Multisignatures secure under the discrete logarithm assumption and a generalized forking lemma

Multisignatures allow n signers to produce a short joint signature on a single message. Multisignatures were achieved in the plain model with a non-interactive protocol in groups with bilinear maps, by Boneh et al [4], and by a three-round protocol under the Discrete Logarithm (DL) assumption, by Bellare and Neven [3], with multisignature verification cost of, respectively, O(n) pairings or exponentiations. In addition, multisignatures with O(1) verification were shown in so-called Key Verification (KV) model, where each public key is accompanied by a short proof of well-formedness, again either with a non-interactive protocol using bilinear maps, by Ristenpart and Yilek [15], or with a three-round protocol under the Diffie-Hellman assumption, by Bagherzandi and Jarecki [1]. We improve on these results in two ways: First, we show a tworound O(n)-verification multisignature secure under the DL assumption in the plain model, improving on the three-round protocol of [3]. Second, we show ...

• Type: Conference
• Year: 2008
• Where: CCS
• Authors: Ali Bagherzandi, Jung Hee Cheon, Stanislaw Jarecki
• Keywords: CCS 2008, KV Model, Multisignature Secure, Security Privacy, Three-round Protocol