signature schemes and applications to cryptographic...

134

Upload: vuongthuan

Post on 08-Dec-2018

221 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

������������ �� ��������� ��������� ������������� ��!����" !#$ %&�'(!��� ���������� )* +!,(!��-!��/.0��� �����

1324657598;:<-=><�8?5@=BA+8C<-8

D?E 1+F6GIHJHJKBLMHONPHOQ KSR&KBTVUXWYHOFMKBZ3H�NX[�\�]^KB_>HOWJG^_`Ua]�\�Z bcGdZ KeKeWOG^Z bfUaZ�LhgiNjFMT E HJKeWD _eG^KBZ�_eK

G^ZkTVUXWYHOGlUa]m[ E ]InV]d]^FMK`ZcHiNa[�HOQ K�WoK`p E G^WoKBFMK`ZcHOq�[rNaWiHsQ KSL KebjWoKeKSNa[

R'N?_>HONaWtNX[9u�Q�Gd]dNaqJNXT+Q32

UCHtHOQ K

vhw D�D w gyx'z D \�{|{ D6}�~�D { } {�z&{�\�����{�\�gyx ~ �����S���

D KeT HJK`FP1�KeW|�X�j�3�_� v UaqoqJUa_�Q E qYKeHoHOq } Z�qYHOGIH E HJKSNa[�{�K`_�Q�Z�Na]dNaba2��X�j�3��� w ]^]�WOG�bcQcHsq�WoK`qYKeWo�jK`L��

w E HOQ�NaW��>���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B�R�KeTVUXWYHsF�K`ZcHtNX[9\�]^KB_�HJWJGd_BUa]�\�Z bjGdZ KeKBWJGdZ b�UaZ�L�giNjFMT E HJKBW D _eG^KBZ�_eK

D KBT HJKBFf1mKBWi�+�m�X�j�3�

g�KeWoHOGIn+K`L�1�2i���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B�e���B���e�e�e���B���e���B�� NjZ+Ua]^Lk�� � G��jK`q�H

� GIHOKeWo1+G�u�WJNa[�K`qoqoNaWtNX[�giNjFMT E HJKBW D _eG^KBZ�_eK{|Q KBqoGdq D?E T�KeWY� G^qoNaW

w _e_�KBT HJKBL�132��e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���B���e�e�e���B���e���w WYHsQ E W&g'� D F6GIHOQ

giQ+UaG�WOF6UaZ��?R&KBTVUXWYHOFMKBZ3H�giNjF6FMG�HoHJKBK&NjZ��'WOUaL E UCHJK D H E L KBZ3HOq

Page 2: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

Page 3: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

������������ ������������������������ �!�!"#���$����%&���'(%*)+ �,����%-�& ����!�!���. �%/�%0�$%&"213���(�4�&�

132w Z�Z+U���2 q�2�UaZ�q65CU`2�U

798�:(;2<>=?=A@CBD=AEF=AG�@IH�@CJ�KML#=?;2@CNO=0EMPRQ/ST@VUC=?L?<TUWKMS$Q/N�XM<YN�@C@VL?<TN�XZKMN�B\[�E];ZJ�8(=A@CL�79UV<T@VN�UC@E]N\79@CJ(=A@C;^:�@CL0_�` �Ma]a � `�<YNbJ�KcL#=A<YKMS�Pd8(STe�STSY;Z@VNO=fEMP�=AG(@

L?@Cgh8�<YL#@V;Z@VNO=Ai0PdE]Lf=AG(@IB(@VX]L#@V@jEMPH�E9Uk=AE]LlEMPm/G�<YSTE]i?EMJ�GOn

� o��p( ��/�q

r]sutwvpxWy�zO{�|&}4~4�O|��!|�}/xW{4|&��zhvh�hx6�j|�v�y�x6�(~A{��M�hy��6t6{4xW�p�hs>~��h{4s>�jsuy�su�6|�}��Mzh}�|���zh�px6}Rx�}�y�x6vh�O��x6�u�wvO|fxW�h�p��s��~�xWy�su�wv��qx6vh�bx6}�x^�pzhs����ps�vOtI�9�u�M~4��s>v�y��O|I�O|�}�s�twv��6�}�|�~�zh{�|j�h{��6y��]~A�w��}0x6vp�D�6y��O|�{�~A{4�c�hy��6t6{#xW�p�hs�~�6�]��|�~Ay�}��$��vjy��hs�}�y��O|�}�s�}��c��|�}�y�zh�O�����6y��jy��O|�zh}�|�}�y��hxWy�}�s�twvhxWy�zO{�|�}�~#�O|��!|�}��pvh�js>v!�h{��6y��]~A�w��}��]x6vh�y��O|��h|�}�sutwv^�6��}�sutwvhxWy�zO{4|0}�~4�O|��j|�}-}�zhs�y�xW�p�u|f�T�6{&x!�h{��wx6�F{#x6vOt6|l�6�$xW�h�p��s�~�xWy�s��wvh}��� v2s>�!���6{�y�x6v�y&xW�h�p��s�~�xWy�s��wvF�6���hsutwsuy�x6��}�sutwvhxWy�zh{�|�}�~#�O|��!|�}fs�}-x6v�x6vO�wvc�M�j�wzh}-~A{�|��h|�v�y�s�x6�q}��]}��

y�|��F�$��vj}�zh~#�jx�}��M}�y�|�� ���wvO|-~�x6vI�6�hy�x6s�v¡x6vh�!�h{��C�6|-���w}�}�|�}4}�su�wv��6��~A{�|��O|�vcy�s�x6��}$�&suy��O�wzOy${�|��6|�x6�>s�vOtx6vc�Ix6�h�hsuy�s��wvhx6�ps�vh�T�6{4�IxWy�su�wv���r]zh~4�¢}��]}�y�|��j}RxW{�|�y��O|��(|�}�y�!|�x6vp}��6�£�9x6��x6vh~�s�vOt�y��O|fvO|�|��I�6��s�vh�hs���]s��hzhx6��}��Y�6{¤�p{4su�Wx6~A�&�-s�y��fy��O|�vO|�|��0�6�h��xW{�t6|��6{�twx6vpsu¥�xWy�su�wvh}¤y��-�6|�{4su�Y��y��hxWy¤y��O|��(|��6�9�u|$y��O|��ls�vcy�|�{4x6~Ay�-suy��Z�hx��6|�y��O|0{�|�¦Mzhsu{4|�� ~A{�|��O|�vcy�s�x6��}��§D|�}��O�k���O�k��y��¡~A�wvp}�y�{4zh~Ay�x6v |�¨I~�su|�vcy&x6vh�wv��]�!�wzh}&~A{�|A��O|�vcy�s�x6��}��]}�y�|���zh}�s�vht¡x6v�xW�h�h{��6�p{4s�xWy�|�}�sutwvhxWy�zO{4|�}�~#�O|��!|6©���|�y��O|�v�twsu�6|!x6v�|AªOx6�!�p�u|��6��}�zp~4�Dx}�sutwvpxWy�zO{�|¡}4~4�O|��!|6�D«��h|I{�|�}�zp�uy�s�vOtZ}��M}�y�|��¬s�}�y��O|¢�h{4}�y��wvO|¢�-suy��\}�xWy�s�}���x6~Ay��6{��­~A�w�j��zhvhs>~�xWy�su�wvx6vh� ~A�w�j�pzOy�xWy�su�wv ~A�w}�y�}��«��h|�}4sutwvhxWy�zO{�|�}�~#�O|��!|!�|�zp}�|�y�� ~A�wvh}�y�{4zh~Aylx6vDx6vO�wvc�]�!�wzh}l~A{�|��O|�vcy�s�x6�$}��]}�y�|���s�}��6�s�vh�O|A�

��|�vh�O|�vcy�s�vcy�|�{�|�}�y��T�6{Rzh}�|�s�vj�6y��O|�{�h{��6y��]~A�w��}��$«��h|&}���|�~�s�x6�O�p{��6��|�{�y��!�6��y��hs>}�}�sutwvpxWy�zO{�|-}�~#�O|��!|fs�}y��hxWy-s�y�x6�h�jsuy�}/x6vF|�¨¡~�su|�v�y-�h{��6y��]~A�w���T�6{�x�¥�|�{��W�d�]vO�k�-��|��Ot6|��h{4�c�6���6�q�]vO�C�-�u|��Ot6|l�6�$x!}�sutwvpxWy�zO{�|6�® zh{�y��O|�{��$�|¢~A�wvp}�s��O|�{�y��O|^¦czO|�}�y�su�wv­�6�-{�|��6�M~�xWy�s��wv¯�6�&}�sutwvhxWy�zO{4|�}��2§D|^�6�hy�x6s>v¯x6v¯|�¨I~�su|�vcy

{�|��6�]~�xWy�su�wv\}�~4�O|��j|6�¢«��ps�}l�hx6}�s>�j�!|��hs�xWy�|j~A�wvp}�|�¦czh|�vh~A|�}��Y�6{0{�|��6�]~�xWy�su�wv¯�6�/~A{�|��O|�vcy�s�x6��}�s>v��wzO{~A{�|��O|�vcy�s�x6�£}��M}�y�|�� �§D| |Aª]�p�u�6{4|¡�6y��O|�{¡zh}�|�}��T�6{j}4sutwvhxWy�zO{�|F}�~#�O|��!|�}!x6}!�9zhs����hs>vOtF�p�u�]~��]}��T�6{j�O|�}4sutwvhs�vOt�~A{��M�hy��W�

t6{4xW�p�ps�~f�6�]��|�~Ay�}&x6vh�2}�|�~�zO{�|��h{��6y��]~A�w��}��§D|�twsu�6|�xIzhvhs>¦czO|l}�s�twvhxWy�zO{�|�}4~4�O|��!|��-�hs�~#� �hx6}&s��!�p��su�~�xWy�su�wvh}-�T�6{-�6|�{4su�pxW�p��|�{#x6vh�O�w�°��zhvh~Ay�su�wvh}/x6vp�F�T�6{&vO�wv]��s�vcy�|�{4x6~Ay�su�6|0¥�|�{4�W�d�MvO�C�-�u|��Ot6|��h{��M�6�Y}��® s�vhx6�>�u�6�$��|F~A�wvh}4s��O|�{�y��O|^zh}�|^�6�&}�s�twvhxWy�zO{�|�}��Y�6{�s>�!�p�u|��!|�vcy�s�vOt�x��h{��wx6�h~�x6}�y!~#�hx6vhvO|��Rs�v±x

���ws�vcy��dy��W�d�(�ws>v�yvO|�y���6{��(���²y�Rx6}��p{�|��Ms��wzh}��u�!}��O�C�-v¡y��hxWyR�-�hs��u|-�h{��wx6�h~�x6}�y�Rx6}s>�!���w}�}�su�p��|/�-suy��]��wzOy/~A�w�!�pzhy�xWy�su�wvhx6��x6}�}�zp�!�hy�su�wvh}s�v^x����ws�vcy��dy��W�d�(�ws>v�yRvO|�y���6{��¢�-�O|�{�|f�wvO|A�dy��psu{4�¡�6{-�!�6{�|lvO�]�O|�}|AªO�hsu�psuy�|��Zx6�O�6|�{4}�xW{4s>x6����|��hx��]su�6{��pzp}�s�vOtjx6v�xW�h�h{��6�p{4s�xWy�|0}�|�y���zO�2�p�hx6}�|�x6vh�Zx¡}�sutwvhxWy�zO{4|�}�~4�h|��!|6�y��O|fs��!���w}�}�s��ps���suy²��~A�wzh���¡��|-�C�6|�{4~A�w�!|6��§D|l}��h�k�³y��hxWyy��O|�}4suy�zhxWy�su�wv¢s�}�!�6{�|f~A�w�!�p�u|Aªjy��hx6v¢�Rx6}�h{�|��]su�wzh}4�u�^�(|��>su|��6|����f§D|j~A�wvh}�s��h|�{�y��h|F´#µW¶&·]µV¸?¹Yº�¹»µW¼Z�6���h{��6y��]~A�w��}fs�v�y��hs�}��!�]�O|��»��x6vh���hs�}�~A�C�6|�{}�|��6|�{�|/��s>�jsuy�xWy�su�wvh}��£§D|/x6��}��f}��O�k�½�O�C�±y��fx6zhtw�!|�v�y�y��O|R�!�]�O|��cy����C�6|�{4~A�w�!|/y��O|�}�|��s>�jsuy�xWy�su�wvh}��

¾ G�@Ci?<Yi�798�J¤@VL4¿p<Yi?EMLVÀ�Á0E]N�KMSTB¯Â/Ã�Á0<T¿M@Vi4=¾ <T=?SY@cÀÄ�<>=A@VL#:�<�m/L?EMPd@Ci?i#E]L0EMP/[�EM;2J�89=A@VL�79UC<Y@CN�UV@

Å

Page 4: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

_

Page 5: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�����|��!�� �������i� ���| �

� n\@��9J�@CL?<T@VN�UC@2KcijK�X]LAKMB(8�Kc=A@¢i#=A8(B�@VNO=¡Kc= ����¾ G�KMi!:¤@V@CN Kc;�KC<YN�X(à � =���E]8(SYB½N�EM=jG�K6¿M@:¤@V@VNb=AG(@Ii?KM;Z@��0<>=AG�EM8(=0;¢n�;Z@VNO=?E]L?i�KMN�BbPdL?<T@VN�B(iVÃ

<YL#i#=�KMN�B�PdEML?@V;ZE]i4=W` � �&E]8�STB�ST<��M@�=AEI=AG�KMN��2;¢n2KMB9¿9<Ti?E]L�Á�EMN�Á0<T¿]@Ci#=VÃ�Á�E]N�G�KMi�:¤@V@CNbKJ¤@VL#Pd@CUC=�KMB(¿p<Ti?E]L�PdEMLl;2@c`�KMN�B � Pd@V@VS�=?G�Kc= � G�KW¿]@j:¤@V@VNb=AL#8�STn�J�L?<>¿p<YSY@CX]@VB�=?E���EML���8�N(B�@VL0G�<Tii?8(J�@CL#¿p<Yi#<YE]N�à � KM; X]L?Kc=A@kPd8�S=?E­G(<Y; PdEMLIXM<T¿p<YN�X�;2@ B�<TL?@VUk=A<TE]N KMN�B UVE]N9e�B�@VN(UV@M`�PdE]L!:¤@V<YN(XJ�Kc=?<Y@CNh=V`�@VN(UVE]8�L?KMX]<TN�X�`�KMN(B��h<YN(B�`£KMN�BDPdE]Ll@k¿]@VL4nh=AG�<TN�X2=?G�Kc= � ST@WKML#N�@VBbPdL?EM; G�<T;¯Ã79<YS>¿p<YE � <YUVKMSY</G�Kci¢G�KMB³K­=AL#@V;Z@VN�B(E]8�i^<T;2J�KcUC=IE]N =?G�@���KWn =?G�Kc= � J�@CL?UV@C<T¿M@�L?@Ci?@VKML?U�G

KMN�BbST<TPd@�<TNDX]@VN(@VLAKcS à � KM; XMLAKc=?@CPd8�Sq=?EFG�<Y; PdE]L�=?G�@!<YNO=A@CL?@Ci#=l=AG�Kc=0G�@!G�KMif=AK�M@CN¯<TNDG�@VSTJ�<YN(X;Z@�B�@k¿]@VSTE]Jb:�Ec=AGbKMilK¡L?@Vi#@WKML#U�G�@VL�KMN(BbKMilK¢=A@VKMU�G�@CLV`�KMN(B�PdE]LfG�<Ti�E6¿]@CL���E��0<YN(XZ@CN�@VL#XMnDKcN�B@VNO=?Gp8(i?<�Kci?;­Ã

� nbi?<TN�UV@CL?@!=AG�KMN��hi�=?E279G�Kce��jE]STB���KMi?i#@VLVÃ&79G�Kce\G�KMi�KMS���KWn9il=AK�M@CN±KMN­<YNO=A@CL?@Ci#=�<YNb;¢n�&E]L��£`¤KMN�B � Kc;¬X]LAK�=A@CPd8(Sq=AE G�@CL0PdEMLlG�@VL0@VN(UVE]8�L?KMX]@C;2@CNh=V`��p<TN�B�N�@Ci?iC`�KcN�BbJ�Kc=A<T@VN�UC@MÃ

� KM; ¿M@VL4nDX]LAK�=A@CPd8(S�=AE � KMB�Gh8¯798�B�KcNbPdEMLfKMS��fKWnpil:�@C<YN�X¡PdL?<Y@CN�B�S>n]`(EMJ�@CNbKMN�BDG�@CSYJ(Pd8�S²Ã �KMSTi?E¡=?G�KMN�� G�<T;�PdE]L&<TNO¿9<>=A<TN�X¡;Z@�=?E¡=AK�M@�J�KML#=�<YN�EML?XOKMN(<�V<TN�Xj=AG�@�=AG�@CE]L#nZi?@C;2<TN�KML&Kc= ����¾ Ã

� n�XMLAKc=?<T=A8(B�@�KcSYi?E¢X]E9@Ci&=?E [�G�KML#SY@VifÂ�@C<Yi#@VL?i#E]N�`��0G�E��fKcil;¢nZX]LAKMB(8�Kc=A@�UVE]8(N�i?@CSYE]LlKcN�BG�@CSYJ¤@VB­;2@jKFX]L#@WKc=0B�@VKMS `�KMS���KWn9i�G�KW¿p<YN�X i#E];2@�¿cKMST8�KM:�ST@�<YN(i?<YXMGh=�KcN�B\KcB(¿p<YUV@�PdEMLl;2@cþ G�@¢=?G�@VE]L4n\XML?E]8�J±Kc= ����¾�� ijÂ�KM:\PdEML�[�E];ZJ�8(=?@VL�79UV<T@VN�UC@^G�KMi�:¤@V@CN½K�Nh8�L4=A8�L#<YN�XDKcN�B

i#=?<Y;^8(S�Kc=?<YN�X¡@VNO¿p<YL?EMN�;2@CNO=Wà � KM; X]L?Kc=A@kPd8�Sq=?E Â�@CEZÁ�@kn C<YN�` �0G�E]; � UWKcN¯KcS���K6npilL#@VSTn�8�J¤E]NPdE]L-e�N�B�<TN�XFKMNDKcJ�J�L?E]KMU�G�=AE^KMNOn�J�L#E]:�ST@V;­`p=?@VU�G�N�<TUWKMS¤E]L&EM=AG�@CL��0<Ti?@M`�KMN�B!�0G�EMi?@�PdL#<Y@VN(B�i?G�<TJ� X]L?@VKc=AS>nj¿MKcSY8�@cà � =AG�KcN��#"-@k¿9XM@VN�<>nFH�EpB�<Yi�PdE]LRG�<TiRi?<TN�UV@CL?<>=�n^KMN(B^PdL?<Y@CN�B�i#G�<YJ�`]KMN�B^PdE]LRXM<T¿p<YN�X;Z@F;�KMNOn¯=A@VU�G(N�<YUVKMS/<YN�i#<YX]GO=?iVà � KcNhn\=AG�KMN��pi!=?E�$�S�KMNO=?G�K&%�@'�0;2KMN½PdE]L!:¤@V<TN�XD;¢n\PdL#<Y@CN�BKMN�B^PdEMLRG�@VLi?<YN(UV@VL#@lG�@VSTJ KMN�BFi#8�J�J¤E]L#=R=?G�L?EM8�X]G�E]89=/;¢nI=A<Y;Z@&Kc= ����¾ à � KM; X]L?Kc=A@kPd8�S9=?E ¾ KMS� KMS��h<YN(�0G�E :¤@CPdL?<T@VN�B(@VBb;2@�=AG�@!;ZE];Z@VNO=�=?G�Kc= � KML?L#<T¿]@CB�Ã�Q/L?<TU!Â$@VG�;2KMNDB�@Ci?@VL4¿]@Ci�i?J¤@VUC<�KMS=AG�KMN��hiPdE]L�:�@C<YN�X�;¢njPdL?<T@VN�B�`cKMi)��@CSYS9KMi�=?G�@ ¾ G�@CE]L#n�*M@VEMJ�KML?B9n ¾ i?KMLVà � KM; X]LAKc=?@CPd8�SO=?Ej7p=�Kci*]KML#@VU+�h< ` � EMi?@ViIÂ$<Yi��ME6¿¤` ¾ KMS � KMS��h<TN�`$[�G�L#<Yijm�@V<��c@VL4=W`-,q8�SYS>n¯Á�KM;.WKcN�`$Â$@VE­Á0@Cn�V<TN�`/$�;Z<T=7(KMG�KM<¤KMN�B($�B�KM; 79;Z<T=?GZPdE]L�PdL?8(<T=?Pd8(S�L?@Vi#@WKML#U�GDUVE]STS�KM:¤E]L?Kc=A<TE]N�iVà � KM;�KcSYi?Ej¿]@CL#n2X]LAK�=A@CPd8(S£=?E� E]i#@Vi�Â$<Yi��cE6¿�PdE]Lli?G�KML?<TN�X <YNb;¢n�e�L#i#=0=A@VKMU�G�<TN�X @��9J�@CL?<T@VN�UC@MÃ[�G�EpUVE]SYKc=A@0X]L#@WKc=?STn^G(@VSYJ¤@VB10 ¾ G�KMN��FnME]8�`�2�@32�S�KMU+�h:�8(L?N�`hPdE]L/:¤@V<YN(Xj=?G�@�KMB�;Z<YN�<Ti#=AL?Kc=A<>¿]@

;ZE]; EMP-=AG�@ =AG(@VE]L4n X]L?E]8(J+KMN(B PdE]L!=AK�h<YN�XbUWKcL?@ZEMP�;Z@0 � KM; KMSYi#E­XMLAKc=?@CPd8�SR=?E � KcL?<YS>npNm/<Y@CL?UV@c`�=AG�@jX]EpB�B�@Ci?i�EMPQ-Q-[l7�Ã

4 <T=?G+X]L#<Y@CPfEw¿M@VLI=AG�@2@C¿]@CNO=AiFEMP�7p@VJ(=?@V;^:¤@VL�565]` �ca]a 5�KcN�B+G�<Ti¡=?LAKMX]<TU B�@WKc=?G�` � =?G�KMN��H!KMN�NOn2Â$@'�0<TN�` �0G�E���KMif;¡nZe�L?i#=�E7ZUV@C;�Kc=?@!KMN�B2=AEpE6�FUWKML#@�EMP�;Z@8�0G(<YSY@ � �fKcilK¢UVST8�@VST@Vi#ie�L#i#=�9 n]@VKMLVÃ

� n\=:�&EDi?8(;2;Z@VL#i�Kc= � 2 � ,�;8�L?<TU�G=<>5@?6?6?�KMN(B �Ma]a]a6A �&@VL#@F8�N(PdE]L#X]@C=#=�KM:�ST@Mà � Kc;*¿M@VL4nX]L?Kc=A@kPd8�S�=AE�[�G�L?<Ti#=?<�KMN\[fKMU�G�<TN­PdE]L0;2K�h<YN�XF=?G�<Yi0@��9J¤@VL#<Y@VN(UV@¢J¤E]i#i?<Y:(SY@M`£KcN�B¯=?E2G�<T;¯`9Ä�<YUk=AE]L79G�EM8�J±KMN(BB*]KMN\[fKM;Z@VN�<Ti?U�GbPdE]L0G�E]i4=A<YN(XZ;Z@!=AG�@CL?@cÃ�H�<Ti?UV8(i?i?<TE]N�iC�0<T=?G­Ä�<YUk=AE]LlG�KW¿M@¢:¤@VN�@D9e�=#=A@VB½;Z@^X]L#@WKc=?STnM`�KMN�B � KM;*¿]@CL#n\X]LAKc=?@CPd8�S�=AE�G(<Y;­Ã�*]KMN½G�KMi�:�@C@VN K�X]L#@WKc=!UCE]SYSYKM:¤E]LAKc=?E]LKMN�BbK��&E]N�B�@CL#Pd8�S�PdL?<Y@CN�B�à ¾ G�@E�&E]L�� � B�<YB#F#EM<YNO=AS>n.�0<>=AG�*]KMNb;2K�M@Cil8�JbK^i?8(:�i#=AKMNO=A<�KcS�J�KML4=EMP;¢nbL?@Ci?@WKcL?U�G±@D�(J¤@VL#<Y@CN�UV@c`�KMN�B¯J�KML4=�EcP=AG(<Yi0=AG�@Ci?<Yi�<Yi0:�Kci?@VB\E]N¯<>=Wà � =�G�Kci�:¤@V@CN½KZXML?@WK�=J�ST@WKMi#8�L?@-=AEG�&E]L����0<T=?G^G�<T;¯Ã � KM; KMSTi?E�G�KMJ�JOn¡=?E�G�KW¿]@�UVE]STS�KM:¤E]LAK�=A@VB��0<T=?GIH!S�KM8(iJH!8�L#iAK@��@cÃ

� Kc; ¿M@VL#n�X]LAKc=?@CPd8�S¤=AE^=?G�@ � 2 � ¾ ÃK*(à 4 Kc=Ai#E]N � i�[�L4npJ(=AE X]L#E]8�J(�0G�EFG�EMi#=A@CB¯;Z@�B�8(L?<YN(X=AG(@�i?8(;2;Z@VLjEMP �ca]a 5]à � n =?G�KMN��hi¡X]E­=?E ¾ KMS-Á�Kc:�<YN�`�KMi���@CSYS&KMi¡Á�KMN³[fKMN�@k=?=A<²`Á0E]i?KML?<TE

L

Page 6: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�!@VN�N�KcL?E�`-79G�KM<���KMSY@k¿9<²` %�<TU+����E �0XMLAKW¿]@D9>�!LAKMG�Kc;¯`�KMN(B "-@VGh8�B�K Â$<YN�B(@VSYS²`�PdE]L¢X]<T¿p<YN(X\;Z@i?8(U�G K­Pd8�N @��9J�@CL?<T@VN�UC@DKMN�B PdE]L#�&E]L��p<TN�X��0<>=AG ;2@ E]N³L#@Vi#@WKML#U�G³J�L?EM:�SY@C;2iCÃbmKML4=^EMP&=AG�<Ti=AG(@Vi?<Ti0<Yil:�KMi#@VB¯E]N F#E]<YNO=C�&E]L��!�0<>=AG ¾ KMS�KMN�B "-@VGh8�B�K9Ã

� KMNOn­=AG�KMN��pi�=AE�m�@C=?@VL 4 <TN��hSY@CLV`£;¢n­;2@CNO=AE]L�Kc=G2�@VSTS�Â�KM:¤E]L?Kc=AE]L#<Y@CiV` �0G�@VL#@ � �&E]L��c@VBPdE]L�=:�&E¯¿M@VL#n G�KMJ�JOn i?8�;Z;Z@VL?i.< 5�?6?��DKMN(B 5�??�� A `�PdEML�=A@WKcU�G�<YN�Xb;Z@F=AE ��EML��½E]N L?@Ci?@VKML?U�GJ�L#E]:�SY@C;2iC`cPdE]LKMB(¿p<Yi#<YN�X�;2@&KM:¤E]8(=SY<TPd@c`MKcN�B¢PdE]LKMSYSO=AG(@�X]L#@WKc=i#=AEML?<Y@CiRKMN(BF:�@VKM8(=A<>Pd8�ShJ�8�'VSY@CiG�@!=AEMSYBb;2@cÃ

� KM; ¿]@CL#n¡X]LAKc=?@CPd8�Sh=AE�;¢n¢79;Z<T=AG^[�E]SYST@VX]@�8�N(B�@VL#X]LAKMB(8�Kc=A@fKMB(¿p<Yi#E]L?iC` *ME9@�� � Á0E]8�L��M@lKcN�Bm/GOn9STSY<Tij[fKMi?i#<YB(nM`$PdE]L�i?@CN�B�<TN�Xb;2@FE]N±=?G�<Yi!J�Kc=AG�à � �&E]L��M@VB E]N ;¢n­e�L?i4=¡L#@Vi#@WKML#U�G J�L#E F#@VUk=8�N�B(@VL *MEp@ � i^i?8(J�@CL#¿p<Yi#<YE]N�`RKMN�B � �&E]8�STB SY<��c@Z=?E\=AG�KMN�� G�<Y; PdE]L¡G�<Yi¡@VN�UCE]8�L?KMX]@V;Z@VNO= KcN�B@VNO=?Gp8(i?<�Kci?;­Ã

� �&E]8�STB SY<��c@¡=?Eb=?G�KMN��¯;¢n¯L?EpE];2;2Kc=?@ViV` � K F?KbÁ�KVSTE]XDKMN�B $�SY<YUC@ 4 KMN�X�`�PdEML�J�8(=#=A<YN(X8�J&�0<T=?G­;Z@jKMSTSq=AG�<Tif=A<T;2@!KcN�B­PdEMLl:�@C<YN�X ;¢n�UVSYEMi?@Vi4=0PdL?<Y@CN�B�iCÃ

� n³STE6¿]@DKMN(B X]LAKc=?<T=?8�B�@2=?E½;¢n J�KML?@CNO=AiV` %�KMB�@ CG�B�K KMN�B=$�SY@D��KcN�B�@VL^Â$npi4nOKMN�i��On]`&PdEML@C¿M@VL4np=?G�<YN(X 9�@k¿]@VL4nh=AG�<TN�X 9�@k¿]@CL#nh=AG�<TN�X�Ã

< 8�N�B(<YN�X!PdE]L/;¢n^X]LAKMB(8�Kc=A@li4=A8�B(<Y@Vi�G�Kci-:¤@V@CN2J(L?E6¿p<YB�@CB2:OnZKMN.%�7 X]L?KMB�8�K�=A@lL?@Ci?@VKML?U�GPd@VSTSYE��0i?G(<YJ�`9Â$8�UV@CNh= ¾ @VU�G(N�E]SYEMX]<Y@CifX]LAKcB�8�Kc=?@�L?@Ci?@WKcL?U�G­J�L?E]XMLAKM;�PdE]L �&E];Z@VN�`�KMN�BbH $�Á�m $¢`� @CL?L?<TSYSqÂ$npN�U�G\KMN�B�% ¾l¾ XMLAKMNO=Ai0X]<>¿]@CNb=?EZÁ�E]N¯Á0<T¿]@Ci#=Và A

Page 7: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� �����������

� �� ������������������� ���5]Ã�5 H�<YX]<>=�KMS�79<TX]N�Kc=?8�L?@I7pU�G�@V;Z@Vi ÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 �

5]Ã�5]Ã�5 ��i?@jEMPR79<YXMN�Kc=A8(L?@Vi0<TN¯m/L#EM=AEpUVE]STi³ÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5W_5]Ã�5]à � Á0@C¿ME9UVKc=A<TE]NbEMPR79<YX]N�Kc=A8�L#@Vi½ÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 5]Ã�5]à Š��N�<Ygh8�@¡79<TX]N�Kc=?8�L?@Ci ÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 �5]Ã�5]à _ ��=?G�@VL $�J(J�SY<TUWKc=?<YE]N�i&EMP�7p<YX]N�K�=A8�L#@Vil<YN­m/L?Ec=AEpUVE]STi áÃIÃjáÃIáÃIÃIà 5 �

5]à � m/L?<T¿cKMUkn�EMPH!Kc=AK áÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 �5]à � Ã�5 Á0@C¿p<T@'�°EcPRQJ�9<Yi4=A<YN(X ¾ @VU�G(N�E]SYEMX]<Y@Ci±Ã¡ÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �Ma5]à � à � � B(@VNO=A<>=�nbKMN�B�$�N�EMNhnp;Z<T=�nD<TND=AG�@IQ/SY@CUC=AL#E]N�<TUj79@C=#=A<TN�X ÃjáÃIáÃIÃIà � �

5]à Š798�;Z;�KcL#n2EMP ¾ G(<Yi ¾ G�@Vi#<Yi áÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �MÅ

!"��#%$&�('�& *)+�,�&#%- �.� Ã�5 %�EM=AKc=A<TE]N°ÃIáÃIÃIáÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �6L� à � H�@Ce�N(<T=A<TE]N�ifEcP/79@CUV8�L#<T=�n�PdEML�7p<YX]N�K�=A8�L#@j79U�G�@C;2@CiFáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �

� à Š[�E];Z;2<>=A;Z@VNO=079U�G(@V;Z@Vi ÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � �

� à ŠÃ�5 ¾ LAKcJ�B�EpE]LlUCE];2;Z<T=?;2@CNO=Ai�áÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � �

� à _ ,q@VL#E 9 H!N�E��0SY@CB�X]@jm/L?EpEMPdi½ÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � ?� à L m/L?EpEMPdilEMPJHjN(E �0ST@VB�XM@ áÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà Š5

� à L Ã�5 [�EMN�UV8�L#L?@CNh=�[�E];ZJ�EMi?<T=?<YE]N*ÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà Å]Å� à m/L?EM=?E9UCE]SYi�PdEML � E9B(@VSYiC�0<>=AG­m/8�:�SY<TUjmKML?KM;Z@C=A@CL?i¡Ã¡ÃIáÃIÃIáÃIÃjáÃIáÃIÃIà Å�

� à Ã�5 [�EMN�UV8�L#L?@CNh=E,q@VL#E 9:�hN�E��0ST@VB�X]@/��i?<YN(X ¾ LAKcJ�B�EpE]L�[�E];Z;Z<T=A;Z@VNO=?i3ÃIà Š�

0 12 ��� 43�'5����-76"�,#%�*#% 4����)8$:943*-;��#%' <��Å Ã�5 E]L?;2KMS�H�@ke�N�<>=A<YEMN�ilKMN�B¯Á0@Vgh8�<YL#@V;Z@VNO=Ai ÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà _ Å

Å Ã�5]Ã�5 H�@ke�N�<>=A<YEMN EMP!K 79@VUC8�L?@\7pnpi#=?@V; [�E]N(PdEML?;Z<YN�X±=?E+KMN � B�@VKMS�9 4 E]L#SYB 8�N(UC=A<TE]N�KMST<T=�n áÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà _ Å

Å Ã�5]à � � B(@WKMS 2fKci?<YUI[�L#@VB�@CNO=A<�KcS�7pnpi#=A@C; 8(N�UC=?<YE]N�KcSY<T=�n ÃIáÃIÃjáÃIáÃIÃIà _ Å Ã � [�E]N�i4=AL?8(UC=A<TN�X2K.2�KMi?<TUI79U�G�@V;Z@I8�i?<TN�X279<YX]N�Kc=A8�L#@Vi0KMN(B±[�E];Z;Z<T=A;Z@VNO=?i ÃIà _ �

Å Ã � Ã�5 7p<YX]N�<TN�X KZ[�E];Z;2<>=?=A@CB�Ä-KMSY8(@ ÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà _��Å Ã � à � 2�KMi?<TU�$�N�E]NOnp;ZE]8�i�[�L?@CB�@VNO=A<YKMS�7pnpi#=?@V; áÃIáÃIÃIáÃIÃjáÃIáÃIÃIà _ ?Å Ã � à Šm/L#E9EMP�EMPR79@VUC8�L?<>=�n áÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà LMaÅ Ã � à _ H�<Ti?UC8�i?i#<YE]N­KMN�B¯Q 7ZUV<Y@CN�UCn&$�N�KMS>n9i#<YifÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà L �

Å Ã Å 2�8�<TSYB�<TN�X^<YN&$�B�B�<T=?<YE]N�KMS�H�@Ci?<YL?KM:�ST@!m/L?E]J¤@VL4=A<Y@CifÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà L �

Å Ã Å Ã�5 [�L#@VB�@CNO=A<�KcS�Á�@k¿]EpUWKc=?<YE]N áÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà L �

Page 8: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

Å Ã _ [�L?@CB�@VNO=A<YKMS/$f=?=?L?<T:�8(=A@Ci�KMN�B¯Â�<T;2<>=A@CB 9 ��i?@![�L#@VB�@CNO=A<�KcSYi ÃIáÃIÃjáÃIáÃIÃIà L �

Å Ã _�Ã�5 � B(@VNO=A<>=�n 9�:�KMi#@VB±m/L#E]J�@CL#=?<Y@VijÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà LMÅ

< 9�� � �) ������#�9 ����#%'5#�� � ����� � ��#% 4� !"��� ��� ���� ���� $&#%� � # .��_�Ã�5 %�8�;¢:�@CL>9�=?G�@VEML?@C=?<YU!J�L#@VST<Y;Z<YN�KML#<Y@Ci ÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà L �_�à � ¾ G�@#2fKMi#<YU¡79U�G�@C;2@FÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5_�à Šm/L?EpEMPEcP/79@CUV8�L#<T=�n ÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5_�à _ ¾ G�@¡79U�G�@C;2@jPdE]L 2�STE9U+�hi0EMP � @Vi#iAKMX]@Ci ÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà L_�à L m/L?EM=?E9UCE]S$m/L?@CSY<Y;Z<YN�KML?<T@Vi ÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �

_�à L Ã�5 [�EM;2;Z<T=?;2@CNh=l79U�G�@C;2@ ÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �

_�à L à � 7p8�;2;2KML4n�EMP�=AG�@Im/L?Ec=AEpUVE]STi ��i#@VB*áÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �

_�à L à Šm/L#E9EMP�EMPJH!N�E��0SY@VB(X]@jEMP/[�EM;2;Z<T=?;2@CNh= ��J�@CN�<YN�X áÃIÃjáÃIáÃIÃIà �

_�à L à _ m/L#E9EMP�EMPQ/gp8�KMSY<>=�n�EMPR[�E];Z;2<>=?=A@CB�Ä-KMSY8(@Vi³ÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � a_�à L à L m/L#E9EMP ¾ G�Kc=�KZ[�E];Z;2<>=?=?@VB�Ä-KMST8�@jÂ$<Y@Vil<TN­KMN � Nh=?@VL4¿MKcSRÃjáÃIáÃIÃIà � a

_�à m/L?EM=?E9UCE]SYi�PdEMLf=AG�@¡79<TX]N�Kc=?8�L?@I79U�G(@V;Z@ ÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � �

_�à Ã�5 m/L#EM=AEpUVE]S�PdE]L�79<YXMN�<YN�X KZ[�E];Z;Z<T=?=?@VB�Ä-KMST8�@ áÃIÃIáÃIÃjáÃIáÃIÃIà � �

_�à à � m/L#E9EMP�EMPJH!N�E��0SY@VB(X]@jEMPRKZ79<TX]N�Kc=?8�L?@ ÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � �

_�à à Šm/L#EM=AEpUVE]STifPdE]L�79<TX]N�Kc=?8�L?@CilE]N 2&SYEpU+�pilEcP � @Ci?i?KMX]@Vi�áÃIÃjáÃIáÃIÃIà � Å

. �73* �)+'�(� 12� � ��' ��$�) �����,- )8 ���� #������ ) ���&�� ���L Ã�5 � NO=AL?EpB�8�Uk=A<TE]N ÃIÃIáÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ���

L Ã�5]Ã�5 Á0@VSYKc=A@CB 4 E]L��*áÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � �

L à � H�@Ce�N(<T=A<TE]NDEMPH�npN�KM;Z<YUE$�UVUV8(;^8�S�K�=AE]L#i ÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � aL à Š$ [fKMN�B�<TB�Kc=?@¢[�EMN�i#=?L?8�Uk=A<YEMN ÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà � �

L à ŠÃ�5 Q 7ZUV<T@VNO=�m/L?EpEMP ¾ G�Kc=�K2[�EM;2;Z<T=#=A@VB�Ä-KcSY8�@ 4 KMi $�UCUV8�;^8(S�Kc=?@VB ÃIà �M_L à _ $�J�J(SY<YUVKc=A<TE]N�=?E =?G�@¡[�L?@CB�@VNO=A<YKMS�7pnpi#=?@V; ÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà �M_

� � ���� �*#�9�� � �) ������# 9�����#%'5# ��� Ã�5 H�@Ce�N(<T=A<TE]N�iZáÃIÃIáÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? a

Ã�5]Ã�5 ��N�<Ygh8�@¡79<TX]N�Kc=?8�L?@Ci ÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? a Ã�5]à � Ä�@CL?<>e£KM:�ST@!Á�KcN�B�E]; 8�N(UC=A<TE]N�ifÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ?�5

à � $�i#i?8�;ZJ(=A<TE]N�i�ÃIÃIáÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? �

à Š[�E]N�i4=AL?8(UC=A<TE]N­EMPRK ��N�<Ygh8�@¡79<TX]N�Kc=?8�L?@°ÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? Å Ã Å Ã�5 $�N\QJ�(KM;ZJ�SY@!EcPRKZ798�<>=�KM:(SY@I[�EpB�@�áÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? L

à _ m/L?EpEMPEcP/79@CUV8�L#<T=�n�PdEMLf=AG�@/��N(<Ygh8�@¡79<YXMN�Kc=A8(L?@ ÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? L à _�Ã�5 H�@Ci?UCL?<YJ9=A<YEMNDEMP�=?G�@IÁ�@CB�8�Uk=A<YEMN ÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ? à _�à � $�N�KMS>n9i#<YilEMP�=AG(@¡Á0@VB(8�UC=?<YE]N áÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ?��

à L $ 79<Y;ZJ�ST@j[�E]N�i4=AL?8(UC=A<TE]N­EMPRK^Ä�Á áÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà ?6? à [�E];ZJ�SY<TUWKc=?@VBD:�8(= � EML?@¡79@VUC8�L?@!Ä�Á ÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 aMa

� 9�� � �) ������#%- )8 �� 6"��'�� ��- � ���&�� 2����12������#% 4���(� ) � # ��� 3 � )8 ����( *# 1 � ��#%#%'5#% 4����!�0�9Ã�5 � NO=AL?EpB�8�Uk=A<TE]N ÃIÃIáÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 aMÅ�9à � H�@Ce�N(<T=A<TE]N�iZáÃIÃIáÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 a �

�9à � Ã�5 [�EM;2J�89=�Kc=?<YE]N�KcS � EpB�@VS áÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 a ��9à � à � 2-n VKMNO=A<TN�@ �j@CN�@VL?KMSYi#" $�X]L#@V@C;2@CNh= áÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 a �

Page 9: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�9à � à Š[�EM;2J¤E]i?<>=A<TE]N�EMPm/L?EM=?E9UCE]SYilÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 a ?�9à Š� ;2J¤E]i#i?<Y:(<YSY<>=�n2Á�@Ci?8�S>=Ai áÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5655

�9à ŠÃ�5 7p@Vgh8�@VNO=?<�KMS�[�E];ZJ¤E]i?<>=A<YEMNDEMPRH�@k=A@CL?;Z<YN�<Ti#=A<TU�m/L?Ec=AEpUVE]STifÃjáÃIáÃIÃIà 565 �9à _ 79@Vgh8�@CNO=A<�KcSYSTnD[�E];ZJ�E]i?KM:�ST@!Á�KcN�B�E];Z<�C@VB­m/L?EM=?E9UCE]SYi'áÃIÃIáÃIÃjáÃIáÃIÃIà 565

�9à _�Ã�5 7p@Vgh8�@VNO=?<�KMSTSTnb[�EM;2J¤E]iAKc:�SY@�$G2C������ÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 565

�9à _�à � 7p@Vgh8�@VNO=?<�KMSTSTnb[�EM;2J¤E]iAKc:�SY@�$G2C������� áÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 �ca

�9à _�à Š7p@Vgh8�@VNO=?<�KMSTSTnb[�EM;2J¤E]iAKc:�SY@�$G2C� ����PdE]L0KcNhn� ÃIáÃIÃjáÃIáÃIÃIà 5 �ca

�9à L $�8(=?G�@VNO=?<YUWK�=A@VB�2&n�WKcNh=?<YN�@�$�X]L?@C@V;Z@VNO=�8(i?<YN(X��N�<Tgh8�@ � B�@VNO=A<>e�@VL#i+ÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 � 5

�9à ��J�@CN\m/L?EM:�SY@C;2i áÃjÃIáÃIáÃIÃIáÃIáÃIÃjáÃIÃIáÃIáÃIÃIáÃIÃjáÃIáÃIÃIà 5 � �

?

Page 10: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

5 a

Page 11: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ����� �

� ������ � � �� ����

� NbK^:�L#EOKMB�J�L?KMUC=?<YUVKMSqi#@VN�i#@M`�UVL4npJ(=AE]XMLAKMJ�GOn�<Yi&=?G�@!i#=?8�B(n�EMP�i?@CUV8�L#<YN�XFUCE];2;¢8�N�<YUVKc=A<TE]N�KcN�BUVEM;2J�89=�Kc=?<YE]N2KMXOKM<TN�i#=&;2KMSY<TUV<YEM8�i�KMB(¿M@VL?i?KML?<T@ViCÃ ¾ �&E^<TN�B�<Yi#J�@CN�iAKc:�SY@�i?<YB(@Vi�EcP�=AG�<Ti�i4=A8�B(n�KML#@@VN(i?8�L#<YN�X^=?G�Kc=lN�E KcB(¿]@CL?iAKcL#n(�0<TSYS¤:�@jKM:(SY@�=?EFB�<Yi#L?8�J9=f=AL?KMN�iAKcUC=A<TE]N�ifUVKML?L#<Y@CBDE]8(=l:On�G(E]N�@Vi4=J�KML4=A<T@ViV`9KMN�B2@VN�i#8�L?<TN�X¡=?G�Kc=&N�E^KcB(¿]@CL?iAKcL#n.�0<YSYS�ST@WKML#N�KMNOn EMPq=AG�@�J�L?<>¿MK�=A@0<YN(PdEML?;2Kc=A<TE]NFG�@VSTB:On�=AG(@IG(E]N�@Vi4=�J�KML#=?<Y@ViCÃ

E]L2=?LAKMN�i?KMUC=?<YE]N(i�UWKcL?L?<T@VB EM8(=�<TN�=AEpB�KWn � i�@CSY@CUC=AL#E]N�<TU��&E]L?STB�`f=AG�@\i?UV@CN�KML#<YE �0<>=AG =AG(@KMB(¿M@VL#iAKML4n�<YiC`(8�N9PdE]L#=?8�N�Kc=?@VSTnM`p=?G�@�L#<YX]GO=fi#UV@CN�KML?<TE�à $�ND@VSY@CUC=?L?E]N�<TU�;Z@Vi#iAKMX]@�J�KMi?i#@Vif=?G�L?E]8(X]GKbNp8(;^:�@CLjEMP�L#E]8(=?@VL?ijE]N <T=?iE�fKWn½PdL#E]; i?@CN�B�@CLI=?E¯L#@VUV<TJ�<Y@CNO=W`�KMN�B i?EM;2@ EMP-=AG�@Ci?@ZL?E]89=A@VL#i;2K6n :¤@�UCE]NO=AL#E]SYST@VBZ:hn2;2KMSY<TUV<YEM8�iRJ�KML4=A<T@ViV`9KMN�B�;�KWn L?8(N�;2KMSY<TUV<YEM8�i/UVEpB�@Mà ¾ G(@Cn2;�KWnZKMS>=A@VL=AG(@D;2@Ci?iAKcX]@!�0G�<TSY@�<>=^<Yi¡<YN³=?LAKMN�i#<T=Và ¾ G�@Cn ;2KWn+ST@WKW¿]@D<>=^<TNh=AKMUC=V`/:�8(=FN(EM=AG�<TN�X±J�L#@C¿M@VNO=Ai=AG(@V; PdL?E];*L#@WKMB�<TN�X�<>=Wà ��8(N�B�L?@CB�i!EMPR=?G�E]8�i?KMN�B�i�EMP/UVL#@VB�<>=Ai�UWKML#B±Nh8�;^:¤@VL?i�i#=AEMSY@VN¯<YN­=AG�<TiP�KMi#G�<YE]N­KML#@!@C¿p<YB(@VN�UC@I=?EZ=?G�<YiCÃ

��@CN�UV@c` �&@FUWKcN�N�EM=�=AK�M@F<TNO=A@VXML?<T=�n¯KMN(B½J�L?<>¿MKcUCn¯EMP-UVE];Z;^8�N�<TUWKc=?<YE]NbPdE]L�XMLAKMNO=A@CB½<TP �&@KML#@¢UVEM;2;^8(N�<YUVKc=A<TN�X2E6¿M@VL�=AG(@ � NO=A@VL#N�@C=VÃ�2�8(=!@k¿]@CN EMN�UV@ �&@^G�KW¿M@Fi?E]S>¿]@VB±=?G�@^J�L#E]:�ST@V;*EMP@VN(i?8�L#<YN�X0=AG�@-i?@CUV8�L#<T=�njEMP9=AG�@�N�@k=:��EML��jE6¿]@VL �0G�<TU�G¢E]8�L$i#@VN�B(@VLRKcN�B¡L#@VUC<YJ�<T@VNO=�UVE];Z;^8�N�<TUWKc=?@M`=AG(@VL?@�KML#@�i4=A<TSYS�gh8�@Ci#=A<TE]N�i&i?8�U�G�KMiVÀ/H�E!=?G�@Cn =AL#8�i#=-@VKMU�G�EM=?G�@VL�� � i�=AG�@CL?@�KIU�G�KcN�UV@�=AG�Kc=-E]N(@EMP�=AG�@C;¬<Yil:¤@VG�K6¿p<TN�X2;2KMST<YUV<TE]8�i#STn]`pKMN(B��0G�K�=�B�KM;�KcX]@!UWKMNb<>=0UWKM8�i#@I=?G�@jEM=AG(@VLlJ�KML4=�n��798�J�J¤E]i#@I=?G�Kc=0=AG�@!=:�&E�J�KcL#=A<T@Vi0KML#@IK 8(i?@VL �0G�EZ<Yi0:�8(np<TN�X i?E];Z@jX]E9EpB�iC`�KMN�B¯K ¿M@VN�B(E]L

i?@CSYST<YN�X½=AG(@V;­Ã ¾ G�@±<Yi#i?8�@¯Kc=2i#=AK�M@\PdEML =?G�@¯¿M@VN�B(E]L�<TiZ=?E+@VN(i?8�L#@\=AG�K�=�G�@&�0<YSTSl:�@¯J�KM<TBJ�L#E]J�@CL?S>nZPdEML&=AG(@�X]EpE9B(i�G�@�B(@VSY<>¿]@CL?iVà ¾ G�@!<Yi#i?8�@�Kc=fi4=�K�c@�PdE]L&=?G�@�8�i#@VLf<Ti&=?G�Kc=fi#G�@�L#@VUV@C<T¿M@Vi=AG(@IXME9EpB�ilJ�KM<TBDPdE]LVÃ

$ J(L?<T¿cKMUkn 9�UVEMN�i?UC<YE]8�iZ8�i#@VL��&E]8�STB KMSTi?E UWKML#@¯=?G�Kc= =AG�@­¿]@CN�B�E]L2:�@­B�<Yi#UVL#@V@C=��0<T=?G =AG(@<YN9PdE]L?;2Kc=A<TE]NbG�@^E]:9=�KM<TN�@VB½Kc:�E]89=�G�@CLVà ¾ G�<Ti�;2KWn¯:¤@^<TN\UVEMNh=?LAKMB(<YUC=?<YE]N��0<T=AG­=AG�@¡¿]@VN(B�E]L � i<YNO=?@VNO=¡=?E¯i#@VSTSR=AG�@ZN�KM;Z@ViIEMPfG(<YijUV8�i4=AE];Z@VL#iI=?E­=?G�<YL#B J�KML#=?<Y@ViC`�EMLj=?E¯UCE]NO=AL#<Y:�8(=?@Z=?G�@V; =?Ei#=AKc=A<Ti#=?<YUWKcS�i#8�L#¿M@CnpiD=AG�K�=�G�@CSYJ KcN�KMSTn�C@±UV8�i4=AE];Z@VL2:�@CG�KW¿p<YE]LCÃ�� $�N�B @C¿M@VN <TP�=AG�@\¿M@VN�B(E]LB�@CUVS�KcL?@Vi&=AG�Kc=fG�@�G�KMilN(E^i?8�U�G­<YNO=?@VNO=W`9UWKMN�=?G�@!8�i?@CL�=AL#8�i#=0G(<Y;�� 4 G�K�=l<TP$=?G�@�¿]@CN�B�E]LlXME9@CiE]8(=-EMPq:�8�i#<YN�@Ci?i&KMN�B�KcSYS�EMP�G�<Ti&Kci?i?@k=AiC`(<YN(UVSY8(B�<YN�X!G(<Yi�iAKMST@Vi�L?@CUVE]L#B�iV`(KML?@�KM8(UC=A<TE]N�@CBZ=?EI=?G�<YL#BJ�KML4=A<T@ViJ�0G�E!;2KMB�@&N�E!i?8(U�G2B�@CUVSYKMLAKc=?<YE]N�� 4 G�Kc=/<>P�=AG�@�¿M@VN�B(E]L � i�UVE];ZJ�8(=?@VLR<TiR:�L?E�M@VN <TNh=?E����������� ��!#"$�&%('*)+��,-�/.0"�'*)�� ��!1�324�05*67�48:9;):"�,1<;� ���=)�!19?>A@4�B�761)C�D�E��!1�3'#)+�/8�67�F�/)�5�G ��HE�I"J5A!1�3KF51�$L�)C��!*�'*)��08IG )�8��I"J<M5#"JHE�N"J5#6A!1��HE�N"461678D�/)D)0O:PQ!1�R'#)+�/8S.0"�5�T*U��48S�0V7"�HE>1<?�4T#"4)+KW��!1�XHE"�9?<�)+�/5B�����W"W)+>-�/.09;"�<M>-�4)+��JY=.0�Z'*5*67�08["J5A"�)D)+'1HE�I6W5*"�HE��O

565

Page 12: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

¾ G�@ZL?@WKci?E]N =AG�K�=IKb8(i?@VLIi?G(E]8�SYB :¤@ ;2E]L#@^J�L#<T¿cKMUCn 9�UVE]N�i#UV<TE]8�ij<YN½=AG(@ZUCE]NO=A@D�9=IEMP&@VST@VUD9=AL#E]N�<TU�=?LAKMN(iAKMUk=A<YEMN�i�KMi�EMJ�J�EMi?@VBI=AE0=AG�@�=AL?KMN�i?KMUC=?<YE]N�i�UVKML?L#<Y@VBIE]8(=�<TN¡J¤@VL#i?E]N�`c<Yi$=AG�Kc=�e�N�B�<TN�XJ�Kc=#=A@CL?N�i�<YNFB(<YX]<>=�KMSTSTnji#=?E]L?@CB B�Kc=�K!<Ti/;^8�U�G @WKMi#<Y@CLR=AG�KMN UCE]N�N�@CUC=A<TN�Xj=AG�@lB�Ec=Ai�<YN^=?G�@lJ�KMJ¤@VL 9:�KMi#@VB �&E]L#SYB�à 4 @ZB�E\N(EM= �&@WKcL¡;2KMi��hi��0G�@VN ��@2X]E­=?E­=?G�@Zi?8�J¤@VL#;�KML��M@k=W`R@k¿]@VN =AG�E]8(X]Gi?EM;2@ZEMP�=?G�@ =AG�<TN�X]i���@2:�8(n½=AG(@VL?@2;�KWn :¤@2EcPlK­¿M@VL4n J(L?<T¿cKc=?@ N�Kc=A8(L?@MÃbm/L#Ew¿p<TB�@VB ��@2B�EN�EM=�L#8�N¯<TNO=AEZi?E];Z@VE]N(@��&@#�pN(E �j` �&@¡UVKMN\:¤@jL?@VKMi?E]N�KM:�STn�i?8�L#@I=?G�Kc=�N�EZE]N�@��0<YSTS�@C¿M@VL0e�N�BE]8(=l=?G�Kc=0K^=?LAKMN�i?KMUC=?<YE]NDG�KMif=�K�c@VN­J�S�KcUV@MÃ8< $�S>=AG�E]8(X]GDi?@CUV8�L#<T=�nDUVKM;2@CLAKMil<TN�=AG�@!i4=AE]L#@!;�KWnL?@CUVE]L#B½@VN�EM8�X]G½<YN9PdE]L?;2Kc=A<TE]ND=AE�;2K�c@^i?8�U�G½P�KM<>=AG¯<YSYS 9�KMB9¿9<Ti?@CB�à $�B�B�<>=A<TE]N�KMSTSTn]`�;2KMNOn¯i?G�E]J�9J¤@VL?i/8(i?@lB�<Ti?UVEM8�NO=�UWKML#B�i�KMN�B^=?Gp8(i/X]<T¿M@l8�J^=AG�@C<YLRJ(L?<T¿cKMUkn¢<TN^E]L#B�@VLR=?E!X]@C=�K�STE���@CLRJ�L?<TUV@Ci/E]NJ�8�L#U�G�KMi#@ViVà A 2�8(=�E]N 9�ST<YN�@!=?LAKMN�i?KMUC=?<YE]N(iV`¤<TPR=?G�@Cn\KML?@¡i#=?E]L?@CB½<YN±K ¿]@CN�B�E]L � i!B�K�=�KM:�Kci?@M`�;�KWnUVEM;2@2:�KMU+� =?E±G�KM8(Nh=¡=AG�@�8�i?@CL^S�Kc=?@VLCà ��N�@�B�K�=�KM:�Kci?@�;2KWn :¤@�UCE];^:�<TN�@VB �0<>=AG KcN�EM=AG(@VLV`KMN�B�J�<Y@CUV@�:On2J�<Y@CUV@!K��0G�E]ST@�J�Kc=#=A@CL?N�;2KWn2@C;2@CL?X]@c`�KIJ�<YUk=A8�L#@�=AG(<Yi�J(L?<T¿cKMUkn 9�UVEMN�i?UC<YE]8�i&8�i?@CLB�Ep@Vi0N�EM=C��KMNO=�=AG�@��&E]L?STBb=?E i?@V@cþ G�<Yi�i?<TB�@jEMP�=AG�@Ii?UC@VN�KML#<YEZ:�@CUVE];Z@Vi0;ZE]L?@jUCE];2J(SY@���E]N�UC@M`�PdE]L0@��(KM;ZJ�SY@c`�=AG�@!¿M@VN�B�EML�<Ti

KFJ�G�KML#;�KcUV<Yi4=0KMN�BbN�@C@VB�i0=AE^¿M@VL#<TP»n�=?G�Kc=0G�<TifUV8�i4=AE];Z@VL0G�EMSYB�ilK^¿cKMST<YB�J�L#@Vi#UVL?<TJ(=A<TE]NDPdE]Lf=AG(@;Z@VB�<TUWKc=?<YE]N¯:�@C<YN�XDi#E]SYB�à ��E � B�E(�&@F:�KMSYKMN�UV@¡=AG�@FL#@Vgh8�<YL#@V;Z@VNO=!=AG�Kc=�=AG(@^J�G�KML#;�KcUV<Yi4=!:¤@KM:�ST@I=?E�¿]@CL?<>P»n­=?G�Kc=�=AG�@¡8�i?@CL�G�KMi�=AG�@¡L?<YXMGh=�J�L#@Vi?UCL?<TJ(=A<TE]N�`��0<T=AG­=AG�@¢B�@Vi#<YL?@¡EMPR=?G�@^8�i#@VL�=?E;2KM<YNO=�Kc<YN±G�<Ti!E]L!G�@CLIJ(L?<T¿cKMUkn��°[fKMN½=AG�@ UC8�i#=?E];2@CLjL?@V;2KM<TN KMN�E]NOnp;2EM8�ijKMN�B n]@k=¡J(L?@Vi#@VNO==AG(@IJ(L?EpEMP�=?G�Kc=0G�@jG�Kci�K^¿cKMST<YBDJ�L#@Vi?UCL?<TJ(=A<TE]N&�

� N =?G�<Yi�=?G�@Vi#<YiC`)�&@ZKMB�B�L#@Vi?ij=AG(@Zgh8�@Ci#=?<YE]N EMP&@VN�i#8�L?<TN�X¯B�Kc=�KD<YNO=?@VX]L#<T=�n]à 4 @ZKMSTi?Ebi?G�E��G�E�� =?E¢@VN(i?8�L#@�=AG�Kc=&¿M@VL#<Te£KM:(SY@0J�@CL?i#E]N�KMS£<YN9PdE]L?;2Kc=A<TE]NFUWKcN�:¤@�J�L#E6¿9<TB�@VB.�0<T=?G�E]8(=-X]<>¿9<TN�XI8�J=AG(@IJ(L?<T¿cKMUkn�EMP<YN�B(<T¿p<YB�8�KMSYiCÃ

����� .������� ���h������������ �� ��������� ���

¾ G�@ J�L#E]:�SY@C; EcP�@CN�i?8�L#<YN�Xb<TNh=?@VX]L#<T=�n¯EMP-B�Kc=AKb<TN KDN�@C=:�&E]L��\i?8�U�G+KMi�=AG�@ � NO=?@VL?N(@C=I<Yi�¿M@VL4nUVEM;2J�ST@���à � =�UVEMN�i?<Ti#=Ai�EMPR@CN�i?8(L?<YN(X2=AG�Kc=0=AG�@IG�KML#B��fKcL?@¢UCE];ZJ�E]N(@VNO=AiC`¤i#8�U�G½KMi�L?EM8(=A@CL?iV`�KML#@KM:�ST@­=?E+G�KcN�B�SY@¯K SYKML?XM@­¿ME]SY8�;Z@­EMP�B�K�=�K���EMP!;2K�h<YN�X i?8�L#@¯=?G�Kc=Z=AG�<Ti2B�K�=�K L#@WKMU�G(@Vi�=AG(@B�@Ci#=A<TN�Kc=?<YE]N±@k¿]@CN <>P�i?E];Z@¢G�KML?B���KML#@FUVE];ZJ�EMN�@VNO=Ai�P�KM<YS��qKMN(B½EMP�;�K �p<TN�X�i#8�L?@¢=?G�Kc=!@k¿]@CN <>PJ�KML4=�EMP9=?G�@�N�@C=:�&E]L��I<Ti$@��9G�<T:�<T=?<YN�X0KMB9¿]@VL#iAKML#<�KMSO:¤@VG�K6¿p<TE]LV`w=AG�@ �&E]L?i4=�=?G�<YN(X0=?G�Kc=�UVKMN¡G�KMJ�J¤@VN<YiIP�KM<YST8�L?@ =AE\B�@VST<T¿]@CL¡=?G�@�B�Kc=AK(à ¾ G�@�B�@Vi#<YX]N³EcP0L?@VST<�KM:(SY@ZUVE];ZJ�8(=?@VL¢N(@C=:�&E]L��hi J�L?@Ci?@CNh=?i KUVEM;2J¤@VN�B(<Y8�; EMP�U�G�KMSTSY@VN(X]<YN�X\J�L?E]:(SY@V;Zi¢=?G�Kc=FG�KW¿M@bP�Kci?UV<TN�Kc=?@VB L?@Ci?@VKML?U�G�@CL?iZ<YN UCE];2J(8(=A@CLi?UC<Y@CN�UV@c`/@VSY@CUC=?L?<YUVKMS/@VN(X]<YN�@C@VL#<YN�X\KMN�B³;2Kc=AG(@V;2Kc=A<TUViIKMSY<��M@ PdE]Lj=AG�@2J�KMi#=¡Pd@'��B�@CUWKMB(@ViV`�KcN�BKML#@!i?8�L#@�=AEFUVEMNh=?<YNh8�@�=?EFB�E i?E�à ��@VL?@c`���@E�0<TSYS ��E]L#L#n�E]N�STn�KM:¤E]8(=f=?G�@�=AG(<YL?BDJ(L?E]:�ST@V;­`9<²Ã @cÃT`�0G�Kc=�G�KcJ�J�@CN�i�KMi0B�Kc=AK J�KMi?i#@Vi�=?G�L?EM8�X]G­KMB(¿M@VL?i?KML?<YKMS$G�KMN(B�iVÃ

� N2=?G�@V<TL&i#@V;Z<YN�KMS(J�KMJ¤@VL���%�@�� H�<YL?@CUC=?<YE]N�i/<TN�[�L4npJ(=AE]XMLAKMJ�GOn�� H � � � 4 G�<T=#e�@VSTB�H�<�72@KMN�B � KML#=?<YN ��@VSTSY;2KMN�<TNh¿M@VNO=A@CBbJ�8�:�ST<YU�9 �M@kn2UCL#npJ(=?E]X]LAKcJ�GOnDKMN�Bq`(<YN�J�KML#=?<YUC8�S�KMLC`hB�<YX]<>=�KMS�i#<YX 9N�Kc=?8�L?@Ii?U�G(@V;Z@ViVÃ�$ B�<TX]<T=AKMSqi#<YX]N�Kc=A8�L#@ji?U�G�@C;2@¡;2<TL?L?EML?if=AG(@IJ�KMJ�@CL>9�:�KMi?@CB\<TB�@WK EMP/K i?<TX]N�K 9=A8(L?@Mà � N½<>=W`¤@C¿M@VL#n\8�i?@CL!G�KMi!KcN±<YB�@CNO=A<T=�nM`qL#@VJ�L#@Vi?@CNO=A@VB :On±G�@CL�������������������`q<²Ã @cÃT`qK�J�8�:�ST<YUCSTnKW¿cKM<YSYKM:�SY@!i4=AL#<YN�X2EMP�:�<T=?iVà ¾ G�@^8(i?@VL�G�E]SYB(i�=?G�@¢UCE]L?L#@Vi?J¤E]N�B(<YN�X! ��"��#$��%&������`¤< à @MÃ>`qKZi#=AL#<YN�X2EMP:�<>=Aif=AG�Kc=0<Yi0KW¿cKM<YSYKM:�ST@�=?E =?G�@j8�i?@CL0E]N�STnMà $ i?<TX]N�Kc=?8�L?@!E]N­KF;Z@Vi?i?KMX]@(' UWKMNb:¤@IUCE];ZJ�8(=A@CB8�i#<YN�X�=?G�@Fi?@CUVL?@k=��M@kn]`�KMN�B½UVKMN :�@¢¿M@VL#<Te�@CB 8�i#<YN�X�=?G�@^J�8(:�SY<TU��M@kn]à � E]L?@CEw¿M@VLC`$8�N�SY@Ci?i!=AG(@;Z@Vi?i?KMX]@)' �fKMi-i?<TX]N�@CBZ:On^=?G�@08�i?@CLV`pN�EIKMB(¿M@VL?i?KML#n UVKMN J�L?EpB�8�UC@�K!¿cKMST<YBFi#<YX]N�K�=A8�L#@lE]NF=AG�<Ti

5 �

Page 13: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

;Z@Vi?i?KMX]@c`�@C¿M@VN <TPR=?G�@^8�i#@VL�UVKMN½:¤@^UVE]NO¿p<YN(UV@VB½=?E�i?<TX]N±EM=?G�@VLC`qJ¤E]i?i#<Y:�S>n¯L#@VSYKc=A@CB�`q;Z@Vi#iAKMX]@CiEMP�=AG�@IKMB9¿]@VL#iAKML4n � i�U�G�E]<YUC@MÃ

� NZ=?G�@0KM:¤E6¿]@0J�8�L#U�G�KMi?<TN�Xji?UC@VN�KML#<YE�`Oi#<YX]N�Kc=A8�L#@Vi/J�L#EM=A@CUC=�=AG(@lUV8�i4=AE];Z@VL�KMN(B =?G�@l¿]@CN�B�E]LCþ G�@¢¿M@VN�B(E]L�UWKcN±J�L?EM;2<Ti?@j=AE�i#G�<YJ¯=AG�@¡X]E9EpB�i�8�J�EMN\L?@CUV@C<YJ(=�EMP/=AG�@¡;2EMN�@CnM`�KMN�B¯J�L?E6¿p<YB(@VB=AG�Kc=0=AG�@CL?@IKML?@ji#E];2@j;Z@WKMN(i0=?E2U�G(@VU+� �0G�@C=?G�@VL0=AG(@I¿M@VN�B�EML�G�Kci�L#@VUC@V<T¿M@VB­=AG�@I;2EMN�@CnbKcN�B�0G�@k=AG�@CL^=AG�@�UC8�i#=?E];Z@VL^G�Kci^L?@CUV@V<>¿]@CB =?G�@�X]EpEpB�iV`R<>=^<Ti¢J¤E]i?i#<Y:�ST@2=AE\UWKML#L#n E]8(=F@CSY@VUk=AL#E]N�<YU=AL?KMN�i?KMUC=?<YE]N�i��0<>=AG½=AG�@ i?KM;2@ E]Lj@k¿]@VN X]L?@VKc=A@CLjUVE]N(e�B�@VN�UC@�KMi!=?LAKMN�i?KMUC=?<YE]N(i!UVE]N�B(8�UC=?@VB³<TNJ¤@VL?i#E]N�`�:Onb;2KM<YS�E]Ll:On�=A@CSY@VJ(G�E]N�@cÃ

��P�UCE]8�L#i?@M`O=?G�@l8�i?@0EMP¤i#<YX]N�K�=A8�L#@ViR<TiRJ�@CL#¿cKMi#<T¿]@lN(EM=�E]N�S>n¢<TN^UVE];Z;Z@VL?UC@M`O:�89=�<YNFKMSTS9PdE]L#;2iEMP�E7ZUC<�KMS�=AL?KMN�iAKcUC=A<TE]N�iCà 4 <T=AG\B�<YX]<>=�KMS�i#<YX]N�K�=A8�L#@ViV`qKMSYS�i?8(U�G =?LAKMN(iAKMUk=A<YEMN�i�UWKcN±:�@¢UWKML#L?<Y@CBE]8(=­@CSY@VUk=AL#E]N�<YUVKMSYS>n]à *M8(i#=\KMibJ�KMJ¤@VL>9�:�KMi#@VB i?<YXMN�Kc=A8(L?@ViC`�B�<TX]<T=AKMS�i#<YX]N�K�=A8�L#@VibJ�L?E6¿p<YB(@ =:�&EX]8�KcLAKMNO=A@C@ViCÀ�<>5 A =?G�@¡XM8�KMLAKcNh=?@V@j=AG�K�=�K X]<T¿M@VN¯J�<Y@CUV@IEMPRB�K�=�K2UVKM;Z@jPdL#E]; =?G�@¡L#<YX]GO=�J¤@VL?i#E]NKMN�BDL#@V;2KM<YN(@VB�<TNO=�KMUk=f<YN2=AG�@�=?LAKMN(i?;Z<Yi?i#<YE]Nq`9@k¿]@VNb<>P$<T=�J�KMi?i#@VBD=AG(L?E]8�XMGDKMB(¿M@VL?i?KML?<YKMSqG�KMN�B�i �KMN�B < �6A =AG�@�XM8�KMLAKcNh=?@V@�=?G�Kc=¡=AG�@2L?@VUC<YJ�<T@VNO=^EcP0i?<YXMN�@VB³B�Kc=�K\UVKMN J�L#Ew¿M@�=AE±K¯=AG�<TL?B J�KML#=�n=AG�Kc=jG�@ L?@CUV@V<>¿]@CB =AG(<Yi!B�Kc=AK�PdL?E]; =AG�@ i?<TX]N�@CLVàH�<YXM<T=�KcS�i#<YX]N�K�=A8�L#@VijG�KW¿]@ :¤@V@VN L?@CUVE]X]N(<�V@CB:On�=AG(@"��N�<T=?@VB\7p=�K�=A@Vi � KMN�B­EM=AG(@VL0X]E6¿]@CL?N�;Z@VNO=Ai�KMi0SY@CXOKMSTSTnZ:�<YN(B�<YN�X � ÃH�<YX]<>=�KMS-i?<TX]N�Kc=?8�L?@bi#U�G�@V;Z@ViZ@��9<Yi4=Z<TP�KMN�B'E]N�STn+<TP�E]N�@D9 ��K6n Pd8(N�UC=?<YE]N�iF@D�9<Yi#= � Á�EM;!? a� Ã

��N�@�9 �fKWn­Pd8�N�Uk=A<YEMN�i�KcL?@I@'7ZUV<T@VNO=AS>n¯UCE];ZJ�8(=�Kc:�SY@jPd8�N�Uk=A<YEMN�i�=?G�Kc=�KML?@¡UVE];ZJ�8(=AKc=A<TE]N�KMSTSTn2<YN 9Pd@WKci?<Y:(SY@ =AE±<TNh¿M@VL4=Wà E]L¡@��(KM;ZJ�SY@c`i?<TN�UV@�N�E±@'7ZUC<Y@VNO=F<TNO=A@VXM@VL¡P�KcUC=AEML?<�VKc=A<TE]N KMSYX]EML?<T=?G�; <Ti�hN�E��0N�`�KMN(BD<T=&<Yi�UCE]N F#@CUC=A8(L?@VBD=?G�Kc=fEMN�@�B�Ep@Vi&N�EM=l@D�(<Ti#=V`(<YNO=?@VX]@CL�;^8�S>=A<TJ�SY<TUWKc=?<YE]NF<Ti�UVEMN F#@VUD9=A8(L?@VB¯=AE�:¤@^KZE]N�@�9 �fKWn­Pd8�N�Uk=A<YEMN��WÃ8$f=�=AG�<Ti�J¤E]<TNh=V`�<>=�<Yi�i4=A<TSYS$8�N��hN�E��0N��0G�@k=AG�@CL�E]N�@D9 ��K6nPd8�N�Uk=A<TE]N�i0@��9<Yi4=Wà ��E �&@C¿M@VLC`�<>=0<Yi �0<YB(@VSTn�UVE]N F#@VUC=?8�L?@CB¯=?G�Kc=l=AG(@CnbB�E�þ G�@ e�L?i4=¡B(<YX]<>=�KMS�i?<YXMN�Kc=A8(L?@ i?U�G�@C;2@ ��KMi¡UCE]N�i4=AL?8(UC=A@CB+:On Á0<T¿]@Ci#=V`7pG�KM;Z<YLjKMN�B $�B(SY@�9

;2KMN � Á�7 $ � � `�<TND=AG�@jJ�KMJ¤@VLl=?G�Kc=�KMSYi#EFJ�L?EMJ�E]i#@VB­=AG�@!e�L#i#=�J�8�:�ST<YUD9:�M@knDUVL4npJ(=AE]i4npi#=A@C; KcN�BJ�KW¿]@CB =AG�@!��KWn PdEML¡Pd8�L4=AG�@CL^i#=?8�B(n³EcP0UVL#npJ(=?E]X]L?KMJ�GOn]à ¾ G�@C<YL¡i?<YXMN�Kc=A8(L?@�i#U�G�@V;Z@D<Yi¡:�KMi#@VBE]N'=AG�@\KMi?i#8�;2J9=A<YEMN =AG�Kc=2=?G�@Cn'<TNh=?L?EpB�8�UC@VB�`lUVKMSYST@VB �4=AG�@\Á�7�$ KMi#i?8�;ZJ(=?<YE]N�à 2&n'N�E��j`=AG(@^Á�7 $ KMi#i?8�;ZJ(=?<YE]N±G�KMi�:¤@VUCE];2@¢K2i4=�KMN�B�KML?B½UCL#npJ(=AEMX]LAKMJ(G�<YU¢KMi?i#8�;2J9=A<YEMN�Ã�Q�KML#STn �&E]L��E]N'i?<TX]N�Kc=?8�L?@Ci ��KMiZKMSTi?E UWKML#L?<T@VB'E]8(= :On'Â�KM;2J¤E]L4=!� Â�KM; �? ` � @VL��pST@ � � @CL ? a `�KMN�B Á�K 9:�<TN � Á�KM: �? Ã

�jEMSYB���KMi?i#@VLC` � <YUVKMSY<²`qKMN(B Á0<T¿M@Vi4= � � � Á ��� X]K6¿M@^=AG�@FL#<YX]EML?E]8�i�B�@Ce�N�<T=?<YE]N½EMP-i#@VUV8(L?<T=�nPdE]L&i?<YXMN�Kc=A8(L?@�i?U�G�@C;2@Ci0KMN�BDJ�L#Ew¿p<TB�@VB�=?G�@�e�L#i#=�UVE]N�i4=AL#8�UC=?<YE]N�=?G�Kc=fJ(L?E6¿cKM:�STnZi?Kc=A<Ti#e�@CB�=AG�K�=B�@ke�N�<T=?<YE]Nq`�8�N�B�@CL�K i#8�<T=AKM:�ST@!KMi?i#8�;ZJ(=A<TE]N <�N�KM;Z@VS>n]`(=?G�@jKMi#i?8�;ZJ(=A<TE]ND=AG�K�=0UVS�K@� 9 PdL?@V@jJ�Kc<YL?iEMP¤J¤@VL?;¢8(=�Kc=?<YE]N(i@��9<Ti#=W`6�0G(<YU�G <Yi�<Y;ZJ�SY<T@VB¢:On¡=AG�@0KMi#i?8�;ZJ(=?<YE]N¢=?G�Kc=/<TNO=A@VXM@VLP�KMUk=AE]L#<�VKc=A<TE]N¢<TiG�KML#B A à ¾ G(@I@VKML?ST<Y@CL�i?<TX]N�Kc=?8�L?@�i?U�G�@C;2@jB�8�@�=?E � @VL��hSY@ � � @VL�? a ��KMi0KMSTi?EFi?G(E �0Nb=AEFi?Kc=A<Ti#P»n=AG(<Yi^B�@ke�N�<>=A<YEMN�à Á�EM;2J¤@VS � Á0E];�? a� <�i#@V@­KMSTi?E�%�KME]L^KcN�B "-8�N�X � % " �? A i?G�E��&@VB'G�E�� =?EUVEMN�i#=?L?8�Uk=�K B�<YXM<T=�KcS&i#<YX]N�K�=A8�L#@­i#U�G�@V;Z@­8�i?<TN�X+KcNhn³E]N�@�9 �fKWn Pd8�N(UC=A<TE]N�à ¾ G�@­<YN�@�7ZUV<Y@CN�UCnEMP$=?G�@!KM:¤E6¿]@�9�;2@CNO=A<YEMN�@VB�UCE]N�i4=AL?8(UC=A<TE]N�iC`�KMN�BDKcSYi?EI=AG�@�P�KMUC=&=AG�Kc=�=AG�@Ci?@�i#<YX]N�K�=A8�L#@�i?U�G(@V;Z@ViL?@Cgh8�<YL#@f=AG�@fi#<YX]N(@VL � i/i?@CUVL#@C= �M@kn^=AE!U�G�KcN�X]@l:¤@C=:�&@V@VN2<YNO¿]EpUWK�=A<YEMN�iEMP£=?G�@li?<TX]N�<YN(X!KMSYXME]L?<>=AG�;­`;2K�M@!=AG(@Vi?@Ii?EMSY8(=?<YE]N�i�SY@Vi#i0J�LAKMUk=A<TUWKMSq=?G�KMN­B�@Vi#<YL#@VB�Ã

��������� � ��������������������������! ��#"$ ����#%�&���' � $'#�#($��' )�$&��+*, )---�.�/)-�-%01�2����*3/PM� ,#� >18��I.�9 )+�4T HX'1<?��9;>1<?9 .0"J��9;��5 9 )N.0��5$%(�I. �D'18��I6 ��� ,-� "54�6�7�8=�451��9 LQ"+: U�'15*.���9;��5�O<; L �I"JK �451��9 LQ"+:U�'15*.���9;��5 9 )=" U�'15*.���9;��5 �D!*"$�W9 ) !*"�8D6 �D� 9?5F2��/8+� U��48=" U�8D"4. �D9?�45���UZ9;51>1'1�D)/T:8D"J��!1�/8E��!*"�5 "J<;<�9?5*>1'7�D)/O>= �!*"4)X,-�0�/5 )�!1�$L:5 �D!*"$�EU�8D��H LC�/"�K �451��9 LQ"+: U�'15#. ��9;��5#)0T ��51�?9 LQ"+: U�'*5*. �D9?�45*)E9?5 ��!1�A'*)�'*"�<Q)��05#)+�A.0"�5 ,-�.��45*)+��8D'*. �D�/6A@ B "��)C)D7T$EZ��<GF�HJI O

5 Å

Page 14: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

79@C¿M@VL?KMS�;ZE]L?@bi#<YX]N�K�=A8�L#@¯i#U�G�@V;Z@Vi2G�KW¿]@±:¤@V@CN�i?G(E �0N =?E :¤@­i?@VUC8�L?@\<YN =AG�@­i?E 9�UWKMSTSY@CBLAKcN�B�E];I9�E]L?KMUVST@�;ZE9B(@VS à ¾ G�@jLAKMN(B�E];I9�E]L?KMUVST@�;ZE9B�@CSq<Ti0K^;2EpB�@VSqEMP�UVE];ZJ�8(=AKc=A<TE]N�<YN(�0G(<YU�G<T=�<Yi!Kci?i?8(;2@CB =?G�Kc=jKDX]<>¿]@CN½G�KMi?G½Pd8�N(UC=A<TE]N½:¤@VG�KW¿]@CiIKMijKMN½<YB(@WKMS�LAKMN�B(E]; Pd8(N�UC=?<YE]N�Ã!< $�N<YB(@WKMSRL?KMN�B�EM; Pd8�N�Uk=A<TE]N <YijK�Pd8�N�Uk=A<YEMNB�0G�@VL#@Z=?G�@ <YN�J�89=!B�E];2KM<YN½<Ti�=AG�@Fi#@C=IEMP�KMSYS�:�<YN�KML#ni#=?L?<TN�X]iV`Oi#8�U�G2=?G�Kc=�@VKMU�G2:(<YN�KML4n^i4=AL?<TN�Xj<Yi/;2KMJ�J¤@VBF=AEIK!LAKcN�B�E]; :�<YN�KcL#n^i4=AL#<YN�XjEMP£=AG(@�i?KM;Z@SY@CN�XM=?G�à A $�ST=?G�E]8�XMGZ=?G�<Yi�KMi#i?8�;ZJ(=?<YE]NZ<Yi/@k¿9<TB�@VNO=?STnFP�KMSTi?@M`O<>=/PdE]L?;2KMST<�V@Ci=AG(@�N�Ec=A<YEMN =?G�Kc=�=AG(@G�KMi#G2Pd8�N(UC=A<TE]N :�@CG�KW¿]@Ci�@Vi#i?@CNh=?<�KMSTSTn Kci&Kj:�SYKMU+�^:¤E��2KcN�B2<>=Ai/E]89=AJ�8(=&UWKcN�N�EM=-:¤@�B(@C=A@CL?;Z<YN�@CB8�NO=A<TS�<T=I<YiI@C¿cKMST8�Kc=A@CB�à � =¢<Ti¡UCE]N�i#<YB�@CL?@VB =AG�Kc=¢K¯J(L?EpEMPlEMP�i?@VUC8�L?<>=�n+<TN =?G�@�L?KMN�B�EM; 9�E]LAKMUCSY@;ZE9B�@CS�XM<T¿]@Cili?E];Z@�@k¿9<TB�@VN(UV@!EMP�L?@Ci?<TSY<Y@CN�UV@�=AE Kc=#=�KMU+�£Ã ¾ G�@jÁ�7 $ � Á�7 $ � � i?<TX]N�Kc=?8�L?@Ci��0<T=?Gi?J¤@VUC<�KMS$;Z@Vi#iAKMXM@IPdE]L#;�K�=?=A<TN�X � 2fÁ3? Å `£=?G�@ <�Kc=>9479G�KM;2<TL(� 7 ��� `¤KMN(B­=?G�@^7pU�G�N�E]L#L � 79U�G ?�5 i?<TX]N�Kc=?8�L?@li#U�G�@V;Z@Vi-G�KW¿]@0:¤@V@CN�KMN�KMSTn�V@CBZKMN�B J�L?E6¿M@VN�i#@VUC8�L?@�<YN^=?G�@lLAKMN(B�E];I9�E]L?KMUVST@�;ZE9B�@CS Ã��E��&@C¿M@VLV`l<>=F<YiI�hN�E��0N � [C� �G?�� =AG�Kc= i#@VUC8�L?<>=�n <YN =AG�@bL?KMN�B�E];I9�EMLAKMUCSY@�;ZE9B(@VSfB�Ep@Vi N�Ec=<Y;ZJ�S>n�i#@VUV8(L?<T=�n�<YND=AG�@jJ�SYKM<YND;ZEpB�@VS²Ã

�j@CN�N�KML#E�`���KMSY@k¿9<²`]KMN(B Á�KM:(<YN�� � ��Á3?? KMN�BZ[�LAKc;2@CLRKMN�BZ7pG�E]8�J � [l7�?6? J�L?EMJ�E]i#@VBF=AG(@e�L#i#=Ri#<YX]N�Kc=A8�L#@�i#U�G�@V;Z@ViJ�0G(E]i?@f@�7ZUV<Y@CN�UCn¢<Yi�i?8�<>=�KM:(SY@�PdE]L�J(LAKMUk=A<YUVKMSh8�i?@fKMN�B �0G�EMi?@fi#@VUV8(L?<T=�nKMN�KcSTnpi?<Ti�B(E9@Ci�N�EM=�KMi#i?8�;Z@^KcN\<YB(@WKMS$L?KMN�B�E];¬Pd8(N�UC=?<YE]N�à ¾ G�@V<TL�i#U�G�@V;Z@Vi!KcL?@Ii?@VUC8�L?@¡8�N�B�@CL=AG(@Ii#E 9�UVKMSYST@VB�� % #����������� " ���� ��%�������Ã

��������� � �9� %��±���4�&������ ������#� . �%�(%0�$%�"��

� N^KcSYSOEMP9=AG�@ ��EML��jE]NIi?<YXMN�Kc=A8(L?@-i?U�G�@C;2@CiUV<>=A@CB^KM:¤E6¿]@M`ci?<TX]N�Kc=?8�L?@-i?U�G�@C;2@Ci-�&@VL#@�UVEMN�i?<TB�@VL#@VBPdE]L�8�i#@�KMi�K0i#=AKMN�B 9�KMSYE]N(@�KMJ�J�ST<YUWK�=A<YEMN�à ��E��&@C¿]@CLV`]i#<YX]N�Kc=A8�L#@�i?U�G�@C;2@CiRKML#@-8(i?@VB¡<YNjNh8�;Z@VL?EM8�iEM=?G�@VL�UVL4n9J9=AE]X]L?KMJ�G�<TUjJ�L?EM=?E9UCE]SYiC`£KMN�B­<T=0<Ti�<T;2J¤E]L4=�KMNO=l=AEZB�@Ci?<YXMN­=?G�@V; �0<>=AG¯=?G�@j:�L?E]KMB�@Vi4=J¤E]i?i#<Y:�ST@!8�i?@Ci�<TN­;Z<YN(B�Ã[�E]N�i#<YB�@CL�=AG�@^8(i?@ EMP�i?<TX]N�Kc=?8�L?@¢i?U�G�@C;2@CijPdEML�UVE]N(i#=AL#8�UC=?<YN�XbKcN KMN�E]NOnp;2EM8�i�UVL#@VB�@CNO=A<�KcS

i#npi4=A@V;­Ã 4 G(<YSY@\i?8�U�G K i#npi#=?@V; UVKMN :�@\UVE]N�i4=AL#8�UC=?@VB PdL#E]; KMNOn i?<TX]N�Kc=?8�L?@\i?U�G�@C;2@ 8�i 9<YN(X�X]@VN(@VLAKcS=A@CU�G�N�<Ygh8�@Ci!PdE]L�UVL4npJ(=AE]XMLAKMJ�G(<YU^J�L#EM=AEpUVEMS�B�@Ci?<TX]N � Â�Á�7 4 ?6? `$B�E]<TN�X�<>=�<YN¯=AG�<TiP�KMi#G�<YE]Nb<Tif¿]@VL4nb<YN�@�7ZUV<Y@CNO=WÃ-Â$@C=08�i�@��9J�SYKM<YN�=?G�<Yi0J¤E]<YNO=l<TN­;ZE]L#@!B�@C=AKM<YS²Ã

� N½K2UCL?@CB�@VNO=A<YKMS�i#npi#=?@V;­`�K�8�i#@VL�UWKMN±EM:(=�KM<TN\KcUVUV@Ci?i�=?E�K2L#@Vi#E]8�L?UC@^E]N�S>nb:On¯J(L?@Vi#@VNO=A<TN�XK±UVL#@VB�@CNO=A<�KcS&=AG�Kc=FB�@C;2E]N(i#=AL?Kc=A@Ci^=AG�K�=^G�@D<Ti^KM8(=?G�E]L#<�V@CB³=AE½B�E½i#E�à � N³=AG�@�J�KMJ¤@VL>9�:�KMi#@VB�&E]L?STB�`�@D�(KM;2J(SY@Vi�EMP/i#8�U�G½UVL#@VB�@CNO=A<�KcSYi�KcL?@¢J�KMi?i#J�E]L4=Ai�=AG�Kc=�KMSTSYE��°8�i�=AE�J(L?E6¿]@^UC<T=?<�V@CN�i?G(<YJ�`¿]Ec=A@VL2L?@CX]<Yi4=ALAK�=A<YEMN'UVKML?B(i2=AG�Kc=�Kc8(=AG�EML?<�C@¯8(i2=AE ¿]Ec=A@M`lB(L?<T¿M@VL � i2SY<YUC@VN�i#@ViZ=AG�Kc=2J�L#Ew¿M@\E]8(LKM8(=?G�E]L#<�WK�=A<YEMN�=AEFB�L#<T¿M@!UWKML#iV`�@C=?UMà � ND=AG(@IB(<YX]<>=�KMS �&E]L?STB�`�<T=f<YifL#@WKMi#E]N�KM:�ST@�=AEF<T;�KMXM<YN�@0=AG�K�=i?8(U�G±K UVL?@CB�@VNO=?<�KMS �0<TSYS�:¤@j<YND=AG�@!PdE]L#; EMPRKFB�<YX]<>=�KMS�i?<TX]N�Kc=?8�L?@cÃ&Â$@k=�8(i�<T;�KcX]<YN�@�=AG�K�=�@VKMU�G8�i#@VL G�KMi KMN <TB�@VNO=A<>=�n����\óÂ$@k= 8�iF=AG�<TN��+EMP�K½UVL#@VB�@CNO=A<�KcSlKMi K½i?<TX]N�Kc=?8�L?@�EMN =?G�@D8�i#@VL � i<YB(@VNO=A<>=�nDKMN�B­J¤E]i?i#<Y:�S>n�i?EM;2@jEM=?G�@VLl<TN(PdE]L?;2Kc=?<YE]N�Ã

$ UCL?@CB�@VNO=A<YKMSpi#npi#=?@V; <Yi�KMN�E]NOnp;ZE]8�i�<TP�<>=�KMSYSTE �0i�8�i#@VL#i�=AE�B�@V;ZE]N�i4=AL?Kc=A@-i?8�U�G¢UVL?@CB�@VNO=?<�KMSTi�0<T=?G�E]8(=&L?@k¿]@VKMSY<TN�X^KMNOn2KMB�B(<T=A<TE]N�KMS�<TN(PdE]L#;�Kc=?<YE]N Kc:�E]89=�=AG(@V<YL-<YB(@VNO=A<>=A<Y@CiVà � N�@Vi#i?@VN(UV@M`��0G(@VN=AG(@¢8�i#@VL�i#G�E��0i�8�J±:¤@CPdEML?@j=AG�@I¿]@VL#<Te�@CL�KMN(B\B�@C;2E]N(i#=AL?Kc=A@Ci�=?G�Kc=�G�@¢G�Kci�K2UCL?@CB�@VNO=A<YKMS `£=AG(@¿]@CL?<>e�@VL&UWKMN2<YN(Pd@CL-N(EM=AG�<TN�X¡KM:�EM8(= �0G(E¡=AG(@�8�i#@VL&<Yi-EM=AG�@CL-=?G�KMNZ=AG�Kc=-=AG(@�8�i#@VL&G�KMi�=AG�@�L?<YXMGh=UVL#@VB�@CNO=A<�KcS à $�B�B�<T=?<YE]N�KMSYS>n]`hKMNbKMN(E]NOn9;ZE]8�i�UVL?@CB�@VNO=?<�KMS�i#npi#=?@V;¬KcSYSYE��0i-=AG�@�8(i?@VL&=AEFE]:(=AKM<YN�KUVL#@VB�@CNO=A<�KcS(KMN(E]NOn9;ZE]8�i#STnMÃ/798�U�G¢i#npi#=?@V;ZiJ��@CL?@�e�L?i#=@VNO¿p<Yi#<YE]N�@CB¢:On¢H!K6¿p<TB^[�G�Kc8�; � [�G�K�� L `KMN�B G�KW¿]@Z:¤@V@VN Pd8�L4=AG�@CLIi4=A8�B(<Y@VB :On [�G�KM8(;�KMN�B QR¿]@VL4=Ai#@ � [fQ ��� `)2�L?KMN�B�i � 2�LAK?6? `�KcN�BÂ�npi#nOKcN�i���KWnOK(`�Á0<T¿]@Ci#=V`¤7(KMG�KM<²`�KMN�B 4 E]STP � Â�Á�7 4 ?6? Ã

5W_

Page 15: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��i#<YN�X­X]@VN(@VLAKcSR=A@VU�G(N�<Ygh8�@Ci¡EMP V@CL?E 9 �hN�E��0SY@VB(X]@2J(L?EpEMPdijKMN�B V@CL?E 9 �pN(E �0ST@VB�XM@ZJ(L?EpEMPdi!EMP�hN�E��0SY@CB�X]@ � � � Á � L ` � � Á �?9` � ��4 � ` � ��4 ���c:q`62C��? �� <T=�<YiRJ¤E]i#i?<Y:(SY@&=?E�J�L#Ew¿M@li#=AKc=A@D9;Z@VNO=AiFi#8�U�G'KMi � � G�KW¿]@­K±i#<YX]N�K�=A8�L#@M` �0<>=AG�EM8(=FiAKWnp<YN(X KMNOnp=?G�<YN(X½;2E]L#@2=?G�KMN³=AG�Kc=�<�<²Ã @cÃT`�0<T=?G�E]8(=�B�<Yi#UVSTE]i?<TN�X.�0G�Kc=�=?G�<Yi�UVL?@CB�@VNO=?<�KMS�SYEpE6�hi�ST<��M@IE]L�=AG�@^<TB�@VNO=?<T=�n ��� =AE��0G(<YU�G½<T=8��KMi<Yi#i?8�@CB A à ��E��&@C¿M@VLV`qB�E]<YN(X2i#E�L?@Cgp8(<YL?@Ci�=?G�Kc=�=AG�@¡J�L?E]:(SY@V;*K�=�G�KcN�B±:¤@¡L#@VJ�L#@Vi?@CNO=A@VB KMiC`¤PdEML@��(KM;ZJ�ST@M`¤K�2&E9E]ST@WKMN­UV<TL?UC8�<T=V`£KMN�B¯=?G�@VN­=AG�@IJ�L#E9EMP�=AG�K�=�=?G�@¡i4=�Kc=?@V;Z@VNO=�<Yi0=AL?8(@¡L#@Vgh8�<YL#@Vi�KJ�L#E9EMP&=AG�K�=¡=?G�@2UC<YL#UV8�<>=¡G�KMi¢KbiAK�=A<Yi4P»np<YN�X¯KMi?i#<YX]N(;2@CNh=Và ¾ G�<Ti¡;Z@C=?G�E9B L?@Cgh8�<YL#@Vi¢@D�9J�@CN�i?<>¿]@UVEM;2J�89=�Kc=?<YE]N�il:¤@CnME]N�B&�0G�Kc=�<YilUCE]N�i#<YB�@CL?@VB¯J�LAKcUC=A<TUWKMS²Ã

$�N KMB�B(<T=A<TE]N�KMS�UVEM;2J�ST<YUVKc=A<TE]N\<Ti�E]:(=AKM<YN�<TN�X�UCL?@VB(@VNO=A<YKMSYi�<TN KDi?@VUC8�L?@I��KWn]à ¾ G�@Fi#<Y;ZJ�SY@i?EMSY8(=?<YE]N#�0G�@VL#@�=AG�@�8�i?@CLRL?@k¿]@WKcSYi/G�<Ti<YB(@VNO=A<>=�n ��� =?E�=AG�@�UVL?@CB�@VNO=?<�KMS9X]LAKMNO=?<YN�X�E]L?XOKcN�<�VKc=A<TE]N�`�0G�E2<YNb=A8�L#N±X]LAKcNh=?i�G(<Y; =?G�@¢UCL?@VB(@VNO=A<YKMS `�<Ti�L#8�SY@CB¯E]89=WÀ �&@ ��KMNO=�=?E�KMSTSYE�� =AG�@I8�i?@CL�=?E�:¤@KMN�EMNhnp;ZE]8�i��0G�@CN+E]:(=AKM<YN(<YN�XDUCL?@VB(@VNO=A<YKMSYijKMi��&@VSTS�� ��@ZKMSTi?E �fKcNh=I=AEb;2K�M@ <>=!J�EMi?i?<T:�SY@^=?EUVEM;^:�Kc=�<YB�@CNh=?<T=�nZPdLAKM8(B�`�KMN(BD<YN�i#8�U�G­K^UWKMi#@M` � � i?G�EM8�SYBDN�@k¿]@CLl:�@CUVE];Z@E�hN�E��0ND=AE KMNOn]EMN�@EM=?G�@VL�=AG�KMNI=AG�@&8�i?@CLVà < 4 @-Pd8�L#=?G�@VL�B�<Yi#UV8�i#i=AG(@�N�EM=?<YE]NIEMP�<TB�@VNO=?<T=�nj<YNI=AG�@&@VST@VUC=?L?E]N(<YU-i?@C=#=A<TN�X<YN¯79@CUC=?<YE]N 5]à � à � à A

��@CL?@M`�X]@CN�@VL?KMSM=A@CU�G�N�<Tgp8(@Vi�EMPpi?@VUC8�L?@/=:�&E 9�J�KML#=�n!UCE];ZJ�8(=�K�=A<YEMN�� "&KcE�� `�� ��4 ���MK(`��!E]S�?��p`Â$<YN a 5 i?KW¿]@!=AG�@!B�K6n¤À/=AG(@!8�i?@CL0KMN�B�=AG(@!E]L?XOKcN�<�VKc=A<TE]N�UVKMNb8�i?@jKFi?@CUV8�L#@!=:��E 9�J�KML4=�n�J�L#EM=AE 9UVEMS�i#8�U�G½=AG�Kc=�=AG�@¢8�i?@CL � i!E]8(=AJ(8(=�<Ti�K�i#<YX]N�K�=A8�L#@¢E]N±G(<Yi�<TB�@VNO=?<T=�n]` �0G�<YST@¡=?G�@¢E]L#XOKMN�<�WKc=?<YE]NSY@VKML?N(i/N�EM=AG(<YN�X�Ã-2�8(=/=?G�<Yi/<Ti/KMSTi?E�¿]@CL#nF@D�9J�@CN�i?<>¿]@MÀX]@VN�@CLAKMS�i#@VUC8�L?@l=:�&E 9�J�KcL#=�n^UCE];ZJ�8(=�K�=A<YEMNKMSTi?E L?@CJ�L?@Ci?@VNO=?i�=AG�@jPd8�N�Uk=A<TE]ND=AEZ:�@jUVEM;2J�89=A@VB\KMi�K�2&E9E]ST@WKMNbUC<YL?UC8�<T=V`£KMN�Bb=AG�@CN\J�L#E9UC@V@CB�i=AE @k¿MKcSY8�Kc=?@!<T=0XOK�=A@!:OnbXOKc=?@MÃ79E^P�KMLC`��&@!G�KW¿]@!B�@Ci?UCL?<Y:¤@VB­K¢UCE]N�i4=AL?8(UC=A<TE]NDEMP�KMN�KMN�E]NOnp;2EM8�ifUVL#@VB�@CNO=A<�KcS�i#npi#=?@V; PdL?E];

K2i#<YX]N�Kc=A8�L#@¡i#U�G�@V;Z@¢8(i?<YN(X!V@CL?E 9 �hN�E��0SY@VB(X]@¢J�L#E9EcPdi�EMPJ�hN�E��0SY@VB(X]@^KMN(B±X]@VN(@VLAKcS�=:�&E 9�J�KML#=�nUVEM;2J�89=�Kc=?<YE]N�à 4 @ G�KW¿]@�KcSYi?EbE]:(i?@VL4¿]@CB+=AG�K�=I=?G�<Yiji#E]SY8(=?<YE]N½<TijN�EM=IiAKc=?<Yi4P�KMUC=?E]L#n KcijP�KcL¡Kci@'7ZUC<Y@VN(UCn¯<Yi0UVE]N(UV@VL#N�@VBqÃ3$ N�Kc=?8�LAKMS�gh8�@Ci#=A<TE]N\=?G�@VL#@CPdE]L#@¡<Ti8�0G�@k=AG�@CLG�&@¢UWKcN\B�@Ci?<YXMN±K2i#<YX 9N�Kc=?8�L?@li#U�G�@V;Z@l=AG�K�= �0<YSTS(@WKci?<YS>n¡np<T@VSYB¢<T=Ai#@VS>P¤=?EjKMN @'7ZUV<T@VNO=�UVEMN�i#=?L?8�Uk=A<YEMNZEcPqKcN2KcN�E]NOnp;2E]8(iUVL#@VB�@CNO=A<�KcS�i#npi4=A@V;­Ã � N EM=?G�@VL#��E]L#B�iV` �&@�N�@C@VB i?<TX]N�Kc=?8�L?@2i?U�G�@C;2@Ci^PdE]L �0G�<TU�G J�L?E6¿p<YN(X½Ki#=AKc=A@C;2@CNO=�i#8�U�G±KMi � � G�KW¿]@^K i?<TX]N�Kc=?8�L?@c` Z<Yi0K ;^8�U�G¯;2EML?@j@'7ZUV<T@VNO=�E]J�@CLAKc=?<YE]ND=?G�KMN­L?@VJ�9L?@Ci?@CNh=?<YN�X^=?G�<Yi&i#=AKc=A@C;2@CNh=fKMilK¢UC<YL#UV8�<>=fKMN(B�J�L?E6¿p<YN(X^i?E];Z@C=?G�<YN(X^KM:¤E]8(=�i?8�U�G­K¢UC<YL?UC8�<T=Và 4 @KMSTi?EIN�@V@CB�=AEI@VN�Kc:�SY@0=AG�@�8�i#@VL&=?E¡EM:(=�KM<TN�KIi?<TX]N�Kc=?8�L?@0E]N2G�<Yi�<YB(@VNO=A<>=�nI�0<T=AG(E]8(=-UVE];ZJ�L#E];2<Ti>9<YN(XZG(<Yil<YB(@VNO=A<>=�n]Ã

� ND=AG�<Ti�=AG�@Ci?<TiV`��&@jJ�L?@Ci?@VNO=�i?<TX]N�Kc=?8�L?@�i?U�G�@C;2@Ci0=?G�Kc=l;Z@V@k=l=AG�@Ci?@�¿M@VL#n�X]@VN�@CLAKMSqL?@Vgh8�<TL?@D9;Z@VNO=AiCà ¾ G(@FX]@VN�@CLAKMST<T=�n¯EMP/=AG(<Yi!KMJ(J�L?EOKcU�G½@VN�KM:(SY@Vi�=?G�@^8�i#@FEMP�=AG�<Ti�i#<YX]N�K�=A8�L#@^i?U�G�@C;2@^PdEMLEM=?G�@VL-UVL4n9J9=AE]X]L?KMJ�G�<TU�J�L#EM=AEpUVEMSYi�<YN.�0G�<YU�G�<>=-<Yi-B�@Vi#<YLAKc:�SY@0=AE¡J�L?E6¿]@�i#=AKc=A@C;2@CNh=?ifEMP�=AG�@�PdE]L?;� � G�KW¿]@¡KZi#<YX]N�Kc=A8�L#@M` ZKMN�BD=AEZE]:(=AKM<YNDi#<YX]N�K�=A8�L#@Vi0E]NbUVE];Z;Z<T=?=?@VB�¿cKMST8�@ViCÃ

��N�B(@VL0=AG�@¢7p=AL#E]N�X2Á�7�$ Kci?i?8(;2J(=?<YE]Nq`���@IUVE]N(i#=AL#8�UC=�KFi?<YXMN�Kc=A8(L?@ji?U�G�@C;2@#�0G�<YU�G¯<Yil@kP 9e�UC<Y@VNO=�KMN�BDPdE]L �0G�<YU�Gb=AG�@CL?@IKML#@!@'7ZUV<T@VNO=8V@VL#E 9:�hN�E��0ST@VB�X]@jJ�L#E9EcPdilEMPJ�hN�E��0ST@VB�X]@cà � N­=?8�L?N�`=AG(<Yif<Ti�EMP�8�i#@!<YN�UCL#npJ(=?E]X]LAKcJ�G�<YU�J�L?EM=?E9UCE]SYi&<YN�XM@VN�@CLAKMS²`�KMN�BD<TNDKMN�EMNhnp;ZE]8�ilUCL?@VB(@VNO=A<YKMSqi4n9i 9=A@C;2i�<YN�J�KcL#=A<TUV8�SYKMLVà 4 @�J(L?@Vi#@VNO=0=AG�<Ti�i#<YX]N�K�=A8�L#@�i?U�G�@C;2@!<TN­[�G�KMJ(=?@VLf_(à 4 @!B�@Ci?UCL?<Y:¤@�G�E��=AEj<TN�UVE]L#J�EMLAKc=?@fi?8�U�G�K!i#npi#=?@V; =AEjE]:9=�KM<TN KMNZKMN�E]NOnp;2EM8�i�UVL?@CB�@VNO=?<�KMS�i4npi#=A@C;�<YNZ[�G�KMJ9=A@VL Å Ã

4 @&KMSTi?E�B�@Vi#UVL?<T:�@-G�E��³=?E�8�i#@&=?G�<Yi�i?<TX]N�Kc=?8�L?@�i#U�G�@V;Z@&=?E�<T;2J�ST@V;Z@VNO=�KMN¡8�N�ST<YN���KM:�ST@R@VST@VUD9=AL#E]N�<TU�UVKMi?GDi#U�G�@V;Z@Mà $�ND@VSY@CUC=?L?E]N�<TU�UVKMi?G�i?U�G�@C;2@�UCE]N�i#<Yi#=?ifEMP�K¡:�KMN��£`�KIi?@k=lEMP$UC8�i#=?E];2@CL?iC`KMN�B K¯i?@C= EcPl¿]@VN(B�E]L?iCÃ+Q�KMU�G 8(i?@VL KcN�B³¿]@CN�B�E]LFG�KciFK\:�KMN��³KMUCUVE]8�NO=Và ¾ G�@VL#@bKML?@�=?G�L?@C@J�L#EM=AEpUVE]STiVÀ�PdE]L �0<T=?G�B�L?K���KMS-<�:¤@C=:�&@V@CN2=?G�@�:�KMN��FKMN(B�KjUV8�i4=AE];Z@VL A `hi?J¤@VN(B�<YN�X!<�:¤@C=:�&@V@CN�=AG(@

5 L

Page 16: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

UV8(i#=AEM;2@CL�KMN(B­=?G�@I¿M@VN�B(E]L A `�KcN�B\B�@CJ�EMi?<T=?<YN�X�<d:�@k=:��@C@VN\=?G�@¡:�KMN��bKMN�Bb=AG(@I¿M@VN�B�EML A à $�i�KL?@Ci?8�S>=�EMP�=?G�@��0<T=AG(B�LAK@��KMS$J�L?Ec=AEpUVE]S²`(=AG�@jUC8�i#=?E];2@CL0E]:(=�Kc<YN�i�KF:�KMN��hN�Ec=A@M`¤KMN(B¯G�<Ti�KMUVUCE]8�NO=:�KMSYKMN�UC@¢<Yi�B�@VUCL?@VKMi?@CB :On­=AG�@^KMJ�J�L#E]J�L?<YKc=A@¢KM;ZE]8�NO=WÃ�H�8�L?<TN�X2=?G�@¢i#J�@CN�B�<YN(XDJ�L?EM=?E9UCE]S `£=AG(@:�KMN��pN(EM=A@D<Ti¢X]<>¿]@VN =AE±=AG(@�¿]@CN�B�E]L�<dJ�L?@Ci?8�;2KM:�S>n <TN³@��9U�G�KcN�X]@�PdE]L^i#E];Z@�X]EpE9B(i¡=AG�Kc=^=AG(@¿]@CN�B�E]L!i#@VSTSYi A `$KMN�B½B(8�L?<TN�X�=AG�@FB(@VJ¤E]i?<>=A<YN(X�J�L?Ec=AEpUVE]S²`¤=?G�@F:�KMN��¯<YN�UCL?@C;2@CNh=?i�=AG�@¡¿]@VN(B�E]L � iKMUCUVE]8�NO=�:OnD=AG�@IKMJ�J(L?E]J�L#<�Kc=?@jKM;ZE]8�NO=Wà $�N­@VST@VUk=AL?EMN�<YU!UVKMi?G¯i?U�G�@C;2@I<Yi ��� ��� ��� ���� ��<>P�`�@C¿M@VN<TP(=AG�@kn^UVEpE]J¤@VL?Kc=A@c`M=AG�@�:�KMN��¡KMN�B¢=?G�@�¿M@VN�B�EML/UWKMN�N(EM=/SY<TN���=AL?KMN�i?KMUC=?<YE]N�iUWKML#L?<Y@CB^E]8(=:On¢=AG(@iAKc;2@!UC8�i#=?E];2@CLVà ��N(SY<YN��cKc:�SY@�@CSY@CUC=AL#E]N�<TU!UWKMi#G���KMi�<YNO¿]@CNh=?@VB¯:hnDH!K6¿p<TB\[�G�KM8�; � [�G�K�� L ÃÂ$@C=I8�i!N�E�� L#@C=?8�L?N =AEbE]8�L!@D�(KM;2J(SY@^EMP�KDJ�G�KML#;�KcUV<Yi4=�=AL4np<YN�X�=?Eb¿M@VL#<TP»n±=?G�Kc=jG�<Ti�UV8�i 9

=AEM;2@CLDG�KMi¯K ¿cKMST<YB J�L#@Vi?UCL?<TJ(=A<TE]N �0<>=AG�EM8(=bSY@VKML?N�<TN�X'KMNOn EM=AG(@VLb<YN(PdEML?;2Kc=A<TE]N KM:¤E]8(=b=AG(@UV8(i#=AEM;2@CLVà ��i?<TN�XDE]8�L!KcN�E]NOnp;2E]8(i!UVL?@CB�@VNO=?<�KMSRi4npi#=A@C;¯`$=?G�@FUV8�i4=AE];Z@VL!UVKMN½J�L#Ew¿M@F=AG�Kc=�G�@G�KMi�KFJ�L#@Vi?UCL?<TJ(=A<TE]N�à ��@jUVKMN­=?G�@VN­J�KWnDPdE]LlG�<Til;2@CB�<YUVKc=A<TE]N�8�i#<YN�XZ@VST@VUk=AL?EMN�<YU!UVKMi?G�Ã

��������� � ����%0�$���4%&� % �½���4�&������ ����

$�N(EM=AG�@CL�<T;2J¤E]L#=AKMNO=�KMi?J¤@VUk=�EMPR=?G�@¢8(i?@¢EcP/i?<TX]N�Kc=?8�L?@Ci�<Yi0=AG(@V<YL�L?@k¿]EpUWKc=?<YE]Nqà � N­=AG�@¡J�KMJ¤@VL 9:�KMi#@VB �&E]L?STB�`�<T=�<YifEcP»=A@VNbJ¤E]i?i#<Y:�ST@�=AEF;2K�c@!K^B�EpUV8�;Z@VNO=0N�EFSTE]N�X]@CL�¿cKMSY<TB�à E]Lf@D�(KM;2J(SY@M`(KB�L#<T¿]@CL � i0SY<YUC@VN�i#@jUWKMN­:�@!L#@C¿ME6�M@CB�Ã

��N�@���KWn EcP�B�E]<TN�X i?E �&E]8�STB�:¤@­=?G�L?EM8�X]G':�S�KMU+� ST<Yi4=AiVà ¾ G�<YiZL?@Cgp8(<YL?@Ci2UCE]N�i#8�ST=?<YN�X KS�KcL?X]@jB�Kc=AKM:�KMi#@¡EcP/L?@k¿]E6�c@VB½i?<TX]N�Kc=?8�L?@Ci�@k¿]@CL#n­=A<Y;Z@IKZi#<YX]N�Kc=A8�L#@¡<Til¿]@VL#<Te�@CB�Ã�[�E]N�i#<YB�@CL�=AG(@i?<>=A8�K�=A<YEMN �0G�@CL?@2J�L?E6¿p<YN�X¯J�EMi?i?@Ci?i#<YE]N³EcP0K¯i#<YX]N�K�=A8�L#@2<TiIB(E]N�@��0<>=AG�EM8(=^KcUC=A8�KMSYS>n½i?G�E��0<TN�X=AG(@Fi?<YXMN�Kc=A8(L?@F<T=?i?@CSTP-E]L�L#@C¿]@VKMSY<TN�X­KMNOn±<TN(PdE]L?;2Kc=?<YE]N\KM:�EM8(=j<T=V`�i?8�U�G KMi!<TN KcN KcN�E]NOnp;2E]8(iUVL#@VB�@CNO=A<�KcS�i4n9i4=A@C; B�@Ci?UCL?<Y:¤@VB±KM:�E6¿M@Mà ��KW¿p<YN�XZ=AG�@IB�Kc=AKM:�KMi#@¢EMP/L#@C¿ME6�M@CB½i?<YXMN�Kc=A8(L?@Vi�KMi�KMN<YN(J�8(=l=AEF=?G�@ji?<YXMN�Kc=A8(L?@�¿]@CL?<>e�UWKc=?<YE]NDJ(L?EM=?E9UCE]S�L?@CN�B�@CL?i0=AG�@jL?8(N�N�<YN(X =?<Y;Z@�EMP�=AG(<YilJ�L#EM=AEpUVE]SB�@CJ�@CN�B�@VNO=�E]Nb=AG�@jNh8�;^:¤@VL0EMP�L?@k¿]E6�c@VB±i#<YX]N�K�=A8�L#@ViVÃ

$�N�Ec=AG�@CL���K6n EMP!;2K�h<YN(X i#8�L?@­=AG�Kc=�KMSTS�<Ti?i#8�@VB i#<YX]N�Kc=A8�L#@Vi2KML?@­¿cKMSY<TB�`�<TiZ=?E+L?@D9�<Ti?i?8(@i?<TX]N�Kc=?8�L?@CilPdL?@Vgh8�@CNO=ASTnM`¤KMN�B\N(EM=l=AEZL?@C<Yi?i#8�@Ii?<YXMN�Kc=A8(L?@Vi0E]N­B�EpUV8�;Z@VNO=?i�=?G�Kc=�KML?@jN�EZSYEMN�X]@VL¿cKMSY<TB�à ¾ G�@ J�L?E]:(SY@V; �0<T=?G½=AG�<Ti�i?E]ST8(=A<TE]N½<Yi�=AG�Kc=IKcN EMJ�@CLAKc=?<YE]N�`�SY<TN�@WKML�<YN±=AG(@FNp8(;^:�@CL!EMP¿cKMSY<TBDB�EpUV8�;Z@VNO=AiC`�G�KMil=AE :¤@jUWKML#L?<Y@CBbE]8(=0PdL?@Cgp8(@VNO=AS>n]Ã

� N [�G�KMJ9=A@VL L `)��@2B�@Vi#UVL?<T:�@2K¯i#E]SY89=A<YEMN =?E­=?G�<YiIJ�L?EM:�SY@C;¯Ã �!8(L¡i#E]SY8(=?<YE]N <Yij:�Kci?@VB+E]NK½X]@VN(@VLAKcSY<�VKc=A<TE]N³EMP�E]N�@D9 ��KWn KMUVUC8�;^8�SYKc=AEML?iVà ��N�@D9 ��KWn KMUVUC8�;^8�SYKc=AEML?i��&@VL?@­<YNO=?L?EpB�8�UV@CB:On 2&@VN�KMSTE]G KMN(B B�@ � KML#@ � 2�B � ?M_ `0KMiDK ��KWn =?E UVE];¢:�<YN�@\K+i?@k=DEMP!¿cKMST8�@Vi�<TNO=AE³E]N(@i?G(E]L#=¢KMUVUC8�;^8�SYKc=AEMLV`�i?8�U�G =AG�Kc=j=?G�@VL#@2<Ti¡Kbi?G(E]L#=#�0<T=?N�@Vi#i¡=AG�Kc=¡K­X]<>¿]@CN ¿cKMSY8(@ ��KMiI<YN�UCE]L>9J¤E]LAKc=?@VB <YNO=?E±=AG�@bKMUCUV8�;¢8�S�Kc=?E]LVà $f=F=AG(@­i?KM;Z@�=A<T;2@c`/<T=F<Ti^<YN(Pd@VKMi?<T:�SY@2=AE±e�N�B'KB�0<T=?N�@Vi#iPdE]LIKD¿MKcSY8�@^=?G�Kc=��fKci¡N�Ec=¢KcUVUV8(;^8�S�K�=A@VBqÃ�QJ�p=A@CN�B�<YN(X¯=AG(@2<TB�@WKMijB�8(@Z=?E 2�@CN�KMSTE]G KMN�B B�@� KML#@ � 2�B � ?M_ ` 2�KML?<��U�KcN�B�mRe�=�V;2KMN�N � 2�m ?�� X]<T¿M@�KcN2@�72UC<Y@CNh=&UVEMN�i#=?L?8�Uk=A<YEMN�EMP�i?E 9�UWKMSTSY@CBUVEMSYSY<Ti?<TE]N 9�L#@Vi#<Yi#=AKMNO=fKcUVUV8(;^8�S�K�=AE]L#iV`�:�KMi#@VB­E]Nb=AG�@ji#=?L?E]N(X2Á�7 $ KMi#i?8�;ZJ(=A<TE]N�Ã

4 @lJ(L?E]J¤E]i?@fK�¿cKML?<YKMNO=REMP£=AG(@fUV<>=A@VB¢UVE]N�i4=AL#8�UC=?<YE]NI�0<T=?G¢=AG(@lKMB�B�<>=A<TE]N�KMSpKMB(¿cKMNO=AKMX]@�=?G�Kc=W`8�i#<YN�X�KMB�B�<>=A<YEMN�KMS�=AL?KMJ¤B�E9EML�<TN(PdE]L#;�Kc=?<YE]Nq`(=AG�@¡L?8�N(N�<YN�XZ=A<T;2@jEMPB�@VST@C=A<TN�X�K ¿cKMSY8�@jPdL?EM;*KMNKMUCUV8�;^8(S�Kc=?E]L0<Yi0<YN�B(@VJ¤@VN�B�@CNO=!EMP=?G�@¢Nh8�;¢:�@CL�EMP/KMUVUC8�;^8�SYKc=A@CB­¿cKMST8�@ViC`qKMN(B\B�@CJ�@CN�B�i�EMN�STnE]N =AG�@Zi?@CUV8�L#<T=�n J�KcLAKM;Z@C=?@VLVÃ.2�@k=?=?@VLIi#=A<TSYS²`�E]N�UC@Z=?G�@ZKMUVUC8�;^8�SYKc=AE]L!<Tij8�J�B�Kc=A@CB�`�8(J�B�K�=A<YN(X=AG(@8�0<>=AN�@Ci?i&=?G�Kc=�K¡X]<>¿]@CN2¿cKMSY8(@�<Ti-<TN2=?G�@�KcUVUV8(;^8�S�K�=AE]L3<�J(L?E6¿p<YB�@CB�=AG�K�=-=?G�<Yi�¿cKMSY8(@�G�Kci&N�Ec=:¤@V@VNDL#@C¿ME6�M@CB�`�EMP�UCE]8�L?i#@0 A UWKMND:¤@�B�EMN�@3�0<>=AG�E]89=�=AG(@�=AL?KMJ¤B�E9EML&<TN(PdE]L?;2Kc=?<YE]N Kc=�8�N�<>=�UCE]i#=VÃ$�UCUV8�;¢8�S�Kc=?E]L?i �0<>=AGb=AG�@Ci?@jJ�L#E]J�@CL#=?<Y@Vi�KML#@!UWKMSTSY@CB�� ��� � ���kÃ

