On delegatability of MDVS schemes

Abstract

In a designated verifier signature (DVS) scheme, a signer (Alice) generates a signature which can only be verified by a designated verifier (Bob) chosen by her. Moreover, Bob cannot transfer his conviction about Alice’s signature to any third party. A DVS scheme provides the capability of authenticating Alice to Bob without disrupting her privacy. A multi designated verifier signature (MDVS) scheme is an extension of a DVS which consists of multiple designated verifiers. Non-delegatability is an essential property of a DVS scheme in scenarios where the responsibility of a signer (Alice) is important and she must not be able to delegate the signing rights to another entity. In this paper, we discuss on all MDVS schemes proposed up to now (to the best of our knowledge) and show that all of them are delegatable. As a result, proposing a non-delegatable MDVS scheme is an open research problem in the literature.

Full text

Journal of Computer Virology and Hacking Techniques (2022) 18:71–80
https://doi.org/10.1007/s11416-021-00382-2
ORIGINAL PAPER
On delegatability of MDVS schemes
Parvin Rastegari1·Willy Susilo2
Received: 14 October 2020 / Accepted: 26 March 2021 / Published online: 13 April 2021
© The Author(s), under exclusive licence to Springer-Verlag France SAS, part of Springer Nature 2021
Abstract
In a designated verifier signature (DVS) scheme, a signer (Alice) generates a signature which can only be verified by a
designated verifier (Bob) chosen by her. Moreover, Bob cannot transfer his conviction about Alice’s signature to any third
party. A DVS scheme provides the capability of authenticating Alice to Bob without disrupting her privacy. A multi designated
verifier signature (MDVS) scheme is an extension of a DVS which consists of multiple designated verifiers. Non-delegatability
is an essential property of a DVS scheme in scenarios where the responsibility of a signer (Alice) is important and she must
not be able to delegate the signing rights to another entity. In this paper, we discuss on all MDVS schemes proposed up to
now (to the best of our knowledge) and show that all of them are delegatable. As a result, proposing a non-delegatable MDVS
scheme is an open research problem in the literature.
1 Introduction
A digital signature scheme is an important primitive to
provide authentication, integrity of the messages and non-
repudiation in security protocols [1]. An ordinary digital
signature scheme is publicly verifiable, i.e., everyone who
holds Alice’s public key can verify her signature on every
messages. Although this public verifiability is useful in
many scenarios, it is not desirable in applications where
the signer must be authenticated without disrupting her pri-
vacy, such as e-voting and e-commerce applications. In 1989,
the concept of undeniable signatures [2] was proposed by
Chaum and Antwerpen to authenticate Alice to Bob without
disrupting her privacy. However, in an undeniable signa-
ture, Bob needs some help of Alice to verify her signature.
To omit the reciprocal communication between Alice and
Bob, the concept of designated verifier signature (or proof)
(DVS) was proposed by Jakobsson et al. [3], and inde-
pendently by Chaum [4], in 1996. DVS schemes provide
the authentication and the integrity of messages, without
BParvin Rastegari
p.rastegari@gmail.com
Willy Susilo
wsusilo@uow.edu.au
1Golpayegan University of Technology, Golpayegan, Isfahan
36925 87412, Iran
2Institute of Cybersecurity and Cryptology, School of
Computing and Information Technology, University of
Wollongong, Wollongong, NSW 2522, Australia
the non-repudiation property. In a DVS scheme, a signer,
Alice, is able to convince a designated verifier, Bob, that
she has indeed signed a message while Bob cannot trans-
fer this conviction to any third party. As a result, Alice is
authenticated to Bob and also her privacy is preserved con-
currently, without any interaction between Alice and Bob.
Additionally, the notion of strong DVS (SDVS) scheme, in
which the private key of the verifier is required in running
the verification algorithm, was also introduced in [3]. Later
in 2003, the concept of universal DVS (UDVS) scheme [5]
was proposed by Steinfeld et al., in which everyone, who
holds Alice’s ordinary signature on a message, can trans-
form it into a DVS for a designated verifier. It is obvious
that a UDVS scheme can be considered as a DVS scheme,
when the original signer (Alice) is herself the signature
holder.
In 1996, a discussion on multiple (instead of just one)
designated verifiers was provided in [3]. After a few years
in 2003, the notion of multi-designated verifier signature
(MDVS) scheme was presented by Desmedt [6]. Conse-
quently in 2004, Laguillaumie et al. formalized this concept
[7]. Up to now, a number of MDVS schemes with various
properties in different setting models have been presented in
the literature [8–24],
In 2005, a new security notion, named as non-delegatability
(ND), was introduced by Lipmaa et al. [25], which opens up a
new direction of research. In a non-delegatable DVS scheme,
neither the signer (Alice) nor a designated verifier (Bob) can
assign the signing rights to any third party (Carol) without the
123
Content courtesy of Springer Nature, terms of use apply. Rights reserved.