An efficient existentially unforgeable signature scheme and its applications

Abstract

We present a practical existentially unforgeable signature scheme and point out applications where its application is desirable. A signature scheme is existentially unforgeable if, given any polynomial (in the security parameter) number of pairs (m1,S(m1)),(m2,S(m2)),…(mk,S(mk)) where S(m) denotes the signature on the message m, it is computationally infeasible to generate a pair (mk+1, S(mk+1)) for any message mk+1 ∉ {m1,... mk}. We have developed a signature scheme that requires at most 6 times the amount of time needed to generate a signature using RSA (which is not existentially unforgeable).