5

Page 17: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� N¢E]L#B�@VL�=AE�8�i?@-B(npN�KM;Z<YU-KMUCUV8�;¢8�S�Kc=?E]L?i�PdE]L�L?@k¿]EpUWKc=?<YE]NIEMP(i?<YXMN�Kc=A8(L?@ViC` �&@�J�L#E]J¤E]i?@�=AG�K�=@WKcU�G^i?<TX]N�Kc=?8�L?@-<Yi#i?8�@CB^i?G�EM8�SYB¡G�KW¿]@�i#E];Z@&8�N(<Ygh8�@�<TB�@VNO=?<Te�@CL�=?G�Kc=)�0<YSTSO:�@-<YN�UCE]L?J¤E]L?Kc=A@CB¢<YNO=?E=AG(@2B(npN�Kc;2<TU KMUVUC8�;^8�SYKc=AE]LIKc=j=?G�@F=A<Y;Z@FEMP�<Yi?i#8�@Mà ��N�UV@Z=AG�<Ti!i?<YXMN�Kc=A8(L?@ <YijL?@k¿]E6�c@VB�`�=AG�<Ti<YB(@VNO=A<>e�@VL �0<TSYS�:¤@jB�@VST@C=A@CB­PdL#E]; =?G�@IKMUVUC8�;^8�SYKc=AE]LCà � N\E]L#B�@VLf=?E2@�7ZUV<Y@CNO=ASTn�B�@V;ZE]N�i4=ALAK�=A@IKi#=AKc=A@C;2@CNO=�i?8�U�GZKMi � � G�K6¿M@0K�i?<TX]N�Kc=?8�L?@fEMNF;¢n¢<TB�@VNO=?<T=�nI=AG�Kc=<YiRi4=A<TSYSh¿MKcSY<YBq` �<>=R<TiRN�@VUC@Vi#iAKML4n=AE�<>5 A J�L#Ew¿M@fK�i#=�K�=A@V;Z@VNO=�EMP�=?G�@&PdE]L#; � � G�KW¿M@fK�i#<YX]N�Kc=A8�L#@&EMN¢;¢nj<TB�@VNO=A<>=�n�� IKMN�B(< �6A J�L#Ew¿M@=AG(@!i#=�K�=A@V;Z@VNO= � ¾ G�@!<YB�@CNO=A<Te�@VLfEMP$=?G�@!i?<TX]N�Kc=?8�L?@�E]ND;¢n2<YB�@CNh=?<T=�n2<Yi&<YN�=AG(@!KMUVUC8�;^8�SYKc=AEMLVà 4 @IJ(L?E6¿p<YB�@j@'7ZUC<Y@VNO=�J�L#EM=AEpUVE]STifPdE]Lli?8(U�G\J�L#E9EMPdiCÃ

��������� � �!�������������&������ ����

��N(<Ygh8�@�i?<YXMN�Kc=A8(L?@0i?U�G�@C;2@CifKML#@�i#<YX]N�Kc=A8�L#@0i?U�G�@C;2@Ci��0G�@VL#@�UCE]L?L#@Vi#J�E]N(B�<YN�XI=AEI@WKMU�G�KMUVUC@VJ(=>9KM:�ST@^J�8�:(SY<YU �M@Cn���� KMN�B½;Z@Vi#iAKMXM@ '½`�=?G�@VL#@F<Yi!K�8(N�<Ygh8�@Fi4=AL?<TN�X� =AG�K�=�=AG�@F¿M@VL?<>e�UWK�=A<YEMNKMSTX]E]L?<>=AG�; �0<TSYS$KMUCUV@CJ(=�KMi�KF¿cKMST<YBDi#<YX]N�K�=A8�L#@!E]N¯;Z@Vi#iAKMXM@ ' 8�N�B�@CL0J�8�:�ST<YU��M@kn���³Ã

��N�<Tgh8�@li?<TX]N�Kc=?8�L?@Ci�KML?@lEMP¤<TNh=?@VL#@Vi#=/PdEMLRi?@k¿]@VL?KMS�L?@VKMi?EMN�iVà $�i�K!i#=�KcN�B 9�KcSYE]N�@�KMJ�J�ST<YUVKc=A<TE]N�`8�N�<Tgh8�@�i#<YX]N�Kc=A8�L#@Vi�X]<>¿]@�KIUCE];ZJ�8(=�K�=A<YEMN�"ci#=?E]LAKcX]@f=AL?KMB�@�9�E �D<TNZ¿M@VL?<>P»np<YN�Xji?<TX]N�Kc=?8�L?@CiVà � ;2KMX 9<YN(@^K�i#<YX]N�K�=A8�L#@¢i?U�G(@V;Z@ �0G�@VL#@FUVE];Z<YN(X28�JB�0<>=AG½K2N�@'� i?<TX]N�Kc=?8�L?@¡E]N½KMN±KMSYL#@WKMB(n­i#<YX]N�@CB;Z@Vi?i?KMX]@D<TiFK±;2EML?@�@�72UC<Y@CNh=ZE]J¤@VL?Kc=A<TE]N+=?G�KMN ¿]@CL?<TP»np<TN�X K±i?<TX]N�Kc=?8�L?@có798(U�G�K±i#<YX]N�K�=A8�L#@i?U�G(@V;Z@�<Yij¿p8�SYN�@CLAKM:(SY@ =AE¯=?G�@2PdEMSYSYE��0<TN�XbB�@VN�<YKMS�9�EMP 9�i#@VL4¿9<TUV@ZKc=#=�KMU+� E]N :�@CG�KMSTPfEMP0K¯i#<YX]N(@VLVÀ¾ G�@­i?<TX]N�@VLI�0<TSYSfi#@VN�B�=?G�@biAKM;Z@­B�E9UC8�;Z@VNO= �0<T=AG'B�<��q@CL?@VNO=Zi?<TX]N�Kc=?8�L?@CiZ=?E+K i?@CL#¿M@VL�KcN�BPdE]L#UV@2=?G�@�i#@VL4¿]@VL^=?E\B�E±K\SYEM=IEMPC�&E]L�� :On ¿]@CL?<TP»np<TN�X±KMSTS/=AG�@Ci?@�i#<YX]N�K�=A8�L#@ViVà ¾ G�@�i#E]SY89=A<YEMN�0G�@CL?@¡KZi#@VL#¿M@VL�i#=AEML?@Vi�K SY<Yi4=0EMP�i?<YXMN�@VB­B�EpUV8�;Z@VNO=Ai�KMN�B­SYEpE6�hi08�J¯KZB�EpUV8(;2@CNh=�<TN�i#=?@WKMB­EMP¿]@CL?<>P»n9<TN�XF=AG�@IKc=#=�KMU�G(@VB\i#<YX]N�Kc=A8�L#@M`�<Ti08�N�B�@Ci?<YL?KM:�ST@!:�@CUWKM8�i#@¡<>=0;�KWnDST@WKMBD=?E2KcUVUV@CJ(=�KcN�UV@IEMPK�B�EpUV8�;Z@VNO=�PdL#E]; KMN½8�N�Kc8(=AG�EML?<�C@VB½J�KcL#=�n]à *M8�i4=j:�@CUWKM8(i?@ K�B�EpUV8�;Z@VNO=!G�KMi�:¤@V@VN i#<YX]N�@CB<YN =AG(@\J�KMi4=W`fB(E9@Ci�N�EM=2;Z@WKMN =AG�K�=�<>=2EM8�X]GO=�=?E :¤@±KMUCUV@CJ(=A@CB <TP�L?@VUC@V<>¿]@VB PdL#E]; K J�KML#=�n=AG�Kc=0P�KM<YSTif=AEZJ�L?EpB�8�UC@¢K ¿MKcSY<YBDi#<YX]N�Kc=A8�L#@MÃ��!N­=AG�@IEM=?G�@VL�G�KMN�Bq`¤8(i?<YN(X�K 8�N�<Tgp8(@¡i#<YX]N�K�=A8�L#@i?U�G(@V;Z@�KMN�B+K­STEM=IEMPfi4=AE]L?KMX]@c`�=?G�<YijJ�L#E]:�SY@C; UWKMN :�@Zi?EMST¿]@CB+:On G�KW¿p<YN�Xb=AG�@Zi?@CL#¿M@VL^i4=AE]L#@KMSTS&=AG(@DB�E9UC8�;Z@VNO=Ai KMN(B =?G�@bi?<TX]N�Kc=?8�L?@CiF<T=^G�KMiF¿]@VL#<Te�@CB <YN³=AG(@­J�KMi#=V`&KcN�B 8�J�EMN'L#@VUC@V<YJ9=EMP�KDB�E9UC8�;Z@VNO=W`�U�G�@CU+�½<TP-<T=j<TijKMSYL#@WKMB(n¯i#=?E]L?@CB�à � P�i#E�`�<YN�i4=A@VKMB EMP�J¤@VL4PdE]L?;Z<YN(XDKDi?@VJ�KMLAKc=?@UVEM;2J�89=�Kc=?<YE]N^=?Ej¿M@VL#<TP»n^=?G�@�K�=?=�KcU�G�@VBZi?<TX]N�Kc=?8�L?@lE]N =AG(@�B(E9UC8�;2@CNO=W`hUVE];ZJ�KML#@f=AG�@�Kc=#=�KMU�G(@VBi?<TX]N�Kc=?8�L?@�=?EF=AG�@jE]N�@ji4=AE]L#@VB�à � P=?G�@CnDKML?@jB�<��q@CL?@VNO=V`�L?@ F#@CUC=VÃ

��N�<Tgh8�@0i?<YXMN�Kc=A8(L?@li?U�G(@V;Z@VifKcL?@0KMSTi?E!L?@CS�Kc=?@VB =AE!¿]@CL?<>e£KM:�ST@lLAKMN�B(E]; Pd8�N(UC=A<TE]N�i�� � Á�Ä�?6? KMN�BIN�E]N�9�<YNO=?@VLAKcUC=A<>¿]@ V@CL?E8�pN(E �0ST@VB�XM@�J�L#E9EMPdi&� � ��? �� `cKMN�B¡KMi�K�L#@Vi#8�ST=�KML#@-¿cKMST8�KM:�ST@R=AEpE]SYi$<TN=AG(@!B�@Vi#<YX]NbEMP�UVL4n9J9=AE]X]L?KMJ�G�<TU!J�L?Ec=AEpUVE]STiVÃÄ�@CL?<Te�KM:�SY@�LAKMN�B(E]; Pd8�N(UC=A<TE]N�i#<»Ä!Á i A KML#@!UVL4n9J�9=AEMX]LAKMJ(G�<YU�E]:�F#@CUC=Ai-=AG�K�=fJ�L#E9B�8(UV@�L?KMN�B�EM; 9�SYEpE6�h<YN�X!:�<>=AiC`(KMN(B2n]@k=f=AG(@VL?@�<Yi&K¡;Z@VU�G�KcN�<Yi#;�=?EUVEMNh¿p<TN�UV@�K�=AG�<TL?B J�KML4=�n¢=?G�Kc=-KMSTS9=AG(@Vi?@�:�<>=AiRUVKM;2@fPdL#E]; =?G�@0iAKM;Z@li?EM8�L?UC@Mà ¾ G�<Ti/G�KMi/J�L#Ew¿M@VB8�i#@CPd8�S�<YN�=?G�@jB�@Vi#<YX]N­EMP�L?@Ci?@C=#=�KM:(SY@�V@CL?E 9 �pN(E �0ST@VB�XM@¡J�L#E9EcP�J(L?EM=?E9UCE]SYi � � Á a 5]`�Á0@Cn a 5 Ã

$�N�Ec=AG�@CL�<TNO=A@VL#@Vi4=A<YN(X2KcJ�J�SY<TUWKc=?<YE]N�EMP�¿M@VL#<Te£KM:(SY@!LAKcN�B�E]; Pd8�N�UC=?<YE]N(iV`�B�8�@!=?E � <YUWKcSY<�KcN�BÁ0<T¿]@Ci#= � � Á a � `�<Yi�=?G�@V<TL!8�i?@Z<YN N�EMN 9�<TNh=?@VL?KMUC=?<T¿]@ STEM=?=?@VL#n\i#npi#=?@V;Zi¡=?G�Kc=I<YN½=A8(L?N KML?@ 8�i#@VBPdE]LF;Z<YUCL?E]J�KWnp;Z@VNO=AiCà ��@VL#@M`�=AG�@bSTEM=?=?@VL#n+E]L?X]KMN�<�C@VLFG�EMSYB�i K½J�8�:(SY<YU �c@Cn���� EMP�K±Ä�Á Ã$�J�KML4=A<TUV<YJ�KMNO=�UVL#@WKc=?@VijG�<Ti�SYEM=#=A@CL#n­=A<YU+�c@C=���G�<Y;Zi?@CSTP-KMN(B½i?@VN(B�i¡<>=�=?E�=AG�@FE]L#XOKMN�<�V@CLVà ¾ G�@E]L#XOKMN�<�V@VLlUCE];ZJ�8(=A@Cil=AG�@j¿cKMSY8�@!EcP�=?G�@I¿M@VL#<Te£KM:(SY@!LAKcN�B�E]; Pd8(N�UC=?<YE]N­E]Nb=AG�@jSYEc=?=A@CL#n2=A<YU+�c@C=V`KMN�Bb=AG(@IUCE]L?L#@Vi#J�E]N(B�<YN�X J�L#E9EcP�à ¾ G�@!¿MKcSY8�@!EMP�=AG(@jPd8(N�UC=?<YE]NbB�@k=A@VL#;2<TN�@ViC�0G�@k=AG�@CL�=?G�@j8�i?@CL�0<YN(iV` �0G�<TSY@2=?G�@DJ�L#E9EMP0XM8�KMLAKcNh=?@V@Ci^=AG�Kc=¡=AG�@DEML?XOKMN(<�V@CL¢UVKMN�N�EM=^U�G�@WKc=Và 79<YN�UC@DK\Ä!Á <Ti

5 �

Page 18: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

G�KML#BD=AEFJ�L#@VB�<TUC=W`9=AG�@!8�i#@VL0G�KMilN(EZ<TB�@WK^G(E � =AE :�<YKMi�=?G�@!SYEM=#=A@CL#n2<YNDG�<TifP�K6¿ME]LVà � NbE]L#B�@VLf=?EX]8�KcLAKMNO=A@C@�P�KM<YL#N�@Vi#ifEMP�=AG(@!SYEM=#=A@VL4n]`(K^8�i?@CLlUWKMNbi?8(J�J�STn�KMNbKMB�B(<T=A<TE]N�KMS¤LAKcN�B�E];�¿cKMSY8�@�=AEF:¤@� �!Á�@CB��0<>=AGD=AG(@j¿cKMST8�@!EMP�=AG�@!Ä�Á Ã

� N¢=AG(<Yi$=AG�@Ci?<TiV` �&@�XM<T¿]@&K�N(@'� UCE]N�i#=?L?8�Uk=A<TE]N¢EMP�K�8�N(<Ygh8�@�i#<YX]N�Kc=A8�L#@�i?U�G�@C;2@c`OKMN�B¡L?@VSYKc=A@CBÄ!Á UVE]N(i#=AL#8�UC=?<YE]N(iVÃ&[�G�KMJ(=?@VL <YilB�@CB�<YUVKc=A@CB­=?E =?G�<Yif=?G�@V;Z@MÃ

��������� � ����� � �!�!"#���$����%&��� % �±������������ ���� �4� . �%/(%��$%&"��

4 <T=?G�=AG(@�8�i?@�EMP�UVL#npJ(=?E]X]L?KMJ�GOn]`�KcN�B�B�<TX]<T=AKMS£i?<YXMN�Kc=A8(L?@�i#U�G�@V;Z@Vil<TN�J�KML4=A<TUV8�SYKMLV`h=�KMi��hi�=AG�K�=KML#@!<Y;ZJ�E]i#i?<T:�SY@�<YN�=?G�@!J�S�Kc<YN�;ZEpB�@VS�:�@CUVE];Z@�Pd@WKMi#<Y:�ST@Mà ��N�@!@D�(KM;2J(SY@�EMP�=?G�<YifJ(G�@VN�EM;2@CN�E]N��KMi/B�<Yi#UVE6¿]@CL?@CBZ:On^m�@WKci?@M`979G(E]i#=AKMU+�£`9KcN�B Â�KM;2J¤E]L4= � m-7( � a KcN�B Â�KM;2J¤E]L4=W`O7pG�E]i#=AKMU+�^KcN�Bm�@VKMi?@ � Â�79m � � `�<TND=AG�@jUVEMNh=?@��p=�EMP 2-n VKMNO=A<TN�@IKMX]L?@C@V;Z@VNO=�J�L?Ec=AEpUVE]STiVÃ

2&n�WKMNO=?<YN�@¯KMX]L#@V@V;Z@VNO=Z<YiF=?G�@¯J(L?E]:�ST@V; EMP�<T;2J�ST@V;Z@VNO=A<TN�X½K :�L?E]KMB�UWKci#=ZU�G�KMN�N(@VS�<YN'KJ¤E]<YNO=�9 =AE 9�J�EM<YNO=¢N(@C=:�&E]L�� �0G(@VL?@Di#E];Z@DN�E9B(@ViF:¤@VG�KW¿]@b;2KMSY<TUV<TE]8�i?S>n]à ¾ G�<YiF<Ti^EMP�X]L?@VKc=F<T; 9J¤E]L#=AKMN�UV@jPdE]L�J�L?Ec=AEpUVE]S�B�@Ci?<YXMN�Àf<T=�<Ti�;^8(U�G±;2EML?@jUVE]NO¿M@VN�<T@VNO=�=AE2B�@Vi#<YX]N\J�L?EM=?E9UCE]SYilPdE]L0=AG(@:�L#EOKMB�UVKMi#=�;ZE9B�@CSq=AG�KMNDPdE]Ll=AG�@jJ¤E]<YNO=�9 =AE 9�J�EM<YNO=�N(@C=:�&E]L��£Ãm�@VKMi?@c`9Â�KM;ZJ¤E]L#=V`OKMN�BZ79G(E]i#=AKMU+� � m-7( � a KMN(B Â�Kc;2J¤E]L#=V`O79G(E]i#=AKMU+�FKMN�B m�@WKMi#@�� Â�7(m � �

i?G(E �&@VB±=?G�Kc=G2&n�WKMNO=?<YN�@¢KMX]L?@C@V;Z@VNO=8�fKMi�<YN(Pd@VKMi?<T:�SY@j<>P=AG(@¡Nh8�;^:¤@VL�EMPR;2KMST<YUV<TE]8�ilN�EpB�@Ci�<TiKc=bST@WKMi4=bE]N�@�9 =AG�<TL?B EMPI=AG�@½=?EM=�KMS�Np8(;^:�@CLbEMP¢N(E9B�@CiVà ¾ G�@kn KMSYi#E'i#G�E���@CB3=AG�Kc=b8�i?<TN�X'Ki?<TX]N�Kc=?8�L?@Di#U�G�@V;Z@Vi2KMN�B K½J�8�:�ST<YUD9:�M@kn <YN9PdLAKMi4=AL?8(UC=A8(L?@M`&KMNOn Nh8�;^:¤@VL EMP�;2KMSY<TUV<YEM8�i¡N(E9B�@CiUWKcN¯:¤@!=AE]ST@VLAK�=A@VBqÃ

$�S>=AG�E]8(X]G�=AG�<Ti�<TilK¢N�Kc=?8�LAKcS�KMJ�J(SY<YUVKc=A<TE]N�EcP�i?<YXMN�Kc=A8(L?@�i#U�G�@V;Z@ViC`�<T=���KMilN�Ec=lJ�L?@k¿p<YE]8�i#STn�&@VSYS 9�i4=A8�B�<T@VB�à � N�=AG�<Ti-=?G�@Vi#<YiC` �&@�UVE]N(i?<YB(@VL&=?G�@�J(L?E]:�ST@V;�EMP�L?8�N�N(<YN�X 2&n�WKMNO=A<TN�@!KMXML?@V@C;2@CNO=;ZE]L?@�=?G�KMN E]N�UC@Mà � =F=?8�L?N�i E]89=F=AG�Kc= i#<YX]N�Kc=A8�L#@ViFB�E N�Ec=ZKMS���KWn9i G�@CSYJ <TN'UVKMi?@D=?G�Kc=F=AG(@2&n�WKcNh=?<YN�@ KcX]L?@C@V;Z@VNO=!<Yi�<YNO¿]E6�c@VB ;2EML?@¡=?G�KMN½E]N(UV@��0<T=?G�E]8(=�i?@Vi#i?<TE]N <YB�@CNh=?<Te�@CL?iCâ7pJ�@CUV<Te 9UWKcSYSTnM`O<TPqi?@C¿M@VL?KMS 2&n�VKMNO=A<YN(@�KMXML?@V@C;2@CNO=�J�L#EM=AEpUVEMSYi-KML?@�@��9@CUV8(=?@VBDUVEMN�UV8�L#L?@CNh=?STn �0<T=?G�E]8(=�KMJ 9J�L#E]J�L?<YKc=A@&i?@Ci?i?<TE]NF<YB(@VNO=A<>e�@VL#i�PdE]L�@WKMU�G <YNO¿ME9UVKc=A<TE]N�`w=AG�@CN =?G�<Yi�J�L?Ec=AEpUVE]SpUWKMN(N�EM==?E]SY@CLAKc=?@�E]N(@=AG(<YL?BZE]L�;ZE]L?@l;2KMSY<TUV<TE]8�iRN�EpB�@CiVà ¾ G�@�iAKM;Z@0<Y;ZJ�EMi?i?<T:�<YST<T=�n¡KMJ�J(SY<Y@CiR=AEIi?@Cgp8(@VNO=A<YKMS�UCE];ZJ�E]i#<�9=A<TE]N�EcP$B�@C=?@VL#;2<TN�<Yi4=A<YU82&n�VKMNO=A<YN(@�KMX]L#@V@C;2@CNh=�J�L?Ec=AEpUVE]STiVà ��E �&@C¿M@VLC`�=AG�@CL?@�<Ti�K¡LAKMN�B(E];2<�V@CB2&n�WKcNh=?<YN�@�KMX]L?@C@V;Z@VNO=lJ�L#EM=AEpUVEMS�=AG�Kc=fUCE];2J¤E]i#@Vifi#@Vgh8�@VNO=?<�KMSTSTn.�0<T=AG(E]8(=fi#@Vi#i?<YEMN­<TB�@VNO=?<Te�@CL?iVÃ

<YN�KMSYS>n]`�KMJ�J�L#E]J�L?<YKc=A@CSTn­U�G�E]i#@VN i?@Ci?i?<TE]N <YB�@CNO=A<Te�@VL?i�@VN�KM:(SY@^UCE];2J¤E]i#<T=A<TE]N\EcP�2-n VKMNO=A<TN�@KMX]L#@V@C;2@CNh=0PdE]L0KcNhn�Np8(;^:�@CL0EMP;2KMST<YUV<TE]8�i&N�E9B(@ViVþ G�@Vi#@�L#@Vi#8�ST=?i-<TSYST8�i#=?LAKc=?@�:¤EM=AG =AG�@lJ¤E���@CL�KcN�BF=AG�@0SY<T;2<>=�Kc=?<YE]N(i�EcP�=?G�@08�i?@0EMP�i?<TX]N�Kc=?8�L?@Ci

<YND=?G�@jB�@Vi#<YX]NbEMPB�<Yi4=AL?<T:�8(=?@VB­KMSYXME]L?<>=AG�;ZiVà ¾ G�@Cn­KcL?@j@��9G�<T:�<T=?@VBb<YN¯[�G�KMJ9=A@VL �9Ã

����� )* +���9����% !��.0� �

79@k¿]@VL?KMS/KMJ(J�SY<TUWKc=?<YE]N�i�B�@Ci?UVL#<Y:¤@VB <YN¯=AG�<Ti�=AG(@Vi?<TiV`�i#8�U�G KMi!KMN�EMNhnp;ZE]8�i�UCL?@CB�@VNO=A<YKMSi4npi#=A@C;2iC`@'7ZUC<Y@VNO=�L?@C¿ME9UVKc=A<TE]N­EMP�KMN�EMNhnp;ZE]8�i�UVL#@VB�@CNh=?<�KMSTiV`�KMN�B¯@VSY@CUC=?L?E]N�<TUjUWKMi#G�`qKcL?@¡KM<Y;Z@VB¯Kc=�J�L?E 9=A@CUC=?<YN�X�J�@CL?i#E]N�KMSp<YN(PdEML?;2Kc=A<TE]N�<YNIE]N 9�SY<TN�@R=AL?KMN�iAKcUC=A<TE]N�i�KMN�B¡X]<T¿p<YN(X�8(i?@VL#iRUVEMNh=?L?E]ShE6¿]@CL-�0G�K�==AG(@CnbB�E2KMN�B­B�EZN�EM=0B�<Ti?UVSTE]i?@IKM:¤E]8(=0=?G�@V;Zi?@CST¿]@CiVÃ&Â$@C=�8�i�B�<Yi#UV8�i#i�=?G�<Yil=AEMJ�<YU!<TN¯K :�L#EOKMB�@CLUVEMNh=?@��p=WÃQ/N�i?8�L#<YN�X2=AG�Kc=�<YN9PdE]L?;2Kc=A<TE]NDEMP/J¤@VL#i?E]N�KMS�N�Kc=A8�L#@¡B(E9@Ci�N�EM=�:¤@VUVEM;2@¡J�8�:�ST<YU��hN�E��0SY@VB(X]@

G�KMi�:¤@VUVEM;2@¡KMN\<TN�UVL#@WKMi#<YN�X2UVE]N(UV@VL#N½KFPd@'� B�@CUWKMB�@Ci!KMX]E2KMi�UVE];ZJ�8(=?@VL�B�Kc=AKM:�KMi#@Vi�:¤@VUVKM;Z@

5 �

Page 19: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�0<YB(@VSTn 8�i#@VB�à � N =AG�@�J�KMi#=V` �0G�@VN ;ZE]i#=¢L?@CUVE]L#B�@VB <TN(PdE]L?;2Kc=?<YE]N L?@Cgh8�<YL#@VB K\UCE]N�i?<TB�@VL?KM:�ST@Gh8�;2KMN @ ��E]L#=¡=AE½L#@C=AL#<Y@k¿]@M`�J�89=?=A<TN�X\=?E]X]@C=?G�@VL¡=:��E½8�N(L?@VSYKc=A@CB J�<Y@CUV@CiFEMP0<YN(PdEML?;2Kc=A<TE]N+KcN�BSY<TN��h<YN�X =?G�@V; =?E'=?G�@ i?KM;Z@ <TN�B�<T¿p<TB�8�KMSG��KMi­N�EM=\KMN @WKMi4n =AKMi��£Ã $�i\K L?@Ci?8�S>=W`!@C¿M@VN°<>P¿p<YL4=A8�KMSTSTn�KMSYS�J¤@VL#i?E]N�KMS�<YN(PdE]L#;�K�=A<YEMN!�fKci�Kc=�i?EM;2@IJ�EM<YNO=0E]L�EM=AG�@CL0L?@VUCE]L?B(@VB½KMN(B\i#=?E]L?@CB\<TNK¢J�8(:�SY<TU�KML#U�G�<T¿M@M`�EMN�@�B�<TB�N�EM=�N�@V@CB�=AE �&E]L#L#nZ=AG�Kc=�i?E];Z@VEMN�@3�&E]8�STB�:�@�KM:�SY@�@WKci?<YS>n =AE^J�89=<T=IKcSYS�=?E]X]@k=AG�@CLj=?E¯XM@C=¡KDUVE];ZJ�SY@k=A@FJ�<TUC=?8�L?@ EMP&E]N�@ � ij=AG�@ J�L#<T¿cKc=?@ K ��Kc<YL?iCÃZ[�SY@VKML?S>n]`$<YN =AG(@KMX]@!EcPRB�Kc=AKM:�KMi#@ViC`�=AG�<Til<YilN�EZSYE]N(X]@VLf=?G�@jUWKMi#@MÃ

$�UCUVE]L#B�<YN�XZ=AE�79<Y;Zi?E]NB�IKcL#e�N��c@VS � i�:�EpE6��� %� �� �� � % ����� � �jKML a]a `¤=?G�@ �IÃ�7¤Ã¤XMEw¿M@VL#N 9;Z@VNO=fL#@VUVEMX]N�<�C@VB�=?G�Kc=&=AG�<Ti ��KMilK¢J(L?E]:�ST@V;�KMN(B�UVL#@WKc=?@VBbKMN�@D�9@VUV89=A<T¿M@�UVEM;2;Z<T=#=A@V@�E]NZ=AG�<Ti<Yi#i?8�@cà ¾ G(@¢UVEMNh=?L?<T:�8(=A<TE]N\EcPR=AG�<Ti�UCE];Z;2<>=?=A@C@��fKMi �?K2:(<YSYS$EcP/L?<TX]GO=Ai�PdEML�=?G�@¢UCE];2J(8(=A@CL�KMXM@Ã>ÃTÃ�UWKcSYSY@CB�=AG�@¡[�EpB�@jEMP Kc<YL � N(PdEML?;2Kc=A<TE]NDm/LAKMUk=A<TUV@ViCÃ

$ N�Kc=A8(LAKMSOgh8�@Ci#=A<TE]N�`�LAKM<Ti?@CBI:OnIH!KW¿p<YB#2�L#<YNj<YNjG�<Ti�:¤EpE6����# �� � #$� � % � ��������% � � 2�L#< ?�� `w<Ti�0G�@k=AG�@CL�<T=-<Ti&@k¿]@VN�J�E]i#i?<T:�SY@l=AE¡J�L?Ec=A@VUk=&=?G�@�J(L?<T¿cKMUkn EMP�<TN�B�<>¿9<TB�8�KMSTi/X]<T¿M@VNZ=AG�@�i?8�L4¿]@C<YSYSYKMN�UC@=A@CU�G�N�E]STE]XMn­<YN(UVL?@VKMi?<TN�X]S>nbKW¿MKc<YS�Kc:�SY@!=AEpB�KWn]à 4 G�<TSY@ 2�L?<TN\;2K�M@Ci�K�i4=AL#E]N�X�UVKMi?@IPdE]L�;2K�h<YN(Xi?8(L?@�=?G�Kc=�=AG(@VL?@�KML?@0J�8(:�SY<TU�;Z@VU�G�KMN�<Yi#;2i�PdE]L�;ZE]N�<T=?E]L?<TN�XjKMSTS(=AG�@�<YN9PdE]L?;2Kc=A<TE]NFUVEMSYSY@CUC=?@VBZ:hn=AG(@�X]E6¿]@CL?N�;Z@VNO=V`(<T=-i4=A<YSTS�L?@Cgp8(<YL?@Ci�KISY@VKMJ�EMPqP�KM<T=?G =?E¢UCE]N�UVST8�B�@�=AG�Kc= � �M<TN(PdE]L#;�Kc=?<YE]N Kc:�E]89= � �$<YN(B�<T¿p<YB(8�KMSYiI<Yi¡N�@VUC@Vi#iAKML#<YSTn UVEMSYSY@CUC=AKM:�SY@c`RKMN(B+=AG�K�= K¯=AL?KMB�@D9�E � UWKMN(N�EM=F:¤@2PdE]8(N�B³=AG�K�=�&E]8�SYB2iAKc=?<Yi4P»n :�EM=?G2=?G�@�J(8�:�SY<TU � i&N(@V@VB(i�PdE]L�iAKcPd@k=�n]`(KMN�B2=?G�@�<TN�B�<>¿9<TB�8�KMS � i/N(@V@VB2PdE]L�J�L?<>¿MKcUCn]Ã*M8�i4=�:¤@VUVKM8�i?@I=AG�@CL?@I<Yi0=A@CU�G�N�E]STE]XMn�=?E2<TNh¿cKMB(@¡J¤@VE]J(SY@ � i�J�L?<>¿MKcUCn]`�B(E9@Ci�N�Ec=�;Z@WKMNb=AG�Kc=0=AG�<Ti=A@CU�G�N�E]STE]XMn(�0<TSYS�:�@j8�i#@VB\<TNDE]L?B(@VLl=AE B�EZi?E�þ G�@VL#@DKML#@2i#@C¿]@CLAKMS�KMJ�J�L#EOKMU�G�@Ci¢=AE­=AG�@2J�L?EM:�SY@C; EMPlJ�L#EM=A@CUC=A<TN�X\J(L?<T¿cKMUkn]à ��N+=?G�@�E]N(@

G�KMN(B�`O=AG�@CL?@0<YiR=?G�@�KMJ�J�L#EOKMU�GZEMP�B�@ke�N�<TN�Xj@��(KMUC=?STn��0G�Kc=-J�L?<>¿MKcUCn^<Ti�<YN^=AG(@�i#E9UC<Y@k=�nFE]N�@0SY<>¿]@Ci<YNq`OG�E�� ;^8�U�GZJ�L?<>¿cKMUCn KcN2<TN�B�<T¿p<TB�8�KMS9<Yi/@VNO=?<T=AST@VB =AE�<dPdEML-@D�(KM;2J(SY@M`O;2KWnp:�@0<T=�<Ti�KMSYS(L?<YXMGh=/=?E:�8(n^K!J�L?@Ci?UVL#<YJ(=?<YE]NF;Z@VB(<YUWK�=A<YEMN^<YN^J(L?<T¿cKc=?@M`O:�89=�B�L?<>¿9<TN�X�<TN�UVE]XMN�<T=?E�i?G�EM8�SYBFN�Ec=�:�@0KMSTSYE��&@VB�Ài?G(E]8�SYB KMN+KMUVUC<YB�@CNh=¡G�KMJ(J�@CN�`�=?G�@ZB�L?<>¿]@VLIi?G(E]8�SYB :¤@�KMUCUVE]8(Nh=AKM:�ST@ZPdE]L!<>= A `�KcN�B+<TNh=?L?EpB�8�UC@SY@CX]<Yi#S�Kc=?<YE]N¡=AG�Kc=-@CN(PdE]L?UC@Vi�=AG�<Ti�SY@C¿M@VS�EMPq<YN�B(<T¿p<YB�8�KMS(J�L#<T¿cKMUkn�<�i#E^K!J�G�KML#;�KcUV<Yi4=�i?@CSYSY<TN�XjX]EpE9B�iE]N 9�SY<TN�@3�0<TSYSq@CLAKMi#@�=AG�@j8�i#@VL � i0N�KM;Z@jKMN�B­KMB(B�L?@Ci?i�KMili?EpE]N­KMif=?G�@!;2@CB�<YUVKc=A<TE]N�<Tili?G�<TJ�J�@CB A Ã��N =AG�@ EM=?G�@VLDG�KcN�B�`�E]N(@½UWKMN KMJ�J�L#EOKMU�G =AG�@½J(L?E]:�ST@V; :hn J(L?E6¿p<YB�<TN�X K UVL#npJ(=?E]X]L?KMJ�G�<TUi?EMSY8(=?<YE]N��0G�<YU�G�`$@k¿]@CN <TN±UWKMi#@Fi?E];Z@^EMP/=?G�@FJ�SYK6nM@VL#i!KML?@¢;�KMST<YUC<YE]8�i�KMN�B KcUC=!<TSYSY@CXOKMSTSTn]`(i#=A<TSYSJ�L#EM=A@CUC=Ail=?G�@jG�E]N�@Ci#=�J�KML#=?<Y@Cil<YNO¿]E]S>¿]@CB�þ E @CN�i?8�L#@jJ�L?<>¿MKcUCn]`9:�Ec=AG­K^SY@CX]<Yi#S�Kc=?<T¿]@�KMN�B­K¢=?@VU�G�N�EMSYE]X]<TUWKMS�@ ��E]L#=f<YifL#@Vgh8�<YL#@VB�Ã-Â$@C=f8�i

:�L#<Y@'�(nbKML?XM8�@E�0GOn]Ãm/L?<T¿cKMUkn­UWKMN¯E]N�STnb@D�9<Yi#=�<YN\K2i#E9UC<Y@C=�nD=?G�Kc=�L?@CUVE]X]N(<�V@Ci�<>=�Kci�K2L#<YX]GO=VÃ � N½KZ=?EM=�KcSY<T=AKML?<YKMN

i#=AKc=A@c` �0G�@CL?@&@C¿]@CL#nh=AG(<YN�X�<Ti$=AG�@-X]E6¿]@CL?N�;Z@VNO= � i:(8�i?<TN�@Vi#iV`]N�Ec=i#<Y;ZJ�STn�KMiK0S�K@�j`�:�8(=KMi�K8��K6nEMP(SY<T¿p<TN�X�`wK�;Z@VNO=AKMSY<>=�n]`6=AG�@CL?@-UWKMN¡:�@-N�E�i?8�U�G^=?G�<YN(X�à 4 <T=AGIE]L �0<T=?G�E]8(=�;ZE9B�@CL?Nj=A@CU�G�N�E]STE]XMn]`=AEc=�KMST<T=�KcL?<�KcN!i#=�K�=A@Vi/i#8�U�G KMi ¾ i?KML?<Ti#=RÁ�8�i#i?<YK�KMN�B¢=?G�@079E6¿p<Y@k= ��N�<YE]N¡=AG�Kc=i?8�UCUV@C@VB�@CB2<>=W`MG�K6¿M@:¤@V@VNDi#8�UVUC@Vi#i#Pd8�S$<TN�UWKcL?L#np<TN�X^E]8(=&=AEM=AKMS£i?8�L4¿]@C<YSYSYKMN�UC@�E6¿]@CL�=AG�@C<YL&i?8�:�F#@CUC=?iVà � N�P�KMUC=V`�KMi&@WKML#STnKMi!=AG(@Z;Z<YB(B�SY@^EcP&=?G�@ N�<YN�@k=A@C@VNO=AG UV@VNO=?8�L#nM`�=AG(@2Á08�i#i?<�KcN i#@VUCL?@C=¡J¤E]SY<TUV@���KMi���@CSYS/UWKcJ�KM:�ST@EMPqi?8�L4¿]@V<TSYSYKMN�UV@�E6¿]@CL �0G�E];Z@C¿M@VL&<T=/PdE]8�N(B��&E]L#=?GhnZEMP�i?8�U�GDK�=?=A@CNO=A<YEMN�à � <��pG�KM<YS£Â$@VL#;2EMNh=?E6¿�`E]N�@ EMPI=AG(@ �c@Cn Á08�i?i#<�KMN J¤E9@k=Ai­KMN�B <YNO=?@VSYST@VUk=A8�KMSTi�EMPI=AG�K�=­KMX]@M`8�0L?EM=?@ <YN 5 �M_�5½EcP¢=AG(@Á08�i?i#<�KMN i?@CUVL#@C=¡J�E]ST<YUC@FKMijG�KW¿p<YN�X­KMN �?KMSTS�9�i?@V@C<YN�X�@Cn]@ =<�KMiIK¯[&npUCSYE]J¤@�9�SY<��c@F;2EMN�i#=?@VL A KcN�B�?KMSTS�9�G�@WKML#<YN�XI@WKcL?iVà $ ;ZEpB�@VL#NbÁ�8�i#i?<YKMNb<YNO=A@CSYSY@CUC=?8�KMS `�$�ST@��(KMN�B(@VL�79E]S�VG�@CN�<T=?i#npNbB�@Vi#UVL#<Y:¤@VBi?EM;2@-:�SYEpEpB 9�U�G�<TSYST<YN�X�`C:�8(=�i#=?<YSYSOJ(L?<Y;Z<T=?<T¿M@/E]N¡=?G�@-=?@VU�G�N(E]SYE]XM<YUWKcSpST@C¿M@VS `�i?EMSY8(=?<YE]N�i$=?E�=AG(@-=?EM=�KMSi?8(L#¿]@C<YSTS�KMN�UC@2J(L?E]:�ST@V;­`�� =AG�EMi?@�B�@CJ�SYE6nM@VB :On+7p=�KMST<YN�� <TN+G�<Ti¡N�E6¿M@VS��� �� � #$ �% � � #$��� �kÃ

5�?

Page 20: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

$�S>=AG�EM8�X]G¢<TNO=A@VSTSY@CUC=A8�KMSYi�PdE]8�N�B¡=AG�<Tii#=AKc=A@�EMP£K �qKM<YL#i�i4=A<���<YN�X(`M<T=)��KMi �hN�E��0NZKMN�BFKMUCUV@CJ(=A@CB2KciK¢P�KMUk=lEMP�SY<>Pd@�=?G�Kc=f@k¿]@CL#nDJ¤@VL#i?E]N ��KMi �fK�=AU�G�@CB�à � =f<YifN�E¢i?8�L#J�L?<Ti?@M`�=?G�@VNq`(=AG�K�=f=AG�@�Á�8�i#i?<YKMNS�KcN�X]8�KMXM@�B�Ep@Vi0N�EM=�UVEMNh=AKM<YN­KMN¯KMB�@Cgh8�Kc=A@!=?LAKMN�i#S�Kc=?<YE]N�PdEMLf=AG�@!¿]@CL#n �&E]L?B �#J�L#<T¿cKMUkn]Ã

��N±=AG�@^Ec=AG�@CL�G�KMN�Bq`�<YN½KZPdL?@V@Fi#E9UC<Y@k=�n]`�J¤@VL#i?E]N�KcSJ�L#<T¿cKMUCn­<Ti�EMP�i?8(J�L?@C;2@^<T;2J¤E]L4=�KMN�UC@MÃ� =f<Ti�N�E¢UVE]<TN�UV<TB�@VN�UC@�=?G�Kc= �!@VEML?X]@ �!L>��@CSYS � i���������`9KcifE]J�J¤E]i?@CB�=AE¢:�EpE6�hi�E]N�;2E]N(i#=A@CL?ilKcN�B¿cKM;ZJ�<YL#@ViV`(<Yif=AG(@I8(ST=A<T;�K�=A@�G�EML?L?EMLlN�E6¿]@VS²Ã $ Pd@C@VST<YN�XFEMP�:¤@V<YN(X ��Kc=?U�G�@VB�`�KMN�B­EMP�E]N�@ � i�J�KMi4=:¤@V<YN(X�KMS��fKWnpi�EMN\L?@CUVE]L#B�`£<Yi�L?@CJ�8�X]N�KcNh=�<YN\KZi#E9UC<Y@k=�n­=?G�Kc=�<Yi�:�KMi#@VB±EMN­=?G�@¢J�L#<YN�UC<YJ�ST@�=AG�K�=J¤@VE]J�ST@fE]8�XMGh=/=?E!:�@&PdL?@V@f=?E!iAKWn �0G�Kc=/=AG�@kn¢=?G�<YN��¢KMN�BFB�EjKciR=AG�@kn^SY<��M@c`�0<T=?G�E]8(=/i#8�:�F#@CUC=A<TN�X=AG(@V;Zi?@VS>¿]@Ci�=?E =?G�@ji?UCL?8(=?<YNOn­KMN�Bb<YNO=?@VL#Pd@CL?@CN�UV@IEMP�EM=AG�@CL?iCÃ

��E��&@C¿]@CLV`�;Z@VL#@�L#@Vi#J�@CUC=�PdEML&J�L#<T¿cKMUkn��0<T=?G�E]8(=�KIi#@C=�EMP�ST<�KM:�<TSY<>=A<Y@CiRKc=#=�KMU�G(@VB2=?E¡¿p<YEMS�Kc=?<YN�X<T=V`�<Ti­N(EM=­K'i#8�7ZUV<T@VNO=\XM8�KMLAKcNh=?@V@cà ¾ G�<Ti­<Tib:�@CUWKM8�i#@+KcN E]L#XOKMN�<�WKc=?<YE]N UVKMN L?@Vi#J�@CUC=¯<T=?iUV8(i#=AEM;2@CL?i � J�L?<>¿MKcUCn�KMN�BDN�EM=��fKMNO=l=?E^X]@VN(@VLAKcSYSTn2B�<Ti?UVSTE]i?@�=AG�@C<YLfJ¤@VL#i?E]N�KMSqL#@VUVEML?B�iC`�:�8(=lN�Ec=E]:�F#@CUC=¡=AE±8�i#<YN�X­=AG�<Ti¡<TN(PdE]L#;�Kc=?<YE]N��0G�@CN³=AG�@CL?@2<YiIi?E];Z@C=?G�<YN�X­=AE¯:�@2XOKM<YN(@VB+:On 8�i?<TN�X\<>=WÃQJ�(KM;2J(SY@Vi2KML#@\i?@CSYST<YN�X UV8(i#=AEM;2@CL�B�Kc=AK =?E =A@CSY@C;�KML��M@k=A@VL#iV`lE]L2KMX]XML?@VX]Kc=A<TN�X½=AG�<Ti2B�K�=�K PdEMLi#=AKc=A<Ti#=?<YUWKcSfJ�8�L#J�E]i#@Vi2KMN�B'J�8�:�ST<Yi#G�<YN�X±=?G�@­L?@Vi#8�ST=?iVà � KMNOn J¤@VE]J�ST@�PdE]8�N�B'i?8(U�G J�LAKcUC=A<TUV@CiB�<Ti#=A8(L?:�<TN�X�`0KMN�B KciDK+L?@Ci?8�S>=W`�J�L?<>¿cKMUCn'L?@CX]8�SYKc=A<TE]N�iZG�KW¿]@½@V;Z@VL#X]@VB :¤EM=?G <YN�=?G�@ ��N(<T=A@CB7p=AKc=A@Ci¡KcN�B <YN½=AG�@ Q/8�L#E]J¤@WKMN���N�<TE]N�`�KMN(B J¤E]ST<YUCn��0<T=?G L?@Vi#J�@CUC=j=AEbJ�L#<T¿cKMUkn±<YN @CSY@VUk=AL#E]N�<YU=AL?KMN�i?KMUC=?<YE]N�i�UCE]NO=A<YNh8�@Ci�=?E�:¤@-K�i#8�:�F#@CUC=REcP�B�<Ti?UV8(i?i?<TE]NjPdE]L�SY@VX]KMS]i?U�G(E]S�KML#i�KML?E]8(N�B¡=?G�@ ��E]L#SYB�Ã

�IKcL#e�N��c@VS � ij:¤E9E6� � %� �� ��� %������­B�Ep@ViIKMN E]8(=?i#=�KcN�B�<YN(X F#E]: EMP�:(L?<YN(X]<YN�XbK�=?=A@CNO=A<YEMN=AEI=AG�@�J�L#E]:�SY@C;�EMP$J�L#<T¿cKMUkn <YN =AG�@�@VSY@CUC=?L?E]N�<TU8�&E]L#SYB�à ��@�:(L?<YN(X]i�K�=?=A@CNO=A<YEMN2=AEIi?EM;2@0Pd8�N�B�K 9;Z@VNO=�KMS��£K@�0i/<YNFJ�L?KMUC=?<YUC@Vi �0<YB(@VSTnIB�@CJ�SYE6nM@VB =AEpB�KWn]`OKMN(BZi#8�X]X]@Ci#=?i�K�Np8(;^:�@CL/EMP�KMJ�J�L#EOKMU�G�@Ci=AG�Kc=0SY@CX]<Yi#S�Kc=?E]L?ifi#G�E]8�STBbUVE]N�i#<YB�@CLVÃ

��E��&@C¿]@CLV`0K½SY@CXOKMSTSTn @VN(PdEML?UV@CB�UCE];2;Z<T=?;2@CNO=¢=AE J�L#<T¿cKMUkn³<Y;ZJ�ST<Y@Vi¡<YN�UCL?@VKMi?@CB�SY<YKM:�<TSY<T=?<Y@CiPdE]LjE]L#XOKMN�<�WKc=?<YE]N�iCÃ(%�E\;2Kc=?=?@VLjG�E���;^8�U�G+K¯X]<>¿]@VN E]L?X]KMN�<�VKc=A<TE]N i#=?L?<T¿M@ViI=AE­J�L?EM=?@VUk=¢=AG(@J�L#<T¿cKMUCn­EMPR<T=Ai�UV8�i4=AE];Z@VL#iV`�<T=�;�KWn­N�EM=�:�@¢K@�fKML#@¢=AG�Kc=�i#E];2@CE]N�@¡:�L?E6�c@^<YNO=?E�<T=?i�B�Kc=�KM:�KMi?@ �<T=�;�KWn�KMSYi#E^:�@�¿p8�STN�@VL?KM:�ST@�=AEF<TN�i?<TB�@VLlK�=?=�KcU+�piCà ¾ Gp8(iV`£<T=�<YifB�@Ci?<TLAKM:�ST@�=AE KcB�E]J(=0KFJ�L#<T¿cKMUkn 9@VN(G�KMN�UC<YN�X�=A@VU�G(N�E]SYEMXMn!=AG�K�=X]<>¿]@Ci�i#8�U�G KMN¢EML?XOKMN(<�WK�=A<YEMN�=AG�@&E]J�J¤E]L#=?8�N�<T=�n�=AE�ST@WKML#N¢Kci�ST<T=?=?SY@KM:¤E]8(=�EM=?G�@VL#i � J�@CL?i?EMN�KMS�<YN(PdEML?;2Kc=A<TE]NbKMi�<Yi�Kc=�KMSYS$J¤E]i?i#<Y:�ST@Mà ¾ G�Kc=�<Til=AE�i?KWn]`�KZ=A@CU�G�N�E]STE]XMn=AG�Kc= ��E]8(SYB­@VN�KM:(SY@IKMN\EML?XOKMN(<�WK�=A<YEMN�=AEZSY@VKML?N­E]N�S>n(�0G�Kc=�<T= � �"� � �=AEZSY@VKML?N�`£KcN�B­=?E2;2K�c@i?8(L?@!=AG�K�=�N(EZEc=AG�@CL�<TN(PdE]L#;�Kc=?<YE]N2<Yil=AL?KMN�i#;2<>=?=A@CB�=AEF=AG(@IEML?XOKMN(<�WK�=A<YEMN�Ã

$�N�Ec=AG�@CLlL?@WKci?E]NDPdE]LfJ(L?<T¿cKMUkn 9�@VN(G�KMN�UC<YN�X^=?@VU�G�N�EMSYE]X]<T@Vif<Ti�=AG�Kc=lSY@CXOKMS¤i#=AKMN�B�KML#B�ifPdE]LfJ(L?<�9¿cKMUCnIKcL?@�N�EM=�8�N�<>PdE]L?; =AG�L#E]8�X]G(E]8(=�=AG�@ �&E]L?STB �cnM@C=�J�@CE]J�SY@�@D�(J¤@VUk=�=?G�@-iAKM;Z@�SY@C¿M@VSOEMP(J�L?<>¿cKMUCnN�E ;2Kc=?=?@VL �0G�@CL?@j=AG�@jEM=?G�@VL0J�KML4=�nD<YilSTE9UVKc=A@CB�Ã

����� ��� � �������� %�� �����4�h��4�����Z���¤�!��%&"4%-�&�4���

¾ G�@b;ZE]i#= :�Kci?<YUDJ(L?<T¿cKMUkn 9�@VN(G�KMN�UC<YN�X½=A@CU�G�N�E]STE]XMn B(@VJ�STEwnM@VB =AEpB�KWn]`-<Yi^=?G�@­m Å m J�L#EM=AEpUVE]S<YNO=?L?EpB�8�UV@CB+:On =AG�@ 4 EML?SYB�9 4 <YB(@�9 4 @V:+[�E]N�i#E]L#=?<Y8�; <���������������������� �"!$#%��&�'�($�)�"!*� A à � N+KNh8(=Ai#G�@VSTS `M=?G�<Yi�=A@VU�G(N�E]SYEMXMn¢@CN�KM:�ST@ViR=?G�@lUVST<Y@VNO=RKMN�BFi?@CL#¿M@VL/=AE!N�@CX]EM=?<�Kc=?@fK�J�L#<T¿cKMUCn¡SY@k¿]@CS(=AG�K�=:¤EM=AG J�KML4=A<T@VijKML#@ZUCE]; PdE]L#=AKM:�SY@#�0<T=?G ��=?G�<Yi!<Ti!B�E]N�@F=?LAKMN�i#J�KML#@VNO=AS>n±=AED=AG(@F8�i?@CLVà ¾ G�@Z<YB�@VK<Yi0=AG�Kc=�K28�i#@VL � i�J�L#<T¿cKMUknbJ�L?@kPd@VL?@CN�UV@Ci!KML#@¡i#J�@CUV<Te�@VB±<TN\KZi#=�KcN�B�KML#B¯PdE]L#;*KMN�B\XM<T¿]@CN\=AEZG�<Ti:�L#E �0i#@VLCà ¾ G�@ji#@VL#¿M@VL � i�J�L?<>¿MKcUCnDJ¤E]SY<TUCn2<Yi �0L#<T=?=?@VN­<YN­K^PdE]L?; =AG�K�=�=?G�@j8�i?@CL � i�:(L?E��0i?@CL�UVKMN8�N�B(@VL?i4=�KMN(B KMN�B±UCE];2J�KML?@j=AE�=?G�@¢8(i?@VL � i�J�L?@kPd@VL?@CN�UV@CiV`�B(@C=A@CL?;Z<YN�<TN�X �0G�@C=?G�@VL�=?G�@¢=:�&EDKML#@UVEM;2J�K�=A<Y:(SY@M`(KMN�Bb<TP�i?E(`�N�@VX]Ec=A<�K�=A@�=?G�@jJ�L?<>¿MKcUCn�=?@VL?;Zil<YNbUCE];2J(SY<�KcN�UV@G�0<>=AGb:¤EM=AG­J�EMSY<YUC<Y@CiVÃ

�Ma

Page 21: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� =¢<Ti¡@k¿p<YB�@CNh=¡=AG�K�= �0G�<TSY@Zm Å m <YiIK¯B(@Vi?<TLAKM:(SY@F=A@CU�G�N�E]STE]XMn]`�<T=I<YiIE]N�S>n @ ��@VUk=A<T¿M@�<TN i#<T=�98�Kc=?<YE]N(iE�0G�@VN K­i#@VL4¿]@VLI<YN gh8�@Ci#=A<TE]N G�E]N�@Ci#=AS>n½B�@CUVS�KcL?@Vi��0G�K�=jB�Kc=�KD<>=j<Yi!X]E]<TN�X�=AEbUCE]SYST@VUC=KMN�B �0G�Kc=I<T=I<TNh=?@VN�B(iI=?E¯B�E&�0<T=?G =?G�@ B�Kc=�K­E]:(=AKM<YN�@CB�Ã.$ 8�i#@VLI;�KWn½EMLI;2KWn N�EM=I:¤@VSY<T@C¿M@<T=Và � E]L?@CEw¿M@VLC`&;2KMNOn³8�i#@VL#i2KcL?@DN�EM=FK���KML#@­EcP�m Å m KMN�B 8�N �0<T=#=A<TN�X]STn ��KM<T¿M@­K���KWn+=?G�@V<TLJ�L#<T¿cKMUCnMà ¾ Gh8�iV`¤m Å m�<Ti�J¤E���@CL?ST@Vi?i�KMXOKc<YN�i4=l;�KcSY<YUC<YE]8(ifKc=#=�KMU+�hiVÃ

$�N�Ec=AG�@CL^KW¿cKM<YSYKM:�SY@^=?@VU�G�N(E]SYE]Xcn <Yi¡KMN�E]NOnp;2<�V<TN�Xbi?@VL4¿p<YUV@Ci^i?8(U�G KMiI=?G�@�EMN�@ViIJ�L?E6¿p<YB(@VB:On!$�N�E]NOnp;2<�V@CLVà UVE];­Ã $ 8�i?@CLfEMP$i#8�U�GbK¢i?@CL#¿p<YUC@�UVKMN�:�L#E �0i#@�=AG(@ 4 @C:�<YN2i?8�U�GbK��fKWnZ=AG�K�==AG(@�i?@CL#¿M@VL KMUCUV@Vi#i?@CB'UVKMN�N�Ec=¢=AL?KMUV@Z=AG�<Ti¢8�i#@VLCà � N³EM=?G�@VL#��EML?B�iC`/i?8�U�G K­i?@VL4¿p<YUV@�J�L?E6¿p<YB�@Ci8�i#@VL?i#�0<T=?G+KMN(E]NOn9;ZE]8�iIU�G�KMN(N�@VSTiVà E]LjE]N 9�SY<TN�@^J�L#<T¿cKMUCnM`Kbi?@CL#¿p<YUC@�i#8�U�G KMi!=AG(<YiI<Yi!¿p<T=�KcS Ã4 <T=?G�E]8(=�<>=W`w<YN9PdE]L?;2Kc=A<TE]N�Kc:�E]89=KcSYSMEcP�KlX]<T¿M@VNI8�i?@CL � i�EMN 9�ST<YN�@/KcUC=A<>¿p<T=A<T@Vi�UVKMNI:�@�L?@k=AL#<Y@C¿M@VB¡:hn@��(KM;Z<YN(<YN�XI=AG�@!STE]X¢e�ST@VifEMP�=?G�<Yif8(i?@VL � i � NO=A@CL?N�@k=�i?@VL4¿p<YUV@!J(L?E6¿p<YB�@CL?iVà ��E �&@C¿M@VLC`�KcN�E]NOnp;2E]8(iU�G�KMN(N�@VSTi!KMSYEMN�@¢KcL?@IN�EM=�i#8�7ZUV<T@VNO=!<YN¯E]L?B(@VL�=?E�@ ��@VUk=A<>¿]@VS>n&��E]L����0<>=AG¯E]L?XOKcN�<�VKc=A<TE]N�il=AG�K�=L?@Cgh8�<YL#@�=AG�Kc=&=?G�@V<TL&UC8�i#=?E];Z@VL?i&G�KW¿]@�i#E];Z@�UCL?@VB(@VNO=A<YKMSYiCà $�N�KcN�E]NOnp;2E]8(i�UVL#@VB�@CNO=A<�KcS�i4n9i4=A@C;<Yi0KcSYi?E N�@CUV@Ci?iAKcL#n­<YNDi#8�U�G±K UWKMi#@MÃ

$�N�EMNhnp;ZE]8�iZUVL#@VB�@CNh=?<�KMS0i4n9i4=A@C;2i.��@CL?@\i#8�X]X]@Ci#=?@VB :On'H!KW¿p<YB�[�G�KM8�; � [�G�K�� L� à ¾ G�@e�L#i#=±J(L?E]J¤E]i?@CB3i#E]SY8(=?<YE]N ��KMi±K'J�L?EpEMP^EcPFUVE]N(UV@VJ9=½KMN�B <YNO¿]EMST¿]@CB K i#@V;Z<�9 =AL?8(i#=A@CB =?G�<YL#BJ�KML4=�n � [fQ ��� ÃZÂ�Kc=A@CLV`�H!KM;ZX��KML#B � H!KM;�? a� KMN�B+[�G�@VN � [�G(@@? L �&E]L��c@VB E]N =?G�@ J�L?EM:�SY@C;¯Ã¾ G�@C<YL�i?E]ST8(=A<TE]N�i�B�<YBIN�EM=�G�KW¿]@�K0=?L?8�i4=A@CB¢=AG�<TL?BIJ�KML4=�n]`M:(8(==?G�@&N(EM=A<TE]N¡EcP�8�i#@VL � i<TB�@VNO=?<T=�n���KMiN�EM=��&@VSTS�9�B�@C¿M@VSYEMJ�@CB�`$KMN�B½=?G�@VL#@CPdE]L#@F<T=E��KMijN�EM=!UCSY@VKML�G�E�� =?G�@V<TL�i#npi4=A@V;ZijUVE]8(SYB±Pd8�N�Uk=A<TE]N<YN UWKci?@Z;�KMST<YUC<YE]8�i�8�i?@CL?i¢i#G�KML#@VB+=?G�@V<TLIUCL?@CB�@VNO=A<YKMSYi��0<>=AG+Ec=AG�@CL?iVÃ(2�EM=AG EMPf=?G�@Vi#@2i#E]SY89=A<YEMN�&@VL?@¢N�EM=�i?Kc=A<Ti#P�KMUk=AE]L4nbPdL?E]; =AG(@^J�EM<YNO=�EcP/¿9<T@'� EMP�@�7ZUV<Y@CN�UCnM`1�0G�<TSY@¢[�G�@VN � i!i?EMSY8(=?<YE]N\KMSYi#ES�KcU+�M@VB¯K L?<YXME]L?E]8(ifB�@Ce�N�<T=?<YE]N­KMN�BbJ�L#E9EcPEMP�i?@CUV8�L#<T=�nMÃ

7p=A@kP�KMN 2&LAKMN�B(i � 2�LAK?6? ��EML��M@CB E]N =AG�@¯J�L?EM:�SY@C; EMP�;2K�h<YN(X J¤E]i#i?<Y:(SY@­K J�8(:�SY<TU�9:�c@Cn<YN9PdLAKMi4=AL?8(UC=A8(L?@�<²m H � A �0G�@VL#@2@CN�UVEpB�@VB <YNO=AEb@VKMU�G 8(i?@VL � i¡J�8�:�ST<YUI�c@Cnpi#�&E]8�STB :¤@ i?E];Z@ZKc=�9=AL#<Y:�89=A@ViCà E]L�@D�(KM;2J(SY@M`qKc=?=?L?<T:�8(=A@Ci�UVEM8�SYB±@CN�UVEpB�@¢=?G�<Yi�J�@CL?i?EMN � i�KMX]@M`qSY@C¿M@VS�EMP�@VB�8(UWKc=?<YE]N�`@C=?UMà $ G�E]STB�@VL0EMPRKZJ(8�:�SY<TU��M@Cn­UCE]8�SYB­U�G�EpE]i?@#�0G�<YU�G\Kc=?=?L?<T:�8(=A@Cil=AEZB�<Yi#UVSYEMi?@ �¤KMB(B�<T=?<YE]N�KcSYSTnM`<T=R<Yi/J¤E]i?i#<Y:�ST@f=AEjB�<Yi#UVSTE]i?@0KMNOnFEMN�@lEMPqKjL#<YU�G i?@k=-EMP�KcSYX]@C:�LAKM<TU�L#@VS�K�=A<YEMN�iRE]N =AG�@Ci?@�Kc=#=AL?<T:�8(=?@ViVÃ2�L?KMN�B�i0J�L#E]J�EMi?@Vi�i?EMSY8(=?<YE]N�i�:�KMi?@CB\E]ND=?G�@jB�<Yi#UVL?@k=A@D9�SYEMXOKML?<>=AG�; J�L#E]:�SY@C;¬KMN(B¯<>=Aif¿cKML?<YKMNO=AiCÃ

4 G�<YST@#2�LAKMN(B�i � �&E]L��bB�@k¿]@VSTE]J¤@VB±K i?@k=�EMPJ�E��&@VL4Pd8�S$=A@VU�G(N�<Ygh8�@Ci!KMN�B¯S�KWnbKFPdE]8�N�B�K�=A<YEMNPdE]L&J�L?<>¿MKcUCn 9�@CN�G�KMN�UC<YN�XFJ(8�:�SY<TU�9 �M@Cn2<YN9PdLAKMi4=AL?8(UC=A8(L?@ViC`�<T=�E]N�S>n2XM<T¿]@Ci0K¢i?EMSY8(=?<YE]N�PdEMLfK^i?J¤@VUC<�KMSUWKci?@jEMP=?G�@jX]@VN(@VLAKcS$J�L?E]:(SY@V; EMPKMN�E]NOnp;2EM8�i0UVL?@CB�@VNO=?<�KMS$i4n9i4=A@C;2iCÃ

$�i¯<YN KMNOn J�8�:�ST<YU�9 �M@kn <YN(PdL?KMi#=?L?8�Uk=A8�L#@M`�2�L?KMN�B�i � m H � L#@Vgh8�<YL#@Vib=AG�K�=±K UV@CL#=A<>e�UWK�=A<YEMNKM8(=?G�E]L#<T=�n < [�$ A UC@VL4=A<TP»n¯=AG�K�=!J�8�:�ST<YU��c@CnpiI:�@CSYE]N�X�=?E�¿cKMSY<TB±8�i?@CL?iCà � N 2�LAKMN(B�i � �&E]L��£`$=AG(@[�$ <Yif=?G�@ ��� ���!UVL?@CB�@VNO=?<�KMS 9�X]L?KMNO=A<YN(X^E]L?X]KMN�<�VKc=A<TE]N�Ã79@VUCE]N�B�`�<TP�KD8�i?@CLI=AKMS��hi�=?E­=:�&E¯B(< ��@VL?@CNO=¡@CNO=A<T=?<Y@CijKMN�B �fKMNO=?iI=?E­J(L?@C¿M@VNO=¢=?G�@V; PdL?E];

B�<Ti?UVE6¿M@VL?<TN�X =?G�Kc=Z=AG�@kn KML?@b=�KMS��h<YN�X =AE =AG�@¯iAKM;Z@­J�@CL?i?EMN�`lG�@­N�@V@CB�i�=AE G�KW¿]@¯=:��E³i#@VJ�K 9LAK�=A@M`�8�N�ST<YN���KM:(SY@^J�8(:�SY<TU.�c@CnpiVà ¾ G�Kc=¢L#@Vgh8�<TL?@Vij=AG�Kc=j=AG�@�[�$ UC@VL4=A<TP»n±:�EM=?G EcP�=AG(@Vi?@��M@kn9iCþ G�@CL?@CPdEML?@M`�:�Ec=AG¯=?G�@¢UCE];Z;^8�N�<TUWKc=?<YE]N­KMN�B¯=AG�@IUVE];ZJ�8(=AKc=A<TE]N�KMS$STEOKMB­E]N\=?G�@F[�$ <Yi�SY<YN(@WKML<YN½=?G�@F=AEM=AKMSRNh8�;^:¤@VLjEMP&8�N�ST<YN���KM:�ST@¢=AL?KMN�i?KMUC=?<YE]N�i�=AK�h<YN�XbJ�SYKMUV@F<TN½=AG�@ @VNO=?<YL?@ J�8(:�SY<TU�9:�c@Cn<YN9PdLAKMi4=AL?8(UC=A8(L?@MÃ

� 5

Page 22: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

����� ��� � �!���f���], ������� ��%&�f,�� ��], �#� ���� �±"����q� �%&�!�4� ����p��4���

$�:¤E6¿]@c`���@!;Z@VNO=?<YE]N�@CB�=AG�Kc=l<T=�<Yi&B�@Vi#<YLAKc:�SY@�K^8�i?@CL � il<YB�@CNh=?<T=�n ��� i?G�E]8(SYBDL?@C;�Kc<YN�i#@VUCL?@C=l=?EJ�L#@C¿]@CNO=¡<TB�@VNO=?<T=�nbPdLAKM8(B�ÃjÂ$@C=!8�i�N�E�� UCS�KML#<TP»n �0G�K�=!<Yi�;2@VKMNO=!:On½KMN±<TB�@VNO=?<T=�n\KMN�B �0GOn]`$<>P=AG(@j¿cKMST8�@ ��� <TilSY@WK �M@VBq`�<YB�@CNh=?<T=�n2PdLAKM8�B­;2K6n�L?@Ci?8�S>=WÃ

� N½KMN¯@VSY@CUC=?L?E]N�<TU¡i#@C=#=A<YN(X�`�<>=�<Yi�B�<�7ZUV8(ST=0=AE�J(8(=�K e�N�X]@CL�E]N��0G�Kc=�@��(KMUC=?STn¯KMN¯<YB�@CNh=?<T=�n<YiCà � i�KMNOnDX]<>¿]@CN\UVEM;2J�89=A@VLl=?@VL?;Z<YN�KMS$KMN­<YB�@CNO=A<T=�n�� ��L�KMNOnDX]<T¿M@VN¯@�9�;2KM<TS�KMB�B(L?@Vi#i$� �!L � mKMB�B(L?@Vi#i$�Â$@C=-8�i-KMN�KMS>n�V@f=AG(@�N(EM=A<TE]NFEMPqKMN <YB�@CNh=?<T=�n^KMi�<T=/L#@VS�K�=A@ViR=?EjUVL?@CB�@VNO=?<�KMSTiVà � N2K!J�LAKMXM;�Kc=?<YU

i?@CN�i?@c`�K!UVL#@VB�@CNO=A<�KcS¤<Ti/<Yi#i?8�@CB2=AE��0G�EM;2@k¿]@VL-<T=�<TiR=AG�K�=&UVKMNZS�Kc=?@VL/i?8(UVUV@C@VB�<TN B�@V;ZE]N�i4=ALAK�=A<YN(XE��0N�@VL#i?G�<TJ¯EcP�=?G�<Yi�UVL?@CB�@VNO=?<�KMS²Ã ¾ G�@VL#@CPdE]L#@M`�=AG(@!;2@VKMN�if=AG�Kc=l@VN�KM:�SY@!i#8�U�G¯K^B�@V;ZE]N�i4=ALAK�=A<YEMNB�@ke�N�@j=AG�@j<YB(@VNO=A<>=�n�EMP�=AG�@jUCL?@VB(@VNO=A<YKMS$E��0N�@VLCÃ

E]LF@��(KM;ZJ�SY@c`-=?E J�L?E6¿]@b=AG�Kc= � ;2KWn B�L#<T¿]@c` � UWKMN'B�@C;2E]N(i#=AL?Kc=A@D;¡n B�L?<>¿]@CL � iZST<YUC@VN�i#@�0G�<TU�G­G�KMil;¢n2J�<YUk=A8�L#@�E]Nb<T=Và ¾ G�@VL#@CPdE]L#@M`�<>=f<Yi�;¢n�J(<YUC=?8�L?@c`�KMN�BbKcSYi?E^=?G�@�P�KMUk=f=AG�K�= � G�K6¿M@;¢n+B�L?<>¿]@VL � i ST<YUV@CN�i?@D<TN ;¢n ��KMSTSY@C=V`R=AG�K�= B�@Ce�N(@­=?G�Kc=F<>=F<Yi � �0G�E UWKMN'J�L#Ew¿M@bJ�E]i#i?@Ci?i?<TE]NEMP&=AG�<Ti¡B�L#<T¿M@VL � iISY<YUC@VN�i#@M`�KMN�B =AG�@CL?@CPdEML?@ =AG�Kc=I=AG(@2ST<YUV@CN�i?@I��KMi¢<Ti?i#8�@VB+=?E¯;Z@ LAKc=?G�@VLj=AG�KMNKMNOn]EMN�@¡@CSYi#@MÃ

� N XM@VN�@CLAKMS²`$<YN½=AG�@ @CSY@VUk=AL#E]N�<YUFi#@C=#=A<YN(X�`$=AG�@ E]N�S>n±;Z@WKMN(ijK6¿cKM<TS�KM:(SY@¡PdEML!B�@V;ZE]N�i4=ALAK�=A<YN(XKMNOnh=AG�<TN�X <Yif=?G�@jB�Kc=�KFi4=AE]L#@VB­E]NbE]N�@ � i0;�KcU�G�<YN�@c`�:¤@I<>=lE]Nb=AG�@!G�KML?B­B�L?<>¿]@jE]LlE]N­KFi?J¤@VUC<�KMSB�@CB�<YUVKc=A@CB B(@C¿p<YUC@Zi#8�U�G³KcijKbi#;�KcL#=AUVKML?Bqà ¾ G�@CL?@CPdEML?@M`�=AG(@FB�Kc=�KDi4=AE]L#@VB E]N E]N�@ � i!;2KMU�G�<YN(@B�@ke�N�@Vi E]N(@ � iF@VSY@CUC=?L?E]N�<TU�<TB�@VNO=A<>=�n]`�KMN(B'ST@WK�h<TN�X\=AG(<Yi¢B�Kc=�K±UVKMN L?@Vi#8�ST=^<YN³<TB�@VNO=A<>=�n PdL?KM8�B�Ã� E]L#@VE6¿]@CLV`¤8�N�ST@Vi?i0:Onbi?EM;2@j;Z@WKMN�il=?G�<YilB�K�=�K UWKMN­:�@j<T;2J�SYKMNO=A@CBD<YNO=AE Gh8�;2KMN�iV`£@CSY@VUk=AL#E]N�<YU<YB(@VNO=A<>=�n��0<TSYS�N�EM=!UCE]L?L#@Vi?J¤E]N�B±=?EDJ�GOnpi?<YUVKMSR<TB�@VNO=A<>=�n\EcP&J¤@VEMJ�SY@c`qi?<TN�UV@Fi#@C¿M@VLAKcSRJ�@CE]J�ST@^;�KWnG�KW¿]@�KMUVUC@Vi?if=?E^K¢XM<T¿]@CN�;2KMU�G�<YN(@M`9KMN�BDKMSTi?E¡:�@CUWKM8�i#@�@VST@VUk=AL?EMN�<YU�B�Kc=�KIUWKMN�<²KMST;2E]i4=&KMS���KWn9i A:¤@IB(8�J�SY<TUWKc=?@VB�Ã

� =�<TiZ=?G�@VL#@CPdE]L#@\@C¿p<TB�@VNO=�=?G�Kc=2=AG�@¯<YB�@CNh=?<T=�n =?E �0G�<TU�G K+UVL#@VB�@CNO=A<�KcS�<Ti2<Ti?i?8(@VB UVKMN :¤@B�@ke�N�@VB¯:OnbK^i#=?L?<YN(XZEcP:�<>=AiCà ��E���@k¿]@CLV`�=AG�@jUCE]NO=A@VNO=?i�EMP�KMNOnD;2KMU�G�<TN�@!U�G�KMN(X]@Vi0E6¿]@CL0=?<Y;Z@Mþ G�@CL?@CPdEML?@M`9=AG�<Ti�i#=?L?<TN�X^EMP�:�<>=Ai&i?G�E]8(SYB�N�Ec=f:¤@�=AG�@�@VNO=A<TL?@�UCE]NO=A@CNh=?ilEMP$=AG(<Yi�8(i?@VL � il;2KMU�G�<TN�@M`:�8(=ji#<Y;ZJ�STn\KDi#=?L?<YN(X�=AG�Kc=j<Ti!i?8�7ZUC<Y@VNO=?STn±STE]N�X�=?E­:¤@F8�N�<Tgh8�@F=AED=AG�<Ti�;2KMU�G�<YN(@ KMN�B½=AEb:¤@G�KML#B­=?E2XM8�@Vi#iVà ¾ G(<Yi0<Yif=?L?8�@��0G�@C=?G�@VL0=AG(@¡@CSY@VUk=AL#E]N�<YU!UCL?@CB�@VNO=A<YKMSYi�KML#@IKMN�E]NOnp;2EM8�i0E]L0N�EM=WÃ4 G�Kc=<Yi�U�G�KMSTSY@VN(X]<YN�X0<TN¡=AG(<Yi�UVE]NO=A@D�p=/<Yi�B�<Yi#UVE]8(LAKMX]<TN�X�8�i?@CL?iPdL#E]; ;�K �p<TN�X0=AG�@C<YL�UVL?@CB�@VNO=?<�KMSTiKW¿cKM<YSYKM:�SY@�=AE EM=?G�@VL#iVÃ

� N³E]L#B�@VLj=AE¯SY<YN��½KMN+@CSY@CUC=AL#E]N�<TU2<TB�@VNO=A<>=�n � ��=AE\K¯J�8�:(SY<YUCSTn\L?@VUCE]X]N�<�WKM:(SY@Z@VNO=A<>=�n i?8�U�GKMi0KFJ¤@VL?i#E]N�`�KcN­EML?XOKMN(<�WK�=A<YEMN�`9EML0K^J�i?@C8�B�E]NOnp;¯`£i#E];2@�Pd8�N�UC=?<YE]N�� < � � A <YifJ�8(:�SY<Ti?G�@CB¯KcN�BUV@CL#=?<Te�@CB :hn�K+UCE]L?L#@Vi?J¤E]N�B(<YN�X³UC@VL4=A<Te�UWKc=?<YE]N�KM8(=AG(E]L?<>=�n�Kci�UVEML?L?@Ci?J¤E]N�B�<TN�X+=?E K+J¤@VL?i#E]N � iJ�GOnpi?<TUWKMS$<TB�@VNO=A<>=�n]Ã

$�N½@D��Kc;2J�ST@^EMP/=?G�@FKM:¤E6¿]@FX]@CN�@VL?KMSi#UV@VN�KML?<TED<Yi�K2J�8�:�ST<YU�9 �M@kn\<TN(PdLAKMi4=AL#8�UC=?8�L?@cà � N <>=W`�K8�i#@VL � i ��� <Yi�G(<Yi�i#@VUCL?@C=��c@Cn � �³Ã ¾ G�@^UVEML?L?@Ci?J¤E]N�B�<TN�XDJ�8�:(SY<YU#�M@kn ��� <Yi�J�8�:�ST<Yi?G(@VB�`$KcN�B=AG(@¢UV@CL#=?<Te�UVKc=A<TE]N±KM89=AG�E]L#<T=�nb:�<TN�B�i�<T=0=AE�i#E];Z@¡J�8(:�SY<TUVSTnbL#@VUCE]X]N�<�WKM:�ST@¡@CNO=A<T=�nM`�i#8�U�G KMi�=AG�<Ti8�i#@VL � i0N�KM;Z@Mà ¾ G�@j8�i#@VL0<Yi&=AG�@!E��0N�@CL�EcP�=?G�<YifJ(8�:�SY<TUE�M@kn ��� :¤@VUVKM8�i?@!=?G�@!UVE]L#L?@Ci?J¤E]N�B�<TN�Xi?@CUVL#@C=#�M@kn � � <Yi�i4=AE]L#@VB E]N½G�<Ti�;�KcU�G�<YN�@cà ¾ G(<Yi�<TiG�0G�Kc=j@CN�KM:�ST@Vi�=AG(@F8�i?@CL�=AEDL?@VKMB ;�Kc<YS=AG�Kc=0<Yil@CN�UVL4n9J9=A@VB��0<T=AGD=?G�<Yi ��� KcN�B­=?E <Yi?i#8�@ji?<TX]N�Kc=?8�L?@Ci�8(N�B�@VLl=?G�<Yi ���³Ã

� NF=AG�@fUCE]NO=A@D�9=�EcPqK�J(8�:�SY<TU�9 �M@Cn¡<YN9PdLAKMi4=AL?8(UC=A8(L?@M`MB�<Yi#UVE]8�L?KMX]<TN�X�8�i#@VL?iRPdL#E]; ;�K�h<TN�X�=?G�@V<TLUVL#@VB�@CNO=A<�KcSYi�KW¿MKc<YS�Kc:�SY@�=AEZEM=AG�@CL?i0<Yi0i#<Y;ZJ�SY@CL�=AG�KcN¯<TN­Ec=AG�@CL�UCE]NO=A@D�9=?iVà � = ��KMi�i?8�X]XM@Vi#=?@VB¯:hn

� �

Page 23: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

HG�&E]L��£`�Â$EM=?i?J�<T@VU�GbKMN(B&%�KME]L � H! %3? =AG�K�=l;�K �p<TN�X � � =?E9EI¿cKMSY8�Kc:�SY@0=AE^XM<T¿]@�K���KWn]`�KcN�BN�@CUV@Vi#iAKML4n PdE]L¢J(L?E6¿p<YN�X½J¤E]i?i#@Vi#i?<YEMN'EcP�K±UCL?@CB�@VNO=A<YKMS `;�K�c@Vi^=?G�@D8�i?@CLF8�N �0<YSTSY<YN(X­=?E½i?G�KML#@=AG(<YilUVL#@VB�@CNO=A<�KcS Ã

��E�� UWKMN � � :�@±;2KMB�@¯=AEpE³¿MKcSY8�KM:(SY@¯=?E X]<T¿M@ K@�fKWn�� E]L�@��(KM;ZJ�SY@c`�:On G�K6¿p<TN�X KJ�GOnpi?<TUWKMS�SY<�Kc:�<YST<T=�n¢Kc=?=AKMU�G�@VB�=?E^B�<Ti?UVSTE]i?<TN�XI<T=Wà ��KW¿p<YN�X¢=?E¢J�KWn�K¢SYEc=�EMP�;2E]N(@CnZi?G�EM8�SYB�EMN�@ � ii?@CUVL#@C=3�M@Cn � � :�@CUVE];Z@��hN�E��0N¯=?E =?G�@jJ�EMSY<YUC@G�&E]8�SYB­:¤@¡KcN­<TN�UV@CNO=A<T¿M@MÃ

4 <T=?G�E]8(=Ii?8(U�G³@��p=A@CL?N�KcS-;Z@WKcN�iV`�<T=I<Yi!J¤E]i#i?<Y:(SY@F=AE­B�<Yi#UVE]8(LAKMX]@ i#G�KML?<TN�Xb=AG�@Zi#=?L?<YN(X����:OnD;2K�h<YN�XZKMSTSqEMP�E]N�@ � i�UVL#@VB�@CNh=?<�KMSTilL?@k=AL?<T@C¿cKM:�ST@!8�i?<TN�XF=AG�<Tili#=?L?<YN(X � [f a 5 Ã

����� ����� � �� % !��� �������;�����(���

$�iZi#=AKc=A@CB @VKML?ST<Y@CLV`�UVL4n9J9=AE]X]L?KMJ�GOn'G�@VSTJ�i ;�K �M@bi?8�L#@­=?G�Kc=Z@VST@VUk=AL?EMN�<YU�=?LAKMN�i?KMUC=?<YE]N(iZ:(L?<YN(X=AG(@�<YNO=A@CX]L?<>=�n�KcN�BDJ�L?<>¿cKMUCn =AG�Kc=l<YN(B�<T¿p<YB(8�KMSYi-@��9J¤@VUk=l=AG�@C; =AE(`�KMN�BDi#<YX]N�Kc=A8�L#@�i#U�G�@V;Z@Vi�KML#@<YN(i#=AL#8�;Z@VNO=�KMS�<TN\KMU�G(<Y@C¿p<TN�XZ=?G�Kc=�X]EOKMS²Ã � N­=AG�<Ti�=?G�@Vi#<YiC`��&@¢UCE]N�i#<YB�@CL�=?G�@¢8�i#@Vi�EMPRi#<YX]N�K�=A8�L#@i?U�G(@V;Z@Vi�<YND=AG�@jUCE]NO=A@��p=�EMP�UVL#npJ(=?E]X]L?KMJ�G�<TUIJ(L?EM=?E9UCE]SYiCÃ

� N [�G�KMJ(=A@CL � �&@b<YNO=AL#E9B�8(UV@bN�EM=AKc=A<TE]N�`�KMN�B'L?@CUWKMSTSfB�@ke�N�<T=?<YE]N(i^PdE]LFB�<YXM<T=�KcS&i#<YX]N�K�=A8�L#@i?U�G(@V;Z@ViV`-UVEM;2;Z<T=?;2@CNh=¡i?U�G(@V;Z@ViV` V@CL?E 9 �hN�E��0SY@VB(X]@bJ�L?EpEMPdi^KcN�B J�L?EpEMPdi^EMP �hN�E��0ST@VB�X]@c`�Kci�&@VSYS�Kci�B(@Vi?UCL?<T:�@ji#=AKc=A@D9�EMP 9 =AG�@D9�KML4=lE]Nb=AG�@jUCE];2J¤E]i#<T=A<TE]N�EMP�=AG(@Vi?@IJ�L#EM=AEpUVE]STiVÃ

%�@D�9=V`�<TN¯[�G�KMJ(=?@VL?i Å `�_2KMN�B L `���@j=A8(L?Nb=AE =AG�@I8�i?@IEMP�i?<TX]N�Kc=?8�L?@ji?U�G(@V;Z@Vi�PdEML�KcN�E]NOn 9;ZE]8�i¢UCL?@CB�@VNO=A<YKMSfi4n9i4=A@C;2iCà � N'[�G�KMJ(=A@CL Å �&@DB�@Ce�N(@bKMN KMN�E]NOnp;ZE]8�i^UCL?@VB(@VNO=A<YKMS�i4n9i4=A@C;KMN�B i#G�E�� G�E�� =AEbUVEMN�i#=?L?8�Uk=j<T=!X]<>¿]@CN KMN KMJ�J�L#E]J�L?<YKc=A@¡i?<TX]N�Kc=?8�L?@Fi#U�G�@V;Z@Mà � N+[�G�KMJ(=A@CL!_�&@DX]<T¿M@�KMN KMJ(J�L?E]J(L?<�K�=A@Zi?<YXMN�Kc=A8(L?@�i#U�G�@V;Z@Mà [�G�KMJ9=A@VL L X]<T¿M@Vi^;Z@VU�G�KMN�<Yi#;2i¡PdE]L¢L#@C¿]EpUWK 9=A<TE]N EMP$KcN�E]NOnp;2E]8(i-UCL?@CB�@VNO=A<YKMSYiCÃ/m/L?@CSY<Y;Z<YN�KML#nI¿]@CL?i?<TE]N�i-EMP¤=AG�@�UVL#@VB�@CNh=?<�KMS£i4n9i4=A@C; KcN�B�KcN�BL?@k¿]EpUWKc=?<YE]N�;2@CU�G�KMN�<Ti?;Zi&J�L#@Vi#@VNO=A@CB¯G�@CL?@�G�K6¿M@�:¤@V@VNDJ(L?@C¿p<TE]8�i?S>nZJ�8�:�ST<Yi?G(@VB � [f a 5]`([f a � Ã

<YN�KMSYS>n]`¤[�G�KMJ9=A@VL X]<>¿]@Vi�K�N�@�� UCE]N�i4=AL?8(UC=A<TE]N±EMPR8�N�<Ygh8�@¡i?<TX]N�Kc=?8�L?@CiV`�KcN�B [�G�KMJ9=A@VL �@��9J�STE]L?@CiZ=?G�@­SY<Y;Z<T=?i^EMP�KMJ�J�ST<YUWKc:�<YST<T=�n EMP�i#<YX]N�Kc=A8�L#@¯i#U�G�@V;Z@Vi2<YN'J�L?Ec=AEpUVE]STiVà m�L#@VST<Y;Z<YN�KML4n¿]@CL?i#<YE]N�i�EMP�=AG�@Ci?@IG�KW¿]@IKMSTi?E :�@C@VN­J�L?@k¿p<YE]8�i#STnDJ(8�:�SY<Ti?G�@CB � Â�npi a � `£Â�Â�Á a �� Ã

�MÅ

Page 24: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� _

Page 25: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ����� �

� ����3 �� � � � ��

¾ G�<Ti�U�G�KcJ(=A@CL<YNO=?L?EpB�8�UV@Ci�=?G�@-N�EM=�K�=A<YEMN¢KMN(B¢B�@ke�N�<T=?<YE]N(i�EcP�i?@CUV8�L#<T=�njPdE]L�i?8�U�G¢UVL#npJ(=?E]X]L?KMJ�G�<TUUVEMN�i#=?L?8�Uk=A<YEMN�i�Kci-i#<YX]N�Kc=A8�L#@0i?U�G�@C;2@CiV`(UCE];Z;2<>=A;Z@VNO=/i?U�G(@V;Z@ViV` V@CL?E 9 �pN(E �0ST@VB�XM@�J�L#E9EcPdi&KcN�BJ�L#E9EMPdi�EMP)�pN(E �0ST@VB�XM@Mà ¾ G�@IKM<Y;�EMP�=?G�<YilU�G�KcJ(=A@CLl<Yi�=?EF;�K�c@�=AG�<Ti�=AG(@Vi?<Tili?@CSTP 9�UCE]NO=�KM<TN�@VBqà $P�KML-:�@k=?=?@VL&=?L?@VKc=A;Z@VNO=fEcP�=AG�<Ti&i#8�:�F#@CUC=0UWKcN�:�@�PdE]8�N�B�<YN �!B(@VB��!E]SYB�L#@V<TU�G � i-:¤E9E6� � EM8�N�B�K 9=A<TE]N�ilEMPR[�L#npJ(=?E]X]L?KMJ�GOn � �!E]S a 5 Ã

� ��� � !, �9���!��

Â$@C=�� :¤@�KMN�KMSTX]E]L#<T=AG(;¯Ã)2&n�I<� A �&@�B�@CN�EM=A@�=AG�K�=�� G�KMi-E]N�@�<YN�J(8(=�<dL?@Ci?J�Ã>`(:On�I<�� ������� � A�&@2B�@CN�EM=?@Z=?G�Kc=���G�KMiji?@k¿]@VL?KMS-<YN�J�89=Ai A Ã!2-n������ ����@ �0<YSTSRB�@CN�EM=A@ =AG�Kc=�� <TijKMN <YN�B�@D�9@VBP�KM;Z<YS>n2EcPRKMSTX]E]L#<T=AG(;2iCÃ��� �I<�� A B�@VN�Ec=A@Vi¡=AG�Kc= � �fKci^E]:(=AKM<YN�@CB+:On L?8�N�N(<YN�X�� E]N+<TN�J�8(=���à � N³UVKMi?@ � <Ti

B�@k=A@VL#;2<TN�<Yi4=A<TUM`O=AG�@CN�=AG�<Ti � <Yi&8�N�<Tgp8(@ �(<>P!�°<Ti&J�L#E]:�KM:(<YSY<Ti#=?<YUM`]=?G�@VN � <Yi&K¢L?KMN�B�E];�¿cKML?<YKM:�ST@MÃ� P#"±<YiK�e�N�<>=A@�i#@C=V`]=AG�@CN �$� "±B�@CN�EM=?@Vi=?G�Kc= � ��KMiRU�G�E]i#@VNFPdL?EM;�"±8�N(<TPdE]L#;2S>njKc=RL?KMN�B�EM;¯ÃÂ$@C=%��KMN�B'& :�@½<TNh=?@VL?KMUC=?<T¿]@ ¾ 8�L#<YN�X ;2KMU�G�<YN(@ViVà 2-n <)( � ��<* A,+ & <* A�- .�A `

�&@DB�@VN�Ec=A@�=?G�Kc=$( KMN�B . KML#@�LAKMN(B�E];�¿MKcL?<�Kc:�SY@CiI=?G�Kc=^UCE]L?L#@Vi#J�E]N(B =?E\=AG(@�E]8(=?J�8(=AiFEcP/�KMN�B'& KMibK L?@Ci?8�S>=bEMP¡=?G�@V<TL#F#E]<TNh=bUCE];ZJ�8(=�K�=A<YEMN�à $�ST=A@CL?N�K�=A<T¿M@VS>n]` ��@��0<YSTS�8�i#@½=AG�@ N�E 9=�K�=A<YEMN1032 �54J<6��<* A7+ & <* A�A PdE]L�=AG(@ E]89=AJ�8(=­EMP8�¢Ã 4 @��0<TSYS!KMSTi?E 8�i#@ =?G�@ N�EM=�K�=A<YEMN9 �;:=<>4 <��I<* A?+ & <� A�A =?E\B�@CN�EM=A@ =AG(@2@CNh=?<YL#@2UCE];2J(8(=�Kc=?<YE]N G�<Ti#=AEML#n½EMP5�¢`�<YN�UCSY8�B�<TN�Xb<T=?i<YN(J�8(=W`¤=AG�@¢UVE]NO=A@CNO=Ai!EMP�<>=Ai�L?KMN�B�EM; =AKMJ�@c`�KMN(B KMSYS�=AG�@¢;2@Ci?iAKcX]@Vi@� L?@VUC@V<>¿]@VB½PdL#E];A&�à � NUWKci?@jEMP�;2E]L#@�=AG�KcNb=:�&EZJ�S�KWn]@CL?iC`���@��0<YSTS�KMSTi?E 8�i#@j=?G�@!N�EM=AKc=A<TE]NB032 �3KcN�B 9 �C:3< <YND=AG(@KMN�KcSYE]X]EM8�i$P�KMi?G�<TE]N�à 4 @ �0<YSYSOi#E];Z@C=A<T;2@Ci�8(i?@�N(EM=�Kc=?<YE]NIi?8(U�G2Kci � 9 �C:=<D4E F032 �HG <6� + & A=AE B�@CN�EM=?@I=?G�@�F#E]<YNO=lB�<Ti#=?L?<Y:(8(=A<TE]NDE]ND=AG�@!¿p<Y@��°EMPI� KMN�B­E]8(=?J�8(=0EMPJ&�ÃÂ$@C= . :¤@2Kb:¤E9E]ST@WKMN±Pd8(N�UC=?<YE]N�à ¾ G(@2N�Ec=�Kc=?<YE]N < ��� �I<K� A À . < � A�A B�@CN�EM=?@Vij=AG�@ @C¿M@VNO=

=AG�Kc= . < � A <Yif=AL#8�@IKcP»=A@CL � ��KMi�XM@VN�@CLAKc=?@VB­:hnbL#8�N�N�<TN�X$� E]Nb<YN�J�89=H��þ G�@Ii#=�K�=A@V;Z@VNO=

m�L �MLN�PO � �QO>< � O ASR �UT O TWV À . <K� V A #XZY;Z@WKMN�i!=?G�Kc=!=AG(@2J�L#E]:�KM:(<YSY<>=�n¯=?G�Kc= . <�� V A <Yi ¾ Á ��Q KcP»=A@CL�=AG�@ ¿cKMSY8�@=� V ��KMiIE]:(=AKM<YN�@CB :hnL?8(N�N�<YN(X KcSYX]E]L#<T=?G�;2i�� � ������! C� V E]N <YN(J�8(=Ai � � ������� � V `-<Yi Y ` �0G(@VL?@D=?G�@DJ�L?EM:�KM:�<TSY<T=�n <Ti

�6L

Page 26: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

E6¿]@CL�=?G�@jLAKMN�B(E]; U�G�EM<YUV@Ci�EcP�=?G�@jJ�L?E]:�KM:�<YST<Yi4=A<YU�KMSYXME]L?<>=AG�;Zi&<TNO¿]E]S>¿]@VBqÃ2&n�� � � � <� A ` ��@^B(@VN�EM=?@ K ¾ 8�L?<TN�XD;�KcU�G�<YN�@I=AG�K�=�;2K�M@Ci!E]LAKMUCSY@¡gp8(@VL?<T@ViCà � à @MÃ>`q=?G�<Yi�;�K 9

U�G�<TN�@��0<YSYS�G�KW¿]@IKMN­KMB�B(<T=A<TE]N�KMS <�L#@WKMB�" �0L?<T=?@�9�E]N�UV@ A gh8�@VL4n�=�KMJ¤@M`�EMN&�0G(<YU�Gb<T=C�0<TSYS �0L#<T=?@�<T=?igh8�@VL#<Y@Ci�<YN2:�<YN�KML#n��(EMN�UV@�<T=-<Yi&B�E]N�@8�0L?<T=?<YN�X¡K¡gh8�@CL#nM`�<T=-<YN(i?@VL4=Ai�K¢i?J¤@VUC<�KMS£i#np;^:¤E]S � � �à 2&n@��p=?@VL?N�KMS£;2@VKMN�iV`pE]N�UC@�=?G�@0i#np;^:¤E]S&� � ¢KcJ�J�@VKML?i-E]N =AG�@�gh8�@VL4n =�KMJ¤@M`pKMNZE]LAKcUVSY@0<Ti-<TNO¿]E6�c@VBKMN�B­<T=?i0KMN�i>��@CL�KMJ(J�@VKML?i0E]ND=AG(@Igh8�@CL#nD=AKMJ�@IKMB F?KMUV@CNh=0=?E =?G�@!� �  i#np;^:¤E]S à 2&n

� X �!<���� <K� A�A � ��� <�� A�&@ B(@VN�EM=?@½=AG�@ UVEMNh=?@VNO=Ai­EMPI=AG�@ gh8�@CL#n =�KcJ�@½E]N(UV@,� =A@CL?;Z<YN�Kc=?@ViC`3�0<T=?G E]LAKMUCSY@�� KcN�B<YN(J�8(= ��ÃI2&n=<� ;( A� � �&@ZB(@VN�EM=?@F=AG�@F@k¿]@VNO=I=AG�K�=��!�fKci¡K�gh8�@CL#n <Ti?i?8(@VB :On��¢`�KMN�B (��KMi�=?G�@IKMN�i>��@CL�L#@VUV@C<T¿M@VBbPdL?E];¬EMLAKMUCSY@��2Ã

2&n�� - & ��@�B(@VN�EM=?@�=?G�Kc=�KMSYX]EML?<T=?G�;�� G�KMi&:�S�KcU+� 9�:�E@��KMUCUV@Vi#i�=AE¢KMSYXME]L?<>=AG�;�&�`9<²Ã @cÃR<T=UWKcN¯<TNh¿ME6�M@�& �0<T=?G¯KcN\KML#:�<T=?LAKML4n�<TN�J�8(=�KMN(B­L#@Vi#@C= & � i0i4=�Kc=?@MÃ

4 @¡iAKWnb=AG�K�=��1<�� A <Yi�K2N�@CX]SY<TX]<Y:(SY@�Pd8(N�UC=?<YE]N�`£<>PPdE]L�KMSTS$J�E]S>npN�E];Z<�KMSTi��)<�� A `�PdE]L�KMSYS$i#8�7I9UV<T@VNO=AS>n�SYKML?X]@��¤`�� <�� A�� 5����)<�� A ÃÂ$@C=I�I<>5�� A KMN�B8& <>5�� A :¤@-=:�&E�J(L?E]:�Kc:�<YST<Yi#=?<YU/KcSYX]E]L#<T=?G�;2iCÃ/2&n?���� & ��@&B�@VN�Ec=A@�=AG�Kc=$PdEML

KMSTSpJ(L?E]:�Kc:�<YST<Yi#=?<YU�J¤E]STnpN�E];Z<�KcS�9�=?<Y;Z@�P�KM;Z<YST<Y@Ci�EcP¤KMB(¿]@CL?i?KML?<T@Vi�L� � R `M=AG(@VL?@�@��9<Yi4=Ai�K�N�@CX]SY<TX]<Y:(SY@Pd8�N�Uk=A<TE]N!�bi#8�U�G¯=?G�Kc=lPdE]L0KMSTS"��`

m/L�� ��# � �I< 5 � A � � � � & < 5 � A � . � L a @5 R � .%$ � � ��& A À .HXZ.%$ X � <�� A

� ��� .0��' �������!i��� !� �|���7�� +��j% ��!� ��������� �� +� ��������� ���

¾ G�@IPdE]SYSTE �0<TN�XFB�@ke�N�<T=?<YE]N­<Yi�B�8�@I=AE(�jE]STB���KMi?i#@VLV` � <TUWKMST< `£KMN(B±Á0<T¿]@Ci#= � � � Á ��� `¤KMN�B±G�Kci:¤@VUVEM;2@�=AG�@&i#=AKMN�B�KML#B¢B�@ke�N�<>=A<YEMN¡EMP�i?@VUC8�L?<>=�njPdE]L�i#<YX]N�Kc=A8�L#@&i#U�G�@V;Z@ViCÃ�79U�G�@C;2@Ci=AG�Kc=i?Kc=A<Ti#P»n<T=RKML?@�KMSYi#EE�hN�E��0NZKMiRi?<TX]N�Kc=?8�L?@�i?U�G�@C;2@Ci/i?@VUC8�L?@0KcXOKM<YN(i#= � ���% �)( � � � �� �� �+* � �" " �� % % �"��Ã�2#-, ������&�� /. /.&�10 9 � � *) ���*�,# - ����#%'5#32�. �&#�� � ���� ��� �% ��� � � ��� � ��� � �4* % � � � � ��� # � % ���� <�5�<* A 7638)(:9 � � � <* A <;>=�'�8@?BA � � � <�� � A�ADCFE � ��#"�G5 � % � � ����� �� � ��#� % ����� � ��� # � % ��� C 638)(:9 � % � � �� � � % � #$� � ��� #�� % ��� C � �H;>=�'�8�?IA % � �J( ��# � K � %������ � ��� # � % ��� C � ���� �%�� % �% � � � � � % � �� �L*� % � #$� �� � � � �NM � # OM � � ���QP � � ��SR � � ��� % � �(����������� ����� ���!T �UM � �" " �� � �"�" WV � � �� MYX

6"���,��#%���� *#%- - �)M � �" " �� ' � �� � % � �� �" " �� � �"�ZM � # � �)( � � ��� �������)����� ��� C � �� � � % � �(� � # #$�" � ��� � � ���( ��"��#$��% ����� C % � � � % � � � �%���� % �UM[638 (:9+\%]E< ' A^E � � � � E �� ���� �"�"� ��% � ����� % � �_( ��# � K � % ����� � ��� # � % ���`;3=�'�8�?BA>a ]Wb�c � #$�dM � # � � ��� C M � # � �Z(� ��� �" ' � �_�eX

m/L���< ��� � � A � 5�<>5 � A � � � 638)(-9 \%] < ' A À ' V a ]gf!h ;3=�'�8�?BA3a ] < '� � A #X a

9 # � �*�,��� 3 :[( � � � M �� �L( ��#$ #�� � � #� ��� � �"�"�" " %���% � � �� � � � ��� � ��� # � % ��� E ���� ����#��@*(�� ��" �� � � %��#$�" ���� � �" " ��" �UM % � � �L( ��#" # �ji � � � ���"� C % � � �L( ��#$ #�� � � � � %��#$� % � 1(� ��� � �� � � % �#"� ��� � �" " �� � � % �SR ��������� % ���1k�� ��#���� � blc � #$�OM � # � � ��� C

Page 27: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

M � # � �BM � � �����" �UM)��#�� � ���� ��� �%���� � � ����� ��� � �4* %�� � � � #� ��� � � �# � ��� � � �� � �" �L � � � �� R:C% � ��#$� �SR � �% � ��� ��� � � ��� ��M ��� ��% ����� � <�� A �� � � % � %

m/L ��<����� � � A � 5�<>5 � A � <� � � A � � ��������� ��� �� < 5 � A 
;>=�'�8�?IA a ]�< '� � A�X 5 f!h <�� � $� < '� � A � A X � <�� A

� ��� # !�� � ���� ���| ��������� ���

$ UCE];2;Z<T=?;2@CNO=�i#U�G�@V;Z@F<Yi�K2=:�&E 9�J�KcL#=�n¯J�L?EM=?E9UCE]S�:�@k=:��@C@VN K�UVE];Z;Z<T=?=?@VL�KMN�B½K�L#@VUC@V<T¿M@VLCÃ� =FUCE]N�i?<Ti#=?iFEMPl=:��E i4=�KMX]@CiVÀZ=AG�@ � ��� � � %-i#=AKMX]@bKMN(B³=AG�@ �)��( � �$i4=�KMX]@cà ¾ G�@DUVE];Z;Z<T=?=?@VLL?@CUV@C<T¿]@CibK ¿cKMSY8(@ � KMi�<TN�J�8(=2=AE+=?G�@ � ��� � � %0i#=AKMX]@c`�KcN�B L?@k¿]@WKcSYi�=?G�<YiZ¿MKcSY8�@%� =AE³=AG(@L?@CUV@C<T¿]@CL�K�=F=AG�@��)��( � ��i4=�KMXM@MÃ=$*J�L?Ec=AEpUVE]Sf<Ti K i#@VUC8�L?@­UVE];Z;Z<T=A;Z@VNO=¢i?U�G�@C;2@­<TP�Kc= =AG(@@VN(B�EMP�=?G�@ � ��� � � %£i#=AKMX]@�=AG�@�L?@VUC@V<>¿]@VL&UWKMN(N�EM=fUCE];ZJ�8(=A@�KMNOnh=AG�<TN�XFKM:¤E]8(=-=AG(@�UVEM;2;Z<T=#=A@VB¿cKMSY8(@M`RKcN�B =?G�@VL#@�@��9<Yi4=Ai¡E]N�STn EMN�@2¿cKMST8�@F=AG�Kc=¡=AG�@2UVE];Z;Z<T=?=?@VL!UVKMN³L?@k¿]@VKMSfKc=I=AG(@ �)��( � �i#=AKMX]@cÃ[�E];Z;2<>=A;Z@VNO=¢i#U�G�@V;Z@Vi i#E];2@k=A<T;2@Ci¢G�KW¿]@bK±J(L?@�9�J�L?EpUV@Ci?i#<YN�X J�G�Kci?@DB�8�L#<YN�X��0G�<YU�G =AG(@

J�KML?KM;Z@C=A@CL?i0EMP�=AG�@jUCE];2;Z<T=?;2@CNO=fi?U�G(@V;Z@¢KML#@!i?@k=�8�Jqà E]L�=?G�@�J(8�L?J¤E]i?@CiREMP�=?G�<Yi�=AG(@Vi?<TiV`�&@ �0<TSYSOUCE]N�i?<TB�@VLK�ST@Vi?i�X]@VN(@VLAKcS9UCS�KMi#iEMP�UCE];Z;2<>=A;Z@VNO=Ai

E]N�S>n]`�N�KM;2@CSTn2=AG�@IUVSYKMi?i0EMP�N�E]N 9�<YNO=A@CLAKMUk=A<>¿]@jUVE];Z;Z<T=A;Z@VNO=?iVÃ�79EM;2@k=A<Y;Z@ViC`�<T=0<TilB�@Vi#<YL?KM:�SY@�=?EL?@CB�8�UC@¡=AG(@¡Kc;2E]8(Nh=�EMPUVE];Z;^8�N(<YUWK�=A<YEMNDN�@V@CB�@VB±<TN­KZUCE];2;Z<T=?;2@CNO=0i?U�G�@C;2@j=AEZE]N�@IL?E]8(N�BJ¤@VL0i#=AKMX]@MÃ[�E];Z;2<>=A;Z@VNO=�KML?@I<Y;ZJ�EML#=�KcNh=0:(8�<YSTB�<YN�XZ:�STE9U+�hi0PdE]L�@Ci?i#@VNO=A<YKMSYS>n­KMSYS$UCL#npJ(=AEMX]LAKMJ(G�<YU¡J�L?E 9

=AEpUVEMSYiV`�PdL?E]; C@VL#E 9:�hN�E��0SY@CB�X]@ J�L?EpEMPdiD=AE';^8�S>=A< 9�J�KML4=�n UCE];2J(8(=�Kc=?<YE]Nqà ��@VL#@M`E�&@+X]<>¿]@ KB�@ke�N�<T=?<YE]N2EMP$N�EMN 9�<TNh=?@VL?KMUC=?<T¿]@�UVEM;2;Z<T=?;2@CNh=�i#U�G�@V;Z@ViCà � N�X]@VN(@VLAKcS `9K¡UVEM;2;Z<T=?;2@CNh=-i#U�G�@V;Z@N�@C@VB N�EM=!:¤@^<TNh=?@VL?KMUC=?<T¿]@cà ��E���@k¿]@CLV`�PdE]L�=?G�@FUVE]N(i#=AL#8�UC=?<YE]N(iG��@FXM<T¿]@¢<YN±=AG(@^i?@Cgp8(@VS `�=?G�@VL#@<YilN(E2N�@C@VBbPdE]Lf=AG(@I;ZE]L#@!X]@VN�@CLAKMS$B(@Ce�N�<>=A<TE]N�Ã

$ N�E]N 9�<YNO=A@CLAKMUk=A<T¿M@/UVE];Z;Z<T=A;Z@VNO=$i#U�G�@V;Z@-UVE]N�i#<Yi4=Ai�EMP(K�i#@C=�9�8�J¡KMSYX]EML?<T=?G�;��b=?G�Kc=�i?@k=Ai�8�J=AG(@^J�8�:�ST<YU¡J�KMLAKc;2@k=A@VL#i�PdE]L�=AG�@^i#U�G�@V;Z@M`�KcN�B½K�UVEM;2;Z<T=?;2@CNh=0Pd8�N(UC=A<TE]N��"&����/8 �qÃ�� =AK�M@CiKMi2<YN�J�89=�F#8�i4=2=?G�@\i#@VUC8�L?<>=�n�J�KcLAKM;Z@C=?@VL&5 �¯KMN�B J�L#E9B(8�UV@Ci2=AG(@\J�8�:(SY<YU&�c@Cn ��� à <²79E];Z@UVEM;2;Z<T=?;2@CNh=�i?U�G�@C;2@CijB�EbN�EM=jN�@C@VB K�i?@C=>9�8�J J�G�Kci?@ ��PdE]L�=?G�@Vi#@M` ��@ UVKMN <Y;2KMX]<YN(@I=?G�Kc=��i?<T;2J(STn�EM8(=AJ�89=Ail=AG�@I8�N�<Tgh8�@ ��� X 5 �!E]N­<YN�J�89= 5��cà A [�E]L#L?@Ci?J¤E]N�B�<TN�XZ=?E2@VKMU�G\J(8�:�SY<TU��M@kn���³`�=?G�@VL#@¢<Yi�K2;Z@Vi#iAKMX]@¡i?J�KcUV@_V a ] Ã��"&����e8)�¯<Yi�K2B�@k=A@CL?;Z<YN�<Ti#=A<TUIKMSYX]EML?<T=?G�; =?G�Kc=�=AK�M@CiKMi0<YN(J�8(=l=AG(@j¿cKMST8�@ViC` ���³` � V a ] `�KMN(B\K � 9�:�<T=0L?KMN�B�E]; i#=?L?<YN(X��pÃ

� N E]L#B�@VL =AE UVE];Z;Z<T=F=AE+K ¿cKMST8�@ � V a ] `�=?G�@\[�E];2;Z<T=#=A@CLFX]@VN�@CLAKc=?@Vi�K LAKcN�B�E];�p`!UVE];ZJ�8(=?@Vi�� X �"&����e8 � <����� � � A KMN�B i?@CN�B�i�� =?E =AG(@ L#@VUV@C<T¿M@VLVà � N =AG�@+Á�@k¿]@WKcSi#=AKMX]@c`�=AG�@ [�E];Z;Z<T=?=?@VL2L?@C¿M@WKMSTiD=AG�@½¿cKMSY8(@Vi � KMN(B��p`�KcN�B =?G�@ Á�@CUV@C<T¿]@CL­¿M@VL#<Te�@CL?iD=AG�K�=� X �"&����e8)�/< ���� � � A à � E]L?@!PdE]L#;�KMSTSTn¤À�2#-, ������&�� /. 0/.&�10 6"��''� ��'5#% 4� -�� �*#%'5#32�. � � ��� # � % ���� #<��5 �"&����/8 � A � ���� �% � %��% � � ���+* � � % ��# ��% �)( � ������������*������ � ��� � � % � � � % �� � � � � � M % � � ������� � ��#� % ����� � ��� # � % ���!� #����� � � ��#�� � ���� ��� �% ��� � � ����� ��� � � % � � � C E �� � �"�$&����e8 � � (� � ����� ��� � �4* %�� � � � ��� ��� %� ���� � M ��� ��*% ����� % � % %� ���" � � ���% (� ��� �H� � � #� � ����� �% #�� ���$# � � � �% ���% � ��� � � % � � � %� �� � ��% � % % � � M � � � � E � ��� % E �(��#��"� ��# %����" � � � �-X

� �

Page 28: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��<YB�<TN�X&<²K9à �£Ã K(Ã�i?@V;2KMNO=A<TU!i?@CUV8�L#<T=�n A X :[( � � � M(% � � �L( ��#$ # � � � �� ��(% � � � � ���% � � �%�# �)*���%������ � M � # % � � (� ��� �@� %�� E ���� � % � � � ��� � � %�% ��# � ��� � � % C � � � � # �� � � � � #$�� � M � # � % ����� �� � �% % �� (� ��� � % � � E � % � � ��� ���% ���� � M #���� % � �)� � ��� % � � �% # � ��� % ������ % ���� M bOc � #$�[M � # � � ��� C % � ��#$� �SR � �% � ��� ����� � %& �� � �� % � # � ��� # � % ��� " �� � � % � %M � # � � �L( ��#$ # ���" � C % � ��#$� �SR � �% � ��� ��� � � ��� ��M ��� ��% ����� � �� � � % � %

m/L�� ��� � � <>5 � A � <�� � A � �<>5 � � � A �� � L a @5 R � � � � � �

� # � �"&����e8 � <����� � � A � � � � " <����� �� A �. � L a @5 R � . $ � �<�� � & A À . $ XZ.$ �� 5�� ��� �1<�� A

2�<TN�B�<TN�X�X � � ��#�� � ���� ��� �%������ � ��� � ��� � �4* % � � � � ���+* ��� � M � # � �L( ��#$ # �J � � �"� � � � ��� � � % � � � %�� � % E � � � � ��#"� � % E �� bgc � #$��M � # � � ��� M � # � �Z C % � ��#$�!�SR � �% � ��� ��� � � ��� ��M ��� ��% ����� � �� � � % � %m�L�� ��� � � <>5 � A � <�� � �� � � � � � A � �<���� A À � � � � V a ]Qf � �X � �f �"&����e8 � <�� �� � � � � A X �"&����/8 � < ���� � � � � A #X � <�� A

�7#%'5)+���� ¾ G�@�B�@Ce�N(<T=A<TE]N X]<T¿M@VN�KM:�E6¿M@�L#@Vgh8�<YL#@Vi�i?@C;�KcNh=?<YU0i?@CUV8�L#<T=�nZEMP¤=AG�@�UVEM;2;Z<T=#=A@VB¿cKMSY8(@Mà � =l<TilK^UVSYKMi?i#<YUWKcSqL?@Ci?8�S>=0B�8�@�=?E.�jE]STB���KMi?i#@VL0KMN�B � <YUWKcSY< � � � �M_ =AG�K�=0@Vgh8�<T¿cKMST@VNO=AS>n]`�&@lUVE]8�STB^i#=AKc=A@f=?G�<Yi�B�@Ce�N�<T=?<YE]NFKciPdE]SYSTE��0iVÀ$=AG�@fKMB(¿]@CL?i?KML#n¢U�G�E9EMi?@Vi���#�KMN(B=� � `OKMN�BFL#@VUV@C<T¿M@ViK¯UCE];Z;2<>=A;Z@VNO=j=AE±K­LAKMN(B�E];�E]N�@2EMPf=AG(@V;­Ã ¾ G�@2i?@CUV8�L#<T=�n EMPf=AG(@�UVEM;2;Z<T=?;2@CNh=Ii#U�G�@V;Z@;Z@WKMN�i-=AG�K�=�=AG(@!KMB(¿M@VL?i?KML#n�UWKMN(N�EM=�=?@VSTSqK¢UCE];Z;2<>=A;Z@VNO=�=AE �0G�<TU�GDE]N�@�EcP�=AG�@C; <>=fL#@VUV@C<T¿M@VBKMNOnD:¤@C=#=A@VLl=?G�KMN­:hn�LAKMN�B(E];¬X]8�@Ci?i#<YN�X�Ã

� $�)������,- ��� � ��''� ��'5#% 4� - ���*# '�# - 79<TN�UV@¡UVE];Z;2<>=A;Z@VNO=0i?U�G(@V;Z@VijKML#@¡EMPPd8�N�B�KM;Z@VN�9=�KcS&<T;2J¤E]L#=AKMN�UC@2<TN+UVL4npJ(=AE]XMLAKMJ�G(<YU�J�L#EM=AEpUVEMSYiV`�;�KcNhn i#J�@CUV<�KcS �£KW¿ME]L?iFEMPl=?G�@V; G�KW¿]@�:�@C@VNUVEMN�i?<TB�@VL#@VB <YN =AG(@�SY<>=A@CLAKc=?8�L?@cà � E]i#=¢N�EM=�Kc:�STnM`�=AG(@VL?@�KML?@28�N�UCE]N�B�<>=A<YEMN�KMSYS>n±G�<TB�<YN(X <dL?@Vi#J�Ã>`:�<TN�B�<YN(X A UVEM;2;Z<T=?;2@CNh=?i�PdE]L �0G(<YU�G =AG�@0G�<TB�<YN�X.<dL?@Ci?J�Ã>`h:�<YN�B(<YN�X A J�L?E]J¤@VL4=�nFB�@Ci?UVL#<Y:¤@VB2KM:¤Ew¿M@G�E]STB�ij@C¿M@VN KMX]KM<YN�i4=IKDUVE];ZJ�8(=AKc=A<TE]N�KMSTSTn¯8�Nh:�E]8(N�B�@VB L?@CUV<YJ(<Y@VNO=!<�L#@Vi#J�ÃT`�UVEM;2;Z<T=#=A@VL A ��N�E]N�9;2KMSYST@WKM:�ST@KcN�Bj;^8(=A8�KMSYS>n�<TN�B�@CJ�@CN�B�@VNO=�UVEM;2;Z<T=?;2@CNh=?i � H!H�% a]a `w[ H �I7 a 5]`6Â� ��� a 5 �0G�@VL#@;^8�S>=A<TJ�SY@�J�SYK6nM@VL#i�KML?@fUCE];Z;2<>=?=A@CL?iKMN�BFL?@CUV<TJ�<Y@CNh=?i/Kc=R=?G�@fi?KM;2@&=A<Y;Z@ �]KMN�BF8�N�<>¿]@CL?iAKcSYSTnIUCE]; 9J¤E]iAKM:(SY@�UCE];2;Z<T=?;2@CNO=Ai(� [ a 5 �0G�<TU�G\KML#@�UVEM;2;Z<T=?;2@CNh=?i �0G�EMi?@ji?@CUV8�L#<T=�nbKMJ(J�L?EOKcU�G�@Vil=AG(@i?@CUV8�L#<T=�n­Kc=#=�KM<TN�KM:�ST@3�0<>=AGD=AG�@j8�i#@¡EcPRKMN­<YB(@WKMSq=?L?8�i4=A@CB¯J�KcL#=�n]Ã

� ��� ��� �2 ����¢�!%0%- �$%&� � ���������(�

E]L�;�KcNhnIUCL#npJ(=AEMX]LAKMJ(G�<YU&KMJ�J�ST<YUVKc=A<TE]N�iV`�K0i?J¤@VUC<�KMS �£KW¿]E]L�EMP�UCE];Z;2<>=A;Z@VNO=�i?U�G�@C;2@CiV`ON�Kc;2@CSTn% # �� ��� � #FUCE];Z;2<>=A;Z@VNO=AiZKML#@­¿M@VL#n�Kc=#=ALAKcUC=A<>¿]@cà $ =AL?KMJ�B(E9E]L UCE];2;Z<T=?;2@CNO=2i#U�G�@V;Z@M`lEMN�STnJ¤E]i?i#<Y:�ST@¢PdE]L�UCE];2;Z<T=?;2@CNO=Ai �0<T=AG K�J(8�:�SY<TU��M@kn]`�KML#@^i?U�G�@C;2@Cij<YNB�0G�<TU�G UCE]L?L#@Vi#J�E]N(B�<YN�X�=?E=AG(@¢J�8�:(SY<YUIUVEM;2;Z<T=?;2@CNh=0i#U�G�@V;Z@ ���³`�=?G�@VL#@¢<Ti�K2=?LAKMJ¤B�EpE]L �M@kn ��� à ¾ G�@��hN�E��0ST@VB�X]@¡EMP��� KMSYSTE �0i!EMN�@F=AEbE]J¤@VN K­UCE];2;Z<T=?;2@CNO=!<YN KMNOn½B�@Ci?<TLAKM:�ST@I�fKWn]à ¾ G�@.�M@kn X]@VN�@CLAKc=?<YE]N <Ti

� �

Page 29: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

UWKcL?L?<T@VBbE]8(=0<TNDi?8�U�G\K �fKWnD=?G�Kc=l=AG(@!UVE];Z;2<>=?=?@VL�B(E9@Ci�N(EM= �hN�E��3=AG(@j¿cKMST8�@���� `£KcN�Bbi?EZK=AL?KMJ¤B�E9EMLfUVE];Z;Z<T=A;Z@VNO=lUVKMN­:�@jK i?@CUV8�L#@¡UCE];2;Z<T=?;2@CNO=Wþ L?KMJ¤B�E9EML/UVE];Z;2<>=A;Z@VNO=AiRKML?@f¿M@VL#n 8(i?@CPd8(S¤<TN UVL#npJ(=?E]X]L?KMJ�G�<TUlJ�L?EM=?E9UCE]SYiC`O@Vi#J�@CUV<�KcSYSTn¡E]N�@Ci

�0G�E]i#@bB�@Ce�N(<T=A<TE]N³L#@Vgh8�<YL#@Vi i?<T;^8�SYKc=A<TE]N�à ¾ G�<TiF<Yi^:¤@VUVKM8�i#@&�0G(<YSY@�KMN KMUC=?8�KMSfJ�KML#=�n+<YN³=AG(@UVEM;2J�89=�Kc=?<YE]N UWKcN�N�EM=��hN�E�� =AG(@ =?LAKMJ¤B�EpE]L �M@kn UVE]L#L?@Vi#J�EMN�B�<YN(X'=?E�K UVE];Z;Z<T=A;Z@VNO=bKcN�B�0<YSTS$=AG�@CL?@CPdEML?@F:¤@^:�EM8�N�B±:On½K2UVE];Z;2<>=A;Z@VNO=W`£=AG(@^i?<T;^8�S�K�=AE]L0UWKcN½:�@^XM<T¿]@CN±=AG�<TiG�c@Cn ��� `=AGh8�iD;2K�h<YN(X³<T=D@VKMi?<T@VL�=?E UVL#@WKc=?@±=AG�@±¿p<Y@�� EMPj=AG�@ KMB9¿]@VL#iAKML4n]à $�ibK³L?@Ci?8�S>=W`0=AL?KMJ�B(E9E]LUVEM;2;Z<T=?;2@CNh=?iIKML?@28�i?@kPd8�S `PdEML¡@D��Kc;2J�ST@M`�<YN C@VL?E 9:�hN�E��0SY@CB�X]@�J(L?EpEMPdi � H!KM; a]a� `=?G�L?@Ci?G�E]STBUVL4npJ(=AE]XMLAKMJ�GOn � *] a]a `�KMN�B­i?<TX]N�Kc=?8�L?@!i#U�G�@V;Z@Vi � 7 ¾ a 5 Ã

4 @��0<TSYS�N�E��3X]<T¿M@jK PdE]L#;�KcSqB�@ke�N�<T=?<YE]NDEcPRKF=AL?KMJ�B(E9E]L�UVE];Z;2<>=A;Z@VNO=li#U�G�@V;Z@MÃ

�2#-, ������&�� /. 0/. j. � � ��� � � % � � � %� �� � � � �(<��5 �$&����e8 � A � ¡=ALAKcJ�B�EpE]L � M % � ��#$� �SR � �% ����� �� � ��# % ����� ��#����"� � �#"� � $ �� � � % � %

� b �&#����"� � � #$� � $ <>5 � A � �% ���% ����� � � # < ���� ��� A b� b�� ��% � $ $ ��� ���#����"� � �#$��% � % # ���� �� $ � � � � %���� % �% � � ��� * � # % �UM � % � �%���� %��� ��� b

� < 5 � A �� � $ $ <>5 � A b� b �� ��#$� � &��#����"� � � #$����� ��� �� � ��% � % � M�< ���� ��� A � $ <>5�� A%C % � � � ��� � � ���%W� � � � V a ] C � ��� � L a @5 R � C � % � � %����% �� � L a 5 R � �� � � % � %3<���� � � A �� < ���� � � A � � �"&����e8)�/< ���� � � � � A�X �"&�� �e8 � < ��� � � � � A b

�7#%'5)+���� ¾ G�@CL?@�KML?@lEM=?G�@VL�N�Ec=A<YEMN�i�EMP�=?LAKMJ¤B�EpE]L/UVEM;2;Z<T=?;2@CNh=?iVÃ)$ ��@VK�M@CL&N�Ec=A<YEMN �&E]8�STB:¤@ K�UVE];Z;2<>=A;Z@VNO=G�0G(@VL?@F=?G�@ ��� ����J(L?EpUV@VB(8�L?@FB�Ep@Vi!N(EM=jN�@VUC@Vi#iAKML#<YSTn¯=�K�c@ZKMi�<YN(J�8(=�F#8�i4=KMNOnF¿cKMSY8(@"� � À � � UVKMN�UCE];2@fPdL#E];�K!i?J¤@VUC<�KMS�B(<Yi#=?L?<T:�8(=A<TE]N�`]<TN�B�<Ti#=A<TN�X]8�<Ti?G�Kc:�SY@-PdL?E]; L?KMN�B�EM;¯Ã$ i4=AL#E]N�X]@CL^N�EM=?<YE]N ��EM8�SYB³:¤@�E]N(@2=AG�Kc=^B�<TB+N�Ec=^L?@Cgh8�<YL#@�=AG�K�=���� ���l=�K �M@Vi�� � KMN�B � � Kci<YN(J�8(=W`q:�8(=j<YN(i#=A@VKMB G�KMi���� ���-=�K�c@3F#8�i#=!=?G�@^¿cKMSY8(@Vi < ���, �? � A KMN�B½e�N(B K�¿cKMST8�@ �2i?8�U�G=AG�Kc= � X �"&�� �e8 � < ���� � � A Ã

� ��� � �� �! ��� ��!�� ������� � )* �!|!�>�

� NO=AL#E9B�8(UV@VB½:On �!E]SYB���KMi#i?@VLC` � <YUWKcSY<�KMN�B±Á�KMU+�cE � � � � Á � L� <YNb=AG�@C<YL�i?@C;2<TN�KMS�J�KMJ¤@VL � ��N=AG(@ HjN(E �0ST@VB�XM@0[�E];ZJ�SY@D�(<>=�n¢EcP � NO=?@VLAKcUC=A<>¿]@0m/L?EpEMPq7pnpi#=?@V;ZiV` C@VL#E 9:�hN�E��0SY@CB�X]@lJ�L#E9EcPdiRUVE]N�9i#=?<T=?8(=A@jK UV@CNh=?LAKMS$UCS�KMi#i0EMPUCL#npJ(=?E]X]LAKcJ�G�<YUjJ�L#EM=AEpUVEMSYiVÃ

� NDKMN2<YNO=A@CLAKMUk=A<T¿M@�J(L?EpEMP�i4n9i4=A@C;¯`p=AG�@CL?@�KcL?@�=:�&E¢J(S�KWn]@CL?iV`p=AG�@�m/L?E6¿]@CLV`�KcN�B2=?G�@�Ä�@CL?<Te�@VLVþ G�@\m�L#E6¿]@VL.�fKcNh=?i2=?E UCE]NO¿9<TN�UV@­=AG�@bÄ�@VL#<Te�@CL2EcP�=AG(@¯¿cKMSY<TB�<T=�n EMP!i#E];Z@­i4=�Kc=?@V;Z@VNO=Wà E]L@��(KM;ZJ�ST@M`h=AG�@�i#=�K�=A@V;Z@VNO=&UWKMN�:�@�EMP�=AG(@�PdE]L#; � E]L?;^8(S�K��b<Ti&i?Kc=A<Ti#e£Kc:�SY@c` ¡E]L ���jL?KMJ�GH5 <Ti=AG(L?@V@D9�UCE]SYE]L?KM:�ST@Mà ¾ G(@VL?@¡KML#@�=:��EZL?@Cgp8(<YL?@C;2@CNO=Ai�EMPRKFJ�L#E9EcPi4n9i4=A@C;¯À/=AG�Kc=�<T=l:¤@ � ��� ��� ��% �k`=AG�Kc=�<Ti/=AE¢i?KWn]`(<>P�=?G�@�i4=�Kc=?@V;Z@VNO=&<Yi�=AL?8(@M`h=AG�@CN�=AG�@�m/L?E6¿]@CL�i#G�E]8�STB�:¤@�KM:(SY@0=AEIUVE]NO¿p<YN�UC@�=AG(@¿]@CL?<>e�@VL)�0<T=AGIG�<TX]G¡J(L?E]:�Kc:�<YST<T=�n�5������OKMN�BI=AG�K�=�<>=�:�@ � ��� �M`�=AG�K�=<Ti�=?E�i?K6nM`M<>P(=AG(@&i4=�Kc=?@V;Z@VNO=<Yi-P�KMSYi#@M`p=AG�@CNDN�EFJ�L?E6¿M@VLli?G(E]8�SYBD:¤@!KM:(SY@�=?E^UVEMNh¿p<TN�UV@�=?G�@�¿]@CL?<Te�@VL��0<>=AG�J�L#E]:�KM:(<YSY<>=�n S�KML#X]@VL=AG�KMN i?EM;2@¯i?;2KMSYSl¿cKMSY8(@��]à $�ST=?G�E]8�X]G�<YN�XM@VN�@CLAKMS�K+J�L#E9EMP�i#npi#=?@V; UVKMN :¤@\B�@ke�N�@VB PdEMLKMNOn UVEM;2J�ST@C=?@VN�@Ci?i¡KMN�B i?E]8�N(B�N�@Vi#i¢i#E\SYEMN�X­KMi 5���� ���2<YijN�EMN 9�N�@CX]SY<TX]<Y:(SY@M` ��@2KML#@ZEMN�STn<YNO=?@VL?@Ci#=?@VB\<TNDJ�L?Ec=AEpUVE]STi �0<T=AGbJ¤@VL4Pd@VUC=�UCE];2J(SY@C=?@VN�@Ci?iCÃ

� ?

