New signature schemes with coupons and tight reduction

Abstract

Amongst provably secure signature schemes, two distinct classes are of particular interest: the ones with tight reduction (e.g., RSA-PSS), and those which support the use of coupons (e.g., Schnorr signature). This paper introduces a new generic signature scheme based on any zero-knowledge identification protocol Z and signature scheme S verifying basic security properties. The so-obtained signature scheme features provable security with tight reduction under the same complexity assumptions as the ones under which the basic zero-knowledge identification protocol and signature scheme are secure. In addition to that, interestingly, the combined scheme supports coupons. We propose an application of our generic conversion scheme based on RSA. We note however that any computational problem ℘ could be turned into such a tight signature scheme supporting coupons for any zero-knowledge identification protocol and signature scheme based on ℘. Interestingly, our design technique provides an alternative to the RSA-PSS signature standard, as it enjoys an equivalently tight security while enabling the use of coupons for increased performances. © Springer-Verlag Berlin Heidelberg 2005.