On the Instantiability of Hash-and-Sign RSA Signatures

The hash-and-sign RSA signature is one of the most elegant and well known signatures schemes, extensively used in a wide variety of cryptographic applications. Unfortunately, the only existing analysis of this popular signature scheme is in the random oracle model, where the resulting idealized signature is known as the RSA Full Domain Hash signature scheme (RSA-FDH). In fact, prior work has shown several tantiability” results for various abstractions of RSA-FDH, where the RSA function was replaced by a family of trapdoor random permutations, or the hash function instantiating the random oracle could not . These abstractions, however, do not allow the reduction and the hash function instantiation to use the algebraic properties of RSA function, such as the multiplicative group structure of Z∗ n. In contrast, the multiplicative property of the RSA function is critically used in many standard model analyses of various RSA-based schemes. Motivated by closing this gap, we consider the ...

• Type: Journal
• Year: 2012
• Where: TCC
• Authors: Yevgeniy Dodis, Iftach Haitner, Aris Tentes
• Keywords: Cryptology, Random Oracle Model, RSA Assumption, Rsa Function, TCC 2012