Page 30: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�2#-, ������&�� /. <".&�10 �; 4��# ��)8����� �4# ����� ��� -;3�-;��#%'�2�. � � � # �UM�� � % ��#� ��%��)( � ��#�� � ���� ��� �% ���� �# � ��� � � �� � �" #<��H �� A � ���� �%�� % � % � � � � % ��# ��% �)( � ��#�� �UM ��� �% � � M � # � ��� � ���� � MYX

[�E];ZJ�ST@C=A@CN�@Vi#i � M8� � C % � � ��� � E �� �"�"� ��% C % � % � 2m�L ����<�� A + ��<�� A -. À .5X 5 #X 5 b�'947pE]8�N�B�N(@Vi?i� � # � �#� � � M � # � � ��# �@( ��#$ �� C m�L ���� + ��<�� AQ- . À .�X 5 �� < � A b

4 @��0<TSYS�:¤@!<YNO=A@CL?@Ci#=A@CB\;ZE]i#=?STn�<YNDJ�L#E9EMP�i#npi4=A@V;Zi0=AG�Kc=0G�K6¿M@¡N(@VX]ST<YX]<T:�SY@ �OÃ%�EM=?@ =?G�Kc=¯K J�L?EpEMP¡i#npi#=?@V; UWKMN E]N�S>n :�@ EMP¢<YNO=A@CL?@Ci#=¯<TPI=AG�@½Ä�@VL#<Te�@CL­KMSYE]N(@ UVKMN�N�Ec=

B�@k=A@VL#;2<TN�@3�0G(@C=AG(@VL5� �là ��P�J�KML4=A<TUV8�SYKML&<TNO=A@VL#@Vi4=0KML?@�J�L?EpEMP�i#npi4=A@V;Zi �0G�@CL?@�=AG(@�Ä�@VL#<Te�@CL<YilJ(L?E]:�Kc:�<YST<Yi#=?<YU�J�E]S>npN�E];Z<�KMS 9�=A<T;2@cÃ

��N =?G�@fEM=?G�@VLG�KMN�B�`6�0G(@VN2K�J�L?Ec=AEpUVE]S9<YiRB�@Ci?<TX]N�@VBFPdE]L�8�i?@l<TNFJ�LAKcUC=A<TUV@c`]<T=<Yi/K�¿M@VL#n^N�Kc=�98�L?KMSqgh8�@Ci#=A<TE]NbG�E��°KFm/L#Ew¿M@VLlUVKMNb:�@�;ZE]L#@�UVE];ZJ�8(=AKc=A<TE]N�KMSTSTnFJ¤E���@CL#Pd8�S�=AG�KMNbJ�L#E]:�KM:(<YSY<Ti#=?<YUJ¤E]STnpN�E];Z<�KcS�9�=?<Y;Z@Mà ¾ G�@CL?@CPdEML?@M`£<>=0;�K�c@Vi�i?@CN�i?@j=AEZUVE]N(i?<YB(@VL0<YNO=A@CLAKMUk=A<>¿]@ # � ��� � � % k`��0G�@VL#@K m/L?E6¿]@CL � i2UCE];2J(8(=�Kc=?<YE]N�KMS&J¤E���@CL?iZKML#@bKMSYi#E½SY<Y;Z<T=?@VB =AE J�L?EM:�KM:�<TSY<Yi4=A<TU2J¤E]STnpN�EM;2<YKMS�9 =A<Y;Z@M`KMN�BZ=AG�@�m/L?E6¿]@CL � i�J¤E���@CL�UVEM;2@Ci-PdL#E]; =AG(@�P�KMUk=&=?G�Kc=�=AG(@�m/L?E6¿M@VLfKcSYi?Ej=�K �M@Vi&i?E];Z@�KM8 �9<YST<�KML4n<YN(J�8(=Wà � E]L?@!PdE]L#;�KMSTSTn¤À

�2#-, ������&�� /. <". 0 �; 4��# ��)8����� �4# )+� � ��'5#% 4�L2�. � � � # �UM � � % ��#� ��%��)( � ��# � � ���� ��� �% ��� � � ���@*� ��� � �4* % � � � � �# � ���� � �� � �" �<��H �� A � ���� �% � %��% � � � � % ��#� ��% �)( � # � ��� � � %+M � #(� ��� � ��� � MYX

[�E];ZJ�ST@C=A@CN�@Vi#i � M�� � C % � � � % � ��#$� �SR � �% E � % � �" " � �� � ��% � %m/L�����<�� � A + ��<�� A - . À .HX 5 X 5

79EM8�N�B�N�@Ci?i � # � �H� � � C M � # � �)��#�� � ���� ��� �% ����� � ��� � ��� � �4* % � � � ��#��@( ��#" ��� Cm/L����� + �(<�� A - . À .HX 5 �� � < � A b

� =<Ti�UVSY@VKML$=AG�K�=KcNhnjSYKMN�X]8�KMX]@�<YN#%�m±G�KMiKl=AL#<T¿p<�KcS]<YNO=A@CLAKMUk=A<>¿]@&KML?X]8(;2@CNh=Và E]L$@D�(KM;2J(SY@M`<TP��³<Yi/=AG(@�SYKMN�X]8�KcX]@0EMP�KMSTS�iAKc=?<Yi4e£KM:�ST@0PdEML?;^8�SYKM@M`O=?G�@VNZ=AG�@�m/L?E6¿]@CL � ilKM8 �9<YST<�KML4n^<TN�J�8(=-<Yi�=AG(@iAK�=A<Yi4P»np<YN�X\KMi?i#<YX]N�;Z@VNO= ¢Ã ¾ E\UVE]NO¿p<YN�UC@2=?G�@�Ä�@VL#<Te�@CLI=?G�Kc=¡=AG�@ZPdE]L?;^8(S�K � <Ti¢iAK�=A<Yi4e£KM:�ST@M`=AG(@¡m/L#Ew¿M@VL�UWKMN­i?<T;2J(STn2X]<T¿M@� °=AE =AG�@!Ä�@VL#<Te�@CLVþ G�@ <YNO=A@CL?@Vi4=A<TN�X =AG�<TN�X'KM:�EM8(=b<YNO=A@CLAKMUk=A<>¿]@ KML?XM8�;2@CNO=Ai <²KcN�B3KcSYi?E'KM:¤E]8(=b<TNO=A@VL?KMUC=?<T¿M@

J�L#E9EMPdi A <Yi�=?G�Kc=­<T=D<TiDJ�EMi?i?<T:�SY@±=?E UCE]NO¿p<YN�UC@ =?G�@½Ä�@VL#<Te�@CLb=?G�Kc= �°<YiDi?Kc=A<Ti#e£Kc:�SY@ E � % � � � %#$��( � ��� ��� � � � � M � # � % ����� �� � �%� ¢Ã $�N <YNO=A@CLAKMUk=A<T¿M@DJ�L?EpEMP�i#npi4=A@V; <dL?@Ci?J�Ã>`�KcL?X]8�;Z@VNO= A�0<T=?GD=AG�<TilJ�L?E]J¤@VL4=�nb<YilUVKMSYST@VBbK�� ��# �@*���� � E � � � ��-J(L?EpEMPi4npi#=A@C; <�L#@Vi?JqÃT`¤KML#X]8�;Z@VNO= A Ã

$f=¢=?G�@2G(@WKML4=¢EMP�=AG�@ZB�@Ce�N�<T=?<YE]N EMP0K�V@VL#E 9:�hN�E��0ST@VB�X]@ZJ�L#E9EMPfi#npi#=?@V; <Yi!=AG�@ZPdE]SYSTE��0<YN�X<YNO=?8�<T=?<YE]N�À�K J(L?EpEMP�i4npi#=A@C; <YiIV@CL?E 9 �hN�E��0SY@VB(X]@¯<>P�`�N�E ;�Kc=#=A@CL��0G�Kc= =AG�@b¿]@CL?<>e�@VL � iZUVEpB�@M`KMNOnh=AG�<TN�X�=?G�Kc=�=?G�<Yi�¿]@CL?<Te�@VL�ST@WKML#N�i�Kci!K�L?@Ci?8�S>=�EMP=AG�<Ti�<YNO=?@VLAKcUC=A<TE]N�`¤<T=�UVE]8(SYB±UCE];2J(8(=A@¡E]N<T=?iRE��0N�à � N EM=AG(@VL �&E]L?B�iC`OPdE]L/KMNOn^¿M@VL?<>e�@VL��3=?G�@VL#@l<Yi�K�i?<T;^8�SYKc=AE]L "½=?G�Kc=V`6�0<T=AG(E]8(=/=�KcS��h<YN�X=AEF=?G�@Im�L#E6¿]@VL�Kc=�KMSTS `p:�8(= F#8�i4=�Kci?i?8(;2<TN�X^=AG�K�= � �l`�UVE];ZJ�8(=?@ViC�0G�Kc=?@C¿M@VL�<T=l<Tif=AG�Kc=C�0<TSYS<YN(B�8�UV@¡=AG�@¢Ä�@CL?<>e�@VL�=?EDKMUCUV@VJ9=W`$KMN(B±=AG�@¢Ä�@CL?<>e�@VLG�0<TSYS�N�EM=�@C¿]@CN N�EM=A<TUV@I=AG�@^B(< ��@VL?@CN�UV@cÃ�$N�Kc=?8�LAKcS$gp8(@Vi#=?<YE]N­<YiC`�EMPRUCE]8�L#i?@M` �0GOn­i?G�EM8�SYBbi?8(U�G½KZJ(L?EpEMPi4npi#=A@C;*:�@ji?EM8�N�B���i?<TN�UV@jN�E��

Å]a

Page 31: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

=AG(@�Ä�@VL#<Te�@CLJ�0<YSTS9:¤@VST<Y@C¿M@lKMNOnh=AG�<TN�X�� ¾ G�@lJ¤E �&@VLR=?G�Kc=R=?G�@fi#<Y;^8�SYKc=AEML "½G�KMiR=?G�Kc==?G�@0KMUk=A8�KMSJ�L#Ew¿M@VL/B�Ep@ViN�EM=W`M<Yi=?G�Kc==?G�@li?<T;^8�SYKc=AE]L�UVKMNFL?8�NZKMN(B^L?@D9�L?8(N �°KMiR<T=i?@C@ViRe�=Và E]L@D�(KM;2J(SY@M`<TP�<T=j<Ti?i?8(@Vi^K­;2@Ci?i?KMX]@ =AG�Kc=¡<YN(B�8�UV@Ci � =AE­L?@:F#@VUC=V`<>=¡UVKMN+i#<Y;ZJ�STn±L?@'�0<TN�B �*KMN�B <Yi#i?8�@2KB�<��q@CL?@VNO=�;Z@Vi?i?KMX]@cà ¾ G�@¡KMUk=A8�KMS�m/L#Ew¿M@VL�B�E9@Ci0N�EM=�G�KW¿]@I=AG�Kc=�Kc:�<YST<T=�n]`9G�@VN(UV@¡=?G�@ji?<T;^8�S�K�=AE]LUWKcN¯X]@k=�K@�fKWn �0<T=?GD=AG�<TN�X]il=AG�K�=l=AG�@Im/L?E6¿]@CL�UCE]8�STB­N(EM=�J�E]i#i?<T:�STn�X]@C=�K@��K6n �0<>=AG�Ã

�2#-, ������&�� /. <". 0 0 9 �(' ��$&) � ���:2�. � ��#�� � ���� ��� �% ��� � � ����� ��� � �4* % � � � � �#�� ����� � �� � �8"� � � � � � i?<T;^8�S�K�=AE]L_M � # � � �� � � �Qi � � % ��#� ��%������ E � % � � � �� � � & ��� � � ���% � C � M% � ��#"� �SR � �% � � ��� � ��� � �Z�)<* A �� � � % � %�M � # � � � � ���% %( �UM � � ��� % � % � �� �% �)< � ADC9 �;:=<>4 <��I<)(P � A + & � A �� 9 �;:=< 4 <��I<6( � A � " <>5 � � A�A b

4 @¢KML?@IN�E�� L?@VKMB(nb=AE2X]<T¿M@¡B(@Ce�N�<>=A<TE]N�ilPdE]L0=:��E!��K6¿ME]L?i�EMP C@VL?E 9:�hN�E��0SY@CB�X]@Mà ¾ G�@Ie�L?i4=<TP�=AG�@Ci?@¡B�@Ce�N(<T=A<TE]N�iC`�H�@ke�N�<>=A<YEMN � à _�à _�`�<Yi0=AG(@¢;ZE]i#=�X]@CN�@VL?KMS�B�@Ce�N(<T=A<TE]N\EcP V@CL?E 9 �hN�E��0SY@VB(X]@J�L#E9EMPdiCà ¾ G�@^i#@VUVEMN�B±B�@ke�N�<T=?<YE]N¯<Yi0=AG�K�=�EMP:�S�KcU+� 9�:�E@��V@CL?E(�hN�E��0ST@VB�X]@(<²H�@ke�N�<T=?<YE]N � à _�à L6A þ G�<Ti�B�@Ce�N�<T=?<YE]N½<Ti�J�L#Ew¿cKM:(STn¯i#=AL#E]N�X]@CLV`�KMN(B½J�@CL?G�KMJ(i!8�N�N�@CUV@Vi#iAKML#<YS>n½i#=?L?E]N�X(`�:�8(=!<>=!<Yi�PdL?@D9gh8�@VNO=?STnD=AG(@I;ZE]i4=0UVE]NO¿]@CN�<Y@CNO=�PdE]Ll8(i?@j<YNbJ�L#EM=AEpUVE]SqB�@Vi#<YX]N�Ã

�2#-, ������&�� /. <". < 0�� # ����� � ���� $�#%� � # ����� ��� -;3*-;��#%'�2 . � ��# � �UM ��� �% � � P #$�" � b C #�� �I*� � � %4TI<��H �� A � � ��#��@*���� � E � � � �� ��#�� �UM ��� �% � � P #$�" � b C #�� ��� � � %4T M � #�� ��� � �� � � M"M � # � �e( ��# � K ��#$ �� % � ��#$���SR � �% � � �� � �H" �� � � % � %+M � # � �W� � C " � �� � �� % � #_P� � ��� � K � � % ����� � b � b � TNM � # � i � � % ��#� ��% ����� E � % � �!<K� A P #$�" � b C ��<�� � A T ��� � � ���% � b¾ G�@­i#=AL#E]N�X]@CL B�@Ce�N(<T=A<TE]N EMP�:�S�KMU+�69�:�E@� C@VL?E 9:�hN�E��0SY@CB�X]@­J�L?EpEMPdiF<YiF=?G�@biAKM;Z@M`-@��9UV@CJ(=

=AG�Kc=0<T=0G�Kci0=?G�@jgh8�KMNO=A<>e�@VL#i�L#@C¿M@VL?i#@VB�À

�2#-, ������&�� /. <". . 0 � $�)8� ����� � � # ��� � ���� $�#%� � # ����� ��� -;3*-;��#%'�2 . � ��#�� �UM ��� �% � �P #$�" � b C # � ��� � � %4T <��H �� A � ��� �"�@* � �YR�� ��#��@*���� � E � � � �� ��#�� �UM ��� �% � � P #$�" � b C # � ��� � � %4TM � # � ��� � �� � � M % � ��#$� �SR � �% � � �� � �J" �� � ��% � %LM � # � �B( ��#�� K ��#$ �/M � # � � � � C "� � �� � � � % � # P� �� � � � K � � % ����� � b � b � TdM � # �� i � � % ��#� ��% ����� E � % � ��<�� A P #$�" � b C �!<K� � A T��� � � ���%I� b

� ��� ) ��!|!�>� !� ����!#� ���������

��@CL?@8��@�L?@VUVKMSYS¤KIB�@Ce�N(<T=A<TE]NZEMP�K¡J(L?EpEMP$EMP/�hN�E��0ST@VB�X]@�J�L?Ec=AEpUVE]S²ÃRm/L?EpEMPdi-EMP/�hN�E��0SY@CB�X]@�KcL?@M`KMi 2�@VSTS�KML#@ KMN�B �jE]STB�L?@C<YU�G � 2 �#? �� �0L?EM=?@M`(�4E]N�@ EMPf=?G�@2;2KMNOn UVEMN�UV@CJ(=A8�KcS&UCE]NO=AL?<T:�8(=?<YE]N�iEMP$=?G�@3�&E]L��2EMP)�!E]SYB �fKMi#i?@CLV` � <YUWKcSY<¤KMN�BbÁ�KMU+�ME � � � � Á � L� à ¾ G�@Cn���@CL?@�e�L#i#=fB(@Ce�N�@CBb:hn @V<TX]@M` <YKc=fKcN�BD79G�KM;2<TL�� 7 ��� KMN�B�:hn ¾ E];2J�K¢KMN�B 4 E]STS � ¾ 4 ��� `9KMN�B�Pd8(L#=AG(@VL�L#@Ce�N(@VB:On&2�@CSYS�KcL?@jKMN�B��!E]SYB(L?@V<TU�G � 2C��? �� Ã

$ J�L#E9EcPREMP �hN�E��0ST@VB�X]@¡<Yi�K2J�L#EM=AEpUVEMS �0G(@VL?@C:On½KZ¿M@VL#<Te�@CL�<Yi�UVEMNh¿p<TN�UV@CB\=AG�K�=�KZUV@VL4=�KM<TNgh8�KMNO=A<>=�n =?G�Kc=^i?Kc=A<Ti#e�@Ci¢i#E];2@2J�EMSTnpN�E];Z<�KMS 9�=?<Y;Z@¡UCE];2J(8(=�KM:(SY@ZL?@VSYKc=A<TE]N #¬<Yi#�pN(E �0N³=?E=AG(@FJ�L?E6¿]@CLVà EML�@��(KM;ZJ�SY@c` UVKMN :�@^K�iAKc=?<Yi#P»np<TN�XbKMi?i#<YX]N(;2@CNh=�=AEbK�PdE]L#;^8�S�K � <YN �0G(<YU�GUWKci?@�# < � � A/X �J< A à � =j<Ti�UVE]NO¿M@VN�<T@VNO=jPdE]L�=AG(@FJ�8�L?J¤E]i#@VijEMP-N�EM=AKc=A<TE]N±=AED<T;�KMXM<YN�@$# Kci=�K �p<TN�XD=:��Eb<TN�J�8(=?iVÀ!E]N�@ �hN�E��0N =?Eb:�EM=?G½=AG�@FJ�L#E6¿]@VL¡KMN�B½=?G�@F¿]@VL#<Te�@CL�<�<YN±=?G�<Yi!@D�(KM;2J(SY@M`=AG(@jPdEML?;^8�SYK � A KMN(B­=?G�@jEM=AG�@CL� ¢`��hN�E��0N­=AEF=AG�@jJ�L#E6¿]@VL�E]N�S>n]Ã

Å 5

Page 32: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

$ J�L?EpEMP�EMPJ�hN�E��0ST@VB�X]@IUWKcN¯:¤@jB�E]N�@!=AL#<T¿p<�KcSYSTn :OnbJ�L#E9B(8�UV<TN�X ¢Ã ��E��&@C¿M@VLV`¤<T=0UVKMN¯KMSYi#E:¤@!B�E]N�@!<TNDi?8�U�G¯K��fKWn�=?G�Kc=f=?G�@!¿]@VL#<Te�@CLlSY@VKML?N�ilN(EM=AG�<TN�X^N�@�� KM:¤E]8(= ¢Ã $ J�L#EM=AEpUVE]S¤=AG�K�=iAK�=A<Yi4e�@Vil=?G�<Yi0S�K�=?=A@CLfUVEMN�B�<T=?<YE]ND<TilUWKMSTSY@CB¯K � ��#��@*���� � E � � � �� ��#�� �UM �UM ��� � E � � � ��&J�L#EM=AEpUVEMS ÃÁ�EM8�X]G�S>n]`�K�¿M@VL#<Te�@CL�� <Yi!K(�hN�E��0ST@VB�X]@^¿M@VL#<Te�@CL�PdE]L�K�L#@VS�K�=A<YEMN�#�<TP/PdE]L�KMNOn\J�L#E6¿]@VL��

=AG�Kc=I<YN�B�8(UV@Vij=AG(@Z¿M@VL?<>e�@VLj=AE¯KMUCUV@VJ9=W`�=?G�@VL#@2<TijK��hN�E��0ST@VB�X]@2@��p=AL?KMUC=?E]L � =AG�Kc=W`�8�i#<YN�X��KMN�B � `�UVE];ZJ�8(=?@Vi� i#8�U�G\=?G�Kc= # <�� � A <Yi0iAK�=A<Yi4e�@VBq`��0G(@VL?@��½<Yif=?G�@IUVE];Z;2EMN­<TN�J�8(=Và $�iB�<Ti?UV8(i?i?@CB\:On 2&@VSYSYKML?@�KMN�B��jEMSYB�L#@V<YU�G � 2C��? �� `(=?G�@ji?8�:9=ASY@k=A<T@Vil<YN�PdEML?;2KMSYS>n B�@Ce�N(<YN�XFJ�L#E9EcPdiEMP��pN(E �0ST@VB�XM@�KML#<Yi#@ �0G�@CN¢<>=�<Ti�N�@VUC@Vi?i?KML#nj=?E�B�@C;�KMN(B¢K0B�@VJ¤@VN(B�@VN�Ukn¢EcP(=AG(@&L#8�N�N�<TN�X�=?<Y;Z@/EMP�¬E]NI=AG�@&J�L?E]:�KM:�<YST<T=�nE�0<>=AG#�0G�<YU�G � KMUVUC@VJ(=?i �0G�@VN¡=�KMS��p<TN�X0=AE � ÃJ$�N^<Y;ZJ¤E]L#=AKMNO=�gp8�KMNO=A<T=�n<YN­=AG�@¢B�@Ce�N(<T=A<TE]N\EcP 2�@VSTS�KML#@¢KMN(B �jEMSYB�L#@V<YU�Gq`�<Ti�=?G�@��hN�E��0SY@CB�X]@^@CL?L?EML�� �0G�<YU�G½gh8�KcNh=?<Te�@CiG�E�� EcP»=A@VN K�U�G�@VKc=A<TN�XbJ�L?E6¿M@VLj<YijKMSTSYE��&@VB±=AEbUCE]NO¿9<TN�UV@F=?G�@^¿]@CL?<Te�@VLVà ¾ G�@ B�@Ce�N(<T=A<TE]N±=AG(@VNB�@C;�KMN(B�i-=?G�Kc=�PdE]L-KMNOn J�L#Ew¿M@VL �3=AG�Kc=-UCE]NO¿9<TN�UV@Ci&=?G�@�¿M@VL#<Te�@CL �0<>=AGZJ�L?E]:�KM:�<YST<T=�nG�����$`h=AG(@�hN�E��0SY@CB�X]@j@��p=AL?KMUC=?E]L0UVE];ZJ�8(=?@Vi� <YND@D�(J¤@VUk=A@CB\=A<T;2@W�!<�J¤E]STn�< � A ��<4� ��� A�A þ G�@ �&E]L�� E]N B�@Ce�N�<YN�X J�L?EpEMPdi­EMPI�hN�E��0SY@CB�X]@ =AG�Kc=¯UWKcJ(=A8�L#@ =?G�@+;ZE]i#=­<TNh=?8�<T=?<YE]N <Ti

E]N 9�X]E]<TN�X�`lKMi�N�@'� J�L#EM=AEpUVE]S�B�@Vi#<YX]N =A@VU�G(N�<Ygh8�@Ci¯KcL?@\B(<Yi?UCE6¿]@VL#@VB�à $ L#@VUC@VNO=b@��(KM;ZJ�SY@¯EMP=AG(<Yi�=AL?@CN�B�<Ti�2�KMLAK� KcN�B�Â$<YN(B�@VSTS � i � 2f a �� N(E]N 9�:(S�KMU+�69�:¤E@�.�hN�E��0SY@VB(X]@�@D�9=?LAKMUk=AE]L-PdE]SYSTE��0<YN�X2fKML?K� � i � 2fKML a 5 i4=A8�B9n½EMP&N�E]N 9�:�S�KMU+�69�:�E@��C@VL#E��hN�E��0ST@VB�X]@ J�L#EM=AEpUVEMSYiVà ¾ G�@V<TL!N�E]N 9�:�S�KcU+� 9:¤E�� �hN�E��0SY@CB�X]@F@��p=?LAKMUk=AE]LC`q<YN(i#=A@VKMB½EMP�8�i#<YN�X � F#8�i4=jKMi!KcN½E]LAKMUCSY@c`¤=AK�M@Ci�=AG�@^B(@Vi?UCL?<TJ(=A<TE]NEMP � KciFK±i?@CJ�KMLAK�=A@D<YN(J�8(=Wà ¾ G�@b;ZEM=A<>¿cKc=A<TE]N PdEML^B�@Ce�N�<YN�X½J(L?EpEMPdi^EMP8�hN�E��0SY@CB�X]@D<YN =AG�<TiP�KMi#G�<YE]Nb<Tif=AG�Kc=0<>=lnp<Y@VSTB�ili#=?L?<TUC=AS>n�J¤E]STnpN�EM;2<YKMS¤=?<Y;Z@�EMP�=AG�@��hN�E��0SY@CB�X]@I@��p=AL?KMUC=?E]L �³Ã

��@CL?@M` ��@­L?@CUWKMSTS�=AG(@DB�@Ce�N(<T=A<TE]N B�8�@D=AE 2�@CSYSYKML?@DKcN�B �!E]STB�L?@C<YU�G�à ��E���@k¿]@VLC`��&@­EMN�STnUVEMN�i?<TB�@VL-J�L?EpEMPdi-EMP �hN�E��0ST@VB�X]@8�0G�@VL#@G�hN�E��0SY@CB�X]@�@VL?L#E]L�Pd8�N�UC=?<YE]N���<Yi�@D�(J¤E]N�@CNO=A<�KcSYSTn^i?;2KMSYS<YN =AG�@2SY@CN�XM=AG EMP0K��0<>=AN�@Ci?i ¢Ã ¾ G�@�L#@WKMi#E]N+=AG�Kc= �&@�<TN�i?<Ti#=¡E]N+=AG(<YiIi#=AL#E]N�X]@CL¢B�@ke�N�<>=A<YEMN<YiI=AG�K�=^<T=¡X]<>¿]@Vi¡X]EpE9B UVE];ZJ�EMi?<T=?<YE]N L?@Ci?8�S>=AiC`�KMN�B+=?G�Kc=¢=?G�@�J(L?EM=?E9UCE]SYi���@D@D�9G�<Y:�<>=¢i?Kc=A<Ti#P»n<T=Và � E]L#@VE6¿]@CLV` 2�@CSYSYKML?@¢KMN�B �!E]SYB�L#@V<TU�G\i?G(E � G�E�� =AEDUCE]N�i#=?L?8�Uk=jJ�L?Ec=AEpUVE]STi�i?Kc=A<Ti#P»np<YN�X2=AG�<TiL?@Cgh8�<YL#@V;Z@VNO=�E]8(=0EMP)��@VK�M@CL�J�L#E9EcPEMP-�hN�E��0SY@CB�X]@jJ�L?Ec=AEpUVE]STiVÃ

4 G�@VN­=AG�@��hN�E��0SY@CB�X]@I@VL#L?E]Ll<Ti�@D�9J�E]N(@VNO=A<YKMSYS>n�i#;�KMSTS `9<T=0<Yil@VKMi?<T@VLl=AE @D��Kc;2<TN�@!G�E��°=AG(@J�L#EM=AEpUVE]S�:¤@VG�KW¿M@Vi^8�N(B�@VL¡UVE];ZJ�EMi?<T=?<YE]Nqà ¾ G�@�=?G�@VEML?@V; �&@��0<TSYS/i?G(E ��<Ti¡<TN P�KMUk=¢i4=AL#E]N�X]@CL=AG�KMNB�0G�Kc=E��KMi��hN�E��0N :�@kPdE]L?@c`$KMS>=AG�E]8(X]G±<T=�i?@C@V;Zi�=AEDG�KW¿]@F:¤@V@CN 8�i?@CB <T;2J(SY<YUC<T=?STn2<YN±=AG(@KMN�KcSTnpi?<Ti¡EMP0i#E];Z@�UVL4npJ(=AE]XMLAKMJ�G(<YU�J(L?EM=?E9UCE]SYiCà � N J�KML#=?<YUV8(S�KML��&@�i?G�E���=AG�Kc=¢=?G�@�J�L#E]J¤@VL#=�n=AG�Kc=�KZJ(L?EM=?E9UCE]S�<Yi0KFJ�L#E9EcPEMP-�hN�E��0SY@CB�X]@j<YilJ�L#@Vi#@VL#¿M@VB½8�N(B�@VL0UVEMN�UV8�L#L?@CNh=�UVEM;2J¤E]i?<>=A<TE]N�Ã�2#-, ������&�� /. ./.&�10 !/�,� � �:������ *� � $&#%� � # 0 !�� 2 2 . � ��% # <�� � A ��� � � ��� � ��� � � ���� ��� ���% ���� � #$��� %������ b � ��% �-<�� A ��� �� � � % � % � �J<K� A M � # � � �� � � % � % # <K� � A� � � � C � � " ���� � % � % ��� � �� � � �-<�� A X � � ��� < � A � ��� ����� � %���� � ��� ���% ���� � b

� ( ��# � K ��#�� � ��� � E � � � ���( ��# � K ��# E � % � #$�" � �"��% %��$# � MYX%�E]N 9�=?L?<>¿9<YKMSY<>=�neX �� ��#$� �SR � �% ���#��@( ��#�� �� � � % � %jM � # � �#� C C � M # <�� � A/X 5 C% � � �

m/L�����<�� � A + ��<�� A - . À .HX 5 X 5

QJ�p=AL?KMUC=?<YE]N �0<T=?G �hN�E��0SY@VB(X]@j@VL?L#E]L ��� � � X �� ��#$� �SR � �% � �SR % #� ��%�� # � ��� # � % ��� �

� � � ���� �%� � %�� �� � � % � % M � # � � � C M � # � � �L( ��#$ # ���" N C � M�)<�� A X m/L�� + �!<K� A - . À ./X 5 � � �

� � �

Å �

Page 33: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

% � � � C ����� � ���% � � � E � % � �"�"�" " %���% � �&��#��@( ��# C � � ��� ���% �" _(� ��� � �� � � % � %# <K� � A � � � � C E � % �� � � �SR � �"��% � �� ��� ����# �UM �% � � �� � ��� �� � ��� ��� � � � � � � � ���

� � � � �������� b4 @li?KWn¢=AG�Kc= �3<TiRK�¿]@CL?<>e�@VL �0<>=AG^L#@Vi?J¤@VUk=/=AE!SYKMN�X]8�KcX]@ � <TP � <Ti/K�¿]@CL?<>e�@VLJ�0<>=AGFL#@Vi?J¤@VUk=

=AE L#@VS�K�=A<YEMN # <�� � A �0G�@VL#@ # <Yif=?L?8�@j< � <Yi0K��0<T=?N�@Vi#i�=?E =?G�@ji#=AKc=A@C;2@CNh=/� �lÃ

� ��� ��� )³%&������ � ����� )+%�� �¢%-�������%&�

4 @�N�E�� =A8(L?N�=?E¢=AG�@�gh8�@Vi4=A<YEMN�EMP$UCE]N�UV8(L?L?@CNO=lUVE];ZJ¤E]i?<>=A<YEMN2EMP�J�L?EpEMPdi-EMP �hN�E��0SY@VB(X]@MÃ-[�E]N�9UV8(L?L?@CNO=f@��9@CUV8(=?<YE]N�EcP�i?@k¿]@CLAKMS�J�L?EM=?E9UCE]SYi�<Ti�KMN2@��9@VUC8(=A<TE]N��0G(@VL?@�=AG�@�;2@Ci?i?KMX]@Vi-PdL?E];�B(< ��@VL>9@VNO=I<YN(i#=�KcN�UV@Ci¡EMP-=AG(@ZJ(L?EM=?E9UCE]S�KML?@ KcL?:�<>=ALAKcL?<YS>n]`�@k¿]@CN³KMB(¿M@VL#iAKML#<�KMSTSTn]`$<TNO=A@VL#SY@VK6¿M@VB :�@k=:��@C@VN@WKcU�G\EM=?G�@VLCà � N\EM=?G�@VLC�&E]L?B(iV`���@¢KMi?i#8�;2@j=AG�Kc=0=AG�@¡KMB(¿M@VL?i?KML#n­UCE]NO=AL?EMSYi0=AG�@Ii?U�G�@CB�8�ST<YN�XZEMPKMSTS(=AG�@�;Z@Vi?i?KMX]@CiV`(i#8�:�F#@CUC=�=?EI=?G�@�UVE]N�i4=AL?KM<YNO=�=AG�K�= �0<>=AG�<TN2@VKMU�G�J(L?EM=?E9UCE]S `hKMSTS�;2@Ci?i?KMX]@Vi&KML#@i?U�G(@VB�8�ST@VB¯<YND=AG�@jL#<YX]GO=0E]L#B�@VLCÃ

� N =AG�@³UCL#npJ(=?E]X]LAKcJ�G�<YU+UVE]NO=A@D�p=W`^UCE]N�UV8(L?L?@CNO= UVE];ZJ�EMi?<T=?<YE]N �fKci±e�L?i4=½UVE]N(i?<YB(@VL?@CB :hnHG�&E]L��£`�%�KME]LC`�KMN�B­79KMG�KM< � H�%�7�?�� <YN�=?G�@V<TL �&E]L��ZE]NDUCE]N�UV8(L?L?@CNO= V@VL#E 9:�hN�E��0ST@VB�X]@�J�L?EpEMPdiVÃ��N(SY<��c@B�0G�Kc= �&@ i?G�E�� G(@VL?@ KM:¤E]8(=bJ(L?EpEMPdiDEMP#�hN�E��0SY@VB(X]@ 8�N�B�@CL­UCE]N�UC8�L?L#@VNO=\UCE];ZJ�E]i#<�9=A<TE]N�`EC@VL#E 9:�hN�E��0SY@CB�X]@ J�L?EpEMPdi­B�E'N�EM=¯N�@VUC@Vi?i?KML?<TSTn L#@V;2KM<YN V@CL?E 9 �hN�E��0SY@VB(X]@+8�N(B�@VL­UVE]N�9UV8(L?L?@CNO=FUVE];ZJ¤E]i?<>=A<YEMN�à � N P�KMUC=V`RN�E½UVEMN�i#=AKMNO=�9�L#E]8�N�B :(S�KMU+�69�:¤E@� V@VL#E 9:�hN�E��0ST@VB�X]@�J�L?EpEMPl<TiV@CL?E 9 �hN�E��0SY@VB(X]@j8�N�B�@CL�UCE]N�UV8(L?L?@CNO=�UCE];2J¤E]i#<T=A<TE]N � [ Hjm-Á a 5 ÃÂ$@C=�8(i�N�E�� @��9J�SYKM<YN��0G�Kc=�<>=�;2@VKMN�i�=?E�UCE]N�UV8(L?L?@CNO=ASTn¯UVEM;2J¤E]i?@IJ�L#E9EMPdi�EMP �hN�E��0SY@CB�X]@cÃ

¾ G�@-:�@CG�KW¿p<YE]L�EMP9=AG�@-UVE];ZJ¤E]i?@CBI¿M@VL?<>e�@VL�<Yi�KMi�@D�(J¤@VUk=A@CB�À@k¿]@VL4nj=A<Y;Z@�K0N�@'� J(L?E6¿]@CLUVEMNh=AKMUC=?i=AG(@�¿M@VL?<>e�@VL&KMN�B ��KMNO=Ai&=?E¡L#8�N2K¡J�L#E9EMP�EMP1�pN(E �0ST@VB�XM@�J�L#EM=AEpUVEMS `hKjN�@'� UCE]JOnZEMPq=?G�@l¿]@VL#<Te�@CL<YilUCL?@VKc=A@CB�`£@WKMU�G­L?8�N(N�<YN�X i#@VJ�KML?Kc=A@CSTnDEMN¯<>=AilUVEML?L?@Ci?J¤E]N�B�<TN�X <YN�J(8(=Wà � EML?@!PdE]L?;2KMSTSTn¤À

4 @ �0<YSTSjKMi?i#8�;Z@ =?G�Kc=­=AG�@ <YN�i4=AL#8�UC=?<YE]N�iD=?E�<YN(<T=A<YKc=A@¯=AG�@ J�L?Ec=AEpUVE]STi­UCE];Z@ PdL#E]; =AG(@�#E]89=Ai?<TB�@M`  < à @MÃ>`�PdL?E]; i?E];Z@jG�<YXMG�@VL 9�SY@k¿]@CS�J�L?EpUV@Ci?i0=AG�K�=0;�KWnD:¤@IKMUC=?<YN�XZKMB(¿M@VL#iAKML#<�KMSTSTn]à ¾ G�@UVEM;2J¤E]i?@CB­¿M@VL#<Te�@CL ���KcUC=Ai�KMilPdE]STSYE��0iVÀ

5]à � L#@VUV@C<T¿M@Vi¡KMij<YN�J�89=!=AG�@ i?@CUV8�L#<T=�n½J�KMLAKM;Z@C=?@VLI5 � =?G�Kc=jB�@k=A@CL?;Z<YN�@Cij=?G�@ i?<�V@FEMP&<YN 9i4=�KMN�UC@Vi/��Ã

� à ��J�E]N¢L?@VUC@V<>¿9<TN�X�KcN � � N�<>=A<�K�=A@���` � � �;Z@Vi#iAKMX]@-PdL?E]; =?G�@ �#EM8(=Ai#<YB�@c` !<>=UCL?@WK�=A@ViK�UVEMJhnEMP�=?G�@!¿]@VL#<Te�@CL � E]Nb<YN�J�89= <>5 � � A à � P�=AG(<Yil<Yif=?G�@�� � =AG � � N(<T=A<YKc=A@ F;2@Ci?i?KMX]@M`9=AG�@CN��&@B�@CN�EM=?@�=AG�<TifUVE]JOn�EMP�=AG�@�¿M@VL?<>e�@VLl:On �PO `�KMN�B�=?G�<Yif<TN�J�8(=f:hn �PO�à ¾ G�@!<TB�@VNO=A<>e�@VL � �¬<Ti8�i#@VBbKMifK¢S�KM:¤@VS£=AE¢B�@VN�Ec=A@�=?G�Kc=lK¡;2@Ci?iAKcX]@�L?@CUV@C<T¿]@CB�PdL?E];�=AG(@�J�L#Ew¿M@VLl<Ti�UVEMN�UV@CL?N�<TN�X=?G�@jJ�L?EM=?E9UCE]S�<TNh¿ME9UVKc=A<TE]NbKMi#i?EpUV<�K�=A@VB&�0<T=?GD=AG�@jX]<>¿]@VN­<YB(@VNO=A<>e�@VL � �¯Ã

Å Ã � P � ORUCE];2J(8(=A@Ci�K�;Z@Vi#iAKMX]@�' =AE�:¤@¢i#@VNO=�=?E�<T=?i�J�L#E6¿]@VLC`�=?G�@^UVEM;2J¤E]i?@CB\¿]@CL?<>e�@VL � i#@VN�B�i&=AG�@�;2@Ci?iAKcX]@ ��� �¯` ' ¢=AE¡=AG�@�J�L?E6¿]@CLV`��0G�@VL#@ ��� <Yi�=AG�@�<YB�@CNh=?<Te�@CL�UCE]L?L#@Vi?J¤E]N�B�9<TN�X^=AE =AG�<TilUVE]JOnbEMP�=AG(@j¿M@VL#<Te�@CLVÃ

_�à ��J�E]N½L#@VUC@V<T¿p<TN�X­K�;2@Ci?iAKcX]@ �����\` ' DPdL#E]; =?G�@FJ�L#Ew¿M@VLC`�=?G�@FUVEM;2J¤E]i?@CB½¿]@VL#<Te�@CL�PdE]L>9��KML?B(i�<>=f=AEF=AG(@j¿M@VL#<Te�@CL � O�=AG�K�=0UVE]L#L?@Vi#J�EMN�B�i0=AE =AG�@j<YB(@VNO=A<>e�@VL ���\Ã

L à ��J�E]N¡L?@CUV@V<>¿p<YN�X�=AG�@ � ��KMS>=$�;2@Ci?i?KMX]@&PdL#E];°=AG(@�E]8(=?i?<TB�@M`�=AG�@&UVE];ZJ�EMi?@VBI¿]@CL?<Te�@VLRG�KcST=AiKMN(B³E]8(=?J�8(=AiI=AG�@Z¿]@CUC=AEML�� EMP0KcSYS/=AG�@2<YN�J(8(=Ai¡L?@VUC@V<>¿]@VBq`�KMN�B³KcN³<YN�B(@�� i?@k=��±=AG�K�=<TN�B�<YUVKc=A@CifPdE]L �0G�<TU�G¯<TN�J�8(=?i0=?G�@jJ�L?EpEMPdilEMP-�hN�E��0SY@CB�X]@���@CL?@¡KMUVUC@VJ(=?@VB�Ã

Å]Å

Page 34: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

%�EM=?@\=AG�Kc=�=AG(@±UVE];ZJ¤E]i?@CB ¿]@VL#<Te�@CLDKMUCUV@VJ9=AiDi?EM;2@±<TN�J�8(=2¿cKMSY8�@CiDKMN�B�L?@ F#@CUC=?iDEM=AG�@CL?iCþ G�@2J�L?E]J¤@VL4=�n���@.�fKcNh=¢<Yi!=AG�Kc=W`�<YN�i4=A@VKMB+EMP�L?8�N(N�<YN�Xb=AG(@2UCE];2J¤E]i#@VB ¿M@VL#<Te�@CLV`-�&@�i#G�E]8�STBG�KW¿]@D:¤@V@CN KM:�ST@�=AE±i#8�:�i4=A<T=?8(=A@�G�<Y; �0<T=?G K �hN�E��0SY@CB�X]@D@��p=?LAKMUk=AE]L^i#8�U�G =AG�K�=^=AG�@�J�L?E6¿]@CL�&E]8�SYBZN�EM=�N(EM=A<TUV@f=AG(@�B(< ��@VL?@CN�UV@c`(KcN�BFn]@C=-=AG(@8�hN�E��0ST@VB�X]@�@��p=?LAKMUk=AE]L �&E]8�SYB E]89=AJ�8(=&KMSTS(=AG(@�0<T=?N�@Vi#i?@Ci&PdE]L �0G�<TU�G2=AG(@�J�L#E9EcP�EMP1�pN(E �0ST@VB�XM@8�&@VNO=�=?G�L?EM8�X]GZi?8�UCUV@Vi#i#Pd8�STSTnMà � E]L?@0PdE]L?;2KMSTSTn¤À

�2#-, ������&�� /. ./. 0 6"�� �� �*���,#% 4� !�� 2 . � ��%�� ��� !��� � E � � � �� ( ��# � K ��#NM � #�#"��� % �����# C � � � ��%��� ��� % � ��� ��� ��� # #$� � %�( ��#$ ������ �UM � b < � � % � %�� � � ����� ��� ��� # #$� � %����� ��� � �� �� �!� M�% � ��#$� �SR � �% � �SR % #� ��%�� # � % � % � �"�"�" " �% �!% � �(��#��@( ��# C � � #����� � ��SR � �"��% � � � � ��� � ��� � � %�� � � �� � � % � %

QJ�p=AL?KMUC=?<YE]N"X � �< 5 � A # ���� E � % � P ��� �"�@* � �YRYT �"�"�" " %�� % � � �L( ��#$ # �^ � � � � %����% P ��T (� ��� ��� X < � � ADCFE � ��#$� � � ( �"��% � # �UM � �� �%� � �"�" C � X <K� � ������ ��� A%C � ���� � � � ���% �UM � � � ���"�" �� � � P � TZM � # � � � � � C E � % � �" " 5O �� � ��% � % # <K�PO � 5O A� � � � b79<T;^8�SYKc=A<TE]N"X �� � �L( ��#" # �ji �(���� E � % � � � � E � ��% � ��# %� � � � ��� % � % � ��( ��# � K ��#��� # % � % � �(��� � E � � � ����SR %�#� ��% � # � b^c � #$� M � # � � ��� C M � # � � �L( ��#$ # ���" � C

� 9 �;:=< F032 ��� < + � < 5 � A�A �� � 9 �;:=<� J �� ]�� < � � <>5 � A�AE � ��#$��� ]�� �� � � % �" % � ����* � # % �UM % � � � �% ���% �UM % � � �SR % #� ��%�� # � b

� �*# ���,#%' /. .j.&�10 6 �� �� ������#% 4�26"�4' � �4-��������� ��� ! � 2�. �)M � � ��� � E � � � ���( ��# �)*K ��# E � % � #"�" � �"��% % �$# C % � � ��� � � ��� � ��� ��� # #$� � % ����� ��� � �� �� � E � % � #$�" � �"��% %��$# b�&#�� �UM b Â$@C=D8(i�e�L?i4=DB�@Vi#UVL#<Y:¤@\=AG�@ �pN(E �0ST@VB�XM@½@��p=AL?KMUC=?E]LDKMSTX]E]L?<>=AG�; � à 4 @ �0<TSYSl=AG(@VNKMN�KcSTn�V@j<T=?ilUVE]L#L?@CUC=AN(@Vi?i�KMN�B­L?8(N�N�<YN(X =?<Y;Z@MÃÂ$@C=¡K � ��� ��� � � �F@D�p=ALAKcUC=AEML � $ :¤@ZK­;2KMU�G�<TN�@^=AG�K�=W`$E]N <YN�J(8(= � KMN(B �0<>=AG :�S�KcU+� 9�:�E@�

KMUCUV@Vi#il=AEFK^J�L#E6¿]@VL�� `(B(E9@Cif=:��EF=AG(<YN�X]i&<YN�J�KMLAKMSTSY@CS À�<T=fL#8�N�if=?G�@!@��p=AL?KMUC=?E]L �³`�KcN�BD<T=fKMSYi#Ei?@VKML?U�G(@Vi0=AG�L#E]8�X]G­KMSTS�=AG(@ �-<K� A 9�:(<T=li4=AL?<TN�X]ifPdE]LfKI�0<>=AN�@Ci?i� i?8(U�G­=?G�Kc= # <�� A�X 5]à � P��E]8(=?J�8(=?i�i?8(U�G½K� ¡` � $ G�KMS>=Ai�KMN�B¯E]8(=AJ(8(=Ai ¢`£EM=AG(@VL��0<Ti?@c` � $ UVE]NO=?<YNh8�@Vi�<T=Ai0i#@WKML#U�G�à � P � $B�<Ti?UVE6¿M@VL?i0=AG�Kc=�N�E i#=AL#<YN�X EMP�SY@CN�XM=?G �-<K� A <Yi�K��0<T=AN(@Vi?il=?E # <K� � A `(=AG�@CN � $ L#@ F#@VUk=AiCÃ

� �KcUC=Ai�KMilPdE]STSYE��0iV
5]Ã�Á08�N =AG�@­UVE];ZJ¤E]i?@CB'¿M@VL?<>e�@VL � V`&E]:�i#@VL#¿M@\<>=Ai E]8(=?J�8(=W`�KMN�B iAKW¿]@¯<T=AiFUCE];ZJ�8(=�K�=A<YEMNG�<Ti#=?E]L#nMÃ

� à E]Ll@VKMU�G%�PO �£`�@D�9=?LAKMUk=�K �0<>=AN�@Ci?i� 5O�`£KMifPdEMSYSYE��0iCÀ<²K A � K�M@�K!N�@'� UCE]JOn EMP¤=AG�@0UVEM;2J�89=�Kc=?<YE]N�`]KMN�B L?@��0<YN�B =AG�<Ti/UVE]JOnF=?Ej=?G�@0;2EM;2@CNh=

�0G(@VN¯=?G�@j;2@Ci?i?KMX]@!� � N�<>=A<�K�=A@ �PO I��KMi0e�L?i4=�<Ti?i#8�@VB�Ã<�: A Á0@VJ(S�KMUC@-=?G�@-¿M@VL#<Te�@CL � O��0<>=AGI=AG�@-UVE];¢:�<YN�@CB¢@D�9=?LAKMUk=AE]L � $ <K�PO A B�@Vi#UVL#<Y:¤@VBFKM:¤E6¿]@cÃÁ08�N � $ =AE @V<>=AG�@CL�EM:(=�KM<TN 5O�E]LlB�<Yi#UVE6¿]@CL�=?G�Kc=0N�E 5O�@��9<Ti#=AiC`£KMilPdE]SYSTE��0iVÀ� 4 G�@VN � $ i?@VN(B�i0K¢;Z@Vi?i?KMX]@�=?E¢=AG(@!KMB(¿M@VL?i?KML#nM`(=AG(<Yi�;Z@Vi#iAKMXM@�<Yi-PdE]L���KML?B(@VB=AEF=AG(@¡KcB(¿]@CL?iAKcL#n �0<T=?G­=?G�@jL?<TX]GO= ���\Ã

Å _

Page 35: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� 4 G�@VNb=AG(@¡KcB(¿]@CL?iAKcL#nbi?@CN�B�i�KF;2@Ci?iAKcX]@�=AE�� O�`�=AG(<Yil;Z@Vi?i?KMX]@!<TifPdE]L���KML?B(@VB=AE � $ Ã

� 4 G�@VN � $ N�@V@CB�i�=?E2L#@'�0<YN(B­=?G�@¢KcB(¿]@CL?iAKcL#n]`�=?G�@¢KcB(¿]@CL?iAKcL#n­<YilL#@'�&E]8�N�B½KciB�<YL#@VUk=A@VB­:On � $ Ã

<�U A � N½UVKMi?@ � $ L?@:F#@VUk=AiV` � 3�0<YSTS�L?@ F#@CUC=�@C¿]@CL#nh=AG(<YN�X <dE]8(=AJ(8(=!KMN\@V;ZJ(=�n­<YN�B�@D�¯i?@C= AKcN�B G�KMST=Và ��=?G�@VL>�0<Yi#@M`!<T=!�0<YSYS�i#=AEML?@ 5O¡KMN�B J�L?EpUV@C@VB =AE @��p=AL?KMUC=­=AG(@ N(@��p=�0<>=AN�@Ci?iCÃ

Å Ã �  E]8(=?J�8(=AiF=?G�@biAKM;Z@�¿cKMSY8�@Ci�� KcN�B � E]8(=?J�8(=Z:On³=AG�@D¿M@VL?<>e�@VL�� C`�KMN(B�KMSTS�=AG(@�0<>=AN�@Ci?i?@Ci�@D�p=ALAKcUC=A@CB�Ã

� =!<Yi�UVST@WKML�=?G�Kc= � !KMS���KWn9i�=?@VL#;2<TN�Kc=A@CiVà � =�<Yi�KcSYi?E�UVSY@VKML�=?G�Kc=E�0G(@VN�@k¿]@VL � �E]89=AJ�8(=?iKMN <YN�B(@�� i#@C=W`�<T=IKcSYi?EbE]89=AJ�8(=?i!=AG�@ UVEML?L?@Ci?J¤E]N�B�<TN�X&�0<T=AN(@Vi?i#@ViCà 4 @2;^8(i#=IN�E�� i#G�E�� =AG�K�==AG(@jPdEMSYSYE��0<TN�X¢=:�&E2UCS�KM<T;2ifG(E]SYB�À

6 $&)8�&' � <�Á�8(N�N�<YN(X =?<Y;Z@ A � L?8(N�i�<TNb@��9J�@CUC=?@VB\J¤E]S>n9N(E];2<YKMS£=A<Y;Z@MÃ6 $&)8�&' <²[�E]L?L#@VUC=?N�@Vi#i A ¾ G�@-¿cKMST8�@Vi � KMN�B �!E]8(=AJ(8(=�:hn � �KML?@-B�<Ti#=AL#<Y:�89=A@VBIUVEML?L?@CUC=?STn]à L?E]; =AG�@Ci?@ =:��E¯UVS�Kc<Y;ZiV`�<>=!PdE]SYSTE �0i�=AG�Kc=� <Yi!UCE]N�UC8�L?L#@VNO=AS>n UVE];ZJ�EMiAKM:�ST@M`$:On H�@ke�N�<�9

=A<TE]N � à L à � ÃÂ$@C=!8�i�e�L?i4=�i?G(E � [�S�Kc<Y; 5]Ã�798�J�J¤E]i?@¡=AG�Kc=�=AG�@^KMB(¿]@CL?i?KML#n � i!LAKMN�B(E];*UVE]<TN�i�KML#@¢e��9@VBqÃ

¾ G�@be�L?i4=�i4=�KMXM@¯EMP � Z<TiGF#8�i#=2L?8�N(N�<YN�X i?@k¿]@CLAKMS�<YN�B(@VJ¤@VN�B�@CNO=�UCE]J�<Y@Ci2EcP�=AG(@b¿M@VL#<Te�@CL �2Ã� =Z=�K�c@ViDK J�E]S>npN�E];Z<�KMSfNh8�;¢:�@CL2EMP�i#=A@CJ�iVÃ3798�J(J�E]i#@\=AG�Kc=2=?G�@\EM8(=AJ�89=�EMP � 2<TiB< �� � A Ã2&n $O `SY@k=I8�i¢B�@CN�EM=?@�KMN KMB(¿M@VL?i?KML?<YKMS&KMSYX]EML?<T=?G�; B�@Ce�N(@VB KMijPdE]SYSTE��0iVÀ¡Á�8�N � �< 5 � A �0<T=?GKMB(¿M@VL#iAKML4n 8�NO=A<TS0nME]8�L#@VUC@V<T¿M@¯=?G�@ � � =?G � � N(<T=A<YKc=A@ �PO ;Z@Vi#iAKMX]@cà ��J¤E]N L?@VUC@V<>¿9<TN�X =AG�<Ti;Z@Vi?i?KMX]@c`p<TN�i#=?@WKMBZEMPq;�K�h<TN�XjKIN(@'� UCE]JOn��PO£EMP�=AG�@l¿M@VL?<>e�@VLC`9i4=�KML4=-<YNO=A@CLAKMUk=A<YN(XE�0<T=AG �!<K�PO A `KMi!B�<TL?@CUC=A@CB :hn½KMB(¿]@CL?i?KML#n� DáÂ$@C=N� O:< A X m�L ��< $O + �!<��PO A�A - . À .�X 5 à %�EM=?@^=AG�K�=:¤@VUWKc8�i?@� <YifK��pN(E �0ST@VB�XM@�¿]@VL#<Te�@CLfPdE]LfL#@VS�K�=A<YEMN #^`�<T=&PdE]SYSTE��0i&=AG�Kc= � <��PO A �0<YSYS¤@��p=?LAKMUk=� 5O�0<T=?Gb<YN � � � � � � �����

� � � � � � � ��� i#=?@VJ�iC`£<TP � O < A � �� � � � `�:On­H�@ke�N�<T=?<YE]N � à L Ã�5]þ G�@VL#@CPdE]L#@M`�<>Pe� O:< A � �� � ��� � `£=AG�@CN � $ <��PO A �0<TSYS�L?8�N¯PdE]L�K�=�;ZE]i#= � � � � � � ��� �

� � � � � � � ��� i#=A@CJ�i�<TN@��9J¤@VUk=�Kc=?<YE]N�à ��=?G�@VL>�0<Yi?@c` � $ <��PO A �0<YSYS�L?8�N½PdE]LjK�=j;2E]i4=��(< � � � � � A i4=A@VJ(i¡i#<YN�UC@ =?G�Kc= � i!G�E��SYEMN�XF<T=l=AK�M@Ci�=?E e�N�B 5O�:Onb:�L#8(=A@!PdE]L#UV@jE]LlB�<Ti?UCEw¿M@VL0=AG�K�=0<T=0B�Ep@Vi0N�EM=0@D�9<Yi#=VÃ

� E]L#@VE6¿]@CLV`�E]N�UC@W �<Yi&e �(@CB�`£KMSTS¤=?G�@�¿cKMSY8(@Vi�� O:< A KcL?@�e��9@CB¯Kci���@CSYS²Ã�Q/¿M@VND=AG(E]8�X]GD=AG(@@C¿M@VNO=I=AG�Kc= � KMUVUC@VJ(=?i?�PO�<Ti�N�EM=jN(@VUV@Ci?i?KML?<TSTn±<TN�B�@CJ�@CN�B�@VNO=IEMP�=AG(@F@C¿]@CNO=I=?G�Kc=j<>=jKMUVUC@VJ(=?i���w`$E]8�L!UWKcSYUV8(S�Kc=?<YE]N±EcP�@D�(J¤@VUk=A@CB+L?8(N�N�<YN(X�=A<Y;Z@ �0<TSYSXMEb=?G�L?EM8�X]G :�@CUWKM8(i?@ EMP&SY<YN(@WKML#<T=�n­EMP@��9J¤@VUk=�Kc=?<YE]N�Ã

E]L2@VKMU�G � � �c`�=AG(@¯@D�9=?LAKMUk=AE]L � �0<YSTSlB�E+N(E �&E]L��=�0<T=?G�J�L#E]:�KM:(<YSY<>=�n 5�� � O:< A `UVEML?L?@Ci?J¤E]N�B�<TN�XD=AED=AG(@F@C¿]@CNO=¡=?G�Kc=� !L?@:F#@VUk=A@VB �PO ��KMN�B��0<T=?G½=AG�@FL#@V;2KM<YN�<TN�X�J�L#E]:�KM:(<YSY<>=�n� O:< A `�<T= �0<YSTS�L#8�N PdEML�Kc=2;ZE]i#= ��� ��� � � � � ��� ��� �

��� � � � ��� ��� � � ��� ��� � � � � ��� ������ � � i#=A@CJ�i�<>P � O:< A � � � � � � � �k`

KMN�B Kc= PdE]LZKc=Z;ZE]i#= � � � � � i#=?@VJ�iZEM=AG(@VL��0<Ti?@cà ¾ G�@VL#@CPdE]L#@M`f<TN @��9J�@CUC=AKc=A<TE]N�`�=?G�@¯@D�p=ALAKcUC=AEML� �0<TSYS�i#J�@CN�B±K�=�;ZE]i4=^�(<�< �PO � �-<��PO A�A�� A i4=A@VJ(i�@��p=?LAKMUk=A<YN(X.�0<>=AN�@Ci?i� 5O�à 2&nbSY<TN�@WKML#<T=�n2EMP@��9J¤@VUk=�Kc=?<YE]N�`�=?G�@ L?8�N(N�<YN�X�=?<Y;Z@¢EMP � <Yi��!< �6< � � �-<�� A�A�� A ` �0G�@VL#@$� � <Yi�=?G�@F¿cKMSY8�@PdE]L �0G�<TU�G � � �J<K� A <Yif;2K �9<Y;Z<�C@VB�à ¾ G�<Yilgh8�KMNO=?<T=�nD<TilJ�E]S>npN�E];Z<�KMS£<YN!��i?<TN�UV@IKMSTS#�PO � i�KML#@EMP�SY@CN�XM=AGD=?G�Kc=�<YilJ¤E]STnpN�EM;2<YKMS�<TN ��à ¾ Gh8�i8�&@IG�KW¿]@IJ�L?E6¿]@CB½[�SYKM<Y; 5]Ã

%�E��¬ST@C=F8(iFJ�L?E6¿]@¯[�SYKM<Y; � à ¾ G(@­EMN�STn UWKMi#@ �0G�@VN � B�E9@Ci N�EM=FE]89=AJ�8(=F=?G�@D¿cKMSY8�@E]:(=AKM<YN(@VB³:On³L#8�N�N�<TN�X � ^<Ti �0G�@CN � FKMUVUC@VJ(=?@VB i?EM;2@ �PO�PdE]L �0G�<TU�G N�E �0<T=?N�@Vi#iF@��9<Yi4=AiCÃ

Å L

Page 36: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

798�J(J�E]i#@�=AG(<Yi-G�KMJ�J¤@VN�i �0<T=AG�N�E]N 9�N�@VX]ST<YX]<T:�SY@�J�L?E]:�KM:�<YST<T=�nMà ¾ G�@CN(��@�i#G�E�� =AG�K�=�=AG(@VL?@�<Yi-N�E�hN�E��0SY@CB�X]@I@��p=AL?KMUC=?E]L�PdEMLf¿]@VL#<Te�@CL � Ã�%�KM;Z@VSTnM`�SY@k=08�i�UCE]N�i4=AL?8(UC=�KMN\KcB(¿]@CL?iAKcL?<�KcS$J�L?E6¿]@CL ��0G�E��0<TSYS£<YN�B(8�UV@ � =AE KMUCUV@VJ9= �0<T=?G�J�L?EM:�KM:�<TSY<T=�n XML?@WK�=A@VL&=AG�KMN � � � � � K¢i#=?L?<TN�X8�bPdE]L �0G(<YU�GN�E.�0<T=AN(@Vi?i�@��9<Yi4=AiVà ¾ G�<Ti�<YN­<T=?i?@CSTP �0<TSYS$<Y;ZJ�S>n�=AG�Kc=�N�E2@��p=AL?KMUC=?E]L�@D�9<Yi#=?iV`�i?<YN(UV@M`¤N�E�;2Kc=#=A@VL�0G�Kc= �¬<YiEMLRG�E��'SYE]N�X�KMN^@D�9=?LAKMUk=AE]L-�0<YSYSpL?8(N�`]<T=)�0<YSTSpP�Kc<YSO=AE�e�N�B K3�0<T=?N�@Vi#iV`OUCE]NO=ALAKcB�<YUk=A<YN(X=AG(@IXM<T¿]@CN�à ¾ G�@IKMB(¿M@VL#iAKML#<�KMS�J(L?E6¿]@CL8�0<TSYSq:¤@W $O B�@Ci?UVL#<Y:¤@VB¯KM:¤Ew¿M@MÃ&79<TN�UV@!<>=fPd8�SYS>n�@C;^8�SYKc=A@Ci=AG(@FUVE]N�B(<T=A<TE]N�i�EMP�=AG�@^<TNO=A@VL?KMUC=?<YE]N\:�@k=:��@C@VN ��jKMN�B� D`�<>=�<YN(B�8�UV@Ci�� =AEDKcUVUV@CJ(=?�PO �0<T=?G=AG(@Ii?KM;Z@!J�L?E]:�KM:�<YST<T=�n�KMil=AG�@jJ�L#E]:�KM:(<YSY<>=�n =AG�Kc= ���KMUCUV@CJ(=Ai/�PO�Ã

�7#%'5)+��� . %�EM=A@j=AG�Kc=�:�EM=?G¯=?G�@¢B�@ke�N�<>=A<YEMN¯EMPUVE]N(UV8�L#L?@VNO=�UVE];ZJ�EMi?<T=?<YE]Nq`£KMN�B¯=?G�@j=AG�@D9E]L#@V; UVKMN :�@FPdE]L#;^8�S�K�=A@VB±PdEML!KMN ���+* ��� � ��UCE];ZJ�E]i#@VB½¿]@CL?<>e�@VLC`�<²Ã @cÃT`$=?G�@^¿]@CL?<Te�@VL!=AG�K�=jB�E9@CiN�EM=&��KM<T=­8�NO=?<YS�=AG(@ @CN�B3EcP¢=AG(@ UCE];ZJ�8(=�K�=A<YEMN =?E EM8(=AJ�89=%�POI=AEMX]@C=?G�@VL �0<T=?G <>=AibKMUCUV@CJ 9=�KcN�UV@ "cL?@:F#@VUC=?<YE]N B(@VUV<Ti?<TE]N�à ¾ G�@½;ZE9B(<Te�UVKc=A<TE]N'=?E³=AG�@\B�@Ce�N(<T=A<TE]N <Ti2=AG�Kc=�=AG(@±i?<T;^8�S�K�=AE]Li?G(E]8�SYB±KMSYi#E�J�L#E9B�8(UV@^<>=Ai�E]8(=AJ(8(=�E]N�9�SY<TN�@M` �0<>=AG�E]89=G��KM<T=?<YN�X PdE]L�=?G�@¢@CN�B½EMP/=?G�@¢UCE];2J(8(=�K 9=A<TE]N�`�KMN�B <T=AiIE]8(=?J�8(=¡i?G�EM8�SYB :�@Z<YN�B(<Yi#=?<YN�XM8�<Yi#G�KM:�ST@^PdL?E]; =?G�Kc=IEMPf=?G�@�E]N�9�SY<TN�@FUVEM;2J¤E]i?@CB¿]@CL?<>e�@VLCÃ

� ��� � ������������ ��� ��� � ������ �������� ����� ����� ��� � �! �"� � �#

$&%('*),+.-0/010243657-98;:<8;=>+�'*+?:"=�@BA0+?2DCFEG+.8;H<HI/0=>+J'*)98K'LH<@�=�+!HI+?'IMN/0-�-0)98KH<+OP-Q@�HIH<341024RS:</,%�1TR8J'<:</0HU'*+�AV'<)036:IAV-98;:U'&R�CB@�:G-W@�H<HI36102XR�1TRY8!HI+�5�/,:<+�A034HI'*:I3610/B'*+�AY-0:<@;'<@B5?@�2Q8;=>@;%0Z.8;242F-98;:I'<36+?H�[�CEG8;HG:I/0%Y1W+?\P@�:I+]'<)0+]-0:<@;'<@B5?@�2F1Q+?Z�36%,H�^`_a+]'<:<+�8K'b'<)0+c8;A,d�+?:<H<8;:IRY8;Hfe,gB+�Aih�j M�kml j�'<)036HfHI+?'IMN/0--0)98KH<+n'*@o@�p7-02q8K5�+;^`r"%�+�g,8;=�-024+n@;\F'*)0+s-,/01026345�MN-98;:*8K=>+�'*+�:t=�@BA0+?2,34H`'*)0+s-,/01026345�MNp;+?RJ=�@BA0+?2DCE)0+?:<+LEb+u8;H<HI/0=>+L'<)98K'G36%V'*),+L36%03X'*368;29H<+�'IM&/,-S-,)98;H<+"+�8;5�)-98;:U'*345�36-08;%v'n)98;HG@�1,'�8K36%0+?A8!p;+�R-98;34:�w`8!-0/01024365cp;+?R>'*)98m'n36Hb-0/0102436HI)0+�Ax8K%0A8�d;8K362q8K1026+s'*@.8;262F-98;:U'*34+�H�C,8;%0Ax8JH<+�5?:<+�'p;+?R>'*)98m'36Hs@;%024RYpo%,@yE%S'*@�'*),36H-98;:U'&R�^

zs)0+]:<+�8KH<@�%�Eb+]'<)036%0pJ@;\W'*)0+s%0@;%BM&/0%,34\P@�:I={8;A,d;+�:IH*8;:UR�8;H�1Q+?36%0Z�e,gB+?A>1W+?\P@�:I+s'*)0+sHI+?'IMN/0--0)98KH<+;C|34HL'*)98K'�C}36%('<)0+.e9:<HU'7-02q8;5?+;C~'<)036HL34Hu8x=>@�:I+.:<+�8;2634HI'<365!HI5�+?%98;:<34@H<36%,5�+�8;%�8;A,d;+�:IH*8;:URE36242G8m'<'�8K5�p�8;%�8;24Z�@�:I34'*),=�8KH.@�-0-W@�H<+?A�'*@�34'<H.H<-W+�5?34e95x34%05�8K:<%98K'<36@�%�^�$&%�8KA0A034'<36@�%�C�34\'*),+8;A,d;+�:IH*8;:UR.36H`8;2624@�EG+?A!'*@L1W+Ge,gB+?AS� M�� j l '*)0+GH<+?'UM&/0-�-,)98;H<+KC�'*)0+?%.'*)034H`HI+?'IMN/0-�-0)98KH<+n1W+�5?@�=>+?H@�10HI@�26+�'*+]H<34%05�+'*)0+c8;A,d;+�:IH*8;:URY=>8�R�1Q+]A0+?H<36Z;%0+�AV+?H<-W+�5?3q8;2424R!\P@;:#'<)036HfH<-W+�5?34e95cH<+�'<'*34%0Z7@;\~'*),+-98;:<8;=�+?'*+?:<H?C}8;%0A(\P@�:"+�g,8;=�-026+.34%�'*),+�-0/01024365�MNp;+�R�HI+?'<'<36%0Z,C~H</05�)a8;%i8;ABd�+�:IH*8;:UR(E36242�pT%0@�E8;242Q'*),+7HI+�5?:<+?'cp;+�RoH�^

�L+?e9%,34'*34@�%0Hn@K\��?+�:I@KM&pT%0@�E26+?A0Z�+u-0:I@B@;\PHn8;%0A-0:<@o@;\PHs@;\tpT%0@�E26+?A0Z�+u36%V'<)0+�HI+u=>@oA0+�24Hs8;:I+5�)98;%,Z�+�A�8;H]\P@�2624@yEH?wszs)0+�8;A,d;+�:IH*8;:UR(36H]e,gB+�A�1W+?\P@�:I+!'*),+.H<+�'IM&/,-�-0)98;HI+;C�'<)0+.-0268�R;+�:IH"'�8;pK+-0/01,26365!-98;:*8K=>+�'*+�:IHu8;H�36%,-0/,'�C|8K%0A�'*)0+�HI36=./0268K'*@;:L8;%0AipT%0@�E26+?A0Z�+�+�gB'<:*8;5�'*@�:78;:I+�8;2624@�EG+?A8;/BgB34263q8K:IR�34%0-0/,'<H>'*)08K'VA0+?-Q+?%0A�@�%�'<)0+(-0/,1026345�-98K:*8;=�+?'<+�:<H?C]8;%0A�8;:I+�5?@�=>-,/,'�8;1,26+\P:<@�='*),+>:<8;%0A0@�=�%0+?H<Hu'*)98K'7EG8;H!/0HI+�A�'<@�Z;+�%0+?:*8K'<+�'<)0+�HI+Y-0/01,26365�-98K:*8;=�+?'<+�:<H?^x�c+?:<+KC�Eb+Y@�=�34''*),+.\P@�:<=>8;2634H<=SCF10/,'u:<+�\P+�:L'<)0+�:<+�8;A0+�:L'<@S�]+�RB�?36%~��HLEb@�:<p����+?RB�,���`@�%iH<+�5?/0:<+�-0:I@;'*@o5�@;26HL34%dK8;:<34@�/0HsHI/05�)�=�@BA,+�26H?^

���

Page 37: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��������� ���� ����������������������������! "��#%$��'&)(+*���$-,.��/10�#%2��3��4546*��7�46�����+(

��8;=�Z�88;:IA � ��8;=Y�;�y�"H<)0@�Eb+�A '*)98K'�C"8KH<H</,=>34%0Z�'*:<8;-WA0@B@;:Y5�@;=>=�34'<=>+?%T'<HY8K%0A '*)0+�-0/01024365�M-98;:<8;=�+?'*+?:�H<+?'I'*34%0Z0CG3X'�36H�+�8;HUR�'*@�8;5�)036+�d�+S5�@�%,5�/0:I:<+�%v'Y��+�:I@KM&pT%0@�E24+�A0Z�+�-0:<@K'*@o5�@�24H�/0H<34%0Z9#M&-,:<@;'<@B5?@�26H?^

:`36:IHI'�C926+?']/0H]A0+�e9%0+JE)08K']34']=>+�8;%0Hs\P@�:]8���+�:I@KM&pT%0@�E24+�A0Z�+J-0:<@o@;\t'*@�5�@�=�-W@�H<+75�@�%,5�/0: M:<+?%v'*24R;^f$N'36HsH<34=>342q8;:f'*@�5?@�%05�/,:<:<+?%v'*24RV5�@�=�-Q@;H*8;1024+L-0:I@B@;\�@;\�pT%0@�E26+�A,Z�+;C9+�g,5?+�-,']'*)08K')0+�:I+Eb+�8;:<+]5�@;%05�+?:<%0+?A8;1Q@;/,'G1W@;'<)Y'*)0+c5�@�=�-W@�H<+?A<;�:<@�d�+?:�=?>G8;%0A>'*)0+c5�@�=�-Q@;H<+�AA@f+�:<3Xe9+�:�BC>�^zs)0+�R�8;:I+.1Q@K'*)�H<34=>342q8;:s'<@YE)98K'�Eb+�A0+�HI5�:I361W+�A�36%('<)0+.-0:I+?do36@;/0HLH<+?5?'<36@�%�\P@�:]'*)0+.-,:<@o@;\f@;\pT%0@�E26+?A0Z�+x5�8KH<+;^�zs)0+x5?@�=>-W@�HI+�A�d�+?:<3Xe9+�:.B?>�34H�C�34%�\ 8;5?'�C�36A0+?%v'*365�8;2D^D:F@;:J'*),+x-0:<+?H<+�%v'*8mM'*34@�%�@;\#'*)0+?H<+�5�@�=�-W@�H<+?A�-,:<@;'<@B5?@�26H?C~EG+�E36242�8;HIH</0=�+�'*)98m'�'*)0+�36%,HI'*:I/05?'<36@�%,HL'*@x36%,34'*368K'*+!8-0:I@;'*@o5�@�2�5�@�=�+L\P:<@�= 8;%S8;A,d�+?:<H<8;:IR;^bzs)0+75�@;=>-W@�H<+?A-0:<@�d�+?:E=?>�^��^�F]-Q@�%S:<+?5�+?34do36%0Z�8;%S36%,-0/,'HGI$&%03X'*3q8m'*+EI|CKJ!CML"NHO�\P:<@;= '*)0+7@�/,'<H<34A0+;C95?:<+�8m'*+J8�5?@�-vR@;\'<)0+.;f:I@�d�+�:�= 8;%0A�:</,%P=>OQI�RSJL[�^�$N\G'<)036H�34H�'*)0+UT<� '*))GI$&%03X'*368K'*+VOx=>+?H<H*8KZ�+;C|'*)0+?%aEb+A0+?%0@;'<+J'*),36H"5?@�-vRS@;\�'*),+.-0:<@�d;+�:"1vRW=�XDC�8;%,A�'*)034Hc34%0-0/,'c1vR�OYI�XZRSJ�Xq[�^]zs)0+!34A0+�%v'<34e9+?:L"N 36HV/,H<+�A 8;H8�268;1W+�2'*@�A0+?%0@;'*+('<)98K'8�=�+�HIH*8;Z;+�:<+�5?+�3Xd�+�A�\P:I@�= '<)0+�-0:I@yd;+�:x34H5?@�%05�+?:<%034%0Z�'*)0+u-0:I@;'*@o5�@�2�36%vd�@o5�8K'<36@�%8KH<H<@o5�368K'*+?ASE3X'*)x'*),+7Z;34d�+?%�34A0+�%v'<34e9+?:�L[N�^

� ^$N\\=�XF5?@�=>-,/,'*+?Hb8L=�+�HIH*8;Z;+�] '*@u1W+sH<+?%T'f'<@73X'*H�d;+�:<3Xe9+�:?C�'*)0+5?@�=>-W@�HI+�A�-0:<@�d;+�:fH<+?%0A0HOQ]^R_L[NV[n'<@�'*)0+u5�@;=>-W@�H<+?Axd�+�:I34e9+?:�^

� ^$N\L'<)0+S5�@�=�-Q@;H<+�A d�+?:<34e0+�:YHI+�%0A,H>'*),+�=�+�HIH*8;Z�+�O`]^R_L"Nx[.'*@i'*)0+�5�@�=�-W@�H<+?A�-0:I@yd;+�:?CA034:<+?5?'s'*)08K']=>+?H<H*8KZ�+�'*@�'*)0+u-0:I@�d�+�:a=�X|5?@�:<:I+�HI-Q@�%,A036%0Z�'*@�'<)0+u:<36Z;)T'aL"N�^

b ^�F]-Q@�%:I+�5�+?34do36%,Z�'<)0+cG<�"8;2X'SO�=�+�HIH*8;Z�+�\P:I@�= '<)0+u@�/,'*HI36A0+KC9)98;2X'�^dfehgji�kQlmk`nMi!oqpsrqp`tKp?uwv l*k�k"xEy{z|y�� j{} O~=�R_BJ[�� y���k��\�{�ol�l j �9�~��zf��k }Ev kmy �vh � j%� x

� @�=�-024+?'*+?%0+�HIHm�H�q�9j ��k }Ev kmy j��A�;j l � �nj l B?>���� �Y� � � �#� z|y � ��� jZv � j{�;j l_zm� �7� �7�Y� �,� �b� �9j��k }Ev kmy j���v l�k �;j l =?>2v l*k �;j y��� @;/0%0A0%0+?H<H������q�9jjv l*k h��vh�� � � �`zJ� �,� �t� �9j ��k }Ev kmy j����;j l � �nj l B > � ��� jZv �Qy � x � ��y j y�� � � j{�}Yj �9� � yE� �oO�� I�X�� [ �

��� e�nK��e7� oqpsr p`t�p?u ��z v l*k�k"x�y{zmy�� j{}¡��� � � � j �¢� � � � h � j y�k��£� � � j y�y � yE��k��\�{�ol�l j �9�`��z���k }Ev kmy ��vh � j���� � � � j �¢� � � � h � j y�k��7� � � j y�y��¤ l*k�k"xV� O � p;+?'<5�)~^ [ � @;=>-024+?'<+�%0+?H<H"\P@�2426@�EH\P:<@�= '<)0+.-W+�:I\P+?5?'"5�@�=�-026+�'*+?%0+�HIHL@;\�'*),+!@�:I36Z�34%98;2-0:I@B@;\~HIRoHI'<+�=SC01Q+?5�8;/,H<+u8;242F'<)98K'b'*)0+L5?@�=�-Q@�HI+�AV-,:<@�d�+?:8;%0AYd;+�:<3Xe9+�:[email protected]�:I+�8K'<+L5�@�-,36+�Hb@;\={8;%,ADB 8;%0Ax\P@�:UEn8K:<AS=>+?H<H*8KZ�+�H]1Q+�'&EG+?+�%S'*)0+?=�^

� @�/0%,A0%0+�HIH�36H.HI)0@�E% 1vR�5�@�%v'*:<8;-W@�H<3X'*34d;+;^ � /,-0-Q@;H<+Y'<)98K'.'<)0+VH<@;/0%0A0%0+?H<H�@;\'*),+V5�@�%oM5�/,:<:<+?%v'"-0:I@B@K\�HIRoHU'*+�=�34Ha¥?^Gzs)0+?%�EG+7H<),@yE '<)98K''*),+JHI@�/0%0A0%,+�H<Hc@;\`'<)0+7/0%0A0+?:<24Ro34%0Z>-,:<@o@;\HIRoHU'*+�=�O~=�R_BJ[b36HG8K'n24+�8;HU'�¥�^�zs)034Hn36Hb1Q+?5�8;/,H<+LEb+L5�8;%�OP%0@�%BMN/0%03X\P@�:<=�24R,[�H<+?+"E)0365�)V\ 8K26H<+�I�X'*),+�@f+�:I34e9+?:�8;5?5�+�-B'*H�E34'<)!'*),36H`-,:<@�198K10362434'&R�CK8;%0AJ'*)0+?%�5�:<+�8K'*+n8L-0:<@�d�+?:`'*)08K'`Eb@�/024A�+�=./0268K'*+'*),+!5�@;%05�/0:I:<+?%T'u5?@�%0A03X'*34@�%0Hc8;%0A�\P@�:I5�+7'*)0+7d�+�:I34e9+?:c'<@V1Q+?)98�d�+.34%�'<)0+.H*8K=>+7En8;H"8;H"34%�'*),+5�@;%05�/0:I:<+?%T'c5�@;%0A034'<36@�%,H�^

�h¦

Page 38: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

dfehgji�kQlmk`nMi!oqpsrqpso����CnMi������|��e7i l�� �|p�u v l*k�k"xCy{zmy�� j{}�� l j y v ��� � l~�¢� }Yj �9��� O~=�R_BJ[ x�kml� � �7�¢� � � j�� � y���k��\�{�Bl�l j �9�`��z�� j l*k�����k � � j�� � j�� x�x�kml � �Y� v l�k h��vh�� � � y�� � � v k���z���k }�� � � � � �Y}YjJ�h�¢��;j lSy � l �Dj y�����x�kml � �Y� ���"� �9j l jU� y � y �Y} �7� � � kml�� x�kml�� � y � �9� j l � ��� � k�� ��� � � � �9j ��k }Ev kmy j��v l*k �;j l =?> k�� � � v �o� I"!{R$#$#$#\R�I&%(')�*� l j y v ��� � �9j l j � �9j ��k }Ev kmy j��av l*k �;j l =?>J� ��y�k!l j � j{�Y�;j y� y � �,+ � � � � l{z � � v �o�b� �9j?��� �`� j y�y j y J-!_R$#$#.# RSJ/% �¢�dfehgji�kQlmk`nMi!oqpsrqp10��3254768�:9<;>=�n@? � nMiA�����|�|e7i l�B)�|p�u v l*k�k"x�y{z|y�� j{}C� l j y v ��� � l~�¢� }Yj �9�D�O~=�R_BJ[ x�kmlf� � �7�¢� � � jE� � yD��k��\�{�ol�l j �9�`��zF� j l�kF����k � � j�� � jf� xx� �9j l j � y � y �Y} �7� � � kmlE� x�kml� �Y� v l*k h��vh�� � � y�� � � v k���z���k }�� � � � � �Y}Yju�h�¢�;j lSy � l �Dj yG���+x�kml � �Y� ����x�kml(� � y � �9� j l � ��� � k�� ��� � � � �9j��k }Ev kmy j��.v l*k �;j l = > k�� � � v �B� I"!{R$#$#$# R�I&%5'H�C� l j y v ��� � �9j l j � �9j ��k }Ev kmy j��.v l*k �;j l = >� ��y�k�l j � j{�Y�;j y � y � �,+ � � � � l_z � � v �o�#� �9j?��� �`� j y�y j y J-!_R$#.#$# RSJ/% �¢�

$N'�)98;H�1W+�+�% H<),@yE%�'*)08K'�34\'*),+�H<+'&Eb@�%,@;'*34@�%0H�8;:I+x%0@�%BMD'*:<3Xdo3q8;2"O 3 ^ +K^4Cf34\]%0@K'�8;262b2q8;%BMZ�/98KZ�+�H.\P@�:.E),365�) ��+�:I@KM&pT%0@�E24+�A0Z�+x-,:<@o@;\PH�+�gB36HU'�8;:<+34%JI�;1;b[�C�'*)0+?%�'*)0+?H<+'&EG@�%0@;'<36@�%0H8;:I+�A,36HI'<36%05�'�^>zs)036H�\P@�2426@�EHL\P:<@�= '*)0+�\ 8;5?'u'<)98K'�C � 8;%0+�'<'<3#+�'.8K2D^f� �GK ;#�]�,���#HI)0@�EG+?A�'*)98m'8K'"26+�8KHI'u8Y24@�Zv8;:I34'<)0=>345�%T/0=.1W+�:L@;\f:I@�/0%0A,H�36H":I+.LT/034:<+�A('<@8;5�)034+?d�+�1,2q8;5�p�M&1W@�g�5�@�%05?/0:<:I+�%v'��+?:<@xpT%0@�E26+?A0Z�+KC~E)03624+�In8;:<8;p��MIn8K:*�,����H<),@yEb+�Ai'*)08K'L%0@;%BM&10268;5�p�M&1W@�g(5?@�%05�/,:<:<+?%v'�N K 5�8;%1W+J8K5�)036+�d�+�A�36%x5?@�%0HI'*8;%v'":I@�/0%0A,H�^

$&%J'<)0+f5�@�=�=>@;%7:<8;%0A0@;= HI'<:<36%,Z.O � � � [~=�@BA,+�2DC ��k�� �Z� �9� j l � ��� �Y�;j���+?:<@]po%,@yE24+�A0Z;+b-0:I@B@K\PH8;:I+J-W@�H<HI361024+�\P@�:"8K%TRS268;%0Z�/98KZ�+�36%FOE; �PIn��QW;BR,��CM:TS � RURy�sO 8;H<HI/0=�36%0Z�5�+?:I'*3Xe9+�AS'*:<8;-QA,@B@�:-W+�:<=!/,'�8K'<36@�%,H.V0'*),36Hc8;H<HI/0=>-B'*36@;%SEG8;H]2q8K'<+�::<+?A0/05�+?A�'*@�'*:<8;-QA,@B@�:s-W+�:I=./,'*8K'*34@�%0HJ�MIBW�R � �q[�^Oc@;%BM&34%T'<+�:<8;5?'<34d�+���+?:<@KMNpT%0@�E26+�A,Z�+V-0:I@B@;\PH!8;:<+�5�@;%05�/0:I:<+?%T'<24Ra5�@�=�-W@�H*8;1,26+�H<36=�-02XRi1Q+?5�8;/0HI+'*),+?R�8;:I+�H<+.LT/0+?%v'*3q8K2624R(5�@�=�-Q@;H*8;1024+;^��]@�EG+�d�+�:?C�Z�+?%0+�:<8;2�%0@�%BMN36%v'*+?:*8;5�'*3Xd�+���+?:<@SpT%0@�E26+�A,Z�+-0:I@B@;\PH75�8K%�1W+�LT/034'<+>34%0+YX�5?36+�%v'�C`H<34%05�+�'*),+Y1W+�HI'!pT%0@�E '*+�5�),%03ZLT/0+?H!'*@�5�8;:I:IR�@�%0+�@�/,'J:<+�MLT/036:I+!Z�@;36%0Z�'*)0:I@�/0Z�)�'*)0+ � @B@�p�M[S|+�do36%�'<)0+�@;:<+�=S^]zs)0+�:I+?\P@�:I+;C�34%v'*+�:<8;5?'<34d;+!��+?:<@KMNpT%0@�E26+�A,Z�+-0:I@;'*@o5�@�24H]8;:<+78;24H<@�@;\�34%T'<+�:I+�HI'c36%'*),+ � � � 8;%,A�5?@�=>=�@�%SH<+�'*/0-�=>@oA0+�24H�C9HI@Y26@;%0Z�8;H]'<)0+?R8;:I+7=�@�:I+L+YX�5�34+�%v'�^dfehgji�kQlmk`nMi!oqpsrqp�\]�3254768�:9<;>=�n@? � nMiA�����|�|e7i l�B k`i l � e^� nM��PnMi�_Ve�l`�Aa �Pn"b�e@4c�|pu v l*k�k"x y{zmy�� j{} O~=�R_B![1� y h � � �d� �Uh kY+���k��\�{�ol�l j �9�`��z?��k }Ev kmy �vh � jj� ��� �9j ��k }�} k��?y j �~� v.} k �oj �� xu� �9j l j!j + � y��1y �Y} �7� � � kmlSy-� ! �e�gf?y{�K� � � �,� �

h � !U� y�� �9j y �Y} �7� � �&kml�x�kml�� �9j � j � j l � � � k�� k"x�� �9j ��k }�} k�� y j �`� v � L �]� � � j y � y � � v �B�� �9j y j �{�Bl � �`z v,� l �¢}Yj � j l �$i � � � � k��B� v �B�YyY� �9j y j �`� v y�� l � �7� � � � � � y�k }YjY� �,+ � � � � l{z� � x�kml }�� � � k��jM��k j �e� !?O �$i�[mlC�oj ��km� j � �9jE� � v,� l��sk"xu� �9j k��B� v �B�k"x�� ! �

h]n kml � �Y� �h�¢�;j l�y � l �Dj yo� � �,� � � ��� � y h km� �(�H�;j l � �nj l � � �x� y7� �9jqp k��o�Qy �`�ojsr � �,� � y{� vM�v � �Dj y>� �9j<� �+y�� � �\� j y>� k�� �9j?v l*k�k"x.y{zmy�� j{} � O �ut vOU� i [{R8w L>x5y{zGO � O}|;[�~ =?>�[<[���O � O � i [�l_R�w L>x�y{znO � O}|;[g�t �gf O j [<[I[ � � �9j l j�vOU� i [E�oj ��km� j y� �9j�� � �okml � � �7} � �,� �7�#k�� � � �v �o� � i �nk��o� v �o�Yy!� �9j y j �`� vfv,� l �¢}Yj � j l�yjx�kml7� �9j�v l*k�k"xEy{zmy�� j{} O`=2R�B![ �

��8;=�Z�88;:<A�H<)0@�Eb+�A�),@yE '*@x'<:*8;%0HU\P@�:<= 8VH<-W+�5?3q8;2e�98�d;@�:�@;\b8x��+?:<@KMNpo%,@yE24+�A0Z;+�-,:<@o@;\f@;\pT%0@�E26+?A0Z�+;Cf%98K=>+?24R�Ct'*)0+ 9#MN-0:<@K'*@o5�@�2#36%v'*@(8�102q8K5�pvMN1Q@�g�5�@�%,5�/0:I:<+�%v'<24Ra5�@�=�-Q@;H*8;1024+Y�?+�:<@mMpT%0@�E26+?A0Z�+u8;:IZ�/0=�+�%v's@;\|pT%0@�E26+?A0Z�+�34%V'*)034Hn=>@oA0+?2Q/0HI36%0Z.'<:*8;-WA0@o@�:G5?@�=�=>3X'*=�+�%v'*H?^��c+?:<+KCEb+!:<+?5�8;242})036H:I+�H</,24'�^G$&%�'*),+JHI+.LT/0+�2 CWEb+uE36262�Z�34d;+�9#MN-0:<@;'<@B5?@�26Hs\P@�:s'<)0+J268;%0Z�/08;Z�+�HsEb+7E34262%0+?+�A(8�5?@�%05�/,:<:<+?%v'"�?+�:<@mM&pT%0@�E26+?A0Z�+u-0:<@o@;\PHs\P@�:?^

�U�

Page 39: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

r 9#MN-0:<@;'<@B5?@�2#36HJ8S'*),:<+�+�M&:I@�/0%0A�-0:I@B@K\s@;\spT%0@�E26+?A0Z�+V-,:<@;'<@B5?@�2�E)0+�:I+V36%�'*)0+VHI+�5?@�%0A:<@;/0%0A~Cc8;262]'*)98m'V'*)0+(d;+�:I34e9+?:x%0+�+?A0Hx'*@�A0@�36HY:<+?d;+�8;2�3X'*HV:<8;%0A0@;= 5?@�36%0HYVu34'*HYH<+�5?/0:<3X'&R 34H@�%02XR 8;Zv8;34%0HI'Y8ad;+�:<3Xe9+�:�E)0@�5�)0@o@�H<+?HV)034HY5�@;36%0H>8;A,d;+�:<H<8;:<368;262XR�^ r"2X'*)0@;/0Z�) +�g08K=>-024+�H�@;\H</,5�)�-0:I@;'*@o5�@;26HbEb+�:I+upo%,@yE%S-0:I36@�:#'*@�)034HnEG@�:IpFC,'*)0+L'<+�:I= 9#M&-,:<@;'<@B5?@�2QEG8;Hs36%v'<:<@oA0/05�+?A1TR� :*8K=>+?:�� � :*8UR ¦ �D^�zs)0+":<+�8KH<@�%V'<)98K'n),+"5�8K2626+?A>'<)0+�HI+�-0:<@;'<@B5?@�26H�9#M&-,:<@;'<@B5?@�2Q34Hb'<)0+"HI)98;-W+L@;\'*),+L26+�'<'*+?:�9"^�zs)0+"A0+?e9%,34'*34@�%YEb+LZ�3Xd�+L)0+?:<+L34HGHI2636Z;)T'<24R�24+�HIHn:<+?HI'*:I365�'*34d;+"'*)08;%Y'*),+L@�%0+LZ;34d�+?%1vR � :<8;=�+�:b8;%0AV1vRY��8;=>Z�88;:<A�����8K=Y�����Q36%>'<)98K'#EG+"A0@.%0@;'b:<+YLT/036:I+"pT%0@�E26+?A0Z�+L+�gB'<:*8;5�'*34@�%'*@�1W+78;H+YX�5�34+�%v'c8;Hs'*)0+�RxA0@0^dfehgji�kQlmk`nMi!oqpsrqp����S9�;��C�|n�lmn � n<4c�|p k j � O`=�R_BJ[Yh�jY� � � l j�j{� l*k��£� �.v l*k�k"x�y{zmy�� j{} x�kml.� � � ��¢� � � j � � � �9j l jaB-� y � ����k � � j�� � j��;j l � �nj l ��� � � l j y v9j ���f�&kH� � �7�¢� � � j�� ���K� vhv kmy jJO~=�R_BJ[y�� � l��Yy ��� � ���H}Yj y�y � � j x�l�k }'= �&k B � � � �H� �9j l jEB � y�k�����z }Yj y�y � � j � k = ��k��+y � y��Qy�k"x � �Yyl � � � k } ��k � �+y�� k j �(� h�jV�Hv l�k h��vh�� � � y�� � � v k���z���k }�� � � � � �Y}YjY�h�¢�;j lSy � l_z(� �,� �7k�� � � v �o� I �� � k�kmy j yJ� �9j l � � � k } ��k � �+y x�kml �;j l � �nj l B ��2z B z ��� j ���hy �oj ��km� j � �9j l j y{�£� � � �7� �;j l � �nj lV�O~=�R_BJ[A� y � 9E� v l�km�&km��k�� � x�� �9j l jSj + � y��Qy � y �Y} �£� � �&kml��¡y{��� � � �,� ��x�kml � �Y� ��� � � � x�kml � �Y�I^'^� �"� y �Y} �7� � � j y]� �9j��m�Dj{� k"x B z x�kml]� �9j�� �9� j l � ��� � k�� ��� � �%v l�k �;j l = k�� � � v �o� I � � �9j l j� �9j%¤ l*k �;j lul j � j{�Y�;j y�� �9j!� � + � � � � l_z � � v �B� J � �,� � � yu� �9j?��� �`� j y�y�x�kml I^'^� �

��8;=�Z�88;:<A�'*+?5�)0%03ZLT/0+Y36H.8KHJ\P@�2426@�EH�w!'<)0+Y5?@�=�=>@�%aH<+�'*/0-�-0:I@BA,/05�+?H�8�'*:<8;-WA0@B@;:J5?@�=�M=�34'*=�+�%v'spK+?RD¤��^fzs)0+C9#M&-0:I@;'*@o5�@;2~36Hn'<)0+�%�=>@oA034e0+�A8;Hs\P@�2426@�EH�w

��^�S}+?'a]F!s1W+u'*)0+J-0:<@�d�+?:�=�� He9:IHI'c=>+?H<H*8KZ�+;^s$&%0HU'*+�8;A(@;\`H<+�%,A036%0ZA]F!�C9'*)0+7-0:<@�d;+�:cE34262HI+�%0A � �������������~OZ¤�RS]F!{R3|�[b\P@�:s:<8;%0A0@;= |o^

�B^zs)0+cd�+�:I34e9+?:GHI+�%0A0H���'*)98K'b36H#'*)0+c5�@�%v'<+�%v'*Hn@K\}34'<Hb:<8;%0A0@�= '*8;-Q+KC,8KHG36Hb-0:<+?H<5?:<361W+�AY1TR'<)0+C9#M&-0:I@;'*@o5�@�2 ^

� ^zs)0+�-,:<@�d�+?:7HI+�%0A,H |oC�'<)0+�:I+�1vR�:<+�d�+�8;2634%0ZV)034H"e9:<HU'u=>+?H<H<8;Z�+�]F!�^7�c+�8;24H<@V5?@�=�-0/,'*+?H8;%,A�HI+�%0A0H'*),+7-,:<@�d�+?:E=�� Hs:I+�HI-Q@�%,H<+u'*@�'*)0+u=�+�HIH*8;Z�+�� \P:<@�= '*)0+�d�+?:<3Xe9+�:?^

b ^zs)0+Vd;+�:I34e9+?:.5�)0+�5�pTH�'*)08K'�� �������������}OZ¤�RS]F!{R>|;[J8K%0A�/0HI+�H.d�+?:<3Xe9+�:.B @;%�:*8;%BMA0@;=>%0+?H<H�� '<@�d�+�:I34\ Rx-,:<@�d�+?:���Hc=�+�HIH*8;Z�+?H.OQ]F!{RS] f [�^

S}+?']/0H5�8;2426+?A'<)0+u-0:<@o@;\tHIRoHU'*+�= '<)o/,Hc=�@BA,34e9+?A�O~=! R_B! [�^"1e£�P� 6 o psrqpsoqp?L x O~=�R_B7[?� y �%v l�k�k"x.k"x ����k � � j�� � j x�kml%� � �7�¢� � � jo� �#� �9j �Wy�k � y O`= R_B [ �¤ l*k�k"xV� O � p;+?'<5�)F[szs)0+�5�@�=�-024+?'*+?%0+�HIHs-0:<@;-Q+?:I'&RV34Hn5�24+�8;:?^�zs)0+�pT%0@�E26+?A0Z�+�+�go'<:*8;5�'*36@;%x-0:<@�-oM+�:U'&R�)0@�26A,H71W+�5�8;/0HI+YH</,-0-Q@;H<+>'<)98K'u'*),+>HI@�/0%0A0%,+�H<H!@;\G'<)0+>-,:<@o@;\nHURBHU'*+?=�Z;@;'uEG@�:IH<+>1TR ¥�^S}+?'>/0H�H<)0@�E '<)98K'�'*)034H�5?@�%v'*:<8;A0365�'*H�+�3X'*)0+?:�'<)0+Spo%,@yE24+�A0Z;+�+�gB'<:*8;5�'*34@�% -,:<@�-W+�:U'&R @K\"'*),+-0:I@B@;\�HIRoHI'<+�= O~=�R_B![�CQ@;:]'<)0+J1,36%0A034%0Z�-0:<@�-W+�:U'&R�@K\�'*)0+75�@;=>=�34'<=>+?%T'�^ S}+?'"/0Hc'<:IRx'*@�e9:<HU'5�@;%T'<:*8;A,365?'J'*)0+Ypo%,@yE24+�A0Z;+V+�go'*:<8;5?'<36@�%�-0:<@�-W+�:U'&R�^(_a+>E34262f36%v'*+?:*8;5�'.E34'<)�'*),+V8;A,d;+�:IH*8;:UR8;Hu\P@�2624@�EH�wu$&%a'<)0+�e0:<HI'!HI'<+�-~Ct'*)0+>8;A,d;+�:<H<8;:IR�HI+�%0A0H!/0H7'<)0+�=>+?H<H*8KZ�+#� ^x$&% � '<+�-$�oCtEb+E36242�H<+?%0A�)034=�:*8;%,A0@�=�%0+�HIH�C�8;%,A�@�1,'*8;36%i'*),+>:I+�H<-W@�%0HI+;^x_a+>E36242�:<+?-Q+�8K'!'<)036HuHU'*+�-�/0%v'*362'*),+L-0:<@�d;+�:s36%,A0/05�+?Hn/0HG'<@�8;5�5?+�-,'uO +�8K5�)'<36=�+]'<)036H#E36242W)08;-0-W+�%xE34'<)V-0:<@;198;10342634'&RU�&%P¥�C0HI@'*),36HuHI'<+�-�=./,HI'J1Q+�:<+?-Q+�8K'*+?A���'¢¥u'*34=>+?H�^ [ � @EG+>)98�d�+Y5?:<+�8K'*+?A�8;%a8;5�5?+�-,'<36%0ZS'*:*8K%0H<5?:<36-B'E34'<)�36%03X'*3q8K2#=�+�HIH*8;Z;+(� CbE3X'*)�'*),+d;+�:I34e9+?:���H�:<8;%0A0@;=>%0+?H<H?Cb24+?'�/0H�5�8;262n3X')� !�^ Oc@�E Eb+

� R

Page 40: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

:<+�E36%0AS)034= '*@ � '*+?- ��8;%0AS@�1,'*8;36%S8;%0@K'*)0+?:c8K5�5�+?-,'*34%0Z>'<:*8;%,H<5�:I36-,'E3X'*)=>+?H<H<8;Z�+ � C9'*)034H'*34=>+cE34'*)SA03 � +?:<+�%v']:*8K%0A0@�=�%0+�HIH � f ^ � /0-0-W@�H<+�'*)08K''*)0+u-0:I@�198;1034263X'&R>'<)98K']36%x'*),36HsH<@;:I']@;\+�gB-W+�:I36=�+�%v'�C|1W@;'*)�'*34=>+?H�C~'<)0+�H*8;=�+.dK8;26/0+�]F!"5�@;:<:<+?H<-W@�%0A034%0Z'*@ � 34H�:<+�d�+�8K26+�A�C�34H���' �B^� 34%05�+ � f EG8;H�5�)0@�H<+?%�36%0A,+�-W+�%0A0+?%v'*24R @;\ � !�Cn8K%0A�3X'�'<@B@;p���'¢¥�'<:<34+�H�36% +�gB-W+�5?'*8K'*34@�% '<@e9%0A�34'�C}8;%0A�'<)0+�-0:<@�108;10362434'&R'*)08K'u34'LEG8;H�\P@�/0%,A�34H.��' �oC}34'L\P@�2426@�EH"'<)98K'�\P@�:%¥ ' �Y\P:*8;5�'*36@;%@;\G-Q@�HIH<341026+ �.� H?C�'<)0+>-,:<@�d�+?:JEb@�/026AaH<+?%0A�8�=�+�HIH*8;Z;+>34% � '<+�- � 36%,A0/05�34%0Z'*)0+�d�+�:I34e9+?:7'<@8;5?5�+�-B'�^Gzs),+�%�'<)0+upT%0@�E26+�A,Z�+J+?:<:I@�:@;\`'<)0+u@�:<34Z�36%98K2�-0:I@B@;\�HIRoHU'*+�=�34H8K']26+�8KHI'a¥ ' �Bw�'<)036Hs34H1W+�5�8K/0H<+34\9'<)0+s36%,34'*368;2T=>+?H<H<8;Z�+s@;\ ;�:<@�d�+?:1= 34Hj]F!�C�'*)0+?%�34'`'</0:<%,H�@�/,'�'*)08K'�\P@�:�¥ ' �yMN\P:<8;5?'<36@�%@;\|'*),+�-Q@�HIH<341026+ �.� H?C0'*)0+?:<+�36HG8.=>+?H<H<8;Z�+%] f '*)98m's36%0A,/05�+?H�B '*@�8;5?5�+�-B'�^ � @�H</0-,-Q@�HI+L'*)98m'E34'<)(-0:I@�198;1034263X'&Rx=>@;:<+u'*)98K'!��' �BCW'*)0+!8;A,d;+�:<H<8;:IR�Z�34d;+�H�8�A03 � +�:I+�%v'%]F!c8;Hc5�@�:I:<+?H<-W@�%0A034%0Z'*@�5?@�=>=�34'<=>+?%v'�� ^fzs)0+�%SEG+u)98�d;+J10:I@�p;+?%�'<)0+u5�@�=�=>3X'*=�+�%v'nHI5�)0+�=�+;^"1e£�P� 6 o psrqp10qp�O~=! R_B! X[�� y���k��\�{�ol�l j �9� h � � �d� �Uh kY+ � j l*k � ����k � � j�� � jjv l*k�k"xLk"xG����k � � j�� � j2� �� �9j!� � + � � � � l_z�y�� l � �7� } k �oj � �¤ l*k�k"xV� O � p;+?'<5�)F[trcH}\P@�:~'*)0+�-,:<@o@;\,@K\,pT%0@�E26+?A0Z�+f-98;:U'�Cy34'|34H~'�8;pK+�%75�8;:I+f@;\,1vRL'<)0+�@;:<+�= �B^��o^4��^Oc@�E 26+�'L/0HcH<)0@�E '*)0+J��+�:I@KM&pT%0@�E24+�A0Z�+!-0:<@�-W+�:U'&R�^Lzs),+�H<36=!/02q8K'<@�:sE36242�8K5?'�8KHc\P@�2426@�EH�w

$&%�'<)0+.5�@;=>=�@�%�HI+?'</0-�-0)98;HI+;C~3X'cE34262|:</,%)v� ~@;\�'<)0+!'<:*8;-WA0@o@�:c5?@�=�=>3X'*=�+�%v'H<5�)0+?=>+�8K%0A@�1,'*8;36%x%,@;']@�%024RV8�5�@�=�=>3X'*=�+�%v's-0/,1026345Lp;+�RD¤&�C01,/,'c8;26HI@�'<)0+�'*:<8;-QA,@B@�:A���i^

zs)0+�%�34'sE34262�:I/0%'*)0+�\P@�2426@�E36%0Z!5�@oA0+L\P@�:+�8;5�)S36%v'<+�:*8K5?'*34@�%VE34'<)Sd;+�:I34e9+?:EB?>�w

��^ � @�=�-0/,'<+78;%S8;:<103X'*:<8;:IRH]# ! 8;%,A�:<8;%0A0@�= |BCF8K%0A26+?'�� � ������� ���}OZ¤�RS]# ! R>|;[�^�B^]�+�5?+�34d;+�'*)0+�dK8;26/,+ �.^� ^]�/0% � C0'<)0+7H<36=!/02q8K'<@�:n@;\�'*)0+C9#MN-0:<@;'<@B5?@�2#O~=�R_BJ[�C0'<@>@�1B'�8;34%�8�'*:<8;%0HI5�:<34-,'!O`]F!{RS] f [\P@�:u:<8;%0A0@�=�%0+?H<H �.^Yr"24'<+�: � '<@�1W+Y8S5�@�=�=�34'*=�+�%v'�'<@c]F!78K%0A�HI+�%0A�'<)036H�'<@�'*),+d;+�:<3Xe9+�:?^

Oc@;'<+n'*)98m'�'*)034H�H<34=./0268K'*34@�%!5�8;%�1Q+n5�8;:<:I36+?A�@�/,'f5�@;%05�/0:I:<+?%T'<24R!1Q+?5�8;/0HI+34'�A0@o+�H�%,@;'�%0+?+�A8;%vRx:I+?E36%,A036%0Z�@;\t'*),+ud;+�:I34e9+?:�^

�L/0+n'*@�'<)0+n'*:<8;-QA,@B@�:`-0:<@�-W+�:U'&R�@;\F'*),+s5�@�=�=>3X'*=�+�%v'�HI5�)0+�=�+;CT'*),+s:<+�HI/024'<36%0Z�HI36=./,2q8K'<36@�%E36242�1W+u36%0A034HI'<36%0Z�/,36H<)08;1026+]\P:<@�= '*)0+u34%T'<+�:<8;5?'<36@�%xE34'<)x'*)0+u-0:I@yd;+�:?^

b �

Page 41: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ����

� � ���� � �� � � ����� � � ������� � � � ��� �

r"Hs34%,\P@�:I=Y8K'<36@�%�1W+�5�@;=>+?Hn36%05?:<+�8;H<34%0Z�24R>8;5?5�+?H<H<341026+KC0-0:I@;'*+?5?'*34%0Z.'*),+L-0:<3XdK8;5?R>@;\t36%0A,34do36A0/08;26H1W+�5�@;=>+?H#=�@�:I+n5�)98;2426+�%,Z�36%0Z,^�zt@uH<@�2Xd�+s'*)034H�-0:<@;1026+?=�Cv8K%>8K-0-026345�8K'<36@�%7'*)98m'#8;2624@yEH�'*)0+36%,A03XMdo36A0/08;20'*@u5�@;%T'<:<@�20'<)0+A036HIH<+?=>34%98K'*34@�%�@;\Q-Q+?:<HI@�%98;2934%,\P@�:<=>8K'<36@�%.34H�%0+�+?A0+�A�^#rc%Y8K%0@�%vRo=>@�/,H5�:I+�A0+?%v'*3q8K2tHURoHI'*+?=�O 8;24H<@�5�8;2426+?AS-,H<+�/,A0@�%vRo= HURoHI'*+?=V[�CQ34%v'*:<@oA0/05?+�AS1vR � )98;/0=�� � )98 � �y�DC934H'*),+71W+�HU']po%,@yE%�36A0+�8.\P@�:sH</05�)�8�HIRoHI'<+�=S^

r"%�8;%0@�%vRo=>@;/0HJ5?:<+?A0+�%v'*368;2�HIRoHU'*+�= � � )98 � �BC ��� �h¦ C � ),+$R �BCt��8;= R��TC S|� � _HR RK�f5�@�%oMH<34HI'<H"@;\�/,H<+�:IHL8;%,A(@�:<Z�8;%036��8K'*34@�%0H?^��L:<Zv8;%,36��8m'*36@;%0HspT%0@�E '*)0+J/0H<+?:<HL@�%,24R1vRS-0H<+?/0A0@�%vRo=>H?^�L3 � +�:I+�%v'�-0HI+�/0A,@�%vRB=�H7@;\b'<)0+�H*8K=>+�/0HI+�:�5�8;%0%0@;'u1W+�2634%0p;+?A�+?d�+?%�3X\#8;262�@;\f'*)0+�@�:IZv8;%034��8mM'*34@�%0H�5?@B@�-W+�:<8K'*+K^ W#+?'�CG8;%�@�:IZv8;%034��8K'<36@�%�5�8;% 36HIH</0+S8�5�:I+�A0+?%T'<3q8;2n'<@�8i-,H<+�/,A0@�%vRo=�Cs8K%0A'*),+]5?@�:<:I+�HI-Q@�%,A036%0Zu/0HI+�:f5�8K%�-,:<@�d�+]-Q@;H<H<+?H<HI36@�%�@;\W'*)034H�5�:I+�A0+?%T'<3q8;20'<@78;%0@;'<)0+�:�@�:IZv8;%034��8K'<36@�%OPE),@�pT%0@�EH�)0+?:�1vR�8(A03 � +?:<+�%v'�-0HI+�/0A,@�%vRB=Y[�CfE34'<)0@�/,'.:<+?d;+�8;2436%0Z(8;%vRo'<)036%,Z�=>@�:I+Y'*)08;%'*),+u\ 8K5?'s'*)08K'H<)0+u@�E%0HH</,5�)(8�5�:I+�A0+?%T'<3q8;2 ^ � :<+?A0+�%v'*368;26Hs5�8;%S1Q+L\P@�:s/,%02634=>3X'*+�AY/0H<+>OP'<)0+�HI+8;:I+75�8;2624+�A } �7� � ��v � j{� y � k �i5�:I+�A0+?%v'*3q8K26H�[s8;%,AS\P@�:@�%,+�MN'<36=�+L/0HI+VO '*)0+?H<+J8;:<+u5�8K2626+?A k�� j{� y � k �5�:I+�A0+?%v'*3q8K26H�[�^1;�@�HIH<+?H<H<34@�%S@;\t8.=./02X'*3XMNH<)0@�E 5?:<+�A,+�%v'*368;2�5�8;%x1Q+�A,+�=�@�%0HI'<:*8K'<+�A8;%8K:<103X'*:*8K:IR%T/0=.1W+�:@;\t'*34=>+?H.V,'<)0+�HI+JA0+?=>@;%0HI'<:*8K'<36@�%0Hs5�8;%0%0@K'1Q+u2634%0p;+?Ax'*@�+�8;5�)S@;'*),+�:�^2�68_ k}��b�e@_ k`��6 =�4Qe a �|n�a�e��|lmk`e@_¢p $N'�H<)0@;/026A 1Q+34=>-W@�H<HI361024+Y'*@i\P@�:IZ�+S8�5?:<+�A,+�%v'*368;2s\P@�:�8/0HI+�:�CB+?d;+�%V3X\~/0HI+�:<Hn8;%0AY@K'*)0+?:b@�:IZv8;%034��8K'<36@�%,H�'*+�8K= /0-V8;%,AV2q8;/,%05�)V8;%Y8;A98;-B'*34d;+"8m'<'�8K5�p�@�%'*),+!@�:IZv8;%034��8K'<36@�%~^ � 8;5�)(-,H<+�/,A0@�%vRo= 8;%0A(5?:<+?A0+�%v'*368;2t=./0HI'"1Q+?26@�%,Z>'*@YH<@�=�+JEb+�242XM&A,+?e9%0+?A/0HI+�:��PS|� � _HRURK� ^�$&%V-98;:U'*345�/0268;:�Cv3X'bHI)0@�/024AY%0@K'G1W+c-W@�HIH<361,26+\P@�:fA03 � +�:I+�%v'n/0HI+�:IHb'*@7'*+�8;= /0-8;%0AYH<)0@�E H<@�=�+"@K\}'*)0+?36:#5�:<+?A0+�%v'<3q8;24Hb'*@.8;%V@�:IZv8;%034��8K'<36@�%>8;%0AV@;1,'�8;34%V8!5?:<+?A0+�%v'*368;2F\P@�:G@�%,+@;\9'<)0+�= '*)98m'`'*),36H`/,H<+�:�8;26@�%,+bEb@�/026A!%0@;'�)98�d;+nZ�@;'I'*+�%�^ � RoHI'<+�=�H�E)0+�:I+G'*),36H`34H`%0@K'�-Q@;H<H<341026+8;:I+cH<8;36A�'*@J)98�d�+ ��k��+y � y�� j �\�{z�k"x?��l j��oj �9� � � ��y ^`r"H#@�:IZv8;%034��8K'<36@�%0Hf8K:<+c8;/,'*@;%0@�=�@�/0Hf+�%v'*3X'*34+�H�C34'f34H�A0+�HI36:<8;1026+s'<)98K'f'*)0+�R�1W+cHI+�-98;:<8;1024+;CT3D^�+;^XCv1Q+]8;1,26+s'*@u5�)0@o@�H<+'*),+�36:fpK+?RoHb'<)0+�=�H<+?24d�+?HG8K%0A36%,A0+�-W+�%0A,+�%v'*2XRi@;\n@;'<)0+�:u+?%T'<34'<36+�H?C|H<@�8;H7'<@�+?%0H</,:<+�H<+�5?/0:<3X'&Ri@;\G'<)0+�HI+>pK+?RoH�8;%,A�\ 8;5?362434'�8m'*+'*),+7HURoHI'*+?=���H]p;+?R=>8;%98KZ�+�=�+�%v'�^

zs)0+H<5�)0+?=>+HI)0@�/024A�8;26HI@(-0:<@�do36A,+x/0H<+?:�-,:<34dK8;5�R�^�r"%�@�:IZv8;%034��8K'<36@�%a5�8;%,%0@;'�e9%0A�@�/B'8;%vRT'*)034%0Z�8;1W@�/,'n8!/0HI+�:�C08;-98;:U'b\P:I@�= '*)0+"\ 8K5?'n@K\}'*)0+c/0H<+?:���Hs@yE%,+�:<HI)036-x@K\|H<@�=�+"HI+?'s@;\|5?:<+�MA0+?%T'<3q8;24H�Cm+?d;+�%.3X\,3X'�5?@B@;-Q+?:*8K'<+�H}E34'<)J@;'<)0+�:t@�:IZv8;%034��8K'<36@�%0H?^|$&%J-98K:I'*345�/0268;:�C�'&Eb@"-0HI+�/0A,@�%vRB=�H1W+�26@;%0Z�36%,ZV'*@x'*)0+�H<8;=>+�/0HI+�:u5�8K%0%0@;'71W+�2436%0pK+�A��MIb:*8URURoC � )98 � �oC ��� �h¦ C � )0+$R �BC|��8;= R��oCS|� � _HRURK� ^

