Signature Schemes from Identification Schemes

Abstract

There are currently two main techniques for constructing signature schemes in the random oracle model. The first technique uses the " full-domain hash " approach, and several schemes designed using this approach were introduced in the previous chapter. Here we cover the second central method, in which signature schemes are derived from so-called identification schemes. We note up front that there is a rich literature studying identification schemes in their own right; however, we limit our-selves to a discussion of only those aspects that are most directly relevant to the construction of signature schemes. The chapter is organized as follows. We first define identification schemes as well as the notion of passive security for such schemes; although this definition of security is relatively weak as far as identification schemes are concerned, the definition suffices for our purposes. We then describe and prove secure the Fiat-Shamir transform, which provides a general method for converting (a certain class of) passively secure identification schemes to signature schemes in the random ora-cle model. We also discuss a simple transformation of certain identification schemes to KMA-secure signature schemes without relying on the random oracle model. Armed with these result, we then devote several sections to identification schemes number-theoretic assumptions, to which the Fiat-Shamir transform can be applied. We remark that many of the ideas explored in this chapter have proven extremely useful in other areas of cryptography, most notably in the context of zero-knowledge proofs. Although we do not describe any of these additional applications, we hope to whet the reader's appetite and thereby motivate the reader to explore these appli-cations; we also expect that the material covered here will provide a firm foundation with which to better understand these more advanced topics.