Gen(1n), and every
message m ∈ M, it must hold that
Vrf(m,Sig(m,skA,pkB),skB,pkA) = 1.
The public and secret keys of A and B can be (and usually are) generated independently.
That is, the algorithm Gen can be “divided” into two independent algorithms GenA(1n) →
(pkA,skA) and GenB(1n) → (pkB,skB). Hence, A and B need not to communicate in order
to obtain public and secret keys. To simplify the presentation, we use the notation with only
one algorithm Gen.
Saednia, Kremer, Markowitch [10] define the designated verifier property as follows.
The designated verifier experiment Ind-DVD,Π(n):
1. Run Gen(1n) to obtain (pkA,skA,pkB,skB).
2. A random bit b
3. Adversary D is given pkA, pkBand oracle access to either Sig(·,skA,pkB) if b = 0
or to Sim(·,pkA,skB) if b = 1. Eventually, D outputs a bit b?.
4. The output of the experiment is 1 if b = b?and 0 otherwise.
$← {0,1} is chosen.
Definition 2 (Designated verifier). Let Π = ?Gen,Sig,Vrf,Sim? be a DVSS for A and
B. We say that Π has a designated verifier property if for any probabilistic polynomial time
adversary D there exists a negligible function negl, such that
Pr[Ind-DVD,Π(n) = 1] ≤1
2+ negl(n).
4

Page 5

We note that there exist schemes for which Sim(·,pkA,skB) produces identically dis-
tributed signatures as those produced by Sig(·,skA,pkB). That is, no distinguisher (running
in an arbitrary time) can win the Ind-DV experiment with probability greater than1
that such schemes has perfect designated verifier property. When a scheme has this property,
then no one can tell whether a signature was issued by A or B, even if their secret keys are
compromised (given public keys, the distinguisher running in an arbitrary time can find secret
keys by itself).
Sometimes, a potential attacker Eve can be convinced (with high probability), that the
signature was created by Alice. For example, when Eve intercepts a signature (m,σ) sent over
a network, which Bob could not see yet. In this case, we need a stronger notion of designated
verifier.
2. We say
The strong DV experiment Ind-SDVD,Π(n):
1. Run Gen(1n) to obtain (pkA,skA,pkB,skB).
2. A random bit b
3. Adversary D is given pkA, pkBand oracle access to either Sig(·,skA,pkB) if b = 0
or to Sim?(·,pkA,pkB) if b = 1. Eventually, D outputs a bit b?.
4. The output of the experiment is 1 if b = b?and 0 otherwise.
$← {0,1} is chosen.
Definition 3 (Strong desig. verifier). Let Π = ?Gen,Sig,Vrf,Sim?? be a DVSS for A and
B. We say that Π has a strong designated verifier property if for any probabilistic polynomial
time adversary D there exists a negligible function negl, such that
Pr[Ind-SDVD,Π(n) = 1] ≤1
2+ negl(n).
Thus if the scheme Π has the strong designated verifier property, then everyone is able to
generate indistinguishable signatures using the algorithm Sim?. The strong designated verifier
property is usually achieved by encrypting the signature (with B’s public-key). This makes
the signature indistinguishable from a random string.
Besides the designated verifier property, the designated verifier signature scheme should
also guarantee, that nobody except Alice and Bob can produce a valid signature for some
message m, i.e. a potential attacker Eve is unable to construct a pair (m,σ), where σ is a
valid signature of m. Based on the resources accessible to the attacker, Eve can perform an
attack in several different models:
– no-message attack – Eve has access to public keys and parameters of participants Alice
and Bob (this knowledge is assumed in all other models as well)
– chosen-message attack – Eve has oracle access to Alice’s signing algorithm
– check attack – Eve has oracle access to Bob’s verification algorithm
While the first two models are well known from the standard digital signature schemes,
the check model is meaningful only in the designated verifier settings. The no-message model
is the most used approach in the proofs of security of current DVSS [6,10,13].
The no-message experiment NMA-forgeE,Π(n):
1. Run Gen(1n) to obtain (pkA,skA,pkB,skB).
2. Adversary E is given pkA, pkBand outputs (m,σ).
3. The output of the experiment is a bit b = Vrf(m,σ,skB,pkA).
5