:`36%08;262XR�C}34'734H7A,+�H<34:*8;1,26+�'*)98K'u'<)0+>HURoHI'*+?=�1W+�+YX�5�34+�%v'�^uIG+?H<36A,+�H7:<+.LT/034:<34%0ZS'<)98K'J34'71W+

b �

Page 42: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

198;HI+�Ai@�%(+ X�5�36+?%v'u-0:<@;'<@B5?@�26H?CQEb+�8;26HI@Y:I+.LT/036:I+.'*)98m'L+�8K5�)�34%v'*+�:<8;5?'<36@�%�36%vd�@;24d�+�8KH"\P+?E +�%oM'*3X'*34+�HV8KHV-Q@;H<H<341026+KC8;%0A '<)0+(:<@;/0%0A0H8;%,A 8;=>@;/0%v'V@;\u5?@�=>=!/0%0365�8K'*34@�%�1W+(=�36%034=Y8K2D^ $&%-98;:U'*345�/0268;:�C�3X\}8u/0H<+?:b)08;H#87=./,24'*34-026+�M&HI)0@�E�5?:<+�A,+�%v'*368;29\P:<@�={HI@�=�+]@;:<Zv8;%,36��8m'*36@;%~C�H<),+c@�/,Z�)v''*@1W+�8;1026+.'<@A0+�=�@�%0HU'*:*8m'*+�34'�E3X'*)0@;/,'uZ�+?'I'*34%0ZV'*)0+�@�:IZv8;%034��8K'<36@�%�'*@S:<+�34H<HI/0+�5�:<+?A0+�%v'<3q8;24H+�8K5�)S'<36=�+;^

� bAb kYl|kQn i 684Gb�e@_ kQ�:6&=e4Qe)a �|n�a�e��ml|k`e@_¢p�$N'c36Hc8;%�36=�-Q@�:U'�8;%v'c8;A0A,34'*34@�%98;2�:<+.LT/034:<+?=>+?%T'c'*)98m''*),+�/0H<+?:<H]H<)0@�/,26A1Q+�A,36H<5?@�/0:<8;Z�+�Ax\P:I@�= HI)98;:<34%0Z�'*)0+?36:n-,H<+�/,A0@�%vRo=>Hc8;%0A5�:I+�A0+?%v'*3q8K26HnE34'<)@;'<)0+�:s/0HI+�:IH�^ �L%0+LEn8�Rx@K\�A,@�36%0Z!34's34Hn1vRV+�%,H</0:I36%0Z�'*)08K'sH<)08;:<34%0Z�8.5�:I+�A0+?%T'<3q8;2�36=�-02634+�Hb8;26HI@H<)08;:<34%0Z�8!-98K:I'*345�/0268;:�CvdK8;24/98;1024+cHI+�5�:I+?'spK+?R>\P:<@�= k��o�Qy �`�oj"'*)0+LHURoHI'*+?= OP+;^�Z0^4Co'*)0+"H<+�5?:<+�'sp;+�R'*)08K'Z�34d;+�H]8;5?5�+�HIHc'<@�'<)0+u/0H<+?:���Hc108;%0px8;5?5�@�/,%T'�[u��� S O-R � C���;#��R � C St� � _HRURm�D^

$&%�8;A0A,34'*34@�%~Cy34'�=>8�Ru1W+#A0+�HI36:*8K1026+f'*@c)98�d�+s8]=>+?5�)98;%034H<= \P@�:tA036HI5�@�d�+?:<34%0Z"'*),+b34A0+�%v'*3X'&Ru@;\8J/,H<+�:bE)0@�H<+c'*:*8K%0H*8;5�'*34@�%0Hb8;:<+c362624+�Zv8K2}OP'<)036H#\P+�8K'</0:<+KCB5�8;2624+�A �¢�6k h�� � � ��k���z }�� �`z.l j{� km� � � � k�� C36HJ@�-,'<36@�%98K2 [ V�@�:!:I+?d;+�8;2G8�/0H<+?:���H.-0HI+�/0A0@;%TRo= E3X'*)�8;%�36HIH</034%0Z(@�:IZv8;%034��8K'<36@�%i34%�5�8;HI+Y'*),+/0HI+�:�=>34H</0HI+�H�)0+�:�5?:<+�A,+�%v'*368;2JOP'*),36H.\P+�8m'*/0:I+;CG5�8;2624+�A �6km� � � � ��k���z }�� �~zil j{� km� � � � k�� C#34H�8;26HI@@�-,'<36@�%08;2 [�^�$N'f5�8;%Y8K26H<@u1W+1Q+?%0+?e95?3q8;20'<@!8K2626@�E k�� j{� y � k �5�:I+�A0+?%T'<3q8;24H�CT3D^�+;^XCv5�:I+�A0+?%v'*3q8K26H�'*)98m'H<),@�/026A�@�%024R1W+!/,H*8;1024+J@;%05�+�8K%0A�HI)0@�/024A(36%05?@�:<-W@�:<8K'*+J8;% k�� � � � � jJA0@;/01026+�M&HI-Q+?%0A036%,Z>'*+?HI'�^$N'bH<)0@�/,26AV1W+c-W@�HIH<361,26+'*@!+?%05�@oA0+"8K'<'<:<361,/,'*+?H�CoH</05�)8;Hb+�gB-034:*8K'<36@�%�A98K'<+�H�CB36%v'*@J8J5?:<+?A0+�%v'*368;2D^�<e@476+lme@b���nK��9jpuzs)0+.H<5?+�%98K:<36@>E34'*)�=./02X'*36-,26+�/0HI+�:<HcE)0@0CQE),3626+7:<+?=Y8K36%034%0ZY8K%0@�%vRo=>@�/,H'*@c'*)0+s@�:IZv8;%034��8K'<36@�%,H�Cm=Y8;%08;Z�+b'<@"'*:<8;%0HU\P+�:�5?:<+�A,+�%v'*368;26H`\P:I@�= @�%0+n@�:IZv8;%034��8K'<36@�%u'*@u8K%0@;'*),+�:�CEG8;H7e0:<HI'J36%v'<:<@oA0/05�+?Aa1vR � )98;/,= � � )98 � �m� ^ � /,10H<+YLo/,+�%v'*2XR�C � )98;/,= 8;%0A � d;+�:U'*H<+(� ��� �h¦ �-0:I@�-Q@;H<+�A�8�H<@�24/,'*34@�%x'*)98K']34Hs198;H<+?A�@�%'*),+7+�gB36HI'<+�%05?+!@;\`8�H<+�=�3XMD'*:I/0HI'<+�A'*)034:<A-98;:U'&RxE)0@36H`36%vd�@�2Xd�+?A�34%�8;242B'*:<8;%0H<8;5?'<36@�%0H?^��]@yEb+?d;+�:?Co'<)0+s36%vd�@;24d�+?=>+?%v'f@;\Q8LH<+�=�3XMD'*:I/0HI'<+�A.'*),36:<A!-98;:I'&R36Hs/,%0A0+�HI36:<8;1026+K^

zs)0+�H<5�),+�=�+�2q8K'<+�:Y-,:<@�-W@�H<+?A�1vR���8;=�Z�88;:IA � ��8;=�R;�y�"+�=�-026@�RoHVZ�+?%0+�:<8;2"5?@�=>-,26+�gB3X'&RTM'*),+�@�:I+?'*345f-0:<34=>3X'*34d;+�HfOP@�%0+�MNEG8�Ru\P/0%,5?'*34@�%0Ht8;%0A7��+?:<@KMNpT%0@�E26+�A,Z�+b-,:<@o@;\PH�[}8;%0A734'<H|5�@�=�-026+�gB34'&R:<+?%0A0+?:<H�34'`%0@;'�8;-0-024365�8K1026+f\P@�:`-,:*8;5�'*365�8;2o/0H<+K^�Q�@�:<+?@�d�+�:?Cv34'`A0@B+?H�%0@;'�-0:<@;'<+�5�'�@�:<Z�8;%036��8K'*34@�%0H8;Zv8K36%0HU'5�@�2426/0A034%0Z�/0HI+�:<H?^nzs)0+7H<5�)0+?=>+7-0:I@�-Q@;H<+�A�1vR � )0+�%�� � )0+.R �K�|36H198KH<+�A�@�%SA036HI5�:<+�'*+�M26@;Zv8;:<3X'*)0=�M&108;H<+?AS1,2636%,A�HI36Z�%98m'*/0:I+�H�^$N'c36H]+YX�5�34+�%v'L1,/,'LA0@o+�Hc%0@;'"8;A0A0:I+�HIH"'*)0+7-0:I@�1026+?= @;\5�@;2626/,A036%0Z�/0H<+?:<H?^�r"%0@K'*)0+?:�A0:*8�E198;5�p�@;\])0+�:�HI5�)0+�=�+8;%0A�'*),+x@;'*)0+?:.-0:<8;5?'<365�8K2GH<5�),+�=�+�H-0:I+?do36@�/,H<24RS-0:I@�-W@�H<+?A�36Hc'<)98K'L'<@V/0HI+�8Y5�:I+�A0+?%v'*3q8K2`H<+�d�+?:*8;2`'<36=�+�H?C~8Y/0HI+�:L%,+�+�A,HL'*@V@�1B'�8;34%H<+�d�+?:*8;2|H<34Z�%98K'</0:<+?Hs\P:<@�= '*)0+u36HIH</034%0Z�@�:<Z�8;%036��8K'*34@�%~^

$&%�8K% +�8;:<2436+�:JEG@�:Ip �PSt� � _HRURBC�S~RBH3RUR;� C#Eb+�-,:<@�-W@�H<+?A�8�Z�+?%0+�:<8;2s5�:I+�A0+?%v'*3q8K2sHIRoHI'<+�=S^_ )03426+n'*),36HfZ�+�%,+�:*8K29H<@�24/,'*34@�%�5�8;-B'*/0:I+�AY=>8;%vR�@;\Q'*)0+A0+?H<34:*8;1024+-0:<@�-W+�:U'*34+�H�CT3X'f36H�%0@;'#/0H<8;1024+36%7-0:<8;5?'<365�+#1W+�5�8K/0H<+#'*)0+#5�@�%,HI'*:I/05?'<36@�%,H`8;:I+b108;H<+?A!@�%J@�%0+�MDEn8�Ru\P/0%05�'*34@�%0Ht8;%0AJZ�+�%0+?:*8;2T�?+�:<@mMpT%0@�E26+?A0Z�+Y-,:<@o@;\PHJ@K\n/0%0:I+�8;2436HU'*365�5?@�=>-,26+�gB3X'&R�^Vzs)0+>@;'*),+�:�C�=>@;:<+�-0:*8K5?'*345�8;2f5?@�%0HI'<:</05�'*34@�%Eb+cZv8�d;+;Co198;H<+?A>@;%Y8�%0@�%oM&HI'*8;%0A98K:<A�A036HI5�:<+�'*+�M&26@;Zv8;:<3X'*)0=�M&108;H<+?A�8;H<HI/0=>-B'*36@;%~Cv)98;H�'*),+]H<8;=�+-0:I@�1026+?= 8;H�'*),+�@;%0+�A0/0+�'*@ � )0+�% � � ),+$R �K� w78S/0HI+�:u%0+?+�A0H7'*@@�1,'*8;36%iH<+�d�+?:*8;2#H<34Z�%98K'</0:<+?H\P:<@;= '*),+734H<HI/036%0Z�@�:IZv8;%034��8K'<36@�%Y36%@�:<A,+�:s'*@�/0HI+J/0%,2636%,pK8K1024RY8�5�:<+?A0+�%v'<3q8;2}HI+?d�+?:*8;2}'<36=�+�H�^�"'*)0+?:s:<+�268K'*+?AVEG@;:<pY34HG'*)08K'@;\�IG:*8K%0A0H7�PIG:*8UR Rm��E),@�-,:<@�do36A0+?H8�5?+�:U'*34e05�8K'<+LHIRoHI'<+�= 34%

E)0345�)�8x/0H<+?:J)08;HJ5?@�%v'*:I@�2�@�d�+�:7E)98K'736HupT%0@�E%�8K1Q@�/B'7'<)0+�8K'<'<:<3410/,'*+?Hu@;\s8x-0HI+�/0A0@;%TRo=S^r"2X'*)0@;/0Z�) 8�5�:<+?A0+�%v'<3q8;2uHIRoHU'*+�= E3X'*) @�%0+�M&H<),@yE 5�:I+�A0+?%T'<3q8;24H5�8;% 1Q+i34%,\P+�:I:<+�A \P:<@;= )034H\P:*8K=>+�EG@�:IpFC,@�1,'*8;36%,36%0Z!8.5�:<+?A0+�%v'<3q8;2QHIRoHI'<+�= E3X'*)V=./,24'*3 M&HI)0@�E�5�:I+�A0+?%T'<3q8;24Hn36HG%0@;'n34=>=�+�A,3XM8K'<+s8;%0A�=>8�RJ36%.\ 8K5?'�1W+s36=�-Q@;H<H<341026+#36%�-,:*8;5�'*365?+;^�r"%0@;'<)0+�:�34%05�@;%Td;+�%034+�%05?+@;\F'*)0+?H<+]8;%0A�'*),+

b �

Page 43: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

@;'<)0+�:bA036HI5�:<+�'*+�M&26@;Zv8;:<3X'*)0=�M&108;H<+?A�HI5�)0+�=�+�HG=>+?%T'<36@�%,+�AV8K1Q@�d�+c36Hf'*)98m'n8;2420'*)0+c/0H<+?:<Hs8K%0AY'*),+5�+?:I'<34e95�8K'*34@�%i8;/,'<)0@�:<3X'*34+�H�36%�'<)0+�HI+�HI5�)0+�=�+�HJ%0+�+?A�'<@H<)98;:I+�'<)0+�H*8;=�+�A034H<5�:I+?'<+�24@�Zv8;:I34'<)0=Z�:I@�/0-~^

zs)0+!5?@�%05?+�-,'�@K\�:<+�d�@o5�8;1,26+.8K%0@�%vRo=>3X'&R36Hs\P@�/0%0A�36%S2634'<+�:<8K'*/0:I+u@�%�+?26+�5�'*:I@�%0365u-98�Ro=�+�%v'HIRoHU'*+�=�H>�MI � K R �TC � ; � R �K��8;%0AiZ�:<@;/0-�H<34Z�%98K'</0:<+�8K%0A�36A0+?%v'*34'&R�+�HI5�:I@yE � r � �;z�;�0C ��� R ¦ C� dB�-R,�vC K ;BR � �|H<5�)0+?=>+?H�^

;�:<36@;:~'*@@�/0:~Eb@�:<pFCm'*)0+f-0:I@�1026+?=�@;\B5�@;%0HI'<:</05�'*36%,Z"8s-0:<8;5?'<365�8K2�HIRoHI'<+�= E34'<)u=./024'<36-024+�MN/0H<+5�:I+�A0+?%v'*3q8K26H�+�24/0A0+?A�:I+�HI+�8;:I5�)0+�:IH7\P@�:"H<@�=�+!'*34=>+V�MIb:*8URURBC � )0+.R �,C~��8;= R��oC"S|� � _HRURK� ^J_a+H<@;24d�+"34'n1vRY+�go'*+?%0A036%,Z�36A0+�8;HG\P@�/0%,AV36%Y'<)0+�5�@;%0HI'<:</05�'*36@;%0Hn@;\|HU'*:<@;%0ZKM � � rM&198;HI+�AxHI36Z�%98m'*/0:I+H<5�),+�=�+�H!� ��� R R0C��7�c� R Rm�t8;%0ASZ�:I@�/0-H<34Z�%98K'</0:<+�HI5�)0+�=�+�H!� r � �;z�;�v� ^� ��� � nMi l ��k7=���l|kQnMi p�$&% � +�5�'*36@;% � ^X�YEG+Y-0:<+?H<+�%v'�@�/,:!A0+�e9%034'<36@�%,H7\P@�:!8�5?:<+�A,+�%v'*368;2GHURBH M'*+?= E34'<)�'<)0+�198;HI365�-0:<@;-Q+?:I'*34+�H?^�rc24'<)0@�/0Z�)i%0@K'u5�@�%05?+�-,'</98;2424R�%0+�E 8;%0A�36%,H<-034:<+�Ai1vR�'*),+263X'*+?:*8K'</0:<+L@;%�=./,24'*3 M&-98K:I'&R>5�@�=�-0/,'*8K'*34@�%�� � 8K%8R �BC � 8;%0���K�|8;%,A�:I+�8;5�'*34d;+uHIRoHI'<+�=�H�� ;�_ �;�K�DC'*),+�H<+"A0+?e9%,34'*34@�%0Hb8;:<+]@;\}34%v'*+�:I+�HU'�C08KHG@�/0:f'*:I+�8K'<=>+?%v'G34HG=�@�:<+s\P@�:I=Y8;20'<)98;%Y'<)0+"@;%0+"/0HI/98;2424R+�%,5�@�/0%v'<+�:<+?A(36%V'<)0+u263X'*+�:<8K'*/,:<+�@�%5�:I+�A0+?%v'*3q8K2|8;%0AS+�26+?5?'<:<@�%0345�5�8;HI)�HURoHI'*+?=>H?^�L/0:�108;H<345�5?:<+?A0+�%v'*368;2uHIRoHI'<+�=SC�-0:<+?H<+?%T'<+�A 34% � +�5?'<36@�% � ^ �B^ �BCL-0:I@ydK8;1,24R�H<8K'*34HIe9+?H�'*),+

198;HI365-0:I@�-Q+?:I'<36+�H�2436HU'*+�A�8;1W@�d�+]Z�34d;+�%>87HI36Z�%08K'*/0:I+sH<5�)0+?=>+c8;%0A>8u5�@�=�=>3X'*=�+�%v'�HI5�)0+�=�+;^�$N'<H+YX�5?36+�%,5?R:<+?2634+�Hs@�%x'*),+7+ X�5�36+?%05?R@K\�'<)0+u/0%0A0+?:<24Ro34%0Z�H<5�)0+?=>+?H�^�L/0:n+�go'<+�%0A0+?A�5?:<+?A0+�%v'*368;2~HURBHU'*+?=�C0-,:<+�HI+�%v'*+?A�34% � +?5?'*34@�% � ^ � C,A,+�H<5?:<341Q+?Hs)0@�E '<@.36%05?@�:UM

-W@�:*8K'<+u8;A0A03X'*34@�%98;2QA0+�HI36:*8K1026+�-0:I@�-W+�:I'<36+?Hs36%v'*@�'*),+7108;H<34575?:<+?A0+�%v'*368;2}HIRoHU'*+�=S^

����� ���# �� �������� ����� ���������� ��� �x� � �!�� � � � �

_a+E342620A,+?e9%0+]H<+?5�/0:I34'&R�\P@�:#8�5�:I+�A0+?%v'*3q8K2WHURoHI'*+?= 36%�'&EG@7HI'<+�-0H?^ :`36:IHI'�C�Eb+E36262BA0+?e0%0+cE)98m'34']=�+�8;%,Hc\P@�:]8>5?:IRo-,'<@�Z�:*8K-0)0365JHIRoHI'<+�= O ��� [n'*@>5�@�%,\P@;:<= '*@Y8;%�34A0+�8K2XMNEb@�:I26AH<-W+�5?34e95�8K'*34@�%O $ � [�^fzs)0+�%Eb+7E34262�Z;34d�+78;%34A0+�8;2 MNEb@�:<24AxH<-W+�5?34e95�8K'*34@�%x\P@�:8�5�:<+?A0+�%v'<3q8;2}HURBHU'*+?=�^

"���� ��� #)�%$?�%*���*"��-'&A/)(��� ������*(,+�(7�+� 4 �P��-&{ �K46*���$ �+¡/1�/.h#%��/1 ��0 �K [#21��%�� \��*"���/1 [*��3+

�L/0:�A0+?e54,376*34@34�36H�384,H<-034:<+�A 1vR � 8940+�6:6*3 � H�/;403Xd�+�:IH*8;2424R�5?@�=�-Q@�H<8;1024+V\P:*8;=�+?Eb@�:<p � � 8949�B���D^�c@�Eb+?d;+�:�C<6*)0+�40@96<36@34�@;\nHI+�5?/0:<3=6&R�EG+>:<+.LT/034:<+�36H�Eb+�8;pK+�:!1W+�5�8;/0HI+>Eb+Y8;:I+>4,@9675�@3405?+�::40+�AE376<)S8?4,@96*34@34@;\`5?@�=�-Q@�H<8;103426376&R�@;\@6*),+7H<8;=�+7HA6*:I+B40Z96<)�3746*)034HC6*)0+?H<36H?^

DYb�es684 ;FE nK�:4 bHGA��iA�¢l|k`nMi 684`kQlJIrK4�36A0+�8;2fOPH:6�8L6*365�[G\P/;405�6<36@3408;263=6&RY5?@340H<34H:6<Hc@;\�8?6<:</0HA6*+?A�-98;:A6&RMN6*),:<@�/0Z;)SE)0345�)(8;242O6*:<8940H M8;5P6*36@940H�8;:I+x5�8;:I:<36+?A�@�/Q6�Cb8(HI+�6�@;\])0@940+�HA6>34A0+�8K2G-0268�R;+�:IHSR � C!6*)0+8;ABd�+�:IH*8;:UR � C#8940AT6*),++B4vdo36:I@340=�+B4U6KV>^GrW6*:<8940H<8;5�6<36@34S36H]894�+?d�+�4U6L384vd;@�24do384,Z?6&Eb@V@�:=�@�:<+u-98K::6*34+�HYVW3=65�894X6�8;pK+H<+�d�+?:*8;2W:<@�/Q40A0H#@;\�5?@�=�=./;40345�8Y6<36@34�6<@75?@�=�-026+P6*+ VT374�6<)0+H<+.LT/0+?2WEb+E36262,Z�34d;+]HI-Q+?5�3Xe95�8Y6<36@34,H\P@�:sHI+?d�+?:*8;2%6<:*8940H<8;5�6<36@34,H]:I+�24+?dK894U6s\P@�:s5�:I+�A0+�4U6*3q8K2}HIRoH:6<+�=�H�^

r"242~-98;:A6*36+?Hs:<+?5�+�3Xd�+J8;H3840-,/Q6Z6*)0+uHI+�5�/,:<376&R-08;:*8;=�+�6<+�:�� i ^zs)0+L+�4Tdo34:<@340=�+B4U6CV -0:I@B5?+�+�A,Hn384V-W+�:I36@oA0H�^[R\4V+�8;5�)x-W+�:I36@oA~CT376]6*+?2626H#@340+c)0@340+?H:6s-,2q8�R�+?:

E)0345�)>6*:<8940H<8;5�6<36@34�6*@738403=6*3q8L6*+;^trK4>)0@340+?H:6G-98;::6&R.= '^R � Co8;5�6<34dK8Y6*+?A>1vR?6*),+"+B4vdo36:I@340=�+B4U6�C

b �

Page 44: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

-98;:A6*345�36-08Y6*+?H#374S6*)0+]H<-W+�5?34e9+?A>6*:<8940H<8;5�6<36@34�1vR>5?@34U6�8;5P6*3740Z 6<)0+Z6*:I/0H:6<+�AV-98K::6&RSM 894,A�6<+�26243840ZM E)98L6>6<:*8940H<8;5�6<36@34 376�374U6*+B4,A0H>6<@a5�8;:<:UR�@�/Q6>8940A E376*)�E)0@�=S^HM 6*)0+�4 +�gB+�5?/Q6*+?H 6*),+6*:I/0H:6<+�A�5?@BA0+#\P@�: 6*)034H@6<:*8940H<8;5�6<36@34�CKE)0345�)�=Y8�Ru384vd;@�24d;+GH<+�40A03740ZL=�+�H<H<8;Z�+?H[6*@c@96*)0+?:`-0268�R�+�:IH8940A�:<+�5?+�3XdB3740ZY=�+�HIH*8;Z;+�Hc\P:I@�= 6*)0+?=�^,R\4 6<)0+!+�40A(@;\[6*)0+J-Q+?:<36@oA~CM= 6*+?2626H�V 6*)0+J@�/Q6*5?@�=�+@;\@6*)0+ 6<:*8940H<8;5�6<36@34�^

r"A,d;+�:IH*8;:UR � 5�894Y8;26HI@uH<+B4,AV8940A�:<+?5�+?34d�+c=>+?H<H<8;Z�+�H 6*@J8940A�\P:<@;= M7^`zs)0+c+B4vdo36:<@940=>+�4U6V )08;H�6<@96�8;2|5?@34U6*:<@;2�@�d�+?:�8;242t@K\ 6*)0+!8;A,d;+�:<H<8;:IRW��Hu8;5�6<36@34,H�wC6*),+.8;A,d;+�:IH*8;:UR � \P@�:UEn8K:<A0H"8;2626*),+s:<+�5?+�3Xd�+�A�=�+�HIH*8;Z�+?H!6*@ V>C�8940AS6*)0+�4�V 6*+?2626H@6*)0+8KA,d�+?:<H*8K:IR � E)0345�)�=>+?H<H*8KZ�+�H!6*@�HI+B40A�^R\4W:�36Z�/0:I+ � M��;CBEb+JZ�3Xd�+7894+�g,8;=�-024+�@;\�8Y4�34A0+�8;2�HIRoH:6<+�=S^

T

Environment E

C D EA B

Adversary

:`34Z�/0:<+ � M��;w�rK4x+�g08K=>-024+"@;\�894x34A0+�8K2QHURBHA6*+?= E)0+�:I+-6*)0+"+B4vdo36:<@940=>+�4U6384U6*+?:*8;5P6*HGE3=6*) 6*),+36A,+�8;2~-08;::6<36+�H � C��YCF8940A���CF8940A�6*)0+78;ABd�+�:IH*8;:URx\P/0262XRY5?@34U6*:I@�26H36A,+�8;2~-08;::6<36+�H2N�894,A V�^

�C��I a�l n��K��6 a � k}��OI _{lme7�r O H:6*8Y6*345�[n5�:URo-Q6*@�Z;:*8;-0),3657HIRoH:6<+�= 36H]=>@oA0+�24+�AS1vRS8>H<+P6L@;\`)0@340+?H:6"5�:IRo-Q6<@�Z�:<8;-0)0345J-0268�R�+�:IH��� CQ6<)0+78;A,d�+?:<H<8;:IR � CF894,A�6<)0+u+B4vdo36:I@340=�+B4U6�V>^

�c+?:<+;CY6*@o@0CL6<)0+G+�4vdB34:<@34,=>+�4 6[V -,:<@o5�+�+?A0H`374!-W+�:I36@oA0H�^@R\4�6*),+b1W+�Z�374;403740Zc@K\9+�8;5�)!-Q+?:<36@oA~C376 6<+�2426HLHI@�=>+�)0@940+�HA6!-0268�R�+�:�E)0345�)�6<:*894,H*8;5P6*36@94 6<@�3740376<3q8Y6<+;^JrK4�)0@340+?H:6J-98;::6&R^= ' ��� C8;5P6*34dK8Y6<+�Ax1vR 6<)0+u+B4vdo36:<@940=>+�4U6�C0-98K::6*345�34-98Y6*+?Hn3846<)0+�H<-W+�5?34e9+?AX6<:*8940H<8;5�6<36@34x1vRx5?@34U6�8;5P6*3740Z6*),+>-98K::6*34+�H7376 40+?+�A0H�6<@�5?@34U6�8;5P6�6<@�5�8K:<:IRi@;/Q6 6<)0+YZ;34d�+�4 6<:*8940H<8;5�6<36@34�C`894,A�:</Q4;40384,Z 6*),+5�@;:<:<+?H<-W@340A03740Z�5?:IRo-Q6<@�Z�:*8K-0)0365>-0:<@Y6*@o5�@�2�E376<) 6<)0+�HI+Y-98;:A6*34+�H�^�R\4 6<)0+Y+�40A�@;\ 6*)0+>-Q+?:<36@oA~C=�6<+�2426HV 6<)0+�@�/Q6<5�@�=�+�@;\ 6*)0+^6<:*894,H*8;5P6*36@94~^ O}Oc@96<+^6*)98Y6),+�:<+KC�6<)0+�HI+a8K:<+�-W+�:<34@BA,HV@;\+�gB+?5�/Q6<36@34 @;\ 6*)0+xHURBHA6*+?=�C'40@96�:<@;/;40A0H�@;\c5�@�=�=./;4,365�8L6*36@94"Vb+�8;5�) -0:<@96<@B5?@�2n=>8�R�:<+YLT/036:I+d�+?:IRY=Y894vR�5�@;=>=./Q40365�8Y6*34@34>:I@�/;40A,H.V0@34,5�+L3=6G34HG5�@;=>-024+�6<+�A~C 6*)034HG34H'6*),+"+B4,Ax@;\%6*)034HG-W+�:I36@oA@;\�+�gB+�5?/Q6*34@34F[�^

r"A,d;+�:IH*8;:UR � 5�89478;26HI@sH<+�40A!8Y40Au:<+�5?+�3Xd�+f=>+?H<H<8;Z�+�H 6<@]8940A�\P:<@�= 894vR�@96<)0+�:�-02q8�R�+?:|384-6*),+HIRoHA6*+�=S^fzs)0+7+B4vdo36:<@940=>+�4U6 V{)98;HZ6*@96*8;2~5?@34U6*:<@;2~@�d�+�:c8;242�@;\ 6*),+J8KA,d�+?:<H*8K:IRW� H"8;5�6<36@34,H�w 6*),+8;A,d;+�:IH*8;:UR � \P@�:UEn8K:<A0H8;242O6*),+�:<+�5?+�3Xd�+�A�=>+?H<H<8;Z�+�HZ6<@>V�C98940A6<)0+B4 V 6*+�2426H 6<)0+u8;A,d;+�:IH*8;:UR� E)0365�)S=>+?H<H<8;Z�+�H,6*@�HI+B40A�8940A6*@�E)0@�=S^S}+�6� � ���SA0+B4,@96*+ 6��0+J8;26Z;@�:<3=6��0= \P@�:c3740376<3q8;2436�?3840Z 6��0+JHIRoH:6<+�=S� Hc-0/01024365u-98;:<8;=�+�6*+?:<H?^sr

A0+?H<36Z9498Y6*+?A O��0@340+?H:6�C�37405�@�:I:</0- 6*361,26+�[]-98;::6&Ri34H�:<+?H<-W@340H<341026+�\P@�:�=>8;pT384,Z�6��0+�HI+>-08;:*8;=�+�6<+�:IHp 40@�E,46*@�8;242 6��0+�-98;:A6*36+?H�^ R\45�8;H<+ 40@�-,/01026345"-98K:*8;=�+�6<+�:<Hn8;:<+-4,+�+�A,+�A~CF8;HIH</0=�+-6��08Y6��� ���36H8.d;@�36A�8;26Z;@�:<3=6��0=S^

b b

Page 45: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

:`36Z;/0:<+ � M �BC034H894+�g,8;=�-026+�@;\`8�:<+�8K2~HIRoH:6<+�=S^

Network

B C D E

Environment E

A

:`34Z�/0:<+ � M �BwurK4�+�g,8;=�-024+�@K\n8:<+�8;2�HIRoH:6<+�= E �0+?:<+?6��0+�+B4vdo36:I@340=�+B4U67384U6*+?:*8;5P6*HuE376�� 6��,+-98;:A6*34+�H � C �YC98Y40A ��CB\P/0262XR�5�@34U6*:I@�26HG-98;::6<36+?H�N 8940A�V O 8940AxHI@�-08;::6<36+�H�N 8940A�V{8K:<+-6��,+8;A,d;+�:IH*8;:UR0[�CW8940A��98;HH<@�=�+�p 40@�E26+?A0Z�+J8;1Q@;/Q6Z6��0+ 40+P6&EG@;:<pF� Hc1Q+ �98�do36@�:?^

�C��I a�l n��K��6 a � k}��OI _{lme7� �g6+l|k}_ � I k~i � 6�i DYb�e@6 4CG � iA�¢l|kQn i 684`kQlJIz �0+�34A0+�8.@;\ 6��036HnA,+?e5403=6*34@34V36H'6��98Y6C40@�+B4vdo36:I@340=�+B4U6H��0@;/026Ax1W+u8;1024+K6*@�6<+�262FE �0+P6��0+?:]3=6n34H6�8K26pT3840ZS6<@V8�5�:IRo-Q6<@�Z�:<8;- �0345JHURBHA6*+?=�CW@�:,6*@?6��0+J36A0+�8;2~\P/;405P6*36@9498;263=6&R�^#z �036H]36A,+�8>@;:<36Z;38498Y6<+�H3846��0+u=./0276<3XMN-98;::6&R�5?@�=>-,/Q6�8Y6<36@34x24376<+�:*8L6*/0:I+�� � QS_ ��� �D^dfehgji�kQlmk`nMi�0qp`t�p`tKp?u ��l_z v � k��;l �{v��7� � y{z|y�� j{}�� � ��� � ��� � � � � � � � � � � � k�� � � �okml � � �7} �� ��� ��k�� �x�kml } y��&k� �9j��`�oj<� ��y v9j � � � � � � � k�� L � � � ��h � � �d� �Uh kY+%x � y �7� k��&� � x.� �9j l jVj + � y��QyCy �Y} �£� � �&kml��y{��� � � �,� �1x�kml � �Y� v,�¢� lSy v l*k h��vh�� � � y�� � � v k���z���k }�� � � � � �Y}Yj x �¢}�� � �Dj y�k"x � �9� j l � ��� �Y�;j � �ol_� � �7�}�� � �7� � j y�� V i R � i�� � �9j l j�j + � y��Qy � � j �¢� � � � h � j x_�£�\��� � k��� O�0[ y{��� � � �,� � �

�[;f:���¤&Ct �� ���|O � i [�V O�� � O � i RV¤�i[ � i V i [ h w� � �����

;�:�� O~L � O � i [ M!OU� i [ � O � i [ �� V i [ h w� � ���[��� � O�0[Oc@96��C6��98L6f384�6����sA��?e54,376*34@34�8;1W@�d��KC 6����sH<34=./0268Y6*@�:�36H�Z;34d���4�h � � �d� �Uh kY+ 8;5�5���H<H!6<@ 6������B4oM

do36:I@340=��B4U6�^ �"\}5?@�/0:IH��;CoH<37405�� 6����]H<34=./0268Y6*@�:�A,@��?H 40@96 �98�d��c102q8K5�pvMN1Q@�g>8;5?5��?H<H 6<@ 6����c34A���8;2-98;:A6*3���H�C�376J5�894Q40@96.:��?E3740A 6������B4vdo36:I@340=��B4U6.1��?R;@340A 6����Y1���Z�374;403740Z�@K\]8�Z�3Xd��B4�- �?:<36@oA~C8940AS5�8Y4;40@96:���8;AS=!�?H<H<8;Z���H]H���4U6c1���6&E"����4 6����#��4vdB34:<@34,=!��4 6c894,AX6���� �0@34��?H:6]-98;:A6*3$�?H�^

z ���:���8;H<@34T6��98Y6�6��036H.A��?e5403=6*34@34�36H!E"��8Kp%��:?6��0894 6����x/Q4034d%��:<H<8;262XR�5?@�=�-Q@�H<8;102��VA��?eBM403=6*36@94~CF36H"-,:���5?36H���24R�6��98Y6K6����&��4Tdo34:<@340=��B4U6 �98;HK6<@VH<5 ���?A0/02���894'��4 6<36:�� 6*:<8940H<8;5�6<36@34 6<@V1��5�8K:<:<3���A�@�/ 6�384�8LZ�3Xd���4�- �?:<36@oA~C�HI@�376`5�894;4,@96f384U6(�?:<2���8�d��s=���HIH*8;Z��?H�@;\WA03 � ��:��B4U6 6<:*8940H<8;5�6<36@34,H@�: �08�d%�Z6*:*8Y40H*8;5P6*34@340H�5?@340A0/05P6(�?A>5?@3405�/,:<:���4U6*24R;^�z �034H�=Y8;p)��H 6��036H 4,@96*34@34.@;\WH��?5�/0:I376&R!=./05 �2$�?H<H]8;-0-���8K26384,Z�6��9894/;4,34d��?:<H<8;2|5�@�=�-Q@;H*8;1034263=6&R�Co10/Q6c8;26HI@*��8;HI3$�?:,6<@�EG@�:IpYE376��~^

:`36Z;/0:�� � M � H �0@�EH �,@yE 6*@YH��0@�E 6��98Y6-6�����:���8;2`HURoH:6(�?= \P:<@;= :`34Z�/0:�� � M �YH*8Y6<36HIe���H-6����H<-���5?34e95�8Y6*34@34@;\@6����u36A���8;2~HURoH:6(�?= \P:<@�= :`36Z�/,:�� � M*��^

b �

Page 46: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

B CA D E

Environment E

T

S(A) S(B) S(C) Simulator S

S(T)

:`34Z�/0:�� � M � w�r HI36=./,2q8Y6<@�:K6*:<8940HI2q8Y6<3840Zx8x:���8;2 ��4Tdo34:<@340=��B4U6J8940A�8;ABd���:IH*8;:URi384U6*@S894i34A���8;2�B4vdo36:I@340=��B4U6�8Y40A(8;ABd���:IH*8;:UR�^ � O � [�C � O ��[]8Y40A � O �J[8;:��7H<34=./02q8L6*@�:IH,6��98Y6 6*:<8940H<268Y6(� 6����:���8;2 ��4vdB34:<@34,=!��4 6 V�� Hs3740H:6<:</05P6*34@340HG\P@�:G36A���8;2�-98K::6*3���H � C �YC98Y40A ��^�z ����H<36=!/02q8Y6<@�: � O ML[6*:<8940HI2q8Y6���H%6����#=���H<H<8;Z��?H�@;\ 6����f:���8;2 ��4Tdo34:<@340=��B4U6[V�384U6*@]=!�?H<H<8;Z���H 6��08Y6 6����!6*:I/0H:6���AJ-98;::6&RM /;40A��?:<H:6*8940A0H?Ct8940A�198;5�pF^7z ����=>8;384�H<36=!/02q8Y6<@�: � 6<:*8940HI2q8Y6���HK6����.:���8;2 ��4vdB34:<@34,=!��4 6 V8940A�6����7:���8;2~8;A,d��?:<H<8;:IRS384U6<@�36A���8;2~1�� �98�do36@�:?^

"���� �Z� .h#%��/1 � /�( *" �����#%������*"/1 �(,+�(�� ��4 1��%�� \��*"���/1 [*��3+r 198;H<345!5?:���A��B4U6*368;2�HURoH:6(�?= �08;H �hy j lSy C kml~� � � � � � � � k��+y CF8940A�;j l � �nj lSy 8KH 6&Ro-���HL@;\�-02q8�R��?:<H?^FcH���:IHu8;:��&��4U6*376<3$�?H�6��08Y6�:��?5��?34d���5?:��?A��B4U6*368;26H?^�z ���.H���6u@;\f/0H���:IH�384 6�����HIRoH:6���= =Y8�R�Z�:<@�E@�d��?:[6*34=!�K^��L:IZv894034��8Y6<36@340Ht8;:�� ��4 6<376<3$��H@6��98L6`Z�:<894U6�894,A!d��?:<34\ R 6����G5?:���A��B4U6*368;26H�@;\;6����G/0H���:<H?^� 8;5 ��@�:IZv894034��8Y6<36@34�Z�:*8Y4 6<H�8�/;4,3ZLT/��iO \P@�:JHI36=�-026345�3=6&R�@;\ ��gB-W@�H<3=6*34@34F[-6&RB-��V@;\5?:��?A��B4U6*368;2D^:`37498;262XR�CTd��?:<34e���:<Hc8;:�� �B4U6*3=6*3$�?HC6��98L6]d%��:I34\ Rx5?:���A��B4U6*368;26Hs@;\@6����7/,H���:IH�^

z ���7HIRoH:6���= H</,-0-Q@;::6*H,6����u\P@;2626@�E3740Z�6*:<8940H<8;5�6<36@340H?w��������� � O���R��.[�w�z �,36H�-0:<@Y6*@o5�@�2n34H�8^6*:*8Y40H*8;5P6*34@34�1 �P6&E ���B4 8i/0H���:�� 8940A 894 @�:IZv894034��8mM6<36@34��>^7z ����/0H��?:� 5�@94 6*8;5�6<H-M E3=6��i8V:��.LT/���HA6 6<@ ��HA6�8;102436H �i8V-0H��?/0A0@34vRo= 1 �P6&E ���B4����:<H���2X\]8940A�@�:IZv894034��8Y6<36@34���^ � ���Y\P/0::6�����:JH<-���5?34e �?H�6����>26@�Z;384�498;=�� ��� 1vRaE �,365 � Mp 40@�EH����?:�8940A 6����.5?@�:<:���HI-Q@34,A03840Z8K/Q6�����4U6*365�8Y6*3740ZYp)�?R ���^-RN\#H ���.A0@ ��H-4,@96 �98�d%��8948K5�5�@;/;4U6]E3=6��M�R%��6�CWH ���ue9:<HA6 �?H:6*8;102634H����?H376s1vRx-0:I@�dB34A0384,Z?6<@SM 8�26@�Z�374 498;=�������8Y40A@;1Q6�8;3740384,Z ���384�:���6*/,:F4~^ � ����\P/0:A6����?:uH<-���5�3Xe ��H7-0H���/0A0@94TRo=�������� � �&^�z ����4 M d���:I34e �?H6����sdK8;2634A0376&RJ@;\fO}��� R ���[f8Y40A~CT34\���x36H 6����"8K/Q6�����4U6*365�8Y6*3740Zup%��R�5�@�:I:���HI-Q@940A0384,Z 6<@J24@�Z�384408;=!���!�`C}5?@34U6�8;5P6*H"� 894,A 6���2426HL3=6K6��08Y6uH<@�=���/0H���:�En8Y4 6<H 6*@ ��HA6�8;1,2636H ��8-,H���/,A0@34vRo=�#�$��� �%�&^�z ���(@;:<Zv894,36��8L6*36@94 �?376�����:Y8;5�5���-Q6<Hx@�:>:��'&��?5�6*H?^NRN\u376Y8;5?5���- 6*H�C]376>Z���4���:<8Y6(�?Hx8:<8940A0@;= TM&103=6 6�8;Z)(u8940A�H:6*@;:���H7376 6<@�Z���6�����:7E376��*��^�M 40@96*3Xe ��H#� @;\8;5?5��?-Q6�894,5��Y@;::��'&��?5�6*34@34~^

+ �-, .0/�12�4365 O���R��cR7�![�w�z �034H7-,:<@96<@B5?@�2�36Hu8 6<:*8940H<8;5�6<36@34i1���6&E"����4�8/0H��?:#� 8940Aa894i@�:<Zv8Y403XM��8Y6*34@348�>^9� 8;-0-0:I@v8;5 ���?H�M7C#8940A H</,10=>3=6*H ���?:�26@�Z�374 498;=�� ����C ����:�8;/Q6����B4U6<365�8L6*384,Zp)�?R ���C 6����!-0H��?/0A0@34vRo=:��C~8940A 6�����408;=!�7@;\f@�:IZv894034��8Y6<36@34;�>^ RN\ ���36H 40@96�8�d;8K2636A8K/Q6�����4U6*365�8Y6*3740Z�p)�?R�\P@�:��!�`C�@�:!3X\<� 34H 4,@96=�J��H.-0H��?/0A0@34vRo=�E3=6��>��C<6����B4 M :���-0243$�?HE3=6���8PG�:W8K362 O!=!�?H<H*8KZ��;^��-6�����:UE36H��;C5M 5?@34U6�8;5P6*H?��^ RN\@� 8;5�5���-Q6<H�C 6�����4XMN40@96*3Xe ��H,6����/,H���:Z6��98Y6c8�5�:��?A��B4U6<3q8;2 �98KH]1�����4�Z;:*894U6(�?A~C9@96�����:UE36H��u3=6:���-,263$�?HnE376�� GI� �A&���5�6�^ O

B�3C�ED F-�G12�4365 OA��R_B�R7� R7�.[�w�z �036Hs-0:I@96*@o5�@;2}36H8�6*:<8940H*8K5�6*34@34S1 �P6&E ���B4(8�/0H���:H� 8940A�8.d���:I34e �?:B�^ r�/0H���:�8;-0-,:<@v8;5 ����H>M 8940A Z�34d%��H�376 ����:�26@�Z�374 ���`C ����:>8;/Q6����B4U6*345�8Y6<3840Zip%��R ���C

b �

Page 47: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

8 498;=��(@;\ 6����(d���:I34e �?: B>C]8�-0H���/0A0@94TRo= � 8Y40A 8 498;=��(@;\78�5?:��?A��B4U6*368;2XMNZ�:*8Y4 6<3840Z@;:<Zv894,36��8L6*36@94��^<RN\ ���36H�8"dK8;2436AJ8;/Q6����B4U6*345�8Y6<3840Z"p%�?RJ\P@�:T����C�8940A�� 34H��J� H�-,H���/,A0@34vRo=E3=6��7@�:<Z�894036��8Y6*34@34"�>CK8940A!8]5?:���A��B4U6*368;2 �08;H�1�����4.Z�:<894U6(��AJ1vR� 6<@ ��C96�����4 M 40@Y6*34e���H B6��98Y6C6�����/0H���: �98;H8�5�:���A���4U6*3q8K2�\P:<@�= �>^ �K6�����:UE36H��KCQM :���-0243$�?HGE376��8 G�:W8K362 O7=���H<H<8;Z��K^

B�3C�ED F-�G12�4365 � .�2� � OA��R_B�R7���jR7� �jR7�.[�w�z �036H7-0:I@96*@o5�@�2�34H78X6*:<8940H<8;5�6<36@34�1 �P6&E ���B4�8S/0H��?:��8Y40Ai894�d��?:<34e���:�B>^#� 8K-0-0:<@�8;5 ����H-M�8940AiZ�3Xd��?H�376 ����:�26@;Z�384 498;=��5����C ����:u8K/Q6�����4U6*3XM5�8Y6*3740ZYp)�?R ���C�8 498;=��7@;\!6����Jd���:I34e �?:%B>CW-0H���/0A0@94TRo=�H ����8940A����C~8Y40A�8 498K=!�7@;\85�:���A���4U6*3q8K2XM&Z;:*894U6*3740Zx@�:IZv894034��8Y6<36@34 ��^�RN\����36H78xd;8K2636Ai8K/Q6�����4U6*365�8Y6*3740Zp%��R�\P@;:�����C8Y40A ����36H �J� HJ-0H��?/0A0@34vRo= E376��B E �,362$� � � 36H �J��H!-0H���/0A0@94TRo= E376��a@�:IZv894034��8Y6<36@34��C98940A�8�5�:��?A��B4U6<3q8;2 �98;H]1����B4�Z�:*8Y4 6���AS1vR � 6*@=���C;6����B4 MN40@96*3Xe ��HaB 6��98L6Z6����7/0H��?:E3=6��-0H���/0A0@94TRo= ��� �98;H8�5�:��?A��B4U6<3q8;2~\P:I@�= ��^�L/Q6*-,/Q6�w �-405���8�6<:*894,H*8;5P6*36@94V36Hb5�@�=�-02$�P6(�?A~C,8./,H���:G@�/Q6*-,/Q6*H 6����-498K=!�c@;\ 6����K6<:*894,H*8;5P6*36@94&I/,H:6�5�@;=>-02���6���A~C#8940A 6�����498;=��V@;\,6����x@�:<Zv8Y4036��8Y6*34@34�376!En8;H�5?@�=�-02$�P6(��A�E3=6��~C#894,A 3X\3=6xEn8KH�8�d���:I34e95�8Y6*34@34�6*:<8940H*8K5�6*34@34~CK6����B4�8;26HI@ 6���� 498;=��i@;\�6����a5?:��?A��B4U6*368;2XMNZ�:*8Y4 6<3840Z@;:<Zv894,36��8L6*36@94"V894 @�:IZv894034��8Y6<36@34�@�/ 6*-0/Q6<H"&I/0HA6 6���� 498;=��S@;\-6���� 6*:<8940H*8K5�6*34@34 8Y40A 6����34A��B4U6<34\ Ro3840Z�6*8;Z#(n@;\@6����7-,H���/,A0@34vRo=�E3=6��xE �0345 �X6���� 6*:*8Y40H*8;5P6*34@34xEn8;H5?@340A0/05P6(�?A~^z �036H!36A���8;2bHURoH:6(�?= 5�8K-Q6*/0:���H�6����V374 6</0376<34d%�Y:��YLT/036:���=��B4U6*H?C�H</05 � 8;H./Q4,\P@�:<Z%��8;1034263=6&R�@;\

5�:���A���4U6*3q8K26H�C08940@34vRo=>3=6&RY@K\�/,H���:IH�C9/;4,26384,pK8K103624376&R�@;\t5?:���A��B4U6*368;2~H��,@yE3740Z�H?C98940Ax5?@340H<34H:6��B405�R@;\|5?:���A��B4U6*368;26H?^ R&A���8K2�@�-���:<8Y6*34@340H 6��98Y6n8;2624@�E 8;A0A03=6*34@3498;29A��?H<34:*8;102��c\ ��8Y6*/0:���Hn5�894V1��"34=>-02���M=��B4U6(�?A�8;HsE"��242D^S ��6�/,H`10:I3$�Y�,RJ342624/0H:6<:*8Y6�� 6����b/0H��b@;\;6����G5�:���A���4U6*3q8K2BHURBHA6(�?=�1vRJ8 6&Ro-0365�8;2 ��g,8;=�-02$�K^ � @34oM

H<34A���:u8/0H���: � E �0@En8Y4 6<H 6*@SZ���678x5�:���A���4U6*3q8K2�\P:<@�= @�:<Zv8Y4036��8Y6*34@34 �>^ �L:IZv894034��8Y6<36@34 �:��YLT/036:���HZ6����u-W@�H<H���HIH<36@94�@;\�5�:���A���4U6*3q8K26Hn\P:<@;= @�:IZv894034��8Y6<36@340H ��!s8Y40A � f 8KHc8�-0:���:��.LT/036HI376��6*@"Z���6�8c5�:���A���4U6*3q8K2B\P:<@;= ��^�rcH<HI/0=!�'6��98Y6 ��-Q@�HIH��?H<H��?HfH</05 ��5?:���A��B4U6*368;26H?^`z ����4 � 5�894.Z��P68Y5?:���A��B4U6*368;2t\P:I@�= � 8KHc\P@�2426@�EH�wnH ���!e9:IH:6 ��H:6*8;102436H�����HL8>-0H��?/0A0@34vRo= E3=6�� � 1vR ��g��?5�/Q6UM384,Z ��������� � O���R��.[8940A^6����B4�H��,@yEH � ���?:L5�:���A���4 6<3q8;24Hc\P:I@�= ��!]8940A � f 1vR ��g���5?/Q6*3740ZB�3C�ED F-�G12�4365 � .�2� � OA��R7�AR��� R�����SR7��!I[c8Y40A B�3C�ED F-�G12�4365 � .�2� � OA��R7�.R7�� R�����{R7� f [�^ Oc@�E�{p 40@�EH 6��98Y6Z6����J/,H���:3=6p 4,@yEH]/;40A���: ���-Q@�HIH��?H<H��?H"5?:���A��B4U6*368;26Hs\P:<@;= ��!n8940A � f 8Y40AE36242�Z;:*894U6 � 8V5?:��?A��B4U6*368;2DC�3D^ �;^XC � 5�8Y4 ��g���5�/ 6(� + �-, .0/�1 � 365 OA��R7� �jR7�.[�^�_ ��:���=>8;:<p�6��98L66����!@�-���:<8Y6*34@34 B�3���D F-�G12�43 5 OA��R_B�R7�cR7�![ ��gB36HA6*Hc\P@;: � X>5?3$��405?R�:���8;H<@34,H�^z �036Hc@�-���:*8L6*36@94�5�8941��./0H��?Ai1TR��{3X\fH����JEn894U6<H-6*@xH��,@yE�8Y-98K::6&R(@94024R�8YHI3840Z�2��!5?:���A��B4U6*368;2DC �;^�Z0^4C 6*@8;5?5���HIHu8H</,10H<5?:<36- 6*36@94BM&198KH���ASH��?:Ido365��;^

��� � ���� � � ��� ��� ����� ����� � �������^��� ����� � ��� � � ����� � ��� �-������ � �� � ��� � � � � �

�! �"#"%$'& �)("��*,+�� -'.Xd��B4�* & ./-940*Y6 +�� &21 ���43��6587.R9 �;: �qR=<�>'? �;@BA�CD*94�E�* 14$ 3�3F.=6G3��B4U6 &=1 ���43��5H7JI R ������������CLK �M �"�"�$'& �N* " + $ 6 $M14$'OQPR$ + " + $ d!.74�-�p 4 $ ( O �4E�-�� $,P * 14$ 3�3F.=6F6��4E�dS* O/ ��. &-'.Xd��B4TKeS ��6�5`=U5=5 ��RV¤ �I RV¤��V,C{R;5YI�R>||RGWXC=C{R_B�5 ��RV¤�YC2C%Z�� 6���� " + $ 6 $!1[$'O,PR$ + " + $ dM.84�-sp 4 $ ( O]\�4E#-�� $,P 6����udS* O/ � & IX^<|!^_W &2 �1 �^6��0*Y6 � � �����������0`Sacbd5QI�R>|,Ce*Y4�Ef<#>'? �g@BA `,aih 5QI�R2WXCLKs_ �(j. OkO * Ok&2$ 4����4E�* " + $ 6 $M14$,OTPR$ + & .k-34�.74�-l* 14$ 3�3F.=6F6��4EVdS* O/ �,^�E���e54��[ENZ�� O/$ (mK

b ¦

Page 48: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

"��Z����� (a*[$��%*[��$5/ �P�4646*Z�7� ��#�� /1 ����R\4 6���. &j& � 1 62. $ 4 ^_("��(j. OkO E����54�� * " + $ 6 $!1[$'O 4����[E��4EY* & *FZ . O E�.84�-lZ Ok$!1�� PR$ + 1[$ 4 & 62+ �1 6G.74�-*94�*94 $ 4��M3 $' �& 1 +��4E���4U6G. * O0& � & 6��43 K� ��. & (j. O/O Z��e* " + $ 6 $!1[$'O Z���6 ("����4 * �& �[+ *Y4�E�* & ./-34��4+4K & *l+�� &= �O 6 $,P 6���� " + $ 6 $M14$'O ^Q6���� �& �4+j(j. O/OT$ ZQ6 *S.84f* & ./-340*L6 +�� $ 4N*��,* O/ � $,P ���4+ 1 � $ . 1 �S^( ��. O �-6���� & ./-34��4+ (j. OkO 4 $ 6 O � *,+:4 *94 � .84 PR$ +23F*Y6G. $ 4 *,Z $' 6Z6������S* O/ ����� ��* &j& ./-94��4E KS ��6F5H7UR9 �;: �\R=<�>'? �;@BA0C Z�� * & � 14 +�� & ./-940*Y6 +�� &=1 ���43��l*94�E 5H7JI R ������������C Z�� * 4 $ 4 \

.84U6��4+G* 1 6G.���� 14$ 3�3F.=6G3��B4U6 &21 ���43��,KXR\4 6���. &�& � 1 6G. $ 4 ^ ("� & � $ (�*�6 ( $S\ " *,+A6�� " + $ 6 $!1[$'O Z � \6 ("���B4N* #& �4+?� *Y4�EN* & ./-34��[+ � ^�(j.76��6���� PR$'O/Ok$ (j.74�- PR 4 1 6G. $ 40* OT&2" � 1 .�� 1 *L6G. $ 4 ^#( ���[+���� i*94�E � i *,+�� �YX 1 .��B4U6 O � & *,3 "�O *,Z O � E $ 3F*,.84 &��

�CnM��PnMiHDViAa�� l � .k-340*Y6 +�� "� Z O . 1�� ���<¤� ^ 14$ 3F3�.7623!��4 6 "� Z O . 1�� ���<¤��IcKc*94#E 1[$ 3 \3�.7623!��4 6 ��K

� _�e����1_ a���k�� 6£lmeDk`iAa�� l�� �����S* O/ ��I^'�� i 6��0*L6,4����[E & 6 $ Z�� & .k-34��4ET^_*94�E��,* O/ � |5' � i&= �1 � 6��0*Y6 � � �����������D5Z¤��I R�I�R3|'CK�qk �Mi�e7����_5a ��k�� 6+l eDk`iAa���l � � 1 +��P6 � ��� � 6��0*Y6 1[$ +2+�� &="%$ 4#E & 6 $ ¤& K� _�e����1_Un<��l$ae� l�� �����S* Ok ��W &= �1 � 6��0*Y6Q<#>'? �g@BA `,a 5YI�RGWXC � �'K

� ��� & � 1[ +2.=6�� &2" � 1 .�� 1 *Y6G. $ 4 &j$,P 6���� " + $ 6 $M14$,O 5 � ~ �6CQ*,+�� �

�\e ������kQlJI � nK�Hl � eF��_�e�� � � ��� " + $ 6 $M14$'O 3 �& 6 +������4* O 58* O 3 $'& 6C-4 $ .74 PR$ +=3U*Y62. $ 4Y*SZ $' 66���� �& �[+�� & .84 "� 6EIXK5Q $ +�� PR$ +=3U* O/O �,^56����[+��*� �!. & 6 & * 4��4- O ./-'.kZ O � PR 4 1 6G. $ 4 � 5��C &2 �1 �6��0*Y6 PR$ +j* OkO I�R"! '#� i ^ PR$ +j* OkO 5 4MZ $' 4#E��4E_CQ*,E$���4+ & *,+=.$� & � ^ PR$ +j* O/O ¤� '�7F5U� i CL^

;�+��P| t � i V( t � ~ � 5Z¤&R�I�R>|,C � ���K���; +��P| t � i V t � ~ � 5Z¤&R"!MR>|'C � � �K�[�&% � 5��C

�\e ������kQlJI � nK�Hl � eF_ k �Mi�e�� � F & �[+ 1 *94;4 $ 6 $' 6 "� 6m*'�S* O ./E & ./-940*Y6 +�� W $ 4Y*Y4��#�S* O/ � 4 O � &=& W ( * & . &2&2 �4E�Z � 6���� � .k-34��[+4K�Q $ +�� $ �%�4+4^ 14$ +=+�� &="%$ 4�E�.84#- 6 $ *Y4��fWc^ 6����[+�� . &* 4�.1L �(�S* Ok ��I 6���*Y6�* �& �4+ 1 *94 " + $ E �1 �,^ &2 �1 ��6��0*Y6 6���. & �S* O/ ��. & � +$) �F*Y6 6����Z��4-'.74;4�.74�- $,P 6���� " + $ 6 $M14$'O K Q $ +�� PR$ +23F* O/O �'^ O ��6 � E��B4 $ 6���6����l.84U6(�[+G* 1 6G.����*� +2.74�-3F* 1 ��.74�� PR$ +,6���� � ./-94��4+?� &6" + $ 6 $!1[$'O K+� ���4+��&� �!. & 6 & *94 )�+-,/.107� ,�23. * O - $ +2.76���3 V &2 �1 �6��0*Y6 6����aF & �4+?� & �!.��[( .84�.84U6(�[+G* 1 6G. $ 4 & (j.76��?6���� �4� 62+G* 1 6 $ + . & 6���� & *,3��e* & .74F.74U6(�4+2* 1L\62. $ 4 & (j.76�� 6���� � .k-34��[+4^�� ����4X6�� $' - � 6���� � � 62+G* 1 6 $ + $ 4 O � �0* & * y � �7�¢�5))$ +2* 14O �6* 1[1 � &2&6 $ 6���� � ./-34��[+4K Q $ +�� PR$ +=3U* OkO �,^ PR$ +J* O/O�" + $ Z0*SZ�. O . & 62. 1 "�$'O � 4 $ 3F./* O \ 6G.k3!� P *,3�. O .$� & $,P� +2.74�-l3U* 1 ��.84�� &�� � i)� ^;6����4+�� �4�#. & 6 & *?4��[- O .k-'./Z O � PR 4 1 62. $ 4 � 5��C &2 �1 �X6��0*Y6

�[;�+�� 5Z¤� R � YCBt 7U5 � i C�V � 5 � YC�~ � i 5Z¤�YC � � � �K���;�+�� 5Z¤�R � YCBt 7F5U� i C�V V !7698;:=<">"? ��@ � 5U� i C �� � i 5�¤�YC � � � �K����� � 5��C

b �

Page 49: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

Q $ +�� & 6G+ $ 4�- O �,^ O ��6m5 � 5�� C=C E��B4 $ 6��-6���� & �.L ��4U6G. * O/O � 1[$ 3 "�$'& �4E & .k-34��[+ " + $ 6 $M14$'O ^M.HK �SKk^6���� " + $ 6 $M14$,O 6��0*Y6 +�� " � *L6 & 6���� & ./-34��4+�� &c" + $ 6 $M14$,OM& �.L ��4 62. * OkO ��(j.=6���6���� *,E$���4+ & *,+ � � 4U62. O 6���� *,E �%�4+ & *,+1� & 6 $'"�& .76 K�S ��6<6���� & �.L ��4U6G. * O/O � 1[$ 3 "%$'& �4E � � 6G+2* 1 6 $ +Q5 V ��@ � 5�� C2CDZ��E�� �54��[E�*940* Ok$ - $' �&=O �,K�� � +��.L ./+���6���� PR$,O/O/$ (j.74�- � : $ +�* O/O0" + $ Z0*,Z�. O . & 6G. 1Q"%$,O � 4 $ 3�. * O]\62./3�� P *,3F. O .�� & $SP � +2.74�- 3U* 1 �#.84�� & � � i � ^@6����4+�� � �!. & 6 & *X4��[- O .k-'./Z O � PR 4 1 62. $ 4 � 5�#C&= �1 � 6��0*Y6

�[;�+��k5�¤ R � YCBt 7F5U� i C V;5 � 5 � YC=C�~ � i 5�¤&YC � � � �K���;�+��k5�¤&R � YC�t 7F5U� i C V;5 V !7698;:=< >"? ��@ � 5U� i C2C �� � i 5Z¤�YC � � ���K�[��� � 5��C

R 6m. &�1[O � *S+K6��0*L6 �& .74�- -��B4��4+G* O 6 ( $g\ " *,+A6�� 14$ 3 "� 6 *Y62. $ 4 6��0*Y6 62. O .���� & * 3 6 * OkO � .84 \E�� " ��4�E��B4U6J*94#E'� � 6G+2* 1 6G*,Z O � 14$ 3F3�.7623!��4 6 &=1 ���43���PSASAQ��}�B�?�H^ 6��#. & " + $ 6 $!1[$'Oi1 *94�Z���.k3 \"�O �43��B4U6(�[E PR$ +j*Y4�� 14$ 3 Z#.840*Y62. $ 4 $SP * & .k-340*Y6 +�� &=1 ���43��m(j.76�� * 14$ 3�3�.76G3��B4U6 &21 ���[3!�SK"1e£�P� 6 0 psoqp`t�p 2 v 2���z�� 2 }�� 0¢� � , �Y} )�0 �¢� ) .Sy�0 .{z<�90¢� 2�� , v �$, 0.y � �¢� 0 ,~� .") 2�� 0 � 0¢��� )�x 23.� �7� � � � , �¢�`� � 23, .{�7� 0 v ."23, 2m��2�� ��� , � , � )%y � �¢� ) .��2�

¤ ."2 2"xV� � ��. &mPR$,O/O/$ ( &6P + $ 3�6���� & � 1[ +2.=6�� " + $," �[+:6G.�� &m$,P 6���� & ./-340*L6 +�� &21 ���[3!�SK � .74 1 �S6����*,E �%�4+ & *,+ � 1 *94;4 $ 6)E�. & 6G.84#- . & � ( ����6����4+ ���j. & 6G* O5� .74�--6 $ 6���� �4� 6G+G* 1 6 $ +'V $ + 6 $ 6����e* 1 6 * O& .k-34��[+ � ^ ���l. & & �& 6J* &�O . � � O �X6 $ $' 6 "� 6J* PR$ +=-��4+ �N( ����4�6G* O5� .84#- 6 $u� * & ( ���B4 6 * O5� .84�-6 $ V�K�I 6�. P ��� $, 6 "� 6 & * PR$ +=-��4+ �f( ����4�6G* O5� .74�->6 $ VF^ 6���*Y6�� & * E�./+�� 1 6 PR$ +2-%�4+1� $ 4�6����& .k-340*Y6 +�� &=1 ���43��,K

"��Z���Z� � /�( *" �� ����C+E4'���( �P����#%� ��� *[/1 �(,+a(�� ��4� � " + $'"�$'& � 6���� PR$'O/Ok$ (j.74�- Z0* & . 1 *Y4 $ 4 �M3 $' #&e1 +��[E��B4U6G./* OD& � & 6(�43 �

������ � ��� "� Z O . 1 " *,+G*,3���6��4+ & PR$ + 6���� & � & 6(�43 . & 6���� & � 14 +=.76�� " *,+G*,3���6��4+c� i ^#*94�E�* "� Z O . 1� ���D¤��I $SP * 14$ 3F3�.7623!��4 6 &21 ���[3!�SK

� _�e��fk`i kYl|k7684~k���6+l|kQnMi � ��� �& �[+ � 1 � $!$'& � & * & � 1 +��P6 � ��� � �iK� � ��p?k~i�kQlmk}684`k���6+l|kQn i � ��� $ +=- *94�.�� *Y62. $ 4?� 1 � $M$'& � & * & .k-340*Y6 +�� � ��� " *,./+ #& .84#- * O - $ +=.76���3

7 *Y4�E "# Z O . & ��� & .76 &Q"# Z O . 1 � � �^¤& �cK������������� 5���R7� CfF & �4+ � PR$ +=3 & * 14$ 3F3�.7623!��4 6 6 $ ���[+ & � 1 +���6 � � � ��������� ����� 5QI � R>|,CL^

& �B4�E & .76Z6 $ 6���� $ +2-'*94�.��4*Y6G. $ 4 � *94#E " + $ ��� & 6��0*L6 & ��� � 4 $ ( & 6���� �S* Ok � 14$ 3F3�.76:6(�4E6 $ K �-4 1 �,6���*Y6). & E $ 4��S^ � *94�E�� Z $ 6�� & 6 $ +�� ��* & �J� &)"�& � E $ 4 �M3 (j.76��=�FK � * O/&=$1 +�� *L6(� & * +G*94#E $ 3 .kE��B4U6G. P �M.84�-�6G*,- PR$ +C6���� "�& � E $ 4 �!3 ^ (K

�"!����$#%�"&(' 5���R7�cR7��C<F & �4+ � *94�E $ +2- *94#.�� *L6G. $ 4�� + 4U* " + $ 6 $M14$,O�PR$ + & � 1[ +�� O � & ./-34�.74�-J*1[$ 3F3�.76:6(�[E �S* Ok �,^S* & E����54��[E .84 � � 1 6G. $ 4 � K �!KX�'^ $ 4 14$ 3�3 $ 4�.74 "� 6 5Z¤� �jRV¤ YI R���CL^*94#EX6���� 14$ +=+�� &="%$ 4�E�.84#- " +2.��S*Y6���.84 "# 6 & K1F & �[+ & 6 $ +�� & ��. &e$, 6 "� 6jWcK

b R

Page 50: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�%& � ���"��#%� &(' 5A��R_B�R7�cR�� C<F & �4+ � ( � $ �0* &l" +�� �M. $' �&=O � .74 "� 6 ��. & "�& � E $ 4 �M3 � .74U6 $ *+ �4,�.0/�12�43 5 5E�cR7��C]6G+2*94 & * 1 62. $ 4 ^�*94�E $ ZQ6 *S.84��[E W ^ PR$ +23 & * 14$ 3�3F.=6G3��B4U6

� � � ���������X5Z¤�R�I ��R>|'C6 $ ��. & & � 1 +���6 � ���!I � K F & �4+ � *Y4�E ���4+=.�� �[+ B .84 � $ � �^6���� " + $ 6 $!1[$'O 5`=�R_B�C PR$ +" + $ �!.74�- � 4 $ ( O �[E�-�� $SP * & .k-340*Y6 +�� $ 4 * 1[$ 3�3F.=6F6(�[E �S* Ok �,^ $ 4 14$ 3�3 $ 4 .74 "� 6 &5�¤& �jR{¤&�I R ��C^0*94�E �& �4+�� &e" +2.��,*L6(��.84 "� 6�5QI ��R>||RGWXCLK

�%& � ���"��#%� &('�� � ����� 5A��R_B�R7����R7� � R7��C F & �[+ � ( � $ �0* &D" +����M. $, �&2O �6.84 "� 6 ��. & "�& � E $ 4��M3� � .84U6 $ * + �-, .0/�1 � 365 5�� �jR7� CC6G+2*94 & * 1 62. $ 4 ^T*94�E $ ZQ6 *,.74��4ENWc^ *94#E ���[+2.����4+�Bl^%(j.76��( � $ 3 � �0* & � & 6 *SZ O . & ���[E "�& � E $ 4 �M3 ��� � �����������D5�¤� I R�I � R>|,CL^d+ 4 6���� " + $S\6 $!1[$'O 5~=�R_BJC PR$ + " + $ �!.74�- � 4 $ ( O �4E#-�� $,P * & ./-340*L6 +�� $ 4 * 1[$ 3�3F.=6F6(�[E �S* O/ �,^ (j.76��1[$ 3F3 $ 4 .74 "� 6 & 5�¤� �jRV¤ �IjR7���XC^_*94�E �& �[+�� & " +2.��S*Y6���.84 "# 6�5QI � R3|�R2WXCLK

� � l`a���l�� ��� & *,3��l* & .84�6���� ./E��4* Oc& � & 6(�[3 � �-4 1 �F* 62+G*94 & * 1 62. $ 4Y. &614$ 3 "�O ��6(�[E ^X* �& �[+$' 6 "� 6 & 6�����40*,3�� $SP 6�����62+G*94 & * 1 62. $ 4�& �& 6 1[$ 3 "#O ��6��4E ^d*94#E 6����>40*S3!� $,P 6���� $ + \- *Y4�.��4*Y6G. $ 4 .76Q( * &e14$ 3 "�O �P6(�[E (j.=6�� ^_*94#Ef. P .76Q( * & *��%�4+=.�� 1 *Y6G. $ 46G+G*Y4 & * 1 6G. $ 4 ^;6����B4* Ok&2$ 6���� 40*,3�� $,P 6���� 1 +��4E��B4U6G./* O \ -'+G*94U62.84�- $ +=- *94�.�� *Y62. $ 4"V_*Y4 $ +=- *94�.�� *Y62. $ 4 $' 6 "� 6 && �& 6�6����40*,3�� $,P 6���� 6G+G*Y4 & * 1 6G. $ 4 *94�E 6���� ./E��B4U6G. P �!.74�- 6G*,- ( $,P 6���� "#& � E $ 4 �M3(j.=6�� ( ��. 1 ��6���� 62+G*94 & * 1 6G. $ 4�( * &e14$ 4#E �1 6��4E K

"��Z��� " � ��2]& '&^(��� ����K*Z�9+R\4 $ +2E��[+�6 $ & � $ ( 6��0*Y6 $' + " + $'"�$'& �[E Z0* & . 1 1 +��4E���4 62. * Oj& � & 6(�[3 1[$ 4 PR$ +=3 & 6 $ 6����f.kE�� * OPR 4 1 6G. $ 40* O .76�� &2" � 1 .�� 1 *Y6G. $ 4�-'.����B4�.74 � � 1 6G. $ 4 � KX�'K �!^T("� 3 �& 6�� � ��./Z#.76m* & ./3 �O *Y6 $ + � K R\46��#. &l& � 1 6G. $ 4 ^)( � E�� &=1 +=./Z�� &= �1 � * & ./3 �O *Y6 $ + *94#E -'.����f* &1� �P6 1 � $,P * " + $M$,P 5R.76�. & $ 4 O �* &9� �P6 1 � Z�� 1 * �& ��6���� " + $M$,P . & 6(�4E#. $' �& *94#E & 6G+G*S./- �U6 PR$ +=( *,+2E_C PR$ +m( � ��6���� & ./3 #O *Y6 $ + . &14$ +2+�� 1 64K

� ��� & ./3 �O *Y6 $ +c+�� " +�� & ��4U6 & 6���� *,E ���[+ & *,+1� \ 1[$ 4U6G+ $'O/O �4E " *,+:62.$� & 6 $ 6����e./E��4* O�" *S+:6G.�� & ^!*Y4�E6����J.kE�� * O " *,+A6G.$� & 6 $ 6����J*,E$���4+ & *,+ � \ 14$ 4 62+ $'OkO �[E $ 4�� & K

� ��� & ./3 �O *Y6 $ +�(j. O/O E $ 6���� PR$'O/Ok$ (j.84�- �

h�� � " +�� & �B4U6G.74�-�*SE ���[+ & *S+1� \ 1[$ 4U6G+ $,O/O �[E #& �4+ & 6 $ 6����,R � *94�E�./E��4* O�$ +=- *94�.�� *Y62. $ 4 & 6 $ 6����*,E$���4+ & *,+ � \ 14$ 4 62+ $'OkO �[E �& �4+ &��

� � ��� & ./3 �O *Y6 $ + -���4��4+2*Y6(� & "� Z O . 1�� ��� &jPR$ +Q./E�� * O $ +2- *94#.�� *L6G. $ 4 & K� � ���B4 *94 *,E$���4+ & *,+ � \ 14$ 4 62+ $'OkO �[E �& �[+ .84#.76G./*Y6(� & * �C� ����� � ^ 6���� & ./3 �O *Y6 $ + �4� \62+G* 1 6 & ��. &j& � 1 +���6 � � �fIXK R P 6���. &Q& � 1 +���6 � � � �0* & 4����%�4+ Z ���B4 & ����4NZ�� PR$ +��,^;6����B46���� & ./3 �O *Y6 $ + 1 +��4*Y6(� & * 4��[( O/$ -,.84�40*,3�� � *94#E & �B4�E & .76 6 $ 6�����6G+ �& 6��4E" *,+:6��,K � ��� 6G+ #& 6(�[E " *,+:6�� & �P6 &� �" * " * &2& ( $ +=E PR$ +�6���. & �& �4+m*94�E 1[$ 4U6 * 1 66����Q./E�� * O!$ +2- *Y4�.��4*Y6G. $ 4�6 $�& ��6 �" * "�& � E $ 4 �!3 � K � ��� & ./3 �O *Y6 $ + & 6 $ +�� & 6��0*L65YI�Rd��R DR;5E�cR7��CLK R P I ��* & Z ���B4 & ���B4 Z � PR$ +��S^Q6����B46���� & ./3 #O *Y6 $ + �& � & 6����m* O \+�� *,E$� � �!. & 6G.74�- Ok$ -'.84�40*,3�� � *94�E " * &2& ( $ +=E( ^�*94�E $ 4 1 �-6���� "�& � E $ 4 �!3 �. &j& ��6 �" ^_*,E�E & 5�� R7� C 6 $ .76 & +�� 1[$ +2E $ 46���� � ���fIXK

�;�

Page 51: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ���B4 *94 *SE ���[+ & *S+1� \ 1[$ 4U6G+ $,O/O �[E �& �[+ .84#.76G./*Y6(� & * + �-, .0/�1 � 365 $ 4 "#& � E $ 4 �M3� ^ 6���� & ./3 #O *Y6 $ + + 4 & 6���� �4� 6G+G* 1 6 $ + $,P 6���� & .k-34�.84#- $ 4f* 1[$ 3�3F.=6F6(�[E �,* O/ � &" + $ 6 $!1[$'O � .=6 �0+ & 6 $ ZQ6 *S.84 & IX^;6����B4f.84�.=6G. *L6(� & * + �-, .0/�1 � 365 (j.=6�� � 6���+ $' - ��6����62+ �& 6(�[E " *,+A6���MJ^!*Y4�E�6����B4 $ 4 1 � M 4 $ 6G.�� � & 6���� & ./3 #O *Y6 $ +[6���*Y6 6���� 1 +��4E���4U6G. * O��* & Z�����4N-'+2*94U6(�[E ^56���� & .k3 �O *L6 $ + 1[$ 3 "� 6(� & 6���� & .k-340*Y6 +�� $ 4 IY*94�E��54�. & ��� &6���� 14$ E�� $,P 6���� � � 62+G* 1 6 $ +[K

� � ���B4 *94 *,E �%�4+ & *,+1� \ 14$ 4U6G+ $'O/O �4E �& �4+�.84#.76G./*Y6(� & * B�3���D F-�G12�43 5 ^Z6���� & .k3 �O *L6 $ +�4� 6G+G* 1 6 & ��. &Q& � 1 +��P6 � ���fIN*94�E�.84#.76G./*Y6(� & B�3C�ED F-�G12�43 5 .84 6����m./E��4* OT& � & 6(�[3 �& .74�-6������S* O/ � & 5 ��R DR;5E�cR7��C2C 1[$ +2+�� &2"�$ 4�E#.84�-S6 $ 6���� � ���fIXK

h�� � " +�� & �B4U6G.74�-�*SE ���[+ & *S+1� \ 1[$ 4U6G+ $,O/O �[E $ +2- *94#.�� *L6G. $ 4 & 6 $ 6����,R � *Y4�EF.kE�� * O� �& �[+ & 6 $ 6����*,E$���4+ & *,+ � \ 14$ 4 62+ $'OkO �[E $ +=- *94�.�� *Y62. $ 4 &��

� � ���B4�M 1[$ 4U6 * 1 6 & � PR$ +Q* �C� ����� � ^ 1 +�� *L6(�m* 14$ 3F3�.7623!��4 6 � $ 4 * +G*Y4�E $ 3�S* Ok �EIf*94�E + 4 ��������� � (j.76�� 6����m*SE ���[+ & *S+1��� &j$ +=- *94�.�� *Y62. $ 4 �& .84�-�� K � � \&="%$ 4�E 6 $ 6���� 62+ �& 6(�4E " *,+A6��6 $ � & 6G*,Z O . & ��6����J./E�� * O]\ ( $ + O E "�& � E $ 4 �M3 � PR$ +6����J*94 $ 4 �M3 $' �&j �& �[+4K

� � ���B4TM 1[$ 4U6 * 1 6 &E� PR$ + * + �4,�.0/�12�43 5 5�� R7� C^ ( ���[+�� � . & 6���� ./E��4* O \ ( $ + O E"#& � E $ 4 �M3 6��0*L6 14$ +2+�� &2"�$ 4�E & 6 $�"�& � E $ 4 �!3 � ^c+ 4 6���� + �-, .0/�1 � 365 5�� R7� C(j.=6���6����Q*,E �%�4+ & *,+=. * OkO � \ 1[$ 4U6G+ $,O/O �[E $ +2- *94#.�� *L6G. $ 4��K<R P � . &2&= � & * �S* Ok � W &2 �1 �6��0*Y6j<#>'? �;@BA `'a

�5QI�RGWDCL^;6����B4X4 $ 6G. P � M 6��0*Y6,6���� 1 +��[E��B4U62. * O . & -'+G*94U6��4E K

� � ���B4 M 14$ 4U6 * 1 6 & � PR$ +j* B�3C��D F-�G1 � 365 5 B�R�� R7� C^ PR$ +=3 *�+2*94�E $ 3 14$ 3�3�.76G3��B4U6��*94�E�.74 � $-� ��6���� & ./3 #O *Y6 $ + PR$ +�6���� ���[+ $S\=� 4 $ ( O �4E#-�� " + $!$,P $SP � 4 $ ( O �4E�-%� $,P* & .k-340*Y6 +�� $ 4 6���� �S* Ok � 14$ 3�3F.=6F6��4ET6 $ .84 �lK 5 O $ 6(�6��0*Y6=� 3U* � Z�� *94*SE ���[+ & *S+2. * O/O � 1[$ 4U6G+ $,O/O �[E $ +=- *94�.�� *Y62. $ 4T^ &=$ .76�3U* � Z � 4�� 1 � &2& *,+1� 6 $NP * � � 6����" + $M$,P K C

� � ���B4 M 1[$ 4U6 * 1 6 & � PR$ +J* B23���D F-�G1 � 365 5 B�R7� � R�� R7��CL^D( ���4+���� � . & 6����F./E��4* O \( $ + O E "�& � E $ 4 �!3 14$ +2+�� &2"�$ 4�E�.74�- 6 $ 6�����+�� * O]\ ( $ + O E "�& � E $ 4 �!3 ����^�.84 � $-� �6���� & .k3 �O *L6 $ + PR$ +C6���� ���4+ $S\�� 4 $ ( O �4E�-�� " + $!$SPi$SP � 4 $ ( O �4E�-�� $,P * & .k-340*Y6 +�� $ 46������S* O/ � 1[$ 3�3F.=6F6(�[E 6 $ .84 ��� K

R P * "�$'O � 4 $ 3F./* O \ 6G./3�� V�E�. & 62.84�- . & ��� & Z �P6 ( ���B4 * & ./3 �O *Y6G. $ 4Y*94�E ��� ^<6����B4 .=6�E#. & \6G.74�- . & ��� & PR$ +�*Y6 O �4* & 6 $ 4�� $,P 6���� & � & .k3 �O *L6(�4E�62+G*94 & * 1 62. $ 4 & ^ Z � * & 6G*94�E0*,+=E � �MZ�+2.kE*,+=- 3��B4U6 � ( � 1 *Y4 + 4 * � �!Z#+2./E & � & 6��43 .84 ( ��. 1 �H6���� ��+ & 6 & � ���[+G* O 6G+2*94 & * 1 6G. $ 4 & *,+��+��4* O \ ( $ + O E $ 4�� & ^_*94�E6���� 62+G*94 & * 1 6G. $ 4 & PR$'OkO/$ (j.84�- 6����[3 *,+�� �& .74�-S6�����.kE�� * O%& � & 6��43 & *Y4�E6���� & ./3 #O *Y6 $ +4K

� ���4+��J*,+����[./- �U6 1 * & � & PR$ + 6����-6G+2*94 & * 1 6G. $ 4 6��0*Y6Q. & E�. & 6G.74�- . & �0*,Z O �,K<R\4 * O/O Z 6Z6 ( $ $,P6����43�5 B�3C�ED F-�G12�43 5 $ + B�3C�ED F-�G12�4365 � .�2� � Z �P6 ( ���B4Y*UE#. & � $ 4�� & 6 �& �4+�*Y4�E�*94 � $ 4�� & 6 $ +2- * \4�.�� *Y62. $ 4 ^B( ���[+�� 6���� 1 +��[E��B4U6G./* O . &2&2 �4+Q. & * O/&=$ � $ 4�� & 6C^�E�. & 6G.74�- . & ��.74�- * +�� * O 62+G*94 & * 1 6G. $ 4P + $ 3 6���� & .k3 �O *L6(�4E $ 4��U*,3 $' 4U6 & 6 $ �[.76����4+JE�. & 6G.84#- . & ��.84#-f* " + $ �%�4+ P + $ 3 * & .k3 �O *L6 $ +.84f* ���4+ $S\�� 4 $ ( O �4E�-�� " + $!$,P ^ $ +eE#. & 62.84�- . & ��.84�-�**���[+2.����4+ P + $ 3 * � 4 $ ( O �[E�-�� �4� 6G+G* 1 6 $ + .74* " + $M$,P)$,P � 4 $ ( O �4E#-��,^ $ +�E�. & 6G.74�- . & ��.74�- * & .k-34��[+ P + $ 3 *94 � � 6G+2* 1 6 $ +m.84 * " + $ 6 $!1[$'OiPR$ +& .k-34�.74�-l* 14$ 3�3F.=6F6��4E �S* O/ �,K OkO & � ����4 O �4*,E6 $l& 62+G*,.k- �U6 PR$ + ( *,+=E 14$ 4U6G+2*,E�. 1 6G. $ 4 & K

�B�

Page 52: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�! �"�"�$'& ��6�����*,E ���[+ & *,+1�YE�. & 62.84�- . & ��� & ( ���P6����[+ B�3���D F-�G12�43 5 . & + 4�(j.76�� *�+��4* O \ ( $ + O E$ +=- *94�.�� *Y62. $ 4 $ +�(j.=6�� * & .k3 �O *Y6 $ +[KeI 6 .=6 E $ � & 4 $ 6�E�. & 6G.84#- . & ��*94!�4� 6G+G* 1 6 $ + P + $ 3 *J+�� * O$ +=- *94�.�� *Y62. $ 4 K � ���[+�� PR$ +��S^M.=6�3 �& 6 E�. & 6G.74�- . & � Z�� 1 * �& �j.=6 &2 �1[1 ���4E & .84 " + $ �M.74�- � 4 $ ( O �4E#-��$,P * & ./-340*L6 +�� $ 4�* �S* Ok �aI�6��0*Y6 ��* & 4 $ 6 Z ���B4 & .k-34��[E KBI 6C6����B4 ("� & �P6 �" *�+��4E �1 6G. $ 4P + $ 3 6���� & ./-34�*Y6 +�� &21 ���[3!�SK

"��Z����� #w*"(+ ���(£( *"�� /1��#���� �*"���� + � ��/1 \+a(+*[(� ����� X 1 .$��4 1 � $,P 6���. & Z0* & . 1 1 +��4E��B4U6G./* OT& � & 6(�[3 E�� " ��4�E &Q$ 4 6���� � X 1 .$��4 1 � $,P .76 & Z . O E�.84�-Z Ok$!1��B& K R 6 . &�1[O � *S+�6��0*L6�6���. &�& � & 6(�[3 1 *94 Z�� 1[$ 4 & 62+ �1 6(�[E P + $ 3 *Y4�� $ 4�� \ ( * � PR 4 1 6G. $ 4 �& .84�-X6���� PR$'O/Ok$ (j.74�- ("� O/O]\�� 4 $ (,4 P * 1 6 &�� 5U� C �%� :�� ; � ����R S S RURK� Ve5 �'C�; � ��� & � \14 +�� 14$ 3�3�.76G3��B4U6 �MO * $ R���� Vm5 � C � � :�� & � 1[ +�� & .k-340*Y6 +�� & � � $ 3 R��m� VQ*94�E 5 b C�OE; 'N K ; � K � � Q � �h¦ ZB� ^X( ���4+�� N K ; � K E���4 $ 6(� & 6���� 14O * &2&m$,P O *94�- *,-�� &�PR$ +6( �#. 1 � 6����4+��� �!. & 6 ���4+ $S\�� 4 $ ( O �[E�-�� " + $M$,PR&�$,P � 4 $ ( O �4E�-%� $,P *f(j.=6 4�� &2& K� $ ("�����[+4^ - $ .74�-f*,Z $, 6 .=6�.746��#. & ( * �,^_.76 4 &= .76G*,Z O � PR$ + " +G* 1 6G. 1 * OT �& �SKR\4 � �0* " 6��4+ b ^,( �Q-,.���� *94*�YX 1 .$�B4U6 & ./-34�*Y6 +�� &=1 ���43��,^36 $ -���6����4+i(j.76�� *94*�YX 1 .��B4U6 1[$ 3 \

3�.76G3��B4U6 &=1 ���43���*94�E�YX 1 .��B4U6 " + $ 6 $!1[$'O/& PR$ +j. &2&2 .84�-�* & .k-340*Y6 +�� $ 4f* 14$ 3�3F.=6F6��4E �S* O/ �*94�E PR$ + " + $ �!.74�- � 4 $ ( O �4E#-�� $SP * & .k-340*Y6 +�� $ 4 * 14$ 3�3�.76F6��4E��S* Ok �,K I � G��YX 1 .��B4U6 ^ ON("�3�� *94�6��0*Y6 6���� 1[$ 3F3 4�. 1 *Y6G. $ 4 14$ 3 "�O � �!.76�� . & - $ .84�- 6 $ Z�� O .84��4*,+ .84?6���� & � 14 +=.76�� " *,+G*S3 \��6��4+[^ *94�EX6���� 14$ 3 "� 6G*Y6G. $ 40* OkO ��( ��(j. O/O +��.L .k+�� * 14$ 4 & 6 *Y4 6K4 3 Z��4+ $SP \ Z#.76 *,+2.=6���3���62. 1$'" �4+2*Y6G. $ 4 & 5 &= �1 ��* & 3 $ E �O *,+ � � "�$ 4���4 62. *Y62. $ 40C " �[+C6G+G*Y4 & * 1 6G. $ 4 K

��� � � � � � � ��� � � ����� ����� >���� ��� � � ������ B� � � �� �-� �c� � �

R\4>6���. & & � 1 62. $ 4T^M("� �4� "#O *,.74 � $ (�6 $ �4� 6(�B4#E 6����eZ0* & . 1e1 +��4E���4 62. * O_& � & 6(�[3 " +�� & �B4U6(�[E�*,Z $ �%�6 $U" + $ �M./E���*,E�E�.=6G. $ 40* O E�� & .k+G*,Z O � P �4*Y6 +�� & K � ���&�4� "�$'& .76G. $ 4N.74 6��#. &e& � 1 6G. $ 4�. & ��./- � \ O ����� O ^Z�� 1 * �& � 6���� Ok$ ( \ O � ��� O E���6G*,. Ok& *,+�� & 6G+G*S./- �U6 PR$ +=( *,+2E K

"�� "���� �����#%������*"/1 �� �����  / � *"��R 6�. & ���[+1�FE�� & ./+G*SZ O �Z6 $ Z � *,Z O �Z6 $ +���� $-� �6* 1 +��4E���4U6G. * O K R\4�6���� *94 $ 4 �M3 $' �& & ��6:6G.84#-�^BE $ .84#-&2$ . & 6G+=. 1�� �J*94�EJ.84U62+ $ E �1 � & *Y4 � � 62+G* 1[$ 3�3 4�. 1 *Y62. $ 4m*94#E 1[$ 3 "# 6 *Y62. $ 4 $ ���[+����4*,E K � �)E $4 $ 6 � 4 $ ( � $ (�6 $ E $ 6��0*Y6 P + $ 3 6���� -���4��4+2* O * &2&= 3 " 6G. $ 4 &)$,PD14$ 3F3�.7623!��4 6)*Y4�E & ./-340*L6 +��&21 ���43�� & K � ��*SE�E�+�� &2& 6���. & . &=&2 �mZ ��.84U6G+ $ E �1 .74�- E � 40*,3�. 1 * 1[14 3 �O *Y6 $ + & .74 � �0* " 6��4+ �!K

����� � �!� �^� � ��� �� � �[� � � ��� � � � ����� � � ��� � �"!$# �[� � � �%!�^�-� �c� �� B�

�! �"#"%$'& ��("� �0* �%� * & ./-34�*Y6 +�� &=1 ���43�� PR$ + & ./-34�.74�-�*FZ Ok$!1�� $SP 3!� &2& *,-�� & K � ���B4�E#. � �4+���4U6" *,+A6 & $,P 6���� & ./-34��[E�3�� &2& *,-�� 1 *94 & �4+ ��� E�. � �[+���4 6 PR 4 1 6G. $ 4 & K,R\4 � ��* " 6(�[+ b ^ � � 1 6G. $ 4 b K b ^("��-'.����m* & .k-340*Y6 +�� &=1 ���43�� $SP 6���. &�� .84#E K

: $ + � �#*,3 "�O �S^ . P 6 �"�O � &)$,P 6���� PR$ +23 5 � R'&MC 1 *Y4UZ�� & ./-34��4E ^B( ���4+��(&�. & 6���� �4� " ./+G*L6G. $ 4E0*Y6�� $,P * 1 +��4E���4 62. * O ^ $ + &2$ 3!� $ 6����[+l*Y6F62+2./Z 6(�S^ 6�����4 .74 $ +2E��4+�6 $ E��43 $ 4 & 62+G*Y6�� 6��0*L6l*

� �

Page 53: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

1 +��4E���4U6G. * O �0* & 4 $ 6�� � " .k+��4E *Y6 6G./3�� (^#.76Q. & &2 X 1 .$��4 6,6 $ " + $ ��� � 4 $ ( O �[E�-�� $,P * & ./-340*L6 +��$ 4 *S6 �"�O ��5 � R'&MC�( ���[+�� & � (KR\4 $ +2E��4+>6 $ 1 +�� *Y6�� & .74�- O � \ #& � 1 +��[E��B4U62. * Ok& ^j. P 6 �"�O � &U$SP 6���� PR$ +23 5 � R���C 1 *94 Z��

& .k-34��[E ^i( ���[+�� � . & *X4 $ 4 1 �,^@6�����4 .84 $ +2E��4+ 6 $N& � $ ( * & .84�- O � \ �& � 1 +��4E���4U6G. * O ^ 6���� �& �[+1 *Y4f+������4* O 6���� 4 $ 4 1 �"� *94�E " + $ ��� � 4 $ ( O �4E#-�� $SP * & ./-340*L6 +�� $ 4 5 � R7�NCLK � ���B4 . P 6���� �& �4+e*Y6F6��43 " 6 & 6 $� #& � 6���� 1 +��4E���4U6G. * O * & � 1[$ 4�E 62./3��,^ 6���. &Q1 *94 Z �mE��P6(� 1 6(�[E K

4 � ���B4 Z���6:6(�[+ &2$'Ok 6G. $ 4 PR$ + & .84�- O � \ �& � 1 +��[E��B4U62. * Ok& ^M. & * &�PR$'OkO/$ ( &�� 6���� #& �4+ $ ZQ6 *S.84 & *& .k-340*Y6 +�� $ 4 5 � R�� !_R7� f CL^�( ���4+�� � R7� ! '���� PR$ + &2$ 3!� " +2./3�� 4 3 Z �[+��D^ *Y4�E � f . && �& 6 &2$ 3�� +2*94�E $ 3 .kE��B4U62.�� �[+ PR$ +@6���� 1 +��[E��B4U6G./* O K � ��� �%�4+2. P �M.84�- $ +2- *94#.�� *L6G. $ 4 & �B4�E & 6 $ 6���� �& �4+ *6+G*Y4�E $ 3 �S* O/ � j '����gK � ��� �& �4+�+������4* O/& 6���� �S* O/ � & � j � %�� ! 3 $ E��*94�E�� f ^*94�E " + $ ��� &�� 4 $ ( O �4E�-%� $,P * & .k-340*Y6 +�� $ 4Y5 � R7� !�# � f C &2 �1 �6��0*Y6 � j � %*�5!c3 $ E�DK 4 $ +2- *94#.�� *L6G. $ 4�6��0*Y6Q* 141 � " 6 & 6���� 1 +��[E��B4U6G./* O ^M(j. OkO�& 6 $ +��K6���� 1 +��4E���4 62. * O +�� 14$ +=EY5�� f R j R LC.84 * "� Z O . 1 *S+ 1 ��.����,K R P 6���� �& �4+ ���%�4+e+ 4 & 6���� 1 +��[E��B4U62. * OD& � $ (j.84�- " + $ 6 $M14$'O *S- *,.84T^ 6����B43 $'& 6 O . � � O � ��� (j. O/O +�� 1 �[.���� 1 ��* O/O �B4�-�� j *94#EU(j. OkO ��* �%�K6 $ +�� &="%$ 4�E (j.76�� � j � % � !L^*94�E�� f K � ��\ O .84��,^ 6���� $ +2-'*94�.��4*Y6G. $ 4 1 *94 O/$M1 *Y6���6���� 1 +��4E��B4U6G./* O +�� 14$ +=E Z � & � *,+ 1 ��.84#- PR$ +� f ^�*94�E &2$'O ��� PR$ +C6������S* Ok � � Z�� &=$'O �M.74�-�6���� & � & 6(�[3 $SP O .84��4*,+ �.L *L6G. $ 4 & K

� ��. & 3���6�� $ E PR$ + " +�� ���B4U62.84�- E $' Z O � \ &2" �B4�E#.84�-�( * &l$ +2.k-'.840* O/O � " + $'"�$'& �4E Z�� � 6(� P *94I +2*94�E & K � �m+�� P �4+Z6����m+�� *,E��[+Z6 $ ��. & E�. &2& �4+:6G*Y6G. $ 4 �PI +G*UR R� K

" ������� .h#%����� *��3+�����/�(+��# � ���0����+� *[��(: $ +�6���. & & � 1 6G. $ 4 ^T* &2&= 3!� 6��0*Y6 ( � *,+���(j.=6���.74�* "# Z O . 1L\=� ���f.84 P +G* & 6G+ #1 6 +�� 5`; K R CK � �0*L6. & 6 $�& * �,^ �����[+1� 5 "%$ 6(�B4U62. * OkO � *94 $ 4��M3 $' �& C �& �[+ .84 6���. &�& � & 6��43 ��* & *94 .kE��B4U6G.=6�� *Y4�E *"� Z O . 1�� ��� 1[$ +2+�� &2"�$ 4�E#.84�-S6 $ 6���. & ./E��B4U6G.=6��'K

�cnMi";����:6 i�_ � e7��6 = k}4~kYlJIO $ 6(�-6���*Y6j.84 $' + & � & 6(�[3f^;6����m./E���4U6G.76�� 14$ +=+�� &2"�$ 4�E & 6 $*� 4 $ ( O �[E�-�� $,P * & � 1 +��P6 � ���'K � ��. &. & 6���� & *,3!��* & .84f*94 � "# Z O . 1L\=� ����.74 P +G* & 6G+ �1 6 +��SKZR P 6���� & � 1 +���6 � ��� & .84�6���� 6 ( $ *,+�� 6����& *S3!�S^;6�����4N*94 � #& �4+j.74 $, + & � & 6��43 (j. OkOT1[$ +2+�� &2"�$ 4�EX6 $l&2$ 3!�J* 1 6 * O ./E���4 62.76��,KR\4 $ +2E��4+ 6 $ �B4 &= +�� &= �1 � * 14$ +=+�� &2"�$ 4�E���4 1 �S^ ("��3U* � � 6���� 1 �[+:62.�� 1 *Y6G. $ 4 * 6�� $ +=.76��

5 � C PR$ + 6����%; K R " *,+:6 $,PD$' + & � & 6(�43 K R\4 6�����; K R ^ 6���� & $ Z $,P 6���� � . & 6 $ �B4 &2 +��K6��0*L66���� & � 1 +��P6 � ��� 4�E��4+ O �M.84#-l* -'.��%�B4 "� Z O . 1 � ��� . & � 4 $ (,4 Z��>6���� " *,+:6��>6 $ ( � $'& �m./E���4 62.76��6���� "� Z O . 1 � ���N. & *Y6:6 * 1 ���4E K R\4^6���� 1 +��[E��B4U6G./* O & � & 6(�[3f^ 6���� & $ Z $SP 6���� � . & 6 $ ��4 &2 +��6���*Y6 $ 4 O � �& �4+ & (j.76�� �S* O ./E .kE��B4U62.76G.�� &Q" *S+:6G. 1 . " *Y6(� .846���� & � & 6(�[3fKR\4 $ +2E��[+�6 $�" *,+:62. 1 . " *Y6��U.84 *^4 $ 4 \ 62+G*94 &=P �4+2*,Z O � 1 +��4E���4 62. * O & � & 6��43 ^�* #& �4+ (j. O/O �0+ & 6

14$ 4 6G* 1 6 6���� � *94�EY+�� ���4* O ��. & ./E���4 62.76���*94�E "� Z O . 1 � ���¤� 6 $ 6���� � K � (j. O/O 6����B4PR$ +=3 * "�& � E $ 4 �M3 (j.76�� 6���� � ^DZ�* & �[E $ 4 ��. &�& � 1 +��P6 � ��� � 14$ +=+�� &2"�$ 4�E�.74�-X6 $ ¤& K � (j. O/O 6����B4 " + $ �%�-6��0*L6C6���� "�& � E $ 4 �M3 PR$ +=3!�[E 14$ +=+�� &2"�$ 4�E & 6 $ 6���. &�� K� ��� � (j. O/O. &=&2 �e* 1 +��4E���4 62. * O 6 $ 6���. &� �& �[+4^ 1 �4+A6G. P �!.74�- 6��0*L6 ��� �0* & *��S* O ./E .kE��B4U62.76��'KTS �P6 �& 1 * OkO 6���. & *G=+ $!$ 6 1 +��[E��B4U62. * O K O 4 � $ +=- *94�.�� *Y62. $ 4 6��0*Y6Q( *94U6 & 6 $ 6 * O5� 6 $l �& �[+ & (j.76�� �S* O ./E ./E��B4U6G.=6G.$� & ^(j. OkO +��.L � & 6K6��0*Y6Z6���� #& �4+ " + $ ��� "%$'&=& � &2& . $ 4 $SP * + $M$ 6 1 +��4E��B4U6G./* O K�-4�� 3F* � 4 $ 6(��6��0*Y64^ ���%�B4 6�� $' - � 4 $ ( ("� �0* �%� * �& �4+ .kE��B4U62.76�� *Y6F6G* 1 ���[E 6 $ �4* 1 �

6G+2*94 & * 1 62. $ 4 ^�("� & 6G. O/O E $ 4 � 6 ��* �%� 6���� " + $'" �4+A6��6��0*L6 6���� �& �[+ & E $ 4 � 6 & �0*,+�� 6����4.k+ 1 +��4E���4 \

���

Page 54: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

6G./* O/&�� * O/OD$ 4�� 4����4E & 6 $ E $ .84 $ +2E��4+,6 $ * O/O/$ ( $ 4�� � &jP +2.$��4�E 6 $U �& � $ 4�� � & 1 +��4E���4U6G. * O/& . &eO ��66���� P +2.��B4�EF-���6 � $'O E $,P 6���� & � 1 +��P6 � � � � *94�E &2$ 3�� $ 6����4+ .84 PR$ +=3U*L6G. $ 4 K � ��. & O ./3�.76G*Y6G. $ 4. & .84 ���4+���4U6 ^ & .84 1 �UE�.k-'.76G* O E0*Y6G* 1 *94 * O ( * � & Z �FE �"�O . 1 *L6(�4ETK $ ("���%�4+[^]6���. &J1 *94 Z � E#. & \14$, +G*,-%�4E�Z � 3F* � .84�-�6���� �S* O/ � � 26 $!$ �S* Ok *,Z O ��6 $ -'.��%�m* ( * �'K : $ + �4��*S3 "�O �,^��4* 1 � �& �[+3F* �UE�� "�$'& .76e*lZ�./-l*,3 $' 4U6 $,P 3 $ 4���� .84U6 $ 6����?; K R ^ &= �1 � 6��0*Y6 � 4 $ ( O �[E�-�� $,P 6���� & � 1 +��P6� � � � * OkO/$ ( & $ 4�� 6 $ (j.76��#E�+G* ( 6����m3 $ 4����,K

DYb�e7i l|kYlJIg;�n i";Sd e7� 6 i�b �?�|n�lmn � n<4 _� ��� 3!� 1 �0*94�. & 3 E�� &=1 +=./Z��4E *,Z $ ��� E�. &=14$' +2*,-�� & 1 +��4E���4U6G. * O%& �0*,+2.74�-�^BZ 6 E $ � & 4 $ 6 " +����%�B4U6.764K Q $ +�� $ ���4+[^ 6 ( $ �& �[+ & ( � $ 14$ 3 "�O ��6�� O �62+ �& 6��4* 1 � $ 6����4+ 5 PR$ + � �#*,3 "�O �S^ � �& Z0*94�EY*Y4�E(j. P � CQ*,+�� 4 $ 6eE�. &214$, +G*,-%�4ENZ � &= �1 ��*F3�� 1 ��*94�. & 3 *Y6 * O/O K � ���4+�� PR$ +��,^�.84 &21 ��40*,+=. $'& ( ���4+��.76 . & 1 + �1 . * O 6��0*Y6 6�����.kE��B4U6G.=6�� $,P * -'.�����4 #& �4+jZ��6E�. &214$ �%�4+��[E ^�*94�E6���� �& �[+Q. & " � � & . 1 * OkO �* �S*,. O *,Z O �J*94#E�+��.L .k+��[E^6 $ " + $ ��� ��. & ./E��B4U6G.=6��'^T.=6 & � $' �O E�Z � "%$'&=& .kZ O � 6 $ ��40*,Z O � 6���� �& �[+6 $ " + $ �%��6��0*Y6 ��. & E#./-'.=6 * O ./E���4 62.76�� 5R. K �,K ^ ��. & � YC 14$ +2+�� &2"�$ 4�E & 6 $ ��. &J" ��� & . 1 * O .kE��B4U62.76��'K� ��. & . & E $ 4��FZ � �0* �!.74�- 6���� #& �4+ " + $ �M./E�� ��. &�"� Z O . 1(� ��� ¤� *94�E & � $ ()6��0*Y6 6���� � 4�E��4+ O �M.84�-���. &�"�& � E $ 4 �M3 *94�E 1 +��4E��B4U6G./* O014$ +=+�� &2"�$ 4�E & 6 $ 6���. & ¤� K�F & .74�--6�����; K R *Y4�E� � 6��4+F4�* O " � � & . 1 * O 4 $ 6G. $ 4 &�$,P ./E���4U6G.76�� ���4+=.�� 1 *Y6G. $ 4 ^D.=6m. & 6�����4 �%�4+=.�� �[E 6���*Y6 6���. &J #& �4+m. &.84#E����[EX6���� $ (,4��4+ $,P 6���. & ¤� K

� i�n i I��kYlPI �He��Mn �U6£l|k`nMi� ��� *,Z $ �%� . & $ 4 O � "�$'&2& ./Z O �j( ���B4 * �& �[+ 1 *Y4UZ�� " � � & . 1 * OkO � PR$ + 1 �[E>6 $ +�� ��� * O ��. & .kE��B4U62.76��'KR\4 &=$ 3�� 1 * & � & ^ 6���. & . & 4 $ 6 *94 $'" 6G. $ 4 K � $U1[$'" �J(j.=6�� &= �1 � & .=6 *L6G. $ 4 & ^�("��.74 62+ $ E �1 � 6����4 $ 62. $ 4 $,P *94 $ 4 �M3F.=6�� +���� $!1 *Y6G. $ 4 K 4 $ 4��M3�.76�� +���� $!1 *Y6G. $ 4 ( $ + �B& * & PR$'OkO/$ ( &�� 6���� �& �[+�B4 1 +1� " 6 & �#. & "� Z O . 1 � � � ¤ �& .84�- &=$ 3!� 62+ �& 6(�[E 6���./+=E " *,+A6�� � & �B4 1 +1� " 62. $ 4 K � 6����B4" + $ �%� & 6��0*Y6K6����&��4 1 + � " 6G. $ 4�. & $,P 6����U¤� 6��0*Y6 14$ +=+�� &="%$ 4�E & 6 $ 6���� � 4�E��[+ O �M.74�- 6����1 +��4E���4U6G. * O 6���� "�$'&2& � &2& . $ 4 $,P ( ��. 1 � . & Z��4.74�- " + $ �%�4E K�R 6m. & �4* & ��6 $ & ���?6��0*L6 &2$�O/$ 4#-f* &6�����¤� . & * PR 4 1 6G. $ 4 $,P 6���� � ^U6���. & 3���6�� $ EF* OkO/$ ( & 6����,6G+ �& 6��4E " *S+:6��S6 $ �54�E $' 6)( � $6���� #& �4+Q( * & K

E e@6&9Me�� G�nK��� _�n � DYb�e£iMl|kQlJIg;�nMi ;Sdfe7� 6�iAb 6�iAb � i�nMi I��kYlJI �<e �Mn �U6+l|kQnMi ("� * � �4+ PR$ +23 $,P .kE��B4U62.76�� \ $ 4 \ E��[3U*94#E�*94�E�*94 $ 4 �M3F.=6���+�� � $M1 *Y62. $ 4�. & ( ���B4 ^ .74 & 6�� *,E $,P�54�E#.84�- $' 6?6���� .kE��B4U62.76�� $,P * #& �4+[^ .76l. &l"%$'&=& .kZ O � 6 $ �54#E $' 6?6���� "�& � E $ 4 �M3 $SP 6���� �& �4+ (j.76�� 6���� $ +2-'*94�.��4*Y6G. $ 4 6��0*Y6�-'+2*94U6(�4E 6���� 1 +��[E��B4U6G./* O K¡: $ + � �#*,3 "�O �S^ . P 6���� �& �[+3�. & Z�� ��* �%�4E ^ 6���� 1 +��4E��B4U6G./* O -'+2*94U6G.74�- $ +=- *94�.�� *Y62. $ 4 3F* �Y( *94U6�6 $ �54�E $' 6 *94�E +���� $ � �6���� 1 +��[E��B4U6G./* O K

� $ * 1 ��.������,6��#. & ^ &= �"�"�$'& � �����[+1�?6G.k3!�j* 1 +��4E���4U6G. * O . & . &2&= �4ET^ 6���� . &2&= .84�- $ +=- *94�.�� *Y62. $ 43 �& 6 $' 6 "� 6 *L6 O �4* & 6 &2$ 3�� " *S+:6 $,P 6���� & ./-340*L6 +�� W $ 4�6���� �& �4+ � &�& � 1 +���6 � � � � K�����4 $ 6��6��#. &6" *S+:6?�B58WDCLK � ��� & � 14 +=.76�� PR$ + & .k-340*Y6 +�� &=1 ���43��l3 �& 6mZ � & 6G+ $ 4�-��[+-6��0*94 #&2 * O/� 4 $ 6$ 4 O � . & . & ./3 "%$,&2& .kZ O � 6 $lPR$ +2-%�m* & ./-340*L6 +�� $ 4N* 3�� &=& *,-���]# 4 $ 6 �4� "#O . 1 .76 O � L �4+2.��4E ^_Z 6.76�. & * O/&2$ ��*,+2E 6 $�14$ 3 "� 6�� * & .k-340*Y6 +�� W $ 4 * O +�� *,E$� L �[+2.$�[E 3!� &2& *S-��f] &2 �1 � 6��0*L6�B58W C��� �B58WDCL^0( ���4+���W . & 6���� $ +=./-'.740* O%& ./-940*Y6 +�� $ 4f3�� &=& *,-%�C]�K � ��� & ./-340*L6 +�� &=1 ���43��("��-'.�����.74 � ��* " 6(�[+ b �0* & 6���. &Q" + $'" �4+A6��'K

� b

Page 55: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� ���B4 * �& �4+ " + $ ��� &m"�$'&2& � &=& . $ 4 $SP * 1 +��[E��B4U6G./* O ^ ���*�B4 1 +1� " 6 & 6���� �S* Ok ���B58WDC 4�E��[+&2$ 3!�,6G+ �& 6��4E " *S+:6���� & � � �'K � 6�����4 " + $ �%� & 6��0*Y6]6���� �B4 1 +1� " 6��4E �S* O/ � 1[$ +2+�� &="%$ 4#E & 6 $ ��. &1 +��4E���4U6G. * O K�R\4 1 * & �l.76�Z�� 1[$ 3�� & 4�� 1 � &=& *,+ �'^@6�����62+ �& 6(�4E " *,+A6���(j. OkO E�� 1 + � " 6 6���. & 1 . " ���4+ \6(�4� 6 *Y4�E $ ZQ6 *S.84 �B58WXC�( �#. 1 ��(j. O/O �B40*SZ O �-6�����. &=&2 .74�- $ +2- *Y4�.��4*Y6G. $ 4>6 $ .kE��B4U62. P � 6���� �& �4+ � &"�& � E $ 4��M3�*94�E�6 * � �J* "�" + $'" +=. *Y6��m* 1 62. $ 4 K

� �

Page 56: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

���

Page 57: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ���� �

� ��� � � � � ��� ��� � � � � � � ��� � � � ����� ������� ��� � � � ����� ���

����� � ��� ���! !#"c���%$& '�(" � � �) '�!* � � �,+ �- � �!.�0/Y* &2&= 31/�2��0*3242��5/�+6/ *,E5/[+ �0* & Z0* & . 1fP *,3F. O ./*,+2.72�� (j.82�� 3 $ E �O *,+F*,+2.72���3&/922. 1 *;:�E=< $ +/ O /43&/,:>2 *S+1�N*,Z & 22+G* 1 2J* O -;/4Z�+2*#K�5@? $ + * 1 +G* & � 14$' + & /S^D+A/4*,EB/4.82��5/4+ ��*;:0* :�- O/ .C: � & � :�-�$ +ED $'O E!( * &=& /[+ \GF /,HCHCI;JA/ �LK �MD F NHC/9O92AP5JA/Q:5R;2A/,K9SUTV/9JA/QWX/QY[Z��[/QKA/ �[/,JAI;H\JA/9HC/��3I;:>2^]_I;O`2aK^I;:5bcb5/`d#:5Z82AZCR[:eK,S

fhg>ikjmlon�l_pqjsr\t_u#t_uwv6xzy|{~}�pN�m��4_������tQ���[�q�����X�[�^���;���,���k�#���&�`�`���w�C�Q�A�;���C�A ¡�;�&¢(£¥¤¦ R�b5PeHCP5K§� ¨��z© �#ª>«�¬®­#�`�a� �¯�;�q °ªz�;�a�(�±���,���N²q�`���³�!�#���&�`�`�a�,´fhg>ikjmlon�l_pqjsr\t_u#t8µ¶v6·!�A4_g¹¸ºn�p#n�log�jqn � �mj�»;n�lopqj'��t½¼\�`�#���`�^�;�&���#�G�¿¾¥�`�9´-À|­#��ÁX�¥�C�`�Â�Ã���@�¿�`�#�¨Ä�¥�Å�`�@�¿���cÆ�Ç_�NT!�³�A���`�¥�È�È�!�o­#�¡�A�;�6 ;���q�;�É���_ÊË�G¨!��­#�(¾;�a����²cÌÂÍÎ ´Ï 6#»;n&r\t@u#t_u#t½Ðo¨��z©¯Ñ5ªz�C�°�;�zÒEÓ��Ô�³�, ;���É�>�È«Õ��­#�`�ËÆ®Ço�NT�©ÇÖÑ&�¶��T,Ç_ª(�¶��T,´

×zp#n`6�n�l_pqj�ØÚÙ0/XKaIÜÛ§2��#I�2'I;:°¢(£�¤ ¦ R¥b5P5H8P5Km�Ý©¯Ñ#ª^ZCK®O �eR[KA/9:¡P5:5Z8]oR;J ¦ H8ÛQI32�JaI3:5b5R ¦ W^Z82��KA/9O,P5J6Z82ÃÛh�hZ7]#ÑcI;:5b˪-I3JA/%JAI;:5b5R ¦ �¹ÞÃßeZ82ÂàeJAZ ¦ /,K9S�áN/92Ââeã[ä;å±æ3ç[è=é�è±êºbe/,:5R;2A/%2��5/QI3HCY[R[J6Z82�� ¦2��5I32Üë\R[:�ZC:5àePe2&�Üì3ë\R[P�2aà5Pe2AK°IËJaI3:5b5R ¦ ¢V£�¤ ¦ R�b5PeHCP5K%W^Z72��BKA/9O,P5J6Z82ÃÛ0�±S1áN/92Qâeã>ä[í¥î\ÇG�Üì,Tb5/9:5R;2a/¡2��5/&I;HCY[R;JAZ82�� ¦ 2��#I32,ëNR[:�ZC:5à5P�2º�Üì3ë\O �5R¥R[K6/,KQ2ÃWXRcJaI;:eb5R ¦ �¹Þïß5Z82%à5JAZ ¦ /9K,ë5Ñ0I;:5b�ª�ëI;:5b�R[Pe2Aà5Pe2AK§�ð©�Ñ#ªhI3:5b�IhJAI;:5b5R ¦òñcó Ì ÍÎ KAP5O ��2��#I32§Y[O9b\Ç ñ[ô Æ®Ç_�|TAT%©õ�[S1£�P5O ��Ihà#I;ZCJÇ_� ôÈñ T(ZCK%I;HCK6RhOÜI;H8HC/,b�ÒEÓ���²q�e�,�É�¿�°ö>�`Ê�ë|W �5/,J6/º2��5/¡O,R;JAJA/9KAàqR[:5b5Z8:5Y����È�`�a�`�Xö>�`Ê-ZCK(2��5/¡÷3I;HCP5/ø ó ÌÂù�ú Î�û KAPeO �z2��5I32 ñ ø-ü � ¦ R¥b&Æ®Ço�NT`S{h�Ü�Ü�m}�ý\n�lop±jðr\t@u#t_uwv6xcyN{�{h�Ü�Ü�m}�ý\n�l_pqjk��tzÀ|­#�zÒEÓ�� ���È�`�¥�(²q�_�¿�����C�)��­e�;�½¾;��þ;�`�ÿ�;�ÒEÓ�� ²q�5�,�É�¿�Vö>�`Ê&Ç_� ôañ TÈ« �;�q 1�&�6�;�q ¥�����`�C�`�³�`�#� �zó Ì�ÍÎ «k���Õ�C�V­e�;�6 &�Ã�4�È���(²q���Ã�!��­#�!þ��;�É�#�� �`�=�È­��o­e�;� ��� ü �³¦ R�bº�'´������a�(¨Ü���Ä�&�;���ÉÊ�«!¬X�4���È�`�¥�³�³��­e�;�®¨Ü���³�;���\²#���ÉÊ��Å���¡�_�;�É�Ã�_���³��`���a�`�����=¨9�;�¡���É�¿�È��� ì� «���­#�`�È�¡� + �C�`���°�1�Å�¿¾;�É�7¾;�_�,�C�'¨Ä�¥�Å�`�_�¿��� �|Ç¿�eTQ�`�=�È­h�o­e�;�

��J��8Ço� ôÈñ T���âeã>ä[í¥î\ÇG� ì T�� � � Ì ÍÎ � � �� ì Ço� ôÈñ[ô�� T�� � � ü �1¦ R¥bº���±©��|Ç@�5T

���

Page 58: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

{h�Ü�Ü�m}�ý\n�lop±jðr\t@u#t8µ¶vÄy±n�¸�pqj��0xzy|{ {h�Ü�,��}�ý\n�lopqj'��tcÀ|­#�¡�`�@�a���¥¾cÒEÓ������È�`���(²q�_�¿�����C���­e�;�°���§�C�h­e�;�A �«1���¶���;²q�¥�¡�;� ÒEÓ��~�³�, ;�¥�É�>�&� �;�q ��;�Ú�`�C�`�³�`�#� ��ó ÌÂÍÎ «¡�Ã�w�È���(²q���Ã�þ��;�É�#�È� ñ�� ���;�q  � �`�=�È­��o­e�;� � � ü �1¦ R¥bº�'´ �0���a��¨Ü���Ä�&�;���ÉÊ�«^¬X�&���È�`�¥�³�¡��­e�;�N¨Ü���º�;���²#���ÉÊ��Å���¡�_�;�É�Ã�@���³�E�`���a�`�����>¨9�;�¡���É�¿�È� � ì � «\��­#�`�a�%� + �C�`���E�§�Å�¿¾;�É�7¾;�_�,�C�±¨Ä�¥�Å�`�@�¿��� �|Ç¿�5TX�`�#�È­º�o­e�;��'J � � � âeã[ä[åqæ3ç[è=é�èqê#Ç�� ì T�� � � Ì ÍÎ ��Ç �=ôÈñ T �� ì Ço� ô�� T � ñ�� ��� � � ü �4¦ R�b¡� �±©��|Ç@�5T

� �5/Ë2aP5à5H8/�Ç_� ô�� T°Y[/,:5/9JaI32A/,bsI;K&I;ßqR�÷;/;ë ZCK-O,I;HCH8/,bðI�¾¥�`�Å�`�A�;� ���e�`�ï�;�Å�È�°R;]E2��5/�^� + �_�,�C�¢V£�¤ à5JAR[ßeHC/ ¦ S×zp#n`6�n�l_pqj�Ø F Û� Ò Î � Ì ÍÎ WX/(W^Z8HCH=b5/9:5R;2a/V2��5/VKA/92ÂR;]��¹P#I;b5JAI32aZ8O(J6/,KAZ8b5P5/9K ¦ R¥b5P5H8R½��ë�Z@SL/3S8ë/,H8/ ¦ /,:>2aK�� ó Ì�ÍÎ K6P5O �z2��#I32���� ó ÌÂÍÎ K6P5O �z2��#I32���� ü � ¦ R¥b¡�®S

�ï]°Ç_� ô � TQZCK°IÝY[/,:e/,JaI3HXZC:eK62ÈI3:5O,/4R3]�2��5/��5/���ZCß5H8/h¢V£�¤ à5J6R[ß5H8/ ¦ ë'I;:5b � ó Ò Î ë®2��e/,:Ç_� ô�� TXZCK^I��,�e�> ;�A�;�_�¿��Z8:5K62aI;:5O9/!R;]®2��5/��#/���ZCßeHC/Q¢V£�¤ÿà5JAR;ß5HC/ ¦ S VR;2A/°2��5I32%K6ZC:5O9/-R[:5/!�¹P#I3J62a/9J!R;]ÕI;H8H\2��5/-/9HC/ ¦ /,:>2AK%R;]�Ì�ÍÎ I;J6/!�¹P#I;b5JAI32aZ8O°J6/,KAZ8b5P5/9K,ë|2��e/K62AJAR[:eY�¢V£�¤�I;K6KAP ¦ àe2aZ8R[:¯Z ¦ à5HCZ8/,K§2��#I32ºZ72ºZCK �#I3JAbw2aRBKAR;H8÷[/"�¹P#I;beJaI32AZCOhZC:eK62ÈI3:5O,/9K1R;]E2��e/

