Short Transitive Signatures for Directed Trees

A transitive signature scheme allows to sign a graph in such a way that, given the signatures of edges (a, b) and (b, c), it is possible to compute the signature for the edge (or path) (a, c) without the signer’s secret. Constructions for undirected graphs are known but the case of directed graphs remains open. A first solution for the case of directed trees (DT T S) was given by Yi at CT-RSA 2007. In Yi’s construction, the signature for an edge is O(n(log(n log n))) bits long in the worst case. A year later, Neven designed a simpler scheme where the signature size is reduced to O(n log n) bits. Although Neven’s construction is more efficient, O(n log n)-bit long signatures still remains impractical for large n. In this work, we propose a new DT T S scheme such that, for any value λ ≥ 1 and security parameter κ: • Signatures for edges are only O(κλ) bits long. • Signing or verifying a signature for an edge requires O(λ) cryptographic operations. • Computing a signa...

• Type: Journal
• Year: 2011
• Where: IACR
• Authors: Philippe Camacho, Alejandro Hevia
• Keywords: IACR 2011, Signature Scheme, Signature Size, Undirected Graphs