Stronger Security and Constructions of Multi-designated Verifier Signatures

TY - GEN

T1 - Stronger Security and Constructions of Multi-designated Verifier Signatures

AU - Damgård, Ivan

AU - Haagh, Helene

AU - Mercer, Rebekah

AU - Nitulescu, Anca

AU - Orlandi, Claudio

AU - Yakoubov, Sophia

N1 - Conference code: 18

PY - 2020

Y1 - 2020

N2 - Off-the-Record (OTR) messaging is a two-party message authentication protocol that also provides plausible deniability: there is no record that can later convince a third party what messages were actually sent. The challenge in group OTR, is to enable the sender to sign his messages so that group members can verify who sent a message (signatures should be unforgeable, even by group members). Also, we want the off-the-record property: even if some verifiers are corrupt and collude, they should not be able to prove the authenticity of a message to any outsider. Finally, we need consistency, meaning that if any group member accepts a signature, then all of them do. To achieve these properties it is natural to consider Multi-Designated Verifier Signatures (MDVS). However, existing literature defines and builds only limited notions of MDVS, where (a) the off-the-record property (source hiding) only holds when all verifiers could conceivably collude, and (b) the consistency property is not considered. The contributions of this paper are two-fold: stronger definitions for MDVS, and new constructions meeting those definitions. We strengthen source-hiding to support any subset of corrupt verifiers, and give the first formal definition of consistency. We build three new MDVS: one from generic standard primitives (PRF, key agreement, NIZK), one with concrete efficiency and one from functional encryption.

AB - Off-the-Record (OTR) messaging is a two-party message authentication protocol that also provides plausible deniability: there is no record that can later convince a third party what messages were actually sent. The challenge in group OTR, is to enable the sender to sign his messages so that group members can verify who sent a message (signatures should be unforgeable, even by group members). Also, we want the off-the-record property: even if some verifiers are corrupt and collude, they should not be able to prove the authenticity of a message to any outsider. Finally, we need consistency, meaning that if any group member accepts a signature, then all of them do. To achieve these properties it is natural to consider Multi-Designated Verifier Signatures (MDVS). However, existing literature defines and builds only limited notions of MDVS, where (a) the off-the-record property (source hiding) only holds when all verifiers could conceivably collude, and (b) the consistency property is not considered. The contributions of this paper are two-fold: stronger definitions for MDVS, and new constructions meeting those definitions. We strengthen source-hiding to support any subset of corrupt verifiers, and give the first formal definition of consistency. We build three new MDVS: one from generic standard primitives (PRF, key agreement, NIZK), one with concrete efficiency and one from functional encryption.

UR - http://www.scopus.com/inward/record.url?scp=85098267647&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-64378-2_9

DO - 10.1007/978-3-030-64378-2_9

M3 - Article in proceedings

SN - 978-3-030-64377-5

VL - II

T3 - Lecture Notes in Computer Science

SP - 229

EP - 260

BT - Theory of Cryptography - 18th International Conference, TCC 2020, Proceedings

A2 - Pass, Rafael

A2 - Pietrzak, Krzysztof

PB - Springer

CY - Cham

T2 - Theory of Cryptograhpy

Y2 - 16 November 2020 through 19 November 2020

ER -