�#/#�eZ8ß5HC/Q¢V£�¤ à5J6R[ß5HC/ ¦ S$�Ã:c2��5/QKA/%�¹P5/9H¿ë#ß>ÛcI;:B���e�`�¿�;�Å�È�ÂR;]m2��e/&�5/���ZCß5H8/Q¢(£¥¤ àeJAR[ß5H8/ ¦ ë�W /W^ZCH8H ¦ /ÜI;:cI'�,�5�> ;�6�;�_�¿�`ë5JaI�2��5/9J^2��#I;:ËY[/9:5/,JAI;HNZC:5K�2ÈI;:eO,/;S( p=¸�p<4}4}6e¸*)¯r\t_u#t_u=t,+\�q ¥�`�¡��­#�°�`�_�È���¥¾4ÒEÓ������È�`�¥�(²q�_�¿���e«^�����C�-­e�;�6 �«%�������;²q�¥�E���^� + �_�,�C�ÒEÓ�� ���e�`�¿�;�Å�È�½Ço� ô�� TÈ«'�G�h�È���(²q�¥�G�§���#�Ã�¿¾¥�`�a� ñ-� �h�;�q  � �`�#�È­c�o­e�;� � � ü �³¦ R�bº�'´fhg>ikjmlon�l_pqjsr\t_u#t10¶vÄyg6 � g�ým¸�l@}�g¥����t!� ²q�Ä���³�1�#���&�`�`�^Ñ �C�z�A�;���C�A 4KaI�]o/)� ¨VÑð©��`Ñ�.0/ �3«�`�#�È­���­e�;�kÑ . �C�h�;� ���)�³²q�Ä���³�4�#�¥�&�`�`�9´21,À|­#�z�È���Ä�a�È�ò#���q ;���¥¾Ý�#���&�`�`�EÑ . �C�&ö��Å��¬'� ���h�£�R[à �5ZC/§D!/,J ¦ I;Z8:˲q�Ä���³�,´43fhg>ikjmlon�l_pqjsr\t_u#tÖr vÄyÅý'g�»>l7684ÕxzyN{�}�pN�m�A4@�m����tQ�(�ÝÒEÓ��Ô�³�, ;���É�>�E�z©ðÑ#ªË�C�EKAàq/,O9Z I;HÕ� ¨Ñ4©Ú�`Ñ . / �Ë�;�q ½ª§© �3ª . / �Ë�;�a�!�,�6¨Ü�²q�Ä���³�È�,´×zp#n`6�n�l_pqj�ØÔÙ�/!KAI�Û³2��#I32EI¡K6à±/9O,Z I3H|¢V£�¤ ¦ R¥b5P5H8P5KÂ�z©ðÑ#ª§WÂI3KEO �eR[KA/9:�I32�JAI;:5b5R ¦ W^Z82��KA/9O,P5J6Z82ÃÛz�4Z8]qÑzI;:5bcª¡I;J6/§JAI;:5b5R ¦ �¹Þïß5Z82^KAI3]o/Qà5JAZ ¦ /9K,S576 g¹p=¸�g¥} r\t_u=t8µ¶v ( 6 l_jmg¥�,gzx4g¥} 6#l_j��\g¹¸ 5-6 g¹p=¸�g�}¯��t§Ðo¨(�¯©ÿÑ5ª¹«(�;�q ºY[O,bmÇÉÑ ô ª;T(© �3«��­#�`�,8 �¯Ì Î:9; Ì=<->0Ì@?A«A8!ÇCB±T%©�ÇDB ¦ R¥b%Ñ ô B ¦ R¥b&ª;T-�C�1�;�ð�DE �`�¿�`�#�_�ÉÊ��È���(²q���¿�>�,�C��;�q 1���#þ;�`�Ä�_�_�,�C�Q�Ä���¥¾³�C�����³���ò#­¥�C�`�&´F �a���G¨9´HGXR ¦ à5Pe2AZC:5Y�8!ÇCB±T®ZCKkK�2aJaI3ZCY �>2A]oR;J6WXI;JAb|S=GXR[:5K6ZCb5/9Jk2��5/Â]oP5:eO92aZ8R[:JI �§Ì=<$>QÌ@? 9; Ì Î ëIQÇDBLK ô B � T°©MBLK ��ª&/2B �ON Ñ ¦ R¥b¡�®ë®W �5/9JA/ � ü ªQP K ¦ R�b!ÑNë N ü ÑRP K ¦ R�bºª¥SS ER;2a/&2��#I�28!ÇTIQÇCBLK ô B � TAT�© ÇDBLK ô B � TÄSQ£�Z8:5O,/�U Ì Î U�©VU Ì=<�>BÌ@?WUUë±Z82E]oR[HCH8R�W^KE2��#I32�IÚ©X8�P K ëÅI;:5bY8ÚZCK(Iß5Z[Z6/,O92AZCR[:ÅS

¤(b5beZ82aZ7÷[/QZCK6R ¦ R[JAà �eZCK ¦ �IQÇCBLK�/]\QK ô B � /]\ � T~© ÇDBLK�/]\QK6T �¥ª�/ÚÇDB � /]\ � T N Ñ ¦ R¥b&�© ÇDBLK �¥ª�/^B �_N Ñ=T ¦ R¥b&�J/ Ç`\QK ��ªa/^\ �_N Ñ=T ¦ R¥b¡�© IQÇDBLK ô B � T�/bIQÇ`\QK ô \ � T

czP5H72aZCàeHCZCO,I32aZ7÷[/½ZCKAR ¦ R[J6à �5Z8K ¦ �^W /¡W^ZCK ��2ARhK��5R�W 2��#I32-8!ÇCBd\5TV©e8!ÇCB±T_8!ÇD\5TÄS 8!ÇDBd\eT(©ÇDBd\ ¦ R¥b!Ñ ô Bd\ ¦ R�b¡ª;T`S&£¥P5à5àqR[KA/f8!ÇDB±T(©�ÇCBLK ô B � T`ëg8!ÇD\5TV©�ÇD\hK ô \ � TÄS!� �5/,:YBd\ ¦ R�b!Ñ�©

�ji

Page 59: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

ÇDBLKO/���Ñ=T,Ç`\QKO/-�ïÑqT ¦ R�b!Ñ4© BLK \hK ¦ R�b%ѧ]oR[JNKAR ¦ /'Z8:¹2A/,Y[/9JAK��#ëj��Sm¤(:#I3HCR[Y[R;P5KAH7Û[ë Bd\ ¦ R�bºªQ©B � \ � ¦ R�b¡ª¥S � �5/,J6/9]oR[J6/;ëR8!ÇDBd\eT�© ÇCBLK \hK ô B � \ � T'©ÇCBLK ô B � T,ÇD\hK ô \ � T'© 8!ÇCB±T_8!ÇD\5TÄS��g�}�} 6Brmt_u#t10|t§Ðo¨%��© Ñ#ª>«|Ñ�©Ô�`Ñ . /��3«�ª1©Ô�3ª . /ÿ�c�C�&�4�ò#�È�`�_�;�mÒEÓ�� �³�, ;�¥�É�¹�È«^��­#�`� Ò Î �C�³���`Ê>�`�É�¿�°¾;�a����²ð�¥�q ¥�`�º�¡���É�_� ²q�É�¿�A�;�_�¿���e«§�G¨-�`�����^Ñ . ª . «(¬®­#�`�È�&�;���Õ�,���mÑ . / ª . �G¨º��­#��`�C�`�³�`�#���½�;�a�(¾¥�`�Å�`�A�;�Ã���a�,´F �a���G¨9´��ï2EZCK�O9HC/ÜI3JÂ2��#I32f Ò Î Z8KVI¡Y[J6R[P5à|S �ï2^Z72^/ÜI;K�Ûh2aRºKA/9/4Ç�]oR[J�/��eI ¦ à5HC/3ë5ß>Ûh2��5/-G �5Z8:5/,K6/JA/ ¦ I3ZC:5b5/9J§2��5/,R;JA/ ¦ T`ë�2��#I32 Ò Î Z8K½Z8KAR ¦ R[JAà �5ZCO¡2aR Ò$<f> Ò ?,S Òg<�Ç_JA/9KAà|S7ë& Ò ? �#I3KR[J6b5/,JqÑ�.=ÇoJA/,K6à|S7ë>ª .ÉT`ë>I;:eb¡I;HCH¹ß5P�2kR[:5/ R;]=Z82AK®/9HC/ ¦ /,:>2AKkI;J6/XY[/9:5/,JAI32aR[J6K,Sk£�ZC:5O9/ÂY[O9b\ÇÖÑ�. ô ª*.ÖT�© �[ëI;:z/,HC/ ¦ /9:>2E2��#I32EZCKVIºY[/,:5/9JaI32AR[J^]oR[JJ Ò�<¡I;:5bb Ò ?,ë=ZCKEI1Y;/,:5/9JaI32AR[J�]oR[JJ Ò Î S@� �5/9JA/`]oR[JA/3ë2��e/,JA/§I;J6/1ÇÖÑ . � ��T9Ç_ª . �¶��TÂY[/9:5/,JAI32aR[J6K^ZC:^ Ò Î S( p=¸�p<4}4}6e¸*)¯r\t_u#tÖrmt§Ð�¨cÇ_� ô�� TË�C�c�;� ���e�`�ï�;�Å�È�z�G¨Ë�o­#���^� + �_�,�C�4ÒEÓ�� ²q�È�;�,�C�`�°«-�;�q z���C�z��ò#�È�`�_�;�±ÒEÓ��Ô�³�, ;���É�>�È«�¬X�§�&�;ʳ���È�`���³�Q��­e�;� � �C�§�¡¾¥�`�Å�`�A�;�Ã���°�G¨J Ò Î ´

� �5/�]oR[H8HCR�W^ZC:5YBH8/ ¦&¦ IBR[JAZ8Y[ZC:5I32a/9K&]oJ6R ¦ 2��5/)I3:#I;H8Û¥K6ZCK³R3]!2��5/�àeJAZ ¦ I;H8Z82ÃÛ�2A/,K�2hb5P5/Ý2ARczZ8HCHC/9J��4czZCH ��� �NI;:5bz¢VI;ßeZC: �M¢EI;ß i�� �@S��g�}�} 6Brmt_u#t��|t°¼m�`�¡�¶�È���(²#���`���Ã�z���#�G�¿¾¥�`�&� �`�4¾;��þ;�`�q´Â��þ;�`�Ú�;�#Ê�þ��;�É�=�JB �`�=�È­ �o­e�;�Æ®Ço�NTHU B|«����Å�-�A�;�����q 4�³�Å���#�Ã�_�Ä��þ��_�;�\ ;��þ��C�����°�G¨��s���³²q�È�;�È�>�,���É�C�`�_�¿�²#���ÉÊ��Å���¡�_�;�Å�_���³�,´F �a���G¨9´��ï]Õ��Z8K(/9÷;/,:|ë|W /ºI;J6/°b5R[:e/;S§£�R4K6P5à5àqR[KA/¡��ZCK(R¥b5b|S%£�P5à5àqR[K6/-2��5/9JA/-/#�eZ8K62AK!I³÷3I;HCP5/Ñ � �0KAPeO �¶2��#I32½Ñ �^U ��S � �e/,:�ÑeU Y;O,bmÇ¿Æ�Ç_�|T ô �|T UÕY[O9b\ÇDB ô �NT`ë^I3:5b¶KAR�Y[O,b\ÇCB ô �NTºZCK1I:5R[:¥Þï2aJ6Z8÷¥Z I3HÅb5Z7÷�Z8KAR[JXR;]®��S

2��5/9J6W^ZCK6/;ë=� �#I;KEI32EHC/,I;K62�2ÃW R³beZCK62AZC:5O`2^R�bebzà5J6Z ¦ /(]_I;O`2aR[J6K,SAGÂI;HCHÅ2��5/ ¦ ÑÝI;:5bcª¥S áN/`2Ñ�.e©ÇÉÑ1� ��T��[�����3ë5ª*.5© Ç_ª%�¶��T��[�����^ß±/QR¥b5bËZC:>2a/9Y[/,J6K,SÕ¤(KAK6P ¦ /QW^Z72��5R;Pe2^HCR[K6K^R;]®Y;/,:5/9JaI;H8Z82ÃÛ2��5I32�� <���� ?,S

áN/92 ��ó Ì�ÍÎ ßq/°O �5R[K6/,:BI32VJaI3:5b5R ¦ S�Ù Z82��zà5JAR;ß#I;ß5Z8HCZ82ÃÛ����[��ë � ZCKVI³K �¥P5I;JA/ ¦ R¥b5P5H8R§ÑNëI;:5bcKAR� ��� ��� � <"! ?#! ©Ç � � T ��� �$��� <"! ?%! © � ��� � <"! ?%! © Ç � ?%! T < P K ü � ¦ R�b!Ñ

Ù Z82��4:5R[:¥ÞÃ:5/9Y[HCZ8Y[ZCß5H8/^à5JAR[ß5I;ß5ZCH8Z82ÃÛ;ë � ZCKÂI-Y[/,:5/9JaI32AR[J ¦ R�beP5HCR½ª�ëeI;:5bhKAR � ��� �&� � <&! ?%!('© � ¦ R¥bª¥ë�K6ZC:5O9/%ªX���(©Ú� � �aª .*) � � ��P K ª . Ñ . ß±/9OÜI;P5K6/�� ?,+�� <>S(-EKAZC:eY½2��e/�G �5Z8:5/,K6/!¢E/ ¦ I3ZC:5b5/9JÕ2��5/,R�ÞJA/ ¦ ë¥Z82ÕZ8K /,I;K6Û&2aR½KA/,/V2��#I32Õ2��e/,KA/(/9÷[/9:>2aK�I;J6/(Z8:5b5/,àq/,:eb5/,:>2ÜëeI;:5b³2��5/,J6/9]oR[J6/V2��5/(à5J6R[ß#I;ßeZCHCZ72ÃÛ2��5I32EI&JAI;:5b5R ¦ � Z8K^I&K �¹P#I;JA/ ¦ R�beP5HCR%ÑNë=I3:5bcI&Y[/9:5/,JAI32aR;J ¦ R¥b5P5H8R¡ª�ë5Z8K�:5R[:�Þï:5/,Y;HCZCY;ZCß5H8/;S� �5/,J6/9]oR[J6/;ëEZ8].� <�W /,J6/0/¹:5R�W^:|ëVW /ÝW R[P5H8b¶Y[/92hI0÷3I;HCP5/01 © � ��� �$��� < ! ? ! ¦ R�bº� KAP5O �

2��5I32�1 ü � ¦ R¥bQÑ�I;:5b21 '©�� ¦ R�b¡ª¥ë®I3:5b�2��5/,J6/9]oR[J6/!Ñ3�ÔY;O,b\Ç#1���� ô �|T54 ��ë®I3:5b0K6RY[O9b\Ç%1�� � ô �|TXZCK^I¡:5R[:¥Þï2aJ6Z8÷¥Z I3HÅb5Z7÷�Z8KAR[JXR;]®��SF Pe2�2��e/,JA/EI;J6/�R[:5H7Û-HCR;YÕ�hàqR[K6KAZCßeZCHCZ72aZ8/,K�]oR;J6� <>ë¹I;:5bº2��e/,JA/`]oR[JA/�W /^OÜI;:º2aJ�Û°2��e/ ¦ I;H8H¿ë>I3:5bW /§W^Z8HCHÅßq/Qb5R[:5/3S( p=¸�p<4}4}6e¸*)¯r\t_u#t�7Nt°¼\�`�E��`�c�;� ���#�Ã�¿¾¥�`�,´ ¼\�`� ñ �`�=�È­¯��­e�;�^Y[O,bNÇ ñ[ô Æ�Ç_�NT6T³© ���`�1¾;��þ;�`�q´Â��þ;�`�¯�;�#Êhþ��;�É�#��B �`�#�È­B��­e�;�XÆ�Ç_�|T U B|«!���Å�³�A�;�ð�DE �`�¿�`�#�@�ÉÊ��È���(²q�¥�G� � �`�=�È­��o­e�;� � � ü�³¦ R¥b&�k´

��8

Page 60: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

?#R[J%KAàq/,O9Z I;H®¢(£¥¤ ¦ R¥b5P5H8Z¿ë=Z82%ZCK%I3HCKAR12aJAPe/-2��#I32%Y[Z8÷;/,: B ��� K6P5O �)2��#I32HB U#Æ�Ç_�|T`ë|R[:e/OÜI3:c]_I;O`2aR[J���S � �5/!]oR[HCH8R�W^Z8:5Y-H8/ ¦&¦ I-I3:5bzàeJAR¥R;]kI3JA/!K62AJaI;Z8Y �>2A]oR[J�WÂI3JAb ���g�}�} 6Brmt_u#t��±t°¼m�`�#�z©ðÑ5ªº�`�^�(�ò#�È�`�_�;�[ÒEÓ��Ú�³�, ;���É�>�È«N�_´_�,´7«;Ñh© �`Ñ�.`/4�½�;�q ^ª!©��3ª*.D/4�3«�;�q (Ñ�. �;�q -ª .��;�È�^²q�Ä���³�È�,´§Ó=��²>²#�����-�hþ��;�É�#��B ��� �C�!¾;��þ;�`�Ý�`�=�È­Ý��­e�;�gB]U¹Æ®Ço�NT © � Ñ .Uª*.o´À|­#�`�����Õ�C��²#���È�`�_�,�C�!�Ã�Ë�DE �`�¿�`�#�_�ÉÊ�¨9�¥�`�G���^�k´F �a���G¨9´(£�P5àeà±R[K6/�Bh©����¿Ñ .�ëe]oR[J�� ó � � ô � ô � � S=� �5/,:Ë]_I;O`2aR[J6ZC:5Y¡�BZCK�Z ¦1¦ /,beZ I32A/;S$� �e/ ¦ R[JA/b5Z1O9P5H82^O,I;KA/§ZCK Bc©Ú���ïÑ�.Uª*. S � �5Z8KEZ ¦1¦ /,beZ I32A/,H8Û&Y[Z7÷[/9KVP5KVÆ�Ç_�NTÄS F ÛËáN/ ¦&¦ I � S7�[S � ë5WX/½I;J6/b5R[:e/;S( p=¸�p�� � �e¸*)¯r\t_u#t��Nt Â��þ;�`���¡�ò#�È�`�_�;�±ÒEÓ�� �³�, ;�¥�É�¹�E�\«X�;�q 4�;�)���#�Ã�¿¾¥�`�@B¯�`�#�È­Ë��­e�;�

Y;O,bmÇ¿Æ�Ç_�|T ô B±T ���

«����Å�-�A�;�0�DE �`�¿�`�#�_�ÉÊE¨9�¥�`�Ã���^�'´� �5/Q]oR[HCH8R�W^Z8:5Y-H8/ ¦&¦ I°Z8K�b5P5/!2aR³£ �#I ¦ Z8J �

��g�}�}��Brmt_u#t��|t°¼m�`�³�;�����#�Ã�¿¾¥�`�h�õ�`�z¾;��þ;�`�q´ Ó=��²>²#�����B�o­e�;�º¬X�0�;�a�ݾ;��þ;�`� �o­#�Bþ��;�É�#�È��\ô��wó Ì�ÍÎ �;�q �B ô \ ó ÌV«ÕY[O,bNÇDB ô \eT½© �Ý�`�#�È­0�o­e�;� ��� ü ����¦ R¥b¡�'´ À|­#�`�w��­#�`�È�1�C�4�;��DE �`�¿�`�#�|²q�È���È�A ;�¥�a�§�G�h�È���(²q�¥�Ã�Q�o­#�§þ��;�É�#���c�`�#�È­c�o­e�;��� � © �³¦ R¥b&�k´F �a���G¨9´(£�Z8:5O,/4Y;O,b\ÇCB ô \5T½©ò�[ëkß>Û02��5/4/#��2A/,:5be/,bsD-G��õI3HCY[R[J6Z82�� ¦ ëNd#:eb�ZC:>2a/9Y[/,J6K�BI;:5b^�KAPeO �z2��5I32�� B /b��\º© �[S�áN/92��°© ��� ���m¦ R¥bº�®S � �5/9:

� � © � ��� Ç � � T � © � � � Ç � � T � © � � �"!#��� © �1¦ R¥bº�

� �5/1]oR;HCHCR�W^Z8:5YhHC/ ¦1¦ I4ZCK§IzY;/,:5/9JaI;H8Z%$ÜI�2aZCR;:)R;]�áN/ ¦&¦ I � S8�[S 8 ëmZC:B2��#I�2§W /4I3JA/&:5R;2§JA/ÄÞK62AJAZ8O92a/9b02ARz2��e/³OÜI3KA/1W �e/,JA/1Y[O,bNÇDB ô \eTQ© �[S'&VR�W /9÷[/9J,ëkW /1W /,J6/³R[:5H7Û�I;ß5H8/º2ARÝK �5R�WÔ2��5Z8KY[/9:5/,JAI;HCZ�$ÜI32AZCR[:³]oR;J�KAàq/,O,ZCI;H\¢V£�¤ ¦ R¥b5P5H8Z¿S��g�}�}��Brmt_u#t_u�(\t°¼\�`���(�ò#�È�`�_�;�¹ÒEÓ��Ú�³�, ;�¥�É�¹�k�Ý©wÑ#ª>«>Ñh© �`Ñ . /Ë�3«#ª§©���ª . /Ë�3«m�`��¾;��þ;�`�q´Ó=��²>²#�����&¬X�³�;�È�-¾;��þ;�`�w��­#�1þ��;�É�=�È� �\ô���ó Ò Î �;�q fB ô \ ó*) «XY[O,bmÇCB ô \eT�4 B �`�#�È­0�o­e�;��+� ü �,�¦ R¥bº�'´.-#�;�É�#�È�/�¥«10 � �°�`�=�È­³�o­e�;�1��2 ü �³¦ R�bº�s�A�;�z�`�Q�È���(²q�¥�G�A 1�DE �`�¿�`�#�@�ÉÊ;´F �a���G¨9´VáN/9243Q© Y[O,bmÇCB ô \5TÄS �ï]ÕY[O,bNÇ � 3 ô Æ®Ço�NT6T �5� ë±2��5/,:Bß>Û GXR[JAR[H8H I;J�Û � S7�[S i ëÅWX/½]_I;O92AR[J%�®S 2��5/9J6W^Z8KA/;ëNZ72 ¦ PeK62!ßq/-2��5/°OÜI;K6/-2��#I32%Y[O,bmÇ 3 ô Ñ . ª . TE© �[S&� �5/,J6/9]oR[J6/;ëN2��e/,JA/¡/#��ZCK62AKQI³÷3I;HCP5/ø ó Ì Í< ! ? ! KAPeO �z2��5I3263 ø°ü � ¦ R¥bQÑ . ª . SF Û�2��5/4/#��2A/,:5be/,bsD-G��õI3HCY[R[J6Z82�� ¦ ë\d#:5bwZ8:>2a/,Y;/,JAK!�0I;:eb^�&K6P5O �w2��#I32� B / ��\¯©73�S VR32a/!2��#I�2

� �"8:9 ü Ç � � T ; ü Ç � � T ; ü � �<8:9 ¦ R�bº�� �5/9:|ë>ß>Û°áN/ ¦1¦ I � S7�[S 8 ë3W /Xd#:eb¡I;:-/9HC/ ¦ /,:>2=�(KAP5O �¡2��#I32>� �"8:9 © � I;:eb°WX/XR[ße2ÈI3ZC: ñ ©�B �?3I;:5b@�eS

���

Page 61: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

����� ����� ���-.�� �������� ��zg )]�=g¥jmg¹¸ �en�lopqjÕt :ÝZ8:5à5Pe2§�Üì3ë=O �5R�R;KA/-IºKAàq/,O9Z I;Hm¢V£�¤ ¦ R¥b5P5H8P5K��)© Ñ#ª¥ë>Ñc©ÿ�`Ñ�.j/ �[ë

ª¶© ��ª . /Ô�[S G �5R¥R[KA/3ëVP5:eZ8]oR[J ¦ H7ÛðI32hJaI3:5b5R ¦ ë�� ô � ô 3 ó Ò Î S P�2aà5Pe2'F� ©Ço� ô � ô � ô 39T`ë#I3:5b�Ó�� ©¯ÑNSÕáN/92�� Î b5/9:5R;2A/Q2��5/QHC/9:5Y;2��ËR;]m2��e/ ¦ R¥b5P5HCPeK��®S�� Î ©��[�±S

�ÿg¥�Ü� ���=gB�,ý �#»[g=t§á\/`2����ÿß±/&Ihà#I;JAI ¦ /92a/9J,S� �5/ ¦ /,KAKAI;Y[/ºKAà5I;O,/&O,R[:eKAZCK�2aKQR;]XI;HCH�ß5ZC:5I;J6ÛK�2aJAZ8:5Y[K R;]\HC/9:5Y;2������ES�� �¹P5Z8÷3I;H8/,:>2aH7Û[ë¥Z82XOÜI;:4ßq/(2��5R[P5Y �>2XR;]mI;KÂO9R[:5KAZ8K62AZC:5Y-R3]\ZC:>2a/9Y[/,J6KZ8:Ë2��5/QJaI;:eY[/ � � ô �! #"®T`S

y|l`�qjml@j �����D�=p=¸3l�n 6 } t : Z8:5à5Pe2�$)ëVO �5R�R;KA/�I�JaI;:eb5R ¦ àeJAZ ¦ /�:¹P ¦ ßq/,J ñ�� �! %" ! K R;]H8/,:5Y;2��&� � ©'���,/ð��ë#I;:5bzI¡JaI;:eb5R ¦ :¹P ¦ ß±/9J)(QR;]�HC/,:eY;2��*�,+�©-� Î /.���,/0/Gë�W �5/,J6/1/Z8K^IºK6/,O9P5JAZ72ÃÛËà#I;JaI ¦ /`2a/,J9S GXR ¦ à5Pe2a/!2��5/!÷;I3HCP5/ � KAP5O �c2��#I32� � ü � � � + 3 ¦ R�b¡�

Pe2Aà5Pe2°Ç ñ[ô ( ô�� TÄS2§g¹¸3l�i®» �en�lop±j ���D�=pq¸�l�n 6 } tH�mR-÷[/9JAZ8]�Û12��#I�2X2��e/%2aP5à5H8/¡Ç ñ[ô ( ô�� T ZCKXI-KAZCY;:#I32aPeJA/%R[: ¦ /9KAKaI3Y[/

$òZ8:z2��5/ ¦ /,K6KaI;Y[/§KAà5I;O,/3ëÅO �5/9O"/z2��5I32 � � ü � � � + 3 ¦ R�b¡��ëÅI;:eb�O �5/,O"/Ë2��5I32!�� #3 P K 4ñ 4 �! #39S

·)4�»>l_g¥jm»j) �5j ���C)\�Ül_�;t �Ã:³à5JAI;O92AZCO,/3ë5� Î © � � � � ZCK�O,R;:5KAZ8b5/,J6/,b³K6/,O9P5JA/3SÕ¤VKÕ]oR;J�2��5/ ¦ /9KAKaI3Y[/KAà5I;O,/3ëkZ8]Õ2��5/1KAZ8Y[:#I32AP5JA/ºKAO �e/ ¦ /³ZCK§ZC:>2A/,:5b5/9b02ARÝßq/1P5K6/,b�beZCJA/9O92AH8Û�]oR[J§KAZ8Y[:5Z8:5Y ¦ /9KAKaI3Y[/,K9ë2��e/,:1���ð©�� ��� ZCK�Y[R¥R�b½/,:5R[PeY �|ë[K6ZC:5O9/;ë[Y[Z7÷[/9:¡I(KAPeZ82ÈI3ß5HC/ O,R[H8HCZCK6ZCR[:¥ÞÃJA/9KAZ8K62ÈI3:¹2 �5I;K��°]oPe:5O92AZCR[:|ëKAPeO �)I;KV£ &V¤^ÞÈ�[ë#R;:5/½O,I;:Ëd#JAK�2 �#I3K���I ¦ /,K6KaI;Y[/Q2aRc� ��� ß5Z72aK9ë±I3:5bc2��5/,:zKAZ8Y[:h2��5/§JA/9KAP5H72aZC:eY÷3I;HCPe/;S�� �5/,:�� � ©�� � �¥S�� �e/ à#I3JaI ¦ /92A/,J6/eY;P5ZCb5/9K|2��5/�K�2ÈI32AZCK62AZCO,I;H;O9HCR[K6/,:5/9KAKmR;]�2��5/'KAZ ¦ P5HCI32a/9bb5Z8K62aJ6ZCß5P�2aZCR;:�2ARÝ2��5/4I;O92AP#I;HÕb5ZCK�2aJAZ8ß5Pe2AZCR[:|ë �5/9:5O,/hZ8:�à5JaI3O92aZ8O,/3ë7/(©ò� ��� ZCK§KAP &O9ZC/,:>2,ë I3:5b2��e/,JA/`]oR[JA/��,+�© � � � � / � ��� / � ��� © �!8 � � S

� �5/,J6/9]oR[J6/;ëq2��5Z8KVK6ZCY[:#I�2aP5J6/½K6O �5/ ¦ /°J6/%�¹P5ZCJ6/,KVR[:5/§K��5R[J�2ºÇG� ��� Þïß5Z82ÈTÂI;:5bz2ÃW R4H8R[:5YÝÇ�� � � �I;:5b��!8 � � TX/���àqR[:5/,:>2AZ I32AZCR[:5KÂ]oR;J�KAZCY;:5ZC:5YeëeW �5ZCH8/%÷[/9JAZ8d5OÜI32AZCR[:ËJA/ �¹P5ZCJ6/,K�2ÃWXR1K��5R;J62°Ç�� � �ºI3:5b� ��� ß5Z82AKÈT&I;:5b¶R[:e/�HCR[:eY Ç���8 � � Þïß5Z82ÈT°/���à±R;:5/,:>2aZCI32aZ8R[:5K9S � �5Z8K³ZCK1:5R;24I;K³/"1O9ZC/9:¹2hI;K³2��e/GXJaI ¦ /9J�Þ�£ �5R[P5àËKAZ8Y[:#I32AP5JA/3ëeW �5Z8O �cJ6/%�¹P5Z8JA/,K�2��5JA/9/§K �5R[J�2½Ç_Z¿SM/;S7ë|� ��� ÞÃß5Z72ÄTÕI;:5bËR[:5/!H8R[:5YcÇ_Z@SL/3S8ë� � � � ÞÃß5Z72ÄT!/���àqR[:5/,:>2AZ I32AZCR[:5K-]oR;J-KAZ8Y[:5ZC:eY5ë'I;:5bw]oR[PeJ-K��5R;J62º/���àqR[:5/9:¹2AZ I32AZCR[:eK°]oR[J°÷;/,JAZ7]�Û¥ZC:5Y5S&VR�W /9÷;/,J,ëqR[P5J�K6ZCY[:5I32aP5J6/QKAO �5/ ¦ / �#I;K^R;2��5/,J^J6/,b5/9/ ¦ ZC:5Y �¹P#I;H8Z82aZ8/,K9S

���:9 ; '$h$=<Ú$=<> h���@?) �9"BAÙ0/QW^Z8HCH±K��5R�W�2��#I32^2��5/QK6ZCY[:#I�2aP5J6/!KAO �5/ ¦ /§ZC:z£�/9O92aZ8R[: � S �ºZ8K�KA/,O9P5JA/3SA ER;2a/!2��#I32VI-]oR[JAY[/9J6ÛÇ#$ ô ( ôañ[ô�� T ¦ IÜÛ �5I�÷;/§÷3I;H8P5/ ñ R3]®H8/,:5Y;2��&� � :5R;2E:5/,O9/,K6KaI;J�ÛÝI¡à5J6Z ¦ /%:¹P ¦ ßq/,J9S£�P5à5àqR[K6/�2��#I324I0]oR[J6Y[/,J�CLKhI3HCY[R[J6Z82�� ¦ED ZCK³Y;Z8÷[/9:|S £�P5àeà±R[K6/ D ¦ I�/3/,K�� K6ZCY[:#I�2aP5J6/�¹P5/,J6ZC/9KmZ8:Q/���à±/9O92aI32aZ8R[:Qß±/`]oR[JA/�Z82|R[Pe2aàePe2aKmI�KAP5O9O,/9KAK6]oPeH¥]oR[J6Y[/,J�Û[S F Û%2��5/ cÝI;J /;R�÷QZC:5/ �¹P#I;HCZ72ÃÛ[ë�#I;H7]e2��5/Õ2AZ ¦ /;ë D :5/,/9b5K��F� R[JN]o/9W /,J$�¹P5/9JAZ8/,K,S�Ù Z82��eR[Pe2mHCR[K6K�R3]#Y[/,:e/,JaI3HCZ82ÃÛ;ë�W / ¦ IÜÛQI;K6KAP ¦ /2��5I32G� Z8K,/¥:eR�W^:�Ç_K6ZC:5O9/§Z7]mZ82^ZCK�:eR;2Üë52��5/,:cZ82�O,I;:cß±/Q/,K�2aZ ¦ I32A/,bË/���àq/,J6Z ¦ /,:>2ÈI;H8H8ÛeT`S

� �

Page 62: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

£�P5à5àqR[K6/z2��5I32º2��5/cR[Pe2Aà5Pe21R;] D Z8KÝÇ%$ ô ( ôÈñ[ô�� T`SsáN/921P5K&b5ZCK�2aZC:eY[P5ZCK �w2��5J6/,/z2ÃÛ¥àq/,K&R;]R[Pe2Aà5Pe2AK,S� ÀeÊIJ#������� �5/%]oR[J6Y[/,J�CLKX/���à±R;:5/,:>2 ñ ZCKXJ6/,HCI32aZ7÷[/,H7Û&à5JAZ ¦ /E2aRºI;H8Hq2��5/!/���àqR[:5/,:>2AKER;Pe2aà5P�2ß>Û42��5/QKAZCY;:#I32aPeJA/QR[JaI3O,HC/3S� ÀeÊIJ#�����Y� �5/h]oR[J6Y[/,J�CLK¡÷3I;HCPe/ ñ Z8K¡:5R;2ºJA/9H I32AZ8÷;/,H8Û0à5J6Z ¦ /³2aRBKAR ¦ /hà5J6/9÷¥ZCR;P5KAH7ÛwKA/9/,:/#�eàqR[:5/9:>2 ñ� I;:5bh2��5/QJAR¥R;2 � Z8K�b5Z�±/,J6/,:>2^]oJAR ¦ 2��5/QO,R[J6JA/9KAàqR[:5b5Z8:5YºJAR¥R;2 ��� S� ÀeÊIJ#�� ��"� �5/1]oR[J6Y[/,J�CLK§÷3I;HCP5/9K ñ Z8K½:eR;2-J6/,H I�2aZ8÷;/,H7Û)à5JAZ ¦ /¡2AR�KAR ¦ /&à5JA/`÷�Z8R[P5K6H8Û�KA/9/,:/#�eàqR[:5/9:>2 ñ� ë � © ��� ë5ß5Pe2^2��e/Q2AP5à5H8/&Ç#$ ô (�TÂZCK�:5/`WQSF Û D KQÇoJA/9KAà|S7ë D � ë D�� TÂH8/92^P5K^b5/9:5R;2a/!2��5/§]oR;JAY[/9JÂW �5R1J6P5:5K D ß5P�2E2��5/,:cR[:5H7Û4R[P�2aà5Pe2AK

2��e/-]oR[JAY[/9J6ÛÝZ8]�Z82%ZCK%R;] ��Û¥à±/Ë�cÇ_J6/,K6à|S8ë ��Û¥à±/1��ëL��Û¥à±/�8>TÄS7� �5/-]oR;HCHCR�W^Z8:5Y³H8/ ¦&¦ I&ZCK%O9HC/ÜI3Jß>Û42��e/§K�2ÈI;:eb#I;JAb��>Û¥ß5JAZ8bÝI;J6Y[P ¦ /,:>2����g�}�}��Brmt��|t_u#t§Ðo¨4��­#�V¨Ü���¿¾¥�`� D �`�=�È�È�È�È�§²q�a�;�È�>�,���É���@Ê)�C���`«§��­#�`� ���Å�c�G¨ D Ka« D � «-��� D���`�#�È�È�È�A ��Q¬'���o­¡²q�a�;�È�>�,���É���_Ê1�;� �C�A���`���"�F8#´

V/#��2,ëÅW /-W^ZCHCH\K �5R�W 2��#I32(P5:5b5/9J(2��5/°K62aJ6R[:5Yh¢V£�¤ I;KAK6P ¦ à�2aZCR;:|ëÅK6P5O,O9/,KAKQà5J6R[ß#I;ßeZCHCZ72aZ8/,K]oR[J�/,I;O �ÝR;] D KÄë D � ë D�� I;J6/Q:5/,Y[H8ZCY[Z8ß5HC/3S��g�}�}��Brmt��|t8µ|t,+m�q ¥�`�&�o­#�ºÓ=�_�a���¥¾cÒEÓ�� ���È�`�¥�(²q�@�¿���e«V��­#�¡�`�=�È�È�È�È�!²q�a�;�È�>�,���É���_ÊB�G¨ D Kº�C��Å�¿¾;�É�7¾;�_�,�C�,´ �0���a�E�`�@�a���¥¾;�ÉÊ�«k� ¨ D KE�`�#�È�È�È�A ��V¬'���o­Q²q�a�;�È�>�,���É���_Ê���KV�������9²#�È�`�G�A -�_���³���³ÇÖÑ KÄÇ¿�5T6TÈ«�>�`���¥¾ ���9²#�È�`�Ã�A ��#�¥�&�`�`���1Ç¿�eT �,�=�`�Ä�¿�È�È«-�o­#�`� ��­#�`�È�z�C���;� �;�M¾¥���Ä���o­¥� ��­e�;�-�Ä�¥�e�Ý��� �_���³��4ÇÉÑ K9Ç@�5TAT§�;�q &�����Éþ;�È�Q��­#� �E���[�_�,�C�!ÒEÓ��Ú²q�a�;�,�C�`� ¬'���o­¡²q�a�;�È�>�,���É���_Ê��"� � ´F �a���G¨9´(£�P5àeà±R[K6/ D K°KAP5O9O,/,/9b5K1W^Z72��¯:5R[:¥ÞÃ:5/9Y[HCZ8Y[ZCß5H8/1àeJAR[ß#I3ß5ZCH8Z82ÃÛ[S�áN/92&ZCK¡K �5R�W 2��#I�2¡2��5Z8KO,R;:¹2AJaI;beZCO92AK�2��5/½£¥2AJAR[:5Y&¢V£�¤ I;KAK6P ¦ àe2aZ8R[:|S¢E/9OÜI;H8H®2��5I32�� Z8K%2��5/¡/#�eàq/,O`2a/9b�:¹P ¦ ßq/,J!R;] �¹P5/,J6ZC/9K,ëmI;:5bBß>ÛÝ2��5/fcÝI;J�/3R�÷)ZC:5/ �¹P#I;HCZ72ÃÛ[ë�#I;H7]\2��5/!2aZ ¦ /3ë D K W^Z8HCH|:e/,/,bzI32 ¦ R[K62V��� © �4ÇÉÑ K`Ç@�5TAT@�¹P5/,J6ZC/9K,SáN/92ÕP5K�O,R[:eK62aJ6P5O92 I;:&I;H8Y[R[J6Z82�� ¦ KAPeO �12��5I32Üë>R[:ºZ8:5à5Pe2ÕI!K62AJAR[:eY°¢V£�¤ ZC:eK62ÈI3:5O,/½Ç_� ô�� T`ëI;:5bËW^Z82��cI;O,O9/,KAK^2aR D KÄë W^ZCHCH±R[Pe2Aà5Pe2°Ç �=ôÈñ TXK6P5O �z2��#I32 ñ�� �½I3:5b � � ü �³¦ R¥b¡�®S

VR�W� à5H IÜÛ¥KÂ2��e/§J6R[HC/!R3]�2��5/QKAZCY;:5/,J9ë=I;KÂ]oR[HCH8R�W^K ��zg )]�=g¥jmg¹¸ �en�lopqjÕØ�G �5R¥R[K6/Q�!� à5JAZ ¦ /E:¹P ¦ ßq/,JAK ñ K ô#"#"#"|ôañ �%$ S G �5R�R;KA/;ëeI32ÂJAI;:5b5R ¦ ë¹÷3I;HCP5/

& K ó Ì Î#' I;:eb & � ó Ì Î(' SQáN/92&�h© �*) ëÅW �5/,J6/,+ ©.- �%$�0/ K ñ� ë �Q©X�21 � ë13Q©X�21 ' SQáN/`2Ço� ô � ô � ô 39TXß±/!2��5/Qà5P5ß5H8ZCO�/;/`Û[Sy|l`�qjml@j �\Ø�-VàqR[:�JA/,O9/,Z7÷�Z8:5YË2��5/4365074K6ZCY[:5I32aP5J6/ �¥Pe/,J6Û $ � ë�O �5R¥R[K6/³Ih÷3I;HCP5/ ( � R;]XH8/,:5Y32�� ��+P5:eZ8]oR[J ¦ H7Û4I32^JAI;:5b5R ¦ S Pe2aà5P�2-Ç ñ�ïô ( �¿ô���� T`ë5W �5/9JA/ ��� © � �98� �

+68� 3 � ë5W �5/9JA/-� � © �:)�8 � 8 ë

� � © � 1 �� ë 3 � © �21 '� SËÇ`�Ã:BR;2��5/,J%W R[JAbeK,ë�� � ë � � I3:5b 3 � I;J6/-÷3I;HCP5/9K!KAP5O �B2��5I32�� � 8� © �=ë� � 8� © ��ë=I;:5b@3 � 8� © 3,TÄS VR;2A/Q2��#I32½Ç ñ�Ãô ( �ïô���� TXO9R[:5K�2aZ82APe2a/§I-÷3I;HCZ8bhKAZ8Y[:#I32AP5JA/ �

� � 8� © ÇT� ��8� � +;8� 3 � T � 8© � �98 � +68 3 "

� �

Page 63: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

VR;2A/!2��#I32�2��5/Qà5P5ß5H8ZCO�/3/9ÛcI;:5bzI;H8H±2��e/§K6ZCY[:5I32aP5J6/,KEI;J6/§beZCK62AJAZ8ß5Pe2a/9bËO,R[J6JA/,O`2aH7Û[S£�P5à5àqR[K6/z2��e/Ë]oR;JAY[/9J6Û¯ZCKcÇ ñ[ô ( ô�� T-R[: ¦ /,K6KaI;Y;/ $)ëXI;:5b ñ]�7� Sb� �5ZCKºY[Z7÷[/,K&P5K � � ©

� � � + 3§© �*) ú � ! 1 � + ! 1 ' û S ß5KA/9J6÷[/¡2��#I32!Z7]�Z82%Z8K(2��e/¡OÜI;K6/-2��#I32 ñ I3:5b +4Ç#$ / & K (a/ & � T(I;J6/JA/9H I32AZ8÷;/,H8Û�à5JAZ ¦ /3ë'2��5/9: ß>Ûð£ �#I ¦ Z8J,CMK-2aJAZ8O"/ Ç@áN/ ¦1¦ I � S7�[S 8 T-W /zI;JA/hb5R;:5/;S¯Ù�/ËW^ZCH8HX:5R32:5/9O,/,K6KaI;J6ZCH7Û �#IÜ÷[/Q2��5Z8K�:5ZCO9/QOÜI;K6/;ë#ß5Pe2^W /§W^Z8HCH±K��5R�W�2��#I32�2��eZC:5Y[KÂW^Z8HCH|ßq/!Y[R¥R�bË/9:5R[P5Y �ÅS?®ZCJ6K62,ëVß>Û I;K6KAP ¦ àe2AZCR[: R[: D K1W / �#IÜ÷[/�Y[O,bNÇ ñ[ô +°T)© �[S £�/9O,R[:eb|ëVW /�W^Z8HCHEP5KA/B2��e/

]oR[H8HCR�W^ZC:5Y°O,H I3Z ¦ �( � �5l@} t��Ë����­§²q�È�;�È�>�,���É���_Ê¡�;�®�C�A���`�k���[�c��þ;�`�E�o­#�(�6�;�q ¥��� �È­#���¿�È�È�V�&�> ¥�!�,Ê°�o­#�V�a�A ;�=�`�_�¿���e«���X�C�½��­#�1�A�����§��­e�;�V�`����­#�`�VY;O,b\Ç ñ[ô $ / & K (@/ & � T 4 ñ «V���a«^���B���;²q��� ñ «V���Å�º�A�;���DE �`�¿�`�#�@�Éʨ9�¥�`�Ã���E�k´

� �5/&O,H I3Z ¦ Z ¦&¦ /9b5Z I32A/,H7ÛËY[Z8÷;/,KQP5K!2��5/ºO9R[:5b5Z72aZCR;:5K%R;]XáN/ ¦&¦ I � S7�[S7� � ë|W �5Z8O �0Y;Z8÷[/9KQP5K÷3I;HCPe/,K � ë�0 � �§KAP5O �c2��#I�2 � 2Ëü �³¦ R�bº�®SÙ�/ ¦ P5K�2Â:5R�W à5JAR�÷;/(2��5/VO,HCI;Z ¦ Sk£¥P5à5àqR[KA/(2��#I32 Z82 ZCK�]_I;HCK6/;S=� �e/,:42��e/(à5J6R[ß#I;ß5Z8HCZ72ÃÛ-2��#I�2Y[O9b\Ç ñ[ô $ / & K (�/ & � T�4 ñ Z8KQHC/,K6K§2��#I;:ð���[��S1£�Peà5à±R;KA/ & � © B / Æ�Ç_�NT��eS� ER;2a/º2��5I32 �cZ8KZC:eb5/,àq/,:5be/,:>2®R3]e2��e/�÷¥Z8/9W�R3]e2��e/ I3be÷[/9JAKaI3J6Û§I;:5b§Z82\Z8K\O �5R[KA/9:°K�2ÈI32AZCK62AZCO,I;HCH7Û(Z8:5b5ZCK�2aZ8:5Y[P5Z8K��#I;ßeHC/]oJAR ¦ JAI;:5b5R ¦ R�÷[/9J'Ì Î S$� �5/9JA/`]oR[JA/3ë>Z8]#W^Z82��¡à5JAR;ß#I;ß5Z8HCZ82ÃÛQY;JA/ÜI�2a/,J�2��#I;:h� �[��ë ñ U $^/ & K ( / & � ë2��eZCK �5R;HCb5K(]oR;J%Y[JA/,I32a/9J(2��5I;:w���[�³R;] I;H8Hm2��5/¡àqR[KAK6ZCß5H8/°O �5R[Z8O,/9KQ]oR;J �eS-� �5/,:)2��e/,JA/¡/#��ZCK62AKQI÷3I;HCPe/ ��� ó Ì Î K6P5O �12��#I32 ñ U�Ç%$ / & K (R/"B@/ÝÆ®Ço�NT����ÈTkI;:5b ñ U5Ç%$ / & K (R/"B@/ÝÆ�Ç#$cT,Ç ���h/���T6T`S� �5/9:zZ72 �5R[H8b5KX2��#I32 ñ U3Æ®Ç_�|TÕW^Z82��hà5JAR;ß#I;ß5Z8HCZ82ÃÛ1I32ÂHC/ÜI3K62!���;��S=� �5/9JA/9]oR;JA/;ë5W^Z72��hà5J6R[ß#I;ßeZCHCZ72ÃÛ���[�¥ëeWX/§/,Z72��5/9JÂ]_I;O92AR[J��sÇ_ß>ÛËáN/ ¦&¦ I � S8�;S � TXR;J��h© Y[O9b\Ç ñ[ô $X/ & K (A/ & � T 4 ñ S

� �5/,J6/9]oR[J6/;ë� KAP5O9O,/,/9b5KXZ8:¡ß5JA/,I�/¹ZC:5Y!2��5/�K62AJAR[:5Y§¢V£�¤ I;K6KAP ¦ àe2aZ8R[:¡W �5/,:e/9÷[/9JÕ2��5/^:¹P ¦ Þßq/,JQR;] �¥Pe/,JAZ8/,K§b5R¥/,KQ:5R;2§/���O9/,/,bw�!�~ÇoW �5Z8O � �5I;à5àq/,:5KQW^Z82��0à5J6R[ß#I;ßeZCHCZ72ÃÛ�� �[�4ß¹Û czI;J�/3R�÷ZC:e/%�¹P#I;H8Z82ÃÛeT-I;:5b¯W �5/,:e/9÷[/9J12��5/ËO,R[:5beZ82aZ8R[:5K¡R;]V2��5/ËO9H I;Z ¦ I;J6/ËKaI32AZCK6d5/,bÿÇ�W �5ZCO � �#I;àeà±/9:5KW^Z82���à5J6R[ß#I;ß5Z8HCZ72ÃÛ¯���[��ëkZ8:5b5/9à±/9:5b5/,:>2AH8Û�R;:�2��5/³:¥P ¦ ß±/9J¡R;]a�¹P5/,J6ZC/9KÈT`ë�I3:5bwKAR�2��5/4KAPeO,O,/9KAKà5J6R[ß#I;ß5Z8HCZ72ÃÛ³R;] ZCK ��K�� � ëeW �5ZCH8/!Z82AK�JAP5:5:eZC:5Y¡2aZ ¦ /(ZCK �4ÇÉÑ K9Ç@�5TATÄS��g�}�}��Brmt��|t��|t,+m�q ¥�`�&�o­#�ºÓ=�_�a���¥¾cÒEÓ�� ���È�`�¥�(²q�@�¿���e«V��­#�¡�`�=�È�È�È�È�!²q�a�;�È�>�,���É���_ÊB�G¨ D�� �C��Å�¿¾;�É�7¾;�_�,�C�,´ �0���a�E�`�@�a���¥¾;�ÉÊ�«k� ¨ D�� �`�#�È�È�È�A ��V¬'���o­Q²q�a�;�È�>�,���É���_Ê���KV�������9²#�È�`�G�A -�_���³���³ÇÖÑ KÄÇ¿�5T6TÈ«�>�`���¥¾ ���9²#�È�`�Ã�A ��#�¥�&�`�`���1Ç¿�eT �,�=�`�Ä�¿�È�È«-�o­#�`� ��­#�`�È�z�C���;� �;�M¾¥���Ä���o­¥� ��­e�;�-�Ä�¥�e�Ý��� �_���³��4ÇÉÑ � Ç@�5TAT§�;�q &�`�=�È�È�È�A ��!¬'���o­-²q�a�;�È�>�,���É���_Ê � � �[�5´F �a���G¨9´�� �5/§ZC:5àePe2�2aR¡2��e/§J6/,b5PeO92aZ8R[:ËZCK½Ç_� ôÈñ T`ë5I;:ËZC:5K�2ÈI;:5O9/QR;]�2��5/��#/���Z8ß5HC/§¢V£�¤ÿà5JAR;ß5HC/ ¦ S

� �5/ /;/9Û&Y[/9:5/,JAI32aZ8R[:&I;:5b1KAZCY;:#I32aPeJA/,K�Z8:º2��5ZCK�O,I;KA/VI;JA/EI;K�Z8:º2��5/Eà5JAR¥R;]±R;]NáN/ ¦&¦ I � S 8�SU��S� �5/zKAZCY;:#I32aPeJA/,K�Ç#$ ô ( ôÈñ[ô � T¡I;:eb Ç#$ �¿ô ( �ïôÈñ�¿ô�� TºY[Z7÷[/cP5K12��5/z]oR;HCHCR�W^Z8:5Y �' VR;2A/c2��#I32&]oJAR ¦Y[O9b\Ç ñ�Ãôañ T '©��EI;:5b¡2��5/�]_I;O`2'2��#I�2 � #3 � ñ[ôÈñ��� � #3 Z82®]oR[HCH8R�W^K�2��#I32 ñ� © ñ I;:5b¡2��¥PeKA� � � + ü� �98 � +68 S � �5Z8K�Z ¦ à5HCZ8/,KÕ2��#I32�$X/ & K ( ü $ � / & K ( �q¦ R�b&Æ�Ç_�|T`SÕ£�Z8:5O,/&Ç%$ ô (�T '© Ç#$ �ïô ( � T`ë#I3:5b& K � $)ë & K � $ � ë $ / & K ( '© $ � / & K ( � S=� �e/,JA/`]oR[JA/3ë=Æ®Ço�NTHU $ / & K (�� $ � / & K ( � '© � ëeI3:5bKAR&ß>ÛËáN/ ¦&¦ I � S8�[S � ë5W /§I;JA/Qb5R[:e/;S

� �5/Ëà5JAR;ß#I;ß5Z8HCZ82ÃÛB2��#I32 �KAP5O9O,/,/9b5K&ZC:wß5J6/ÜI�/¹ZC:eYB2��5/z£¥2aJ6R[:5YB¢V£�¤�I;K6KAP ¦ àe2aZ8R[:¯ZCK¡I�2HC/,I;K62�� �[�Ëßq/,O,I;P5K6/&W^Z72���à5JAR[ß5I;ß5ZCH8Z82ÃÛÝI32QHC/,I;K62&���;��ë|2��5/º]oR[J6Y[/,J D�� W^Z8HCH�:5/,/9b�I32 ¦ R[K62½�!��¹P5/,J6ZC/9K,S��g�}�}��Brmt��|tÖr\t,+m�q ¥�`�&�o­#�ºÓ=�_�a���¥¾cÒEÓ�� ���È�`�¥�(²q�@�¿���e«V��­#�¡�`�=�È�È�È�È�!²q�a�;�È�>�,���É���_ÊB�G¨ D � �C��Å�¿¾;�É�7¾;�_�,�C�,´ �0���a�E�`�@�a���¥¾;�ÉÊ�«k� ¨ D � �`�#�È�È�È�A ��V¬'���o­Q²q�a�;�È�>�,���É���_Ê�� � �������9²#�È�`�G�A -�_���³���³ÇÖÑ � Ç¿�5T6TÈ«

� 8

Page 64: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�>�`���¥¾ ���9²#�È�`�Ã�A ��#�¥�&�`�`���1Ç¿�eT �,�=�`�Ä�¿�È�È«-�o­#�`� ��­#�`�È�z�C���;� �;�M¾¥���Ä���o­¥� ��­e�;�-�Ä�¥�e�Ý��� �_���³��4ÇÉÑ � Ç@�5TAT§�;�q &�`�=�È�È�È�A ��!¬'���o­-²q�a�;�È�>�,���É���_Ê �ÜÇ¿�5T � i �1Ç¿�5T9´F �a���G¨9´�� �5/QZC:eà5Pe2Â2ARº2��5/!JA/9b5P5O`2aZCR;:hZCK§Ç_� ô�� T`ëeI;:ËZC:5K�2ÈI;:5O9/!R;]\2��5/ �5/���ZCß5H8/!¢V£�¤ÿà5JAR;ß5HC/ ¦ S

G �5R¥R[KA/ºI1÷3I;H8P5/³� � 3 ���!�³Ç@�5TEPe:5Z8]oR[J ¦ H7ÛcI32%JAI;:5b5R ¦ S(Ù Z72���àeJAR[ß#I3ß5ZCH8Z82ÃÛ)���;�!�³Ç@�5T`ë2��e/§/#��à±R[:e/,:>2 ñ W^ZCH8HÅßq/Q2��5/QKaI ¦ /QI;K^ZC:h2��5/�3 C 2����¥Pe/,J6Ûh2AR¡2��5/QKAZ8Y[:#I32AP5JA/!R;JaI;O9HC/;S� �5/(Z8b5/ÜIQR;]±2��5Z8KÕJ6/,b5PeO92aZ8R[:&ZCK'2��#I�2ÕW /VW^Z8HCH5K6/92 P5à12��5/Eà5P5ß5H8ZCO /;/`Û1Z8:ºKAP5O �hI!WXI�Ûº2��#I32Üë

W^Z82��5R[Pe2 /¹:5R�W^HC/,beY[/ÂR;]52��5/X]_I;O`2aR[J6Z%$,I32aZ8R[:½R3]#�®ë[Z72®Z8K®àqR[KAK6ZCß5H8/ 2AR(ZCK6KAP5/XO,R[J6JA/,O`2aH7Û½beZCK62AJAZ8ß5Pe2a/9bKAZ8Y[:#I32AP5JA/9K�R[: �¥Pe/,J6Û�� '© 3Aë¹Z8:1I3H ¦ R[K62k2��5/^KaI ¦ / ¦ I;:5:5/9J�I;K�ZC:¡2��5/^à5J6R�R3]±R3]|áN/ ¦&¦ I � S 8�SU��S?#R[J �¹P5/,J�Û 36ë 2��5/ÝI3:5K6W /,J&W^ZCHCH�ßq/cà±R[K6KAZ8ß5HC/hR[:eH8Ûw]oR[J&IBKAàq/,O,Z7d#O;ëXà5JA/9O,R ¦ à5Pe2A/,bs÷3I;H8P5/ËR;]� ©'$���/ ([ëeW �5/9JA/��B© HCR[Y

��#S

�zg )��hg¥j\g¹¸ ��n�l_pqj�Ø�G �5R¥R[KA/ �!�1Ç¿�5TqJaI;:5beR ¦ à5J6Z ¦ /,K � ñ� � SmáN/92 + ©Ç - �%$� / K ñ� T�� ñ� S=G �5R¥R[K6/� ô��ó Ì � Î Pe:5Z8]oR[J ¦ H7Û)I32½JaI3:5b5R ¦ S�G �5R¥R[KA/³IzJaI3:5b5R ¦ ÷3I;H8P5/ � R;]�HC/9:5Y;2�� �,+ÈSzáN/`2�(© � ) ¦ R¥b&��S%áN/92 �4© � � ¦ R¥bº�®ëÅI;:5b 3!© � � 8�� P 5 S(á\/`2ºÇo� ô � ô � ô 39TEßq/½2��5/-à5P5ßeHCZCO/3/9Û[S

y|l`�qjml@j �\Ø�-VàqR[: J6/,O9/,Z8÷¥Z8:5Y02��5/�� 507 K6ZCY[:#I�2aP5J6/'�¹P5/9J6Û $ � ë�� '© 3AëXO �5R�R;KA/�IB÷3I;HCP5/ ( � R;]H8/,:5Y;2�� �,+�P5:5Z7]oR[J ¦ H8Û4I32(JAI;:5b5R ¦ S Pe2Aà5Pe2-Ç ñ��ô ( ��ô ��� T`ë=W �5/9JA/ ��� © � ���� � +��� 3 � ë=W �5/,J6/� � © �:)�8 � � ë � � ©X� �� ë13 � ©X� � 8�� P 5� S¡Ç`�Ã:)R;2��5/,JEWXR[J6b5K,ë � � ë�� � I;:5b 3 � I;J6/½÷3I;H8P5/,KVKAP5O �2��#I32J� � �� © �#ëA� � �� © ��ëXI3:5b 3 � �� © 39T`S^ ER;2a/h2��5I32zÇ ñ��ô ( ��ô���� T°O,R;:5K62AZ82aP�2a/cI�÷;I3HCZCbK6ZCY[:#I�2aP5J6/;S-Eà±R[:wJ6/,O9/,Z8÷¥Z8:5Y�2��5/ 36507cKAZCY;:#I32aPeJA/��¹P5/9J6Û $ � ë'O,R ¦ à5Pe2A/³2��5/4÷3I;H8P5/�( � © � ��� $ � S��� © � � S� VR;2A/½2��5I32 � � 8� © � � 8�� P 5 ! 5 © � 5 3(© � ��8 � +;8 3�S� VR32a/Q2��#I32(Z8] ��+�Z8KVK6P &O,ZC/9:>2aH8ÛH8R[:5YhÇo/;SMY5S7ë�� Î / ����/ /Ãë�W �5/9JA/@� Î ZCK 2��5/%H8/,:5Y;2��³R;]N2��5/ ¦ R�beP5HCP5KÕ�®ë5���sZ8K 2��5/(H8/,:5Y;2��R;]®I ¦ /9KAKaI3Y[/;ëqI;:5b /®Z8K^I&K6/,O,PeJAZ82ÃÛËà5I;JaI ¦ /92A/,JaT`ë ( � ZCK�b5Z8K62aJ6ZCß5P�2a/,bcK62aI32aZ8K62AZCOÜI3HCH8Û&O9HCR[K6/2AR&Pe:5Z8]oR[J ¦ R�÷[/9J(I3HCHÅK�2aJ6ZC:5Y[K�R3]kHC/9:5Y;2�� �,+ÈS

£�P5à5àqR[K6/X2��5/ ]oR[JAY[/9J6Û§Y[Z7÷[/,KÂÇ#$ ô ( ôÈñ[ô � TNKAPeO �º2��#I32 ñ ZCKm:5R;2kJ6/,HCI32aZ7÷[/,H7ÛQà5JAZ ¦ /�2aR ñ� S$� �e/,:ñ © ñ� ßq/,O,I;P5K6/ ñ ZCK^R;]kHC/,:eY;2�� � � S¤VHCK6R5ëqI;KE2��5/½÷;/,J6Z8d#O,I32aZ8R[:zZ8KVK6P5O,O9/,K6K6]oP5Hm]oR[JE2��5/Q]oR[JAY[/9J6ÛI;K°W /,H8HÂI;K½]oR[J½2��5/ 3 C 2�� �¹P5/9J6Û[ë � � 8 © � � � + 3³© � � � ! + ! � 8�� P 5 © � ú � P �98 û � ! ú + P +;8 û ! � 8�� SBáN/`2�ð©��=KAÆ®Ço�NT�/�� � S� ER;2a/½2��#I32(W^Z82��Ýà5JAR[ß5I;ß5ZCH8Z82ÃÛh÷;/,J6ÛÝO,H8R[KA/§2aR)�[ëq2��5/°÷3I;H8P5/��=K ó � � ô � � S¤(H8KAR5ë�:5R32a/k2��5I32�� K±Z8K|ZC:5be/,àq/,:5b5/9:>2®R[:%2��5/ÕI;be÷;/,JAKAI;J6Û CMKm÷¥Z8/9WQS�� �5/,J6/9]oR[J6/;ë;Z7]¹2��5/'à5J6R[ß#I;ßeZCHCZ72ÃÛ2��5I32 ñ� UqÇ#$ �0$ � T���/�Ç (E� ( � T�/ ñ�� ZCKE:5R[:�Þï:5/,Y;HCZCY;ZCß5H7Û �5Z8Y �5/9JE2��#I;:�� �[��ë#2��5/9:�Z82VZCK^2��e/OÜI3KA/Â2��5I32 ñ� U°Ç%$¶�=$ � T�� � /)Ç (Å� ( � T / ñ�� I;:eb ñ� U-Ç#$¶�=$ � T,Ç@Æ®Ço�NT /�� � T /)Ç (Å� ( � T / ñ�� ëI;:5bB2��e/,JA/`]oR[JA/ ñ� U Ç#$�� $ � T¡Ço:5R;2A/º2��#I32Qß>ÛBb5/`d#:5Z82AZCR[:)R3]�I4]oR[JAY;/,J6Û $ '©�$ � TÄS�ï]X2��e/HC/9:5Y;2�� � � Z8KÂ2ÃWXR1ß5Z82AK�HCR[:eY[/,JÂ2��#I;:h2��5/QH8/,:5Y;2��ËR;]kI¡÷3I;HCZ8b ¦ /,KAKAI;Y[/����(ë52��5ZCK�Z8K�Z ¦ à±R;KAKAZ8ß5HC/3S� �5/,J6/9]oR[J6/;ë¹W^Z82��¡à5JAR[ß5I;ß5ZCH8Z82ÃÛ½I32�H8/ÜI;K�2����[��ë[2��5/Â]oR[H8HCR�W^ZC:5YVO,R[:eb5Z82AZCR[:¡Z8K ¦ /`2�� ñ� ) Ç%$�� /(@/ ñ�� � � T© �mSa� �5/9JA/9]oR;JA/;ëqWX/ �#IÜ÷[/½2��5/½]oR;HCHCR�W^Z8:5Y � � � 8 ü � )! ë=W �5/,J6/-Y[O,bNÇ ñ�Ãô �ÅT © �[ëI;:5bcKARºß>ÛcáN/ ¦&¦ I � S8�[S 8 ëeW /§O,R ¦ à5Pe2A/ ñ� CM2��zJ6R�R32�R;] � S

� �5/,J6/9]oR[J6/;ë KAP5O9O,/9/,b5KÕZC:-K6R[H8÷¥Z8:5YQI;:¡ZC:eK62ÈI3:5O,/ÂR3]q2��5/@�#/#�eZ8ß5HC/¢(£�¤ à5JAR[ßeHC/ ¦ W �5/,:1�!�ZCK^I¡K6P &O,ZC/9:>2(:¹P ¦ ßq/,J�R3]$�¹P5/9JAZC/9K-Ç�W^Z82��càeJAR[ß#I3ß5ZCH8Z82ÃÛ1I32^HC/,I;K62Q� �[�°2��5Z8K�ZCKÂ2��e/§O,I;KA/Qß>Ûh2��e/cÝI;J /;R�÷-Z8:5/%�¹P#I3HCZ82ÃÛeTÄë3W �5/9:43±ZCK�O �5R[KA/9:ºO,R[J6JA/,O`2aH7ÛhÇ�2��5Z8K®ZCKm2��5/XOÜI;K6/ÂW^Z82��°à5JAR[ß5I;ß5ZCH8Z82ÃÛ¡� �[�!�½TI;:5bQW �5/9:°2��5/ÕO,R;:5b5Z82AZCR[:QZ8K ¦ /92 Ç�W^Z82��½à5J6R[ß#I;ßeZCHCZ72ÃÛ-���;��Z8:5b5/9à±/9:5b5/,:>2AH8ÛQR;]e/9÷[/9J6Û¹2��eZC:5Y%/9HCK6/�T`S� �5/9JA/9]oR;JA/;ë KAP5O9O,/9/,b5KEW^Z82��Ëà5J6R[ß#I;ßeZCHCZ72ÃÛ�� � � i � Z8:Ë2AZ ¦ /XÑ � Ç@�5T`S

� �

Page 65: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

£�ZC:eO,/^2��5/E:¹P ¦ ßq/,JÕR;]|K6ZCY[:#I�2aP5J6/��¹P5/9JAZ8/,KXZ8KÕI32 ¦ R[K�2�2��5/EJAP5:e:5ZC:5YQ2aZ ¦ /3ë[WX/ �#IÜ÷[/VK��5R�W^:2��e/Q]oR;HCHCR�W^Z8:5Y°2��e/,R[J6/ ¦ �576 g¹p=¸�g¥} r\t��Nt��|t��Â�¥�E�`�7¾;�q�;�_���a�^���È­#�`�³�E�C�^���È�`���a�V���q ¥�`�E��­#�VÓ=�_�a���¥¾½ÒVÓ�� ���È�`���(²q�_�¿���q´�����È�V²q�a�È�`�C���`�ÉÊ�«X� ¨º�%¨Ü���@¾¥�`�¡�,�a�A��ö��1���¥�½�`�7¾;�q�;�_���a�§���È­#�`�³�-�����_���³�XÑmÇ@�5T-¬'���o­&²q�a�;�È�>�,���É���@Ê��Ç@�5TÈ«k�o­#�`�z�o­#�VÓ=�@�a���¥¾°ÒEÓ��Ô���È�`���(²q�_�¿���B�A�;�Ý�`�!�,�È��ö>�`�c���c�@���³� �4ÇÉÑmÇ¿�5T6T(¬'���o­§²q�a�;�È�>�,���É���@ÊIQÇ6�ÜÇ¿�5T �`ÑmÇ¿�eTAT,´

��� � ����� �� ����� � <[$& � *,$����h.�$=<�� �!.k. ���º�!.£�P5àeà±R[K6/;ë�ZC:5K�2a/,I;bQR;]¥KAZCY;:5ZC:5Y^IÂK6ZC:5Y;HC/ ¦ /,K6KaI;Y[/�$)ë�R[:5/kWXI;:>2aKN2AREK6ZCY[:QI�ß5H8R�O"/ER;]� ¦ /,K6KaI;Y[/9K$SK ô#"#""|ô $�qS�?=R;J ¦ R[K�2ÂI;àeà5HCZ8OÜI32AZCR[:5K9ë[2��5/9KA/(2ÃW R-à5J6R[ß5H8/ ¦ KXI;J6/V/ �¹P5Z8÷3I;H8/,:>2Üë¥KAZ8:5O,/VZC:³R;JAb5/9J2aR¡K6ZCY[:hK6P5O ��I-ßeHCR¥O"/qëeZ82ÂZ8K�KAP &O9ZC/,:>2�2AR �5I;K��ËZ82X2aRºI-K ¦ I;H8H ¦ /,KAKAI;Y[/�$�P5KAZ8:5YºI¡O,R[H8HCZ8KAZCR;:�ÞJA/9KAZ8K62ÈI3:¹2 �#I3K��Ë]oP5:5O92AZCR[:Åë#I;:5bË2��5/9:c2ARºKAZCY;: $�P5KAZ8:5Y1IºR;:5/`Þ ¦ /9KAKaI3Y[/QKAZCY;:#I32aPeJA/!KAO �e/ ¦ /;S

&VR�W /9÷[/9J,ë§Z8]§2��5/�I;àeà5HCZ8OÜI32AZCR[:¶W / �5I�÷;/�Z8: ¦ ZC:eb Z8:>÷[R[H7÷[/,Kcà5J6R�÷¥Z8:5Y3/¹:5R�W^H8/,b5Y[/�R;]°IKAZ8Y[:#I32AP5JA/%I;:5bhà5J6R�÷¥Z8:5Y¡JA/9H I32AZCR[:5KXI ¦ R[:5Y-O9/,J62aI;ZC:³O,R ¦ à±R;:5/,:>2aK�R3] $SK ô"#"#"|ô $�që5Z72 ¦ I�Û1ßq/�5/9HCàe]oP5H¥2aR �5I�÷;/^I%KAZ8Y[:#I32AP5JA/ KAO �5/ ¦ /�/9KAàq/,O,ZCI;HCH7Û§b5/,K6ZCY[:5/9b-2aR��#I3:5b5HC/ ß5HCR¥O"/¹KkR;]�� ¦ /9KAKaI3Y[/,K9S&V/9JA/3ëeWX/(à5JAR[àqR[K6/%R[:5/%K6P5O �ËKAO �5/ ¦ /3S VR;2A/(2��#I�2�ZC:1R[P5JÂà5J6R[àqR[KA/9bhKAO �5/ ¦ /3ëe2��5/V÷;I3HCP5/ �wZ8Kd ��/,b �qZ@SL/3S8ë�2��5/Qà5P5ßeHCZCO�/3/9ÛËZ8K�b5/,K6ZCY[:5/9bc2AR¡WXR[J /4]oR[J^I¡KAàq/,O9Z8d#O!÷3I;HCPe/��^S�zg )]�=g¥jmg¹¸ �en�lopqjÕt :ÝZ8:5à5Pe2§�Üì3ë=O �5R�R;KA/-IºKAàq/,O9Z I;Hm¢V£�¤ ¦ R¥b5P5H8P5K��)© Ñ#ª¥ë>Ñc©ÿ�`Ñ�.j/ �[ë

ª�© �3ª . / �;S G �5R¥R[KA/3ëÂP5:5Z7]oR[J ¦ H8Û�I321JaI;:5beR ¦ ë � K ô#"#"#"Åô �� ô � ô 3 ó Ò Î S Pe2aà5P�2F��ò©�Ç_� ô � K ô#"#"#"|ô �� ô � ô 39T`ë>I3:5b³Ó5� ©ðÑNSkáN/`2 � Î be/,:5R;2A/ 2��5/ÂHC/9:5Y;2��°R;]#2��5/ ¦ R�beP5HCP5K��S7� Î ©Ú�[�±S

�ÿg¥�Ü� ���=gB�,ý �#»[g=t§á\/`2����ÿß±/&Ihà#I;JAI ¦ /92a/9J,S� �5/ ¦ /,KAKAI;Y[/ºKAà5I;O,/&O,R[:eKAZCK�2aKQR;]XI;HCH�ß5ZC:5I;J6ÛK�2aJAZ8:5Y[K R;]\HC/9:5Y;2������ES�� �¹P5Z8÷3I;H8/,:>2aH7Û[ë¥Z82XOÜI;:4ßq/(2��5R[P5Y �>2XR;]mI;KÂO9R[:5KAZ8K62AZC:5Y-R3]\ZC:>2a/9Y[/,J6KZ8:Ë2��5/QJaI;:eY[/ � � ô �! " T`S

y|l`�qjml@j �����D�=p=¸3l�n 6 } t : Z8:5à5Pe2 $SK ô"#"#"|ô $�që(O �eR�R[K6/BI�JaI;:eb5R ¦ àeJAZ ¦ /Ý:¹P ¦ ß±/9J ñ��� %" ! K R;]mHC/9:5Y;2��*� � ©'���'/w��ë5I;:ebËI-JaI;:5beR ¦ :¹P ¦ ß±/9JG(!R3]�H8/,:5Y32��*�,+'©'� Î / ���S/ /GëW �5/9JA/ /�Z8KVI¡K6/,O,PeJAZ82ÃÛ4à#I;JaI ¦ /`2a/,J9S GXR ¦ à5Pe2a/!2��5/!÷;I3HCP5/ � KAP5O �c2��#I32� � ü � � �K "#"" � ��� � + 3 ¦ R¥b¡�

Pe2Aà5Pe2^2��5/!2AP5à5HC/&Ç ñ[ô ( ô�� T`S2§g¹¸3l�i®» �en�lop±j ���D�=pq¸�l�n 6 } tH�mR-÷[/9JAZ8]�Û12��#I�2X2��e/%2aP5à5H8/¡Ç ñ[ô ( ô�� T ZCKXI-KAZCY;:#I32aPeJA/%R[: ¦ /9KAKaI3Y[/

$)ë#O �5/9O"/h2��#I32 � � ü � � �K "#"#" � � � � + 3 ¦ R¥b¡�®ë=I3:5bzO �e/,O"/h2��#I�2 ñ-� � #3 P K S576 g¹p=¸�g¥} r\tÖrmt_u#t�À|­#���`�7¾;�q�;�_���a�����È­#�`�³�V�>�`��þ;�E�C�����È�`�¥�a�\¨Ü���(�,�C���Èö��(�G¨^�³�È�È�,��¾¥�È�È«m���q ¥�`���­#�QÓ=�@�a���¥¾ºÒEÓ�� ���È�`�¥�(²q�_�¿���q´F �a���G¨9´^Ù0/ËW^Z8HCH K��5R�WõI)J6/,b5P5O`2aZ8R[:w]oJAR ¦ IÝ]oR[JAY[/9J D ]oR[J-2��5ZCK¡K6ZCY[:5I32aP5J6/4KAO �e/ ¦ /;ë 2AR�I;:I;H8Y[R[JAZ72�� ¦ 2��#I32°ß5JA/,I�/¹K°2��e/4ß#I;K6ZCO³K6ZCY[:5I32aP5J6/³K6O �5/ ¦ /4]oJAR ¦ £�/9O92AZCR[: � SU��S'� �5/4J6/,b5P5O`2aZ8R[:JA/9O,/9Z8÷[/9K^I;KXZ8:5à5Pe2 2��5/(à5P5ß5H8ZCO /;/9Û³R;]N2��e/(ß#I;K6ZCOVKAO �5/ ¦ / �(Ço� ô � ô � ô 39T`ëeI;:5b �5I;KÂR[JAI;O,H8/(I;O9O,/9KAK2aR¡2��5/Qß#I;KAZ8OQKAZCY;:#I32aPeJA/!KAO �e/ ¦ /;S

� �

Page 66: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�zg )��hg¥j\g¹¸ ��n�l_pqj�t�G �5R¥R[KA/ÝI;: Z8:5b5/�� � ó �Ö� ô � �VI321JaI3:5b5R ¦ S áN/92³á\/`2 � � © �#S ?#R[J� ó �É� ô � �@ë � '©��=ë±O �5R¥R[K6/-I;:5bÝZC:>2a/9Y[/,J &� ]oJAR ¦ Ì � Î P5:5Z7]oR[J ¦ H8Û4I32(JAI;:5b5R ¦ ëqI;:5bÝHC/92� � © � 1 � S Pe2Aà5Pe2^2��e/§àeP5ß5HCZ8O�/;/`Û0Ç_� ô ��K ô#"#"#"Nô �� ô � ô 39T`S

y|l`�qj �en��\¸�g'�=g�j\g¹¸ �en�lop±j�t :�ZC:eà5Pe2%K6ZCY[:5I32aP5J6/7�¹P5/9J6Û¯Ç%$SK ô#"#"#"Åô $�5TÄë|I;K /c2��5/-K6ZCY[:#I�2aP5J6/R[JAI;O,H8/¡]oR[J°IcKAZ8Y[:#I32AP5JA/&R[:02��5/1÷3I;H8P5/=$ � S -VàqR[:�J6/,O,/9Z8÷¥ZC:eYz2��e/1÷3I;HCPe/ÝÇ ( ô��=ôÈñ T`ë�HC/92(%.°© (1��� ���/ � &� $ � S � �5/�JA/9KAP5H72aZC:eYwKAZCY;:#I32aPeJA/)ZCK�Ç (%. ô��=ôÈñ T`SX�ï2zZ8Kh/ÜI;K�Û 2aR¯KA/9/2��#I32QZ82QZ8KQb5ZCK�2aJAZ8ß5Pe2A/,bBK62aI32aZ8K62aZ8OÜI;H8H8ÛcO,H8R[KA/¡2ARc2��5/ºJAZCY �¹2QbeZCK62AJAZ8ß5Pe2aZ8R[:)à5J6R�÷¥Z8b5/,bB2��#I�2�,+'©'� Î / ���Y/ /ÃëeW �5/9JA/ /®ZCK�K6P &O,Z8/,:>2aH7ÛhHCR[:eY5S

£�P5à5àqR[K6/X2��5/XI;be÷;/,JAKAI;J6Û CMKk]oR[JAY;/,J6Û§Z8K�Ç#$SK ô#"#"#"Nô $� ô ( ô��=ôÈñ TÄSg� �5/9:cÇ (h/�� ��/ � &� $ ��ô��=ôÈñ TZCK½Ic÷3I;H8ZCb�KAZ8Y[:#I32AP5JA/&ZC:�2��5/1ß#I;KAZ8O1K6O �5/ ¦ /4R[: ¦ /9KAKAI;Y[/*$ � SÝ£�P5àeà±R[K6/12��5/³K6ZCY[:#I�2aP5J6/FCMK ñZCK!beZ�±/,JA/9:>2½]oJ6R ¦ I;:>ÛBà5J6/9÷¥ZCR;P5KAH7Û)KA/9/,: ñ� SJ� �e/,:�W /³I3JA/ºb5R[:5/ �!WX/ �#IÜ÷[/1O,JA/,I32a/9b�]oR;JAY[/9JD�� I3:5bwO,R[:>2AJaI;b5Z8O92A/,bðáN/ ¦&¦ I � S 8eS ��S0£�R)K6P5à5àqR[KA/h2��eZCK ñ © ñ� S F Pe2cÇ%$SK ô#"#"#"Åô $�#T '©Ç#$ � K ô"#"#"|ô $ � T`S&Ù Z82��0à5J6R[ß#I;ßeZCHCZ72ÃÛ�I�2½H8/ÜI;K�2&��� ��ë�Z72QZCK!2��e/1O,I;KA/º2��#I�2 $ � ��$ � � ë�I3:5b0W /�#IÜ÷[/§O,J6/ÜI32A/,bzIº]oR;JAY[/9bcK6ZCY[:5I32aP5J6/!R[: ¦ /9KAKaI3Y[/ $ � S ÷[/,JAI;HCH@ë\Z8]Õ2��5/1I;be÷;/,JAKAI;J6Û D K6P5O,O9/,/,beK-ZC:B2aZ ¦ /%ÑmÇ@�5T(W^Z82��0à5J6R[ß#I;ßeZCHCZ72ÃÛ �§P5KAZ8:5Y �1Ç¿�eT�¹P5/,J6ZC/9K,ë>2��5/�J6/,b5PeO92aZ8R[:ºKAP5O9O,/9/,b5KXI;Y>I;Z8:5K62k2��5/�ß#I;K6ZCO�K6O �5/ ¦ /^ZC:-2aZ ¦ /�ÑmÇ¿�5T\W^Z82��ºà5J6R[ß#I;ßeZCHCZ72ÃÛI32^H8/ÜI;K�2 �"�[� �¶I3HCKARºP5K6ZC:5Y4�1Ç¿�5T@�¹P5/9JAZC/9K,S

����� ; '$¡"k$��^$&* ; '�!*,�� + �- �,�%.�Ã:!2��5Z8KNKA/9O92aZ8R[:|ë�W /�W^Z8HCH�K��5R�W �5R�W�2aR�O9R[:5K�2aJAPeO92�I�KA/,O9P5JA/�à5J6R;2aR¥O,R;H;]oR[J|K6ZCY[:5Z8:5Y�I�O,R ¦1¦ Z8262a/,bà5J6R;2aR¥O,R[HÕI;K§b5/`d#:5/,bwZ8:w£�/9O92AZCR[:.8eSU�¥S8�[ëmP5:5be/,J-R[PeJ½ß#I3KAZCO&KAZ8Y[:#I32AP5JA/&KAO �e/ ¦ /4b5/,K6O,J6ZCßq/,b�Z8:£�/9O92aZ8R[: � S ��S

� ���� ����������������� �"!$#&%'�(���� �5/!]oR[H8HCR�W^ZC:5Y½O,R ¦&¦ Z82 ¦ /,:>2XKAO �5/ ¦ /§ZCKÂbeP5/!2aR&?#P Z6ZCKAI�/¹Z|I;:5b /�I ¦ R32aR � ? 8ji �\I;:5bË/9H I;ß�ÞR[JAI32a/9bðR;:ðß>Û �!I ¦ Y*)I3JAbwI;:ebs?#P Z6Z8KaI�/¹Z � �!? � � �@S �ï2aKºKA/9O,P5J6Z82ÃÛwJ6/,H8ZC/,K°R[:w2��5/ �#I;J6b5:5/9KAKºR;]]_I;O`2aR[J6ZC:5Y5S�zg )]�=g¥jmg¹¸ �en�lopqj � �e/-à5P5ß5H8ZCO /;/`ÛÝO9R[:5K6ZCK62AK(R;]'I³KAàq/,O9Z I;Hm¢V£�¤ ¦ R�beP5HCP5K^�0R;]'HC/9:5Y;2�� � Î ëI;:eb,+ � Ò Î ë.- � /�+109ë5W �5/,J6/�/�+10^Z8KÂ2��5/QY[J6R[P5àËY[/,:e/,JaI�2a/,bcß>Û2+|S( pq}�}�l�n�}�g¥j±n,� �5/¡O9R ¦1¦ Z82 ¦ /9:>243eæ�å¥å6587\Ç F�� ô B ô & TE]oR[J!ZC:eà5Pe2aK!R3] H8/,:5Y32�� � � I;:5b�JaI;:�Þb5R ¦ :5/9KAK &¡ó Ì Î ë#ZCK�b5/`d#:5/,bÝI;KÂ]oR[H8HCR�W^K �93eæ�å¹å:587|ÇAÇo� ô - ô +=T ô B ô & T®©;- � + 1 ¦ R¥b¡�®S��g�}�}��Brmt��|t_u#t�À|­#�c�È���¡�¡���_�³�`�#�E���È­#�`�³�³ ¥�È���`�Ä�_�`�A )�>�`��þ;�1�C�º�`�ï�;�_�C�`�_�¿�A�;���ÉÊc­¥�_ ;���¥¾B�;�q �È���(²q�¥�ï�;�_�¿���q�;���ÉÊ1�,���q ;���¥¾1� ¨'¨9�¥�`�G���Ä���¥¾1�C�!­e�;�6 >´F �a���G¨9´VáN/92ºP5K½d#JAK�2ºK��5R�W 2��5/ �5Z8b5ZC:eYÝà5J6R[à±/9J62AZC/,K°R;]^2��5/4K6O �5/ ¦ /;S0áN/92Bðßq/hI�K62AJAZC:eY�R;]HC/9:5Y;2��-�

�S á\/`2ËP5KËK��5R�W�2��#I32h]oR;JËI;HCHVO,R[J6JA/,O`2 /;/9Û¥K F�� © Ço� ô - ô +=T&2��5/Bb5ZCK�2aJ6ZCß5Pe2AZCR[:Ç & � Ì Î �<3�©<3eæ�å¥å6587|Ç F�� ô B ô & T � 39TkZCKÕK62ÈI�2aZCK�2aZ8OÜI;H8H8Û½O,HCR;KA/�2aR4Ç 3 � 4=+ � � 39T`S�£�Z8:5O,/aB

ZCK�d ��/9b|ëqI;:5b>- ó 4;+ � ë5W /§OÜI;:c/%�¹P5Z7÷;I3HC/,:>2AH8ÛhK �5R�W�2��#I�2E2��5/,K6/§2ÃW R³/#��à±/9JAZ ¦ /,:>2AKVZ8:5b5P5O9/���

Page 67: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

K62aI32aZ8K62AZCOÜI3HCH8ÛBO9HCR[K6/4b5Z8K62aJ6ZCß5P�2aZCR;:5K½R;: 3 . © 3�� - � ë'Z@SL/3S8ëEÇ & � Ì Î � 3 . © + 1 ¦ R¥b¡� � 39T½Z8KK62aI32aZ8K62AZCOÜI3HCH8Û³O,H8R[KA/§2aR)Ç 3#. � 4"+ � � 3,TÄSa� �5ZCKE]oR[HCH8R�W^K^ßq/,O,I;P5KA/ & WXI;K(O �eR[KA/9:�]oJAR ¦ Ì Î ë& © & K6Æ®Ço�NT�/ & � ëeW �5/,J6/ & � Z8K�K62ÈI�2aZCK�2aZ8OÜI;H8H8Û&O,H8R[KA/!2aRºP5:eZ8]oR[J ¦ 2aRºÌÂù�ú Î�û S VR�WÔH8/92QP5KQK��eR�W 2��5/&ß5ZC:eb5ZC:5YhàeJAR[àq/,J�2ÃÛ[S1á\/`2§P5KQK��5R�W2��#I32½I;:0I;be÷[/9JAKAI;J6ÛBß5J6/ÜI�/¹Z8:5Y2��e/�ß5ZC:5beZC:5Y!à5J6R[àq/,J62ÃÛ-I;HCH8R�W^KkP5K'2aR%]_I;O`2aR[J9S'£�Peà5à±R;KA/^R[P5J'Z8:5à5Pe2'Z8K�I%KAàq/,O9Z I;H#¢V£�¤ ¦ R�beP5HCP5K�®S°áN/92��¶ßq/ºI4JaI;:5beR ¦ :¹P ¦ ßq/,J!R3] H8/,:5Y32�� � Î /��[S7 VR;2A/-2��#I�2!2��5/¡J6/,KAPeH82aZ8:5Yhà5P5ßeHCZCO5/;/`ÛZCKEb5Z8K62aJ6ZCß5P�2a/,bÝK62ÈI�2aZCK�2aZ8OÜI;H8H8Û4O9HCR[K6/§2AR³2��e/°JAZ8Y �>2(beZCK62AJAZ8ß5Pe2aZ8R[:|SE£�Peà5à±R;KA/°2��#I32EWX/¡I3JA/°Y;Z8÷[/9:IÝO9R ¦1¦ Z82 ¦ /9:>2 3�ë'I3:5b�2ÃW RÝWÂIÜÛ¥K¡R;]�R;à±/9:5ZC:5YzZ82 � - � + 1º© 31© - � ! + � ! ¦ R¥bº�®ëkK6P5O ��2��#I�2B '©MB . S�áN/`2�� © ��B�/ & ë�� . © ��B . / & . S'�ï2°]oR[H8HCR�W^K +�� P�� ! ©ò� ¦ R¥b¡�®S ER;2a/&2��#I�2KAZ8:5O,/ & I;:5b & . I;J6/°R[:eH8ÛzR;]�HC/9:5Y;2�� � Î ëÅW �5Z8HC/ � ZCKVR;]�HC/9:5Y;2�� � Î /Ú�[ë|Z72 ¦ PeK62!ßq/°2��e/-OÜI;K6/2��5I32�� '©�� . SB£�ZC:eO,/ +�� P�� ! © � ¦ R¥bº�®ëkZ72½]oR;HCHCR�W^KQ2��#I�2SU +$UÅb5Z8÷¥ZCbe/,K����� . ë'I;:5bwK6RY[O9b\Ç� ��� . ô Æ®Ç_�|TAT � � ë\I;:eb0K6RËW /1I;JA/¡b5R;:5/ºß¹Û,GXR[JAR[H8H I;J�Û � S8�[S i ë\I;KQH8R[:5YËI;K%W / /¹:5R�W� SÒ^�`�&�;�aö;´� VR32a/^2��#I32Õ]oR[J'2��e/ �5Z8b5ZC:5YQà5J6R[àq/,J62ÃÛ;ë¥2��5/(R;:5H8Û¡J6/%�¹P5Z8JA/ ¦ /,:>2Õ]oJAR ¦ 2��5/Eà5P5ß5H8ZCO /;/`ÛZCKV2��#I324- ó /�+109ë\I3:5bBKARh2��5/¡àeP5ß5HCZ8O�/;/`ÛBOÜI;:Bßq/¡Y[/,:e/,JaI�2a/,b�I;b�÷[/,J6KaI;J6Z I;H8H8Ûzà5JAR�÷¥ZCbe/,b)2��#I�22��eZCK�JA/ �¹P5ZCJ6/ ¦ /,:>2 �5R[HCbeK,S

Ù�/EWÂI3:¹2 2aR-Y;P#I;JaI3:¹2A/,/E2��5/EKA/9O,P5J6Z82ÃÛ1R;]|2��eZCKÕO,R ¦&¦ Z72 ¦ /,:>2�KAO �e/ ¦ /%/9÷;/,:4W �5/9:42��5/ /;/`ÛZCKVà5JAR�÷¥ZCbe/,b)ß>ÛÝ2��5/¡I;be÷;/,J6KaI;J�Û[S&��R³/,:5K6P5JA/-2��#I32Üë±WX/¡I3b5b�2��5/½]oR[HCH8R�W^Z8:5Y /;/9ÛÝO,/9J62aZ7d#OÜI�2aZCR;:à5J6R�O9/,b5P5J6/ �¡2��e/³à#I;J�2ÃÛB2��#I32½Y[/9:5/,JAI32a/9b�2��5/1O,R ¦&¦ Z72 ¦ /,:>2 /;/`Û¥KcÇ_� ô - ô +qT ¦ PeK62-àeJAR�÷[/4/#�¹ÞZCK�2a/9:5O,/1R;]�2��5/1b5ZCK6O,J6/92a/1HCR[Y[I;JAZ72�� ¦ H8R[Y 7 - ¦ R¥b&��S'� �eZCK§OÜI;:�ßq/³beR[:5/³PeKAZC:eYÝWX/9HCHÖÞ�/¹:5R�W^:2a/9O �5:5Z �¥Pe/,K^2��#I32^W /Q/,H I3ß±R[JAI32a/!R;:cZ8:h2��5/QKA/ �¹P5/,HXÇ_O`]GS � �!? � � � T`S� �� � !��4��������� ��� �.%'������� �.� # ������� � �"!¤(H8H®à5J6R;2aR¥O,R;HCK!I;K6KAP ¦ /-2��5I32%2��e/&àeP5ß5HCZ8O°à#I3JaI ¦ /92A/,JAK%W /,J6/¡d ��/,b0I3]�2a/9J(2��5/&I;b�÷[/,J6KaI;J�Û�WXI;Kd ��/,b�Ç_R;2��5/,J�W^ZCK6/½I¡:5R;:�ÞÃP5:eZ8]oR[J ¦ I;be÷;/,J6KaI;J�Û ¦ IÜÛ /¹:5R�WÿK6/,O9JA/92 /;/`Û¥KÈT`S

� �5/Q]oR[HCH8R�W^Z8:5Y�/¹:5R�W^:ÝàeJAR;2AR�O9R[HCK�I3JA/QKA/9O,P5J6/½P5:eb5/,J�2��e/§K�2aJ6R[:5Y1¢(£�¤ I;K6KAP ¦ àe2AZCR[: �� �'JAR¥R;]&R;] /¹:5R�W^HC/,beY[/¯R;]&b5ZCK6O,JA/`2a/¯HCR;Y>I;JAZ72�� ¦ J6/,à5J6/,KA/9:>2ÈI32AZCR[: ¦ R�b5PeHCR I O,R ¦ àqR[K�ÞZ72a/ �M? 8 � �@S=� �#I�2XZ8K�2AR°KAI�Û;ë5IQà5JAR32aR¥O,R[H#W^Z82��1O9R ¦&¦ R[:&ZC:eà5Pe2aKVÇG��TÕI³Ç_� ô -hK ô#"#"#"|ô - �XT`ëW �5/9JA/1� ZCK½IzK6à±/9O,ZCI;HÕ¢(£�¤ ¦ R�b5PeHCP5K§I;:5b - �Vó Ò Î ]oR;J°I;H8H�� � 3�� $ ��I;:eb Ç¿�;TIº÷;I3HCP5/�# ó Ò Î ë±2��5/°àeJAR�÷[/9J%à5JAR�÷;/,K /¹:5R�W^HC/9b5Y[/-R3]k÷3I;HCP5/9K �=K ô#"#"#"Åô � � K6P5O ��2��#I�2#ÿ© - ��0/ K - � 8� ¦ R�bº�®S� �'JAR¥R;]qR;] /¹:5R�W^HC/9b5Y[/�R;]q/%�¹P#I3HCZ82ÃÛ½R;]qJA/9à5JA/9KA/9:¹2aI32aZ8R[: ¦ R¥b5P5H8R(2ÃW R³Çoà±R;KAKAZ8ß5H8Û½b5Z Å/9JA/,:>2ÈTO9R ¦ àqR[K6Z82a/ ¦ R¥b5P5HCZ�� G c 8�8 ß �@S � �#I321ZCK¡2AR0KAI�Û;ë�IBà5JAR;2AR�O9R[HÂW^Z82��sO9R ¦&¦ R[:¯Z8:5à5Pe2AKÇo��K ô -QK ô#""#"Nô - �ÂT'I;:eb�Ço� � ô +RK ô#""#"|ô + �ÂT�I3:5b&2��5/^÷;I3HCP5/9K�#�K ó Ò Î � I;:eb$# � ó Ò Î ' ë2��5/(à5J6R�÷[/,JXà5JAR�÷[/9K /¹:5R�W^HC/9b5Y[/%R;]Å÷;I3HCP5/9K �=K ô#"#"#"Åô � �ðK6P5O �42��#I�2%#�K'© - ��0/ K - � 8� ¦ R¥b� K`S�I;:5b&# � © -

��0/ K + �

8� ¦ R¥b¡� � S

� �'JAR¥R;]º2��5I32�I O,R ¦&¦ Z72A2A/,bÚ÷3I;H8P5/�ZCK�2��5/wà5J6R�b5PeO92BR;]&2ÃWXR R;2��5/,J)O9R ¦&¦ Z72A2a/9b�÷3I;H7ÞP5/9K��4G c 8�8 I �@S=� �#I�2ÂZCK�2aR½KaIÜÛ[ëeI½à5J6R;2aR¥O,R;H=W^Z72��1O,R ¦&¦ R;:1Z8:5à5Pe2AK%ÇG��TÕI§O,R ¦&¦ Z82 ¦ /,:>2/3/9ÛsÇ_� ô - ô +=T(I;KQb5/9KAO,J6ZCßq/,b�ZC:0£�/9O92aZ8R[: � S � S8� �®I;:eb Ç@�[TV÷3I;HCPe/,K'# � ë�# � ë"# � � ZC:� Ò Î ëW �5/9JA/42��5/hà5JAR�÷;/,Jºà5JAR�÷;/,K /¹:5R�W^HC/,beY[/hR;]^2��5/³ZC:>2a/9Y[/,J6K � ë ë�( K`ë�( � ë�( � KAP5O �¯2��#I�2#�©=- � +�) � ¦ R�bº�®ë�# � ©;-

� +�) ' ¦ R�bº��ë#I;:5b&# � � ©;- �� +�)�* ¦ R�bº�®S

� �

Page 68: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� �'JAR¥R;]!2��#I32ËI�O9R ¦1¦ Z8262a/9bs÷3I;HCPe/ÝHCZ8/,K1ZC: I�Y[Z7÷[/9: ZC:>2a/9Y[/,J4Z8:>2a/,J�÷3I;H � áNZCà � ���¿S � �#I�2Z8Kº2AR�KAI�Û;ë�I0àeJAR;2AR�O9R[HÂW^Z82��sO9R ¦1¦ R[:ðZC:5àePe2aKzÇ���T&IBO,R ¦&¦ Z82 ¦ /,:>2 /3/9ÛÚÇ_� ô - ô +=TºI3Kb5/9KAO9JAZCßq/,b³ZC:h£¥/,O92AZCR[: � S � S8� �|Ç@�[TÕIQ÷3I;HCP5/�# ó Ò Î �NÇ#8>T�Z8:>2a/,Y;/,JAK �ºI;:5b���ë¥W �5/,J6/(2��e/à5J6R�÷[/,JÕà5J6R�÷;/,K /¥:eR�W^H8/,b5Y;/(R;]q2��5/EZC:>2A/,Y[/9JAK ��I3:5b (°KAP5O �³2��#I32�#ÿ©;- � +�) ¦ R¥b¡�ÝI3:5b� � � � ��S

×zp#n ��n�l_pqj�Ø �Ã:w2��e/hKA/%�¹P5/9H¿ë�WX/4W^Z8HCH KAR ¦ /92AZ ¦ /,K°PeKA/h2��5/h:eR;2ÈI32AZCR[:�ZC:>2aJ6R�b5PeO,/,b¯ß>Û^GÂI�Þ¦ /,:5Z8KAO �4I3:5bh£¥2aI;b5H8/,J �4G�£ 8 � �#]oR[JÕ÷3I;J6ZCR[PeKÕàeJAR¥R;]oK�R;] /¹:5R�W^HC/9b5Y[/VR;]|b5Z8KAO9JA/92A/(H8R[Y>I;J6Z82�� ¦ K'I3:5bà5J6R�R;]oK�R3]�2��5/!÷;I3HCZCbeZ82ÃÛ1R;]®K�2ÈI32A/ ¦ /,:>2aKEI;ßqR[Pe2Eb5Z8KAO9JA/92A/QHCR[Y>I3JAZ82�� ¦ K,Sk?#R[JXZC:5K�2ÈI;:5O9/;ë

F�� ��Ç � ô��ô �ÅT � \¡©=- � + � � �\º©��- � �+ � Ç � � � � � T �b5/9:5R;2a/9KËI�� ���`�a���¿ö��Å��¬��C�A �¾¥� �^�a���G¨B�G¨��¡�Å��¬��C�A �¾¥�B�G¨c���#�G�¿¾¥�`�a� ��« «1�;�q  � �`�=�È­ �o­e�;�\ © - � + � �;�q �\ © �- � �+ ­#���7 ��È«¡¬®­#�`�a� � 4 � 4 � ë�wW �5/9JA/ \ ô - ô + ô �\ ô �-=ë^I;:5b �+ I;J6//,H8/ ¦ /,:>2aK(R;]�KAR ¦ /°Y;JAR[P5àeK � © / -.0�©�/�+10(I;:5b ��© /��- 0^© / �+109S�� �5/¡O,R;:¹÷;/,:>2aZ8R[:)ZCKE2��#I�2D!JA/,/�/½H8/9262a/,J6K®b5/9:5R;2A/@�¹P#I;:>2aZ72aZC/9K�2��5/6/¹:5R�W^HC/9b5Y[/ÂR3]#W �5ZCO �-Z8K®ßq/,Z8:5Y(à5J6R�÷[/,bÅë¹W �eZCHC/ I;H8H¥R32��5/9Jà#I;JAI ¦ /92a/9JAK½I;JA/ /¹:5R�W^:�2aRc2��5/&÷[/,J6Z8d#/9J,S -VK6ZC:5YË2��eZCK§:5R;2ÈI�2aZCR;:|ë®Icà5JAR¥R;] Þïà5JAR;2AR�O9R[HkO,I;:�ßq/b5/9KAO,J6ZCßq/,bcß>Û7Z6P5K62EàqR[ZC:>2aZ8:5Y¡R[Pe2^Z72aK^I;Z ¦ W �5Z8HC/ �eZCb5Z8:5YºI;HCHÅb5/92aI;ZCH8K,S

Ù�/!W^Z8HCH|:5R�WÚà5JA/9KA/,:>2E2��5/Qà5J6R;2aR¥O,R;HCKÂ2��e/ ¦ KA/,H7÷[/9K,S

� ���� ����� � �>�������'����� � !�� � � �,����������������� ����� ���4��� �Ù0/&:eR�W K��5R�W IËà5J6R�R;]ÕR;] /¹:5R�W^HC/9b5Y[/&à5JAR;2AR�O9R[H®]oR[J!àeJAR�÷¥ZC:5Y /¹:5R�W^HC/,beY[/ºR;]ÂIËO,R ¦1¦ Z8262a/,b÷3I;HCPe/;S�Ù0/EY[Z8÷;/VI��ÕÞïà5JAR;2AR�O9R[H#à5J6R�R;]±R;] /¹:5R�W^HC/,beY[/VR3]ÅJ6/,à5J6/,KA/9:>2ÈI32AZCR[: ��Z82�O,I;:1ßq/^O,R[:>÷;/,J62A/,bZC:>2ARwI�Y[/,:e/,JaI3H $,/9JAR3Þ /¹:5R�W^HC/,beY[/�à5J6R�R;]QPeKAZC:eYwK62ÈI3:5b#I;J6b¶2a/,O �e:5Z �¹P5/9Kcß5I;KA/9b R[:¶2aJAI;à±beR�R[JO,R ¦1¦ Z82 ¦ /9:¹2ºK6O �5/ ¦ /,K9ëVbe/,KAO9JAZ8ß±/9b¶ZC:¶£�/,O`2aZCR;: ��S � S7�[S ¤(HCH^à5J6R;2aR¥O,R;HCK1I;JA/zZC:¯2��5/zà5P5ß5H8ZCO`Þà#I;JAI ¦ /92a/9J ¦ R¥b5/9H¿S

��� �!�!�#"%$&"('*),+.-0/2143�57698;:=<?>A@CBD8;BFE�37<4378;1HG 1 BFIKJLG ì0MN&OQP�RCP;S#T /UB�@C69V#W=:=5YXF37>AZF[\<^]93_5`Z0E�Ea:b<^E�3�Ic< MB�5`Z0EaEa:b<^Ea3�Id<Hegf R � S � E�ZhJ OQijlk �nm#o kdp -A$&"('*),+.-0/rqsBFIKJut i

vxw y{z}| ]KZcZ0143~G 1�� VC:b<�� K P � � BD<H8�BFIKJ9Z0E i�� 3�ICJu��f R 1 � S 1 ' <4Za<^]93_�Q378;:b�K378 iv���w�z}� 3�IK378;BD<43�BFILG

9 � VC:b<�5�]KBFW=Wb3�I9�F3�� i

vxw y{z}| Z0Ea@C69<43�<^]93�8^3�1^@ Z0IC143_� K f�� K\� ��q��#� � f�� � � ��t i

�A�0�0on'(+.�C"(�0oC���H]K3��F378;:b�K378HBF575`37@K<^1�:b[\�~e 9 f R + � S + ' i?�ZCY[P5J6/ � Þa�����ÕÞ �'JAR32aR¥O,R[H �'J6R�R;]�R;]®¢E/9à5JA/9KA/9:¹2aI32aZ8R[:SczR�beP5HCR&IJGXR ¦ à±R[K6Z82A/

� i

Page 69: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��g�}�}��Brmt��|t8µ|t,+m�q ¥�`����­#��Ó=�_�a���¥¾�ÒEÓ�� ���È�`�¥�(²q�@�¿���e«¡�o­#�1²q�È���Ã���È���( ¥�È���`�`�_�`�A w�������7¾;��¥�È���#� ���C�z� �(�C²q�a���G���È��� ���`�È���¿ö��Å��¬��C�A �¾¥�½²q�a���G¨z�G¨4ö��Å��¬��C�A �¾¥�c�G¨h¬'���@�Å�È�È�cÇDB ô \eT!¨Ü���h��­#��a�`�7�;�@�¿���

� Î�� ��� 7 © � � ô ÇDB ô \eT��$� ©;- � + � ¦ R�bº� �´F �a���G¨9´�� �5/¡O9R ¦ àeHC/92A/,:5/9KAK%Z8K(R[ß>÷¥ZCR;P5K �^Z8]®2��5/-àeJAR�÷[/9J%]oR[HCH8R�W^K^2��e/°à5J6R;2aR¥O,R[H@ëq2��5/,:� � 9 ©- 1 � + 1 ' Ç - � + � T 9 © - 1 � !#9 � + 1 ' !#9 � ©;- + � + + ' S

� �5/�� $,/,J6R�/¹:5R�W^HC/9b5Y[/Eà5JAR;à±/9J62ÃÛº]oR[HCH8R�W^K'ß±/9OÜI;P5K6/(K6P5à5àqR[KA/E2��5/EO �#I;H8HC/,:eY[/63^Z8K'd ��/,b4Z8:I;be÷3I;:eO,/;S � �e/,:Ý2��5/°K6Z ¦ P5HCI32aR;JÂO �5R¥R[KA/9K ( K^I;:5b ( � I32VJaI;:eb5R ¦ ë=I;:5bÝK6/92AK� © - + � + + ' � � 9 S�ï]� 1 © � 9 / ¦ I*�ÅÇ � � ô � � ô � Î T / /kW �5/9JA/ /'ZCKVI1K6/,O9P5JAZ72ÃÛÝà#I3JaI ¦ /92A/,J,ë=2��e/,:�O �5R¥R[K6ZC:5Y�( KEI3:5b( � I�2^JaI;:5beR ¦ ZCK�K�2ÈI32AZCK�2aZCO,I;HCH7Û&ZC:5b5Z8K62AZC:5Y[PeZCK��5I;ß5HC/3S

� �5/°/#�¥2aJaI3O92aZ8R[:Ë]oR[HCH8R�W^K^ßq/,O,I;P5KA/½KAP5àeà±R[K6/½2��#I32^W^Z82��Ý:5R[:¥ÞÃ:5/9Y[HCZ8Y[ZCß5H8/(à5J6R[ß#I;ßeZCHCZ72ÃÛ4R�÷[/9J2��e/ÂO �5R[Z8O,/ÂR;]=2��5/ÂO �#I;H8HC/9:5Y[/�3�ë;2��5/�à5JAR�÷;/,J'OÜI3P5KA/9Kk2��5/X÷;/,J6Z8d#/9Jk2aR!I;O9O,/9àe2ÜS=� �e/,:¡2��5/ ÷[/,J6Z8d#/9JOÜI3:1Y[/`2'2ÃWXR½I;O9O,/,à�2aZC:eY§2AJaI;:5K6O,J6ZCàe2AK'ß#I;KA/9b³R[:¡2��5/^KaI ¦ /��-ë>W^Z82��ºO �#I3HCHC/9:5Y[/9K 3ÂI;:5b 3#.CS=� �5Z8KJA/9KAP5H72aK^ZC:h2��5/Q/%�¹P#I32AZCR[:5K�� � 9 ©=- + � + + ' I;:5b � � 9

! ©=- + ! � + + ! ' S( � �5l@} tQ¼\�`���&© 3^� 3�.o´0À|­#�`��� UNÇ (jK'� (%. K T&�;�q �� U|Ç ( � � (W.� TÈ«^�¥�q ¥�`�-��­#�¡Ó=�@�a���¥¾4ÒVÓ�����È�`�¥�(²q�@�¿���q´

F �a���G¨-�G¨°�`�7�;���&´(£�Peà5à±R;KA/^2��#I32(Ço� ô -eTkI;J6/VI3:1Z8:5K62aI;:5O,/ER;]±2��5/ �#/#�eZ8ß5HC/E¢V£�¤ à5JAR;ß5HC/ ¦ Sg� �5//��¥2AJaI;O`2aR[J�KA/`2aKÕP5à¡2��5/^à5Peß5HCZ8O,/;/9ÛºR3]±2��5/^O,R ¦&¦ Z72 ¦ /,:>2kß>Û¡O �eR�R[K6ZC:5Y½I!JaI;:eb5R ¦ ��R3]ÅH8/,:5Y;2���,+�/ 8ºI;:ebzH8/92A2AZC:5Y�F�� © Ç_� ô - ô +=T`ëeW �e/,JA/ +³©=- � ¦ R�bº��S

VR�W 2��5/B/��¥2aJAI;O92AR[JËR[ße2aI;ZC:5Kh/ �¹P#I32aZ8R[:5K�� � 9 © - + � + + ' I;:5b�� � 9! © - + ! � + + ! ' S áN/`2

� © Ç ( KN� (%. K Td/ �ÂÇ ( � � (%.� T`ë��Q© 3'� 3�.�ë5I;:eb4KAP5àeà±R[K6/%]oR[JÂO9R[:>2aJaI3b5ZCO`2aZCR;:12��5I32�� ) Ç ( � � (W.� TR[J�� ) � S� �5/Ë/%�¹P#I32AZCR[:eK¡Y[Z8÷;/hP5K-2��#I�2 ��� ü -�� ¦ R¥bº�®S � �5/,J6/9]oR[J6/;ëÕZ8]�� ) � ë'W /Ëß5JA/,I�/�2��e/

£¥2AJAR[:5Y-¢(£�¤ÚI;KAK6P ¦ àe2aZ8R[:³ß>Û³á\/ ¦1¦ I � S8�[S7� � I;:5b4W /!I;JA/Vb5R[:5/3SÕ£�R°W /(W^ZCK �³2aR°K��5R�W 2��#I�22��eZCK �#I;àeà±/9:5KEW^Z72��Ë:5R[:¥ÞÃ:5/9Y[HCZ8Y[ZCß5H8/VàeJAR[ß#I3ß5ZCH8Z82ÃÛ[ë�KaIÜÛ[ë=I�2VH8/ÜI;K�2Q���[��S£�P5à5àqR[K6/;ë�2��5/,:Åë�2��5I32Üë�� U � I;:5b�� ) Ç ( � �'( . � TÄS4áN/92 � © �=KAÆ®Ço�NT=/ � � Sh£�Z8:5O,/ �=K%Z8KZC:eb5/,àq/,:5be/,:>2®R3]�2��5/XI3be÷[/9JAKaI3J6Û CLKm÷¥ZC/9WQë�]oR[JNK6R ¦ /�O �5R;ZCO,/�R;]!� KÈë���U � ©�Ç ( K,� (%. K T�/³Ç �=KAÆ®Ço�NT�/

� � T,Ç ( � � (W.� T I;:5b���U � .5© Ç ( Kq� (%. K T�/ðÇAÇ � K /w��TAÆ�Ç_�|T�/ � � T9Ç ( � � (%.� TÄS=� �5/,J6/9]oR[J6/;ë��!b5Z7÷¥ZCb5/9KÇ � .,� � T`ë�Z¿SM/;S7ë ��U3Æ®Ç_�|T,Ç ( � � (%.� T`SÕ£¥ZC:5O9/!� ) Ç ( � � (%.� T`ë¹Z82Õ]oR[H8HCR�W^K'2��#I32ÕY[O9bmÇ"� ô Æ�Ç_�NT6T ��� I3:5bW /°I;J6/!b5R[:5/Qß>Û'GXR[J6R[HCHCI;J6Û � S7�[S i S� �¹P5K,ëqZ82 ¦ P5K62Eßq/Q2��#I32���U�Ç ( � �0(%.� T�I;:5b �fU � S �ï2�]oR[HCH8R�W^KÂ2��#I32���U�Ç ( K®�0(%. K TÄS

?#JAR ¦ 2��5/EO,H I3Z ¦ ë[Z82']oR[H8HCR�W^Kk2��5I32Üë¹Z8]qW /VH8/92 BË©�Ç ( K#� (%. K T����¥ë¥I;:5bJ\º©Ç ( � � (%.� T����¹ë[2��e/,:ÇDB ô \5TÕI;JA/!I-J6/,à5J6/,K6/,:>2ÈI32AZCR[:ËR;]"�~Z8:4ß#I;K6/,K�-³I;:5b +|ë ¦ R�b5PeHCR°��S VR;2A/(2��5I32Â2��e/!/��¥2aJAI;O92A/,b÷3I;HCPe/,K^I;J6/§:eR;2^:5/,O9/,K6KaI;J6ZCH8ÛËàqR[K6Z82aZ7÷[/3S

Ò^�`�&�;�aö;´��ï2!Z8K(/ÜI3K6ÛÝ2ARhKA/9/ �5R�W�2AR4Y[/,:e/,JaI3HCZ%$9/½2��5ZCK%àeJAR;2AR�O9R[H®I3:5b�2��5/¡O9R[JAJ6/,K6à±R[:eb5ZC:5Yh/#�¹Þ2aJAI;O92AR[JÂ2aR¡2��5/QOÜI;K6/§W �5/9JA/§ZC:5K�2a/,I;bËR;](-qëe2��5/,J6/°I3JA/!KA/`÷[/9JaI;H\ß#I;K6/,K°Ç -QK ô#"#""Nô -�#�T`S

��8

Page 70: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� �� ����� � �>������� � � � � � � � �,����������� � �"!�� � ���'�"��ï2§W^ZCHCH®KAR ¦ /92AZ ¦ /,KQß±/&:5/9O,/,K6KaI;J�Û02ARÝà5J6R�÷[/³/ �¹P#I;HCZ72ÃÛ)R;]Â2ÃW RÝO9R ¦&¦ Z72A2a/9b)÷;I3HCP5/9K,ëmà±R[K6KAZ8ß5H8ÛO,R ¦1¦ Z8262a/,b)2ARzP5:eb5/,J½b5Z�±/,J6/,:>2°O9R ¦&¦ Z72 ¦ /,:>2�/;/`Û¥K,Sc?#R[J!2��#I32,ëmW /³/#���5ZCß5Z72Q2��5/º]oR[HCH8R�W^ZC:5Y�ÕÞÃàeJAR;2AR�O9R[H �

��� �!�!�#"%$&"('*),+.-0/2143�57698;:=<?>A@CBD8;BFE�37<4378;1HG 1 BFIKJLG ì0MN&O K P�R K P;S K T BFIKJ N&O � P�R � P;S � T /r@#69VCW=:=5�XF37>n1�ZF[*<^]93l5`Z0EaEa:b<^Ea3�Id< MB�5`Z0EaEa:b<^Ea3�Id<Hegf R � K S � K E�ZhJ O K BFIKJf R �� S��� E�ZnJ O � ijlk �nm#o kdp -A$&"('*),+.-0/rq��Kt �� i

vxw y{z}| ]KZcZ0143sG 1;� VC:=<�� K P � � P � � BD<L8;BFIKJKZ0E i� 3�IKJ�� K f R 1 �K S 1 'K E�ZhJ O K ��� � fR 1 '� S 1 *� E�ZhJ O � <4Za<^]93l�Q378�:b�K378 i

v���w�z}� 3�IK378;BD<43�BFILG ì � VC:b<�5;]KBFW Wb3�I9�F3_� ivxw y{z}| Z0Ea@C69<43�<^]93�8^3�1^@ Z0IC143_� K f�� K\� ��q��#� � f�� � � ��t#� � � f�� � � �� i

�A�0�0on'(+.�C"(�0oC���H]K3��F378�:b�K378 BF575`37@K<^1 :=[!� K e 9 f R + �K S + 'K E�ZhJ O K BFIKJ�� � 9 fR + �K S + *� EaZnJ O � i?®ZCY;P5JA/ � ÞG� �Y�ÕÞ �'JAR32aR¥O,R[H �'JAR¥R;]®R;]7� �¹P#I;H8Z82ÃÛhR;]k¢E/9à5JA/9KA/9:¹2aI32aZ8R[:SczR�beP5HCR1I�GXR ¦ Þà±R;KAZ82A/

��g�}�}��Brmt��|t��|t,+m�q ¥�`����­#��Ó=�_�a���¥¾�ÒEÓ�� ���È�`�¥�(²q�@�¿���e«¡�o­#�1²q�È���Ã���È���( ¥�È���`�`�_�`�A w�������7¾;��¥�È�!�#� �c�C�º� �(�C²q�a���G���È��� ���`�a���¿ö��Å��¬��C�A �¾¥��²q�È���G¨º�G¨Qö��Å��¬��C�A �¾¥�&�G¨½¬'���_�Å�È�È�¡ÇCB ô \ ô �>T ¨Ü���°��­#��a�`�7�;�@�¿��� � Î�� � � � 7 � � � ' � 7 ' © � � ô��Õô ÇCB ô \ ô �>T��$� ©;- �K + � K ¦ R�bº�J� � ©=- �� + �� � ´F �a���G¨9´����5/!O9R ¦ àeHC/92A/,:5/9KAK�I3:5b.$,/9JAR3Þ /¹:5R�W^HC/,beY[/%à5J6R[à±/9J62AZC/,K ]oR[HCH8R�W ZC:³2��5/(KAI ¦ /(WÂIÜÛ³I;KÂZ8:2��e/-à5JAR¥R;]ÕR;]ÕáN/ ¦&¦ I � S � SU�¥S����5/¡/��¥2aJAI;O92AZCR[:)àeJAR[àq/,J�2ÃÛÝ]oR[H8HCR�W^KVßq/,O,I;P5K6/;ëmI;K%Z8:Ý2��5/¡àeJAR¥R;]R;]VáN/ ¦&¦ I � S � SU��ë®Z82��#I3K°2aR)ßq/³2��e/hOÜI;K6/42��#I32,ë'Z8]�W /ËR[ße2ÈI3ZC:�2ÃW R�I;O,O9/,àe2AZC:5Y�2AJaI;:5K6O,J6ZCàe2AKßqR;2���ß5I;KA/9bwR[: Ç"�&K ô � � TÄëkW^Z82���O��#I;HCH8/,:5Y;/,K 3&I;:5b 3#.Õ©73 / �¹ë®W /4Y[/`27B¶©�Ç ( KÂ� (%. K T ���¥ë\0© Ç ( � � (%.� T����¹ëkI3:5b �)© Ç ( � �'(%. � T ���¥ë®I;HCH�R�÷[/9J°2��e/1Z8:¹2A/,Y[/9JAK9ëkP5:5b5/9J°2��e/h£¥2AJAR[:5YÝ¢(£¥¤I;K6KAP ¦ àe2aZ8R[:|SÒ^�`�&�;�aö;´� VR32a/Q2��#I32,ëqW��eZCHC/!2��5/°à5J6R;2aR¥O,R;HmZ8:Ý?�ZCY[P5J6/ � ÞÈ�§R[:5H8ÛhW R[J /;/,bz]oR[J(I&O,R ¦&¦ Z82 ¦ /,:>2/;/`Û�O��5R[KA/9:�ZC:0Ih2aJAPeK62a/9b�KA/`2aP5à�à��#I;K6/1P5:eZ8]oR[J ¦ H7Û)I32§JaI3:5b5R ¦ ëN2��5/&à5JAR¥R;]XR;]ÂK6/,O,PeJAZ82ÃÛ)]oR;J2��e/°à5J6R;2aR¥O,R[H\Z8:�?®Z8Y[P5JA/ � ÞG�&Y[R¥/,K^2��eJAR[P5Y���KAR4H8R[:5Y1I;K Z6PeK621���Å��R;]k2��e/°O,R ¦1¦ Z82 ¦ /9:¹2 /3/9Û¥KWXI;K!O��5R[K6/,:�ZC:�2��eZCK(]_I;K��5ZCR;:|S����5/ºR;2��e/,J%R[:e/ ¦ IÜÛzß±/-O��eR[KA/9:0Z8:)I;:�I;JAßeZ82aJAI;J6ÛËWXIÜÛ[ë|W^Z82��÷3I;JAZ8R[P5K§à#I;JAI ¦ /`2a/9JAK�/¹:5R�W^:�2ARz2��e/4I;be÷;/,J6KaI;J�Û[S ���5Z8K½R;ß5KA/9J6÷3I32aZ8R[:�Z8K½b5Pe/12aR GÂI ¦ /9:5ZCK6O��I;:5bSczZ8O��5/,H8K � G c 8�8 I �¿S� �� � ����� � ����% � �� � ������� � � � !�� � ���'��� � �"� ��� �9��� � � �"����� ����5/4HCI;K62½à5J6R�R;]ÂR;],/¹:5R�W^HC/9b5Y[/4à5J6R;2aR¥O,R;H�W /³W^Z8HCH':5/9/,bwZC:�2��5Z8K°K6/,O92AZCR[:�ZCK½IÝà5JAR¥R;]Â2��#I32°IO,R ¦1¦ Z8262a/,bº÷3I;HCPe/VH8ZC/,K�Z8:4I;:4Z8:>2a/,J�÷3I;H¿Sg���5ZCK ZCKÕb5P5/V2AR¡áNZCà ¦ I[I � á\Z8à � ���¿ë�P5KAZ8:5Y°/,I;JAH8ZC/,J'W R[J�/

���

Page 71: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

R;] F R[P5beR;2� F R[P ��� �\I;:5bcR;]=G �#I;:|ë=?#JAI;: /;/9HmI;:5b"��KAZ8R[P5:5Z8K �4GÂ?$� 8 i �¿SáNZCà ¦ I[I CMK�ZCKEI1K6Z ¦ à5HC/QI3:5bz/9HC/9Y>I;:>2EJA/,K6P5H82E2��5I32EY[Z8÷;/,KEK62ÈI�2aZCK�2aZ8OÜI;H1$9/,J6R3Þ�/¹:5R�W^HC/9b5Y[/½à5JAR3Þ

2aR¥O,R;HCK%2��5I32½IcO9R ¦1¦ Z8262a/9b)ZC:>2a/9Y[/,J�BwH8ZC/,K%W^Z72��5Z8:�IcY[Z7÷[/9:0Z8:¹2A/,J�÷;I3HEÇT� ô �`T`SJ���5/³Z8b5/ÜIhZ8K½I3K]oR[H8HCR�W^K ��[Sa���5/ºà5J6R[ß5H8/ ¦ R3]XK��5R�W^ZC:5YË2��#I�2�B ó ÇT� ô �`T%ZCK!J6/,b5PeO,/,b�2aRh2��e/&àeJAR[ß5H8/ ¦ 2aRËK��5R�W^Z8:5Y2��#I32®I(:¹P ¦ ßq/,J®Z8K�àqR[K6Z82aZ7÷[/ � B ó ÇT� ô �`T � B �7� � � �a�¥��B � � S��ï] # ©=- � + 1 ¦ R�bº�®ë2��5/,:�H8/92 #

�©�#�� - �X¦ R¥b&��ëÅI3:5b # � ©"- � � # ¦ R�bº�®S� ER�W W / �#IÜ÷;/°2aR1K��5R�W 2��#I�2

#�I3:5b #

�I;J6/Qß±R;2��ËO,R ¦&¦ Z72 ¦ /,:>2X2AR1àqR[K6Z82aZ7÷[/!Z8:¹2A/,Y[/9JAK9S

��Sa�ï2§ZCK§IhWX/9HCHÖÞ�/¹:5R�W^:�]_I3O92§b5P5/º2aRzá\I;Y[JaI3:5Y[/-2��5I32½I;:>ÛB:5R[:�Þï:5/,Y>I�2aZ8÷;/ºZC:>2a/9Y[/,JQOÜI3:�ßq/J6/,à5J6/,KA/9:>2a/,bËI3KXI§KAP ¦ R;]±]oR[P5JÕK_�¹P#I;J6/,K9S ¢EI;ß5Z8:&I;:5bh£��#I;HCH8Z82 � ¢V£ i�� �qY>IÜ÷[/VI;:1/ &O,Z8/,:>2I;H8Y[R[J6Z82�� ¦ ]oR;J§O9R ¦ à5Pe2aZ8:5Y42��eZCK!JA/9à5JA/9KA/9:¹2aI32aZ8R[:|SJ���¹P5K§2��5/¡2ÈI;K /�ZCK!2ARcK��5R�W2��5I32§IO9R ¦1¦ Z8262a/9bh:¥P ¦ ß±/9J^ZCK^I¡KAP ¦ R;]kK �¥P5I;JA/9K,S

8eSV£��eR�W^Z8:5Y12��#I32VI1O9R ¦&¦ Z72A2a/9bË:¥P ¦ ß±/9JVZ8K(IºKAP ¦ R3]kKA/`÷[/9JaI;H�R;2��5/9JVO9R ¦&¦ Z72A2a/9bh÷;I3HCP5/9KZ8K'K62aJAI;ZCY��¹26]oR[J6WXI;J6b|S'áN/92 � I;:5b � ßq/�2ÃWXR½O,R ¦&¦ Z72 ¦ /,:>2aK9Sg�mR§K��5R�W¶2��#I32 I§O9R ¦&¦ Z726Þ¦ /,:>2 ) ZCKk2aR!2��5/�÷;I3HCP5/ �°© B@/�\që>Z82�ZCK'K6P &O,Z8/,:>2 2ARQK��5R�W¶2��#I32 ) ZCK�I!O,R ¦&¦ Z82 ¦ /,:>22ARº2��5/QKaI ¦ /!÷3I;HCP5/QI3K � � S

� S �'JAR�÷;/^2��#I32ÕI!O,R ¦1¦ Z8262a/,b°:¥P ¦ ß±/9J'ZCK'I!K �¥P5I;JA/3ë¥PeKAZC:eYQ2��5/�à5J6R;2aR¥O,R[H�]oR[JkK��eR�W^Z8:5Y!2��#I�2I¡O,R ¦1¦ Z8262a/,bh:¹P ¦ ß±/9JEZ8K^I¡à5JAR¥b5P5O`2VR3]�2ÃW R1R32��5/9JEO9R ¦&¦ Z72A2a/9b4÷3I;HCP5/9K,ë5ßq/,H8R�WQS���5/³R;:5H8Û)J6/ ¦ I;ZC:eZC:5YËà5J6R;2aR¥O,R[Hk2ARÝY[Z7÷[/&ZCK!]oR[JQà5J6R�÷¥Z8:5Yz2��#I32°IcO9R ¦1¦ Z8262a/9b�:¹P ¦ ß±/9J½Z8K2��e/§àeJAR¥b5P5O92ER;]m2ÃW R1R;2��5/,J^O9R ¦1¦ Z8262a/9bh:¥P ¦ ß±/9JAK9S

��� �!�!�#"%$&"('*),+.-0/2143�57698;:=<?>A@CBD8;BFE�37<4378;1HG 1 BFIKJLG ì0MN&OQP�RCP;S#T /�@C69VCW :=5�XF37>LZF[QB�5`Z0EaEa:=<^E�3�Id<Y1^5;]93�Ea3 M5`Z0EaEa:b<^Ea3�Id<^1���f R � S 1�� E�ZhJ O ��� �

f R � S 1�� EaZnJ OBFIKJ�� � f R � � S 1 i

jlk �nm#o kdp -A$&"('*),+.-0/rq��Kt �9���9�

��9� � i

v���y{z�� 1^:=I9�L<^]93�@C8^ZF<4Zn5`Z0Wr�0:b�F3�I :=I� *:b�0698^3�� ��� �\57BD8^8^> Z069<~<^]93�[ Z0W WbZ���: I9�L@K8^ZnZF[&17�6K1^: I9��143�57698;:b< > @#BD8;BFE�37<4378;1HG 1 BFIKJAG ì /� i������cN��2P�� � T /�� �

f R � S )��! i� i������cN#"rP�� � P�� . T /$� �

f R � S ) �&% � � f'� �� S )!

