Security of 2t-root identification and signatures

Abstract

Ong-Schnorr identification and signatures are variants of the Fiat-Shamir scheme with short and fast communication and signatures. This scheme uses secret keys that are 2t-roots modulo N of the public keys, whereas Fiat-Shamir uses square roots modulo N. Security for particular cases has recently been proved by Micali [M94] and Shoup [Sh96]. We prove that identification and signatures are secure for arbitrary moduli N = pq unless N can easily be factored. The proven security of identification against active impersonation attacks depends on the maximal 2-power 2m that divides either p − 1 or q − 1. We show that signatures are secure against adaptive chosen-message attacks. This proves the security of a very efficient signature scheme.