Structure-Preserving Signatures
from Type II Pairings
Masayuki Abe, NTT
Jens Groth, University College London
Miyako Ohkubo, NICT
Mehdi Tibouchi, NTT
Mathematical structures in cryptography
• Cyclic prime order group G
– 𝐺 𝑥 ⋅ 𝐺 𝑦 = 𝐺 𝑥+𝑦
• Useful mathematical structure
–
–
–
–
ElGamal encryption
Pedersen commitments
Schnorr proofs
…
Pairing-based cryptography
• Groups G1 , G2 , G 𝑇 with pairing 𝑒: G1 × G2 → G 𝑇
– 𝐺 𝑥 ⋅ 𝐺 𝑦 = 𝐺 𝑥+𝑦
– 𝑒 𝐺 𝑥 , 𝐻 𝑦 = 𝑒 𝐺, 𝐻
𝑥𝑦
• Additional mathematical structure
–
–
–
–
–
One-round tripartite key exchange
Identity-based encryption
Short digital signatures
NIZK proofs
…
Structure-preserving cryptography
• Preserve mathematical structure of pairing groups
– Communication consists of group elements in G1 , G2
– Use generic group operations
• Multiplication, membership testing, pairing
– Avoid structure-destroying operations
• No cryptographic hash-functions
• Modular design
– Structure-preserving
building blocks easy to combine
Bilinear group setup
• 𝑝, G1 , G2 , G 𝑇 , 𝑒, 𝐺, 𝐻 ← Gen(1𝑘 )
– Groups G1 , G2 , G 𝑇 of prime order 𝑝
– Bilinear map 𝑒: G1 × G2 → G 𝑇
• 𝑒 𝐺 𝑥 , 𝐻 𝑦 = 𝑒 𝐺, 𝐻 𝑥𝑦
• G1 = 〈𝐺〉 , G2 = 〈𝐻〉 , G 𝑇 = 〈𝑒 𝐺, 𝐻 〉
• Types
– Type I: G1 = G2 and 𝐺 = 𝐻
– Type II: G1 ≠ G2 but there is efficiently computable
homomorphism 𝜓: G2 → G1 (and 𝐺 = 𝜓 𝐻 )
– Type III: G1 ≠ G2 and no efficient homomorphism
Structure-preserving signatures
• Setup describes bilinear group and group
elements in G1 , G2
• Verification key adds group elements in G1 , G2
• Messages consist of group elements in G1 , G2
• Signatures consist of group elements in G1 , G2
• Verifier uses pairing product equations to check
validity of signatures, e.g.,
𝑒 𝐺, 𝑆 = 𝑒 𝑉, 𝑀 𝑒 𝜓 𝑅 , 𝑅 𝑒 𝑊, 𝐻
Efficiency of structure-preserving signatures
Pairing type
Verification
equations
Signature
size
Verification
key size
Type I: G1 = G2
2
3
2 (1)
Type II: 𝜓: G2 → G1
1
2
2
Type III: G1 ≠ G2
2
3
2 (1)
Matching upper and lower bounds
for all types of bilinear groups
First lower bound on
verification key size
Type II: Holds when 𝑀 ∈ G2
Unknown for Type I and III
Constructions
• Structure-preserving signatures in Type II groups
with efficiently computable linear map 𝜓: G2 → G1
• Strongly existentially unforgeable signatures
– Infeasible to forge signature on new message
– Infeasible to forge new signature on old message
• Randomizable signatures
– Infeasible to forge signature on new message
– Possible to randomize signature on old message such
that it looks like a fresh signature
Strongly unforgeable signatures
• Setup 1𝑘 : Return 𝑃𝑃 = 𝑝, G1 , G2 , G 𝑇 , 𝑒, 𝐺, 𝐻
𝑝, G1 , G2 , G 𝑇 , 𝑒, 𝐺, 𝐻 ← Gen(1𝑘 )
• KeyGen 𝑃𝑃 : Return 𝑉𝐾 = (𝑉, 𝑊) and 𝑆𝐾 = 𝑣, 𝑤
𝑣, 𝑤 ← 𝑍𝑝 ; 𝑉 = 𝐺 𝑣 ; 𝑊 = 𝐺 𝑤
• Sign𝑃𝑃,𝑆𝐾 (𝑀): Given 𝑀 ∈ G2 return Σ = (𝑅, 𝑆)
𝑡 ← 𝑍𝑝∗ ; 𝑅 = 𝐻 𝑡−𝑤 ; 𝑆 =
𝑣 1
𝑀𝑡 𝐻𝑡
• Verify𝑃𝑃,𝑉𝐾 𝑀, (𝑅, 𝑆) : Accept if and only if
