Comments on a signature scheme based on the third order LFSR proposed at ACISP2001

Abstract

In this paper we will compare two signature schemes proposed by different sets of authors. One is the XTR-Nyberg-Rueppel signature proposed by A.K. Lenstra and E.R. Verheul in [3] and the other is the signature scheme proposed by C.H. Tan, X. Yi and C.K. Siew (We will call it TYS signature.) in [9]. XTR-NR signature uses the third degree trace projection Tr: GF(p6) → GF(p2) and has been generalized in [8] by Lim et. al. as a scheme in GF(p6m) using Tr: GF(p6m) → GF(p2m). On the other hand, TYS signature is based on a third order LFSR. Tan et. al. claimed that TYS signature is as secure as Schnorr signature scheme. We will explain why these two schemes are essentially the same. In addition, we will point out that TYS signature as it is has some flaws in their arguments. We will show that in order to cure the flaws of TYS signature, one should bring in exactly the same security and efficiency consideration of XTR scheme as in [8].