How to aggregate the CL signature scheme

Abstract

We present an aggregate signature scheme whose public key consists of only two group elements. It is therefore the first sequential aggregate signature scheme with short keys in the standard model. Our construction relies on the Camenisch-Lysyanskaya signature scheme (Crypto 2004) and is provably secure under the LRSW assumption. Moreover, we develop a novel aggregation technique that we call aggregate-extension technique. The basic idea is to extend the aggregate by a single element and to use this additional space to "store" some information that would be lost due to the compression of the signatures. We believe that this technique might be of independent interest. © 2011 Springer-Verlag.