Discrete-Log-Based Signatures May Not Be Equivalent to Discrete Log

Abstract We provide evidence that the unforgeability of several discrete-log based signatures like Schnorr signatures cannot be equivalent to the discrete log problem in the standard model. This contradicts in nature well-known proofs standing in weakened proof methodologies, in particular proofs employing various formulations of the Forking Lemma in the random oracle Model. Our impossibility proofs apply to many discrete-log-based signatures like ElGamal signatures and their extensions, DSA, ECDSA and KCDSA as well as standard generalizations of these, and even RSA-based signatures like GQ. We stress that our work sheds more light on the provable (in)security of popular signature schemes but does not explicitly lead to actual attacks on these.

• Type: Conference
• Year: 2005
• Where: ASIACRYPT
• Authors: Pascal Paillier, Damien Vergnaud
• Keywords: ASIACRYPT 2005, Cryptology, Discrete-log Based Signatures, Nature Well-known Proofs, Signature