Chameleon Signatures

Abstract

This paper presents a new tool for enhancing the confidentiality and privacy of electronic transactions such as the signing of agreements, commitment to bids, etc. We introduce chameleon signatures that provide with an undeniable commitment of the signer to the contents of a signed document (as regular digital signatures do) but, at the same time, do not allow the recipient of the signature to disclose the contents of the signed information to any third party without the signer's consent. Chameleon signatures are closely related to the much researched notion of "undeniable signatures" but they allow for simpler and more efficient realizations. In particular, they do not involve the design and complexity of zero-knowledge proofs on which traditional undeniable signature schemes are based, and they are non-interactive without requiring idealized random-oracle assumptions. Chameleon signatures are generated under the standard method of hash-then-sign, where the hash is implemented via chameleon hash functions which are characterized by the non-standard property of being collision-resistant for the signer but collision tractable for the recipient. We present simple and efficient implementations of chameleon hashing and chameleon signatures. The former are constructed based on standard cryptographic assumptions (e.g., the hardness of factoring or discrete logarithms), while the signature part can use any digital signature scheme (e.g., RSA or DSS). We prove the unforgeability of the resultant chameleon signatures solely based on the unforgeability of the underlying digital signature in use.