?®ZCY;P5JA/ � Þ 8 ���ÕÞ �'JAR;2AR�O9R[H±]oR;J �'JAR�÷¥ZC:5Y ���#I32�I GXR ¦1¦ Z8262a/9b VP ¦ ß±/9J �ÃKÂ2��5/��'J6R�b�ÞP5O92ER;]g�ÂW R 2��5/9J�GXR ¦&¦ Z72A2a/9b" VP ¦ ß±/9JAK

��g�}�}��Brmt��|tÖr\t,+m�q ¥�`����­#��Ó=�_�a���¥¾�ÒEÓ�� ���È�`�¥�(²q�@�¿���e«¡�o­#�1²q�È���Ã���È���( ¥�È���`�`�_�`�A w�������7¾;��¥�È�!�#� �h�C�-�u�(�C²q�È���Ã���È��� ���`�È���¿ö��Å��¬��C�A �¾¥�X²q�È���G¨¡�G¨!ö��Å��¬��C�A �¾¥�-�G¨§¬'���_�Å�È�È�¡ÇCB ô \ ô & � ô & � ô & � T6T¨Ü������­#�w�a�`�7�;�_�¿��� � Î � � � 7 © � � ô���ô )Vô ÇDB ô \ ô & � ô & � ô & � T � � © - � + 1� ¦ R¥b&� � � ©- � + 1�� ¦ R�bº�J� ) ©;- � � + 1 � ´

� �

Page 72: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

F �a���G¨9´V?®Z8JAK62,ë¹HC/92 P5K Y[Z8÷;/E2��5/ /¹:5R�W^H8/,b5Y[/(/��¥2aJAI;O92AR[J,S�£¥ZC:5O9/(ßqR;2��1R;]Å2��5/(K�2a/,àeKXR;]|2��5/(àeJAR¥R;]I;J6/EàeJAR¥R;]oK'R;] /¥:eR�W^H8/,b5Y;/ER3]Å/ �¥P5I;HCZ72ÃÛ¡R;]±JA/,àeJA/,K6/,:>2ÈI�2aZCR;:|ë¹ß¹Û&áN/ ¦1¦ I � S � S 8�ë[WX/^OÜI3:1/#��2AJaI;O`22��e/Ë÷3I;H8P5/,KcÇ � ô��ô ( � ô ( � ô ( .ÖT°K6P5O��s2��#I32 # � © - � +�)��[ë #

�© - � +�)���ë I;:5b�# � © # �� +�)

! ©- � � +�) � � ! ) ! S Pe2aàePe2^2��5/!÷3I;HCPe/,K§Ç � ô��ô ( � ô ( � ô ( � / ( .7T`S¤(KX]oR;JÕ2��5/ $,/9JAR3Þ /¹:5R�W^HC/,beY[/(à5J6R[àq/,J62ÃÛ;ë5Z82Õ]oR[H8HCR�W^K']oJAR ¦ 2��e/V]_I;O`2X2��5I32Âß>Û³á\/ ¦1¦ I � S � S 8eë2��e/�à5JAR;2AR�O9R[H�]oR;Jkà5JAR�÷¥ZC:eY /¹:5R�W^H8/,b5Y[/^I3:5bº/%�¹P#I;H8Z82ÃÛ-R3]±J6/,à5J6/,K6/,:>2ÈI32AZCR[:ºZ8K�Ia�ÕÞÃà5J6R;2aR¥O,R[H@S

���5/Q]oR[HCH8R�W^Z8:5Y-H8/ ¦&¦ I½]oR;HCHCR�W^KX]oJ6R ¦ 2��5/Qb5ZCK6O,P5K6KAZCR;:zZ8:42��5Z8KEK6/,O`2aZCR;: ���g�}�}��Brmt��|t��|t,+m�q ¥�`�Â��­#�ÂÓ=�_�a���¥¾!ÒEÓ�� ���È�`���(²q�_�¿���e«Å¼�� ²q�&�>��� �m²q�a���G���È�����C�^���(�C²q�È���Ã���È������`�a���¿ö��Å��¬��C�A �¾¥�X²q�a���G¨°�G¨%ö��Å��¬��C�A �¾¥�½�G¨Q¬'���@�Å�È�È�½ÇCB ô & T'¨Ü���Q��­#�§�È�`�7�;�_�¿���

� Î�� ��� 7 © � # ô � ô � ô ÇDB ô & T�� # ©;- � + 1 ��B ó ÇT� ô �`T �´

����� ; '$¡"k$��^$&*Ü. <[$& "7��� � � + �½"7?) '� �� ����� ��Ã:¯2��5/ËKA/ �¹P5/,H@ë W /zJ6/,H8Û�R[:��ÕÞÃà5J6R;2aR¥O,R;H�$,/9JAR3Þ /¥:eR�W^H8/,b5Y;/zà5J6R�R3]oK¡R;] /¹:5R�W^H8/,b5Y[/cR;]VJA/9à5JA/ÄÞKA/9:>2ÈI32AZCR[:Ëà5J6R;2aR¥O,R[H8K �¹2��5/`ÛhOÜI3:cßq/%O9R[:>÷[/,J�2a/9bÝZC:>2ARºI-Y[/,:5/9JaI;H $,/,J6R3Þ�/¹:5R�W^H8/,b5Y[/Qà5J6R�R3]\P5KAZ8:5YK62aI;:5b#I3JAbË2a/,O��e:5Z �¹P5/9KVß#I3KA/,bzR[:h2aJAI;à±beR�R[J�O9R ¦&¦ Z72 ¦ /,:>2ÂK6O��5/ ¦ /,K-Ç_O9]GS � �!I ¦ ��� ��TÄS

��� �� ����� � �$# ��� ��� �<!��;���4� � � � � � ����� � �.�"!�� � � �'��Ã:e]oR[J ¦ I3HCH8Û;ë¹ZC:ËI¡à5JAR32aR¥O,R[Hq]oR[JÂKAZ8Y[:5Z8:5Y¡I-O,R ¦1¦ Z8262a/,b1÷;I3HCP5/3ë�W / �5I�÷;/§I-KAZCY;:5/,JÂW^Z72��hà5P5ßeHCZCO/;/`Û�F���ë¹I;:5b¡2��e/�O,R[J6JA/,K6à±R;:5b5ZC:eY!KA/,O9JA/`2 /3/9Û4Ó���ë¹I3:5b&I%P5KA/9J�W��eR��¥Pe/,JAZ8/,K'2��e/�KAZCY;:5/,J®]oR;J'IKAZ8Y[:#I32AP5JA/3S ���5/QO,R ¦&¦ R[:hZC:5àePe2Â2aR¡2��5/Qà5JAR;2AR�O9R[HÅZ8K^I¡O,R ¦&¦ Z72 ¦ /,:>2 #�]oR[JÂW��5Z8O��c2��5/!P5KA/9J/¹:5R�W^K½2��5/³R[àq/,:eZC:5Y0Ç#$ ô & TÄS��Ã:02��5/1/9:5b�R;] 2��5/&à5J6R;2aR¥O,R[H@ëN2��5/&P5KA/9J°R[ß�2ÈI;Z8:5K§IcK6ZCY[:#I�2aP5J6/��� Ç#$cT`ë=I3:5bc2��5/QKAZ8Y[:5/,J�H8/ÜI;J6:5K�:5R;2��5ZC:eY1I3ß±R[P�2 $)S��g�}�}��Brmt�7|t_u#t ���7¾;���a� �#� �� ¥�È���`�Ä�_�`�È�%�¡���È�`�¥�a� ²q�a���Ã���È���3¨Ü���E�`�7¾;�#���¥¾&�³�È���¡�¡���@�Ã�A ºþ��;�É�#�,´F �a���G¨9´VáN/92Q2��e/¡/��¥2aJAI;O92AR[J�+ ß±/ºI;K%]oR;HCHCR�W^K �%Z82!J6P5:5K!2��e/¡/��¥2aJAI;O92AR[J!]oR[J%K62A/,à � S � S8�ºR;]Õ2��e/à5J6R;2aR¥O,R[H@ëkI;:ebwb5ZCK6O,R�÷[/9JAK!BsI;:5b & 2��#I�2¡I;J6/4R;]^HC/9:5Y;2��5K � � I;:eb.� 1 JA/9KAàq/,O92AZ8÷;/,H8Û;S,�ï2°2��e/,:�¹P5/,J6ZC/9K°2��5/1KAZ8Y[:#I32AP5JA/1R[JaI;O9HC/º]oR[J-IzKAZCY;:#I32aPeJA/³R;:�B\SS�ï2°R[ße2ÈI3ZC:5KQ2��5/³KAZCY;:#I32aPeJA/)Ç ( ôÈñ[ô�� T`S VR32a/�2��5I3242��e/�÷;I3HCP5/ ()ZCK4I�JaI;:5beR ¦ Z8:¹2A/,Y[/9J4R;]§HC/9:5Y;2�� ��+ÄS ���5/B/��¥2aJAI;O92AR[J42��5/9: KA/92AK& . © (½� & SY�ï] ��+ + � Î /'�3ë'W��5/,J6/&�4Z8K¡I�KA/9O,P5J6Z82ÃÛwà#I3JaI ¦ /92A/,J-Y[PeZCb5Z8:5YÝ2��e/hK62ÈI�2aZCK�2aZ8OÜI;HO,H8R[KA/9:5/,K6K,ë¥2��5/9:³2��5/^÷3I;HCPe/ & . R;ße2ÈI;Z8:5/,bº2��eZCK�WÂIÜÛºW^ZCH8H#ß±/EK62aI32aZ8K62aZ8OÜI;H8H8Û½O,H8R[KA/E2aRQ2��5/E÷;I3HCP5/ & .Y[/9:5/,JAI32a/9b4ß>Û � ë�I;:5b³K6R-K62aI32aZ8K62AZCOÜI3HCH8Û;ë[2��5/(I;be÷;/,JAKAI;J6Û CMKX÷¥ZC/`W ZCK�2��5/VKaI ¦ /VW��5/`2��5/9JX2ÈI3H /¹ZC:5Y2aR¡2��5/QJA/ÜI3HNKAZCY;:5/,J � ë#R[JÂ2ARº2��5/Q/��¥2aJAI;O92AR[J +1S

��� � ����� � �>�������'����� � !�� � � � � !��;��� � ��� ����Ã:z2��5ZCK^K6/,O92AZCR[:Åë=W /§Y[Z8÷;/°Is�ÕÞÃà5J6R;2aR¥O,R;H $,/,J6R3Þ�/¹:5R�W^H8/,b5Y[/§à5J6R�R;]®R;] /¹:5R�W^H8/,b5Y[/§à5J6R;2aR¥O,R[H|]oR;JK��eR�W^Z8:5Yº2��#I32EI¡O9R ¦1¦ Z8262a/9b4÷;I3HCP5/9KEZ8K^I¡KAZCY;:#I32aPeJA/!R[:zI;:5R;2��5/,J�O9R ¦&¦ Z72A2a/9b4÷3I;HCP5/3S

� �

Page 73: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��� �!�!�#" $ "�'*)�+.-F/��26KVCW=:=5�XF37> N&OQP��CP�� P � T ZF[�<^]93~1^:b�0ICBD<^698^3Y1;5;]93�E�3 ��:=<^]�@CBD8�BFE�37<4378;1G � �9G + �hG � i | Z0EaEa:=<^E�3�Id<�@#69VCW=:=5�XF37> N&O��UP�R���P;S�rT �#5`Z0EaEa:b<^E�3�Ic< � i -�o kcp -A$ "�'*),+d/Qq BFIKJL� � 1^6K5;]u<^]KBD< ��f R �� S 1��� E�ZhJ O � i ,$��#"(o kcp - $ "�'*)�+0/ KBF5`<4ZF8;:���BD<^:=Z0I ZF[ OQi

� �ay�� 9ZF8;E�5`Z0EaEa:b<^Ea3�Id< ��f � � � 1 EaZnJ O � BFIKJl@C8^Z.�F3�<^]KBD< � �

:=1,B�5`Z0EaEa:b<^E�3�Ic<<4Za<^]93�1^BFE�3��DBFW=693lBF1 � i�r8;Z.�F3lXhI9Z��YWb3�J9�F3lZF[\q��K� i �28^Z.�F3�<^]KBD<Hq�� N��hP � " T �CBFICJ���� N��hP � �� T�i

� �Lw���| ]9ZnZ0143�Bl8;BFIKJ9Z0E � . ZF[,Wb3�IK�F<^] G + �cBFIKJ Bl@K8�:=E�3�Ic6CE_V 378rZF[,Wb3�IK�F<^]�G � i | Z0E �@C69<43���f N ��� 1 ! � T K 8 � iU� 3�IKJ N � . P��0P � T <4Z�<^]93_6K14378 i

-�o kcp - �#)�+.'*),+0�� ,37<Y�~f�� � � . i �H]93l6K14378�Z069<4@C69<^1HB�1;:b�0IKBD<^698^3 N � P��FP � T Z0I�q i?®ZCY[PeJA/ � Þ � ��£�Z8Y[:#I32AP5JA/!R[:zIJGXR ¦&¦ Z72A2a/9b"!ÕI;HCPe/

��g�}�}��Brmt�7|t8µ|t�À|­#�(²q�a���G���È�����������7¾;�¥�a��#��#c�C�º� �(�C²q�a���Ã���È����¨Ü���(²q�a��þ����¥¾4ö��Å��¬��C�A �¾¥�&�G¨��­#�§þ��;�É�=�È�½ÇCB ô & � ô ( ôañ[ô�� T%�`�#�È­c�o­e�;��# � ©;- � + 1�� ¦ R¥b¡� �;�q %$'&)(&5+*-, � ÇCB ô ( ôÈñ[ô�� T,´F �a���G¨9´����5/½O,R ¦ à5HC/`2a/9:5/,K6KVà5J6R[àq/,J62ÃÛcZ8KEO9HC/,I;J,S ���5/ $9/,J6R3Þ�/¹:5R�W^HC/9b5Y[/½à5JAR[àq/,J�2ÃÛh]oR[HCH8R�W^K�ß±/ÄÞOÜI3P5KA/%2��5/%KAZ ¦ P5HCI32aR[J�O,I;:4]oR[J ¦ 2��e/%O,R ¦&¦ Z82 ¦ /,:>2AKXI32XJaI;:eb5R ¦ Ç_KAZ8:5O,/V2��5/`Û4JA/`÷[/,I;H|:5R;2��5ZC:eYK62aI32aZ8K62AZCOÜI3HCH8ÛeTÄë#I;:5bc2��5/9:�ZC:>÷[R�/;/°2��5/½K6Z ¦ PeH I32AR[JÂ]oR[J^2��5/ $,/,J6R3Þ�/¹:5R�W^H8/,b5Y[/½à5JAR¥R;]oK^R;] /¹:5R�W^HÖÞ/,beY[/QR;]®J6/,à5J6/,K6/,:>2ÈI32AZCR[:ÝI;:5bËßq/,HCR;:5Y[ZC:eY-2aR&I;:cZC:>2a/9J6÷3I;H¿S

Ù�/ ¦ PeK62Õ:5R�W¶K��5R�W 2��5I32�2��5/9JA/^/���ZCK�2aKÕI;:º/��¥2AJaI;O`2aR[J'2��5I32�O,R ¦ à5Pe2A/,KÕI!÷;I3HCZCb°KAZCY;:#I32aPeJA/;S P5J%/#��2AJaI;O`2aR[J%W^Z8HCHmZC:>÷[R�/;/¡2��5/¡/#�¥2aJaI3O92aR;J%]oR[J(2��e/¡à5JAR¥R;]�à5J6R;2aR¥O,R[H8KVW /ºP5KA/ºI;KQI4ßeP5ZCH8b5ZC:5Yß5H8R�O"/=S&�ï]ÕR[P5J%/#��2AJaI;O`2aR[J%]_I3ZCHCK9ëq2��5/,:)W /¡OÜI;:BK6/92QP5àBI4J6/,b5P5O`2aZ8R[:�2��#I�2!ß5JA/,I�/¹K!2��5/º£¹2aJAR;:5Y¢V£�¤ I;KAK6P ¦ à�2aZCR;:|S£�P5à5àqR[K6/%2��5/%/#�¥2aJaI3O92aR;JÂKAP5O9O,/9/,b5KEI;:5bhO9R ¦ à5Pe2a/9KQÇDB ô ( ôañ[ô 0 ô � ô & � ô & + ô & � ô & 2 ô & � ô & T'KAP5O��2��5I32 #Ô© Ç #/.9T � + 1!I3:5b #Ô© � � � + 3�- � + 1,ë|I;:5b # � © - � 2 + 1�SH VR;2A/°2��#I�2(2��eZCKEZ ¦ à5HCZ8/,K�2��#I�2# �. © � � � + 3 - � SºáN/92 � ©�#/. � - 2 S ER;2a/-2��#I32 � � © # �. � - � © � � � + 3�S&£�Z8:5O,/-W /&I;HCK6R /¹:5R�W2��5I32aB�ZCK^R;]�HC/9:5Y;2������Eë (§ZCK^R;]®HC/9:5Y;2��&�,+�I;:5b ñ Z8K^R;]®H8/,:5Y32�� � � ë5W /°I;J6/Qb5R[:5/ �ÕW /½R;Pe2aà5P�2Ç ( ôÈñ[ô � T W��eZCO��cZCK^I¡KAZ8Y[:#I32AP5JA/!R[:Ë2��e/ ¦ /,K6KaI;Y;/&B\S��� �� ����� � �$# ��� ������<!��^� � � ��� ���"� ���10�� � #32 � � �54 �"������� �"�Ù�6875R:9;6<9��#I=9(K>9aJAI;ZCY��-96]oR[J6WXI;J6b ¦ R�b5Z7d#OÜI?9aZCR:75K@9aRA9��B6½à5JAR:9AR�O9R[HCKEI;ßqR�÷)6-Y;Z8÷)6§P5KVà5JAR:9AR�O9R[HCK]oR[JºKAZ8Y)75ZC75YBß5HCR¥O"/¹K1R;](O,R ¦&¦ ZC9;9;6,bw÷3I;HCP'6,K,ëXI:75bD9aR�à5JAR�÷)6 /-75R�W^H�6,beY)6zR3]!I0K6ZCY)75I=9aP5J>6ËR)7ß5H8R�O"/¹KNR;]�O,R ¦&¦ ZC9;9;6,b(÷3I;H8PB6,K9SmÙ�6�I;H8KAR�75R:9;6E9��#I?9Üë�P5KAZC75YEI:7>Û!à5J6R:9aR¥O,R[H�]oR[JNà5J6R�÷¥ZC75Y�J;69H I=9AZCR)75KI ¦ R)75Y�O9R ¦ àqR)7B6F7G9aK\R;]�I�b5ZCK6O,J;6H9I6ÄÞÃHCR;Y>I;JAZJ9�� ¦ J;69à5J;69K;6F7-9aI=9aZ8R)75K\R;]eI�Y[JAR[Peà<69H�6 ¦ 6F7-9 �4GÂI ¦ 8 i ëG c 8�8 Ieë F JAI 8�8 �¿ë�OÜI:7hß�6%P5K>6,b"9aR¡b'6 ¦ R)75K>9AJaI=9;6(J>6,H I?9aZCR:75KXI ¦ R)7eY-O,R ¦ àqR)7B6K7G9AKÂR;]mI°K6ZCY)7B69bß5H8R�O"/¯R;] ¦ 6,K6KaI;Y:6,K,S ÙL6 �5ZCY��5HCZ8Y �G9M9��5Z8K³àqR[Z�7G91ß¹ÛðK��5R�W^Z�75YwI0à5JAR:9AR�O9R[H�9��#I?94I;H8HCR�W^K1I:7R!=ÞÃH8Z�7B6Vb5R[P5ß5HC6`ÞïKAà�6K75b5ZC75YM9I69K>9VbB6,K6O,JAZ8ßN69bzZC7z£O6,OH9aZCR:7 8�S � S¢P69OÜI;H8HQ9��#I=9§ZC70R[J6bB6,JR9aRS6K7#I3ß5H�6&I:70R!qÞïHCZC7B6¡b5R[P5ßeH�6`ÞïKAà�6K75beZ�75YT9I69K>9Üë®IzO9J;6,b'6K7G9aZCI;H�ZCK§IKAZ8Y)7#I=9AP5J;6'R:7°I@9aPeà5H�6VÇGÓ � ôVU K ôVU � T`ë3I:75bQZC7½I^KAà�6K7eb5Z�75Y^à5J6R:9aR¥O,R;H=Ç_Z@SW63S8ë�O,J>6,bB6F7-9AZ I;H>K��5R�W^Z�75Y>T

� 8

Page 74: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

IQP5K;69J J>69÷)6,I;HCKQ9��B6E÷3I;H8PB6a�^© �5Ó�� / U K ¦ R¥bºª�ë>]oR[J'K6R ¦ 6EàeJAZ ¦ 6�7¹P ¦ ß�6,J�ª¥ë�I=75b U � ë>]oR[J�I÷3I;HCP'6�� ó Ì@?kO��5R;K;6K7³ß¹Û 9��B6E÷:6,J6Z8d 69J,S ���B6EP5K;69J ¦ PeK>9 9��B6F74à5J6R�÷:6 9��#I=9 9��B6^÷3I;HCP'6EJ>69÷:6ÜI;HC6,bO,R;JAJ;69KAàqR)75b5K 9aRM9��B6QKAZCY:7B6,bcß5HCR¥O"/³R3] ¦ 6,K6KaI;Y)69K-ÇÃÓ5� ôVU K ôVU � TÄS& 69J;6;ë^W 6�bB6,K6O,J6ZCß�6)I ¦ 69O��#I:75Z8K ¦ 9��5I=9Üë^O,R ¦ ß5Z�7'6,b W^ZJ9��¶R[PeJ4KAZ8Y)7#I=9AP5J;6zKAO��B6 ¦ 6Ý]oR;Jß5H8R�O"/¹K^R;] ¦ 6,K6KaI;Y:6,K,ëqI;O��eZ�69÷:6,K 9��5Z8K,S'Ù�6<7eR:9I6 9��5I=9 9��B69K;6R9ÃÛ�à�6,KER;] 9I6,O��'75Z �¹PB69K(I;J>6QKAZ ¦ ZCHCI;J

9aRM9��5R[K;6Qb5P'6<9AR F JaI:75beK � F JAI 8�8 �@SÙL6%I;KAK6P ¦ 6 9��#I=9XW/6QI;J>6(Y[Z7÷)6F7|ë5I;KXà5P5ß5H8ZCO(à5I;JaI ¦ 6F9;6,J6K,ëeàeP5ß5HCZ8OV÷3I;H8PB6,K%ÇÖÑ4©Ú�3ª /s� ô -%<�TW��B69J;6(Ñ�I:75b�ª&I;J>6½à5J6Z ¦ 6,K9ë±I=75b - <ÜÌ=< �#I;K(R;JAbB69JVª¥S�ÙL6½J;6%�¹P5Z8J;6R9��#I?9%ª � ¦ I �|Ç¿�! %" ô �� � TW��B69J;6 ��� ZCK 9��B6¡H�6F75Y:9��)R;] 9��B6M75R:75OK6 U K`S§Ù�6ºI;HCK6RËI;KAK6P ¦ 6 9��#I=9(W/6&I;J>6-Y[Z8÷:6K7�I:75R=9��B69JO,R ¦1¦ ZC9 ¦ 6F7-9Xà5P5ß5H8ZCO�/=69Û[ë�Ço� � ô - � ô + � TÄë5KaI ¦ 6§I;K^Z�7"9��B6QJ;69K>9VR;] 9��5ZCK�G �5I;à'9I69J,S� 7hR[JAb'6,J/9AR¡à5JAR�÷)6 9��#I=9 9��B6%÷3I;H8PB6,K%ÇT� ôVU � TÕO,R[J6J;6,K6à±R:75b"9aR 9��B6%KAZ8Y)7#I=9AP5J;6VR)7 �5Z8KÂK;69O,J;6H9/:6`Û¡O,R ¦1¦ ZC9>9I6,b%9aRQZ�7¡O9R ¦1¦ ZC9 ¦ 6F7G9�#�� 9��'6�P5K;69J�]oR;J ¦ KkO,R ¦&¦ ZC9 ¦ 6K7G9AKkI:75b #�K 9aR U K'I=75b

# � 9aR U � S & 6 9��B6K7)K��5R�W^KR9��#I=9 �'6 �#I;KQI³K6ZCY)75I=9aP5J>6-R)7 9��B6-ß5H8R�O"/cR;]�÷3I;HCPB69K%O,R ¦1¦ ZC9>9I6,b9aRºß>Û"9��5ZCK�ß5H8R�O"/1R;]�O,R ¦&¦ ZJ9 ¦ 6K7G9aK9ë5I:7ebT9��#I=9 9��'6%÷;I3HCPB6!O9R ¦1¦ ZC9>9I69b"9aRºZ�7 #�KXZCK�R;]mHC6K75Y:9�����ES &P6-J;6`÷)6ÜI3HCK U � I:7eb)K��5R�W^K 9��5I=9'# � ZCK%I³÷;I3HCZCbzO,R ¦&¦ ZC9 ¦ 6K7G9P9aR U � S & 6¡I;H8KAR4O,I;JAJ6Z�69KR[P'9�9��B6!]oR[HCH8R�W^Z�75Y-àeJAR¥R;]®R3] /-75R�W^H�69b5Y)6§à5JAR=9aR¥O,R[H �

F�� ��Ç � ô��ô & � ô & �[T �"- �< © Ç - �< T � - � �#�� ©=- �� + 1��� �#�K�© - �� + 1�� �

��g�}�}��Brmt�7|t��|t�À|­#�¡²q�È���Ã���È���E ¥�È���`�Ä�_�`�A ��>�`��þ;�c�C�Ý�c²q�a���G¨��G¨4ö��Å��¬��C�A �¾¥���G¨z�¯�,�C���Èö��G¨þ��;�É�#�È�¡ÇÃÓ�� ôVU K�T§�`�=�È­z��­e�;�^ÇGÓ�� ôVU K ôVU � T°�C�Q�`�7¾;�Å�A �«��;�q  #�� �C�-�Ý�È���¡�¡���@�³�`�#�Õ�G�1Ó��0«�;�q 7��© �#Ó�� / U K ¦ R�b¡ªe´F �a���G¨9´°Ç¿£ /:6F9AO��=T����B6§O,R ¦ à5HC6F9;6K7B69KAK%I=75b@$F6,J6R3Þ�/-75R�W^H�69b5Y)6§à5JAR;àN69J>9aZC6,K^]oR[HCH8R�WÚZC7T9��B6§P5KAP#I3HWXI�Û;S ÙL6 ¦ P5K�9 75R�W�I;beb5J;69KAK 9��B6'�¹PB69K>9AZCR)7sR;] 6��9AJaI;OH9aZCR:7|S2���B6z]_I3OF9 9��#I?91W 6 6#�O9AJaI;OH9ÇGÓ�� ôIU K ôVU � T®I:7ebºI(KAZ8Y)7#I=9AP5J;6ÂR:789��B6 ¦ ]oR[H8HCR�W^KmKAZ ¦ ZCHCI;JAH7Û!I;K�]oR[J 9��'6Âà5JAR=9aR¥O,R[H¥Z�7��ZCY[P5J>6 � Þ� Sa���B6-R:75H8Û 9��5Z�75Y&W/6§WXR;JAJ6ÛÝI;ßqR[P'9VZCK 9��#I?9��V© �5Ó��V/ U K ¦ R¥b&ª¥S -VK6Z�75YhI /-75R�W^H�6,beY)66��9AJaI;OH9aR[J�]oJAR ¦ 9��B6Qà5J6R�R3]oKER3] /-75R�W^H�69b5Y)6§R;]E6 �¹P#I;H\J;69à5J;69K;6K7G9aI=9aZ8R)75K,ë#W 6%6#�9aJaI3OF9^÷3I;HCPB69K �I:75b R;]mH�6K7eY:9��5K ��� I=75b&���sKAP5O��T9��#I?9^HCR[Y � � Ç - �< T�© ��© �g�H/ ݦ R¥b&ª¥ë\ÇoKAZ�7eOK6 9��'6§R;JAbB69JR;]*- <§Z8Kª;TXI:75b ��Z8K/9��B6%÷3I;H8PB6%O9R ¦1¦ ZC9>9I69b�9aRºZC7 #�� W��5ZCHC6 ZCK/9��B6%÷3I;HCPB6(O,R ¦&¦ ZJ9;9;6,b�9ARZ�7 #�KÄS -P75bB69J�9��B6½K>9AJAR)75Y4¢(£�¤ I;KAK6P ¦ à'9aZ8R)7|ëqZC9E]oR[HCH8R�W^K 9��5I=9 �w©ÔÓ�� I:75b © U KÄë|I=75bKARf��©ÿÓ�� ��/ U K ¦ R�bºª¡I3K^W 6QJ;6 �¥PeZCJ;63S

� �

Page 75: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��� �!�!�#" $ "�'*)�+.-F/��26KVCW=:=5�XF37> N&OQP��CP�� P � T ZF[�<^]93~1^:b�0ICBD<^698^3Y1;5;]93�E�3 ��:=<^]�@CBD8�BFE�37<4378;1G � �9G + �hG � �26KVCW=:=5YXF37> N RCP;S#T ZF[*B�5`Z0EaEa:b<^E�3�Ic<H1^5�]93�E�3�EaZnJK6CWbZ O

| Z0EaEa:=<^E�3�Id<�@#69VCW=:=5�XF37> N&O � P�R � P;S � T �#5`Z0EaEa:b<^E�3�Ic< �� -�o kcp -A$ "�'*),+d/r�H]93��DBFW=693�1 N q P �

�T 1^6K5�]�<^]KBD< �

�f R �� S 1 �� E�ZhJ O��

BFICJLq :=1 ZF[QWb3�IK�F<^]AG � BFIKJ���:=1 ZF[QWb3�I9�F<^]�G Πi�rBFW=693�1 N � P��FP � T �#B��DBFW=:=J�1;:b�0IKBD<^698^3~Z0IsE�3�1^1^BD�F3lq i

� �ay{z}| ]9ZcZ01^3F� 6CIK:b[&ZF8;EaWb>ABD<�8�BFIKJ9Z0E ZF[2Wb3�I9�F<^] G � � BFW=6K3�1���� � + � � � � � 2 � � � BFIKJ� i | Z0E�@C6K<43�<^]93l[&Z0W=WbZ��Y:=I9���c6CBFId<^:b<^:=3�17/ � + f R + S 1�� E�ZnJ O � � � f R � S 1 3 EaZnJ O �� . fL� R 2 E�ZnJ O ��� 2 f R 2 S 1�� �� f � ��� � � f R � S 1 i ��f N � . T � S 1 E�ZhJ OQi� <H:=1H:=E�@ ZF8^<^BFIc< <4Z�I9ZF<43l<^]CBD< ��f N � . T � S 1 fL� � R 2 � S 1 f N�� � �

+ � T?R � S 1 E�ZhJ OQi� 3�IKJu<^]93l�DBFW=693�1 N � + P � � P � . P � 2 P � � P � T <4Z�<^]93_�F378;:=�K378�BFIKJu57BD8;8^>LZ069<H<^]93l[&Z0W �WbZ ��:=I9�� � @K8;ZF<4Zn5`Z0W �7378;Z � XnI9Z ��Wb3�J9�F3�@K8^ZnZF[&1HZF[(XhI9Z��YWb3�J9�F3F/

� i_� ]9Z ��<^]CBD< ��: 1UB 5`Z0EaE�:b<^E�3�Ic< : I�VCBF1^3�1 N � . P;S#T <4Z <^]93~� BFW 693�5`Z0E�Ea:b<4<43�J<4Z :=IL<^]K3l5`Z0EaEa:b<^E�3�Ic< � � /

� � �cN��P��CP�� � T /���f'� �. S ) % � � f R � S ) 3

� i_� ]9Z � <^]KBD< ��� �U: 1\BFW 14Z�B�5`Z0EaEa:b<^E�3�Ic<Q:=I VCBF143�1 N4N��#P�� P�RhT�P;S#T �h<4Z�<^]93��DBFW=693�15`Z0EaEa:b<4<43�J <4Z_Vn>�5`Z0EaEa:b<^Ea3�Id<^1 �

�� � + � � � �nBFICJ�<^]KBD<2<^]K3�@ Z��U3782ZF[ S ]9378^3:=1�<^]93l1;BFE�3_BF1�: I�� /

�����cN��hP�� P��9P��P���P�� + P�� � P��hT / ��� ��f ���V���FR��.S ) % �

�f R���S )�� %

� + f R � S )�� % � � f R � S )� %��f N � . T � S )

� i_� ]9Z �%<^]KBD< � � :=1rB�5`Z0EaEa:b<^E�3�Ic<2<4Z�<^]93H@K8;ZnJK6C5`<QZF[ <^]93H�DBFW=693�125`Z0E�Ea:b<4<43�J<4Z�Vn> � 2 BFIKJ�� � /

��� �cN��9P���P��P�� � P�� 2 P�� � P�� . T / � � f R���S )� % � 2 f R�� S ) � %� � f R � S ) 3 % � � f N � 2 T � S )

!

� i_� ]9Z � <^]KBD< ��:=1aB 5`Z0EaEa:=<^E�3�Id< <4Z!BFI�:=Ic<437�F378 ZF[lWb3�IK�F<^] G � ��� + :=1aB

5`Z0EaEa:b<^Ea3�Id<H<4ZaBFI :=Id<437�F378�ZF[\Wb3�IK�F<^]AG + �KBFIKJ�� � :=1�B�5`Z0E�Ea:b<^E�3�Ic<�<4Z�BFI:=Ic<437�F378Y:=IL<^]93�:=Id<4378;� BFW N � 3 PK P � 3 T�i

®ZCY;P5J;6 � Þ � ���'JAR¥R;]�R;]U�R7eR�W^HC6,b5Y:6!R;]'I&£�Z8Y)7#I=9AP5J;6

���

Page 76: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

���

Page 77: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ����

� � ��� ��� � ����� � � ����������� � �� �� !�"�#�$�%�&�

')(+* ,.-0/�1325476789/;:<2=->@?BACAEDGFIH0J5FKHMLNDPOQ?BFKH<RKFNSTFVUPRWJPXYLWH<Z[JP\<\]H<FKF^LKD_J`RKH]FIDG?BRI\]HPa5b � STFcFIH<Lc\ � JPXBUPH]F^D+dPH]RcLKSfegHPhFKDPe=H)?BFIH]RIF=JiRKH5JPZBZCH]ZkjlJPXBZ%OmDGRNFIDGegHPj3L � H5JP\<\]H<FKFnLWDoL � H`RIH]FIDG?BRK\<H5SfFNRIH<dGDPpPH]Zqa�r � H]XJs?CFKH]RVSfFtLWRvuwSfXBU5LWD_JP\]\<H]FKFVL � HgRKH<FKDG?CRK\]Hij�FKDPe=HndGH<RKSTxBH]RVeN?BFILc\ � H<\yp�L � JiLtL � H=?BFKH<RcSTFcSTXL � SfFnFKHMLza{b � H`SfegegH]ZBSfJiLWH0FIDG|f?@LWSfDPX}STF~LWD � JzdGHsL � H5dGH]RISTx�H<R=|TD@DPp�?BA}L � H`?BFKH<R=STX�FIDGegHZ�JiLWJP��JPFIH�LKDce=JPpiH�FI?BRKH�L � J�LlL � H�?CFKH]R�SfF3FvLWSf|T|�JP|T|fD+�QH<Z�Ji\]\]H<FKFQLKDVL � H�RKH]FIDG?BRI\]H�STXn�w?CH]FILKSfDGXqab � STF�FKDG|T?CLWSTDGX_STF�H��CA�H]XCFKSTdPH~SfX_LKH]RIe=F�DPO3\]DGegeN?BXCSf\zJ�LWSfDPXsS�O;L � HNZBJiLyJP�BJPFKHNSTF�XBDiL�|fDw\zJi|.LKDL � H0dGH]RISTx�H<R]a���XBDPL � H]RnJiABABRKDGJP\ � SfFNDPO�\]H<RILKSTx�\]JiLWH0RIH<dPD@\]JiLWSTDGX�\ � JPSfXCF]j;� � H]RIH5H<dGH<RIu%ZBJ+uH]|TSfUGST�B|fH9?CFKH]RIFQUGHML9JtOmRKH]F � \]H<RILKSTx�\]JiLWH�DPO�H]|TSfUGST�BSf|TSTL�uPa�b � SfFlSfF�FKDGegH<� � J�L���H<LKLKH]Rl�EH<\zJP?BFIH�L � H\]DPe=eN?CXBSf\]JiLWSTDGX��B?BRKZCH]X[STFcXBD+��F � STO�LKH]Z�OmRIDGe�L � HgdPH]RKS�x�H]RVLWD`L � H=?BFKH<R]j��C?CLNFvLWSf|T|;FK?C�EH]RIFL � HcZBRKJz����JP\yp`DPO � STU � \]DGegeN?BXBST\zJiLKSfDGX)\<DGFILKF]jEJPF��QH<|f|�JPF�L � HV\]DGegAB?CLWJiLWSTDGX`\]DGFvLWF�XBH]H<ZBH]ZLWD�RIH]SfFIFK?BH5\<H]RILKSTx�\]JiLWH<F]a��sDGRIH]D+dGH<R]j�S�L~ZBSTFWJP|T|fD+��FNRKHMdGDw\zJiLKSfDGX�JiLgJPRI�BSTLKRWJPRvu�LKSfegH)JPFnXBH<H]ZJPRISfFKH<F]a0��FWJ�LWSfFvO�JP\<LKDGRIuoFKDG|T?CLWSTDGX�LKD`L � SfFtABRIDG�B|TH]e � JPFV��H]H]X�JPX�STXYLWH]RIH]FvLWSfXCUs��?BH<FILWSTDGX�OmDPRFKDPe=H�LKSfegHPjBH<FKA�H]\]SfJP|f|�u�STX`JnFISTLK?�JiLWSTDGX0� � H<RKHtL � Ht?BFIH]RKF�SfX)L � HtFIuwFILKH]e JPRIHcJiXBDGXYuwe=DG?CF]a

��\<\]?BeN?C|¡JiLKDGRKF��lH]RIHoSfXYLKRKDwZB?B\]H<Z¢�Yu{£QH<X�JP|TD � JPXBZ¢ZCH��_JPRIH�¤¥£lZ¦�_§P¨P©�JPF0J��QJzu�LKD\]DPeN�BSfXCH�JVFKH<LQDPOkdiJP|T?BH]FlSfXYLWDVDGXBH�F � DGRvL9JP\<\]?Be^?B|¡JiLKDGR]j�FI?B\ � L � J�LlL � H]RIH�SfFlJcF � DGRvLQ��STLKXBH]FIFL � JiL~J`UGSTdPH]X�diJP|T?BHg�QJPFNSTXB\]DPRKA�DGRWJiLKH]Z�SfXYLWD`L � H�JP\]\<?BeN?B|fJiLWDGR<a5��L^L � H�FWJie=HnLWSTe=Hij�STLVSTFSfX@OmHzJPFISf�B|THlLWDªx�XCZ�J���STLKXBH]FIF;OmDGR;J�diJP|f?BH�L � JiL;�QJPF3XBDPL3Ji\]\]?CeN?B|¡J�LWH]Zqa;«��@LKH]XBZCSfXBUtL � H9STZBHzJiFZB?BHVLWD=£QH]XBJP|fD � JPXBZsZBHN�sJPRKH�¤¥£lZ¦�_§P¨G©¬j�£�JPRKSM­\VJPXBZo®�xBLK¯]e=JPXBX[¤¥£�®3§Y°±©&UPSTdGHcJPXsH<²g\]STH]XYL\]DPXBFILKRK?B\MLWSfDPX[DPO�FKD�³�\zJi|f|fH<Z�\<DG|f|TSfFKSTDGX@³´RKH]FISfFvLyJPXYLVJP\<\]?BeN?C|¡JiLKDGRKF<j���JPFIH]Z�DGX�L � H0FILKRKDGXCU7µ�>w�JPFIFK?BegACLWSTDGXka

r�H�ABRIDGA�DGFKH�J[diJPRKSfJPXYL0DPOVL � H7\]STLKH]Z¶\]DPXBFILKRK?B\MLWSfDPX¶��S�L � L � H�JPZBZBS�LWSfDPX�JP|�JPZCdiJPXYLyJPUPHL � JiLzjl?BFKSTXBU�JPZBZBS�LWSfDPX�JP|lLKRWJPA�ZBDwDGR~SfX@OmDGRKe=JiLWSTDGXkj�L � H)�QDGRIp%DPO�ZCH]|fHMLWSTXBU�J�diJP|T?BH0OmRKDGe"JPXJP\<\]?BeN?C|¡JiLKDGR�\zJiXs��Hte�JPZCHªSfXBZBH<AEH<XBZBH<X�L�DPO�L � HVX�?Be^�EH<R�DiO�JP\<\]?Be^?B|¡JiLKH]Z)diJP|f?CH]F]jBJiL�?BXBSTL\]DPFILza·£QH<LILWH<R)FILWST|f|¬j9DGXB\]HoL � H�JP\<\]?BeN?C|¡JiLKDGR0SfF�?BAEZBJiLWH<Zkj�?BA�Z�JiLKSfXBU�L � Ho��S�LWXBH<FKF)L � J�L5JUGS�dGH]X`diJP|f?BHVSfF�SfX5L � HNJP\<\]?BeN?C|¡JiLKDGRc¸�ABRID±dwSTZBH]Z_L � JiL�L � STF�diJP|T?BH � JPF�XBDPL��EH<H]X7RKHMdGDGpiH]ZkjEDPO\]DP?BRKFIHP¹»º�\zJPX��EH~ZCDGXBHN��STL � DG?CLªL � HNLWRKJPA�ZBD@DPR�SfXCOmDPRKe=JiLWSTDGX_J�Lt?BXBSTL�\]DGFvLzaN��\]\]?CeN?B|¡J�LWDGRIF��STL � L � H]FIH�ABRIDGA�H]RILKSfH<F^JPRIH=\]JP|f|TH]Z�¼P½�¾�¿PÀ~ÁÃÂMa0Ä�uwX�JPegSf\nJP\<\]?Be^?B|¡JiLKDGRKFVJPRIH�J�LKLWRKJP\<LKSTdPHnOmDPR

°G°

Page 78: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

L � HcJiABAB|fST\zJiLKSfDGX�DPO�UPRWJPXYLWSTXBUgJPXBZ5RKHMdGDGp�STXBU=ACRKSTdwST|fH]UPH]F]a� X%L � H)JiXBDGXYuwe=DG?CF~JP\]\<H]FIFgFIH<LILWSfXCUBj�� � H]RIH5J_?BFIH]R~\zJiX%ABRKD+dGH)H<|fSTUGSf�BST|fS�L�u_��STL � DG?CL^RKH�³

dGH]JP|fSTXBU � SfFªSTZBH]XYLKSTL�uGj.RIH<dGDw\zJ�LWSfDPX�JiABAEH]JPRKH<Z�STe=A�DGFIFKSf�C|fH^LKDsJi\ � SfHMdGHPj���H]\zJi?BFKHgSTOQJ0dGH]RISTx�H<R\zJiX�LKH]|T|l� � HML � H<RnJo?BFKH<RgSTFNH]|TSfUGST�B|fHnDGR^SfXBH<|fSfUPSf�B|THPj � H)FKH<H]egFnLKD7UYJPSTX[FKDGegH0STXCOmDGRKe=JiLKSfDGXJP��DG?CLtL � H=?BFIH]R�� FcSfZBH<X�LKSTL�uPa���D+�lH<dGH<R]j�S�LtLW?BRIXBFcDP?CLcL � JiLtL � SfFtSfXYLW?CSTLWSTDGX7��JiFV��RIDGXBUB¹ � Xw³ZBH<H]Zkj;?BFISfXBUoJP\]\<?BeN?B|fJiLWDGRIF^STX�\]DPeN�BSfXBJiLWSTDGX���S�L � ¯<H]RIDi³�p�XBD+��|fH<ZBUGH0ACRKDwDPOmFNJP|T|fD+��FVDGXBH=LKDABRID±dPHVL � JiL�Jn\]DGege=S�LKLKH]Z0diJP|f?CHVSTF9SfX)L � H^JP\<\]?Be^?B|¡JiLKDGR]a;r�HtF � D+��L � JiL�L � STF�\zJPX`�EHtZBDPXBHH<²g\<SfH]XYLK|Tu�¸mSÃa¥HPa�jk¾������Yu)RKH<ZB?B\]STXBUnLWDgJPX���³�\<DGe=AC|fH<LKHªABRKDP�B|fH<e JPXBZ5L � H]X`?BFKSTXBU~L � HªO�JP\MLL � JiL �������� ¤��V�`r��Y°��C©�JPXCZo¾����E�Yu=?BFKSTXBUN\<?CLI³�JPXBZ@³´\ � D@DPFKH�OmDGR�L � H�£�JPRKSM­\�JiXBZ5®�xBLW¯�³e=JPXBX��¥Fc¤¥£�®3§Y°±©�\]DGXCFILWRI?B\<LKSfDGX�ºMa

� RKDGe L � H)JP��D±dPHPj;�lH0DG�CLWJPSfX%JiX[H<²g\]STH]XYL~egH]\ � JiXBSfFIe OmDGRcRKHMdGDGp�SfXCU7UGRKDG?CA[e=H<eN��H]Rv³F � SfA[OmDGR^L � H0��LKH]XBSTH]FKH5HMLnJP|Ãa�SfZCH]XYLWS�L�u�H<FK\]RID+���iUGRKDP?BA�FISfUGXBJiLW?BRIH0FK\ � H]egH�¤ ��� �Pb �!�P©t¸mL � HegDGFILVH<²g\<SfH]XYLcFKH<\]?BRIH�SfZCH]XYLWS�L�u7H]FI\]RKD+���iUPRKDG?BA�FKSfUPX�JiLW?CRKHnFK\ � H<e=Hgp�XBD+��X�LWD`Z�JiLKH+ºtJPXBZ�J\]RIH]ZBH<XYLWS¡Ji|�RIH<dPD@\]JiLWSTDGXsegH]\ � JPXBSfFIe�OmDGR�DG?BR�\<RKH]ZCH]XYLWSfJP|�FIuwFILKH]e`a�b � HV\]DGXCFILWRI?B\<LKSfDGX`\zJiX_��HJPABAC|fSfH<ZsLKD0DPL � H]R�FI?B\ � FK\ � H]egH]FtJPF��QH<|f|Ãa�b � HNSTZBHzJgSfF�LKD�STXB\]DGRIAEDPRWJiLKHVL � HNAB?B�C|fSf\VpPHMusOmDPRJPX�JP\]\<?BeN?B|fJiLWDPRªFK\ � H<e=HgSfXYLWD5L � HgUPRKDG?BA�e=JPX�JPUGH<R"�¥F=¸�RKH<FKAka�j�DGRKUYJiXBSf¯]JiLWSTDGX��¥Fyº�AB?C�B|fST\~pPH<uPjJPXBZgL � H�FKH<\]RKHMLQLKRWJPA�ZBDwDGR3DPOkL � H�JP\<\]?BeN?C|¡JiLKDGR3FK\ � H<e=H�SfXYLWDtL � H�\]DGRIRKH<FKA�DGXBZBSTXBU^FIH]\]RIH<LQpPH<uPa«3JP\ � LWSfegH)J7?BFIH]R�#IDGSfXCFNL � H)UGRIDG?BA�¸�RIH]FKAqaTj�DG�CLWJPSfXBFnJ7\<RKH]ZCH]XYLWSfJP|�º�j3L � H5UGRKDP?BA�e�JPXBJPUGH]R¸�RIH]FIAkaTj�DPRKUYJPXCSf¯zJ�LWSfDPX¦º3UPSTdGH<F � H]R�JNegH]e^�EH<RKF � SfA)\]H<RILKSTx�\]JiLWHg¸mRKH]FIAka�j�\]RKH<ZBH]XYLKS¡JP|k\<H]RvLWSTxB\zJiLKH+ºMa��X5STX�LKH]UGRKJP|�A�JPRIL�DiO�L � SfFQ\]H]RvLWS�x�\zJiLKH�SfF�JNABRKSTe=H�Xw?CeN�EH<R $Ga;b � SfF���ST|f|��EH�L � H�diJP|T?BHªJPZBZCH]ZLWDnL � H^JP\<\]?Be^?B|¡JiLKDGR�� � H<X_L � Ht?BFIH]R�SfF�JPZBZBH<Zkj�JPXBZ`ZBH]|TH<LKH]ZsOmRIDGe�L � H^Ji\]\]?CeN?B|¡J�LWDGR9S�O�L � H?BFIH]R"�¥FtABRKS�dwSf|fH<UGH]F � JzdGH~LWD)��H~RKHMdGDGpiH]Zka~b � STFªABRKD+diJP�B|�u_FIH]\<?BRKHnegH]\ � JPXCSfFKe�ZBDwH]FªXBDPLVJiZBZJPXYu�FKSTUGXBSTxB\zJPXYLc\]DGegeN?BXBST\zJiLKSfDGX�DGRV\]DPe=AB?@LyJiLKSfDGX�D+dGH]R � HzJiZ[LWDsL � H�?CXBZBH]RI|TuwSfXCU_FK\ � H]egH]F¸¬J�L�egDGFIL�JcO�JP\<LKDGRQDiO&%GºMa�r�H�XBDiLWH�L � JiLQ�EDPL � DG?BRQZCuwX�JPegSf\�JP\]\<?BeN?B|fJiLWDGR�FK\ � H]egHtJPXBZ0L � H��� �Pb�STZBH]XYLWS�L�u0H<FK\]RID+���iUGRKDP?BA_FISfUGX�J�LW?BRIHªFK\ � H<e=HVRKH<|Tu)DGX)L � HtFILWRIDGXBU=µ�>w� JPFKFI?Be=A@LWSfDPXka

')(+*,(+* -/.&021 � .4365 798;:� DGR^L � H5\]|¡JiFKF~DPO�UGRKDP?BA�FKSfUPX�JiLW?CRKH)FK\ � H]egH]Fs¤���®3§=<Cj>��JPe�§G°±©�� � H<RKH5L � H)UPRKDG?BA�� FnAB?B�C|fSf\pPHMu_\<DGXYLyJPSTXBF�J=|TSfFIL�DPO&L � HcAB?B�B|TSf\tpPHMuwF�DPO;Ji|f|kL � HcUGRIDG?BAse=H<eN�EH<RKF<j�H��@\]|f?CZBSfXBU�J=egH]eN��H]RSfFtFvLWRWJiSfU � LKOmDPRI�QJPRKZkhtL � HgUPRKDG?BA�e�JiX�JPUGH<RªDGXB|TuoXBH]H<ZBFcLKDsRIH]egD±dPHgL � H=Ji�qH<\<LKH]Z�egH]e^�EH<R"�¥FpPHMu7OmRKDGe L � Hn|TSfFIL]a^b � H<FKH=FK\ � H<e=H<F]j � D+�QHMdGH]R<j � JzdPHgL � HnZBRWJz����JP\ypoL � JiLªL � Hn\]DGegAB|fH��@STL�uDPOVABRID±dwSTXBU%JPXBZ¢dPH]RKS�O�uwSfXBU[egH]e^�EH<RKF � SfA¢SfF=|fSTXBHzJPR=SfX L � H7X�?BeN��H]R0DiOc\<?BRKRIH]XYL5egH]eN��H]RIFJPXBZ}L � H<RKHMOmDGRKH`�EH<\]DGegH]FgSfXCH<²g\]STH]XYL=OmDPR=|fJPRKUGH)UPRKDG?BACF]a¢b � STF=ZBRKJz����JP\yp�SfFnD+dGH<RK\]DPe=Hs��uFK\ � H]egH]F�� � H<RKH�L � H�FKST¯]H�DPO�L � H�UGRIDG?BA��¥F9AB?B�C|fSf\�pPHMu)JPFl�QH<|f|kJiFQL � H�\]DGegAB|fH��@STL�ugDPO.ABRID±dwSTXBUJPXBZ�dGH]RISTO�uwSfXCU_egH]eN��H]RIF � STA�SfFVSfXCZBH]A�H]XBZCH]XYL~DPO�L � H�X�?Be^�EH<R^DPO9egH]e^�EH<RKF�¤��9>C§G°Cj@?t®3§!�Cj�9�_§G§i��jk��� �Pb �!�P©¬a~b � H=STZBHzJ)?BXCZBH]RI|TuwSfXBU0L � H]FIH=FI\ � H]egH]FVSfF�L � JiLtL � HgUPRKDG?BA�AB?C�B|fST\NpPHMu\]DPX�LWJPSfXCF�L � H^UGRIDG?BAoe=JPX�JPUPH]R"�¥F�AB?B�B|TSf\VpPH<usDPO�JgFK?BS�LyJP�B|THcFISfUGXBJiLW?BRIH^FI\ � H]egHPa�b&D0��H]\<DGegHJ=UPRKDG?BAse=H<eN��H]R]j�Jg?BFKH<R�\ � DwDGFKH<F�Jge=H<eN�EH<RKF � SfAsAB?B�B|TSf\tpPHMus� � ST\ � L � H^UGRIDG?BAse�JPXBJPUGH]RFKSTUGXBF<a b � ?BF]jlLWD�ABRKD+dGHse=H<eN��H]RKF � SfAqjQJ�?BFKH<R � JPFgLKD�ACRKD+dGHsAEDGFIFKH<FKFKSTDGX DiO�egH]eN��H]RIF � STAAB?B�C|fSf\VpPHMuGjEDPO�L � H^\]DPRKRKH<FKA�DGXBZBSTXBU�FIH]\<RKH<L�pPH<u_JPXBZsDPO3JgUGRKDG?CAoe�JiX�JPUGH<R"�¥F�FISfUGX�J�LW?BRIHcDGX_JegH]eN��H]RIF � STA`AC?B�B|fST\ªpPHMuGa

b � H�ABRKDP�B|fH<e·DPOEHM�@\]|T?BZBSTXBUtUGRKDG?CAgegH]e^�EH<RKF���STL � SfX~FI?B\ � J�OmRKJPe=HM�QDPRKpc��S�L � DP?CL3SfXB\<?BRv³RKSTXBU0�BSTU)\]DGFvLWF � JiFª�EH<H]X�\]DGXCFKSfZCH]RKH<Zkj.�B?CLt?BXYLKSf|�XCD±� XBD)FIDG|f?CLKSfDGXs��JPFtFKJiLWSTFIO�JP\MLWDGRvuGaBAªXCH

°C�

Page 79: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

JPABACRKDYJP\ � SfF�LWD0\ � JiXBUGH^L � H^UGRIDG?BA��¥F�AC?B�B|fST\cpiH<u_JPXBZoRIH]STFKFK?CH~JP|f|kL � HNegH]eN��H]RIF � STA_\<H]RILKSTxC³\zJ�LWH]F�¸�\MO aq¤ �;b ���]©¡ºMa>�Q|fHzJiRK|TuPjYL � STF�AC?CLWFl�w?CSTLWH�Jc�C?BRKZBH<X�DGXgL � H�UGRKDP?BA=e=JPX�JiUGH]R<jwH<FKA�H]\<S¡JP|T|TuOmDGRn|¡JiRKUGH)UGRIDG?BABF<a{��XCDPL � H<R�JiABABRKDGJP\ � STFnLKD�STXB\]DGRIAEDPRWJiLKH5J�|TSfFILnDiOªRKHMdGDGpiH]Z{\<H]RILKSTx�\]JiLWH<FJPXBZ)L � H]STRQ\]DPRKRKH<FKA�DGXBZBSTXBUne=H<eN��H]RKF � SfA�pPH<uwF�SfXYLWDcL � HªUGRIDG?BA��¥F9AB?B�C|fSf\�pPH<u7¤¥£�> ���]©¬a � X0L � STFFKDP|f?CLKSfDGXkj@� � H]XoACRKD+dwSfXBUge=H<eN��H]RKF � SfAqj¦Jg?BFIH]R � JPF9LWD=ABRKD+dGHtL � JiL � SfF�DGR � H]R�egH]eN��H]RIF � STAAB?B�C|fSf\9piH<unZBDwH]F�XBDPLlJPACAEH]JPR;DGXnL � H�|fSTFILza@��H<XB\]HijwL � H�FKSf¯<H�DPOEL � H�AB?B�B|TSf\9pPHMugJPF;�QH<|f|¦JPF3L � H\]DPe=AB|THM�@STL�u`DPO3ACRKD+dwSfXBU)JiXBZodGH<RKSTO�uwSTXBU0FKSTUGX�JiLK?BRKH<FªJPRIH^|fSTXBHzJiR�STX_L � H^Xw?CeN�EH<R�DPO3H��C\<|f?BZCH]ZegH]eN��H]RIF]a � X)A�JPRvLWST\]?B|fJPR]jYL � SfFQegHzJiXBFQL � JiLQL � H�FKST¯]H�DiO�J^UGRKDP?BA)FKSTUGX�JiLK?BRKH�UGRKD+��FQ��S�L � L � HX�?BeN��H]R�DPO&HM�@\]|T?BZBH<Z_egH]eN��H]RIF]a

>@DGXBU`¤¥>@DGX ���]©EABRKH<FKH]XYLKF�JiX5JP|TLKH]RKXBJiLWS�dGH�JiABABRKDGJP\ � SfX0\<DGX�#I?BXC\<LWSTDGX���S�L � JN\<DGXBFILKRK?B\MLWSTDGXL � JiL9uwSfH]|TZBF�OmDGRv��JPRIZ5FKH]\<?BRKHVUGRIDG?BA5FKSTUGX�JiLK?BRKHªFI\ � H]egH]F���JPFIH]Z_DPX5L � Hª��� �Pb�UGRIDG?BA5FKSTUGX�J�³LW?CRKH�FK\ � H<e=HN¤ ��� �Pb �C�P©Ãa�r � Sf|fH � H]RKH9L � H�FISf¯<H�DiOkJtUGRKDP?BA=FISfUGXBJiLW?BRIH9SfF3SfXCZBH]A�H]XBZCH]XYLQDiOqL � HX�?BeN��H]R�DPO�H��C\<|f?BZCH]ZNegH]eN��H]RIF]j±L � H�dGH<RKSTxB\zJiLKSfDGXtLyJPFIpªRKH<e�JPSTXBF.\]DGegAB?CLWJiLWSTDGX�JP|T|Tu�SfXYLWH<XBFKS�dGHijJPXBZnSTF;|fSfXCHzJPR&SfXNL � H�X�?Be^�EH<R;DPO�HM�@\]|T?BZBH]Z=UGRKDP?BA~e=H<eN��H]RKF<a3�sDGRIH]D+dGH<R]j � H]R3JiABABRKDGJP\ � ZBD@H<FXBDPL&�QDPRKptOmDGR�DGRIZBSfXBJPRIutUGRIDG?BANFISfUGXBJiLW?BRIHQFI\ � H]egH]F3JPF&STL&RKH<|fSfH<F � H]Jzd@ST|TutDGXcL � H�ZCST�EH]RKH<XYL�LWSTe=HA�H]RKSTD@ZCF�A�H]\<?B|fSfJPR�LKDVOmDGRv��JiRKZgFKH]\<?BRKH�FKSTUGX�JiLK?BRKH<F]a���LKH]XBSTH]FKH�JPXBZgb9FK?BZCSfp`¤ �;b ���]©�JPZ�JiACL3L � STFJPABACRKDYJP\ � LKDsL � H0��� �Pb�UGRKDP?BA[FKSTUGX�JiLK?BRKH �iSfZCH]XYLWS�L�u�H<FK\<RKD+��FK\ � H<e=Hia7b � H]STR^FKDP|f?CLKSfDGX�RKH�³LyJiSfXBF;L � H�ACRKDGA�H]RvL�u~L � JiL3L � H9dGH]RISTx�\]JiLWSTDGXnLyJPFIp~SfF;|fSTXBHzJiR;SfX~L � H�X�?BeN��H]R3DPOqHM�@\]|T?BZBH]Z=UGRKDP?BAegH]eN��H]RIF]a��sDGRIH]D+dGH<R]j�STL9?CFKH]F�FKD�³�\zJi|f|fH<Z)ZBDG?B�C|fHtZBSfFI\]RIH<LWHt|TDGUYJPRISTL � e=F�� � Sf\ � RKH<FK?B|�LWF�SfX)L � H\]DPe=AB|THM�@STL�uVDPO¦ACRKD+dwSfXBU ��FKSfUPXBSfXBU�JPXBZNdPH]RKS�O�uwSfXBU�LKDª�EHQRWJiL � H]R � SfU � \]DGegA�JPRIH]ZNLWD�?BXBZBH<RK|TuwSTXBUFK\ � H]egH0¸�JP�EDP?CL�JNO�JP\<LKDGR9DPO�§!�NOmDGR9RKH]JPFKDGXBJP�B|fHtFIH]\]?CRKSTL�u5ABJPRWJPegH<LKH]RIFyºMa

� SfXBJP|f|�uGjC�lHcA�DGSTX�L�DG?@L�L � JiL�L � HcABRKDPAEDGFKJP|��Yu�?tSTe H<L�JP|¬a.¤ ?����4���]©.STF��BRIDGpPH<Xkj�SÃa¥HPa�j�H���³\]|T?BZBH<Z0UGRKDP?BA0egH]eN��H]RIFQ\zJiX0FILKSf|f|�ACRKD+dGH�egH]e^�EH<RKF � SfA7¸�JiO�LWH<RlL � H�UGRIDG?BA0e=JPX�JiUGH]R�\ � JPXBUPH]ZL � HcUGRIDG?BA��¥F�pPH<uPjqH��C\<|f?BZCH]ZoegH]eN��H]RIF�\zJPXo?CAEZ�J�LWHtL � H<SfR�e=H<eN��H]RKF � SfA`SfX@OmDGRKe=JiLWSTDGX)SfX5L � HdGH<RIu5FKJPe=H��QJzu`JPF�XBDGX@³´HM�@\]|T?BZBH<ZsegH]eN��H]RIFyº�a

b � ?BF]j;?BXYLKSf|3XBD+�tj�JP|T|;FK\ � H<e=H<F � JzdGH0Js|fSTXBHzJiRªZBH]A�H]XBZCH]XB\Mu[H]S�L � H<RcDPX�L � H�X�?BeN��H]RVDPO\]?CRKRKH<XYL�egH]eN��H]RIF]jlDGRnDGX}L � H5LWDPLWJP|9X�?BeN��H]RnDPO�ZCH]|fHMLWH<Z egH]eN��H]RIF]a}��Fn�QH � JzdGHsXBDPLWH<ZJP��D+dGHPj;L � SfFN|TSfXBH]JPRVZBH]A�H]XBZCH]XB\Mu%\]DGegH]F^SfX[L � RKH]H��¦JzdGDGRIF]h�¸��±ºtL � H)�B?BRIZBH]X%��H]STXBU7DGX[L � HUGRIDG?BA_e=JPX�JiUGH]R�LWD=RKHM³´SfFIFK?BHc\]H]RvLWS�x�\zJiLKH]F�SfX_HMdGH<RIu_LKSfegHtAEH<RKSfDwZ�&¸ %Pº�L � H^�B?BRIZBH]X_�EH<SfXBU=DGXL � H�UPRKDG?BAnegH]eN��H]R&LWDtABRKD+dPH�L � JiL � STF;\]H<RILWS�x�\zJ�LWH9SfF;ZCST�EH]RKH<XYL;OmRKDGe·JPXYu~DPO�L � DGFIH9L � JiL � J+dPH��H]H]X)RIH<dPDGpPH<ZsJiXBZ0DGX�L � H�dPH]RKS�x�H]R�LWDN\ � H]\yp=L � SfF�CDGR�¸��Gº3L � H��B?BRIZBH]X)��H]STXBU^DGX=L � H�dGH]RISTx�H<RLWD~A�H]RvOmDGRKe JN\]DPe=AB?@LyJiLKSfDGX�Ji|¦LKH]FvL�DGX0L � HªegH]FIFWJPUPH�RKH<\]H]S�dGH<Z`OmRIDGe�L � Hª?BFIH]R�OmDGRlHzJP\ � STLKH]eSfX)L � Ht|fSfFvL9DPO&RKHMdGDGpiH]Zo\<H]RILKSTx�\]JiLWH<F]a

� X7\]DGXYLKRWJPFvLzj�SfX_DG?BR�FIDG|f?CLKSfDGXsXBD)DGA�H]RKJiLWSTDGX_STF�|fSTXBHzJPRI|Tu)ZCH]A�H]XBZBH<XYLcDPXoL � HNX�?Be^�EH<R�DPO\]?CRKRKH<XYL3DGR�LWDiLyJP|@ZBH]|TH<LWH<Z~e=H<eN��H]RKF<a � LKF;DGXB|TucD+dGH<R � H]JPZnD±dPH]R3J�FI\ � H]egH9��STL � DG?CL�RIH<dPD@\]JiLWSTDGXSfFcL � H�OmDP|f|fD+��STXBUBhNr�H0RKH<�w?CSfRKH)FIDGegH0AB?B�B|TSf\�JPRK\ � S�dGH0L � JiLNFvLWDGRIH]F~STXCOmDGRKe=JiLKSfDGX�DGX�JPZBZCH]ZJPXBZ�ZBH<|fHMLWH]Z�?BFIH]RIF]a�b � H]Xkj3L � H)AC?B�B|fST\0pPHMu#¸m� � DGFKH5FKST¯]H0ZCH]A�H]XBZBFnDGXC|Tu�DGX%L � H)FIH]\]?CRKSTL�uA�JPRKJPegH<LWH<Ryº�XBH<H]ZBF3LWDV��H9?BAEZBJiLWH<Z�HzJi\ � LKSfegH�Jt?CFKH]R3STFlJiZBZBH]ZgDGR;ZBH<|fHMLWH]Zqa3«�Ji\ � ?BFIH]R�eN?BFvLRKH]JPZ)L � HªAC?B�B|fST\�pPHMu0OmRKDPe�LKSfegH�LWDNLKSfegH~¸�Hia UCaTjBACRKSfDPRQLWD~ABRID+d@STXBU � SfFQe=H<eN�EH<RKF � SfA¦º�jBJPXCZ`S�OL � H~AB?B�B|TSf\^piH<u � JPF�\ � JPXCUGH]Z�FKSTXB\]HNL � H~|¡JiFIL�LKSfegH � H^|fDwDGpPH<Zkj � H~eN?CFILªRIHzJPZ7L � HNXBH<��FtSTXL � H9AB?B�B|TSf\�JiRK\ � S�dGH�JPXBZNL � H]XnA�H]RvOmDGRKe J�|fDw\zJP|w\]DPe=AB?@LyJiLKSfDGXka�b � H�JPegDG?BXYL�DPO�Z�JiLyJ�LKDªRKH]JPZJPXBZ0L � Hª|fDw\zJi|E\<DGe=AC?CLyJiLKSfDGX0JPRKH�|TSfXBH]JPRQSTX�L � HªXw?CeN�EH<R9DPO�\ � JPXBUPH]F�L � JiL � JzdGHªLWJPpPH<X`AC|¡JP\<HSfX5L � HVegHzJiX�LKSfegHPjB�C?CL^¾����9STX)L � HtLWDPLWJP|�X�?BeN��H]R�DPO�\ � JPXBUGH<F]a�b � H^JPZCZBSTLKSfDGX�Ji|k�B?BRIZBH]XsDGXL � HNdGH]RISTx�H<RªSfF�FISfegAB|Tu5L � JiL � H~F � DG?B|TZ7|fDwDGp`JiLªL � H~AC?B�B|fST\^piH<uoOmRIH]��?BH]XYLK|Tu}¸�� � Sf\ � FKH<H]egF

°P§

Page 80: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

?BX�JzdPDGSfZ�Ji�B|fHzº �CL � HªdGH]RISTx�H<R�XBH]H<Z_XBDPL�RIHzJPZ5L � HcJiRK\ � S�dGHPa

')(�� ������-7:</;:<2=- 2����`- ��� :z8 � 8�8�6�� 6����V/�2g1�����������on��! "�$#&%('&%!)*%,+.-�/ Â1032 / ¿wÂyÂ10wÀ4035�¿C� �6287 �62g¿,7<¿PÀ~Á95 ½ �:7nÁ�¾<;"0 � ->=�?A@3B Á - ¿,7<¿PÀ~Á95 ½ �:77<¿PÀ~Á95 Á /C- �:7�7�0w¾q ��Á ��¾ -EDGFH=JI"@3BLK Á �NM�9M / 7 �6595 � K Á�¾3OP;"2 �C; / 2 ��Á /C-�Q«�²g\]SfH<XYL�UPH]XBH<RWJiLKSfDGXkhSR&M / 2 / Á - ¿P¾ /NT ÂMÁ / ¾;��;"2 �<Uy¿�U]Á95 Á - ��ÁÃÂg¿<5VO �62�Á �NMwÀ.W6�9MC¿C� ��¾[Á�¾<;"0 � � @

;"2 �]¼<0� /C- ¿ 2I¿P¾�¼ ��À / 5 / À / ¾;�YX �:7 I"@*Z\[ �62 / �6] / 2C^t¿<5 ��¾3O K Á �NM�X_^YW"¿<5 - � �60 �`;"0 � -- ��À / ¿<0baGÁ95 Á�¿<2�½=Á�¾J7 �62�Àg¿C��Á ��¾7¿�U �60 ��Xc^Q¼ / ¾���� / ¼0¿<0ba"d Z

«�²g\]SfH<XYL�HMdiJP|f?�J�LWSfDPXkheXgf I"@ Á - ¿�;;�65 ½i¾���À~Á�¿<5`h - Áji / ÂMÁ92WÂ10@Á � �9MC¿C�9^���¾�Á�¾<;"0 ��¸Nk�lnmEº�f�opd4q?p@ ^��60 �`;"0 � - ¿�]�¿<5`0 /�r fsopd<^ K M / 2 / otdsÁ - ¿P¾ /NT ÂMÁ / ¾;�!5 ½ - ¿PÀ�;"5�¿�U�5 / Á�¾<;"0 ��¼ ��Àg¿PÁ�¾7 �62 �9M / 7�0@¾q ��Á ��¾uX_vl¿P¾�¼ ?p@ Á - �NM / Á�¾;� / ¾�¼ / ¼=Á�¾<;"0 ��¼ ��Àg¿PÁ�¾ K M;� -�/>/ 5 / À / ¾;� - ¿<2 / � �U / ¿wÂyÂ10wÀ4035�¿C� / ¼ Z

w�?�JPFIS�³�\<DGegeN?CLyJ�LWSTdPHPhyx&�62)¿<595�z*^�7 �625¿<595{Xf I"@ ^�7 �62)¿<595{k|f}opdb^�7 �62)¿<595~m&�1l�m*�uf ?p@ ^X�¸�X�¸!k_l�m&� º1l�m*�Mº F X�¸�X�¸!k_l�m*��º�l�m&�Iº ZL� 7�� F�= m&��lJ�J���cl�m�� B Á - ¿s5 Á - � �:7 / 5 / À / ¾;� - �:7?p@ ^3;;� -C- Á!U�5 ½ K Á �NM,2 / ; / ��Á �¬Á ��¾ - ^��9M / ¾U]½8X�¸!k_l���º KA/ ¼ / ¾���� / X�¸�X�¸:�J�J�]¸!k_l�m&�Iº�lJ�J�J�Wº1l�m���º Z

r¶STLKXBH]FIFKH<F]h~� / � r f�opd�¿P¾�¼�m}f ?p@�Z�+ ]�¿<5`0 /�� f�otd�Á - ÂK¿<595 / ¼7¿7��STLKXBH]FIF�7 �62�m#Á�¾ r0w¾�¼ / 2EX}Á 7 r4F X�¸ � l�mEº Z

>@H<\]?BRISTL�u�h�� / �&oP�d q ? � @ ¼ / ¾���� / �NM / ¼ ��Àg¿PÁ�¾ - 7 �62 K MwÁÃÂCM�NM /  ��À�;"0 �´¿C��Á ��¾�¿<5�;"2 �+ / ¼<0�2 / 7 �627�0w¾q �¬Á ��¾�X�f I"@ Á - ¼ /N� ¾ / ¼}� �9M30 - otd ��oP�d ^ ?p@ � ? � @�� Z x&�62s¿<595�;"2 �<Uy¿�U]Á95 Á - ��ÁÃÂ;;�65 ½�¾���À~Á�¿<5`h �¬Á�À / ¿Y¼<] / 2 - ¿<2MÁ /C-��4@ ^&�9M / 2 /�/ aGÁ - � - ¿c¾ / O<5 ÁjOPÁ!U�5 / 7�0w¾q ��Á ��¾�k¸�zCº - 0�ÂCM �NMC¿C�®;R+¤VXL� W=¸ � @ º ��k���opd �±¸9m_l � l���º�� �4@ ¸�X*l opd¡l�kqºQh

�£¢ ?p@ � � f�o �d ��msf ? �@ ��m¥¤f�� ��X�¸ � l�mEº F X�¸!k_l���º�© F �q¸�zBº¦ ��� / �NMC¿C����¾�5 ½��NM / 5 / OPÁ �¬Á�Àg¿C� / ¿wÂyÂ10@À4035�¿C� / ¼�]�¿<5`0 /C- ^�¸9m&�1lJ�J�J�&lnm��9º§^9À40 - �SU / 5 ��¾3O � �?p@ v,�9M / 7 �62�O / ¼�]�¿<5`0 / m{ÂK¿P¾\U / 5 ��¾3O � ��¿,;;� -C- Á!U�5 ½¨5�¿<2�O / 2 -�/ � ? � @ Z

¸�b � STF9ZBH<xBXBSTLKSfDGX5SfFQH]FKFIH]XYLWSfJP|f|�u�L � HªDGXBHtDPO&£�JPRISM­\ªJiXBZ_®�xBLK¯]e=JPXBXkj@��STL � L � HªZBST�EH]RIH]XB\<HL � JiL=L � H<u�ZCD�XBDPL=RKH<��?BSfRIH`L � JiLgL � HsJP\]\<?BeN?B|fJiLWDPRg��H`�w?BJPFKS ³�\]DPe=eN?@LyJiLKSTdGH ��JPF=J�\<DGXBFKH�³��?BH]XC\]H�L � H<u=XBH]H<Z0LWD^STXYLWRKDwZB?B\<H�L��lDNOm?BRIL � H]RQJP|fUPDGRKS�L � egF]jYDGXCH�OmDGR�UGH]XCH]RWJ�LWSfDPX0JPXBZ�DGXBH�OmDPRdGH<RKS�x�\zJiLKSfDGX5DPO�JN��STLKXBH]FIF�diJP|T?BHPa»º

b � HNJi�ED+dGHVZBHMx�XBSTLKSfDGX5STF�FIH]H<e=STXBUG|Tu�LyJPST|fDGRIH]Z0OmDGR�JnFILyJ�LWSf\t?BFIH^DPO&L � HcJP\<\]?BeN?C|¡JiLKDGR]a � XL � SfF�A�JiAEH<R]j � D+�lH<dGH<R]j��QH�JPRIH9SfXYLWH<RKH<FILWH<ZnSfXnJ�ZCuwX�JPegSf\Q?BFKH9� � H<RKH9L � H<RKH9STF;Jªe�JPXBJPUGH]R&\]DGXw³LWRIDG|f|TSfXBUtL � HtJP\]\<?BeN?B|fJiLWDGR<jCJiXBZ5FKH<dPH]RKJP|�?BFKH<RKF<a � SfRKFvLzj@|fH<L�?BF9F � D+�#L � J�L9ZCuwX�JPegSf\ªJiZBZBSTLKSfDGXDPO�JNdPJi|f?BHªSTF9ZBDGXBHcJiL�?BXBS�L�\]DGFvL�SfX)L � STF9FKHMLKLWSTXBUBa©���ªGªG«¬#c%('&%!)�% � / �YX|f I"@�Z � / � rGF X�¸Nk_l���º­U / �9M / ¿wÂyÂ10wÀ40�5�¿C� �62 - ��7<¿<2 Z � / � r � FX�¸ r lnm�� º F X�¸Nk_l�� � º8U / �NM / ]�¿<5`0 / �:7 �NM / ¿wÂyÂ10wÀ40�5�¿C� �62 K M / ¾�m��¦Á - ¿Y¼Y¼ / ¼�� ���NM / ¿wÂyÂ10wÀ40�5�¿C� / ¼-�/ �9^_� � F �¯® = m�� B�Z � / ��m�f�� ¿P¾�¼ � U / �9M /�K Á �¬¾ /C-C- 7 �62Sm}Á�¾ reZ R&M /  ��À�;"0 �´¿C��Á ��¾ �:7� � K MwÁÃÂCM5Á - �9M /,K Á �¬¾ /C-C- 7 �62Sm�Á�¾ r � ^�Á - Á�¾�¼ / ; / ¾�¼ / ¾;�)��¾ �NM /P- Áji / �:7Y� Z

�!�

Page 81: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� 2 � �:7 Z � � STFª\]DGegAB?CLKH]Z�JPF�OmDG|T|fD+��F]h � � F X�¸ � l�m � ºMa ��H<LV?BFtF � D+��\]DPRKRKH<\<LKXBH]FIF^?BFISfXBU)L � H��?�JPFIS�³�\<DGegeN?CLyJ�LWSTdPHNABRIDGAEH<RIL�u�h,X�¸ � �(l�mEº F X�¸�X�¸ � lnm�� º�l�mEº F X�¸�X�¸ � lnmEº1l�m�� º F X�¸ r l�m�� º Fr �¡a

r�HteN?CFIL�JP|fFIDn�EHVJP�B|TH�LWD � JPXBZC|fHªZCuwX�JPegSf\ªZCH]|fHMLWSTDGXBF9DPO�J~diJP|T?BH�OmRKDPe�L � HVJP\<\]?Be^?B|¡J�³LWDPR]a � LtSfF�\<|fHzJiR � D+�·LKD)ZBD)L � JiL�?BFKSTXBU5\]DGegAB?CLWJiLWSTDGXBF�L � JiLVJPRIHN|fSTXBHzJiR�SfXoL � H~FKST¯]H~DPO�L � HJP\<\]?BeN?C|¡JiLKH]Z_FIH<LE�%a ��H<RKHPj��QHcRKH<FILWRISf\ML�L � H^ZBHMx�XBS�LWSfDPXsFID0JPF�LWD�e=JPpiHVL � H^\<DGe=AC|fHM�@S�L�u)DPOL � SfF9DGA�H]RKJiLWSTDGX)SfXBZCH]A�H]XBZBH<XYL�DPO�L � HVFISf¯<HVDiO~�%h���������on��! "�$#&%('&%('c%,+ -�/ Â1032 / ¿wÂyÂ10@À4035�¿C� �62ªÁ - ZCuwX�Jie=ST\gÁ 7�Á ��MC¿ - �NM / 7 �6595 � K Á�¾3O�;"2 �C; / 2 �¬½ Q�������!�3�±n��_��!�>n��N "� �NM / 2 /¨/ aGÁ - � /NT ÂMÁ / ¾;�9¿<5VO �62MÁ �9MwÀ -� ^�� - 0¦ÂCM �NMC¿C�9^9Á 7 r�F X�¸!k_l���º§^

m_l�m��"f �G^�¿P¾�¼>X�¸ � l�mEº F r ^ �9M / ¾ Z� ¸K¿<0baed¡l r l�m � º F r � - 0�ÂCM�NMC¿C� r � F X�¸!k_l���� = m � B º§v� Z ��¸�X"l r l r � lnm_l�m � º F � � - 0�ÂCM �9MC¿C��X�¸ � � l�mEº F r � Z

� D+�tji�lH�F � D+�%L � JiL&J�ZCuwX�Jie=ST\lJi\]\]?CeN?B|¡J�LWDGR�STF�FIH]\<?BRKHQJPUYJPSTXBFIL�JPXcJPZ�JiACLWS�dGH�JPZCdPH]RKFKJPRIuPjSfX�L � HgOmDG|T|fD+��SfXCU)FK\]H<X�JPRISfDBhV��X�JP\]\<?BeN?B|fJiLWDGRte=JPX�JPUPH]RtFKHMLWFV?BA�L � HgOm?CXB\<LKSfDGXGX�JPXCZ�L � HdiJP|f?CH�k5JPXBZ � SfZBH<FlL � H�LWRKJPAEZCD@DGR�SfX@OmDGRKe=JiLWSTDGXs¿<0<a"dGa;b � HªJiZCdGH<RKFWJiRIu)JiZ�JPACLKSTdGH<|TugegD@ZBS�x�H]FL � HVFIH<LS�%a;r � H<X_J~diJP|f?BHªSTF�JPZBZBH<Z`LKDnSTLzj@L � Hte=JPX�JPUGH<R9?BA�Z�JiLWH<F9L � HVJP\<\]?BeN?C|¡JiLKDGR�diJP|f?BHJP\<\]DGRIZBSfXBUP|TuGa�r � H]X J7diJP|T?BH­mf � STF~ZBH]|TH<LKH]Zkj3L � H5e=JPX�JPUPH]R~RK?CXBFgJP|fUGDPRKSTL � e JiXBZAB?B�C|fSfF � H]FªL � H=RIH]FI?B|TL]a � X�L � H=H<XBZkj.L � HgJPZCdPH]RIFWJPRvu�J�LKLWH<e=A@LWF�LWD`ABRID@ZB?C\]H=J)��S�LWXBH<FKFtL � J�Lm���¤fs� SfF9SfX)L � Ht\]?BRIRKH]XYL�JP\<\]?BeN?C|¡JiLKDGR r a��� � ��6�3ª #&%('c%('&% � / � D U / ¿V¼P½�¾�¿PÀ~ÁÃÂ�¿wÂyÂ10@À4035�¿C� �62�¿<5VO �62�Á �9MwÀ Z � / ��� U / ¿P¾~Á�¾;� / 2K¿w ��Á9] /R 032�Á�¾3O=Àg¿wÂCMwÁ�¾ /�-�/ �t0�;�¿ - 7 �6595 � K{-�Q� �����\n�� ¸�X"l+¿<0<a"d¡l§kEºC^ K M / 2 / X�f I"@ ¿P¾�¼�ksf�otd Z� �~��n��N« ���"!�«en��N "��� � h F$# ^ r h F k Z%­�&'�� "��&��Ýn� GªG�&(&�«*)*�&+�

,.-�/ �L�10�2 m43 � ¾L2 /C- ;;��¾ -�/ � �B�NMwÁ - À /C-C- ¿�O / ^ -�/ � r h F X�¸ r l�mEºC^;¿P¾�¼�� h F �H® = m B�Z,.- �5�P©�� � �60�2 m43 � ¾�2 /C- ;;��¾ -�/ � � �NMwÁ - À /C-C- ¿�O / ^;ÂCM / Â87 �9MC¿C�"m�f��G^�¿P¾�¼^Á 7 - ��^ -�/ �

r h F$ ¸K¿<0ba"d¡l r lnmEºC^Q¿P¾�¼,� h F �9� = m B�Z:*0�;�;"5 ½ �9M / Â103212 / ¾;�t]�¿<5`0 / �:7 r � � �9M / ¿Y¼<] / 2 - ¿<2�½ Z

� / � o��d q ? � @ ¼ / ¾���� / �NM / ¼ ��Àg¿PÁ�¾ - 7 �62 K MwÁÃÂCM �9M /  ��À�;"0 �ÿC�¬Á ��¾�¿<5�;"2 �+ / ¼<0�2 / 7 �62"7�0@¾q ��Á ��¾X f I"@ Á - ¼ /N� ¾ / ¼ Z x&�62ª¿<595�;"2 �<Uy¿�U]Á95 Á - �¬ÁÃÂt;;�65 ½�¾���À~Á�¿<5`h �¬Á�À / ¿Y¼<] / 2 - ¿<2MÁ /C-p�4@ ^ �9M / 2 /�/ aGÁ - � - ¿¾ / O<5 ÁjOPÁ!U�5 / 7�0w¾q ��Á ��¾u�k¸�zBº - 0¦ÂCM�9MC¿C�®;R+¤�¸K¸�X"l±¿<0baed±º�� W�¸�� @ º �§k­� otd �±¸Nm_l � º�� �4@ ¸�X*l opd¡l�kqº<; ��¸�X"l±¿<0bayd¡l§kEº<= ¸N� l r ºQh

� f�o �d ��msf ? �@ ��m¥¤f�� ��X�¸ � l�mEº F X�¸!k_l���º�© F �q¸�zBº

���

Page 82: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� 2 � �:7 Z ��H<Ll?BF3HM� � ST�BSTLlJtRKH]ZC?B\<LKSfDGXnOmRKDGe L � H�JPZCdPH]RIFWJPRvugL � JiL3dwSfDG|fJiLWH<F�L � H�L � H]DGRIH]e�LWDtL � HJPZCdPH]RIFWJPRvusL � JiL��CRKHzJipwF�L � HcFKH]\<?BRKS�L�u_ACRKDGA�H]RvL�u_DPO;J�FKH<\]?BRIH~JP\]\<?BeN?B|fJiLWDPR]a�b � HNRIH]ZB?B\MLWSTDGX��Sf|T|�ABRID@\<H]H]Z SfX¶L � H7OmDG|T|fD+��SfXCU#¸�FILKRWJPSTU � LKOmDGRv��JiRKZ¦º0e=JPXBXBH<R]h A�X STXBAB?CL�¸�X*l otd l�kqº�j�OmH<H]ZL � H]FKHgdiJP|f?BH<FVLKD`L � H0JiZCdGH<RKFWJiRIuGa)b�D_RIH]FIAEDGXCZ�LWDsJPX¢¸��I��ĪÄ��CjymEºV��?BH<RIuGj&FKSTe=AB|�u7?BA�Z�JiLKH� JPXBZ�\<DGe=AC?CLWH ruF X�¸Nk�ln��ºMatb�D)RKH]FIAEDPXBZ�LKD5J�¸��KĪ« �.«;b�«��CjVmEº���?BH<RIuGj.\<DGe=AC?CLWH ruFX�¸Nk�ln� � = m B ºMj@JPXBZ�L � H]X0?CAEZ�J�LWHE�[a�b � H�FI?B\]\<H]FKF9DiOkL � H�JPZCdPH]RKFKJPRIu�ZBSfRIH]\MLW|Tun\<DGRKRIH]FIAEDGXCZBFLWD~L � HtFK?B\<\]H]FIF�DPO�DG?BR9RIH]ZB?B\MLWSTDGXka

� SfXBJP|f|�uGj�SfXNL � H�JPABAB|TSf\zJ�LWSfDPXc�lH � JzdGH�SfXNegSfXCZN�QH9RIH]��?BSfRIH�L � J�L�L � H�Ji\]\]?CeN?B|¡J�LWDGR�JP|f|TD±��FOmDGRªJiX�HM²g\]SfH<XYLtABRKDwDPO3L � J�LtJ)FKH]\<RKHMLVdiJP|T?BHNUGS�dGH<X7��uoFKDGegHN\]DPe=egSTLKe=H<X�L�SfF�\<DGXYLyJPSTXBH]Z�STXJsUPSTdGH<X%JP\<\]?BeN?C|¡JiLKDGRVdiJP|T?BHPa5b � J�LNSfF<j&�lH�RIH]��?BSfRIH=L � JiL^L � H0Ji\]\]?CeN?B|¡J�LWDGRt��H /NT ÂMÁ / ¾;��5 ½;"2 �6]�¿�U�5 / ��STL � RKH]FIAEH<\<L�LWDnFKDPe=Ht\]DPe=egSTLKe=H<X�LQFK\ � H<e=H�¸��9��À~À~Á �vº�a��� �� ��&�� � �N���)*� ���� & ��E ���c�_ �� �!�� )*�s ��E« �$« � � �~ª ���!«�n����� « � �_� b � H]RIH3HM�@SfFvLWF�JPX

HM²=\<SfH<X�Lc¯]H<RKDi³´p�XBD+��|fH]ZCUGH=ACRKDwDPO�DPOlp�XBD+��|fH<ZBUGH�FvuwFILWH<e � � H]RIHgL � H=\<DGege=DGX�STXBAB?CLKFJPRIH��5¸m� � H<RKH�� F �9��À~À~Á �¬¸Nm_l��Pº���STL � J��0��H]STXBU`J5RKJPXBZBDPe=|�u_\ � DPFKH]X�FILKRKSfXCU�ºMj�L � HJP\<\]?Be^?B|¡JiLKSfXBU)Om?BXC\<LWSTDGX¬X}JiXBZ r fgopdYj&JPXBZ�L � HgABRID±dPH]R�� FcSfXBAB?@LWFcJPRKHs¸��wjcm$f ?p@ jk fHotd±ºnOmDGR=ABRKD+dwSfXBU�pwXCD±��|TH]ZBUPHoDPOPm.j � j���FK?B\ � L � JiL�� F �9��À~À~Á �¬¸Nm_l��Pº=JiXBZr>F X�¸ � l�mEºMa

� O¦�Yu��IH<²g\]STH]XYL����QH�egHzJiX��IA�DG|TuwXBDGegS¡Ji|�³´LKSfegHPj��QL � H]X~JPXYu^JP\]\<?BeN?B|fJiLWDPR&FKJiLWSTFIx�H<F&L � SfF�ABRKDGAw³H]RvL�uGa ��D±�lH<dPH]R9�lH�\]DPXBFKSTZBH]R9JVABRKDwDPO�FvuwFILWH<e�HM²=\<SfH<X�L�STOkS�LQ\<DGegA�JPRKH<Fl�lH]|T|���S�L � j�OmDGRQH��CJPen³AB|THPj�JnABRKDwDPO�DPO&p�XBD+��|fH]ZCUGHcDiO�J~ZBSTFK\]RIH<LKHV|TDGUYJPRISTL � esa

')( � � ! �N-747:]4 �c/�� ! 2g-��&/�13678�/�:]2g-b � H�\]DGXCFILWRI?B\<LKSfDGXgZB?BH�LWDc£�JPRISM­\�JPXCZ�®�xBLK¯]e=JPXBX7¤ £�®3§Y°�©¦STF;L � H���JPFISfF;OmDGR3DG?BR3\<DGXBFILKRK?B\MLWSTDGX��H]|fD+�ta7b � H�ZBST�EH]RIH]XB\<H]FNOmRKDPe L � H0\]S�LWH<Z%\]DGXBFvLWRI?B\<LKSfDGX�JPRIH=L � JiL`¸��±ºtL � H0ZBDGe=JPSTX�DPO�L � HJP\<\]?BeN?C|¡JiLKH]ZndPJi|f?BH<F;\]DGXBFISfFvLWF�DPOqACRKSfegH9X�?BeN��H]RIF�DPXB|Tu �E¸ %Gº��lH�UGSTdPH�JtegH<L � D@Z~OmDGR;ZBH<|fHMLWSfXCUdiJP|f?CH]F�OmRIDGe L � H~JP\<\]?Be^?B|¡JiLKDGR]jESÃa¥HPa�jq�lH~\]DGXBFvLWRI?B\<LVJ�¼P½�¾�¿PÀ~ÁÃÂ^JP\]\<?BeN?B|fJiLWDGR�;¸ �Yº��lH~UGSTdPHH<²g\<SfH]XYL�JP|fUGDPRKSTL � egF�OmDGRlZCH]|fHMLWSTXBU^JV?BFKH<R�JPXCZ0?BA�Z�JiLWSTXBUcJV��STLKXBH]FIF ��JiXBZ7¸m¨�º;�lH�ACRKD+dwSfZBH�JPXH<²g\<SfH]XYL�¯]H<RKDi³´p�XBD+��|fH]ZCUGHcACRKDwDPO�DiO�egH]eN��H]RIF � STA5pwXCD±��|TH]ZBUPHPa

" I"@ STF^L � H�O�JPegSf|TuoDPO�Om?BXB\<LKSfDGXCFcL � JiL~\]DPRKRKH<FKA�DGXBZ%LWD_HM�@AEDPXBH]XYLWSfJiLWSTXBUoegD@ZC?B|fDsFWJiOmH�³ABRISfegH�ABRID@ZC?B\<LKF�ZBRWJz��X)OmRKDPe�L � H�SfXYLKH]UGH<RKF9DPO.|TH]XBUPL � zEa,� � DwDGFKSTXBUX f I*@ JPegDG?BXYLKFLKD�\ � DwDGFKSTXBUªJ�RKJPXBZBDGe egD@ZC?B|f?BF$# F&%(' DPO¦|fH<XBUPL � zEjP� � H]RKH % F % % �*) �Gj '�F % ' �*) �GjJPXCZ % j % ��j ' j ' �.JiRKHnJP|T|&ABRISfegHPaªr�H^��Sf|T|&ZBH<XBDPLKH X�\<DGRKRIH]FIAEDGXCZBSfXBU0LKD)e=DwZB?B|T?BF+#�JiXBZZBDPe�JPSTX ?-,/. 0 ��u4X21 . ,/. 0 a&r�H9ZBH<XBDPLWHEX31 . ,/. 0 �Yu¨X31tJPXBZ~�Yu¨X�� � H<XgS�L;ZBDwH]F;XBDiL3\zJP?BFIH\<DGXCOm?BFISfDGXka

" ?-,/. 0 SfF9L � HtFIH<L = $�f�4�5�687(9;:gh $=<F&% � l ' �?>A@CB $ BED B jB� � H<RKH @ JiXBZ D \zJiX_��H\ � DPFKH]X���STL � JPRK�BS�LWRKJPRIusAEDP|TuwXBDGegS¡JP|�ZBH<AEH<XBZBH]XC\]HgDGX7L � HnFKH<\]?BRISTL�u7ABJPRWJPegH<LKH]R�z�j&JiF|TDGXBU=JPF %�F @ JPXBZ D F @ � a ? � ,/. 0 SfF^¸¬JPXYu`FK?B�CFKH<L�DPOyº9DPO�L � H^FIH<L�DPO�STX�LKH]UGH<RKF�OmRKDGe¤ %�l @ �HG

�<©�FK?B\ � L � J�L ?-,/. 0 � ? � ,/. 0 a" � DGR X F X31CjCL � HVJP?@�@Sf|TS¡JPRvu�STXCOmDGRIe�JiLKSfDGXo¿<0<a"dcSTF�L � HªO�JP\MLWDGRISf¯]JiLWSTDGX0DPOI#�a

�=%

Page 83: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

" � DGR X F X31Cj�otd F = ksf����H1nh¡k <F � B JPXBZ�o �d F����1 a" � DGR,X F X21Cj�X�¸!k_l�mEº F k��e=DwZ?#�a � DPLWH~L � JiL�X�¸�X�¸!k_l�m&�Iº�l�m*��º F X�¸!k_l = m&�Cl�m*� B º Fk����� ;egD@Z?#

"�� AEZ�J�LWH�DPOqL � H�JP\]\<?BeN?B|fJiLWDPR�dPJi|f?BHia���F3egH]XYLWSTDGXBH]ZgHzJiRK|fSTH]R<j�JPZBZBSTXBUVJtdiJP|T?BH��m0LWDtL � HJP\<\]?Be^?B|¡JiLKDGR9diJP|f?BH r \]JPX_��HcZCDGXBHcJPF r � F X�¸ r l��mEº F r����egD@Z�#�a�Ä�H<|fHMLWSfXCU=JndiJP|f?BH�msOmRKDGe�L � HVJP\<\]?BeN?C|¡JiLKDGR9SfF�JPF9OmDG|T|fD+��F]a ¸K¸ % l ' º1l r l��m�º F r����� �������� �! �#" �%$&! �#" egD@Z�#&a

"�� AEZ�J�LWH_DiOª��STLWXCH]FKF<h���F0egH]XYLWSTDGXBH]Zqj9?BAEZBJiLWSTXBU�L � H_��STLKXBH]FIF­k#JiO�LWH<R'�m � JPF��EH<H]XJPZCZBH]Z�\zJiX���H~ZBDGXCH~��u k*� F X�¸!k_l��mEº F k ��Ga � X�\]JPFKHij(�mE<F m�f ?p@ � JPFt��H~ZBH]|TH<LWH<ZOmRIDGe�L � HQJP\]\<?BeN?B|fJiLWDPR]j±L � H���STLWXCH]FKF~k~\zJPX^�EHl?BAEZBJiLWH<Z~JPF&OmDP|f|fD+��F<a&£�uVL � HQH��wLWH]XCZBH]Z� ��Ä�JP|fUGDPRKSTL � e`jEDGXCHg\]JPX�\]DGegAB?CLKHNL � HnSTX�LKH]UGH<RKF*)�j,+^FK?B\ � L � JiL-)¡m=)�+.�m F �=JiXBZL � H]X�k � F ��¸!k_l�m_l��mcl r l r � º F k0/ r �%1 a ��HML�?BFQdPH]RISTO�ugL � JiLYX�¸!k � l�mEº F k � � egD@Z?# F r � h

¸Nk / r �21 º � F ¸ <@a �+º¸I¸!k / r � 1 º � �� º �#3 �� F ¸ <@a %Pº

¸I¸!k � º / �� ¸ r � �� º 1 � º �#3 �� F ¸ <@a �Gº¸ r / �� r 1 � º �#3 �� F r �#3 �� F r � ¸ <@a ¨Yº

«;��?�JiLKSfDGX�¸ <wa %GºQSTF9\]DGRIRKH<\<L��EH<\zJP?BFIH4�moSfF9RIH]|fJiLWS�dGH]|�u0ABRISfegH�LWD65�¸ #�ºMar�H5XBDiLWH)L � J�LgJPZBZBSTXBU�DGR~ZBH]|TH<LKSfXBU7FIH<dGH<RWJP|9diJP|T?BH]FgJiLnDGXC\]H5\zJPX���H5ZBDGXBH5FKSTe=AC|Tu���u

|fHMLKLKSfXBU,m��B��H�L � H�ABRKDwZB?B\ML9DPO�L � H�JPZCZBH]Z)DGRlZBH]|TH<LKH]Z0diJP|f?CH]F]a�b � SfF9Ji|fFKD � DG|TZBFl��S�L � RIH]FKA�H]\MLLWDn?BA�Z�JiLKSfXBU~L � Hª��STLWXCH]FKF<a9�sDPRKHtABRKH<\]STFKH]|�uGj�|TH<L�7 1 ��HtL � HtABRKDwZB?B\ML�L � HPm4�¥F�LKD=JiZBZ`LKD�JiXBZ798V�EH^L � HNDGXCH]F�LKD)ZBH]|TH<LWHcOmRKDGe�L � H~JP\]\<?BeN?B|fJiLWDPR�diJP|f?CH r aªb � H]XqjkL � HNXCH<�·JP\]\<?BeN?B|fJiLWDGRdiJP|f?CH r �Eh F r;:�<�: � = ������� �! �#" �%$&! �#" egD@Z�#�a � O{k_��JiF�L � Hª��STLWXCH]FKF�L � JiLSm_�QJPF�\<DGXYLyJPSTXBH]Z`SfX rJPXBZ m7�QJPFªXBDiL�RKH<e=D+dPH]Z7OmRKDGe�L � H~JP\<\]?BeN?C|¡JiLKDGR]j�SÃa¥HPa�jem6>?798�j�L � H<X k*� k 1 :@< r � / e=DwZ�#�SfF�J��STLKXBH]FIF;L � JiL{m0SfF�\]DGXYLyJiSfXBH<ZgSTX r � jG� � H<RKHA)^JPXCZB+�FWJiLKSfFvO�uC)¡m-)D+E798 F ��JPXBZgJPRKH9\<DGegAB?CLWH<Z?BFISfXBU~L � HVH��wLWH]XCZBH]Z � ��ÄJP|fUGDPRKSTL � e`a��� � ��6�3ª #&%GFc%!)�%IH ¾�¼ / 2 �9M /�- �!2 ��¾3O�� : + ¿ -C- 0wÀ�; �¬Á ��¾�^ �NM / ¿�U �6] /  ��¾ - ��2�0� �¬Á ��¾_Á - ¿ -�/ hÂ1032 / ¼P½�¾�¿PÀ~ÁÃÂc¿wÂyÂ10wÀ40�5�¿C� �62 Z� 2 � �:7 Z «�dGH<RIu�L � STXBUN��H]FISfZBH<FQFKH<\]?BRISTL�ugSfF�SfegegH]ZBSfJiLWHia�£lunb � H]DGRIH]e <@a %@a %wj@S�LlSTF3FK?C²g\]STH]XYLQLKDF � D±�#L � JiL�L � H�\]DGXCFILWRI?B\<LKSfDGX)FKJiLWSTFIx�H<F�FKH<\]?BRISTL�u0JPF�ZBHMx�XBH]Z5STX5Ä�H<x�XBS�LWSTDGX�<@a %@a �Ga A�?BR�ACRKDwDPOSfF�FKSfegSf|fJPR9LWD�L � H~DGXBH^UGSTdPH]X��Yu7£�JPRISM­\�³ ®�xBLW¯<e�JiXBX_OmDGR�L � H]STR�\<DGXBFILKRK?B\MLWSTDGX�¸mL � HNZBST�EH]RIH]XB\<H��H]SfXCU�L � JiL.�QHlZBD�XBDPL&RKH]��?BSTRKH�m��iLKD���H�ABRKSTe=HzºMa.b � H�ABRKDwDPOB�Yuc£�JPRISM­\�³ ®�xBLW¯<e�JiXBXtSfF�JP\<LK?�JP|T|TuL � HVFKJPegHtJPF�DGXBHtUGSTdPH]X`�Yu`> � JPegSfRª¤ > � J!� �i©¬a

� DPLKH�L � J�L�L � H�ZBH<x�XCSTLWSTDGX)DPO.FIH]\]?CRKSTL�u0RKH]��?BSTRKH<F�L � JiLQOmDGR�JPXYu�ZBDGe=JPSfX ? �kOmDGRl� � Sf\ � L � HJP\<\]?BeN?C|¡JiLKDGR�Om?CXB\<LKSfDGXLX`SfFl�lH]|T|�³´ZBH<x�XCH]Zkj@STLlF � DG?C|fZ0��H�STe=A�DGFKFISf�B|TH9LWDN\<DGe=AC?CLWHªJVdPJi|f?BH k��FK?C\ � L � JiL,k F X�¸!k�� lnmEº �.L � H<RKH<OmDPRKHn�QHg\]DGXCFKSfZCH]RªL � HgFKHMLVDPO�A�DGFKFISf�B|THNOmDGRKUPH]RIu_LWD`�EH ? � ,/. 0RWJ�L � H<R�L � JPX ?-,/. 0 a

>@?BABA�DGFIHg�lH0JPRIHnUGSTdPH]X�JPX�JiZCdGH<RKFWJiRIu � L � JiL]j�DPX�STXBAB?CL #}JPXBZ\k fKJL���H1Cj.DG?@LWAB?CLKFM ACRKSfegH]F�m&�ClJ�J�J�cl�m�� f ?-,/. 0 JPXBZ\k � f ���1 j&m � f ? � ,/. 0 FK?B\ � L � J�L=¸!k � º �EN F k0O �@P � � Sf|fHm��I<F mQ.OmDGR�JP|T|SRKa ��H<L�?BF�?BFIH � LWDn�BRIHzJPp=L � HtFILKRKDGXCU�µ�>@�JPFKFI?BegACLWSTDGXka

� �

Page 84: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

>@?BABA�DGFIH # F %(' L � JiL9SfF�JnACRKDwZB?B\<L�DiO�L��lDnFWJiOmHªACRKSfegH]F<j %­F % % � ) �tJPXBZ '�F % ' � ) �GjSfF~UPSTdGH<Xka >@?BABA�DGFKH)L � H`diJP|T?BH�k f ����1�SfF~UGS�dGH]X�JPF~�lH]|f|¬a�b&D��BRIHzJPp[L � H5FILWRIDGXBU�µ�>w�JPFIFK?BegACLWSTDGXkjC�lHVeN?BFIL�DP?CLWAB?@L�JNdiJP|T?BH $ � �Pj��0FK?C\ � L � JiL���� F k.a

r�HVF � JP|f|kACRKDw\]H]H<ZoJPF9OmDG|T|fD+��F]h,�ªSTdPH=¸�#{l�kqºlLKD~L � HcJPZCdPH]RKFKJPRIuPa9>@?CABAEDPFKHtL � HVJPZCdPH]RIFWJPRvu\]DPe=H<F&?BAc��STL � J�OmDPRKUGH<RIu�¸!k��(l�m��9l±¸9m&��lJ�J�J�clnm���ºIºMj�� � H]RIHAm <F mQCOmDGR&JPXYu*RKa �.HML{m F�� �Qe� mQ�ab � ?BF��QH � JzdGH,k�� � N F k9�Pa� �!« ��ª % � / � � F UG\]Z�¸Nm � l�mEº Z R&M / ¾ / Á �9M / 2�� F ��62�� F m��S7 �62 - ��À / � B�� B M Z

� 2 � �:7 �:7ªÂ15�¿PÁ�À Q >@?BABA�DGFIH���� m)JPXBZ�� <F �Ga�b � H]XkjCJPF�m&�1lJ�J�J�yl�m���JPRKH�ABRISfegH]F]j�S�L;OmDG|f|TD±��FL � JiL��ªSTF�L � HQABRID@ZC?B\<L�DPO¦J�FI?B�BFIH<L;DPO¦ACRKSfegH]F<a�>w?BABA�DGFKH�OmDGR&FIDGegHpmQ�JiXBZ�m����QH � JzdGHAmQ m�������ab � H<X¨mQ m���� m � a;£Q?CL;L � SfF;STF3Jª\]DGXYLWRKJPZBST\<LWSTDGXnJPF�mQ m�� � m � eN?BFIL � DP|fZ~ZB?BH9LKDtL � H9ZBHMx�XBSTLKSfDGXCFDPO � ,/. 0 JiXBZ¥� �,�. 0 hs£lH]\zJi?BFKHLm � f� �,/. 0 �QH � JzdGHLm � F @ � a � DGRnJPXYu mQ l�m���fH� ,/. 0 jmQ m���� @ � � m � j¦JPF8m&�1l�m*��� @ a

� RKDGe$L � H�\]|fJPSfe`j�STL�OmDG|f|TD+��F�L � JiL�� F UG\<Z.¸Nm��9lnmEº F m.h;H]S�L � H<R�¸��±º�� F �GjCDPR�¸ %Gº�� F m���j� � ST|fHLm�� <F m���j�FID�� F m�� F�m��¡a £�u ��H<e=e=J�¨Ca �Ga � �CjlL � H`dPJi|f?BH<F �[JPXCZ � � �o\]JPX��H~\]DGegAB?CLKH]Z�H<²g\]STH]XYLW|�uGj.FK?B\ � L � J�L!�#" F k�egDwZ #&a~b � SfFª\<DGXYLWRKJPZBSf\MLWFªL � HgFvLWRIDGXBU`µ�>w�JPFIFK?BegACLWSTDGXka')(%$ (+* &('*),+2..- �0/ 8;7 7214365 1 � 187 7�9:9*+ � � .43<; 1 0>= . 5 1@?BAC)D),=E9F=�G

021 � .43��H<RKH��QHlF � D+�%L � JiL&L � HlJP\]\<?BeN?B|fJiLWDGR.H�� � Sf�BS�LWH]Z^JP��D±dPHQSTF�HM²g\]SfH<XYLW|TutACRKD+diJP�B|fH3��STL � RIH]FKA�H]\MLLWDtL � H�\<DGege=S�LWegH]XYL;FK\ � H]egH�ZBH<FK\]RISf��H]Z=SfX=>@H]\MLWSTDGX=¨Ca <@a �Ga3>w?BABA�DGFKH�L � J�L�L � H�AB?B�B|TSf\�pPHMunDPOL � H~\]DGege=S�LWegH]XYL�FK\ � H<e=HnSfFN¸�#IH�lKJLH�lNMOH�ºMj.JiXBZoL � J�LªSTL��QJPFªABST\ypPH<Z�STX�JPX7SfXCSTLWSfJP|�LWRI?BFILKH]ZFKHMLW?BAsA � JPFIHPa

r�H`JP|TFKD7XBH<H]Z�LWD�HM�wLKH]XBZ�L � H5Ji\]\]?CeN?B|¡J�LWDGRNAC?B�B|fST\)pPHMu#¸�#~l r º^��u[RWJPXBZCDGe H<|fH]egH]XYLKF¸PJ"lNM¦ºAf����H1~FI?B\ � L � JiL�|TDGURQ�MsSfF9XBDiL�pwXCD±��X`LWD~L � HVACRKD+dGH<R]ab&DªACRKD+dGH�L � JiL3J�UGS�dGH<X~\]DGege=S�LWegH]XYLTS � JPXCZnJ�UGSTdPH]XnJP\<\]?Be^?B|¡JiLKDGR r \<DGXYLyJPSTXNL � H�FKJPegHdiJP|f?CH $GjBL � HªOmDG|T|fD+��SfXBU^ABRKDPLKD@\<DG|kSTF9\zJPRIRKSfH<Z5DG?CLza

©���ªGªG«¬#c%GF&%('&% R&M / ;"2 ��� �+ �65EÁ�¾ux3ÁjO<032 /!U h Á - ¿�i / 2 �6h 7�¾�� K 5 / ¼�O / ;"2 � �:7 �:7�7�¾�� K 5 / ¼�O / �:7�9M / ]�¿<5`0 /C- ¸ $¡l§k_l��Pº - 0�ÂCM�NMC¿C��kV� F r e=DwZ?#¶¿P¾�¼WS F J��H MYXH Z� 2 � �:7 Z b � Hc\]DGegAB|fHMLWH<XBH]FIF�ABRIDGA�H]RIL�u`STF�\<|fH]JPR]alb � Hc¯<H]RIDi³�p�XBD+��|fH<ZBUGHcABRKDGA�H]RvL�u)OmDG|f|TD+��F9�EH�³\zJi?BFKH�L � H3FKSTeN?B|fJiLWDGR�\]JPXcOmDPRKe�L � Hl\<DGege=S�LWegH]XYLWF�J�L�RKJPXBZBDGe�JPXBZcO�JipPH3L � H�ABRKDwDPOmF<a � DGR�L � HHM�wLKRWJP\MLWSfDPXkjqXBDiLWHcL � JiL��QHNH��wLWRWJi\<L�diJP|T?BH]FN¸[Z�l>\ lK]�l_^�º9FK?B\ � L � JiLn¸��±º�S FHr J�`�MYa F S!bc MYaij¸ %Pº�^ F Zd\�jBJPXBZ7¸��YºeZ f ? a � RKDPe ¸ �±º�j@�lH�JP|TFKDNUGHMLª¸m¨�º�Sfbc F r J�`Ba ��H<LAk F S c ¤gJih�a � DPLKHL � JiL�k b F ¸[S c ¤jJ h º b F S bc ¤gJ bkh F r J ` ¤jJ ` Fr jqJPXBZoFID��QH^DG?CLWAC?CL�L � HcdiJP|T?BHlZPf ? � JiXBZABRID@DPO&DPO&e=H<eN��H]RKF � SfALk.a

')(nm �poqo��z:z8S�c/�:]2g- /�2 /�r � ! 1��ª4 �ª-0/;: �>�ts­�u�&/��P���H<RKHij.�lHgF � D+� � D±� LWD5?BFIHnL � HnZCuwX�JPegSf\nJP\<\]?Be^?B|¡JiLKDGR�ABRIH]FIH]XYLWH<Z[SfX�>@H<\<LKSfDGX <@a �)SfX�DGRv³ZBH<R�LWD)RIH<dGDPpPHn\]RIH]ZBH<X�LKS¡JP|TF�STXoL � HN\<RKH<ZBH]XYLWSfJP|�FvuwFILWH<e�ABRIH]FKH<XYLWH]Z�SfX � � JPACLKH]R��=� � H<RKH~L � H?BXBZCH]RK|�uwSfXBUnFKSTUGX�JiLK?BRKHªFI\ � H]egHVSfF�JPF�SfX�� � JiACLWH<R�¨Ca

�P¨

Page 85: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

���������������� ��������������������! #"%$&('*)�',+-'/.�021!3�465� 87!�#�#�:9;�:��7<4*1!=?>�=/7!@�A! CB D�'6E�FG 1�9H9H��469I ?@J4LK����-�����M�! #"N$& H ',+ H '/. H 0O>��P1�9H9H�Q469I ?@R4TS �U �?VXWRYZ�;�[�\�� ��J��]M5� 2^<7!���� ?_�$`�'/a!'*b H 0(_6�:�O5H465:7<4c` �Ld )�9H1XeI&f7!@:egS �ih + �H . XkjH 9H1Xe

& HclmonHprq G 5�1R1�_6 !>X�:@-�Q3s1!=O9H�Q"t7<4u=O7!@:e�1�9v1!3\�Q ?@�A!465Cw 1 >R^<7!���� ?_cxy>zb " >Rb�7!@:e{�P1�9IK-��4* 465� |31����Q1~}M��@�A��cS c h `-+ " 9H1XeI&(>�S " h + " . X�� 9I1zeI&(>�S h $�S c 0 � . X 9H1Xet& l

� 42��_2��9IK�1!=6467!@R4i4*1C@�1!4* 8465-7<4TS h $�S c 0 � . X h ` � + " � . X $,9I1ze�&�0 l� ?@:eg465� �^<7!���� ?_|$�S c 'OS " 'OSy0�4*1I465� �^! #=/�Q�: #=L7!@:e��#7<=/=6"C1���4i465� �31����Q1~}M��@�A;�# #=61<��z@�1�}M�� ?e�A! |K:=61X1!3_21!3��z@�1�}��Q ?e�A! !�� l � 5�1~}�465-7<42S���_u7t�P1�9H9H�Q469H ?@J4L��@C�-7!_* ?_|$�S c '/.�0�4*1t465� T^�7!���� T�P1�9C9H�Q4*4* ?e4*1���@�465� ��P1�9H9H�Q469I ?@R4�S � >�7!@:e�465:7<4;S��~)�5:7!_|465� I=O�QA�5J4|=/ #K:=6 ?_* ?@R467<46�Q1�@��@�$s+-'/.�0O>��:_/��@�At465� 8K:=/1!4*1X�P1���e: ?_6�P=/�Q�� ?e{��@ � ?�P46�Q1�@�� l��Xl � l

