Cryptosystems on Trapdoor Group with Infeasible Inversion.pptVIP

Cryptosystems on Trapdoor Group with Infeasible Inversion SJTU CIS GONG Zheng neoyan@ Outline Background Transitive Signature (TS) Homomorphic Signature (HS) Trapdoor Group with Infeasible Inversion (TGII) Some Failed Attempts RSA Group LFSR Group Braid Group Conclusion Homomorphic Signature Homomorphic signature schemes. Robert Johnson, David Molnar, Dawn Xiaodong Song, and David Wagner. In CT-RSA, pages 244–262, 2002 Definition of HS Related works on TS Transitive Signature Schemes S. Micali and R. Rivest, CT-RSA 2002, LNCS 2271 Model for Undirected Transitive Signatures H. Zhu, IEE Proc.-Commun, Vol. 151, No.4, 2004 Transitive Signatures: New Schemes and Proofs M. Bellare and G. Neven Asiacrypt 2002 and a revised version published on IEEE Transaction on Information Theory, Vol. 51, No.6, JUNE 2005 Transitive Signature TS = {KGen, VSign, VVer, ESign, EVer, Comp} KGen: Input secure parameter, generate private and public keys VSign: Input a vertex information, output a vertex signature ESign: Input two vertex info and secrets, output a edge signature on the given vertexes Transitive Signature VVer and EVer: Input a vertex (edge) signature and public key, output 0 or 1 Comp: Input two edge signatures, which have a joint in the graph, output a new edge signature Transitive Signature Vertex Signature Signature on the vertex i, denote Vi Unforgeable Certificate based or Non-certificate based Edge Signature Signature on the edge (i, j), denote Eij Unforgeable Stateful or Unstateful Transitive Signature Edge Signature Composability Anyone can compose two edge signatures (with a joint) into a new edge signature. Comp(.,.), {Eij, Ejk} - Eik Composed edge signature is indistinguishable from the original signature. An Undirected Paradigm on Prime Order Group(1) System Parameters Prime order group Zp Subgroup Zq, q|p-1 g, h are two generator of the group Zq Vertex Signature Vertex value: vi = g^{xi}*h^{yi} Certificate: Vi = SDS(vi, notioni) Edge Signatu