How to improve signature schemes

Abstract

Bellare and Micali have shown how to build strong signature schemes from the mere assumption that trapdoor permutation generators exist. Subsequently, Naor and Yung have shown how to weaken the assumption under which a strong signature scheme can be built: it is enough to start from permutations that are one-way rather than trapdoor. In this paper, which is independent from and orthogonal to the work of Naor and Yung, we weaken in a different way the assumption under which a strong signature scheme can be built: it is enough to start from what we call a weak signature scheme (defined below). Weak signature schemes are trapdoor in nature, but they need not be based on permutations. As an application, the Guillou-Quisquater-Simmons signature scheme (a variant on Williams’ and Rabin’s schemes, also defined below) can be used to build a strong signature scheme, whereas it is not clear that it gives rise directly to an efficient trapdoor (or even one-way) permutation generator.