𝑀, 𝑅, 𝑆 ∈ G2 and 𝑒 𝑊𝜓 𝑅 , 𝑆 = 𝑒 𝑉, 𝑀 𝑒 𝐺, 𝐻
Randomizable signatures
• Setup 1𝑘 : Return 𝑃𝑃 = 𝑝, G1 , G2 , G 𝑇 , 𝑒, 𝐺, 𝐻
𝑝, G1 , G2 , G 𝑇 , 𝑒, 𝐺, 𝐻 ← Gen(1𝑘 )
• KeyGen 𝑃𝑃 : Return 𝑉𝐾 = (𝑉, 𝑊) and 𝑆𝐾 = 𝑣, 𝑤
𝑣, 𝑤 ← 𝑍𝑝 ; 𝑉 = 𝐺 𝑣 ; 𝑊 = 𝐺 𝑤
• Sign𝑃𝑃,𝑆𝐾 (𝑀): Given 𝑀 ∈ G2 return Σ = (𝑅, 𝑆)
𝑟 ← 𝑍𝑝 ; 𝑅 =
𝐻𝑟
; 𝑆=
2 +𝑤
𝑣
𝑟
𝑀 𝐻
• Verify𝑃𝑃,𝑉𝐾 𝑀, (𝑅, 𝑆) : Accept if and only if
𝑀, 𝑅, 𝑆 ∈ G2 and 𝑒 𝐺, 𝑆 = 𝑒 𝑉, 𝑀 𝑒 𝜓 𝑅 , 𝑅 𝑒 𝑊, 𝐻
• Randomize𝑃𝑃,𝑉𝐾 (𝑀, Σ): Return Σ′ = (𝑅′ , 𝑆′)
𝛼 ← 𝑍𝑝 ; 𝑅′ =
𝑅𝐻 𝛼
; 𝑆′ =
2
2𝛼
𝛼
𝑆𝑅 𝐻
Efficiency
Beats lower bounds in
Type I and III groups
• Signature size
– 2 group elements in G2
Unilateral signature
• Verification key size
– 2 group elements in G1
Provably minimal
• Less efficient than signatures in Type III groups
– In current Type II instantiations we have larger G2
elements than Type III. So even though we have fewer
group elements, Type III signatures are smaller
– Also, currently membership testing in G2 is expensive,
so verification is slower than comparable Type III
signatures [Chatterjee and Menezes, ePrint 2014]
Security
• The signature schemes are provably secure in the
generic bilinear group model
• We conjecture that for a minimal size signature
scheme it is necessary to use an interactive
assumption (it is the case for Type III signatures)
• Can tweak the randomizable signature scheme to
become secure under a non-interactive
assumption by adding a group element to
verification key and signature
• Verify signature Σ = (𝑅, 𝑆, 𝑇) on 𝑀 by checking
𝑒 𝐺, 𝑆 = 𝑒(𝑈, 𝑇)𝑒 𝑉, 𝑀 𝑒 𝜓 𝑅 , 𝑅 𝑒 𝑊, 𝐻
Lower bounds for 𝑀 ∈ G1
Matches lower bounds in
Type I and Type III settings
• Theorem
A structure-preserving signature scheme in the
Type II setting on messages 𝑀 ∈ G1 must have at
least 2 verification equations
– Even for one-time signatures under random message attack
• Theorem
A structure-preserving signature scheme in the
Type II setting on messages 𝑀 ∈ G1 must have at
least 3 group elements in the signatures
– Generic signer, even for random message attack
Lower bounds for 𝑀 ∈ G𝟐
Theorems show our
constructions are optimal
• Theorem
A structure-preserving signature scheme in the
Type II setting with a single verification equation
must have at least 2 group elements in the
verification key
One-time signatures can be smaller
𝑒 𝐺, 𝑆 = 𝑒 𝑉, 𝑀 𝑒(𝑊, 𝐻)
– Even for one-time signatures under random message attack
• Theorem
A structure-preserving signature scheme in the
Type II setting on messages 𝑀 ∈ G2 must have at
least 2 group elements in the signatures
– Generic signer, even for random message attack
Summary
• Complete classification
Pairing type
Verification
equations
Signature
size
Verification
key size
Type I: G1 = G2
2
3
2 (1)
Type II: 𝜓: G2 → G1
1
2
2
Type III: G1 ≠ G2
2
3
2 (1)
• Constructions
– Strong
𝑒 𝑊𝜓 𝑅 , 𝑆 = 𝑒 𝑉, 𝑀 𝑒 𝐺, 𝐻
– Randomizable 𝑒 𝐺, 𝑆 = 𝑒 𝑉, 𝑀 𝑒 𝜓 𝑅 , 𝑅 𝑒 𝑊, 𝐻