�c�|� $��?'*�-'*� � '/ �0i�RS h S bc . a 9H1XeI& ¡S �ih + bH . a/¢H 9I1Xet& H ¡ ST�~) h + ` . a 9I1zeI&�£

¤ l � 5�1~}¥465:7<4�S��~)C��_i7!��_*1H7t�P1�9H9H��469I ?@J4L��@g�-7!_6 ?_8$s+-'/.�0O>�4*1I465� �K:=61ze:�:�P4u1!3465� 8^<7!���� ?_2�P1�9C9H�Q4*4* ?e�4*1H�X"�S¦7!@:efS " >:7!_Me�1�@: 8��@ � ?�P46�Q1�@�� l�§Xl ¤ l

¨ l � 5�1~}¥465:7<4i465� �^�7!���: ��P1�9C9H�Q4*4* ?e{4*1I��@{�P1�9H9H�Q469H ?@J4MSt>���@��-7!_* ?_8$�S c '/.�0O>��_2��@{465: |=/7!@�A! 8© � ,�. 0 >-7!_2e: ?_6�P=/�Q�� ?e{��@ � ?�P46�Q1�@�� l��Xl��Xl� STUG?BRKH <+³ �Gh;®;RID@DPO&b � JiL�J �QDGege=S�LKLKH]Z�ª�JP|T?BH � F�SfX)L � Ht��\]\]?CeN?B|¡J�LWDGR

� X7UGH]XCH]RWJi|ÃjqH]JP\ � DGRKUGJPXBSf¯]JiLWSTDGX5��Sf|f| � JzdPHPj�SfXoJPZBZBS�LWSfDPXsLWD�STLWF�?BFK?BJP|�\]RIH]ZBH<XYLWS¡Ji|�AB?B�C|fSf\pPHMuGjCJVAB?C�B|fST\9pPH<u_¸�X"l§kEº�DPOkJVZCuwX�Jie=ST\�Ji\]\]?CeN?B|¡J�LWDGR<a�«�dGH<RIunLWSTe=H�Jª\]RIH]ZBH<XYLWS¡Ji|\«`SfF3STFKFK?CH]Z?BXBZCH]RªL � H~\<RKH<ZBH]XYLWSfJP|�AB?C�B|fST\NpPHMuGj.L � H~DGRIUYJPXBST¯zJiLKSfDGX_RKH]\<H]S�dGH]FªL � HNdiJP|f?BH>m&¸�«.º�� � H<RKH4m&¸/¬ ºSfF�JPX)H<²g\]STH]XYLW|�u0\<DGe=AC?CLyJP�C|fH�Om?BXC\<LWSTDGX)FK?C\ � L � JiL8m&¸�«.º8f ? a9b � HtdiJP|T?BHEm&¸�«.ºQSfF�JPZBZBH<Z5LKDL � HtJP\]\<?BeN?B|fJiLWDGR�� � H]X5L � Hª\]RKH<ZBH]XYLKS¡JP|�«�STF�UGRWJiX�LKH]ZkjBJPXBZ5ZBH]|TH<LKH]Z)OmRKDGe�L � HtJP\]\<?BeN?B|fJiLWDGR� � H<X�L � H~\]RIH]ZBH<X�LKS¡JP|;STF�RKHMdGDGpiH]Zkag®;RKDwDPOlDPO�p�XBD+��|fH]ZCUGHnDPOlJ5\<RKH<ZBH]XYLWSfJP|;SfXYdPDG|TdPH]FªABRID±dwSTXBUp�XBD+��|fH<ZBUGH�DiO�¸ : � lP«el � º;FK?C\ � L � J�LT«oSTF�JcFKSTUGX�JiLK?BRKH�DGX :=��j@JPXBZ­X�¸Nm&¸�«.º1l � º F k.j�� � H]RIHk¶SfFnL � H_\]?BRIRKH]XYL0diJP|T?BH_DiOªL � H_JP\]\<?BeN?B|fJiLWDGR<a#r � JiL)SfFgH]FIFKH<X�LKS¡JP| � H]RIHoSfFnL � J�L0XBD�L��lD\]RIH]ZBH<XYLWS¡Ji|fF � JzdGHªL � HVFKJPegHtdiJP|T?BH�m&¸­«�ºMa

� DGR�L � H~FKSfUPX�JiLW?CRKHNFI\ � H]egH~ZBH]FI\]RISf��H]Z�SfX � � JiACLWH<Rª¨Bjq� � H<RKHnFKSTUGX�JiLK?BRKH{«%DPX7e=H<FKFWJiUGHM SfFtJ0LW?BAC|fH`¸k®¡l $¡l r º�FK?B\ � L � JiL-) � +?¯ � F r ��egDwZ #&j.|fH<L�m&¸­«.º F $Ga � D5L��lD`\]RKH<ZBH]XYLKS¡JP|TF��Sf|T| � JzdPHVL � HtFWJPegHªdPJi|f?BH $Ga

�=<

Page 86: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

���

Page 87: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ����

� � �� � � � ���� ���%� ��� �"��� ��� �

>@STXB\]H�L � H�FIH]egSfX�Ji|��lDGRKpgDPO@�ªDG|fZ@��JPFIFKH<R]j��`Sf\zJi|fS�JPXBZ)µ�STdPH]FvLV¤��V�_µ��!��©qDGX0ZBHMx�XBSTXBUNFKSTUGX�J�³LW?CRKHªFK\ � H]egH]F]j�S�L � JiF9�EH<\]DGegH�\]|THzJPR�L � J�L�L � H�xBRKFIL�RKH]��?BSTRKH<e=H<X�L9OmRIDGe JNFKSfUPX�JiLW?CRKH�FI\ � H]egHSfF9L � JiL�STL�F � DG?B|fZsFWJiLKSfFvO�u0L � HB�V�_µ ZBH<x�XCSTLWSTDGX5DPO;FIH]\]?CRKSTL�uPa ��D+�lH<dPH]R]jELWDg�EHVe=DPFIL�?BFKHMOm?B|ÃjL��lD0JPZBZCSTLWSTDGX�JP|qABRKDGA�H]RvLWSTH]F�DPO�FISfUGXBJiLW?BRIHtFK\ � H<e=H<FªJPRKHtZBH<FKSTRWJP�B|THPh�¸ �±ºQL � JiL�L � HVFK\ � H]egH^��HFKH<\]?BRIHcSTX)L � HªAB|fJPSfX)egDwZBH]|¬jCSÃa¥HPa�jC��S�L � DG?@L�JnRKJPXBZBDPe DGRWJi\]|fH�DGR9\]DGegegDGX)A�JPRKJPe=HMLWH<RKF �¦JiXBZ¸ %Pº�L � JiL�L � HcFI\ � H]egHc��HVFILyJ�LWH]|TH]FIF]j¦SÃa¥HPa�j¦XBDPL�RKH<�w?CSfRKHªL � HcFISfUGXCH]R9LWDg?BA�Z�JiLWHtL � HcFIH]\]RIH<L�pPHMuJiO�LKH]R9HzJi\ � SfXYdPD@\]JiLWSTDGXka

b � HVDGXB|Tu�FKSTUGX�JiLK?BRKHªFI\ � H]egH]F�FWJiLKSfFIO�uwSTXBU~�EDiL � DPO&L � H]FIH^JiZBZBSTLKSfDGXBJP|EACRKDGA�H]RvLWSfH<F�JPRKHªL � H>wLKRKDGXBU�³ µ�>@��³´��JPFKH<ZNFK\ � H]egH]F�DPO �ªH]XCX�JPRKD�H<L�JP|Ãa@¤ � ��µ�§G§±©BJiXBZ �QRWJie=H<R�JPXCZn> � DG?CA`¤��9>C§P§i©ÃjJPXBZªL � H;FK\ � H<e=H�SfegAB|TSfH]Z��Yu�L � H�dPH]RISTx¦JP�C|fH�RKJPXBZBDGe Om?BXB\<LKSfDGXªZC?BH;LWD��sST\zJP|TSPH<L�Ji|ÃaY¤¥�_µ�ªª§P§i©Ãj��JPFIH]Z`DGX`µ�>w�^aB��X`DPAEH<X`��?BH<FILKSfDGX)�QJPF9LWDn\]DGegHª?BA)��STL � J~FKSfUPX�JiLW?CRKHªFK\ � H]egHVFKJiLWSTFIO�uwSfXCUL � HcL��lD0JPZBZCSTLWSTDGX�JP|qABRKDGA�H]RvLWSTH]F]j�FK?C\ � L � J�L�S�L��lDG?B|TZ_��H^FIH]\]?CRKH^?CXBZBH]R�J=ZBS��qH<RKH<X�L�L�uwAEHcDPOJPFIFK?BegACLWSTDGXka ��H]RKHij��QHtUGS�dGHtFK?B\ � J~FKSfUPX�JiLW?CRKHtFK\ � H<e=Hij¦��JPFKH<ZsDPX_J~UGH<XBH]RKJP|fST¯zJiLKSfDGX0DiO�L � HÄ�ST²gH�³ ��H<|f|Te�JPX�JPFKFI?BegACLWSTDGX)OmDGR9UGRKDP?BABF9� � H]RIHcZCH]\]STFKSTDGX�JP|�Ä�S�²gHM³ ��H]|T|fe=JPX�STF9HzJPFvuGa�L�~���4�_��&J� )"�_«en � ��� &b% b � H9FISfUGXBJiLW?BRIH�FK\ � H]egH��QH9ABRIDGA�DGFKH�STF;J�?BXBST��?BH�FKSTUGX�JiLK?BRKHQFK\ � H<e=Hia� XCSf��?BHVFKSfUPX�JiLW?CRKHtFK\ � H<e=H<F�JPRIH �c�_µ�³�FIH]\<?BRKHcFKSfUPX�JiLW?CRKHtFK\ � H<e=H<F�� � H<RKHVL � HtFKSTUGX�JiLK?BRKHtSTFJ � JPRIZ@³´LKDi³�\<DGe=AC?CLWH�Om?BXC\<LWSTDGXnDPO�L � H�AB?B�C|fSf\9piH<ugJPXCZgL � H�e=H<FKFWJiUGHPa�b � H<u~�lH]RKH�SfXYLKRKDwZB?B\]H<Z�Yu�ªDG|fZC�QJPFIFKH]R�JPXCZ A�FILKRKD+dwFKpYu�¤�� Aª§=%±© � a

� X0L � H�RWJPXCZBDGe~³�DGRKJP\]|TH�egDwZBH]|¬j@JcRKHzJi|fSf¯]JiLWSTDGXnDPO.?BXBST��?BH�FISfUGX�J�LW?BRIH]FQSTFl�lH]|T|�³�p�XBD+��Xka � DGRHM�CJPegAB|THPj±FKDGegH;µ�>@�%FKSTUGX�JiLK?BRKH<F.JPRKH;?CXBSf��?BHih(«1 . � . � ¸ M º F ¸��%¸ M ºKº �#3 �;egDwZ #~STF�JQOm?BXB\MLWSTDGXDPOª¸�#{l $¡l���l M ºªFKDs|fDGXCUsJiFB$�STFVJsABRISfegH~Xw?CeN�EH<RcUPRKHzJ�LWH]RtL! BJPX # ¸mL" BSfFVSfFt��H]\]JP?BFKHgOmDGRVJABRISfegH $Gj $ � #oSTe=AB|TSfH<F3L" �JiL $ªSTFQRKH<|¡JiLKSTdPH]|TugABRISfegH�LKD$#�¸ #�ºKº�a,�tDP|fZC�QJPFKFIH]R9JiXBZA�FILWRID+d@FIpYuUGS�dGH�J�FKDG|T?CLWSTDGX^STXcL" BHQ\<DGe=egDGX@³´RWJPXCZBDGe~³�FILKRKSTXBU9e=DwZBH<|Ãa&��D+�lH<dGH<R]j�SfXVL! BHlFILWJPXBZ�JPRIZNegD@ZBH<|ÃjL! CHcDGXC|Tu5p�XBD+��Xo\]DPXBFILKRK?B\MLWSfDPX_DPO�?BXBSf��?BHcFKSTUGX�JiLK?BRKH<F��QJPF�L! BHcDGXBHVZB?BHtLWD)�`Sf\zJi|fSÃjBµ�JP�CSfXkjª�JPZ% BJPX[¤¥�_µ�ªª§P§i©Ãa

�tDP|fZC�QJPFKFIH]RQJPXBZ�A�FvLWRKD+dwFKpYu& �JzdGH�JP|fFIDcF' BD+��X( BD+�{LWDc\]DGXBFvLWRI?B\<LQ?BXBSf��?BH�FKSTUGX�JiLK?BRKH<FlSTXL! CH�\<DGe=egDGXnRWJiXBZBDGe�FvLWRISfXBUVe=DwZBH<|�?BFKSTXBUcXCDGX@³�STXYLWH]RKJP\<LKSTdPH�¯<H]RIDi³�p�XBD+��|fH<ZBUGH�ABRKDwDPOmF<a�b) BH<u*,+.-0/2143'57686:9<;=57>@?BADC�E�FG?HE�AJILK�98M:>D57;�N0OP/:QSRT>VUH5:3G;"W�9<>YX�57OP9Z57>L;[K�98M:>J5�;�NDO�/"KS57OP/\>0]:;^/,_05`3G;�681aN0>09Zb`ND/cK�98M:>J5�;�NDO�/"K5:K�de/2fD>0/"dg-D/2OP/:QihjNe;�;P-0/k3,]`>D3,/'le;PK�57OP/mK�Nenk329</'>`;P6<1oO�/'6857;�/'do>0]7;�;P]qpj]:OPOP1r5:sJ]`Ne;�;�-0/kK�N0se;P6</2;�98/'K�]:Uc;�-D/de/2fD>09<;�98]:>DK'Q

�Y°

Page 88: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

JP|TFKDnUYJzdGHªL! CHV\<DGXYdGH<RKFKHc\]DGXCFILWRI?B\<LKSfDGXqa�tDP|fZC�QJPFKFIH]R.JPXCZBA�FvLWRKD+dwFKpYu �¥F�\]DPXBFILKRK?B\MLWSfDPXVDiOCJ�XCDGX@³�STXYLWH]RKJP\<LKSTdPH;¯]H]RIDi³�p�XBD+��|TH]ZBUGH;ACRKDwDPO

¸ ����� ?Vº�OmDPRcJiX�u�|fJPXBUG?�JiUGH~SfX �� OmDGRtA�DG|TuwXBDGegS¡Ji|�³´LKSfegHcACRKD+dGH<RKF � j�SfFªL! CH�JP|�LWH<RKX�JiLKSTdPHnLKDL! CH�\<DGXBFvLWRK?C\<LWSTDGX#ZB?BH7LWD � H]STUGHPj �.JPABSfZCDPL`JPXBZ >^ �Jie=STR�¤ � �&>@§G§i©¬a � H<SfUGHij �.JPACSfZBDPL`JiXBZ>^ �Jie=STR;UGSTdPH�JV\]DGXBFvLWRI?B\<LKSfDGX=��JPFKH<Z0DGXgLWRWJiAEZBDwDGR3A�H]RKe^?CLyJiLKSfDGXCF]a � X=\]DGXYLWRKJPFIL]j;�ªDG|fZ@��JPFIFKH<RJPXBZ A�FvLWRKD+dwFKpYu%F' BD+��L" �JiL^L" BH0LWRKJPA�ZBD@DPR^ABRIDGAEH<RIL�u�SfF^XCDPL~XBH<\]H]FIFWJPRISf|�u[\]RI?B\]SfJP|Ãj��EH<\zJP?BFIH?BXBST��?BH5FKSfUPX�JiLW?CRKH]F=JPRIH`FI?C²g\]STH]XYL0JiFn�lH]|T|Ãa � XYLKSf|QL" BHsRIH]FI?B|TLKFgSTX}L" BSfFNL" BH]FISfF<jlL! CH]RKH5�QJPFXBD)JiABAB|fST\zJiLKSfDGX)LKD=L! CH �ªDG|fZC�QJPFIFKH]R�JPXBZ A�FvLWRKD+dwFKpYu_\]DGXBFvLWRI?B\<LKSfDGXkjEFKSTXB\]HVL! BHcDGXB|Tu`p�XBD+��X\]DPXBFILKRK?B\MLWSfDPXBFtDPOQ?CXBSf��?BHnFKSTUGX�JiLK?BRKH<F]j.H<dPH]X[STXoL! BHn\<DGe=egDGX@³´RWJPXCZBDGe~³�FILKRKSTXBU�egD@ZCH]|Ãjk�lH]RIHH]S�L! BH<RQ��JiFKH]Z)DPX)µ�>w�$¸m�k CSf\� )SfFl\]DGX #IH]\<LK?BRKH<Z0LWDN��H�JVO�JPe=ST|Tu~DiO�LWRWJiAEZBDwDGR�AEH<RKeN?@LyJiLKSfDGXBFWºMjDGR3DGX=XBDGX@³´SfXYLWH<RWJP\MLWSTdPH�¯]H]RID^p�XBD+��|fH<ZBUGHia A�?BR3RIH]FK?C|TL�L! BH<RKH<OmDPRKH�SfegAB|fSTH]F�L" �JiL�LWRWJiAEZBDwDGR;A�H]R ³eN?CLWJiLWSTDGXBFªegSfU YLªXCDPLV�EHnXBH<\]H]FIFWJPRvu�OmDGR ����� ? ��S�L! �H<²g\<SfH]XYLcABRKD+dPH]RKF<a)>@A�H]\<STx�\]JP|f|�uGj�DG?CRRKH<FK?B|�Lzj@\]DGeN�CSfXBH<Z=��STL" �L! CH�RKH<FK?B|�L�DPO4�tDG|TZC�QJPFKFIH]R9JPXCZ A�FILWRID+d@FIpYuGjBF' BD+��F�L! �JiLQDG?BRQ�_JPXYuY³Ä � ��FKFI?Be=A@LWSfDPXoFILWJiLWH<Z�STX�>@H<\<LWSTDGX �Ca %=STe=AB|TSfH<F�FI?B\� ����� ?�ABRKDwDPOmF<a���L�L! CHNFWJPegHcLKSfegHPjL! CSfF�JPFIFK?BegACLWSTDGX5SfF9XBDiL�p�XBD+��X`LWDnSfegAB|TugH��CSTFILKH]XB\<H^DPO�LWRKJPAEZCD@DGRQAEH<RKeN?CLWJiLWSTDGXBF<a�,� �b�9�~«�� �N�5��«����� "ª � �����;n��! "��&<% ��XBDPL! CH]R�RIHzJPFIDGX0�k Yu0?BXBST��?BH�FKSTUGX�JiLK?BRKH<F9JPRIH�diJP|f?BJP�B|fHSfFnL! BJiL�L" BH<u JPRKHs\]|TDGFKH<|Tu�RKH<|¡JiLKH]Z LKD�dPH]RKS�x¦JP�B|TH_RKJPXBZBDGe Om?BXC\<LWSTDGXBF<a ª3H<RKSTx�JP�B|fH`RWJiXBZBDGeOm?BXB\MLWSTDGXBFs¸�ª�µ � FWºc�QH<RKH`SfXYLWRID@ZC?B\]H<Z��Yu}�sST\zJP|TSÃj3µ�JP�BSTXkj�JPXBZoª�JPZ% �JPX�¤¥�_µ�ªª§G§i©¬a�b) BH<uJPRIH�FISfegSf|¡JiR�LWDNACFKH]?CZBDGRWJiXBZBDGe$Om?BXB\MLWSTDGXBFª¤ � �c��� ��©¬j@H��C\<H]ACLQL! �JiL�L! CH<u=JPRKH�JP|fFIDVdPH]RISTx¦JP�C|fHPab) �JiL�STF3LKDtFWJzuGj@JPFKFID@\<S¡JiLKH]Zn��STL" �JªFKH<\]RIH<L�FIH]H<Z : �[jYL! BH<RKH�SfF�JtAB?B�B|TSf\9piH<u � �!JPXCZ�JªOm?BXB\�³LWSTDGX����ª¸6¬ º�h = ��l � B @��= = ��l � B c FI?B\� 7L! �JiLn¸ �±º�� F � ���¸NmEº�STF�H<²g\<SfH]XYLK|Tus\]DGegAB?CLWJP�B|fHUGS�dGH]X)L" BHª\]DGRIRKH<FKA�DGXBZBSTXBU5: � �.¸ %Gº�JNACRKDwDPO 7����¸9mEºlL! �JiL9L" BSfF�diJP|T?BH �=\]DGRIRKH]FIAEDPXBZBF9LWD~L! CHAB?B�C|fSf\tpiH<u � � SfF�JP|TFKDgH<²g\]STH]XYLW|�u5\]DGegAB?CLWJP�B|THVUPSTdGH<X : � �&¸ �Yº���JPFKH<ZoAB?BRIH]|�u5DGX � �"JiXBZDGRKJP\]|TH=\]JP|f|TFVLKD�� ��¸/¬ ºcJPXCZ�L! BH=\]DGRIRKH<FKA�DGXBZBSTXBUoABRID@DPO�DGRWJP\<|fHij�XBD7JiZCdGH<RKFWJiRIu�\zJPX[ZCSfFILKSfX@³UG?BSTF" ~L! CH�diJP|T?BH�� ���¸NmEº�OmRIDGe$JªRWJPXCZBDGe·diJP|T?BH���STL" BDG?CL3H��CAC|fSf\<STLK|Tuc�w?CH]RIuwSTXBUVOmDPR�L! BH�diJP|f?BHm.a

ªªµ � F_¤ �_µ�ª�§G§i©�JPRKH5?BFIH<Om?B|�OmDGRnABRIDPLWDw\]DG|9ZCH]FKSTUGXka{b) CH<u}\zJPX��EH5dwSfHM�QH<Z¢JPF=J�\<DGen³egSTLWegH]XYLtLWDoJPX�H��CA�DGXBH<XYLWS¡Ji|lX�?BeN��H]R^DPO9RWJiXBZBDGe~³�|TD@DGp�STXBU)�BSTLKF]j��k BSf\� %\]JPX[��H�DPO9?CFKH0STXABRIDPLWDw\]DG|TF]a � DGR�HM�CJPegAB|fHij¦?BFKSTXBU�dGH<RKS�x¦JP�B|THcRKJPXBZBDGe Om?CXB\<LKSfDGXBF<jEDPXBH^\]JPXoRKH<ZB?B\<H^L! BHcX�?Ben³��H]R^DiO�RKDG?BXCZBFcOmDGRcRKH<FKH<LILyJP�C|fH�¯<H]RID7pwXCD±��|TH]ZBUPH0ABRKDwDPOmFtLWD �sSfX�L" BH��BJPRKH0egDwZBH]|�¤¥�_µ�� �]©Ãa��XCDPL! BH<R�H��BJie=AB|THNJPACAB|fST\zJiLKSfDGXkj�ZC?BH^LWD0�sSf\]JP|fS�JPXCZ7µ�S�dGH<FILn¤¥�_µ��=%�©¬jqSTF�J=XCDGX@³�STXYLWH]RKJP\<LKSTdPH|fDiLKLWH<RIunFvu@FvLWH<e�?BFIH]Z5SfX=e=ST\]RKDPA�Jzu@egH]XYLKF]a>��H]RKHijCL! CH�|fDiLKLWH<RIugDGRIUYJPXBST¯]H]R BDG|TZBF�JVAB?B�B|TSf\�pPHMu� � DiO�J�ªªµ � ak��A�JiRILWST\]STA�JPXYLª\]RIHzJiLKH]F BSTFª|fDPLILWH]Rvu_LKSf\ypPHML��q BSTe=FIH]|�OQJiXBZ�FKH]XCZBFcS�LªLWD)L! CHDGRIUYJPXBST¯]H]R<a~b) BHnDGRKUGJPXBSf¯<H]Rª\<DGe=AC?CLWH<FtL" BH~diJP|f?BH4� F � ���¸��Iº�DGX7L! BHn|TDPLKLKH]RIusLWST\ypPH<L]j�JiXBZL! CHc\<DGRKRIH]FKA�DGXBZCSfXBUgABRKDwDPOK7 F 7���ª¸��Iº�alb) BHVdiJP|f?BHE�)ZCH<LWH<RKegSfXBH<F9�k BH<L" BH]R�L! BHt?BFIH]R���STXBF]j�k BST|fHcL" BH~ABRID@DPO 7�UP?�JPRWJiX�LKH]H<FtL" �JiL�L" BHNDGRIUYJPXBST¯]H<R�\zJPXCXBDPLª\� BH]JiLza^>@STXB\]HnJfª�µ � STFr �JPRIZLWDnABRIH]ZBST\<L]jBL! BHt?BFIH]Rk �JPF�XBDgSfZBH]J BD+��LWDn�BSfJPF�L! CHV|TDPLKLKH]Rvu0SfX BSTF�O�JzdGDGR<a

b) BH]FIH0DG� #IH<\<LKFNJPRIH=XBDiLV�lH]|T|�³´FILW?CZBSfH<Z��STX�O�JP\MLzj�DGXB|�u�DGXBHg\]DGXBFvLWRI?B\<LKSfDGXkj���JPFIH]Z[DPX�L! CHµ�>@�#JPFKFI?Be=A@LWSfDPXkjP�QJPFlACRKH<dwSTDG?BFK|�uNp�XBD+��X7¤¥�_µ�ªª§P§i©Ãa;�sSf\]JP|fS¬jGµ�JP�BSfXgJPXCZ�ª�JiZ% �JPXgF" BD+�lH]ZL! BJiLzj�OmDGRVL" BH0AB?CRKA�DGFKH<FNDPO9\<DGXBFILKRK?B\MLWSTXBU7J�ª�µ � j�S�L^STFcFI?C²g\]STH]XYLNLWDs\]DGXCFILWRI?B\<L~Js?BXBST��?BHFKSTUGX�JiLK?BRKHnFI\� BH]egHPa5�`DGRKHgABRKH<\]STFKH]|�uGj.OmRKDGe�J`?BXCSf��?BHgFKSfUPX�JiLW?CRKHnFK\� BH<e=Hn��STL" �FIe�Ji|f|�egH]F ³�2RT>VUH5`3G;'W!;P-0/298O%3,]:>JK ;PO�ND3,;�98]:>V9ZK^NDK�98>0Mi?BADC�E�FG?HE�AJIeK�98M:>D57;�N0OP/'K���-0]�pj/2X`/2O"W2NDK�9<>DM 6Z5�;�/'O[;P/'3 -0>D98bLN0/"K[]:U�� 983'57689 W

� 5:s09<>[WD57>Dd��\5:d0-D57>SW0;�-0/'9<O 32]:>DK�;�OPND3G;P9<]`>q3'57>qNDK�/4N0>09Zb`ND/�K�98M:>D57;�N0OP/'K'Q�!�

Page 89: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

FWJiUGH_FIA�JP\]Hij9L! BHMu�\<DGXBFvLWRK?C\<LWH<Z¶J ªªµ � ��S�L! JPX{JPRI�BSTLKRWJPRvu�SfXBAC?CL�FISf¯<HsL! BJiL=LKDG|fH<RWJiLKH]F=JA�DG|TuwXBDGegS¡Ji|�³´LKSfegH�JPZ@dGH]RIFWJPRvuGa�b) CH<u_L" BH]X7UGJ+dPH~JPX7µ�>@��³���JPFIH]Zo?CXBSf��?BHNFISfUGXBJiLW?BRIH^FI\� BH]egHOmDGR�J~FKe=JP|T|ke=H<FKFKJPUGHtFKA�Ji\]HPa

�QDGXBFvLWRK?C\<LWSTXBU�ª�µ � F�OmRIDGe$ABFKH<?BZBDGRKJPXBZBDPe�Om?CXB\<LKSfDGXBF�¸�®�µ � FWº3STFQJtUGDwD@ZgABRKDP�B|fH<e·L! �J�L�lH�ZBDVXBDPL�p�XBD+� BD+�{LKDcFIDG|TdPH�STXgL" BH�FILWJPXBZ�JPRIZ�egD@ZCH]|Ãa�b) BSTFlSTF;�EH<\zJP?BFIH��YunSTLKF3ZBH<x�XCSTLWSTDGXkjL! CH9DG?CLWAC?CL3DPOqJª®�µ � F" BDP?B|fZn��H9SfXBZBSTFILKSfXBUG?CSfF" BJP�B|fH3OmRKDPe·RWJiXBZBDGe`a ��D+�QHMdGH]R<jCS�O��lH9HM�wLKH]XBZL! CHQegD@ZBH<|GLWD�JP|f|TD±��SfXYLWH<RWJP\MLWSTDGXkj�STL�SfF.A�DGFKFISf�B|TH�LKD�\]DPe=egSTL�LKD�L! CHlFIH]\]RIH<L;FIH]H<ZNDPO¦J�®�µ � JiXBZ|fHML�L! BJiL9FKH<RIdPHcJiF�JNAB?B�B|TSf\�piH<uGj¦JiXBZ)L! BH<X`ACRKD+dGHªL! BJiL�JNUGS�dGH]X5DG?@LWAB?CL�\<DGRKRIH]FIAEDGXCZBF�LWD~L! CH\]DPe=egSTLILWH]ZtFIH]H]Z~?CFKSfXCU�J�¯]H]RIDi³�p�XBD+��|TH]ZBUGHlABRKDwDPO a�b) BSfF�FKDP|f?CLKSfDGXtSfF�?BX�J�LKLWRKJP\<LKSTdPHl��H]\]JP?BFKHlDPOL! CH�H��CA�H]XCFKH�DiOk\]DPe=eN?CXBSf\]JiLWSTDGX~RKDG?CXBZBF]a � XnL! CH�FIDi³�\]JP|f|TH]Zo ��À~À ��¾­2I¿P¾�¼ ��À - ��2�Á�¾3O�egDwZBH]|�k BH<RKHgXBDGX@³´SfXYLWH<RWJP\MLWSTdPHn¯]H]RIDi³�p�XBD+��|TH]ZBUGHnABRID@DiOmFcJiRKHnAEDPFKFKST�B|fHij�J5\<DGXBFvLWRK?C\<LWSTDGX�SfFtAEDPFKFKST�B|fH?BFISfXBU=\]DGege=S�LWegH]XYLWF�JiXBZ_XBDPX@³�STX�LKH]RKJP\<LKSTdGHt¯<H]RKD=p�XBD+��|fH]ZCUGH)¤ £ � ���C�Cj�£�Ät�_®3§��Gj � ��>C§P§i©Ãa��D+�lH<dPH]R]jGL" BSfF.STF�?CX�JiLKLKRWJP\MLWS�dGHlJPF��lH]|T|��EH<\zJP?BFIHlL" BSfF.egD@ZBH<|YSfF.?BX�?BFI?�JP|@JPXBZ^XCDGX@³�STXYLWH]RKJP\<LKSTdPH� ? STF)HM�@A�H]XBFISTdGHia b) �?BF<jª\]DGXCFILWRI?B\<LKSfDGX#DPOVdGH<RKSTx�JP�B|fH7RKJPXBZBDPe Om?BXB\MLWSfDPXBF0OmRKDGe UGH]XBH<RWJP|JPFIFK?BegACLWSTDGXBF9RIH]e=JPSfXBF�JiXsSTX�LKH]RIH]FILKSfXBUnDGA�H]X5ABRIDG�B|TH]e`a�����&�L��� & ���«*��«en��N "�t% µ�H<\]H<X�LK|TuPj��PDG?w�sJPXBZ � UG?CuPH]X�¤ � � ���M©�ZBH]egDGXBFvLWRWJ�LWH]Z`L! �J�L�DGXCH\zJiX%H]XB\<DG?BXYLWH<R~UGRKDG?CABFNSfX��k BSf\� %ZBH<\]STFKSfDPX�JP|lÄ�ST²gHM³ ��H]|T|fe=JPX�SfFcHzJPFvuGj�JPXBZ�uPH<Ln\<DGe=AC?CLyJ�³LWSTDGX�JP|�Ä�S�²=H�³ ��H]|f|Te�JiX=FIH]H]egFm �JiRKZka;b) BSTF�SfFQJPX0H<|fH]UGJPXYL9RKH<FK?B|�LQL! BJiLzjCJPe=DPXBU^DPL" BH]RlL! BSTXBUGF]jF" CH]ZBFª|TSfU YL�DGX BD+�RKH]JPFKDGXBJP�B|fHcSTL�SfF�LKD)JPFIFK?BegH^ZBH<\]STFKSfDPX�JP|&Ä�ST²gHM³ ��H]|T|fe=JPXkac¸�b) CHNFILWJiLWH�³egH]XYL�DPO&L" BH]FIH^JiFKFK?Ce=ACLKSfDGXCF9SfF9UGS�dGH]X`SfXs>@H<\<LKSfDGX �Ca �Ga»º

�PDG?@�[¤ �PDG?;�!�i©�ABRIDGA�DGFKH<Zo?BFKSTXBU=L" BHcÄ ��³ ÄªÄ � FIH]A�JPRKJiLWSTDGXsLKD�JgUGDwD@ZsH]XBZkj��Yu`HM�^ BSf�CSTLI³SfXCUsJ)DGXCHM³�RIDG?BXBZ�pPHMu�HM�@\� �JPXCUGH=ACRKDPLKD@\<DG|�OmDGR�L! CRKH]HnA�JiRILWSTH]F<a�>w?B�BFKH<��?BH]XYLW|�uGj&SfXBFISfU YLtSfXYLKDFK?C\� �UGRIDG?BABF �JPF5ABRID+dGH]Z�RKH]|TH<diJPXYL)OmDGR0L" BH�RIH]\<H]XYL_\<DGXBFvLWRK?C\<LWSTDGX#DPO^STZBH]XYLKSTL�uY³���JiFKH]Z#H]Xw³\]RvuwACLWSTDGX¢ZB?BHoLKD�£QDGXBH` JiXBZ � RKJPXBp�|fSTX ¤ £ � ���<©��k BST\� #RIH]FIDG|TdPH]Z J[|fDGXBU�FILyJiXBZBSfXCU%DGAEH<XABRIDG�B|fH<e"¤¥>^ �JC�=<�©¬a A�L! CH]RªSfXYLKH]RKH<FILKSfXBU)\<DGXBFKH<��?BH]XB\<H]FcDPO3L! BH~FvLW?BZCuoDPO3L! BH<FKHnUGRKDP?BABFtJPRIH~J\]DPXBFILKRK?B\MLWSfDPX`DiO�J~F" CDGRIL�FISfUGX�J�LW?BRIHªFK\� BH<e=HtSfX0L" BHtRWJPXCZBDGe~³�DGRKJP\]|TH�egD@ZBH<|;¤ £ ��> ���]©�JPXBZ5DPOJ~FKSTe=AB|TH�\]RIH]ZBH<XYLWS¡Ji|�FIuwFILKH]e ¤ ª3H<R ���<©Ãa� � �5��� &'����n &<% r�HVUGSTdPH^JgFKSTe=AB|THª\]DGXCFILWRI?B\<LKSfDGXsDPO;Jg?BXBST�w?CHcFISfUGX�J�LW?BRIHcFI\� BH]egH^��JiFKH]Z_DGXUGRIDG?BABF9�k BH<RKHcÄ � STF9\]DGX #IH]\<LK?BRKH<Z �JiRKZsJPXBZsÄªÄ ��SfF�HzJPFvuGa A�?BRKF�SfF�J~LWRIH]H�³�|fSTpPHª\<DGXBFILKRK?B\�³LWSTDGXkaVb) BHne=H<FKFKJPUGH~FKABJP\]Hn\]DPXBFKSTFILWFtDPO�\<D@ZBHM�QDPRKZBFVDPOlJPX�H]RIRKDGR ³�\]DPRKRKH<\<LKSfXBU)\<D@ZBHNL" �JiLt\]JPX\]DPRKRKH<\<L�J~\]DGXCFILyJiX�L�OmRKJP\<LKSfDGX)DPO&H]RIRKDGRIF]a � DGR #¦³��BS�L9\]DwZBH<�lDGRIZBF]j�L! CHVZCH]ACL" sDPO.L" BHªLWRKH<HtSfF�#�ab) BHtRKDwDPL�DPO�L! CHtLKRKH<HVSTF9|¡JP��H]|T|fH<Z���STL" J�j�J~UGH<XBH]RKJiLWDPR9DPO�J~UGRIDG?BA5�k BH]RIHVÄ ��SfF) �JPRIZ_JiXBZÄªÄ ��STF�HzJPFvuGa3b) BH % 1 |THzJzdGH<F�DPO.L! BH�LKRKH]Hª\<DGRKRIH]FIAEDGXCZ_JP|T|EL" BHªAEDPFKFKST�B|fH+#�³��CSTL9FvLWRKSTXBUGF<a;b) BH% Q XCD@ZBH<F9DPO�ZBH]A@L! RKj� B R�F #o\<DGRKRIH]FKA�DGXBZ5LWDnJi|f|¦L! BHªA�DGFKFISf�B|TH R�³´�BSTLQABRKHMxC�@H]F�DPO&JPX�#�³´�BSTLFILKRKSTXBUBa

� A�JPSTRQDPO�UGRIDG?BA)H]|TH]egH]XYLWFª¸ @ Q . �8F J 1 P�� �Jl @ Q . � F J 1 P�� ºlSTF9JPFIFKDw\]S¡J�LWH]Z0��S�L! )H]JP\� 5ZBH]ACL" RDPO;L" BH^LWRIH]H~JiF�A�JPRvL�DPO;L" BHNAB?B�C|fSf\cpPHMuGaªb) BH~|fJP�EH<|&DiO�J�XBDwZBHNDPO3ZBH<ACL! RQSfF�ZCH]RKS�dGH<ZoOmRKDGeL! CH�|¡JP��H]|¦DPO.S�LWFlA�JPRKH<XYL9�Yu�RKJPSfFISfXBUVL! BH�ABJPRKH<X�L"� FQ|¡JP��H]|¦LWD^L" BH�H��@AEDGXCH]XYLA)�Q . � STOkL" BSfFlXBDwZBH�STFSTLKF9A�JPRIH]XYL �¥F�|TH<O�L�\� BST|fZkj@DGRA)�Q . �lSTO&STL9STF�L! BHtA�JPRIH]XYL �¥F�RKSfU �L�\� CSf|fZqa

�QDGegAB?CLWSTXBU0L! CHNFKSTUGX�JiLK?BRKHNDPX�H]JP\� �\]DwZBH<�lDGRIZ M JPegDG?BXYLWF�LWD)\]DPe=AB?@LWSfXCU�L! BH~|fJP��H]|fFDPOªL" BH7XBDwZBH]F0DPX{L! BHoABJiL! {OmRIDGe L" BHoRID@DPL�DPOtL! BHsLWRKH<H7JP|T|�L" BH_�QJ+u ZBD+��X¢LWD[L! CHo|fH]JiO\]DPRKRKH<FKA�DGXBZBSTXBU~LWD M a;b) BHVFKSfUPX�JiLW?CRKHªSfF�L" BSfF�FIH]��?BH]XC\]H^DiO�|fJP�EH<|fF<a��L�x�RIFIL�UG|¡JPXC\]HPj�L" BSfF�e�Jzu5FIH]H]e dGH<RIu`FKSTe=ST|¡JPRlLWD=L" BH � JPDGR ³ µ�H]SfXCUGDG|fZ�¤ � µ�§Y°�©�ABFIH]?BZCDi³RWJiXBZBDGe·Om?CXB\<LKSfDGXka � XBZBH<H]Zkj�L! BH<SfR;\<DGXBFILKRK?B\MLWSTDGX~��JPFlJPXnSfXCFKABSTRWJiLKSfDGX^LKDte=STXBHPa ��D+�QHMdGH<RlL! CH

�G§

Page 90: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

ABRID@DPOQSfFtXBDPLVSTe=egH]ZBSfJiLWHia=b) CH=e=J #IDGRtZBS��qH<RKH]XC\]HnOmRKDGe�L" BH=\<STLKH]Z�RKH]FI?B|TLcSfFªL" �JiLo BH]RIH=�lHeN?BFvL^UPSTdGHgJ`ABRKDwDPOQL" �JiLtL! CHgOm?BXC\<LWSTDGX��QJPFVH<diJP|T?�JiLWH<Z�\<DGRKRIH]\<LK|TuPa0b) �JiLce�JipPH]FVSTLo �JiRKZBH<RLWDsABRKD+dPH�FKH<\]?BRISTL�uPa � DGRtHM�CJPegAB|THPj�ACRKDwDPO��Yu�J Yuw�BRKSTZ%JPRIUG?BegH]XYLzj�JPFcZCDGXBH��Yu � JiDGR^JiXBZµ�H]SfXCUGDG|fZ`¤ � µ�§Y°�©¦STF;RK?B|TH]ZgDG?CL3STe=egH]ZBSfJiLWH<|Tu�hkL! CH]RKH�SfF;XCDV�QJzu~�QH�\zJPX=JPXBFv�QH<RlFIDGegH�DiOqL! CHJPZCdPH]RIFWJPRvu �¥F���?BH]RISfH]F���S�L! �LKRK?B|�u�RKJPXBZBDPe �BS�LWF<jCFKSTXB\]H�OmDGRQFI?B\� 5�BSTLKFQL! BH<RKH���ST|f|��EH�XBD~ABRKDwDPO a

A�?BRnABRKDwDPO�DPO�FIH]\<?BRKS�L�u[OmDGRNL! CH`?CXBSf��?BH5FKSTUGX�JiLK?BRKH5RIH]|fSTH]FNDPX J7UGH<XBH]RKJP|fST¯zJiLKSfDGX[DiO�L! CHÄ�ST²gH�³ ��H<|f|Te�JPX[JPFKFI?Be=A@LWSfDPXka�r�Hs\]JP|f|9S�LnL! BH �W�_JPXYuY³ Ä ����JiFKFK?Ce=ACLKSfDGXqa ��D+�lH<dPH]R]j�OmDPRZBSTRKH]\MLW|�uª\]DGXYdPH]RILKSfXBU�L! BSTF&FISfegAB|fH � >tLWDyªªµ � j+�QHlXBH]H<Z^LWD�e=JPpPHlJ�dPH]RIuVFvLWRKDPXBU�JPFIFK?BegACLKSfDGX� BD+�lH<dGH<R�L" BHcRIH]FI?B|TLKSfXBU�ªªµ � SfF9dGH<RIu5FISfegAB|fHia�r�HVJP|TFKDnFK?BUPUGH]FvL�Jne=DPRKHªSfXYdPDG|TdPH]Z_�C?CL�JP|fFIDegDGRKH=FKH]\<?BRKH)\<DGXBFvLWRK?C\<LWSTDGX%DPO�J ª�µ � �BJPFKH<Z%DGX[L! BH)�_JPXYuY³ Ä � JPFIFK?BegACLKSfDGXka_b) BSfFN|fJPFIL\]DPXBFILKRK?B\MLWSfDPXsSTF9\]|fDPFKH]|�u0RIH]|¡J�LWH]Z)LKDnL" �JiL�ZB?BHªLKD��`Sf\zJi|fSkHML�JP|Ãa.¤¥�_µ�ªª§P§i©Ãa� �Nn �!���_�� ��'n � � ���&9n, ���n � � &6� � «*�\n�� � % � X�>@H]\MLWSfDPX �Ca ���QH�UGSTdPH9ZBH<xBXBSTLKSfDGXBF3DPO�dGH<RKS�x¦JP�B|THRWJiXBZBDGe Om?BXB\MLWSfDPXBF)JPXBZ¢?CXBSf��?BH7FISfUGX�J�LW?BRIH]F]a � X >@H<\<LWSTDGX �Ca %��lH7FILyJ�LWH7DG?BR�\]DGegAB|fH��@STL�uJPFIFK?BegACLWSTDGXBF.OmDGR.?BXBST�w?CHlFISfUGX�J�LW?BRIH]F]a � X~>@H<\<LKSfDGX �Ca �9�lHQUGS�dGH3DG?BR�?BXBST�w?CHlFISfUGX�J�LW?BRIHlFI\� BH]egHJPXBZ5ABRID+dGHtSTLQFKH]\<?BRKHtSTX`>@H]\MLWSfDPX �@a ¨Ba�r�H�L! CH]X5ABRKD+dwSfZCHtJNFKSfegAB|TH�\]DPXBFILKRK?B\MLWSfDPX5OmDPR9Jgªªµ �?BXBZCH]RVJ)FKDGegH<�k �J�LtFILWRIDGXBUGH<RtJPFKFI?BegACLWSTDGXkj�SfX�>wH]\<LKSfDGX �Ca <@a^r�Hn\]DGXC\]|f?CZBH~SfX�>@H<\<LKSfDGX �Ca ���STL" ¢J[\]DPXBFILKRK?B\MLWSfDPX¢DPOVJ�ªªµ � ��JPFIH]Z¶DGX L" BHo�lHzJPpiH]R5JPFIFK?BegACLWSTDGX¢JP|TDGXBHij��C?CL0�k BDGFIH\]DPe=AB|THM�@STL�u[¸���DPL" 7SfXoLWH<RKegF�DPOl\]DGegAB?CLWJiLWSTDGX7JPXCZ7SfXoLWH<RKegFªDPO�\]DGXC\]H]A@LW?�JP|;FISfegAB|fST\]S�L�uBº�STFL! CHVFKJPegHtJPF9L! �JiL�DPO��sST\zJP|TSqH<L�JP|¬a�¤¥�_µ�ªª§G§�©Ãa

�5(+* ������-7:</;:<2=-��

� (+*,(+* � -E+���= .���+���- 1�O= 8;.,?

� XCSf��?BHªFKSTUGX�JiLK?BRKH<F9JPRIHªFKH]\<?BRKHtFISfUGX�J�LW?BRIH]FQ�k BH<RKHªL! CHªFKSfUPX�JiLW?CRKH�STF9J^Om?BXB\MLWSfDPX5JPF�DGABA�DGFIH]ZLWDgJnZBSfFvLWRISf�B?CLKSfDGXqa���������on��! "��&%!)�%!)*%,+ 7�0@¾q ��Á ��¾­7<¿PÀ~Á95 ½f« � � "I¸/¬ º h = ��l � B @ �= = ��l � B�� � @ " Á - ¿ 0@¾�Á���0 /- ÁjO<h¾�¿C�!0�2 /¨- ÂCM / À / � H : � Á 7 �NM / 2 /L/ aGÁ - � - ;"2 �<Uy¿�U]Á95 Á - �¬ÁÃÂ�¿<5VO �62�Á �9MwÀ�W4^ /NT ÂMÁ / ¾;��¼ / � / 2�À~Á�¾�Á - ��Áÿ<5VO �62�Á �NMwÀ��6����"^^¿P¾�¼�¼ / � / 2�À~Á�¾�Á - ��ÁÃÂ5¿<5VO �62�Á �9MwÀ��;9 5�6���� - 0�ÂCM �9MC¿C�SW�¸�� @ º¨O / ¾ / 2I¿C� /C- �9M /7 / ½ ;C¿PÁ92 � � l': �G^��6�����¸ : � lnmEºªÂ ��À�;"0 � /C- �9M / ]�¿<5`0 / « F « ��¸NmEº�¿P¾�¼��;9 5�6�� �k¸ � � l�m_lP«�º] / 2�Á �8/C- �9MC¿C�c« F « ���¸NmEº Z

Z ��!�¿<5 Á�¼PÁ ��½ � � 7y« F �(6��"��¸ : � l�mEº§^�¿P¾�¼ �NM / 2 /¨/ aGÁ - � - ¿�2K¿P¾�¼ ��À - �!2�Á�¾3Os¿P¾�¼5¿�]�¿<5`0 / z- 0�ÂCM �9MC¿C��¸ � � l': ��ºNÁ - �<U"�ÿPÁ�¾ / ¼�U]½L2�0@¾�¾�Á�¾3O¨W�¸�� @ º ��¾ �NMwÁ - 2K¿P¾�¼ ��À - ��2�Á�¾3O6^ �9M / ¾�;9 5�6����q¸ � � l�m_lP«.º F � Z

� Z � H ¾�Á���0 / ¾ /C-C- �:7�« ���¸ M º � R&M / 2 / ¼ �[¾���� / aGÁ - ��]�¿<5`0 /C- ¸ � �gl M lP«y��lP«��Mº - 0¦ÂCM �NMC¿C�«y��<F «��g¿P¾�¼#�;9 5�6����k¸ � � l M lP«y�Iº F �;9 5�6�� �q¸ � � l M l «��Mº F � Z

$ Z � : / Â1032�Á �¬½ � x&�625¿<595e7<¿PÀ~Á95 Á /C- �:7�;"2 �<Uy¿�U]Á95 Á - �¬ÁÃÂ�;;�65 ½i¾���À~Á�¿<5`h ��Á�À / �62K¿wÂ15 / R 032MÁ�¾3O�Àg¿<hÂCMwÁ�¾ /C-P= @ �%� "@ B ^,�9M / 2 /4/ aGÁ - � - ¿�¾ / O<5 ÁjOPÁ!U�5 / 7�0@¾q ��Á ��¾u�k¸�zBº - 0�ÂCM�NMC¿C�

§!�

Page 91: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

®;Rz¤T¸ � � l : ��º�� W=¸ � @ º �¸��l�m_lP«�ºt� @������� �� . � "@ ¸ � @ º �$h �;9 5�6����k¸ � � l�m_lP«.º F � > ¸Nm_lP«.º,¤f��t© B �k¸�zBº

� � « ����!«� c�� �����{�~��n��N e��% �ªDG|TZC��JiFKFKH<R^JiXBZ A�FvLWRKD+dwFKpYu ¤ � Aª§=%+©lUPSTdGHgJ5RKH<|¡J��@H]Z�ZBHMO¡³SfXCSTLWSTDGXka � X#L! BH<SfR)ZBHMx�XBSTLKSfDGXqj�H<dPH]X�L" BDG?BU L! CH�FISfUGXBJiLW?BRIH�SfF5?BXBST�w?CHPj�L! CH�dPH]RKS�x�\zJ�LWSfDPXABRID@\<H]ZB?BRIH^e=Jzu5RKH]��?BSTRKHijqJPF�JPX_JPZBZBS�LWSfDPX�JP|�SfXCAB?CLzj�JgABRKDwDPO�L" �JiL�L! BHcFKSTUGX�JiLK?BRKHVSfF�\]DPRKRKH<\<L]ab) BSTF=ABRID@DiO�STF=DG?@LWAB?CLg�Yu�L! BH`FKSTUGXBSTXBU�JP|fUGDPRKSTL" Be LWDGUGHML! BH<Rg��S�L! �L! BH`FKSTUGX�JiLK?BRKHij�JPXCZ STLegSfU YL�XBDPLª��HN?BXBST��?BHPa ��H]RKHN�lH~UGS�dGHcL" BHNFvLWRKDPXBUGH]RªZCH<x�XBS�LWSTDGX_��H]\]JP?BFKHN�lH~\zJiX7FWJiLKSfFIO�usSTL¸ �ªDG|TZC��JiFKFKH<RtJPXBZ A�FILKRKD+dwFKpYu�ZBD5XBDPL]j�H<dGH<X�L" BDG?BU �L" BH<u_�QDGRIpoSfXoL" BH~\]DPe=egDGX7RWJiXBZBDGeFILKRKSTXBU~e=DwZBH<|�ºMa ��D+�lH<dGH<R]j¦XBDPLKH�L! BJiL�L! CHªRKH]|fJ��@H]Z)ZBHMx�XBS�LWSfDPX0SfF�FI?C²g\]STH]XYL9OmDGR�\<DGXBFILKRK?B\MLWSTXBUªªµ � Fc¤¥�_µ�ªª§G§i©¬a

�L�~���4�_� &J�")e�_«en � ���&s«*��� &9n�«enJ� �N�&(&<% >wSfXB\<H=J`?BXBST�w?CH=FISfUGX�J�LW?BRIHgSTFVJ5Om?BXC\<LWSTDGX�DPO�L! CHAB?B�C|fSf\�piH<u�JPXBZ=L" BH�egH]FIFWJPUPHPj@JcFKSTUGX�JiLK?BRKH�DGX�JcUGS�dGH]X=e=H<FKFKJPUGH���ST|f|���H�L" BH�FKJPegH��k BHML! BH<RL! CSfFN�QJPF~L! BH0x�RIFILgegH]FKFKJPUGH5FKSTUGXBH<Z}�Yu[L" BH)FKSTUGXBH<R]j�DGRNL! BH�#@�¥L" �egH]FIFWJPUPHPa[��F=J7RIH]FK?C|TLzjSTL=SfF=HzJPFvu�LKD[FKH<HoL! �J�L�L! CHoFKSTUGXBH]R=ZBDwH]F�XCDPL0XBH<H]Z¢LWD�RKH]egH]e^�EH<R0JPXYu�L! BSTXBU%JP��DG?CL�A�JPFvLLWRKJPXBFKJP\<LKSfDGXBF<j�SÃa¥HPa�j�J~?BXBST�w?CHVFISfUGXBJiLW?BRIHªeN?BFvL���HtFILWJiLWH<|fH]FIF]a

� (+*,(�� ; .&8V+�� 1�� 0 . -/1e- 3 7�9 � =E- ) �O+ 7 - ?b) BH�ZCH<x�XBS�LWSTDGX���H]|TD±�{SfFQZC?BH�LKDn�sSf\]JP|fS�HML9JP|¬aE¤ �_µ�ª�§G§i©¬a�r�H�?BFKH�FIDGegH<�k �JiLQZBST�EH]RIH]XYL9JiXBZegDGRKHª\<DGe=ABJP\<L�XBDiLyJiLKSfDGXkj^ BD+�QHMdGH<R]a

b) BH~SfXYLK?BSTLKSfDGXsDPO;L! BSTF�ZBHMx�XBSTLKSfDGX_SfF�L" �JiLtJgOm?BXB\<LKSfDGX7STF�J�dPH]RKS�x¦JP�B|TH^RKJPXBZBDGe Om?BXB\MLWSTDGXSTO�S�L�SfF9|fSTpPHtJ~ABFIH]?BZBDPRWJPXBZCDGe Om?BXB\MLWSfDPX5��S�L! `JnAB?B�B|TSf\�piH<u`JPXBZ`ABRID@DPOmF<a���������on��! "��&%!)�%('c%,+ 7�0w¾q �¬Á ��¾¨7<¿PÀ~Á95 ½ � � � " ¸6¬ º�h = ��l � B � � @ " �= = ��l � B � � @ " Á - ¿u] / 2�Á � ¿�U�5 /2I¿P¾�¼ ��À¯7�0@¾q ��Á ��¾H��!S�Sx � Á 7�9M / 2 /\/ aGÁ - � ;"2 �<Uy¿�U]Á95 Á - ��ÁÃÂ_¿<5VO �62�Á �NMwÀ�W>^=¿P¾�¼�¼ / � / 2�À~Á�¾�Á - ��Áÿ<5VO �62�Á �NMwÀ -�������� ^�� 5�� � 9�^&¿P¾�¼ �;9 5�6�� � - 0�ÂCM �9MC¿C� Q W=¸ � @ º�O / ¾ / 2I¿C� /C- �NM / 7 / ½A;C¿PÁ92 � � l': �¬v������� ¸ : � lnmEº� ��À�;"0 � /C- �NM / ]�¿<5`0 / � F � ���¸NmEº§v � 5�� � 9q¸ : � lnmEº� ��À�;"0 � /C- �NM / ;"2 � �:7?7 �NMC¿C�� F ���ª¸9mEºCv=¿P¾�¼ �;9 5�6�� �k¸ � � l�m_l �"l 7�º­] / 2�Á �8/C- �9MC¿C��� F � ���¸NmEºu0 - Á�¾3O �9M / ;"2 � �:7 7 Z[ �62 / 7 �62�Àg¿<595 ½ Q

Z � �9��À�;"0 �´¿�U]Á95 Á ��½ �:7�� ��ª¸NmEº � � ��¸NmEº F!������� ¸ : � l�mEº Z� Z � � 2 �6]�¿�U]Á95 Á �¬½ �:7������¸9mEº � � 7t¸ �"l 7�º F � 5�� � 9E¸ : � l�mEºC^,�9M / ¾

�;9 5�6����q¸ � �gl�m_l �"l 7�º F �

Z

$ Z � H ¾�Á���0 / ¾ /C-C- �:7 �����¸9mEº � R&M / 2 / ¼ ��¾���� / aGÁ - �e]�¿<5`0 /C- ¸ � � l : � l�m_l �3�Cl �<�Jl&7&��l 7*��º - 0�ÂCM�9MC¿C�T� � <F �<�n¿P¾�¼ �;9 5�6�� �q¸ � � l�m_lK�3��l 7&�Kº F �9 5�6����k¸ � �gl�m_lK�<��l&7*�Mº F � Z

§��

Page 92: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� Z � ��-�/ 0C¼ �62K¿P¾�¼ ��À~¾ /C-C- �:7 � ��¸NmEº � x&�62�¿<595J7<¿PÀ~Á95 Á /C- �:7�;"2 �<Uy¿�U]Á95 Á - �¬ÁÃÂ�;;�65 ½�¾���À~Á�¿<5`h ��Á�À /R�0�2�Á�¾3O=Àg¿wÂCMwÁ�¾ /C-�= @ � � "@ l D @6B ^,�9M / 2 /4/ aGÁ - � - ¿�¾ / O<5 ÁjOPÁ!U�5 / 7�0@¾q ��Á ��¾u�k¸�zBº - 0�ÂCM�NMC¿C�

®3Rz¤T¸ � � l': ��º�� W=¸ � @ º �¸ � , l�m_l�:�� � �;9wº�� @�������� �� . � "@ ¸ � @ º �

� �AF!������� ¸ : � l�mEº ��3��� = ��l � B � � @ " �

+Y� = ��l � B �¸�� 0 l + � º�� D ������� �� . � "@ ¸ :�� � �;9*l � / º h + F + � > ¸Nm_l�� 5�� � 9q¸ : � lnmEºKº,¤f � , ® � 0 ©

B ��¤!% ) �k¸�zBº��R&M / ;"032 ;;� -�/ �:7 �NM / :�� � �9�2I¿P¾�¼ ��À ]�¿<2�Á�¿�U�5 / Á -P- � �NMC¿C� @ @ ÂK¿P¾ - ¿<] /�- ��À / 0 -�/ 7�035Á�¾J7 �62�Àg¿C��Á ��¾ �NMC¿C� D @�K Á9595��NM / ¾7¾ /C/ ¼ Z �� ¾���9M / 2 K �62K¼ - ^&�9M / ��¾�5 ½ K ¿P½ �9MC¿C��¿P¾0¿Y¼<] / 2 - ¿<2�½N �6035�¼ � / 595 � ���¸NmEºc7�2 ��À�¿�2I¿P¾�¼ ��À]�¿<5`0 / ^�7 �62Ym �:7tÁ � - � K ¾�ÂCM;��Áà/ ^3Á - U]½ ��0 / 2�½iÁ�¾3OgÁ ��¼PÁ92 /  �!5 ½ Z

� L�STF�H]JPFIu5LKD�FKH<H)¤¥�_µ�ªª§G§�©�L" �JiL�UGSTdPH]X7J�ªªµ � � � �?"¢h = ��l � B � � @ " �= = ��l � B j�DPXBH^\]JPX\]DPXBFILKRK?B\MLVJfªªµ � � �� � " h = ��l � B � N � @ " �= = ��l � B � � @ " jE�k BH<RKH�� � ¸�zBº F �G¸�zBº G�� |fDGU M ¸�zCº��Yj�JiFOmDG|T|fD+��F]h �P��� ¸9m&�����J�����Am � N � @ "�º F � ���¸Nm&���P�J�J���8m � N � @ "��8k � º������ª¸9m&���P�J�J���Ym � N � @ "��8k&�Iº���J�J��� �����¸9m&�����J�����Sm � N � @ " �Ek � � @ " º��k BH<RKH4kQ;ZBH<XBDPLKH]F�L! CH � |fDPU M ¸�zBº��<³��BS�L�RKH<ABRKH<FKH<X�LWJiLWSTDGXDPO�L! BHtSTX�LKH]UGH<R RKj�JPXCZ ��� �nZBH<XBDPLKH]F�\]DGXB\]JiLWH<X�JiLKSfDGXka

b) �?BF�STX)L! BHtFKH<��?BH]|.�QHª��ST|f|qOmDw\]?BF9DPXs\<DGXBFILKRK?B\MLWSTXBU�ª�µ � F���STL! 5�BSTX�JPRvu)DG?CLKAB?CLWF<a�L�~���4�_�5&J�")"��«en �����& � &<% � %�� &<% �`Sf\zJi|fSBHML�JP|¬a�F' BD+�QH<Z( BD+�{LWDc\]DGXBFvLWRI?B\<LMªªµ � F3OmRKDGe?BXBST��?BH~FKSTUGX�JiLK?BRKH<F]aNb) BHn\<DGXYdGH]RIFKHij�X�JPegH]|�u_\<DGXBFvLWRK?C\<LWSTDGX�DPOQJ0?BXBSf��?BHnFISfUGX�J�LW?BRIH^OmRKDGe!Jªªµ � j\ BDG|TZBF�Sfege=H<ZBS¡JiLKH]|�u�S�O�L! CH^ABRID@DPOmF�SfX5L! CH�ªªµ � F�JPRKHc?BXBST�w?CHPa � O�L! CH^ABRID@DPOmF�JPRIHcXBDiL?BXBST��?BHPj�L! BH<X7XBD0\]DPXBFILKRK?B\MLWSfDPXoFWJiLKSfFvO�u@STXBU�DP?BR�FvLWRKDPXBU0ZBHMx�XBSTLKSfDGXsDPO3?BXBST��?BH^FISfUGX�J�LW?BRIH]F�STXp�XBD+��Xka ��D+�lH<dPH]R]j�\<DGXBFvLWRK?C\<LWSTXBU0RIH]|¡J±�CH<Z7?BXBST�w?CH^FKSTUGX�JiLK?BRKH<F�SfX`L! BH^FKH]XCFKH~DPO9�ªDG|fZ@��JPFIFKH<RJPXBZ�A�FILKRKD+dwFKpYu�¸�FIH]HtL! BHtH]XCZsDPO�>@H<\<LWSTDGX �Ca �Pa �±ºQSTF9Sfege=H<ZBS¡J�LWHPa

�5(�� �£����6�� o_/�:]2g-����H<L ����H�JiX=HM²=\<SfH<X�LQJP|TUGDGRKS�L! Be L! BJiLzj�DGX=SfXBAB?@L � @ j�UGH<XBH]RKJiLWH<F�JtUGRKDG?CA W F ¸�!3l ' lKJCº���STL" H<²g\<SfH]XYLK|Tu�\]DPe=AB?@LyJP�B|TH)UGRKDP?BA�DPAEH<RWJiLKSfDGX"!wjlDPO�ABRISfegH)DGRKZCH]R ' j3��STL" �UPH]XBH<RWJiLKDGR4JEa�r�HRKH<��?BSfRIHcL! BJiL�J5STF���RISTLILWH]XsZBD+��XoSfXs�BSfXBJPRIu5?BFISfXBU$#0¸m|fDGU ' º��CSTLWF<jqJiXBZ_L! BJiL�HMdGH<RIusH]|fH<e=H<XYLDPO�L! BHtUGRIDG?BA �JPF�Jn?BXBST�w?CHV�CSfX�JPRvu0RIH]ABRIH]FKH<XYLyJiLKSfDGXka

r�HgRKH<��?BSfRIHgL" �JiLtL! BHnZBH<\]STFKSfDPX�JP|3Ä�ST²gH�³ ��H<|f|Te�JPX_ABRKDG�C|fH]e!�EHnHzJiFIu�SfX¬Wna0�sDPRKHgABRKH�³\]STFKH<|TuGj��QHsRKH<�w?CSfRKH`L! �J�LgL" BH]RIH_STF=JiX H<²g\<SfH]XYL0JP|fUGDPRKSTL" Be OmDGRnZBH<\]SfZCSfXBU�L! BH`OmDG|f|TD+��SfXBU|¡JiXBUG?�JPUPH&%('*) � ¸�WcºMh

%+'*) � ¸�Wcº FH= ¸�!3l ' lKJ"l��sl-,�l ��ºf�/.�m_lK�­f � $ FK?B\� `L! �JiLS� F J � l�, F J10bl � F J � 0 B

§=%

Page 93: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

A�XBH�L! BHQDPL! BH<R� �JPXCZkjP�lH���Sf|f|wXBH<H]Z~LWD�e=JPpiHQL! BHlOmDG|f|TD±��STXBU�JiFKFK?Ce=ACLKSfDGXc�k BSf\� ~STF�FKDGegHM³�k �JiL�FvLWRKDPXBUGH]R;L" �JPXn\]DGegAB?CLWJiLWSTDGX�JP|CÄ�ST²gHM³ ��H<|f|fe=JPXka � L�STF;H]FKFIH]XYLWSfJP|f|�uN|TSfpPH9\<DGegAB?CLyJ�LWSfDPX�JP|Ä�ST²gH�³ ��H<|f|Te�JPXqjiH��C\<H]ACL�L! BJiL�SfXBFvLWHzJiZgDiOELWJPp�SfXBUªL��lDcSTXBAB?CLKF]j�J.��JiXBZ J 0 jwJPXBZnL! CH�\� BJP|f|TH]XBUGHSfF�\]DGegAB?CLKSfXBU J.� 0 jk�QH �JzdPH=J)|TDGUYJPRISTL! Ce=ST\VX�?Be^�EH<RªDPOQ�BJPFKH<FfJ 0 §lJ�J�J�&l>J 0�� j.JPFª�QH<|f|;JiFtJP|f|L! CH~ABRKDwZB?B\MLWF�J O������ 0 � OmDPRªJP|f|�ABRIDGAEH<R�FK?C�BFKHMLWF��DPO;L! CH~X�JiLW?CRWJP|TF�?BA7LWD0JPXBZ�SfXB\<|f?BZCSfXBU �PjJPXBZ5L! CHV\� BJP|f|TH]XBUGHªSTF�LWDn\]DPe=Hª?BA5��STL" )L! BHªdiJP|f?CH J O ��� 0 � a/ &(&(��ª �\n��N e� &% '&%!) , � «���� �C��� / &(&(��ª �\n��N e� 3 % x&�62c¿<595 � F #0¸m|fDGUtzCºC^"7 �62~¿<595 ;"2 �<U�h¿�U]Á95 Á - ��ÁÃÂ8;;�65 ½i¾���À~Á�¿<5`h ��Á�À / 7<¿PÀ~Á95 Á /C- �:7�R 032MÁ�¾3OgÀg¿wÂCMwÁ�¾ /C-�= @ @6B ^

®;R+¤�¸�!3l ' lKJCº�� ��¸ � @ º � = ��Qe� � $ h � B R B � B �= ��� F��

����� � � � ��� F J��� h�� ¢·¤ �M© B �

� � @ @ ¸�!3l ' lKJ"l = ��� h��\¢¤ �M© B º h � F J O 0 P © B �k¸�zBºK M / 2 / U]½�¤ �M© KA/ ¼ / ¾���� / �9M /P-�/ � �:7ªÁ�¾;� / O / 2 - 7�2 ��À � � �&� Z

�tRIDG?BABF3DPO�L! CSfF �¦JzdGDPR]j��k BH]RIH�L" BH�ZBH]\<SfFKSTDGX�JP|BÄ�ST²gHM³ ��H]|T|fe=JPX^ACRKDG�B|TH]e SfF3HzJPFvuGjwJPXBZnuGHMLUGH<XBH]RKJP|fST¯zJiLKSfDGXBFqDPOCL" BH3\]DGegAB?CLWJiLWSTDGX�JP|PÄ�ST²gHM³ ��H]|T|fe=JPX�ABRIDG�B|TH]e JPRIHV �JPRKZqjPJPRIH3FWJPSTZtLKD BJ+dPH�KÄ �9³ ÄªÄ � FKH]ABJPRWJiLKSfDGXqa ��«��CJPegAB|TH]FªDPO3UGRIDG?BABF�L" �JiLtJiRKHN\<DGX�#IH]\MLW?BRIH]Z�LWD( �JzdPH=Ä �9³ ÄªÄ �FKH<A�JPRKJiLWSTDGX�JiRKHnH]|T|fSfA@LWSf\^\]?BRvdGH�UPRKDG?BACFVL" �JiLcJP|f|TD+� L" BHgr�H]ST|;A�JPSTRKSfXCU�¤ >@ST| ���±©Ãa � DGRtJsegDGRKHL! CDGRKDG?CU �H��@AEDGFISTLKSfDGX�DPOQFK?B\� [UPRKDG?BACF]j.�QHgRKHMOmH]RtL! BHgRKH]JPZBH]R<j�OmDPRVH��CJPe=AC|fHPj�LKD`L" BH=RIH]\<H]XYLA�JPA�H]RIFl�Yu �PDG?w�=JPXBZ � UG?CuPH]X�¤ � � � �<©¬j �PDG?w�s¤��PDP?;�!�i©�JPXCZ0£QDGXCHL =JPXBZ � RKJPXBp�|fSTX`¤¥£ � ���]©¬a � XL! CHVFIH]��?BH<|Ãj��QHª��ST|f|qXCDPL�JPZBZBRIH]FKF�L! CHVX�?Be^�EH<Rv³´L" BH]DPRKH<LKSf\tJPFIAEH<\<LKF�DPO�L! CHVFI?B� #IH<\<Lza

�5( � !�2g-��&/;136789/;:]2g- 2�|� � -7:��)6 � s5:��g- �c/;671��>@?BACAEDGFIH`L" BHsJP|fUGDPRKSTL" BegF ��j jQJPFgSfX�>@H]\MLWSTDGX �@a %@jQJPRKH5UGS�dGH<Xka ��H<L z��EH)L! CHsFIH]\]?CRKSTL�uA�JPRKJPegH<LWH<R]a ��H<L�L! BH�e=H<FKFKJPUGH�FKA�JP\<Hl\<DGXBFISfFIL&DPOCFILWRISfXBUPF&DPOC|fH<XBUPL! # � a A�?BR�DGXB|TuªJPFKFI?Be=A@LWSfDPXDGX)L! CHVFISf¯<HVDiO&L" BHte=H<FKFWJiUGHtFKA�JP\<HcSTF�L! �J�L # �8F \�¸�|TDGUtzBºMa

��H<L S 1 � h = ��l � B1 � �= = ��l � B 1 � 1 � " ��H�JªO�JPegSf|�u^DPOqH]RIRKDGR ³�\]DPRKRKH<\<LKSfXBUV\]DwZBH]F3�k BH<RKH+#�¸�# � º

SfF�AEDP|TuwXBDGegS¡JP|¬j¦JPXBZ_L" BHNZBSTFILWJPXB\]H^DPO;L! BH^\]DwZBHNSfF+� #�¸�# � ºMjE�k CH]RKH�� � ��SfF�J�\]DPXBFILWJPXYLza � XDPL" BH]R;�lDGRKZBF<jYS�STF3JtOm?CXB\<LKSfDGXnFK?C\� =L! BJiL�STO � <F � �BJiRKH�FILKRKSfXCUGF3DPOq|TH]XBUiL! �# � jYL! CH]X�S�¸ ��ºZBS��qH<RKF�OmRIDGe S�¸ � ��º�STX~JiL;|THzJPFvL � #;¸ # � º�AC|¡JP\<H]F]a � DPR�HzJiFKH�DPO¦XCDPLyJiLKSfDGXqjPSfXcL! BH�FIH]��?BH<|B�QHQ��ST|f|��RKS�LWH�#}SfXBFvLWHzJiZ�DPO #;¸ # � ºMa � DGRVJPX�D+dGH<RIdwSfHM��DPO�H<RKRIDGRv³´\]DGRIRKH]\MLWSTXBU5\]DwZBH]F<j�FKH<H=L" BH=|TH]\MLW?BRIHXBDPLKH]F9DPO&�sJPZ% �?s>@?BZ�JPX�¤¥>@?BZB©¬a ��H<RKHijC�QHªXCDPLWH�L" �JiL9FISfXB\<H��lH���Sf|f|¦XBDiL9XBH]H<Z)L! BH�ZCH]\]DwZBSTXBUDGA�H]RKJiLWSTDGXkj�DGXB|Tu�L" BH�H<XB\]DwZBSfXCU_DGA�H]RKJiLWSTDGXkj&�lH�\]JPX[H]JPFKST|Tu�JP\� BSTH<dPH=# F #0¸ # � º�a`r�H=��ST|f|UGS�dGHVJPX5HM�CJPegAB|fHªDiO�FI?B\� oJ~\]DwZBHtSfXs>@H<\<LKSfDGX �Ca �Ca �Pa

r�Hg��Sf|T|�XBD+��F" BD+� BD+�$LKDs\<DGXBFILKRK?B\MLnJP|TUGDGRKS�L! BegFPWnj �6��"�kj �;9 5�6�����JiFcFIAEH<\]STxBH]Z[STXÄ�H<xBXBSTLKSfDGX �Ca �Ga �Ga/ �")" ��6�! � ª W µ�?BX ��¸ � @ º;LKDcDG�@LyJPSTX�W F ¸ !3l ' lKJCºMa>� CD@DGFIH+#`A�JPSTRKF�DPOkRKJPXBZBDGe�H<|fH]egH]XYLKF

STX � $ ho¸ )�� . � lE)�� . �Kº1lJ���J�&l±¸ ) 1 . � lE) 1 . � ºMa ��H<L @ Q . / F J 1 P � " j;OmDGR�� B R B zEj +sf = ��l � B aA�?CLKAB?CL�L! BHªOmDG|T|fD+��SfXCUNpPHMu5A�JPSfR<h

§ �

Page 94: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

: � F)�� . � )�� . � �J�J� ) 1 . �)�� . � )�� . � �J�J� ) 1 . � � � F

@ � . � @ � . � �J��� @ 1 . �@ � . � @ � . � �J��� @ 1 . �

/ �")" ��6�! � ª �6��"� A�X7SfXBAC?CL�J=e=H<FKFWJiUGH � DPO3|TH]XBUPL" # � jq\]DPe=AB?@LWH^L" BHNH]XC\]DwZBSfXBU=DPO �?BFISfXBU7\<D@ZCH Sgh M F S=¸ ��º�a�b�D7FKSTUGX[L! BH�#¦³��BS�L~\]DwZBHM�QDGRIZ M F M � �¨�J�J� � M 1CjDG?@LWAB?CLy« ��ª¸ M º F ¸�®b��lJ�J�J�cl#®81GºMj@�k BH]RIH{® �AF J)JiXBZ ® Q F ¸�® Q ! �Kº 1 P � � P OmDGR � B R B #�a

/ �")" ��6�! � ª �;9 5�6���� ��HMLt®�� . �8F J�aiª3H]RKS�O�u�L" �JiLzjBOmDPR�JP|f| � B R B #�j ¸�!3l ' lKJ"l?®�� . Q ! �§l @ Q . � P l?®�� . Q�º F|+ ����� � R

�tRKJPA% BST\zJP|T|TuPjw�lH�dwSfH<�#L! CHªe=H<FKFWJiUGHªFKA�Ji\]HVJPF�L! CHª|fHzJzdPH]F�DPO&JN��JP|fJPXB\]H<Z5�BSfX�JiRIugLWRKH<HªDPOZBH<ACL! #�ag«3JP\� �SfXYLWH<RKX�JP|�XBD@ZCHgDiOlL" BH~LWRKH<HnSfFtJPFIFKSfUPXBH]Z�J)|¡JP��H]|¬j�JPFªOmDG|T|fD+��F]h�L" BHn|¡JP��H]|&DPOL! CH�RKDwDPL�STF�J�a�b) BHª|fJP��H]|�DPO�J^\� BST|fZkjwZBH]XCDPLWH<Z����;SfF�DG�@LyJPSTXBH]Z�OmRIDGe$L! BH�|¡JP��H]|�DPO.STLKFQA�JiRKH]XYL]jZBH<XBDPLWH<Z�� j�JPF�OmDP|f|fD+��F<h�S�O;L! BH~ZCH]ACL" �DiO;L! BH~\� BST|fZoSTF RKjkJPXBZ7STL�SfF�L" BHN|TH<O�Lª\� BST|fZkj�L! BH<X7STLKF|¡Ji�EH<|�STF��� F � 1 P � � j@�k BST|fH�STO�S�LQSTFlL! CH�RKSTU YLQ\� CSf|fZqj@S�LWFQ|fJP��H]|���Sf|T|���H��� F � 1 P � a�b) BH�FISfUGX�J�LW?BRIHDGX)JiX #�³´�BSTLlegH]FKFKJPUGH�\]DGXBFISfFvLWF�DPO�JP|f|�L! CH�|¡Ji�EH<|fF�DGX=L" BH�A�JiL" =OmRIDGe$L! BH�|fHzJ�O�\]DGRIRKH<FKA�DGXBZBSTXBULWDcL! BSTFQegH]FKFKJPUGHtJP|T|�L! BH��QJzu�LKD^L! BH�RKDwDPLza�b�DNdGH<RKS�O�u�\<DGRKRIH]\<LKXBH]FIF9DPO&J^FKSTUGX�JiLK?BRKHijCDGXCH�?BFIH]FL! CHcJi|fUGDGRISTL" Be L" �JiL�FKDP|TdGH<F9L! BHVÄªÄ ��OmDGR�L" BHtUGRKDG?CAsD+dGH<R9�k BSf\� 5L! BSTF9SfF�ZBDGXCHPa�������!�3��� �*% � X�LWH]RIe=FtDPOQH<²g\]STH]XB\MuGj�L! BSTFVFISfUGXBJiLW?BRIHnFK\� BH<e=H=SfFVJ5O�Ji\<LWDPRªDPO #�¸�#�º��lDGRKFIHL! BJPX¢L! BH �QRKJPe=H<Rv³ >^ BDG?BA¶FI\� BH]egHPj�STX¶JP|f|�A�JPRKJPegH<LWH<RKF)FI?B\� �JPF0L" BH7pPHMu¶JPXBZ¶FISfUGX�J�LW?BRIH|fH<XBUPL" BF�JPXCZ_L! BH^\]DGegAB|fH��@STL�u5DPO3RIH]|fHMdiJPXYL�DGA�H]RKJiLWSTDGXBF]a�b) BSfF�e=H]JPXBF�L! �JiL�STL�SfF�FILWST|f|.RWJ�L! BH<RABRKJP\<LKSf\zJi|ÃjlJPXBZ�uPH<L �JPFnL��QD��EH<XBH<xBLKF]ho?CXBSf��?BH<XBH]FIF]j�JPXBZ}FKH<\]?BRISTL�u}��JPFIH]Z{DGX�J�ZCST�EH]RKH<XYLJPFIFK?BegACLWSTDGXka � X`\]DGegA�JPRISfFIDGX0LWD~L! CHV?CXBSf��?BHtFKSTUGX�JiLK?BRKHªDiO;�sST\zJP|TSqHML�Ji|Ãa�jCDG?BR�\<DGXBFILKRK?B\MLWSTDGXSfFnABRIH<OmH<RWJP�B|TH_JiFgO�JPR=JPFgH<²g\]STH]XB\Mu}SfFg\]DGXB\<H]RIXBH]Zka¶b) BSTF=STFn�EH<\zJP?BFIHoDG?BRn\<DGXBFILKRK?B\MLWSTDGX STFZBSTRKH]\MLzjB�k BST|fH�L" BH<u)x�RIFIL�UGS�dGHVJg?CXBSf��?BHVFKSTUGX�JiLK?BRKH�OmDGR�F' BDGRIL�egH]FIFWJPUGH<F]j�L! CH]X_F' BD+� BD+��LKD\]DPXBFILKRK?B\ML�J{ªªµ � JPXBZsJ~?BXBSf��?BHtFISfUGX�J�LW?BRIHªDPO�JiRK�BS�LWRWJiRIu0|TH]XBUiL! )OmRKDGe�L! �J�Lza%­��������!��) � � �N�3��) � �� &�� )"�_« � �6�&<% £QDGXBH` nJPXBZn>@ST|TdPH]RK��H]RIUn¤ £9> �=%�©@A�DGSfXYL�DP?CL�L" �JiLzjSTO�L" BH5|¡JPXBUP?�JPUGH�%�¸ !3l ' l>JBº F = J 0 l��J�J�clKJ 0�� lKJ O �P 0 P B STF~H<²g\]STH]XYLW|�u%ZBH<\]SfZBJP�B|fHij�L" BH]X�L! CHFKSTUGX�JiLK?BRKHtZBDwH]F�XBDPL�XBH<H]Z`LWDg\]DGXYLyJiSfX5L! BHV|¡JP��H]|TF9DPO�L" BHVSfXYLWH<RKegH]ZBSfJiLWHªXBDwZBH<F]a � a¥HPa�j�LWDgFKSTUGXJ_egH]FIFWJPUGH5� j M F S=¸ ��º�j;STLcSfF^FI?C²g\]STH]XYLNLWD7UPSTdGH�® F J O �P 1 P�� � P aob) BSTF^RIH]ZB?B\<H]F~L! CH|fH<XBUPL" [DPO�J_FKSTUGX�JiLK?BRKH���u�J_O�JP\MLWDGRcDPO�#�a ��D+�lH<dPH]R]j3x�XBZCSfXBU7UGRIDG?BABFc�k BH]RIH %�¸ !3l ' lKJCºtSTFH<²g\<SfH]XYLK|TugZBH]\<SfZ�Ji�B|fHij@JiXBZ�uGHMLQL" BHª�_JiX�uY³�Ä �#��FKFK?Ce=ACLKSfDGX=SfF�FILKSf|f|�RIHzJPFIDGX�JP�C|fHPjwSfFlJPX=DGAEH<X��?BH]FvLWSTDGX[¤ £9> �!%�©Ãa� �� � �g�_�3�� � �� «��� �.�� ��8�8�¡ �� ���� ���� ) �¡ ���*% b) CH=RIHzJPFIDGX�L" �JiLªL! CH=\<DGXBFILKRK?B\MLWSTDGX?BFIH]FgJPX�H]RIRKDGR ³�\]DPRKRKH<\<LKSfXBU7\<D@ZBH)STFNAB?BRIH]|�u%J_LWH<\� BXBST\zJP|�L��lHzJPp�L! �JiL~JP|f|TD±��FcL! BH)FISfUGX�J�LW?BRIHFK\� CH]egHgLKDs��HnABRKD+diJP�B|THg?CXBZBH]RtL! CH0�_JiX�uY³�Ä ��JiFKFK?Ce=ACLKSfDGXqa � X�DGRKZCH]RªLWD`\]DGXYLKRWJPZBST\<LtL! CHJPFIFK?BegACLWSTDGXkj��QH0RIH]ZB?C\]H)JPX�SfXBFvLyJPXB\<H�DPOQL! BH0�_JPXYuY³ Ä � ACRKDG�B|TH]e LWD_JPX[STXBFILWJPXB\]H=DPO9L! CHFKSTUGX�JiLK?BRKH�FK\� BH<e=Hia3r�HªH]e^�EH<Z0L! BH�diJP|T?BH]F J 0 P.DPO.L! CHt�_JPXYuY³ Ä ��ABRIDG�B|TH]e�SfXYLWD^L" BHªAB?B�C|fSf\

§P¨

Page 95: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

pPHMu7DPO3L! CHgFISfUGXBJiLW?BRIHNFK\� CH]egHPa � X�DGRIZBH]R�OmDGR�L! BH~RIH]ZB?B\MLWSTDGX7LWD)UGD0L" BRKDG?CU kjk�lHgXCH]H]Z�L! CHOmDGRIUGH]Z�egH]FKFKJPUGHNLKD`ZCST�EH]R�OmRIDGe�JP|T|&L" BH~ABRKHMdwSfDG?BFI|Tu_�w?CH]RKSTH]Z�e=H<FKFKJPUGH]FtDGX7L" BH~�BSTLKF��k BH]RIH= J 0 P B JPRKHoH<eN��H]ZBZBH<Zka�b�D�UG?�JPRKJPXYLWH]HoL" �JiL]j��lH�?BFKHoL" BH7H]RIRKDGR ³�\]DPRKRKH<\<LKSfXBU%\<D@ZBHij��k CSf\� H]XCFK?BRIH]FQL" �JiLQL" BH�egH]FIFWJPUPH�DGXg�k BSf\� �L" BH�JiZCdGH<RKFWJiRIu=\]DGegAB?CLKH]F�JtOmDGRKUPH]RIugZBS��qH<RKF3OmRKDGe�JiX�uABRIH<dwSfDG?CF�egH]FIFWJPUPH�DGXgJtFK?B�CFILyJiX�LKS¡JP|BOmRKJP\<LKSfDGXnDPOE�BS�LWF]a�b) BH�FvLWH<A�DPO�L! BH�ABRID@DiOEL" �JiL�RKH<�w?CSfRKH<FH]RIRKDGR ³�\<DGRKRIH]\<LKSfDGX5STF �.H<e=e=J �Ca¥¨Ba¥¨Ba

� (%$ (+* A - &���1e9�� 0 . 7�1 1 ��=E+ � 1�� 0 . 7 7 3 .�QDGXBFISfZBH<RtJ0RWJPXCZBDGe \]DwZBH~\]DGXCFILWRI?B\<LKH]Z�JPF�OmDG|T|fD+��F]h�# F %i¨ # � RKJPXBZBDGe FILKRKSTXBUGFªDPO3|TH]XBUPL" # � JPRKH`\� BDGFIH]Xkj9|TH<Lg?BF=ZBH]XBDiLWH5L! BH<e �Yu�� � lJ���J�&l�� 1 jQ�k BH<RKH_H]JP\� �� Q F � Q � � �J��� � � Q1 ab) BHNH<XB\]DwZBSTXBU0DPO;egH]FIFWJPUPH � F M �����J�J� � M 1 � SfF�S�¸ ��º F �J� ���J�J��� � 1Cj��k BH]RIH^L! CHN�BSTL�EQ F� 1 ��Ke� M � � Q���� ���������� ��������� �¬������� �!��"�#" # � ��$%��&('��!� *) �+# ��,[S�, ���.-1l_S�, �¬��-%-/�(�!����#%�0#! (�1 �32�2/45��"6��45�.#�����78�:9;�+#=<>�8�!��#" ��:7!�?���8<@��$����A�B��$ ���C�3��� �¬� D) �8#��FE S�, ���%-HG(SI, �KJL-+M�����N� �8#PO�Q����!�(��#Q�R#" �� R%ST#! N9�4 #P���;O ��4 ��7!�:�(Q�4 �D��$Q�����(��2 # �%U 9�4V#P��#%$%4 ��"�MW������XZY <E*XKJ[MO�Q\E]XZY+^_�(Q�G`XKJ[^a�AQbEc,dXZY\G`XKJ+-+^_�(QP4 �e�If UQg $%��������2ih3��$�4j��9(�5���% (7� k#! l�3#6mD$Qn?o%p ONq\Ef3reEsmD$Qn�o�p ONqtE g reE gvu�w Eyx ��45��78���tq:4 �z7� ������!��45���(�!���!�����8�H#Q� {|���e�R}vMD~��E��lMPONq45��4 �����!���!�(���!�H#��3�RO�} �� #�45���!����{�#Q���%�8��#" l�3#z�t�DpT��,���,dXZY%-L����,dXKJL-�-�r@E���q��;Y �en�o�p O/q r � ��8$%�8�B��$%��M�9H{�#" ���� ��!$�������9;�� �����Ml�3���� (�%45�("���� w M

mD$� p���,���,dX�Y�-+����,dX�J+-%->��� � r¡  mC$� p£¢ �;,¤�I,�XZY�-L���I,�XKJL-�- u ��¥ gvu�w ¢H� gvu�¦ rE mC$� p£¢�§ ONq u ��¥0xP¢?��¨�r© w �3ª «V¬¬V­%®a¯£°8­=± �E w � ª ®²¯ ³B´B± ¬¯ ³�¬ �E w � ª �[µ·¶ © w ª �¸µ·¶ © w ª?¹ � �

�>�������!ºW ��!�H#%� {�M;9H{�#! ��� ���4 ���»9;�� (����M��%4 ��7!��#! ��8$%����$%��� �!�%�¼#" l��� w J � � �;�����%4 9��5��7� ���457!�8��B��$eXZY��E*XKJ[M�mC$Q�Dp .lX�Y��E*X�J6� # ��,���,dX�Y�-+����,dX�JL-%-R `� � r © w ª � �

�»½.¾ ¿ÁÀDÂ�ÂNÃ*ÂNÃÅÄ�Æ�ÇtÈÉÀCÊ8ËÍÌ Ã�Â/ÀÎËPÏkÆ ÐÒÑÉÊ!Ó�ÈkÆ Ä»Ê!Ô/ÑkÕ�ËPÈÉÀDÆ� �0#%Ö�45�:�%�878#%45����M�<@�z�%Ö(�v<×Ö��[<Ø#%��$��!�� �78��9�$��¸��ÙW45�("�#QÖ(�ÛÚ0���H{ U�Ü�1 ��$���9��5�82i#Q�/�B��$%"�4 ��"/��%4 "��l�3#% �$%���3�Ý#%Ö���7!�����.#Q$� �78#%45����45�����878#Q4 ����Þ _ß(à 45$���#!M(<>���%Ö(�v<#QÖ����B��� �5�[<:45�("��5�82�2��(áâCã�ä|ä|åKæèç�é\ç¤êlç�ë�ìvíHílî[ï[ð:ñ(ò�ó�ô�õWö ,%,�,=÷?�Qø?�%ù(-+�!úvûeq5ü ý�þ�Y=ÿWq5ÿ � ü ý������%ü Y��Q-+���É�v,��3YL�¸^!^¸^è�� � -%-CE g��� lð�� ��}¼E`ù���� o�� ¯��

o � � o��� lð��Qð � q5ü !Ýo " ð��Íî$#=ð�ï%#& lð¼ì'�)(+*!ìlð-,$.0/ ì�ð2143>ï+ì657 8#& �.0# ù �

o � � o E ûtq ü ! o 9:�Qî[î<;�%= �z�%Ö(�v<]#%Ö��z� �!2/2I�N9H{�4 ���� �7+#Q4 ���0����� à ��$A��E g M�#QÖ���h��!$�4 &l7!�3#Q4 ���k�3�5"���$�4 #%Ö�2<:45� ����787!�8�(#6����� {I4 ���3YCEû�Y=ü ! o

>@?

Page 96: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

9�� Eù � ¯ � � ù � ¬ � � ù ��� � � � J ù ��� � � ù ��� � � ù �� � � ù �� � � ù ��� � � ù � ¯ ��� �ù � ¯ � ¯ ù � ¬ � ¯ � Y ù � ´ � ¯ ù ��� � ¯ ù ��� � ¯ ù �� � ¯ ù �� � ¯ � ¹ ù � ¯ ��� ¯

à 4 "� �$%�tÞ UQg á � �[{I�L'��32���� �6���è�z�� �9�� 457eÙ��+{I��$����( �7!�8��9W{/#QÖ(� $%�8�� �78#%45��� P� ��#QÖ�4 �@�L'(��2��(�5��M��E g f�M �eE ß( � Ö(��$��!�� �7+#Q4 ���»$Q�����(��2��V{I�(457�Ù��8���0E]ú ß � ¦ � > þWM �ÁE g f g

) �8#z#%Ö���� �!2/2I�»Ö���� �K�B��$t��¥ g � Ö���h��!$�4 &l7!�3#Q4 ������� "���$%4V#QÖ�2 <:45�5�C�37!7!�8�(# ��}N����� {�4V�� ,·÷?�Qø���ù;�7�L} ª Y��QûR}.ü !

����}+-�E g �� (#N9H{��(�8&l��4V#Q4 ������� � MD#QÖ�4 �Û45�z#%Ö���7¸�3�%�»�����V{|4V� ��}»E

ù�� � � � � � MD<:Ö��!$���� 4 �z#QÖ��» ��(45ºW ���h3���5 (��45� 143 �% �7�Ö�#QÖl��#Ûù � E �L} ª Y �� {K#QÖ��»4 ���� �7+#Q45���ÖH{?�;��#%Ö��!��45�8M���E�� } ª Yq��;Y � q5ü !Ýo � Ö��8$%�+�B��$%�3M �L}:E`ù � � � � � � E`ù�� � o�� ¯��

o � � o

��� �!��" #%$'& (*),+�-!./+�02130245./67$98:$';=<7(>./+�021� ��#%Ö��¼�B���5� �[<:45��"�M*?.<>�A@�$��8�B�8$%�C#Q��#QÖ��e$%�8�� �78#%45���ÍM��3���/#%Ö��:�B��$%"��8$D�B��$P#QÖ��e�%4 "��l�3#% �$%�:��7�Ö��!2/�45�B?.�� �$:���(h��!$��Q��$.{ @

C �87EDGFHFÍ#QÖ/D3#JI�4HKMLQÖ��=K��!7ON P%4HL={RQ/DGPSD�2/�AL%�OP8MTDGU/VRLQÖTDWL:� �¼EYXJZ FH[]\^I/_+Ml��Ea`5Z¤� �b_dcefN/Q/Q�[]K��JLQÖTDWLg[]N PgDGV�h��OP�KSDGP.{�ShKMP�N/U/U�4HU/\iL%452/�:4jKlkAZmI/_bc C �87EDGFHF/LQÖTDWLMn:4jKlLQÖ(�JV�4HK�LoDpU�7!�q[Gr

LQÖ(���APsP�[]P U 7O[]P�P%�!7dLQ4HU/\N7O[�V���<>�tN/K%�pcguè�dLM�tE vxwzy|{G}�~��o���m� Jwzy|{o~ Y µ ~ Y ªT� �|�|� �H��� g cqZ��![pLQ��LQÖTDWL��:E%`5Z�Fj[]\^I _s_dc

� K�KsN�2/�t� 4jK�DGK:4HU�e?�!7AL%4j[]U�Þ c w c

�A�����'�g�������bã=�vã����� G��¡����^¢ � K'£jU � KsKsN ¤¥Q Ls£j[]U�Þ c w c g M[<>�^DGP��l\]£ h��OUtD�\]Ps[GN/Qt�ØE¦Z=÷?�%ø��%ù _DGU/V����OF5�A¤��AU§LSK � YL� � J¸�¸^¸^¸^Í� �/¨ [prJ�NMD<:Ö��OP�� �T© E¡ù�ª¬«§c = �­DGP��RDGFjK�[®\]£ h��OU�LQÖ(��hGDpFjN��AK¯l°²± ù � «o³S´ ª « Mgr�[]PBµ�¶ p �+rmc � Ö���\][§DGF�£jK·LS[�¸/P%�OD�Ù � K�KsN/¤BQ LS£H[]U�Þfc w c g MM£�c_�pc Mg¹O[]¤BQ/N L%�ù ��º« � ¯ ª¬« c

»�㧼:½�ã��\ã��vå ��¡ ���¾¢ ml£j¹�Ù­D¿PSDpU/V/[]¤À� U ¸/£ÁLJK�LSP�£jU/\Â� ±Äà Y�Å�^¸^¸^WÅ Ã ¨ DGU/V®D¥PSDGU/V []¤À� U ¸/£HLKsN ¸/K%�dLi�ƶ×p �;r�cJZ à []P�Ks£H¤¥Q/F �OPMU [GLoDpLs£j[]U>Ç/DGK�KsN/¤/��LQÖTDpL�L%Ö��=£jU/V £j¹!�AK�DGP%�=[]P�V��OP��OV­KsN/¹�Ö­LQÖTDWL� © © � © � Y2r�[]P�DGFHF�� ©ÉÈ �Êc�_

e��AL¥N/QËLQÖ��­Q/N/¸ Fj£j¹�Ù3�8{ÌDGK·r�[]FHFj[�Í�K!á�û>} « ü ý « ± �T© c � [ÆK%�dL¿N/Q�ûtq ü ýtÍ:Ö��AP%��~ uÈ �a[GP~ ± � ©�È �®¸/N L à �±aà © Ç ¹�Ö/[�[]K%� hpDGFHN�� � q5ü ý�Î 143 DpU/VÂK%�dL¼ûtq5ü ý ± ù �

o � Ï c à £j\]N/P�� Þ UQg \]£Vh��OKMDGU�dÐ DG¤BQ/F ��[Gr�Í:Ö/DpL�LQÖ��=P%�AV/N/¹dLS£j[GU�V/[?�OK�£HU5LQÖ/£HKqK�LQ�AQÑc

Ò�ã�ÓO�l������¡ ��½Ô���ÕÓE¡�½��bå �����vã¦Ö>�bã×�W¡¤ã�ÓG¢ = �ØÍ�£HFjF=P%�AKsQ�[]U/V�Ls[:DpL²¤B[]K�L w kRK�£j\]UTDWLSN/P��º×N��OP�£5�AK�r�P�[]¤ÙL%Ö��tDGV(h��APsKsDGP�{GÇÚDpK�r�[GFjFj[�Í�KAcefN/Q/Q�[]K��7LQÖ��=DGV�h��OP�KSDGP.{�ShK:º×N��OP.{5£HK¼X Í:Ö��OP����¿Z�X�_ ± � ± �0Y�Åt^¸^!^dÅ � � c¾uè�dL7�¾Z&�­_

V��AU/[GLQ��L%Ö��=K�LSP�£jU/\ �N}¯Å�^¸^¸^�Å �N} º c�>Ö��O¹�Ù�£Hr!�¾Z+�­_ ± �¿c � r�Ks[/Ç�LQ�APs¤B£jUTDpL%�BÍ�£ÁLQÖ�? à DG£jF�ch@ÜÛJLQÖ(�OP�Í�£HK%�pÇʹO[]¤BQ/N L%�BL%Ö��¿K�£j\ U

UTDpLsN/P%�BDGK7r�[GFjFj[�Í�K8á7uè�AL ¯ � ± ù�c�uè�dL ÃoÝ'±ÜÃSÝ Z|�'_7¸��·DGU�� U ¸ £HL�K�LSPs£HU/\RKsN/¹�ÖÆLQÖTDWL à } « ±Üà ©> Þ

Page 97: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

r�[]PqDGFHF�� ©·È �Êc � {Rµ © ÇTÍ>�iV��OU/[pLQ�=LQÖ��=� U ¸/£HL�K�LSP�£jU/\·Í:Ö/£j¹�Ö�ÖTDGK!D g £jU­QÚ[GKs£HLs£j[]U��'Ç�DGU/V0f(S K�8h��OP.{�Í:Ö(�OP%�z�OFjK��Gc

�g[]¤BQ/N LQ�¥Z ��Y��¸^¸^¸^è�� � _MN/Ks£HU/\�LQÖ���r�[]FHFj[�Í�£jU \ Fj[�[]Q�á� U/£ÁLS£�DpFj£��8�7n6á ± f ¨

à []P>~ ±×g Ls[N�Z g _ � rP~ ± � ©ÉÈ ��DGU/V ��q ± à © Ç/L%Ö��OU�n6á ± n�� µ ©Z w _ �¸q ±�¯ � � ³³�� � ��

o� � � � � � � ³� � ���

o � � � �� Ï��� � � � � ��Z ß _ � U/¹OP��O¤/�OU§L6~ZB�OU/V­[Gr�Fj[�[]Q,_

�t�W�Ñ �ãfÓOÓE¡��'½ ���\ã�� �,�W½�ã×��¼l¢ �q[�ÍØKsN/Q QÚ[]K��lLQÖTDpL>LQÖ��^DGV(h��OP�KSDGP.{�¹O[]¤/�OK*¸/DG¹�ÙJÍ�£HL%ÖtDgr�[]Ps\��AVKs£H\]UTDpLsN/P%�¿[]Uˤ��AKsKSDp\���X Ý r�[]PÉÍ:Ö/£H¹�ÖË£HLÛÖTDpK�U/[GLNº×N��OP�£5�AV�� cØuè�AL � Ý ± �¿Z�X Ý _bc � Ö/£HKr�[]P�\��OP.{É£HK������JZ+� Ý _ ± ú � !

�ü q¤þ×c � Ö/£HK�r�[]P�\��OP.{É£HK�� î[î "g£HrÑ�lZ+� Ý _ ± �¿c � rTLQÖ(�Mr�[]Ps\��AP�{i£jK�\][f[�VÑÇ

Í@�i[]¸fLoDG£HU5LQÖ���hpDGFjN(� ù � º « � ¯ ª¬« ¸H{­u\�A¤¥¤¥DÛÞ c ¦ c g Ç/¸H{ÂKs£H¤¥Q F {5¹A[]¤BQ/N LS£HU/\­Z�� !�ü q�_ Y µ � o

³³� � � �oo c

��� �!�� �a1���� q&/+¬& 0^45.T67$98:$';=<7(>.T+¬0g1uè�ALqk ± kAZmI/_�¸��tL%Ö��z�bÐ Q��O¹dLQ�AV²PsN/U U/£jU/\BLS£H¤���[Gr�LQÖ��iDGV(h��OP�KSDGP.{]c à []P�LQÖ��tQ/N/P�QÚ[]K��OK![GrÊLQÖ(�DGUTDpF {�Ks£HKOÇ/¹A[]U/Ks£HV��OP�L%Ö���r�[]FjFH[�Í�£HU/\�DGFH\][]P�£HLQÖ ¤¥K8á

! � Fj\][]P�£HL%Ö/¤ g PsN/U/K¾LQÖ(�JKs£H\]U/£HU/\tDGFj\][GPs£HL%Ö/¤¦DpU/V¿P��OKsQ�[]U/V K2LS[tLQÖ��!DGV(h��OP�KSDGP.{;S KRº×N��APs£5�AKDGKqLQÖ��tLSP�N�� Ks£H\]U/£HU/\¥[GPSDG¹AF5�iÍ2[]N/FHVÑc � rlLQÖ���DpV(h��APsKSDpP�{�[]N LSQ N LSK�D/hGDpFj£jVRr�[]P�\��OP.{]Ç,LQÖ/£HKDGFH\][]P�£HLQÖ ¤Ü[GN LSQ/NfLSK¥?SefN/¹A¹!�AKsKOc @

! � Fj\][]P�£HL%Ö/¤ w PsN U/K¿LQÖ(�²Ks£H\]U/£jU \�DGFH\][]Ps£ÁLQÖ/¤ ¸/N LÂ[]U F {ÌP%�AKsQ�[]U/V/K¿Ls[ w kNº×N��OP�£5�AKOc � rL%Ö��¿DpV(h��APsKSDpP�{Æ£jK�KsN��AKi¤B[]P%�Nº×N��APs£5�AKOÇ�[]N LsQ/N L²? à DG£jF�ch@ ÛJLQÖ��AP�Í�£jK��GÇ�£Hr2LQÖ��BDGV(h��OP�KSDGP.{[]NfLSQ/N LsKqDÛhpDGFH£jV5r�[]P�\��OP.{]Ç/L%Ö/£jK�DGFH\][]P�£HLQÖ ¤Ü[GN LSQ/NfLSK¿?SefN/¹A¹!�OK�KOc @

! � Fj\][]P�£HL%Ö/¤ ß £HK^L%Ö��JKsDG¤��JDGK � Fj\][GPs£HL%Ö/¤ w Ç��dÐf¹!�AQ L�£HU¿[]U��J¹EDGK��Gc¾�JDp¤��AF {]Ç�£HL2¹�Ö/[�[]K%�AKDtPSDGU/V []¤À�ƶ×pT��rmÇ\¢��@¢ ± �pÇ�� ± ú+�3Y+�!^¸^¸^��=� ¨ þ×Ç DpU/V¿[]NfLSQ/N LsK�? à DG£HFj@�£ÁrÑ£HL^K�[zÖTDGQ Q;�AU/KL%ÖTDpLt�¾Z��¥ZdX Ý _s_ ± �lZ��¥ZdX�_�_�Í:Ö��AP%��X Ý £HKqL%Ö��ÉDpV(h��APsKSDpP�{�ShK!r�[]Ps\��AP�{GÇ>DGU VÉX £HK!DpUW{Q/P��8h�£j[GN/KsFV{�º×N��OP�£5�AV�¤/�OKsKsDG\��pÇ,DGU/VRU/[GLSDpLS£H[]U®�¾Z+�­_gV(�OU/[GL%�OK-�N}

¯Å%�N}

¬Å�^¸^¸^EÅ%�N} º c

! � Fj\][]P�£HL%Ö/¤ ¦ £HK#"�N/K�LiFH£5Ù3� � FH\][]Ps£ÁLQÖ/¤ ß �dÐf¹8�OQ Lt£jU []U(��¹EDGK��Gc·�JDp¤��AF {]Ç>£HL�¹�Ö/[�[]K��OKtDPsDGU/V/[]¤ � U ¸/£ÁL�K�LsPs£jU \�� DGU VÆ[GN LSQ/NfLSK�? à DG£jFH@¥Í:Ö��AU��8h��OPtLQÖ���r�[]P�\��OV ¤/�OKsKsDG\��/X Ý £HKK�N/¹�Ö�L%ÖTDpLe�¥ZdX ÝÁ_ ± �5ÝÚÍ:Ö��AP%���¾Z&�5ÝÁ_��± �¿c

! � Fj\][]P�£HL%Ö/¤ ? £HK$"�N/K�L·Fj£5Ù3� � FH\][]Ps£ÁLQÖ/¤ ¦ �bÐ ¹8�OQ L¥£jU�[GU��¹EDGK��GcË�!DG¤��AF {GÇl£HL�[]NfLSQ/N LsK? à DG£HFj@�Í:Ö��AU��8h��OPMLQÖ(�6º×N��OP�£5�AV5¤��AKsKsDG\���X £HK2K�N/¹�ÖÂLQÖTDWLR�¥ZdX�_ ± �ÀÍ:Ö(�OP%�i�¾Z+�­_ ±�¿c

! � Fj\][]P�£HL%Ö/¤¡Þ¿PsN U/K�[]N/P!P%�OV N/¹ALs£j[]UÑc � L7[]N LSQ N LSKR?sefN/¹O¹8�OK�Ks@RÍ:Ö��OU��+h��AP=L%Ö�� P��OV/N/¹dLS£H[]UK�N/¹O¹8�!�OV KJ£jUR¹A[]¤¥Q N LS£HU/\�£HLsK�\][§DGF�c

� {�x�q Ç/F5�dL�N/K�V��OU/[pLQ�=LQÖ��=KsN ¹O¹!�AKsK!Q/Ps[]¸/DG¸/£jFH£HL={B[Gr�DGFj\G[]Ps£ÁLQÖ/¤ ~sc>&%

Page 98: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

âCã�ä|ä|åKæèç�é\ç���ç �� lð�ï+ì)575�ð�ï�ï�í �Qî��7.�� ( / ( #�� î<;�� / � î$��( # � (5ï #& lð�ï .�Ið .�ï # lð0ï+ì)575�ð�ï�ïí �Qî��7.�� ( / ( #���î<; # lð ;¸î$� � ð�� 9:�Qî[î<;� � {¹A[]U/K�LSPsN ¹ALS£H[]UÑÇ L%Ö/£jK�DpFj\][]P�£HL%Ö/¤ []N LSQ N LSKB?Se�N/¹O¹8�OKsK�@¿£V��LQÖ(�7r�[]Ps\��AP�KsN/¹A¹!�8�OV/KAcâCã�ä|ä|åKæèç�é\ç� �ç x�����xÍY u�w 9:�Qî[î<;� efN/Q QÚ[]K��5DÂKsN ¹O¹!�AKsK�r�N/F2r�[]P�\��OP.{®P%�8º×N/£jP��OK=k�º×N��OP�£5�OKt[]U LQÖ��BD¸h��APSDG\��Gc � Ö(�OUظH{ LQÖ(�Ú�DGP�ÙG[[hR£jU(�!º×NTDGFH£HL={]Ç w kRº×N��APs£ �OKqDGP%�=K�N��B¹O£5�AU§L7DpL�F �EDGK�L:ÖTDGFÁr�L%Ö���LS£H¤��pcâCã�ä|ä|åKæèç�é\ç�é\ç x ¹ ��x�� u�w 9:�Qî[î<;�!C �O¹EDpFjF>L%ÖTDpL-�5Ý ± �¥ZdX ÝÁ_M£HK�D·¹A[fV(�AÍ2[]PsV�[GrÊDpU��APsP�[]P U ¹O[]P�P%�O¹dLS£HU/\·¹O[�V��=[Gr�V £jK�LSDGU/¹8�nL��c � ÖTDpL!£j¤BQ/Fj£ �OK^LQÖTDpL�r�[]P�DpFjF\X Ç)� Ý V/£V�Í�APsK�r�Ps[]¤ � ± �¥ZdX�_M[]U�DpL�F �EDGK�LJnL� Fj[�¹EDpLs£j[]U KOcef[/Ç!£HrtÍ>� Q/£H¹�Ù��AV �®FH[f¹ODpLS£H[]U/KÂDWLRPSDGU/V []¤ Í�£HL%Ö P%�OQ F�DG¹8�O¤/�OU§LEÇ�mlP���p �lZ+�­_ ± �¾Z&� Ý _=r� Z g ¥®nA_ ª ¨ c^ef£jU ¹!�!Í@��DGP��JQ/£H¹�Ù×£jU/\ÉÍ�£ÁLQÖ/[GN LMP��OQ/FjDG¹!�A¤��AU×LOÇ(mlP��(p �lZ+�­_ ± �lZ+� Ý _=r\  � ¨ q��;Y ZB�/¥nL�0¥ ~ _ u �  ÀZ g ¥ n � ¨o_ ¨ r�[]P=DGUH{²¹A[]U/K�LoDGU§L�¨z�]f cÉu\�dL�¨ ± ^_f g nir�[]PJKs£j¤BQ/FH£j¹O£ÁL={]c=uè�AL��V��AU/[GLQ��L%Ö��=K%�AL![Gr�¤��AKsKsDG\��OK:º×N��APs£5�AV�¸H{ÂL%Ö��tDGV(h��APsKsDGP�{Gc � {¿LQÖ��=N/U/£H[]UR¸Ú[GN/U/V

mlP� p��lX È �¦KsN/¹�Ö­LQÖTDpL��lZ��¥ZdX�_�_ ± �¾Z&� Ý _�r\  w kAZ g ¥�n � ¨S_ ¨ © gvu�w£Hr ¦ k © Z gvu Z g ¥Ìn � ¨o_�_ ¨ c � D�Ù×£HU/\¿LQÖ(�ÉFj[G\§DGPs£ÁLQÖ/¤Ù[]U®¸Ú[pLQÖ²K�£jV��AKJ[GrlL%Ö����!º×NTDWLS£j[GUÑÇÚÍ@� \��dLLQÖ(�!¹A[]U/V/£ÁLS£j[GU�Fj[]\lk � w © �*Fj[G\,Z gvu Z g ¥É^ > > nO_�_dÇ�DGU/VBKs[tKs£HU/¹!��Í>�eÖTD¸h��!K%�dL¾��� wzy|{G}Á� �wzy|{o~ Y µ ~ Y ªT� �|�|� �H� ÇLQÖ £jK�£jK�KsDpLS£HK��l�AVÑcâCã�ä|ä|åKæèç�é\ç���ç x�� ��x ¹ u�w ¨ 9:�Qî[î<;� �![pLQ��LQÖTDWL � Fj\][GPs£HL%Ö/¤ ß DGU V � Fj\][]P�£HL%Ö/¤ ¦ ¹ODGU�¸��=PsN/URÍ�£HL%ÖRL%Ö��tKSDG¤/�=DGV(h��OPsKsDGP�{GǸ/N L � FH\][]Ps£ÁLQÖ/¤ ¦ ¤¿D¸{­[]N LsQ/N LÂ? à DG£jFH@·Í:Ö £jF5� � FH\][]P�£HLQÖ ¤ ß []NfLSQ/N LsKR?SefN ¹O¹!�AKsKAch@*�g[]U/K�£jV��APLQÖ(�M¹EDGK��MÍ:Ö��OU·¸�[GLQÖ�[pr�L%Ö��O¤9[]N LsQ/N Lt?sefN/¹O¹8�OK�KOc @ � U LQÖ £jK�¹ODGK%�pÇÚZ g _l�¾Z��¥ZdX Ý _s_��± �lZ��¥ZdX�_�_r�[]PÉDGFjF^Q/P%�+h�£j[]N/K�F {�º×N��OP�£5�AV X9ǾDGU/V Z w _·�¾Z¤�¿Z�X�_s_ ± �¿c �![pLQ�¥L%ÖTDpLOÇl\]£ h��OU�LQÖ/DpLRZ g _t£HKLSP�N��GÇ/L%Ö��=Q/Ps[G¸TDG¸/£HFj£HL={¥[GrMZ w _g£HK¼�dÐ DG¹dLSF { w ª ¨ câCã�ä|ä|åKæèç�é\ç æ�ç x�! ± x�� 9:�Qî[î<;� �![pLQ�¥L%ÖTDpLtLQÖ��B[]U/FV{ V/£ �;�OP��OU/¹8�¥¸��AL|Í@�!�AU�LQÖ��·L|Íg[²DGFj\][GPs£HL%Ö/¤BK7£jK=LQÖTDWL � Fj\][]P�£HL%Ö/¤? Í�£jFjF>Ks[]¤/�ALs£j¤/�OK�[]N LsQ/N L¿? à DG£HFj@�Ks[�[]U��APOc � FH\][]Ps£ÁLQÖ/¤ ¦ Í�£HFjFÚ¹O[]U§LS£HU×N��ÉDpU/K�Í@�OP�£jU/\�º�N(�OPs£ �OKAǸ/N LOÇ�£Hr � FH\][]P�£HLQÖ ¤ ? ÖTDGK5[GN LSQ/NfLË? à DG£HFmÇ @�LQÖ��AUÄ�lZ��¥ZdX Ý _s_Z�± �lZ��¥ZdX�_�_ ± �¿ÇqDGU/V:K�[� FH\][]P�£HLQÖ ¤ ¦ Í�£jFHF>[]NfLSQ/N L¿? à DG£HFj@�DpKMÍ>�AFjFmcâCã�ä|ä|åKæèç�é\ç#";ç x�$ ± x�! 9:�Qî[î<;�tà £HPsK�LOÇ×U/[GLQ��LQÖ/DpL2Í:Ö(�ALQÖ(�OP2Í@�!DGP%�qPsN/U U/£jU/\ � FH\][]P�£HLQÖ ¤ ? [GP � Fj\][GPs£HL%Ö/¤ ÞfÇ×L%Ö��th�£ �AÍ[Gr^LQÖ��BDGV�h��OP�KSDGP.{ £jK7L%Ö��·KSDG¤/�Gc��!DG¤/�OF {�áBZ g _!LQÖ��·Q/N ¸/Fj£H¹�Ù��+{ £jK�£jV(�OU§LS£H¹EDGFHF {­V/£jK�LSP�£j¸/N L%�OV&%Z w _·¸�[GLQÖYDGFj\][GPs£HL%Ö/¤BK�P%�OK�QÚ[GU/VYLS[ØDpL¿¤B[]K�L w k�K�£j\]U/DpLSN/P��0º×N��APs£5�AK'%·Z ß _�¸Ú[GL%Ö:DGFH\][]Ps£ÁLQÖ/¤BKQ/£H¹�Ù ��DGU/V��ÙN/U/£Ár�[]Ps¤BF {5DpL7PsDGU/V/[]¤ DpU/V²P%�dr�N/K%�iLS[¿P��OK�QÚ[]U V�LS[¿D¿Ks£H\]UTDpLsN/P%��º×N��OP.{ÉX £Ár�¾Z¤�¿Z�X�_s_ ± �¥c � Ö��AP%�Ar�[GP%�GǧL%Ö���Q/Ps[G¸TDG¸/£HFj£HL={�L%ÖTDpLÊL%Ö���DGV�h��OP�KSDGP.{�¹O[G¤��AKlN/Q Í�£HL%Ö·DJr�[]Ps\��AP�{£jU5L%Ö��7L|Í2[B¹ODGK%�AK�£jKgL%Ö���KSDp¤��pc¾�![�Í=ÇTU/[GL%�JLQÖTDWLMLQÖ���Q Ps[]¸TDp¸/£jFH£HL={·LQÖTDWLMLQÖ��7r�[GPs\��AP�{¥£jKM\][�[�V£jK�DpFjKs[�L%Ö��=KSDG¤/��ál£HU­¸�[GL%Ö­¹ODGK%�AKOÇTLQÖ(�=r�[GPs\��AP�{£HK�\][f[�V£Hr^�¾Z¤�¿Z�X Ý _�_ ± �¿c

>)(

Page 99: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

mlN LsLs£jU/\�LQÖ(�OK%�=LS[G\��AL%Ö��OPAÇ/Í>��ÖTD¸h��3áâCã�ä|ä|åKæèç�é\ç���ç��&; # lð4;¸î$� � ð���� ï�ï+ì6575�ð�ï�ïeí �Qî��7.�� ( / ( #�� (5ï x � .0� " ð��8ílð75�#�ð " �Lì'�)�)( � � # ( Ið (5ïk � # lð�� #& lð�ï+ì)575�ð�ï�ïRí �Qî��7.�� ( / ( #���î<; # lð �Qð " ì65�#+(dî$� (5ï x u�w ¨ � � ± x u `¿Z�k�_

� U­LsN/PsU>Ç/LQÖ/£HK�£j¤BQ/Fj£ �OK2L%Ö���r�[]FjFH[�Í�£jU/\ÉL%Ö��O[GP%�O¤�á� �\ã×�,��ã?ä æ�ç�ébç��ç��� " ð�� �6ï�ï+ì 6í #+(dî$� �0�� � � #& lð 5�î$�(ï�# �Lì)5�# (dî$��í �Qð�ï[ð��)#=ð " ( �»ë�ð75�#+(dî$���0��(5ï .�ì �)(+*!ì�ð�ï�( � � .0#¤ì ��ð

�»½�� � Ä»Ê�� ���!Æ � Â/Ñ��ÝËDÀCÈÉǼËDÊ!Â/Ñ Â/Ã Õ � �"!�g[]U/K�£jV��AP�LQÖ���r�[]FHFj[�Í�£jU/\ ÇfPsDpLQÖ��AP�K�LSP�[]U/\/Ç ¹O[]¤BQ/F5�bÐf£HL={ÂDpKsKsN ¤¥Q Ls£j[]UÍá# ÓEÓE�bäØ�'��¡��Ú� æ�ç ��ç¤êlç%$�&�ã×��¼('*)ØåT�Ú¼('*+-,-'�&�ã×��¼('*,�å/�W� # ÓEÓE�bäØ�'��¡��Ú�/. �� lð��Qð�ð�� (5ï�#£ï .5�î$�(ï�#�.0�)# ¨ �10 ï+ì)57 # �.0# ;¸î$� .0/ /lí �Qî��7.�� ( / (5ï�#+(�5:ílî$/ � �Íî 8(+.0/32 #+( Ið ;�.�8( / (dð�ïNî<; �(ì'�( � � .4257 ( �Íð�ï úvû � þ � ( # �Lì'�)�)( � � #+( Ið `5Z w � « _ �

mlPvpÁZ=÷?�Qø?�%ù _�Î 5qZ76 � _ %!ú98�qÚÎ 143 á�6� `~A  I;:�þ %¯ Î û=<?> @ ü 3 ü ALü � ª o �CB ~ED �� Z=÷?�Qø?�%ù��!ú[ù ª o á�6�  ~D %I : þp_ á ¯ ± ù �tª o rè  ílî$/ � ZmI/_b÷ w ª � � «

� lð��QðGFIH ÷?�Qø?�%ù��!ú98KJ¤þ[r ZML�_ � î$� ( ��í�ì # .0� I : 2 � ( #¼ï�# �( � �¿µ � î�ì'# í�ì'#£ï ù �ON «P � ¯ ª´ PP ( Q µ (5ï �Íî$# .0�

.0/ /32 6 ï�#+�( � � +�ãSRÊ��¡���¡ ����æ�ç���ç¤êUTM&%V-WYXZ) Ò[&\]_^a`vç�� ,�ð��( b:.�� /5ð�ì ��í �Qð " (�5�# .�� /5ð�;Lì'� 5�#+(dî$�c$9d[/e/. ;�.428( / � Z��N�gfih�j_k(�gl ó�m h ò � ñ(ò�ó�ôvõWö _ � ( # ( ��í�ì'# /5ð�� � #& � Z�I/_ � î�ì #�í�ì #�/5ð�� � # ià ZmI/_ � .0� " ï[ð75+ì'�( #���×ZmI/_ (5ï " ðnb �Íð " .�ï .�d(ope ð��'5�ð=í # # �.0# �Qð�*!ì ( �Qð Ið��)#rq0î<;ts�ðnb �)( #+(dî$�\�0 �@�� (5ï-�Qð=í / . 5�ð " � ( # # lð ;¸î$/ /5î � ( � �Suwv ð�#yx ZML �zL _ �+ð .0���Iî$��. 5�/5ð .0/ � î$�( #& #& �.0# �Lì'�(ï ( � #+( Ið �×ZmI _ � lð�� ( #Bï{b ��ï�#( ��í�ì #:(5ï 6 � �� lð�� u

| P H Z 9Ê� � ë�� _lÎ �¥ZM6 � _ %Z��N�g}\�*8 _lÎ x[~a�M���7� ~�� �Aü D � Z76 � _ á�8 ± f;h�j_kTZ ë×� �g}Ú_y�

Z�}\�gl ó�m h ò Z ë×� �g}Ú_s_��È ���\ �69� �×Z�I/_âCã�ä|ä|åKæèç���ç¤êlç �� lð:ì'�)(+*!ìlðRï�( � � .0#¤ì'�Qð4( �Ië�ð75�# (dî$�-�0�� (5ï-.�dp/e � ( # �ï[ð75+ì ��( #���� � « ì'� " ð���6ï�ï+ì 6í #+(dî$���0��@ �@9:�Qî[î<;� Zme?Ù��ALs¹�Ö,_ à []FHFj[�Í�£jU \!LQÖ(�qQ Ps[�[Gr>£HUBe��O¹dLS£H[]UIÞfc ¦ ǧF �ALÊ� ± I : c � Ö��OU>Çf¸S�·uè�O¤B¤¥D�Þ c ¦ c ( ÇN/K�£jU/\ÂDpU DGV����APsKsDGP��²L%ÖTDpLJKsN/¹A¹!�!�AV/Kt£jU�¸ P%�ED3Ù�£HU/\5LQÖ(� N/U/£ º�N(� Ks£H\]UTDpLsN/P%� £HU � � « K�LQ�AQ/K7Í�£HL%ÖQ/P�[]¸TDG¸/£HFj£ÁLa� � ª � « ¹O[]P�P%�AKsQ�[]U/V/KlLS[�¹A[]¤BQ/N LS£HU/\6ù � ª P £jU Ls£j¤/� � � « Í�£ÁLQÖ�Q/P�[]¸TDG¸ £jFj£ÁLa���=Z � ª � � : _dÇÍ:Ö/£H¹�Ö�¹A[]U§LSPSDpV/£j¹dLSK�LQÖ��tDGK�KsN/¤BQ Ls£j[]UÑc� Ö��=r�[]FjFH[�Í�£jU/\iQ/Ps[]Q�[]K�£HLS£H[]U¹O[G¤¥Q/F �AL%�OKMLQÖ(�tQ £j¹ALsN/P%�3á�t�W�,�l��ÓE¡ ��¡��Ú� æ�ç ��ç���T�X�) Ò[&\�_^7`[ç��&; # lð��Qð (5ï .�d[ye Z����gfih�j_k��gl ó�m h ò � ñ(ò�ó�ôvõWö _ � ( # ( ��í�ì # /5ð�� � #& � Z�I/_ � î�ì # í�ì'#%/5ð�� � # Rà ZmI/_ � .0� " ï[ð75+ì �( #�� �×ZmI _ � # lð�� � ;¸î$� .0��� �]Ý Z�I/_�  � ZmI _ �

> >

Page 100: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

# lð���ð (5ï . d/o[e Z�� Ý ��f;h�j_k Ý �gl ó�m h ò Ý � ñ�ò�ó�ôvõWö Ý _ � ( #& ( ��í�ì # /5ð�� � #& � Ý Z�I/_ � î�ì # í�ì'# /5ð�� � # ÃSÝ ZmI _ ± 6 � .0� " ï[ð75+ì ��( #�� � Ý ZmI/_ ± �×ZmI/_ � µ ¹ �/Z ílî$/ � ZmI/_[L � � � ~��o� _ �� .�Ið�/ � � # lð ;¸î$/ /5î � ( � � (5ï.Ud(ope � ( #& �ï[ð75+ì �( #�� � Ý ZmI _�u

! � Ý Z76 � _ ± Z �¿Z76 � _ ���G_ � � lð��Qð � (5ï . à ZmI _ 2 � ( #Dï�# �( � � 57 lî[ï[ð�� .0# � .0� " î ! fih�j_k Ý Z ë�� �g}Ú_ ± fih�j_k,Z ë�� �g}Ú_���� � � lð���ð �� " ð��Íî$#�ð�ï # lð ( �)�Íð��>í �Qî " ì65�#�! ñ(ò�ó�ô�õWö×Ý Z ë§� ��}Ú_ ± Znfih�j_k,Z ë�� �g}Ú_ � ñ(ò�ó�ôvõ?ö Z ë�� ��}Ú_s_

�,�W�����¤å ��¼ æ�ç���ç� èç��0ð% �.0,�ð î�� #�.0( �Íð " .�d/o[e � ( # ( ��í�ì'# /5ð�� � #& I � î�ì #�í�ì # /5ð�� � # 6 � .0� "ï[ð75+ì ��( #���ílî$/ � Z�I/_ � UTDpLSN PSDGFÊ[GQ;�AU�Q/P�[]¸/F �O¤ £HK7LS[R\]£E����¸��ALsL%�OP=K%�A¹ON/P�£HLa�®\GNTDGPSDpU×L%�!��LS[­D�� Ceà []¸ LSDG£jU��AV

r�Ps[G¤ÀD·N/U/£5º×N��=K�£j\]UTDWLSN/P���£jUÂLQÖ/£HKMr DGK%Ö £j[]UÑÇ []PMLS[·K%Ö [�Í � ��£jV��AU/¹!�t[Gr�£j¤BQÚ[GKsKs£H¸/£jFH£HLa�Gc

�»½ � �  � ���¸Ê¸Ç:Õ�Ë Æ�� �ÉÈ0Ë�� Â/ÀDÆ Ä�Æ�ÇtÈÉÀDÆ � �"!� �AP%�pÇ'Í@��¹O[GU/K�LsPsN/¹dLÉD�� Ctà DGU V�DÂN/U £5º×N���Ks£H\]UTDpLsN/P%�ɸTDGK%�AV�[GU L%Ö�� Í@�ED�Ù3�OPiDGKsK�N/¤¥QfLS£j[GUDGFH[]U��Gc � Ö/£HKi£HK=L%Ö��BKSDG¤/�BDGK�LQÖ��IÚ�£j¹ODGFj£D�dLiDGFmc H Ú C � > > �¾¹O[]U/K�LSP�N/¹ALs£j[]UÑÇb�dÐf¹8�OQ LiLQÖTDpLtLQÖ(�N/U/V(�OPsFE��£jU/\ ���APs£ �,DG¸/F ��N/U/Q/P��OV/£H¹ALoDp¸/F5��r�N/U/¹dLS£H[]UR£jK�V/£V�Í�AP%�OU§LOc�t�W�,�l��ÓE¡ ��¡��Ú� æ�ç5æ�ç¤êcT�X�) Ò[&\�_^7`[ç��&; # lð��Qð (5ï .1d/o[e � ( #& ( ��í�ì'# /5ð�� � # � ZmI _ � î�ì'# í�ì #/5ð�� � # 6 � .0� " ï[ð75+ì ��( #�� �×Z�I/_ � # lð�� #& lð��Qð-(5ï .�d(o[e � ( # /ì'�)�Qð�ï�#+��(�5�#=ð " ( ��í�ì # /5ð�� � # � î�ì'# í�ì #/5ð�� � # 6 � .0� " ï[ð75+ì �( #�� .0#:/5ð�.�ï�# ¤B£jU*Z �×ZmI/_ � µ ! � � � ~��o� µ

! _ � Ö��tQ/Ps[�[Gr�[Gr�L%Ö��=Q/Ps[GQÚ[]K�£HLs£j[]U5\G£����AK�LQÖ���� Ceà ¹O[]U K�LSP�N/¹ALs£j[]U>Ç/Í:Ö/£j¹�ÖRÍ>�t[]¤B£HL¼Ö(�OP%�pc�![�Í�F �AL�N/KqP%�AK�LSDpLQ� � K�KsN/¤BQ Ls£j[]U�Þ c � cE6=Ls[·¤¿D�Ù3���dÐfQ/Fj£H¹O£ÁL�N/K%�t[Gr�K%�A¹ON/P�£HLa��á

# ÓEÓE�bäØ�'��¡��Ú� æ�ç5æ�ç¤êUTsÓ T�� `*'*)ØåT�Ú¼('*+-, å/ÓEÓE�bäØ����¡ ���{`vç ebî$��ï[î Ið �×ZmI/_6� ílî$/ � ZmI/_ � ;¸î$�.0/ / úvû � þ � ( ; úvû � þ (5ï . ;�.�8( / � î<;�í �Qî��7.�� ( / (5ï�#+(�5 ��ì �( � � . 57 ( �Íð�ï � ( #& �+ì �)�)( � � #+( IðkAZmI _ ± `5Z ��Z�I/_s_ � # lð�� ;¸î$� .0/ / ��� FH[]\lkAZmI/_ �

| P H Z=÷;�Qø;�%ù _ÊÎ 5qZ76 � _ %!ú98KJÚÎ 143 á�6� ��A  ��þ %ú � � ±"!

# � �8 # % ¯ � ± ù%$ � á��ƶ H � ��þ %

¯ Î û�Z·÷;�Qø_��ùr�8ú ¯ ��á���¶ H � ��þp_ á ¯ ± ù �=ª P � © 69� � � ZmI _= ��Í�£jFjF�¹A[]U/K�LsPsN/¹dLRD&�(' à Í�£HL%ÖY£jU Q/N L¥F5�OU \GLQÖ �=Z�Fj[]\:� Ý Z�I/_s_bÇqDGU/VYK��O¹ON Ps£HLa� � Ý ZmI _ ±

�*) ~hwzy|{]�o� ¸TDpK%�OV []UËLQÖ/£HK¥DpKsKsN ¤¥Q Ls£j[]U>c � � | P�[]Q�[]Ks£ÁLS£j[GU/KNÞ c ? c � DGU/V Þ c_Þ cE6]Ç2L%Ö/£jK�£H¤¥Q/FH£5�AK�D� Ceà Í�£HL%Ö­N U/P%�AK�LSP�£j¹dLQ�OV�£jU/Q N L�F5�AU/\GLQÖ­DGU V�K��O¹ON Ps£HLa�5¤¥£HU*Z�� Ý ZmI/_ � µ ! � � � ~��o� µ

! _ ± � ) ~hwzy|{§�o� c� Ö/£jK=£HK=L%Ö��·KSDG¤/�BDGK=[]N/P=N/U/£ º×N��¥K�£j\]U/DpLSN/P���¹O[]U K�LSP�N/¹ALs£j[]U>Ç�[]U F��kÖ(�OP%�·LQÖ(�BQ N/¸/Fj£H¹ÛÙ�� �DGU/V¥LQÖ��7V(�OQ L%ÖÂ[Gr*LQÖ��qLSP��!��DGP��JK�¤¿DGFHF5�APOc � Ö(�7Q/Ps[�[Gr*Í2[]P%Ù×KM£HU��dÐ DG¹dLSFE�BL%Ö��7KsDG¤��qÍMDz�¿DGKM£HULQÖ(�tQ P%� ��£H[]N/K�¹O[]U K�LSP�N/¹ALs£j[]U>c

6�0 0

Page 101: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� �\ã×�,��ã?ä æ�ç æèç���ç �� lð:;¸î$/ /5î � ( � � 5�î$�(ï�#+�Lì65�#+(dî$� (5ï8.�d[/e u ï[ð�#2� J5ü ý .0# � .0� " î ;�Qî 143 �;¸î$� 6  �K  � � �`� Fj[]\:�×ZmI _ � Ã È úK0��z6�þ v ð�# 9�� ± ú[ù � P � Ï á 6   ��  � � à ÈúK0��z63þ�þ � ë�� ± ú � J5ü ý%þ �&; � (5ï . � ( � .0����ï�#+�( � � î<; /5ð�� � # � � # lð�� /5ð�#�� � �7ZBù � º P � ¯ � P � � P _ �� lð,�ð��( b45�.0# (dî$� (5ï .�ï ( � # lð 5�î$�(ï�# �Lì)5�# (dî$� " ð�ï�5��(��+ð " ( ��ë�ð75�#+(dî$�c�0��� ��#£ï�ï[ð75+ì �( #�� (5ï .0#4/5ð�.�ï�#�×ZmI/_ ì'� " ð�� �6ï�ï+ì6í # (dî$���0C�0 �@9:�Qî[î<;� Zme?Ù��ALs¹�Ö,_ � Ö/£jKiQ/Ps[�[Gr�£HKz�OK�K%�AU×Ls£�DGFHF�� LQÖ(�5KSDG¤/�5DpK £jU�e��O¹dLS£j[GUZÞ c ¦ Ç�Í�£HL%Ö � ± � ±Fj[G\ �×Z�I/_ %:�dÐf¹8�OQ L¥LQÖ/£HKB¹ODGK%��£jK·Ks£H¤¥Q F5�OP·DpKBL%Ö��OP���£jK·U/[ƹO[�V��pc � �OP��GÇgLs[f[ Ç2Í@��Ö/[GQ;�RLQÖTDWLLQÖ(�¥DpV����APsKSDpP����hKtr�[]Ps\��OP���Í�£jFHFʸ;��\G[f[�VÑÇ'DGU/VƸS� uè�O¤B¤¿D�Þfc ¦ c ( Ç'£Hr �×ZmI _�£HK7LQÖ��·K�£��!��[prgLQÖ(�¤/�OKsKsDG\��^KsQTDp¹!�GÇpLQÖ��AU 69� �×ZmI _*[pr LQÖ(�2r�[]P�\��OP�£5�OK*Í�£HFjF§¸��2\][�[�VÑc � �t¹O[]U§LSPsDGQ�[]Ks£ÁLS£����GÇW£jUi`5Z ��Z�I/_s_PsN U/U/£jU \5LS£j¤/�GÇ�LQÖ���Q Ps[]¸TDp¸/£jFH£HLa�­[Gr2D¿r�[]Ps\��OP���£jK 69� �×ZmI/_bc � Ö(�OP%�dr�[]P%�pÇ*LQÖ���Q/P�[]¸TDG¸ £jFj£ÁLa�R[Gr2D\][�[fV5r�[GPs\��AP��£HK 69� � � ZmI _dc � Ö/£HKq¹A[]U§LSPsDGV/£j¹dLSK � K�KsN/¤BQ Ls£j[]U�Þ c_Þ cE6]c

�g[]¤ ¸/£HU/£jU \JLQÖ��MDG¸Ú[����GÇ]Í@��\��AL¾D � Ceà Í�£HLQÖÉN/U/P%�AK�LsPs£j¹dLQ�AVB£HU/Q/N LÊF5�OU \GLQÖÑÇp[]N LsQ/N LlF �OU/\GL%Ö6]ÇTDpU/V�K��O¹AN/Ps£ÁLa�

¤¥£HUÑZ � Ý ZmI/_ � µ ! � � � ~��S� µ! _ ± ¤B£jU>Z��×ZmI _ � µ � � � � wzy|{o~��¬~��o�Á� µ ! _ ±�� Z��×Z�I/_ � µ � � _ ±1� ) ~hwzy|{]�S�

c

6�0�6

Page 102: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

6�0 �

Page 103: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� � ��� ����

� ����� ����� ����� ��� � � ��� � ������������� ��� �!��� �"�����$#%�&����� ' ( )*�+�����,� � �����-��� �����

.0/21 3 Ñ�Ë$465 �ÉÈÉǼËDÊ75�Ñ8 Ö�� � � �EDGU§LS£HU���9��OU(�OPSDpFjKØZ � � �EDpU×Ls£jU�� � \GP%�!�A¤��AU§L � _RQ Ps[]¸/F �O¤ £HK�[GU���[pr LQÖ���¤¥[GK�L­P%�;:K%�ODGPs¹�Ö(�OV�DGP��EDGK�£HU V/£jK�LSPs£H¸/N L%�OVƹO[]¤BQ/N Ls£jU/\/c �!N/¤/�OP�[]N/K �pDGPs£jDpLS£H[]U/K7[Gr^LQÖ(�BQ Ps[]¸/F �O¤FÖ/D����¸��!�OUB¹O[GU/Ks£HV��OP��OV¿N U/V��OP¾V/£=<Í�AP%�AU×L^¹A[]¤¥¤ÉN/U/£j¹ODpLS£H[]U ¤B[fV(�OFjKAÇ×DGU/VB¸Ú[pLQÖ·QÚ[GKs£HLs£�����P%�OK�N/FHLsKOÇ×£mc��GcQ/P�[GLS[�¹O[]FHKOÇTDpU/V�U(�O\§DpLs£����tP��OK�N/FHLsKOÇT£mc��Gc¾£H¤¥Q�[]KsK�£j¸/£HFj£ÁLa�BDGU/V­Fj[�Í>�AP�¸Ú[]N U/V/Kq[]U�� �B¹O£5�AU/¹ �­DpU/VP%�AKs[]N Ps¹!�AKOÇ�Ö/D����7¸��!�OUI�OK�LSDG¸/FH£jK%Ö(�OVÑc 8 Ö(�7P%�ODGKs[]U¥r�[]P^L%Ö/£jK �pDGK�L2£jU§L%�OP%�AK�Lg£jK¾LQÖ��qr DG¹AL^LQÖTDWLgLQÖ(�� � �EDpU×Ls£jU��>9��AU��OPsDGFjK�Q/P�[]¸/F �O¤Õ£jK�LQÖ(�ÉDGFH\][]P�£HLQÖ ¤¥£H¹J£j¤BQ/F �O¤/�OU§LoDpLs£j[]UÂ[pr¾DB¸ Ps[§DGV ¹EDGK�L7¹�ÖTDGU?:U��AF�Í�£HL%Ö/£jU D5Q�[]£jU§L@: LS[A:|Q�[]£jU§L!U��AL|Í2[]P%Ù,c>B|UÆDGV V/£HLs£j[]U�Ls[£HLsK7£j¤BQÚ[GP�LoDpU/¹!��DpK�DÂK�LoDpU/VC:¬DpFj[]U��Q/P�£j¤B£HLS£E���pÇ2¸/P�[§DGV/¹ODGK�L¥£jKBD�Ù�� �ËLs[f[]F�£HUÌL%Ö���V(�OKs£H\]U [pr�K%�A¹ON/P���Q/P�[GLS[�¹O[]FHK�r�[]P·¤ N/FHLs£jQTDpP�La�¹O[G¤¥Q/NfLoDpLs£j[]UÑc

Ü �OK�Q/£HL%�MLQÖ���£H¤¥Q�[]P�LSDGU/¹8�M[Gr,LQÖ/£HKl¸TDGK�£j¹Mr�N/U/¹dLS£H[]UTDGFH£HLa�iDGU/V�LQÖ(�t�GDpK�L2DG¤B[]N/U§Ll[Gr�P%�AK%�ODGPs¹�ÖLQÖ/DpL6Ö/DGKJ¸��!�AU®V/£jP��O¹AL%�OV�Ls[�ÍMDGP�V/K7£ÁLEÇ,[]N/PqN/U/V��APsK�LoDGU/V £jU/\5[prlLQÖ��ÉDGFj\][GPs£HL%Ö/¤B£j¹7£HKsKsN(�OKJ£HKqr DpPr�Ps[G¤Ô¹A[]¤¥Q F5�AL%�Gc � K�£jKR� �f£HV��OU§L�r�P�[]¤Ù[]N PMP%�AKsN/FÁLSKOÇfLQÖ��AP%�tDGP%�JK�LS£HFjF;Ù�� �0D�N(�OK�Ls£j[]U KMLQÖTDpL:Ö/D����U/[GL?���dLl¸��!�OU DGV/V/P��OKsK��OVÑc,B|UiLQÖ/£HK�L%Ö��OK�£jKOÇpÍ>�MQ Ps[���£jV��2Ks[]FHN LS£H[]U/K*LS[!Ks[]¤/�g[Gr LQÖ��AK%�ED×N��AK�LS£H[]U/KAc

8 Ö���Q/P�[]¸/F5�A¤ [Gr � � �EDGU§Ls£jU��F9��OU(�OPSDpFjK7£HK�Z £HU r�[]P�¤¿DGFHF�� _2V�� �TU��AV�DpKJr�[]FjFH[�Í�K!á 8 Ö��AP%�·DGP��G QTDGP�LS£5�AKOÇ/[GU���[Gr�Í:Ö/£j¹�Ö­£jKML%Ö��H9��AU��OPsDGF>Í:Ö/[/Ö/[]FHV/K�DGUR£jU/Q N Lw}'c6B|U�DpV/V/£HLs£j[]U>ÇfLQÖ(�OP%�=£HK�DGUDGV����OP�KSDGPM�ÉÍ:Ö/[7¹A[]U§LSP�[]FjK�N/QÉLS[qk�[Gr/LQÖ(�gQTDGP�LS£ �OKÊDpU/V ¹EDpU ¹EDGN K%�gL%Ö��O¤ÄLS[�DpPs¸/£ÁLSPSDpPs£jFE�7V�� ��£�DpL%�r�Ps[G¤ L%Ö���V��OK�£j\]U/DpLQ�AV®Q/Ps[GLs[f¹A[]F�K�Q;�A¹O£ �T¹EDpLs£j[]U>c 8 Ö(�­Z¤Ö/[]U(�OK�Lo_JQTDGP�LS£5�AK7U��8�OV®LS[RDG\GP%�!�É[]U D¹O[G¤¥¤B[]U �pDGFHN��Gc à N P�LQÖ(�OPs¤B[]P��GÇÊ£ÁrMLQÖ��I9��AU��OPsDGFg£HKÉU/[GLir DGN/FÁLa�]Ç�L%Ö��OU�L%Ö/£jKi¹O[]¤B¤¥[GU��pDGFjN��¤ N/K�Lq¸;��Ö/£HK�[]Ps£H\]£jUTDpFÚ£HU/Q/N Lw}'c| �ODGK%� ð�#4.0/ ?H | e u ( 0fÇ,u�e | ( � �'Q/Ps[���£jV(�OV�DBK�[]FjN Ls£j[]U5Ls[�LQÖ�� � � �EDGU§Ls£jU��H9��OU��APSDGFHK�Q/Ps[]¸?:

F5�A¤ £jU�L%Ö�� K�LoDGU/V/DGPsV²¤B[�V��OF�Ç�£�c_�pc!L%Ö��É£HU r�[]Ps¤¥DpLs£j[]UC:mLQÖ��A[]P%�dLS£H¹�¤¥[�V��OF*Í�£ÁLQÖ²Q�[]£jU§L@: LS[A:|Q�[]£jU§L¹O[G¤¥¤ N U/£j¹ODpLS£H[]U�FH£jU��AK�Z DGU/V²U/[¿K%�ALsN/QÆDGKsK�N/¤BQ LS£H[]U/Ko_bc à []P�LQÖ��A£jPJK�[]FjNfLS£j[GUÑÇ�L%Ö�� U×N/¤ ¸��OP![Grr DGN/FÁLa�¿Q/DGP�Ls£5�OKAÇfkbÇ/¤ÉN/K�L�¸��7F5�AKsKML%ÖTDGU G � ß c à N/P�L%Ö��OP�¤¥[]P��GÇ L%Ö�� �¿¹O[]¤BQ/F �O¤/�OU§LQ�AV5LQÖ/£HKMP%�AKsN/FÁL

JLKNMPORQSO$TVUXWZYA[SW7\P]^OR_`QXab[SO$OcQSQSO@deTSfga;]h]hijORkelPfhmna;]hO@deTRo6�0 ß

Page 104: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

¸S�ÂK%Ö [�Í�£HU/\�LQÖTDWLMLQÖ���P��eD×N/£HP%�O¤/�OU§L�r�[]PMk�� G � ß £jKM£HU5r DG¹AL�£HU�Ö��AP%�OU§LOc 8 Ö/DpL�£jKAÇ/U/[�Q/P�[GLS[�¹O[]FÍ:Ö/£H¹�ÖØKs[GF����AKtL%Ö�� � � �EDGU§LS£HU�� 9��AU��OPsDGFjK=Q/P�[]¸/F5�A¤3£jU®LQÖ(�¥K�LoDGU/V/DGPsV�¤¥[�V��OFl¹ODGU�Ls[]F5�APSDpL%�·DLQÖ £jPsVR[]P�¤B[]P��7r DGN/FHLa�¿QTDGP�LS£5�AKOc

8 Ö���DG¸�[����M¸�[]N/U/V�[GUÉLQÖ��gU�N ¤ ¸;�APÊ[GrTr DGN FHLa�tQTDGP�LS£5�AK�£HUÉLQÖ��gK�LoDpU/VTDGP�V�¤¥[�V��OF�£jK�DJK%� ���AP%�Fj£H¤¥£ÁLoDpLs£j[]U>c B L!£jK�LQÖ��AP%�dr�[]P%�=[Gr�\]P%�ODpLq£j¤BQÚ[]P�LoDGU ¹!�7LS[B£jU§LsPs[�V/N/¹!�iD·V/£ <;�OP��OU§L�Z DGU/V­P%�ODGFj£HK�LS£H¹�_¤B[fV��AFg£HUØÍ:Ö/£j¹�ÖË£ÁL £jKiQÚ[GKsKs£H¸/F5�¥LS[ DG¹�Ö/£ � ����Ö/£j\�Ö(�OPÉr DGN FHLÉLs[]F5�APSDGU ¹!�Gc�Û7U��5Q�[]K�Ks£j¸ £jFj£ÁLa� £jUC:�][GF����AKgDpN/\]¤/�OU§LS£HU/\�LQÖ���K�LSDGU/VTDpPsV¿¤B[�V��OF/K�N/¹�Ö¥L%ÖTDpL^¤/�OKsKsDG\��AK2K��OU§Lg¹ODGUB¸;�qDGN L%Ö��OU§Ls£j¹EDWLQ�OV>c� ��DGN L%Ö��OU§Ls£j¹EDWLS£j[GUÑÇ�Í@� ¤/�EDGU­LQÖ�� DG¸/£jFH£HLa�¥LS[ÂDGK�¹!�AP�LoDp£jU�L%ÖTDpLJD¿¤��AKsKsDG\��iÍgDGK7£HU�r DG¹dL7K��OU§L¸S�ËD®KsQ��O¹A£��T¹ÂQTDpP�La�]ÇA� ���OUËÍ:Ö��OU U/[GL�V £jP%�A¹ALsF���P��O¹8�O£����OVËr�Ps[]¤ LQÖTDWL�QTDGP�La�]c 8 Ö/£HK·¹EDGU˸��DG¹�Ö/£ � ���OVRN/Ks£HU/\·DÉLSP�N/K�L%�OVÂQ/P��OQ/P�[f¹8�OK�Ks£jU \BQ(ÖTDGK%��£HU¿Í:Ö/£H¹�Ö�DiQ/N/¸/FH£j¹b:·Ù�� �¿£HU r�PSDGK�LSP�N/¹ALsN/P%�Jr�[GPV/£H\]£HLSDGF�Ks£H\]UTDpLsN/P%�AK Z¤�pch\/c H C e � %�( Ç`9�Ú C ()( ��_B£HK¿K��ALÂN/Q>c Z = �²U/[GL%��L%ÖTDpL¿L%Ö/£jK¥P%�7D�N £jP%�AKLQÖ/DpL�LQÖ��­DGV_���OP�KSDGPM�˸;�R¹A[]¤¥Q N LoDpLs£j[]U/DGFjFE� ¸Ú[]N U/V��OV>c � [�Í>� ���OPAÇgLQÖ(�OP%�»�bÐ £HK�LBQ/P��OQ/P�[f¹8�OKsKL:£jU \¥Q�Ö/DGK%�AK!Í:Ö/£H¹�Ö�V/[¥U/[GLqP%�7D�N £jP%�iDGUS�­¹O[]¤BQ/N LSDpLS£H[]UTDGFÑDGKsK�N/¤¥QfLS£j[GU/K'%,K%�8� | �/L �O¤¥DGU/U²DpU/V= DG£jV/U(�OP H | = > Þ ��c�_ B|U/V��!�AVÑÇ | �ODGK%� ð�# .0/ �H | e u ( 0 ÇGu�e | ( � � N K%�MK�N/¹�ÖBDGU�DGN/\G¤��AU×LSDpLS£H[]U DpU/V[]¸ LSDG£jU¥D=Q/Ps[GLs[f¹A[]F/r�[]PlLQÖ(� � � �ODGU§LS£jU(� 9��OU��APSDGFHK^Q Ps[]¸/F �O¤ Í:Ö £j¹�Ö¿¹ODGU¥Ls[]F5�APSDpL%� .0��� U×N/¤É¸;�AP[Gr'r DGN/FÁLa�¿Q/DGP�Ls£5�OK�Z�LQÖ £jKM£HK ���AP��ÂV/PsDG¤¥DpLS£H¹!¹A[]U/Ks£HV��OP�£jU/\ L%Ö���Fj£H¤¥£ÁLoDpLs£j[]U Ls[I6�� ß r DGN FHLa�¥£jU5LQÖ(�K�LSDGU/VTDpPsVˤ¥[�V��AF _dc 8 Ö�� � � �ODGU§LS£jU(� 9��AU��OPsDGFjK Q Ps[]¸/F �O¤ £jU�LQÖ £jK ¤B[fV(�OFg£HK P%�drB�OP�P%�OV�Ls[�DpK.�ì #& lð��)#+(�5�.0#�ð " � � �EDpU×Ls£jU�� 9��OU��APSDGFHKOc

� ¹O[]¤B¤¥[GU�N/K%�R[Gr � � �EDGU§Ls£jU�� 9��OU��APSDGFHK�£jK LS[ K�N/¸/K�Ls£HLsN LQ�Rr�[]P·D®¸/Ps[]DGV/¹EDpK�L·¹�ÖTDGU U��OF�c8 Ö��AP%�Ar�[GP%�GÇJ£HL£HK¹OF5�ODGP¿L%ÖTDpLÂLQÖ(�ÆK��AL�LS£jU \]K£jU:Í:Ö/£H¹�Ö Í@�®Íg[GN/FjV:ÍgDGU§L�DpU/VaU(�!�OV LS[ËP�N/U£HL¿£jUS�][GF�����¤¿DGUS� £jUS�][�¹EDWLS£j[GU/K¿[Gr�L%Ö�� � � �ODGU§LS£jU(� 9��AU��OPsDGFjK¥Q/Ps[GLs[f¹A[]Fmc 8 Ö�� D×N��OK�LS£H[]U:[GrÍ:Ö��dLQÖ��APRL%Ö��OK���Q Ps[GLs[f¹A[]FjK5P��O¤¥DG£jU:K��O¹AN/P%�®Í:Ö��AU*�dÐ��A¹ON L%�OV%¹A[]U/¹AN/PsP��OU§LSFE�]Ç7£HU:QTDGPSDpFjF5�AF![GPK%�7D×N��OU§LS£jDGFjFE� £jK=LQÖ×N/KÉDGU�£j¤BQ�[]P�LSDGU§L=[]U��Gc � [�Í@� ���OPAÇA�bÐf£jK�Ls£jU/\RÍ2[]P%Ù []UØL%Ö/£jKtQ/P�[]¸/F5�A¤ Z £HU¸�[GLQÖ·LQÖ��qK�LSDGU/VTDpPsV¥DGU/V5DpN LQÖ��AU§LS£j¹ODpLQ�AV¥¤B[�V��OFHKo_�r�[�¹ON/K��OV¿[GU¥LQÖ(�qK��O¹AN/Ps£ÁLa�¿DpU/V¥¹A[]PsP��O¹dLSU��AKsK[Gr�Q/Ps[pLS[�¹O[]FHK�£jURD·Ks£jU \]F5� �bÐ��O¹ONfLS£j[GU�[]U/FE�]c

B L £HK��ODGK�� Ls[�K%�8�¥L%ÖTDpLtLQÖ��¥N/UTDGN L%Ö��OU§Ls£j¹EDWLQ�OVØQ/Ps[GLs[f¹A[]F¾[Gr | �EDGK�� ð�# .0/ H | e u ( 0 ��ÇÊDpU/V[GL%Ö��OP7Q Ps[GLs[f¹A[]FjK!£jU�L%Ö�� K�LSDGU/VTDpPsV ¤¥[�V��AFmÇ�V/[¹O[]¤BQ�[]K%�i¹O[]U/¹AN/PsP��OU§LSFE�ËZ DGU/VÉÖ��AU/¹!��£HU®QTDGP@:DGFHF5�OF¾DpU/V�K%�7D×N��OU§LS£jDGFjFE� _dc � [�Í>� ���OPAÇlLQÖ/£HKi£HKÉU/[GLiLQÖ��¥¹EDGK��¿Í�£HL%ÖØP��OKsQ��O¹dL�LS[ .�ì'# lð��)# (�5�.0#=ð "� � �EDpU×Ls£jU�� 9��OU��APSDGFHKOc 8 Ö�� �/PsK�LlLs[=U/[GLS£H¹!�ML%ÖTDpL¾¹O[G¤¥Q�[]Ks£ÁLS£H[]U £jU�L%Ö/£jKl¤B[fV(�OF £HKlQ/Ps[G¸/F5�A¤¿DpLs£j¹Í@�OP%� 9�[]U/\ Ç/u*£jU/¹A[]FjU>Ç DGU V C N/K�Ö׸i� H 9=u C >@? �mÇfÍ:Ö/[·DGFjK�[ KsN \]\��OK�L�¤��dLQÖ/[�V/Kgr�[GPg[����APs¹O[G¤¥£HU/\LQÖ(�ÂQ/Ps[]¸ F5�O¤­cÆÛ7N/PÉÍ2[]P%Ù�K%Ö/[�Í�K�LQÖ/DpL LQÖ(�OK%�ÂK�N/\]\��AK�Ls£j[]U/K·DpU/VËDGUS��[GL%Ö��OP�K·DGP%�¥r�N LS£HF5��%¾£HUr DG¹dLɹA[]¤¥Q�[]K�£HLS£H[]U £jU LQÖ/£HKi¤B[�V��OFl£HKi£H¤¥Q�[]KsK�£j¸/F �RZ�DpKÉFj[GU/\­DGK 6�� ß []Pt¤B[]P%�·[GrML%Ö��BQTDGP�Ls£5�AKDGP��­r DGN FHLa� _dcÄZ = ��U/[GL%�­L%ÖTDpL¥¸i�̹A[]¤¥Q�[]K�£HLS£H[]UÑÇlÍ@��P%�drB�OPBLS[ÆK�LoDWLQ�OF �OK�K¿¹O[G¤¥Q�[]Ks£ÁLS£H[]U&%�K%�8�e��A¹ALS£H[]U % c � c ß r�[]P�D�r�[]P�¤¿DGFÚV/£jK�¹ON/K�Ks£H[]UÑc�_

� �'��ÒIãfÓO� � ��Ó�ç Û�N P �TP�K�LÉL%Ö��O[GP%�O¤­ÇÊK�LoDpL%�OV�¸��OFH[�Í=Ç�K%Ö/[�Í�KÉL%ÖTDpL�DpN LQÖ��AU§LS£j¹ODpLQ�AV � � �EDGU?:LS£HU�� 9��AU��OPsDGFjK�Q/P�[GLS[�¹O[]FHKOÇ,¸�[GLQÖ­V��AL%�OP�¤¥£HU/£jK�LS£j¹tDGU V�PSDpU/V/[]¤B£��8�OVÑÇT¹ODGU/U/[GL!¸��ɹO[G¤¥Q�[]K%�AV�£HUQTDGPsDGFjF �OFÑZ�DGU/V·LQÖ×N/K¾¹A[]U/¹ON PsP%�AU§LSF�� _bc 8 Ö/£jK¾£jK¾D�K�N/PsQ/P�£jK�£jU/\tDGU/VBQ�[�Í@�OP�r�N/F,K�LSDpLQ�A¤��AU×L¾Í�£ÁLQÖ·P%�;:KsQ��O¹dLgLs[tL%Ö��!£HKsK�N��![pr��OU(ÖTDGU/¹A£jU/\tLQÖ��qK�LSDGU/VTDGP�V¿¤B[fV(�OF/¸S�·LQÖ��!DGV/V £HLS£H[]U·[Gr*DpN LQÖ��AU§LS£j¹ODpLS£H[]UÑc8 Ö�� L%Ö��O[]P��O¤ K%Ö/[�Í�K7L%ÖTDpL7L%Ö/£jKt�OU�ÖTDpU/¹!�A¤��AU×L " î[ð�ï �Íî$# Q/Ps[���£jV��iLQÖ���Dp¸/£jFH£HLa�ÂLS[¿[9���OP�¹O[]¤/�LQÖ(�É£j¤BQ�[]KsK�£j¸/£HFj£HLa�¿P%�AKsN/FÁL!Í:Ö��AU ¹O[]¤BQÚ[GKs£HLs£j[]UR£HKJP%�7D×N/£jP��OVÑc 8 ÖTDpL7£HKOÇ�£HrÊL%Ö��OP��É£HK7D¿U��8�OV�r�[GPQTDGPsDGFjF �OF*¹A[]¤¥Q�[]K�£HLS£H[]UÑÇ/L%Ö��OU�L%Ö��ÉU×N/¤É¸;�AP7[GrÊr DGN FHLa�RQ/FjD����OP�K7¹EDGU U/[GL!¸;� G � ß [GP!¤B[]P%�pÇ>DpU/VÖ��AU/¹!�=LQÖ��tDGNfLQÖ��AU×Ls£j¹ODpLQ�AV�¤B[fV(�OFÑQ/P�[��f£HV��OK�U/[¥DGV��pDGU§LSDG\���[����APqL%Ö��=K�LoDpU/VTDGP�V�¤B[fV(�OFmc

6�0��

Page 105: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� �\ã×�,��ã?ä ";ç¤ê�ç¤êlç ��î�í �Qî$#�î�5�î$/�;¸î$� .�ì #& lð��)#+(�5�.0#�ð "�� ����.0�)# ( �Íð � � �Qð�ð Ið��)# # �.0# 5�î 6ílî[ï[ð�ï( �Ií�.0� .0/ /5ð�/ Z ð�,�ð�� # � (�5�ð _ 5�.0� #=î$/5ð���.0#=ð G � ß î$� Iî$��ð ;�.�ì'/ #���í�.0�#+(dð�ï C �O\§DGP�V/£jU \ÉLQÖ�� D�N(�OK�Ls£j[]UÂ[pr�K��eD×N��AU×Ls£�DGF>¹O[]¤BQÚ[GKs£HLs£j[]U>Ç×Í@��K%Ö [�ÍaV/£=<Í�AP%�OU§L�P��OK�N/FHLsKOc = � �TPsK�LQ/P�[9���ÉDpU/[GLQÖ(�OPiZ�Í@�ED�Ù3�OPS_�FH[�Í@�OP�¸�[]N/U/VÂr�[]P " ð�#=ð���8( �)(5ï�# (�5 Q/P�[GLS[�¹O[]FHK!á� �\ã×�,��ã?ä ";ç¤ê�ç���ç v ð�#�� �+ð:. V��AL%�OP�¤¥£HU/£jK�LS£j¹ í �Qî$#=î�5�î$/ ;¸î$� .�ì'# lð��)# (�5�.0#=ð "�� ����.0�)# ( �Íð � � �Qð�ð 2Ið��)#�# �.0# #=ð���8( � .0#�ð�ï � ( # ( � � �Qî�ì'� " ï�î<; 5�î Ûì'�)(�5�.0#+(dî$� �� lð�� � � 5�.0� �+ð:ï[ð�*!ìlð��)# (+.0/ / �5�î 6ílî[ï[ð " .0# Iî[ï�# � ��� 6 #+( Ið�ï B|U�¹O[GU×LsPSDGK�LEÇGr�[GP � .0� " î 8(��ð "2Q/P�[GLS[�¹O[]FHK�Í@�M[]¸fLoDG£HU QÚ[GKs£HLs£����2P��OKsN FHLSKÊDGU/V Q/P��OK��OU§L^DJQ/P�[GLS[�¹O[]FÍ:Ö/£H¹�Ö�¹EDGU�¸;�B¹O[G¤¥Q�[]K%�AVØK��eD×N��OU§Ls£�DGFHF�� Z�DpUi�ÆQ�[]F���U/[G¤¥£jDGF�U×N/¤ ¸��OPi[GrgLs£j¤/�OKS_dÇ�DGU/V�Í:Ö £j¹�ÖLS[GF5�OPsDpLQ�AKÊk�� G � � r DGN/FÁLa�ÉQ/DGP�Ls£5�OKAc 8 Ö���Q/P�[GLS[�¹O[]F�Í:Ö/£j¹�Ö·Í@�qQ P%�OK��OU§L^£jKl¸TDpK%�OVB[]UBD7Q/P�[GLS[�¹O[]F[Gr à £ÁL�O£]DGU/V�Ú�DGN/P��OP HTà Ú�0 0K�]LQÖTDWLÑLS[]F �OPsDpLQ�AKÑk � G � � r DGN/FÁLa�7QTDGP�LS£ �OKOÇ�DpU/V=£jK*£jU7L%Ö��¾K�LSDGU/VTDGP�V¤B[fV��AF�DpN/\]¤/�OU§LQ�AV�Í�£HL%Ö®DGU²£HV��EDGF'LQÖ P%�!�;:|QTDpP�La��¸/Ps[§DpV/¹EDGK�L�Q/P�£j¤B£HLS£E���pc = � K�Ö/[�Í9L%ÖTDpL!LQÖ/£HKQ/P�£j¤B£HLS£E���7¹ODGU�¸��=P%�AQ/F�DG¹8�OV­¸S��DpU�DGNfLQÖ��AU×Ls£j¹ODpLQ�AV�Q/P�[GLS[�¹O[]FÚr�[]P�LQÖ/P��!�tQTDGP�Ls£5�AK�L%ÖTDpLq¹EDpU�¸��¹O[G¤¥Q�[]K%�AV¥K��eD×N��AU×Ls£�DGFHF��ÂZ�DGU/V·LQÖ(�qP��OK�N/FHLs£jU/\=Q/P�[GLS[�¹O[]F/DGFjK�[t¹A[]¤BQÚ[]K��OK¾K%�7D×N��OU§LS£jDGFjFE� _dc 8 Ö×N/KAÇÍ@�iQ/P�[�����á� �\ã×�,��ã?ä ";ç¤ê�ç� �ç��6ï�ï+ì Ið # �.0# # lð��QðÉð�� (5ï�#Bï .Éï�( � � .0#�ì �Qð�ï�57 lð Ið #& �.0# (5ïkð�� (5ï�#=ð��)# (+.0/ / �ï[ð75+ì ��ð . � .0( �(ï�# 57 lî[ï[ð�� Ið�ï�ï . � ð .0#+# . 5�[ï �� lð�� #& lð��Qð�ð�� (5ï�#£ï . � .0� " î 8(��ð " í ��î$#=î�5�î$/�;¸î$�.�ì #& lð��)#+(�5�.0#�ð "�� ����.0�)#+( �Íð� tð��Íð���.0/aï � ( # . �+î�ì'� " ð " �lì �+ð���î<; �Qî�ì � " ï � # �.0# #=î$/5ð���.0#=ð�ïk � G � � ;�.�ì'/ #���í�.0�#+(dð�ï .0� " 5�î 6ílî[ï[ð�ï ï[ð�*!ìlð��)# (+.0/ / � .0����ílî$/ � �Íî 8(+.0/ �lì �+ð��zî<; #+( Ið�ï = ��DGFjK�[5Q/P��OK%�AU§LtD5PSDGU/V []¤¥£ �!�AV � � �EDGU§Ls£jU��F9��OU(�OPSDpFjK7Q/P�[GLS[�¹O[GF�L%ÖTDpL7Ls[]F5�APSDpL%�OK .0��� U×N/¤F:¸��OPB[GrJr DGN FHLa�ËQTDGP�LS£ �OKOÇgDGU/V ¹O[]¤BQÚ[GK%�OKBK%�7D×N��OU§LS£jDGFjFE�ÌDGUS�ËQÚ[GF���U/[]¤B£�DGF2U×N/¤ ¸��OPB[Gr7LS£H¤��AKOc� [�Í@� ���OPOÇ^LQÖ��ÂU×N/¤É¸;�AP�[GrJ¤/�OK�KSDG\��OK�K%�AU§L¥£HU�LQÖ/£HK Q/P�[GLS[�¹O[]F2£jKÛ�bÐ Q�[]U��AU§LS£�DpFM£jUØL%Ö��RU×N/¤F:¸��OP7[Gr^QTDpP�LS£ �OKAc 8 Ö��OP��Ar�[]P��GÇ*£HLJ¹EDGU®[GU/F���¸;�ÉN/K%�AV Í:Ö(�OU®LQÖ���[����OPSDpFjF�U×N/¤É¸;�AP7[Gr^QTDGP�LS£5�AKJ£HKFj[G\§DGPs£ÁLQÖ/¤B£j¹q£jUÂL%Ö��=K%�O¹AN/Ps£ÁLa�ÂQTDGPsDG¤/�ALQ�AP�[Gr�LQÖ��=Ks£H\]UTDpLsN/P%�=K�¹�Ö��O¤/�Gc

� �Ø���\ãIVRÓ!ã5��� VR��¡ ÖÑ�\ã��ÍãfÓOÓE¡ �����A�bã��Ú��¡nRÝã×�pÓ3ç � K¾Í�£jFHFT¸;�qDGQ QTDGP%�AU§L2r�P�[]¤ LQÖ(�!Q/P�[f[pr�K[Gr7L%Ö���FH[�Í>�AP¥¸�[]N/U/V K Z 8 Ö��A[]P%�A¤¥K % cE6]c�6�DGU/V % c�6Gc � _bÇgÍ:ÖTDpL¿Q/P%� ���AU×LsKRDG\]P��!�O¤/�OU§L¿£jUËLQÖ/£HKK%�dLsLs£jU/\5£HKqL%Ö��Ér DG¹dLJL%ÖTDpLtÖ/[]U��AK�L�QTDpP�LS£ �OK!¹EDGU/U [GLJL%�OFjF�£jU­Í:Ö/£j¹�ÖÉ�bÐ��O¹ONfLS£j[GU²[GrlLQÖ(�ÉQ/P�[GLS[�¹O[]FD�\]£����OUR¤/�OKsKsDG\���ÍgDGKqDGN LQÖ(�OU§LS£H¹EDpL%�OVÑc 8 Ö/£HK!DpFjFj[�Í�KgL%Ö��=DGV����OP�KSDGPM�ÂLS[�?�¸�[]PsP�[�Í�@·¤/�OK�KSDG\��AKr�Ps[G¤ [GU����dÐ��A¹ON Ls£j[]U�Ls[®DGU/[GL%Ö��OPAÇlDGU/V�¸S�ÆLQÖTDWL�DpL�LoDG¹�Ù LQÖ��¥K���K�L%�O¤­c B|UÌe��O¹dLS£H[]U % c ? Ç�Í@�K%Ö [�Í LQÖTDpLt£Ár2Í@�Br�N P�LQÖ(�OPtDGN/\]¤/�OU§L=LQÖ(�¥DpN LQÖ��AU§LS£j¹ODpLQ�AVؤB[fV(�OFÊK�[�LQÖ/DpL=N/U/£ D�N(�¿DGU V�¹A[]¤F:¤B[]U £HU/V/£j¹8�OK¥DGP%��DGK�Ks£j\GU��OVÌLS[|�ODG¹�Ö`�dÐ��A¹ON Ls£j[]UÑÇML%Ö��OU K%�O¹AN/Ps£ÁLa�ÌN/U/V��AP¿¤¥DGUS�˹O[]U/¹AN/PsP��OU§L�dÐ��A¹ON Ls£j[]U/Kq¹EDpU�¸��=DG¹�Ö/£ � ���AV�Z r�[]P�DGUS�RU×N/¤ ¸��OP�[Gr�r DGN/FHLa�¿QTDGP�LS£5�AKo_bc

8 Ö×N/KOÇ�[]UËLQÖ���[]U���ÖTDGU/V>ÇM[]N/PBP%�AKsN/FÁLSKBK�LSP��OU/\pLQÖ��AU LQÖ���¹O[]¤B¤B[]U˸;�AFj£5�dr!L%ÖTDpL¥K%�AKsKs£H[]U£jV(�OU§LS£ �l�OP�K�DpP%�^U��O¹8�OKsKsDGP��=r�[]P�DG¹�Ö £5� ��£HU/\JDpN LQÖ��AU§LS£j¹ODpLQ�AV � � �ODGU§LS£jU(�E9��OU��APSDGFHKOc�Û7UtL%Ö��2[pLQÖ��APÖTDGU VÑÇ*Í>�·K%Ö [�Í LQÖTDWL=KsN/¹�Ö�£jV��AU×Ls£��l�APsK 5�.0�)�Íî$#��+ð � ð��Íð�� .0#=ð " � ( # ( � #& lðzï �vï�#=ð c 8 �fQ £j¹EDpFKsN \]\��OK�LS£H[]U/K=r�[]Pi\��OU��APSDpLs£jU/\­K%�AKsKs£H[]UØ£HV��OU§Ls£��l�APsKt£jUÆQ/PSDG¹dLS£H¹!�B£jU/¹AFjN/V��NÖTDz��£jU \�LQÖ(�09��OU��APSDGF¹�Ö/[�[]K%�·[]U(�GÇ�[]P�ÖTDz��£jU/\ÂLQÖ(�BQ/DGP�Ls£5�OK��bÐ ¹�Ö/DGU/\��BPSDGU V/[]¤ K�LSPs£HU/\]K=DGU V�K��AL=LQÖ��·£HV��OU§LS£ �l�OP7Ls[¸��iLQÖ(�ɹO[GU/¹EDpL%�OUTDWLS£j[GU�[Gr¾DpFjF*LQÖ��AK%� K�LSP�£jU/\]KAc � [�Í>� ���APOÇ 8 Ö��A[]P%�A¤ % cE6]cE6ÉP�N/F5�AK![]NfL�DGFHF*KsN/¹�ÖKs[GFjN Ls£j[]U/K®Z U/[GLs£j¹8�²LQÖTDpL "�N K�L­¹O[]¤B£jU \�N/Q:Í�£HLQÖ D�¹O[G¤¥¤B[]U:£jV(�OU§LS£ �l�OP£HUi�G[]F����OKRP%�ODG¹�Ö/£HU/\DG\]P��!�A¤��AU×Lo_dc C DpLQÖ��APOÇÑ[GU���¤ N/K�L=DGKsK�N/¤/� LQÖ����bÐf£jK�L%�OU/¹8�·[Gr^Ks[]¤/� #+�+ìHï�#=ð " ð�� #=ð���� .0/ Ið�.0�(ï

6�0 ?

Page 106: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

r�[]P�¹A[]¤¥£HU/\·N/QRÍ�£HLQÖ­N/U/£ D×N��tDGU/V­¹O[]¤B¤¥[GU­£HU/V/£H¹!�OKAc 8 Ö £jK�K%�8�O¤BKqLs[B¸��iD ���OPM��V £��B¹ON/FÁLEÇ/£ÁrU/[GL�£H¤¥Q�[]K�Ks£j¸ F5�GÇ DGKsK�N/¤BQ LS£H[]UÂLS[·P%�ODGFj£ �!�7£HU­¤¥DGUS�ÂUTDWLSN/PsDGFÑK%�dLsLs£jU/\]KAc

� UTDpLSN PSDGF D×N��AK�Ls£j[]UBLS[tDGK%ÙzÖ��OP��qP��OFjDpLQ�AK¾Ls[�LQÖ���r DG¹dL^L%ÖTDpL¾N/U £ D×N��qDGU/VB¹O[]¤B¤B[]U�K%�AKsKs£H[]U£jV(�OU§LS£ �l�OP�K DGP��¿DGUS�×ÍgD��ØU��!�AV��OV�£HU�[GPsV��APiLS[�¹O[]P�P%�A¹ALSFE�ÆPs[]N L%�¿£HU/¹O[]¤B£jU \­¤/�OK�KSDG\��OKiLs[�LQÖ(�Ps£H\�Ö§Lt¹O[]QS�Æ[GrML%Ö��¥Q Ps[GLs[f¹A[]FmÇ*Í:Ö��AU�K%� ���OPsDGFg¹A[]Q/£ �OKt[GrgL%Ö��¿Q/P�[GLS[�¹O[GF¾DGP%�BPsN/U U/£jU/\�¹O[]U ¹ON/PL:P%�AU§LSF��GcjB|U/V��!�AVÑÇÑ\]FH[]¸TDGF*K��OK�Ks£j[GU²£jV��AU§LS£����OPsK!Ks[]FE���tLQÖ/£HK!Q/P�[]¸/F �O¤­c � [�Í>� ���APOÇÑ£ÁLJDpFjKs[¥KsN��B¹8�OKr�[]P��ODG¹�ÖØQTDpP�La�²Ls[�DpFjFj[�¹EDWLQ� /5î�5�.0/ £jV��AU§LS£����OPsK�r�[]P�£ÁLSK��OFHr¬c 8 Ö/DpLt£jKOÇÑÍ:Ö(�OU�DÂQTDpP�La� ¸��O\]£HU/K=DU��dÍ �bÐ��O¹ONfLS£j[GUÑÇ]£HL�¹�Ö/[�[]K%�AKlDJN/U £ D×N��g£HV��OU§Ls£��l�AP2� ���=DGU/VÉ£jU r�[]P�¤¥K�DGFHF×QTDGP�Ls£5�AK�Ls[7¹O[]U ¹EDpL%�OUTDpL%�� ���5LS[RDpUi��¤/�OKsKsDG\��ÉL%Ö�� ��K%�AU/V�Ö/£j¤ÕÍ�£ÁLQÖ/£HU�LQÖ/£HK6�bÐ(�A¹ON Ls£j[]U>c B L�£jKqLQÖ��AU®\]NTDGPsDGU§LQ�!�AV²LQÖTDWLDGUS�R¤/�OKsKsDG\��=K%�AU§LJ¸S�­DGU»Ö/[]U(�OK�L!QTDGP�La�ÂLS[BDGU/[pLQÖ��APeÖ []U��OK�LJQ/DGP�La�5Í�£HFjFѸ��=V/£jP��O¹dLQ�OVRLS[·LQÖ(��dÐ��A¹ON Ls£j[]U®£ÁL7¸��OFj[GU/\]K!Ls[/c = �ÉLQÖ×N/K�¹A[]U/¹OFHN/V��ÉL%ÖTDpL!r�[]PJLQÖ(� Q/N/P�QÚ[]K��OK�[Gr¾¤/�OK�KSDG\�� Ps[]NfLS£jU \£jUR¹A[]U/¹ON PsP%�AU§L6�bÐ(�A¹ON Ls£j[]U KOÇ,\]Fj[G¸TDGF>£HV��OU§Ls£��l�APsKqDGP%��U [GLqU��!�AV��OVÑc

Û7N/P�£j¤BQÚ[]K�Ks£H¸/£jFH£HLa��P��OKsN FHLSKqDGP���£jUÂLQÖ(��¤¥[�V��OFÚLQÖTDpLqDpKsKsN ¤��AKqK�[]¤/��£jU/£ÁLS£�DpFj£��ODpLS£H[]U·Q�ÖTDGK��¸��Ar�[]P��2LQÖ(�@�bÐ(�A¹ON Ls£j[]UÉ[Gr,DGUS�iQ/Ps[GLs[f¹A[]F×K�LSDGP�LsKOc 8 Ö×N/KAÇGÍ@�MK%Ö/[�ÍËLQÖ/DpL�U [J£jU £HLS£jDGFj£ �EDpLs£j[]U!Q�ÖTDGK��¹EDpU�K%�dLJN Q­L%Ö��iQ Ps[GLs[f¹A[]F*£jURKsN ¹�Ö®D·ÍgDz�ÂLQÖTDWLJ\]FH[]¸TDGFÚ£jV��AU§LS£����OPsK�Í�£jFHFѸ��tP��EDGV £jF��5Dz�GDp£jF�Dp¸/F5�[]P �ODGKs£HF����OK�LoDG¸/FH£jK�Ö��OV®r�[]P7¹A[]U/¹AN/PsP��OU§LEÇ'[]P�� ���OUÆQTDGPsDGFjF �OF�Ç;�bÐ(�A¹ON Ls£j[]U [Gr^Q/P�[GLS[�¹O[GFjKOc = ��V/[U/[GLqP�N/F5��[]NfLqL%ÖTDpLqKs[G¤����dÐ�L%�OPsU/DGF�DGNfÐf£jFH£�DGPM�¿£HU/Q/N LsKOÇTKsN ¹�Ö®DGKqDB\GFj[]¸TDpF>¹OFH[f¹�Ù,Ç,¤¥D��¿\]£����=N/KDGQ/Q Ps[]Q/P�£�DpL%��K%�AKsKs£H[]U­£jV��AU×Ls£��l�APsKAc B|U V��!�AVÑÇTLQÖ/£HK�£jK�D�KsN/¸ "��O¹ALJ[Gr�r�N/P�L%Ö��OP�K�LsN/V��Gc

�8äØ� � ¡  �å ��¡��Ú��Ó �m��� ��ã� §�'�vã )Ä� � ��¡��Ýå ���b¼ ��äØ���'�[åf��¡ ����Ó�ç � K¾Í>�eÖTDz���qK�LSDpLQ�AV¿DG¸�[����pÇ[]U��R£H¤¥Q�[]P�LSDGU§L N/K��Âr�[]P � � �EDGU§Ls£jU�� 9��OU��APSDGFHK�Q/Ps[GLs[f¹A[]FjKÉ£jK LS[ K�N/¸/K�Ls£HLsN LQ�ÂLQÖ(�­¸ Ps[§DGV ¹EDGK�L¹�ÖTDGU U��OF�£jU­D·¤ N/FHLs£jQTDpP�La�¥Q/Ps[GLs[f¹A[]Fmc6B|U­r DG¹ALOÇT¤¥[]K�L:Ù×U/[�Í�U²Ks[]FHN LS£H[]U/KMr�[]P�¤ÉN/FHLs£jQTDGP�La�5¹A[]¤F:Q/N LSDpLS£H[]U/K�DGK�KsN/¤/�gD�¸/P�[§DGV/¹ODGK�L�¹�ÖTDGU/U(�OFmÇp¹OFjDG£j¤B£jU/\2LQÖTDpL�£ÁL'¹EDGUi¸;�^KsN/¸ K�LS£ÁLSN L%�OVi¸i�tD � � �EDGU?:LS£HU��F9��OU��APSDGFHK�Q/Ps[pLS[�¹O[]F�Í�£HLQÖ []N L=DGUS�®¹A[]¤BQ/Fj£H¹EDpLs£j[]U/KActÛ7N/P�P%�AKsN/FÁLSK7LQÖ(�OP%�dr�[]P%��£H¤¥Q F��RLQÖTDWL¤ N/FÁLS£HQTDGP�La�ÆQ/P�[GLS[�¹O[GFjKÉL%ÖTDpL·P%�AF��Ø[]UËDGN L%Ö��OU§LS£H¹EDpL%�OV � � �EDGU§Ls£jU�� 9��OU��APSDGFHK LS[ P%�AQ/F�Dp¹!�5LQÖ(�¸/P�[§DGV/¹ODGK�Lq¹�ÖTDGU U��OF�ÇT¹EDGU/U [GLq¸;�=¹O[G¤¥Q�[]K%�AVR£jURQTDGPsDGFjF �OF>[GP�¹O[]U/¹AN/PsP��OU§LSFE�]c

� U/[pLQÖ��APB£H¤¥Q�[]P�LoDGU§L�£H¤¥Q/FH£j¹ODpLS£H[]U�[prJ[]N P�P%�OK�N/FHL·£HK�V/N��ÂLS[®L%Ö��Âr DG¹AL�L%ÖTDpLBDGUS��K��O¹ON P%�Q/P�[GLS[�¹O[]F�r�[]PÊK�[]F���£jU \�� ð��Íð�� .0/ ¤ÉN/FHLs£jQTDGP�La�=LoDGK�Ù�Kl¹ODGU·¸;�gN/K%�AVBLs[�Ks[]FE��� � � �EDpU×Ls£jU�� 9��OU(�OPSDpFjKOc8 Ö��AP%�Ar�[GP%�GÇ�U/[]U(��[GrÚL%Ö��OK��!Q Ps[GLs[f¹A[]FjKʹODGUB¸;��¹A[]¤¥Q�[]K��OVB£jU�QTDGPsDGFjF �OFf[]Pl¹O[]U ¹ON/P�P%�OU§LsF��]Ç×N/U F5�OK�K¤B[]P%�7L%ÖTDGU � � ß [Gr�LQÖ��=QTDpP�LS£ �OKqDGP���Ö/[]U��AK�L![]P�D�Q�ÖS�fK�£j¹ODGF'¸/Ps[§DpV/¹EDGK�Lq¹�ÖTDGU/U��AF'£jK�Dz�pDG£jFjDG¸/F5�pc

� �'��� �,� ���'Ó3ç ��äØ�l��ÓE¡���¡ ���R� � �Íãf §�'�vãG)Ä� ����¡��bå/���d¼ �t���T���* ]����Ó3ç 8 Ö��AP%�@ÖTDGK�¸;�8�OU¤ N/¹�Ö5Í2[]P�Ù¿[]U5L%Ö��JLS[GQ/£j¹![Gr'Q/Ps[pLS[�¹O[]FÚ¹O[]¤BQÚ[GKs£HLs£j[]UB£jU¥LQÖ��7¹A[]U§LQ�bÐfL�[pr'¤ N/FHLs£jQTDpP�La�B¹O[]¤BQ/NC:LoDWLS£j[GU H � �ED > � Ç�Ú C > � Ç��MDGU�040 Ç Ü Ú�0 0 Ç��MDGU�0_6��mcDÚ�N/¹�Ö5[Gr>LQÖ/£HK¾Í2[]P�Ù/Ö/DGK^r�[�¹ON K%�OV¿[]U �8�OPs[A:Ù×U/[�Í�F5�AV/\��^DGU/Vt¹O[]U ¹ON/P�P%�OU§L �!�APs[ :·Ù�U [�Í�F �OV/\��^Q Ps[GLs[f¹A[]FjK H 9� > Þ�Ç Ü �7e >)( Ç C � > > Ç��� |¾C 0_6��mcà []P��dÐ DG¤BQ/F5�pÇ�9=[]FHV/P%�A£j¹�ÖÆDGU/V���PSDEÍg¹ � �?Ù H 9 � > ÞK�¾K�Ö/[�Í LQÖTDWLtL%Ö��OP����bÐf£jK�LiQ/P�[GLS[�¹O[]FHK7LQÖTDWLDGP�� �8�OPs[A:=Ù×U/[�Í�F5�AV/\��¥Í:Ö(�OU �bÐ(�A¹ON L%�OV�K�LoDGU/V?:¬DGFH[]U��GÇ�DGU V ���dL V/[�U/[GLi¹O[]¤BQ�[]K%�B£jUÆQTDGPsDGFjF �OFZ¤� ���AU�L|Í�£j¹!�E_dc � [�Í>� ���APOǾQ/Ps[pLS[�¹O[]FHKtL%ÖTDpLi¹O[]¤BQÚ[GK%�¿V [0�dÐf£HK�LRZ�K%�8�GÇÊr�[]P��dÐ DG¤BQ/F5�pÇ69�[]FjV/P��b:£j¹�Ö H 9�[]F�0 � �!DGU/V P%�ArB�AP%�AU/¹!�AK5LQÖ��AP%�O£HU,_dc B|UY¹A[]U§LSPSDpK�LEÇMÍ@�²K�Ö/[�Í L%ÖTDpL¥£HL¥£jKB£j¤BQÚ[GKsKs£H¸/F5�5Ls[[]¸ LSDG£jU .0����í �Qî$#�î�5�î$/ LQÖ/DpL�Í�£jFjFÚ¹O[]¤BQ�[]K%�7L|Í�£H¹!�=£jURQTDGPsDGFjF �OF�c

6�0�Þ

Page 107: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

.0/�� � Æ���ÑÉÊ8ËDÊ75�Ñ��� ��M��" ��0��Ü-�<!. ��./+�021���� 0q;�$ �= �t¹A[]U/K�£jV��AP!D·K%�dLsLs£jU/\·£jUS�G[]F���£jU \ G Q/DGP�Ls£5�OKAÇ�� � � � � �y� ���fÇ/L%ÖTDpLq£jU§L%�OPSDp¹AL�£jU­D ï � � 57 �Qî$�Íî�ìHïQ�[]£jU§LR:mLS[ : QÚ[G£jU§L^U��AL|Í2[]P%Ù,c B|URKsN/¹�Ö�D U��AL|Í2[]P�Ù�Çl�ODG¹�ÖRQTDG£HPM[Gr�QTDGP�LS£5�AKM£jK2V/£jP��O¹dLSF��¥¹O[GU/U��O¹dLQ�AVÑÇDGU/VØ£HLt£jKiDGKsK�N/¤/�OVØL%ÖTDpLÉL%Ö��5DpV����APsKSDpP���¹EDGU/U [GLɤB[�V/£Hr��®¤/�OK�KSDG\��OK K��OU§L ¸��AL|Í@�!�AU�Ö []U��OK�LQTDGP�LS£ �OKOcB|UYLQÖ £jKÂK%�dLsLs£jU/\/Ç:�ODG¹�ÖaQ/DGP�La� £jK¥r�[GPs¤¥DGFjFE�ˤ¥[�V��OF �OVY¸S� DpU:£jU§LQ�APSDG¹dLS£���� 8 N/Ps£HU/\¤¥DG¹�Ö/£jU(�gÍ�£HL%Ö G �-6�QTDG£HPsKÊ[Gr�¹A[]¤¥¤ÉN/U/£j¹ODpLS£H[]UiLSDGQ��OKOc 8 Ö���¹O[]¤B¤ N/U £j¹EDWLS£j[GUÉ[Gr,LQÖ(�MU��AL|Í2[]P�ÙQ/P�[f¹8�!�OV Kq£HUÂK���U/¹�Ö/P�[]U/£ �!�OV­Ps[GN/U/V/KAÇ Í:Ö��OP����EDG¹�Ö­Ps[]N U/V¹O[]U Ks£jK�LSK�[Gr�D ï[ð�� "JQ�ÖTDpK%��r�[]FjFH[�Í>�AV¸S�­D ��ð75�ð�( ,�ð Q�ÖTDpK%�Gc6B|URLQÖ�� ï[ð�� "�Q�ÖTDGK��=[Gr �ODG¹�Ö�P�[]N/U/V>Ç/LQÖ��=QTDGP�LS£ �OKMÍ�Ps£ÁLQ�=¤/�OKsKsDG\��AKq[GU×Ls[LQÖ(�O£jPi[]N LsQ/N LÉLSDGQ��OKOÇÊDGU/V�£jUÆLQÖ�� �Qð75�ð�( ,�ð Q�ÖTDGK��GÇÊLQÖ(�¿QTDGP�LS£ �OKÉP��EDGV�LQÖ��5¹A[]U§LQ�AU×LsK�[GrML%Ö��O£HP£jU Q/N L�LoDpQ;�AKOc

8 Ö/£jK!QTDGQ��OPqP%�drB�OPsKqLS[·LQÖ�� .�ì'# lð��)#+(�5�.0#�ð "i¤B[�V��OF�Ç/Í:Ö��OP��ÉKs[G¤��=La��Q;�i[Gr #+�+ìHï�#=ð " í �Qð=í �QîK25�ð�ï�ï�( � � í) �.�ï[ð £HKÉDGK�KsN/¤/�OV>c 8 Ö/£HKÉ£HKi¤B[fV(�OF5�AV�¸S�ØDGFjFlQ/DGP�Ls£5�OKiDGFHKs[0Ö/D���£HU/\²DGU�DGV/V/£ÁLS£j[GUTDGF����� ������������� LQÖTDWLg£HK^\��OU��APSDpL%�OV5V/N Ps£jU \iLQÖ(�JQ/P��OQ/P�[f¹8�OKsK�£jU/\ÉQ�ÖTDGK��Gc 8 �fQ £j¹EDpFjF��GÇ×£jUBKsN/¹�ÖRDtQ/P%�;:Q/P�[f¹8�OKsK�£jU/\BQ�ÖTDpK%�GÇ,D·Q/N/¸ Fj£j¹;:=Ù3� �5£HU r�PSDpK�LSP�N/¹ALsN/P%�=[Gr�Ks£H\]UTDpLsN/P%��Ù3� ��KJ£HK�\��OU(�OPSDWLQ�OV>c 8 Ö/DpLq£jKOÇ�EDp¹�Ö¥QTDpP�La� P��O¹8�O£����OK¾£HLsKÊ[�Í�U¥K��O¹AP%�AL^K�£j\]U/£HU/\ Ù3� �]Ç�DGU VB£HU·DGV/V/£ÁLS£H[]UÑÇGQ N/¸/Fj£H¹ ���APs£ �T¹EDpLs£j[]UÛÙ3� ��KDGK�Ks[�¹O£�DWLQ�OV®Í�£ÁLQÖ DGFHF�[GL%Ö��OP�QTDpP�LS£ �OKAcRZ 8 Ö/£HK��OUTDp¸/F5�AK�QTDGP�Ls£5�AK7LS[RN/K%��L%Ö���Ks£H\]UTDpLsN/P%��K�¹�Ö��O¤/�LS[5DGN LQÖ(�OU§LS£H¹EDpL%�ɤ/�OKsKsDG\��AKJLQÖTDWLJLQÖ(� ��P%�O¹8�O£E���GÇÑDGU/V²£HK!LQÖ×N/K!LQÖ�� K�[]N/P�¹!� [GrlL%Ö��ÉU/DG¤��²?sDGNC:LQÖ(�OU§LS£H¹EDpL%�OV/@/c�_ � [�Í@� ���OPOÇ�Í>�¥K�LSP��OK�KiLQÖ/DpLt[]N/PtFj[�Í>�APi¸�[]N/U VKÖ/[GFjV/K=r�[]PtDGFjF�Q/P%�AQ/Ps[�¹!�AKsKs£HU/\Q�ÖTDpK%�OKÉZ¤� ���AU�LQÖ []K%��LQÖ/DpLq¹EDGU/U [GL�¸;��� �¥¹A£5�AU×LsF��Â\��OU��APSDpL%�OV,_bc

B|UÉLQÖ £jK�¤¥[�V��OF�ÇWDqk :¬DpV����APsKSDpP��i£jK�D!QTDGP�La��LQÖTDWL�¹A[]U§LSPs[GFjK'k � G [Gr/L%Ö��gQTDpP�LS£ �OK�� � � � � �/� ��� ÇÍ:Ö��AP%�¿L%Ö��5¹O[GPsPsN Q LS£H[]UØK�LSPSDWLQ�O\ ��V(�OQ��OU/V/K�[GUØLQÖ��¿DGV����OPsKsDGP���� KG��£5�AÍ Z�£mc��GcÁÇ�LQÖ(�5DGV����OP�KSDGPM�£jKqDGV/DGQ LS£E���E_dcgef£jU/¹8��LQÖ��iDGV����OPsKsDGP��­¹A[]U§LSPs[GFjK�LQÖ��AK%�tQTDGP�LS£5�AKOÇT£ÁL�P%�O¹8�O£E���OKqLQÖ��A£jP:�OU§Ls£jP%� ��£5�dÍ�KDGU/V�V��AL%�OP�¤¥£HU��OK�LQÖ(�i¤/�OK�KSDG\��AK!L%ÖTDpL�LQÖ�� �RK%�AU/VÑc`B|U­QTDGP�Ls£j¹AN/F�DGPAÇ LQÖ(�OK%�i¤��AKsKsDG\��OK!U��!�AV�U/[pL¸��JDG¹A¹O[]P�V/£jU \tLs[tL%Ö��!Q Ps[GLs[f¹A[]Fl�dÐ��O¹AN LS£H[]UÑÇf¸/N L^PSDpL%Ö��OP^¹EDpU¿¸��!¹A[]¤¥Q N LQ�AV¿¸S��LQÖ��!DGV����OP�KSDGPM�DGKÂDpU DGPs¸/£ÁLSPsDGP��Ër�N/U/¹dLS£H[]U:[Gr=£HLsK ��£5�dÍ=c = �²U/[pLQ��L%ÖTDpLÂ[]N P5£j¤BQÚ[GKsKs£H¸/£jFH£HLa�ØP%�OK�N/FHLsK�Ö/[]FHV� ���OU�DG\§DG£HU/K�L�D K�LoDWLS£j¹7DGV����APsKsDGP��ÆZ r�[]PgÍ:Ö/[G¤ÔLQÖ(��K%�ALq[Gr'r DGN FHLa�¥QTDGP�Ls£5�AKM£jK �fÐ(�AV�¸��Ar�[GP%�7LQÖ(��dÐ��A¹ON Ls£j[]U­¸;�A\]£jU Ko_dc

�![GL%�²LQÖTDWLÂ[]N/P5Q Ps[GLs[f¹A[]FjKBr�[]PÂDGN L%Ö��OU§Ls£j¹EDWLQ�OV � � �ODGU§LS£jU(� � \]P��!�O¤/�OU§LÂL%ÖTDpL¹A[]¤¥Q�[]K��K%�7D×N��OU§LS£jDGFjFE�ÂP%�AF��Â[GURL%Ö��tK%�O¹AN/Ps£ÁLa�R[GrÊK�£j\]U/DpLSN/P���Ks¹�Ö��A¤��AKOÇÚDGU/VRLQÖ×N/K!DGKsK�N/¤/�iQ/P�[]¸TDG¸ £jFj£HK�Ls£j¹Q�[]F���U/[]¤B£�DpF=: Ls£j¤/�7DGV_���OP�KSDGP�£5�AK7[]U/FE�]c�Û7U²L%Ö��É[GL%Ö��OP6ÖTDGU/VÑÇÚ[]N/P!£j¤BQÚ[]K�Ks£H¸/£jFH£HLa�5P��OK�N/FHLsK Ö/[]FHVr�[]P^DGV����OP�KSDGP�£5�OK7Z�DGU VIÖ/[]U(�OK�LgQTDGP�LS£5�AKo_ÊÍ:Ö/[]K��JPsN U/U/£jU \tLs£j¤/�q£HK¾[Gr'DGUS�·¹O[G¤¥Q/F �dÐf£HLa�Gc$B|U¥r Dp¹ALEÇLQÖ(��DGV����OPsKsDGP��¥LQÖTDWLMÍ>�J¹O[]U/K�LSP�N/¹AL�Ls[ Q/Ps[�����[]N/PgFH[�Í>�APM¸Ú[GN/U/V/KM£HKg[Gr*L%Ö��7KsDG¤��J¹O[]¤BQ/F5�bÐf£HLa�DGK�LQÖ(� lî$�Íð�ï�# QTDGP�Ls£5�AKOc

� ��M�� � � �¾1g./+�17$"!a$�17$') ����&�#��%$2)T$'$&� $�1g.8 Ö�� �bÐf£jK�Ls£jU/\iFj£ÁLQ�OPsDpLSN P%��V�� �/U��OKML|Í2[�P%�AF�DpL%�OV¿Q Ps[]¸/F �O¤BK!á � � �EDGU§LS£HU�� 9��OU��APSDGFHKMDGU V � � �EDGU?:LS£HU�� � \]P��!�A¤��AU×LOc,B|U¥L%Ö����TP�K�L2Q/Ps[G¸/F5�A¤�Ç]L%Ö��OP��J£jK¾[]U(�!V��AKs£H\]UTDpL%�OV¿Q/DGP�La�GÇ�L%Ö�� 9��OU��APSDGF�ǧÍ:Ö/[Í�£jK�Ö��OKtLS[�¸/Ps[§DpV/¹EDGK�L £ÁLSK��GDpFjN���LS[�DGFjFlL%Ö��¥[pLQÖ��APÉQTDGP�LS£ �OKOcIB|U�LQÖ��¥K%�O¹A[]U/V�Q Ps[]¸/F �O¤­ÇÝ�ODG¹�ÖQTDGP�La�/ÖTDGKMDpU¿£jU Q/N LgDGU/V¿L%Ö��JQTDpP�LS£ �OK¾Í�£jK�Ö¿LS[ÉDG\]P%�8�![GUÂD��pDGFHN��GÇ×Í�£HL%Ö5D��pDGFH£jV/£ÁLa� ¹A[]U/V/£ÁLS£j[GULQÖ/DpLM£Ár*Dɤ¥D "�[]P�£HLa��[Gr\Ö []U��OK�LMQTDpP�LS£ �OK2¸;�A\]£jUBÍ�£HLQÖBLQÖ��!KSDG¤/� �pDGFHN��GÇ×LQÖ(�OU¿L%Ö�� �¥¤ N/K�LgLQ�APs¤B£=:

6�0 %

Page 108: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

UTDpL%� Í�£HL%Ö�LQÖTDWL �GDpFjN��pc 8 Ö(�OK%�·Q/P�[]¸/F �O¤BK7DGP��Û�eD×N/£��pDGF �OU§L�£HU�LQÖ���K��OU/K���LQÖTDpL�DGUS�²Q/P�[GLS[�¹O[]FKs[GF���£jU/\�[]U��5¹ODGU�¸��5N/K��OV�LS[�¹O[]U/K�LSP�N/¹ALBD�Q Ps[GLs[f¹A[]F¾Ks[]FE�f£HU/\�L%Ö��¿[GL%Ö��OPAÇÊÍ:Ö/£jF �BLs[]F5�APSDpLs£jU/\LQÖ(�tKsDG¤/��U�N ¤ ¸;�AP�[Gr�r DGN/FHLa�¿QTDGP�LS£5�AKOc = �=P%�OFjDWÐ¥LQÖ��=K�LSDGU/VTDpPsV­P%�eD×N/£HP%�A¤��AU×LsK�[]URQ/Ps[GLs[f¹A[]FjKr�[]P^LQÖ���Dp¸Ú[���� � � �ODGU§LS£HU��7Q/P�[]¸/F5�A¤¥K2£jU¿L%ÖTDpL2Í>�=DGFHFj[�Í DÉQ Ps[GLs[f¹A[]F�Ls[Ér DG£HF�Í�£ÁLQÖ5Q/P�[]¸TDG¸ £jFj£ÁLa�LQÖ/DpL¾£jKÊU(�O\]FH£j\]£H¸/F5�^£jU�K�[]¤���K��O¹AN/Ps£ÁLa��QTDGPsDG¤��dLQ�APOc 8 Ö £jKlP%�AF�DWÐ DpLs£j[]U�£HKÊU��8�OV��AV¥r�[]P�L%Ö���¹EDGK���[GrDGN L%Ö��OU§Ls£j¹EDWLQ�OV � � �EDGU§Ls£jU��qQ/Ps[pLS[�¹O[]FHKÊÍ:Ö��OP��!K�£j\]UTDWLSN/P��qK�¹�Ö��O¤/�OKgDGP%��N/K��OV Z DGU/VB¹EDGU¥DGFÁÍMDz��K¸��=r�[GPs\��AVRÍ�£ÁLQÖRKs[G¤��=U��A\]Fj£H\]£j¸/F �!Q Ps[]¸TDp¸/£jFH£HLa� _dc à []P�¤¿DpFjF��GÇ+�ãSRÊ��¡���¡ ��� ";ç���ç¤êUT��ɼ��HåT����¡��\ã���ã��bã×�vå � ÓK`vç v ð�# � � � � � �/� �&��� � .0� "�� ± �&� �+ð G í�.0��2#+(dð�ï .0� " /5ð�# � �+ð #& lð " ð�ï�( � � .0#=ð " í�.0��#�� � ( #& ( ��í�ì'# } t�� . "@" ( #+(dî$� # lð��Qð (5ï .0� . " ,�ð���ï .0���� lî .�� 5�î$��Lìví #�ì[í #�î k î<; # lðNí�.0��#+(dð�ï ( � 5�/ ì " ( � � # lð�ï=ílð75�(+.0/Pí�.0�#�� � ��í ��î$#=î�5�î$/ï[î$/ ,�ð�ï # lð � ����.0�)#+( �Íð� tð��Íð���.0/aïNí �Qî�� /5ð ( ; #& lð ;¸î$/ /5î � ( � � # � î�í �Qî�ílð��#+(dð�ï lî$/ " $�ð��'5�ð=í #� ( # �Íð � / ( � (�� /5ð>í �Qî��7.�� ( / ( #�� . u�@ � \GP%�!�A¤��AU§L¸á � / / lî$�Íð�ï�#èí�.0�#+(dð�ïÛî�ì'# í�ì #:# lð�ï .�Ið ,$.0/ ìlð � �^DGFH£jV/£ÁLa�;á �&; � (5ï lî$�Íð�ï�# � #& lð�� .0/ / lî$�Íð�ï�#�í�.0�# (dð�ïzî�ì'# í�ì'# } �0ð " ð��Íî$#�ð ï+ì)57 .�í �Qî$#�î�5�î$/ �'� � ��ü } B|U LQÖ��®K��ALsLs£jU/\Ì[Gr � � �EDpU×Ls£jU�� � \GP%�!�A¤��AU§LR£HLR£jKÂU [GLRK�LsPSDG£H\�Ö§Lsr�[]P�ÍMDGP�V:LS[�r�[]Ps¤ÉN/F�DpL%��LQÖ(��pDGFj£HV/£HLa��Q/P�[]Q;�AP�La�Gc B|U§LSN/£ÁLS£E���OFE�]Ç'£HL=K�Ö/[]N/FHV�¹ODGQ LsN/P%�·LQÖTDWL=£Hr@�OU/[]N \�Ö|Ö/[GU��OK�LÉQTDpP�LS£ �OK=¸��O\]£HUÍ�£HL%Ö�LQÖ(� KSDG¤/�É£HU/Q/N L��GDpFjN��=LQÖ��AU®LQÖ�� ��Í�£HFjF'[]N LsQ/N L7L%ÖTDpL��pDGFHN��Gc � �:?.Ö/[]U��AK�LEÇ @ÂÍ>�ɤ��ODGULQÖ(�ÂQTDGP�Ls£5�AK LQÖTDpL�r�[GFjFj[�Í L%Ö��RQ/P%�AKs¹OP�£j¸��OVÌQ/Ps[pLS[�¹O[]F@�dÐ DG¹ALsF��GÇ2£H\]U/[]P�£jU/\�L%Ö��£jK�KsN��ÂL%ÖTDpL�LQÖ(��TP�K�LqK�L%�OQ�[pr�L%Ö��=QTDGP�La�5¤¥£H\�Ö§L�¸;��Ls[B¹�Ö/DGU/\��=£HLsK�Fj[�¹EDGF>£jU/Q/NfLEc+�ãSRÊ��¡���¡ ��� ";ç���ç�� T��ɼ��HåT����¡��\ã # ½��vãWã?ä|ã��Ú�4`vç v ð�# � � � � � �y� ��� �+ð G í�.0�# (dð�ï � � ( # .�ï 2ï[î�5�(+.0#=ð " ( ��í�ì'#£ï } � � � � �/�g} � ��� . "@" ( #+(dî$� # lð���ð (5ï .0� . " ,�ð���ï .0��� � lî .�� 5�î$���Lì[í #�ì[í#=î k î<; #& lð�í�.0�#+(dð�ï �� lð�� � .Ûí ��î$#=î�5�î$/ ï[î$/ ,�ð�ï # lð � ����.0�)# ( �Íð � � �Qð�ð Ið��)#Cí �Qî�� /5ð ( ; # lð;¸î$/ /5î � ( � � # � î�í �Qî�ílð��# (dð�ï lî$/ " $�ð��'5�ð=í # � ( # �Íð � / ( � (�� /5ð>í �Qî��7.�� ( / ( #���. u�@ � \GP%�!�A¤��AU§L¸á � / / lî$�Íð�ï�#èí�.0�#+(dð�ïÛî�ì'# í�ì #:# lð�ï .�Ið ,$.0/ ìlð � �^DpFj£jV £HLa��á � ; ¤¿D�Ð*Z G �Ëk��� G � �� � 6�_ î<; #& lð:í�.0�#+(dð�ï �.0,�ð # lð�ï .�Ið ( ��í�ì'#:,$.0/ ì�ð } .0� ";¸î$/ /5î � # lð¼í �Qî$#�î�5�î$/;ï=ílð75�( b45�.0#+(dî$� � # lð�� .0/ / lî$�Íð�ï�#�í�.0�# (dð�ïÛî�ì #�í�ì # } = �qU [GLQ��LQÖ/DpLlr�[]PÊLQÖ(�q£HU r�[]P�¤¿DpLs£j[]U?: LQÖ(�O[]P��ALS£H¹2K��AL�LS£jU \/Ç]LQÖ��w�pDGFH£jV/£ÁLa�ÉP��eD×N/£jP��O¤/�OU§L^£jKlN/K�NTDGFHF��K�LSDpLQ�AV Ks[ÂLQÖTDWL=£HL�¤ N K�L�Ö/[]FHV®[]U/FE��Í:Ö��AU�¤B[]P��ÉLQÖTDpU # � î # ( � " ï [pr2L%Ö���QTDGP�LS£5�AK ÖTDz���·LQÖ(�KSDp¤���£HU/Q/N L[�pDGFjN(�GÇ/¸��O¹ODGN/K%�t£jU5L%Ö��=£jU r�[GPs¤¥DpLS£H[]UC: L%Ö��O[GP%�ALs£j¹qK%�dLsLS£HU/\/Ç G ��k � � G � ß c

# �*���bã��Ú��¡� �å �¸ãf���ɼ��HåT�Ú��¡ �\ã �i���T���* ]��� ÓG¢ B|U¥LQÖ(�J¤B[fV��AF/r�[]P2DGN LQÖ(�OU§LS£H¹EDpL%�OV � � �ODGU§LS£HU��9��OU��APSDGFHK � � \]P%�8�O¤/�OU§LEÇ,Ks[G¤���LSP�N/K�L%�OV�Q/P%�AQ/Ps[�¹!�AKsKs£HU/\¿Q(ÖTDGK%�i£jK�PsN U�¸��Ar�[]P��ÉDpUi�»�bÐ��O¹ONfLS£j[GU/K¸��O\]£HUÑc B|UØL%Ö/£jKiQ�ÖTDGK��GǾD�LsPsN/K�LQ�AVÌQ/DGP�La�ÆV/£HK�LSP�£j¸/NfLQ�OKzÙ�� ��K Ls[k� ���OP��ØQTDGP�LS£j¹A£jQTDWLS£jU \­Q/DGP�La�Gcà []Ps¤¥DGFHF��]Ç+�ãSRÊ��¡���¡ ��� ";ç���ç� T # �*���bã��Ú��¡� �å �¸ãf���ɼ��HåT�Ú��¡��\ã���ãf�\ã×�vå ��Ó�� # ½,�vãWã?ä|ã��Ú�4`vç � í ��î$#=îK25�î$/@;¸î$� .�ì # lð��)# (�5�.0#=ð " � � ��.0�)#+( �Íð tð��Íð�� .0/aï���� � �Qð�ð Ið��)# (5ï . � � ��.0�)#+( �Íð tð��Íð���.0/aï���� � �Qð�ð 2Ið��)#èí ��î$#=î�5�î$/ � ( # #& lð ;¸î$/ /5î � ( � � .�ì � Ið��)#�.0#+(dî$� u

!�� . 57 �í�.0�#�� �.�ï .0� . "@" ( #+(dî$� .0/ ����� ����� ��� � � 6�0 (

Page 109: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

! 9:�(dî$� #=î .0���kí �Qî$#�î�5�î$/�ð���ð75+ì'#+(dî$� � .0� ( " ð�.0/ Z #+�LìWï�#=ð "�_ í�.0�#�� 57 lî[î[ï[ð�ï . ï[ð���(dð�ï�î<;ï�#+�( � � ï � � � � � �(�� � . 575�î$� " ( � � #�îzï[î Ið " (5ï�#+��(��!ì #+(dî$� � .0� " ï[ð�#£ïRí�.0�#�� � J � ï ����� ����� ��� � �#=î�ð�*!ì .0/ ��J�Z ;¸î$�zð�,�ð���� � ± 6 � � � �y� G _

ebî$/ /5î � ( � � # lð .��+î$,�ðtí �Qð=í ��î�5�ð�ï�ï�( � � ï�#�. � ð � # lð6í �Qî$#�î�5�î$/ (5ï8�Lì � ( � # lðzï�#�.0� " .0� " 5�î Ûì;2�)(�5�.0#+(dî$� Iî " ð�/0;¸î$� � ����.0�)# ( �Íð tð��Íð�� .0/aï���� � �Qð�ð Ið��)#èí �Qî$#=î�5�î$/aï � K2Í>� Ö/D����7¤/�OU§LS£H[]U��OV>Ç/DiU/DpLSN/PsDGF��dÐ DG¤BQ/F5�![Gr*KsN ¹�Ö�DiQ/P%�AQ/Ps[�¹!�AKsKs£HU/\�Q�ÖTDpK%�7£HK2[]U(�JÍ:Ö��OP��LQÖ(�2K�LSPs£HU/\]K�� � � � � �(�� �!¹A[]U/K�LS£HLsN LQ�2D�Q/N/¸/FH£j¹b:·Ù�� �=£jU r�PsDGK�LsPsN/¹dLSN/P��Gc 8 Ö/DpL�£HKOÇ�LQÖ��¾LSP�N/K�L%�OViQTDGP�La�¹�Ö/[�[]K%�AK�Ù�� � : QTDG£HPsK·Z���I � ���I � _ � � � �/��Z���I �����I �G_�r�P�[]¤ D¥K%�O¹AN/P%��K�£j\]U/DpLSN/P��ÉK�¹�Ö��O¤/�GÇ'DGU V®K%�ALsKLQÖ(�i¹A[]U§LQ�OU§LsK![Gr�QTDGP�La� �?J � K�LoDGQ���LS[/�eD×NTDGF ��J ± Z���I � � � � �y����I4J � � ����I4J �7�WI4J ����I4J � � � � � �y����I �G_dc8 ÖTDpLg£jKAÇ DGFHF,QTDGP�Ls£5�AKgDGP��J\]£E���AU¿LQÖ��A£jP^[�Í�UÂKs£j\GU/£jU/\�Ù�� �5DpU/V¿LQÖ(� ���APs£ �T¹EDpLs£j[]UIÙ�� ��K�[Gr*DGFjFTLQÖ(�[GL%Ö��OP�QTDGP�LS£ �OKOc

= �tP%�A¤¿DpP%Ù¿L%ÖTDpL�LQÖ(�ÉDG¸�[����;:|V�� �TU��OV�Q/P%�AQ/Ps[�¹!�AKsKs£HU/\¿Q(ÖTDGK%�t£jKt���OPM��K�LSP�[]U/\/c à £jP�K�LOÇ/£HL�£HKDGK�KsN/¤/�OV L%ÖTDpL�£HL�£jK�P�N/U ¹A[]¤¥Q F5�AL%�OFE�=¸i�ÉDqLsPsN/K�LQ�AV�QTDGP�La�Gc à N/P�L%Ö��OP�¤¥[GP%�GÇWLQÖ��AP%�2£jK�U [7¹O[]¤BQ/NC:LoDWLS£j[GUTDGFѸ�[]N/U/V�[]U�L%Ö��ÉQ�[�Í>�AP![prÊLQÖ��=LSP�N/K�L%�OV²Q/DGP�La�R\��AU��OPsDpLS£HU/\¥L%Ö���Ù�� ��KAc!�e� ���OP�L%Ö��OF �OK�KOÇ[]N/P�£H¤¥Q�[]K�Ks£j¸ £jFj£ÁLa�·P%�AKsN/FÁLSK:Ö/[]FHV�� ���AU�r�[]P�K�N/¹�Ö²D·Q/P%�AQ/Ps[�¹!�AKsK�£jU/\BQ�ÖTDGK��Gc

� ��M��� ��0��Ü-É02& +|./+¬0g130^4��Æ)T0l./0�(*0 ��&8 Ö/£HK!QTDpQ;�AP!V��ODGFjK�Í�£ÁLQÖ�L%Ö��tK%�O¹AN/Ps£ÁLa�­[GrlDGNfLQÖ��AU×Ls£j¹ODpLQ�AV � � �EDpU×Ls£jU�� � \]P��!�A¤��AU×L!Q/P�[GLS[�¹O[]FHKOÇÍ:Ö��AUÌL%Ö��5Q/P�[GLS[�¹O[]F2£jK��bÐ��O¹ONfLQ�OV ¤¿DpUi�ÆLS£H¤��AKRZ PsDpLQÖ(�OPÉL%ÖTDGU "�N/K�L []U/¹!�E_dc = �ÂV�� �TU��ÂLQÖ(�¹O[G¤¥Q�[]Ks£ÁLS£H[]U�[GrÚQ/Ps[GLs[f¹A[]FjKÊLs[i¸�� ï�# .0#=ð�/5ð�ï�ï c 8 Ö/£HK¾¤��ODGU/K¾LQÖTDpLlL%Ö��eÖ/[]U��AK�L2QTDGP�Ls£5�AK2Dp¹AL^N/Q�[]ULQÖ(�O£jP���£5�AÍÔ£jU�D²Ks£jU \]F5���dÐ��O¹AN LS£H[]U�[]U/FE�]c à N/P�L%Ö��OP�¤¥[]P��GÇÊ£HU�K�LSDpLQ�AF5�OK�K ¹O[G¤¥Q�[]Ks£ÁLS£H[]UÑÇ�L%Ö��OP��£jK�U [�N/U £ D×N��BK%�OK�Ks£H[]U�£HV��OU§Ls£��l�AP=L%ÖTDpL=£HKt¹A[]¤B¤¥[]U²Ls[�DpFjFÊQTDpP�LS£H¹O£HQTDpLS£HU/\5QTDpP�LS£ �OKAc�Z�e��!�·LQÖ(�B|U§LSP�[fV/N ¹ALS£H[]UÂr�[]P�D·V/£jK�¹ON/K�Ks£j[GU­[GU�K��OKsK�£j[]U­£jV(�OU§LS£ �l�OP�K!DpU/V­L%Ö��O£HP�Ps[]F �Gc�_

8 Ö��7P��EDGK�[]U5LQÖTDWLgK�LoDpL%�OF5�AKsKM¹A[]¤BQÚ[]K�£HLs£j[]U·£jK2[Gr*£HU×L%�OP��OK�LOÇ £HK2LQÖ/DpLg£Ár*£HL2£jK¾LQÖ(� �EDGK�£5�AK�LRÙ×£HU/V[Gr,¹A[]¤¥Q�[]K�£HLS£H[]UÑc B|U�QTDGP�LS£H¹ON/FjDGPOÇ�LQÖ/£HKʤ/�EDGU/K�LQÖTDWLÊLQÖ��>Ö/[]U��AK�LlQTDpP�LS£ �OKÊV [7U/[GLlK�LS[]P��M£jUɤ��A¤F:[]PM��L%Ö��O£HP���£5�AÍ�K7r�P�[]¤ Q/P%� �f£H[]N/K��bÐ(�A¹ON Ls£j[]U Kt[GP7¹O[�[]PsV £jUTDpL%�ɸ��AL|Í@�!�AU�V/£=<Í�AP%�AU×L��bÐ��O¹ONfLS£j[GU/K[�¹O¹ON PsPs£HU/\ DpL�L%Ö��R¹ON/P�P%�OU§L·LS£H¤��pc = Ö��AU�� ���OP¥QÚ[]K�Ks£H¸/F5�pÇ^K�LoDpL%�OF �OKsK·¹A[]¤¥Q�[]K�£HLS£H[]U�K�£j¤BQ/Fj£ �l�OKQ/P�[GLS[�¹O[]F>V��OK�£j\]U�DGU/VRP%�AV/N/¹8�OK7DpKsKsN ¤¥Q Ls£j[]U K�[]U­L%Ö��=¤¥[�V��AFmc

= �=U/[pLQ�7LQÖ/DpLqDGFHL%Ö/[]N/\�ÖRL%Ö���QTDGP�LS£ �OK�DGP���K�LoDWLQ�OF �OK�KOÇTLQÖ��=DpV����APsKSDpP��R£jK�DpFjFj[�Í@�OV5Ls[B¤¥DGFH£=:¹O£H[]N/K�F��¹A[f[]P�V/£jU/DpLQ�=¸��AL|Í@�!�OU0�dÐ��O¹AN LS£H[]U/K7DpU/V�P��O¹O[GPsV�£ÁLSKw��£5�dÍ%r�Ps[G¤ÕQ/P%� �f£H[]N/Ke�dÐ��O¹AN LS£H[]U/KAcà []Ps¤¥DGFHF��]Ç×¹A[]¤¥Q�[]K�£HLS£H[]U£jK�¹ODGQ LsN/P%�AV�¸S�ÂLQÖ(�=r�[GFjFj[�Í�£HU/\ Q/P�[f¹8�OKsK8á+�ãSRÊ��¡���¡ ��� ";ç���ç�é TsÓ!ã�ÖÑ�\ã��Ú��¡Bå �@åT���:�Ýå ��å � �Bã%�2 ]��äØ�l��ÓE¡ ��¡��Ú�{`vç v ð�# � � � � � �y� ��� �+ðèí�.0��2#+(dð�ï%;¸î$� .0� .�ì'# lð��)# (�5�.0#=ð "�� ����.0�)# ( �Íð tð��Íð���.0/aï���� � �Qð�ð Ið��)#Pí ��î$#=î�5�î$/ � v ð�# µ� H G � �+ð.0� ( � " ð���ï[ð�#Rï+ì657 #& �.0# ;¸î$�Ið�,�ð���� � È µ � #& lð . " ,�ð��Qï .0� �� 5�î$�)# �Qî$/aï8# lð6í�.0�#�� �?J �4,�ð��#+( Ið � ( � " (�5�ð�ï .0�Qð . "@" ð " #=î µ .�ï # lð . " ,�ð���ï .0��� 57 lî[î[ï[ð�ï #�î 5�î$��Lìví # . "@" ( # (dî$� .0/�í�.0��#+(dð�ï �� ( # #& lð �Qð�ï�#+�(�5�# (dî$� # �.0#�� µ ��� k �� lð�� � # lð K%�7D�N(�OU§LS£jDGF^Z P��OKsQ>cHÇTQTDpPSDGFHF5�OF�_¾¹A[]¤BQÚ[]K�£HLs£j[]U î<;� ( �),�î$/ ,�ð�ï #& lð ;¸î$/ /5î � ( � � í ��î�5�ð�ï�ï u

! o:ì � # lðPí �Qð=í �Qî�5�ð�ï�ï�( � � í) �.�ï[ð .�ï�ï[î�5�(+.0#=ð " � ( # � .0� " î�� # .0( � # lð¼ï�#+��( � � ï � � � � � �/�7��� �� lð�� � ;¸î$�zð�,�ð������ � ï[ð�#:# lð � � � ������������� î<; � # #�î�ð�*!ì�.0/ � # ! o:ð=ílð�.0#%#& lð%;¸î$/ /5î � ( � � í �Qî�5�ð�ï�ï .Nílî$/ �$�Íî 8(+.0/��lì �+ð��Iî<; # ( Ið�ïzï[ð�*!ì�ð��)#+(+.0/ / � Z �Qð�ï=í �( ��í�.0� .0/ /5ð�/ _

6�0 >

Page 110: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

�@ �� lð . " ,�ð��Qï .0��� 57 lî[î[ï[ð�ï .0� ( ��í�ì #:,�ð75�#=î$� } � � � � �y�g} � � e2(�� #& lð ( ��í�ì # # .+ílð�î<;�ð�,�ð�� �8 lî$�Íð�ï�# � # #=î �+ð } # .0� " ( #Bï � .0� " î #�.+ílð #=î �+ð .

ì �)( ;¸î$��8/ � Z .0� " ( � " ð=ílð�� " ð��)#+/ � _ 57 lî[ï[ð�� � .0� " î �ï�#+��( � � �����),�î Hð .0/ /Pí�.0��#+(dð�ï ;¸î$� .0� ð���ð75+ì # (dî$� î<; � Z ìWï�( � � # lð�ï�#+�( � � ï � ð��Íð���.0#=ð " ( �# lð�í �Qð=í �Qî�5�ð�ï�ï�( � � í) �.�ï[ð .��+î$,�ð _ �� lðIð���ð75+ì # (dî$� (5ïzï+ì657 # �.0# ;¸î$� � È µ � # lðIð�ï�ï . � ð�ï�ï[ð��)# �'��í�.0�#�� �?J .0�Qð " ð�#�ð���8( �Íð " �'� Z � lî .0/aï[îNï[ð�ð�ï �?J � ï ,�(dð � _ �4� # lð�î$# lð��8 �.0� " � .0/ />î$# lð�� í�.0�# (dð�ï%;¸î$/ /5î � # lð ( �(ï�#+�+ì)5�#+(dî$�(ï .�ï " ðnb �Íð " ( ��

= �·K�LSP%�AKsK=LQÖTDWL�LQÖ��·Q/P��OQ/P�[f¹8�OKsK�£jU/\­Q�ÖTDpK%�·£jK��bÐ(�A¹ON L%�OV�[]U/F���[]U/¹8�¥DpU/VØDpFjF �bÐ��O¹ONfLS£j[GU/KN/K��iLQÖ(�iK�LSPs£HU/\]KqV/£jK�LSP�£j¸/N L%�OV­£jURLQÖ/£HK�Q�ÖTDGK��Gc à N/P�L%Ö��OP�¤¥[GP%�GÇTÍ@�ÉU/[pLQ�=LQÖTDpL Ü � �TU/£HLs£j[]U % c � c �£j¤BQ/FH£5�OK�L%ÖTDpL=DGFHFÝÖ []U��OK�L�QTDGP�LS£ �OK�DGP�� []¸/FH£���£j[GN/K![prlLQÖ�� [pLQÖ��AP �dÐ��O¹AN LS£H[]U/K7L%ÖTDpL�ÖTDz��� LoD�Ù3�OUQ/FjDG¹!�RZ�[]PJL%ÖTDpL=DGP�� LoD�Ù×£HU/\5Q/FjDG¹!� £HU®QTDGPsDGFjF �OF _bc 8 Ö/£HK7£jK7£H¤¥Q Fj£j¹A£HLq£jU�LQÖ�� r DG¹dL7LQÖ/DpL�£jUÉ�ODG¹�Ö�dÐ��A¹ON Ls£j[]UØL%Ö��BQTDGP�Ls£5�AKiDpP%�B£jUS�][�Ù3�OV�Í�£ÁLQÖÆU/[²DGV V/£HLs£j[]UTDpFÊK�LSDpLQ�B£jU r�[GPs¤¥DpLS£H[]UÑÇ*¸�� �][GU/VØLQÖ(�¹O[GU×L%�OU§LSK![GrÊL%Ö��O£HPq£HU/Q/N LOÇTPSDGU V/[]¤ DGU/V�Ù�� �­LSDGQ��OKOc�Û�U­LQÖ��t[GL%Ö��OPeÖTDGU/V>Ç,L%Ö��iDGV����APsKsDGP�� ¹EDpUعO[�[]P�V/£jUTDWLQ�B¸;�dL|Í>�8�OU�LQÖ(���bÐ(�A¹ON Ls£j[]U KOÇlDGU VØ£HLsK���£ �AÍ DpLÉDGUS�Æ\]£����OUÆLS£j¤/�·£jU/¹AFjN/V(�OKiDGFjFLQÖ(�t¤/�OK�KSDG\��OKqP%�O¹8�O£E���OV­£jU­DGFHFÑ[GL%Ö��OP¼�bÐ(�A¹ON Ls£j[]U KOc �

� �Ar�[GP%��Q/Ps[�¹!�8�OV/£HU/\/ǧÍ@�qK�Ö/[�ÍYLQÖ/DpL^DGUS� � � �EDGU§Ls£jU�� 9��OU��APSDGFHKqZ []P � \]P%�8�O¤/�OU§Lb_ÊQ/P�[GLS[�¹O[]F( � # lð ï�# .0� " .0� " Iî " ð�/ ¹O[G¤¥Q�[]K%�AK�¹O[]U/¹AN/PsP��OU§LSFE�]c�t�W�,�l��ÓE¡ ��¡��Ú� ";ç ��ç¤êlç�� ���/í �Qî$#=î�5�î$/ � ;¸î$� � ����.0�)# ( �Íð tð��Íð�� .0/aï Z î$� � � �Qð�ð Ið��)# _ ( � # lðK�LSDGU/VTDpPsV­¤¥[�V��OF � �Qð .0( �(ï ï[ð75+ì �Qð�ì'� " ð�� 5�î$� 5+ì ���ð��)# 5�î 6ílî[ï�( #+(dî$� 9:�Qî[î<;�%= � P%�AV/N/¹!�iLQÖ��iK%�O¹AN/Ps£ÁLa��[pr � N/U V��OP7¹A[]U/¹AN/PsP��OU§L�¹O[G¤¥Q�[]Ks£ÁLS£H[]U­Ls[¿£ÁLSKJK��O¹AN/Ps£ÁLa�­r�[GPD�K�£jU/\GF5�N�dÐ��O¹AN LS£H[]UÑc � KsKsN ¤��¥¸i�ƹA[]U§LSPSDpV/£j¹dLS£j[GU L%ÖTDpLtLQÖ��AP%���dÐf£jK�LSK DpU�DGV����OP�KSDGPM� Í:Ö/[PsN U/K � ¹A[]U/¹ON PsP%�AU§L6�bÐ(�A¹ON Ls£j[]U K![Gr � ÇTK�N/¹�Ö�L%ÖTDpL�Í�£HL%Ö­U []UC:|U(�O\]FH£j\]£H¸/F5�!Q/Ps[]¸/DG¸/£jFH£HLa�GÇ £jUR[]U(�[Gr�LQÖ����bÐ(�A¹ON Ls£j[]U KqL%Ö��=[]N LSQ N LSK�[Gr�LQÖ��=QTDpP�LS£ �OK�DGP��=U/[GLqDG¹A¹O[]P�V/£jU/\�Ls[·L%Ö��=P%�7D�N £jP%�A¤��AU§LSK�[GrLQÖ(� � � �ODGU§LS£HU�� 9��AU��OPsDGFjKAc = �B¹A[]U/K�LSPsN ¹ALiDGUÆDGV����OPsKsDGP�� Ý*Í:Ö [­£HU§LQ�OP�UTDGFHF��­£jU/¹A[]PsQ�[]PsDpLQ�AK DGU V²DpL�LoDG¹�Ù×K7DBKs£HU/\]F5���bÐ(�A¹ON Ls£j[]U�[Gr � cjB|U§LSN £HLS£E���AF��]Ç Ý Ks£H¤ N/F�DWLQ�OKqDGFHFè�dÐ��O¹AN LS£H[]U/KJDGQTDGP�Lr�Ps[G¤ L%Ö��É[GU��É£HU�Í:Ö/£H¹�Ö KsN/¹A¹!�8�OV/K=£jU�£HLsKJDpL�LoDG¹�Ù,c à [GPs¤¥DGFjFE�]Ç Ý ¸;�A\]£jU/K!¸S��¹�Ö/[�[]K�£jU/\¿DGU£jU V��dÐ � È�� úi64� � � �/� � þ×c 8 Ö��AUÑÇ>r�[]PJDGFjF'¸/N LJLQÖ�� �����N�bÐ��O¹ONfLS£j[GU®[GrlLQÖ��ÉQ/Ps[GLs[f¹A[]FmÇ Ý Q F�Dz��KLQÖ(�7Ps[]F �OKM[pr*LQÖ�� Ö []U��OK�L�QTDGP�LS£5�AKg£HUÂDGU£jU§L%�OPSDp¹ALS£H[]U¥Í�£ÁLQÖ Z LQÖ/£HKgKs£H¤ N/FjDpLS£H[]U¥£HKM£jU§L%�OPsU/DGF�Ls[ Ý _bc¾Û7U¿LQÖ(�![GL%Ö��OP@ÖTDGU/V>Ç�r�[]P¾LQÖ(� � ��� �bÐ��O¹ONfLS£j[GUÑÇ Ý �dÐ�LQ�APsUTDpFjF��B£HU×L%�OPsDG¹ALsK^Í�£ÁLQÖ¥L%Ö��6Ö []U��OK�LQTDGP�LS£ �OK2DGU/V5QTDpKsK%�AKM¤/�OKsKsDG\��AKM¸;�dL|Í>�8�OUÂLQÖ(�O¤ÜDGU/V Z�Í:Ö/£H¹�Ö5£HL2PsN/U Kg£jU§L%�OPsU/DGFjFE�/_bc 8 Ö��tÙ�� �Q�[]£jU§L!£jU�L%Ö�� Q/P�[f[GrÊ£jK!L%ÖTDpL!LQÖ���Ö/[]U��AK�L�QTDpP�LS£ �OKtÖ/[]FjV�U/[5K%�A¹OP��AL=£jUfr�[]Ps¤¥DpLS£H[]U�Z�DGU V²V/[5U/[pL¹O[�[]P�V/£jUTDWLQ�t¸;�dL|Í>�8�OU��dÐ��O¹AN LS£H[]U/Ko_bc 8 Ö��AP%�Ar�[GP%�GÇÚLQÖ�� K�£j¤ N F�DpLs£j[]UR[GrlL%Ö�� ¹O[GU/¹ON/P�P%�AU×L7K%�AL�LS£HU/\¸S� Ý r�[]P £HK ílð��&;¸ð75�# c 8 Ö×N/KOÇ�Í�£HLQÖ�Q/Ps[G¸TDG¸/£HFj£HLa��69� � Ç�L%Ö�� � ��� �dÐ��O¹AN LS£H[]UØ£HKtL%Ö��¥[GU��¿£HUÍ:Ö/£H¹�Ö KsN/¹A¹!�8�OV/KAc � [�Í>� ���APOÇlLQÖ/£HKi¤/�EDpU/KiL%ÖTDpL Ý KsN ¹O¹!�8�OV/K·£HUظ/P��ED�Ù×£jU \�LQÖ(�¿Q/P�[GLS[�¹O[]Fr�[]PtDRKs£jU \]F5�N�dÐ��A¹ON Ls£j[]UYZ�Í:Ö��AP%� Ý �hKtKsN ¹O¹!�AKsK�Q/P�[]¸TDG¸ £jFj£ÁLa�0�7D×NTDGFjK 69� � Ls£j¤/�OK�LQÖ��BKsN ¹O¹!�AKsKQ/P�[]¸TDG¸/£HFj£ÁLa�¿[Gr c�_ 8 Ö £jK�¹O[GU×LsPSDGV £j¹ALsK�LQÖ��=K�LSDGU/VC:|DGFj[GU���K%�A¹ON/P�£HLa�R[Gr � c

RKNMPO abdAa;]hW�7WblAQ �2O��AdPf^TSfhWbd�� W7[ TSMPO��LWb_EY W7QSf T f^W7dEW�� ������������������ "!#�$�%�#&('Xi*)ca;deTSfhdPO,+ ORdPO@[ a;]gQ#-�./7[SORO@_EO@deTfgQ0�PO@[ f^m7O1�2� [ Wb_43�O��AdAf T f^W7d�5 o762o 8 \ i,[ O@_EWnm f^d��TSMPOX[ O�� O@[ O@d��LO T W T MPOXYP[SORYP[ W9�@ORQ Q fhd: Q T a�bOXa;d�� Q O@TSlPY�; T abY OcQ@o6 6�0

Page 111: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

.0/�� 3 � ��5 � ��� ���z������ �� ����� �{�B|U�L��/£jKqK��A¹ALs£j[]U�Í��ÉQ P��OK��OU§L7L|Í2[¿£H¤¥Q�[]KsK�£j¸/£��j£ÁLa�¿P��OKsN��HLSKqP��A\������/£���� �!���ɹ#"G¤%$&"('s£)�S£�"(�*"�+,��-C:�!���#���S£H¹��.���#�%/ � �������S£����102�(���#�#34�#���5$���"��!"�¹#"(��'#6871�A¹��������!�9�:�lÍ;�<������¹ "(�/¹ �#�����#�¿Í>=)�!�@?�ACB�AED 2F D�?�?1G#"�3%$&"('�=)�!=�"(�6>H8=���'��#I&J��K'���"LJM���9�.�N=)�2=�'<=�3%$&"('�'�=�O����P�!"@G "(��'Q�!��-�G �R���S��-��!���#���!=�G��.���#�/ �UT��.�V��=����W02�(���#� 3%� �V�X$���".�!"UG#"(�Y�!���.�XG "(34$Z"('��#'%=��[$9���!�.����� �]\^"(�4G#"���G#-������ �V������_�I>�.���`=�''�� G#-����4J>���#� G ��ab"(�P34"(���c$9������=�� 'R�����K+^��-����a�(6 8 ��=�'P���#'�-����]=�'P�.�9����"��("(-�'2��"b�!���4H8=�'�G���� �D�AcB F)d H H�egf ((h �1��"iJ��#� O&"(-����j+k"(�4/ �UT��.�V��=����l02�����#� 3%� ���X=��j�����l'����.���9�����`34"m��� �R\^=n6o�.6�IJ>=�����"(-��p��-��!���#���!=�G��.��=�"(�q_r6�st�@'Q�!���#'�'p���9�.� "(-��c���#'�-����K��"m� 'p��"��p34�#���#�E�t'���"LJu���9�.�4��-C:�!���#���!=�G��.���#�v/ �UT#�����!=����X02�����#� 3%� ���p$���".�!"UG#"(��']��"S��"��w���#G �#'�'!����=����xG "(3%$&"('���yz�!�:�!��� �#I8J��'���"iJ{�!�9�.�R"����S|�B�}9}�~:A�G#"(��'��!��-�G �]$���"��!"UG#"���'N�!���.�PJ>=����8G#"�3%$&"('��.6%�m=���G �K�!��� ���4���m=�'Q�]$���" :�!"UG#"���'R+k"(�c-�����-��!���#���!=�G��.���#�v/ �UT#�����!=����@02�(���#� 3%� �V�c�!�9�.�K�����%��� '�=���=�� �V�R+k"(�c���S��� � G ��a+^��-��)�a��$9�.���!=��#' ������G "(3%$&"('��lG "(��G -������#���!�E�(I�����=�'p'���"LJ>'4���9�.�p�����l�����.�����������l�(��=���� �jOi��!���w$����#$���"mG �#'�'�=����@'����#$S=�����-m�!��� �V��=�G#�.�!� �S/ �UT��.�V��=����w02�(���#� 3%� �V�<$���"��!"UG#"(��'>=�'1��"('Q�1J>���#�G#"�3%$&"('�=)�!=�"(�@=�'Y���eDV-�=����#��6� �r�m�#IgJ�� '���"LJ��b��"iJ��#�PO&"(-�����"(������� �U-�3KOZ� �P"�+���"(-�����'R���eDV-�=���� �x+k"(�4�UD�AED��r�p��}9��? 2

A^��|]��-������#���!=�G��.���#�t/ �UT������!=����402�(���#�#34�#���]�!�9�:�wG "(34$Z"('��#']'��7DU-��#���!=������E�(6�\ � "����p�!�9�.�]�!���=�34$&"('�'�=�O�=���=��a� ".+���B���B F�F D F G "(34$Z"('�=���=�"(�b��"�����'>� ���#��+k"��1��������"�3%=�T#�#�*$���"��!"UG#"���'#6�_Kst�]'���"LJ�!���.�K=)+1���v��-������#����=�G��:�!�#�j/O�mT#�����!=����b02�(���#� 3%� �V�K$���"���"mG "(�,�!�9�.�w�!"(���#���.�!� ' G �.a�"(�K34"(���+^��-��)�a�c$�������=��#'z=�'8�!"RG "(3%$&"('��Y'��eDV-�� ���!=��.����� �<��=�34�#'#I.�!��� �4�����#���>�����Y�r��� G#-���=�"(��'5=��pJ>��=�G�� =����-���'Y+k"(�Y3%"����N�!����� � � � ��"(-�����' 6 8 �U-�'#I9�!���R�V-�3KO&�#�>"�+���"�-�����'>=��b�����R$���"���"mG "(�=�'Y��=��������=��S�����p�V-�3KO&�#�P"�+,��=�34�#'N=)�P=�'2��"bG#"(34$&"('��.6 8 ��=�'N��-����#'P"(-m�]���S�S$�����G ��=�G��.�8$���"��!"UG#"(�g�!�9�:�J>=�����G "(3%$&"('��R+k"��>�W\k�������(�L_5$Z"(�E�U��"(34=����&�V-�3KO&�#�>"�+g�!=�34�#' 6

� �Z�i�g�k�i�k�&�5� e�� �b-�'X�9��'Q�*$���"��U=����S'�"(34��=����!-�=)�!=�"��`=�����"tJ>�S�`�!����������� ��$Z"LJ��#�b"�+R�!���$����#$���"mG �#'�'�=����*'Q�!�#$x=����.-��!��� ���!=�G#�.�!� �x/ �UT������!=���� 02�(���#� 3%� �V�R��"m� 'P��"��R��� ��$SJ>��� ��G "(3F:$&"('�=)�!=�"��p=�',���7DU-�=���� �6>\^71� G��������!�9�.�5=�� �����>'��!�����C:E����"(���1'�� ���!=�����I(�!��� ���1���m=�'Q����-��!���#���!=�G��.���#�/ �UT��.�V��=����402�����#� 3%� ���c$���"��!"UG#"���'N�!���.�R�!"(���#�!�:�!� ���S���V-�3KO&�#�R"�+�+^��-����a��$9���Q�!=�� '#6X�N���!���"������#�5�9������I�-������#�;$����!������� ��G#"(34$&"('�=)�!=�"��I�3%"����Y�!�9�.� � G ��aw$9�.���!=��#'53K-�'Q�;O&�<��"(���#'Q��6�_ 0<�=���'��!��-�G ��=����2'����#$b=�'5��"c�9��'Q��'��#�N��"LJ ��-m�!��� �V��=�G#�.�!� �*/ �UT������!=����20<�(��� �#34�#���Y$���"��!"UG#"���',�a�m$?:=�G#�����E�K-���=���=�T#�������1$���� $���"UG#� '�'�=����K'Q�!�#$�Im=��%"(�����#�,�!"w=���G ���#��'��>+^��-��)�5��"(��� �!����G#��680¡$�-�O���=�Gb:E¢.� �=��m+k�!��'Q�!��-�G �!-����>+k"(��'�=��(���.�!-����<'�G����#34�#'Y=�',-�'�� �*�����X����=�'5���#��$�'5=��@�.G���=�� �m=����K�.�(��� �#34�#����+k"���!���]+k"(����"LJ>=����K���#��'�"(��6 �;"(��'�=���� �Y�!�����#�]$9������=�� '1£wIq¤¥������¦§$9�.���!=�G#=�$9�.�!=����K=���� '��!�����9�����\^-��9��-������#���!=�G��.���#�q_1/ �UT�������=����]02�(���#� 3%� �V�<$���"��!"UG#"(�n6�H9-��Q�!��� ��34"(���.IZ�.'�'�-�3%�R�!�9�:�2��-���=�����!���c���m� G#-���=�"(�W£{G#����=�34'��!"%¤u���9�.�<¦¨'��#���P=)�1'�"(34�w34�#'�'!������}©6 8 ��� �I¤ªG�������"��2��= <Z�#�@:�#����=��.���4O&� �EJ��#� �t�!���%G#��'�� �!�9�:�c¦«�.G �!-������E�S'�� ��� }���"W£wIg����������� G���'��4���9�.�w¦¬��=�����".�'�� ���j�!��=�'G���.��-��b�.����£«=�'c+^��-��)�a�(6 8 �V-�' I�¤­G��.����"�� O&�b'�-����b�!�9�.� £«��������������� G#�#=E�(� � }+k��"�3¬¦ 6,BE�����#� �Iq'�-�G����p3%"U���#�Z�9��'>O&�#�#�lG��.����� �@�!���l®Q"(�!����3%� '�'!�.�(�#¯ 34"m��� ��Im=��bG#"��V���!��'Q��!"%�!���x®�'�=��(���#�S34�#'�'!���(� ¯b3%"U��� �8"�+5��-m�!��� �V��=�G#�.�!� ��/ �UT������!=����p02�����#� 3%� ��� H eg� |,°S� �n6]�N��!���p"��!��� �N�9�����I��!���p-�'��p"�+5'�=��(�9�:�!-����c'�G����#34�#'R���#��$�'N�!"X"9���#��G#"(34�K�!��=�'N������G��R$���"�O���� 3W±BC+�¦u�9�.�v?��)²�}�D��w�����G�.����-�� }t������'�� ���]����=�'2'�=����9�.�!-����c��"b£cI������#��£§G "(-����S+k"���J;�������!���'�=��(�9�.��-����b��"�¤%6³�m=���G#�l£´G�������"�� +k"(�����W¦ �µ'4'�=��(���.�!-�����I5�!��=�'KJ;"(-����j�!��� �`G#"���'���=��!-m�!�l�$���"m"�+z���9�.�N¦u=������#� ��'��#��� }��!"X£c6 8 ��� ��� +k"�����I�-m�!=���=�T =����p�!���K-���+k"(���(���.O�=���=��a�*$���"($Z� ���a�W"�+'�=��(�9�.��-���� '#I�=)�c=�'c$&"('�'�=�O����4��"���G���=�� ���b/ �UT�������=����@0<�(��� �#34�#���K+k"(�w���S���U-�3KOZ� �K"�+�+^�.-����a�

¶(¶(¶

Page 112: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

$9���Q�!=��#'#6� "LJ�� �(� �#Ig�!��� ��O&"��(� =�����-�=���=�"(�W��"(����'P"(�����W=����b'�� ����=����@J>���#���4�b'�=����(���K���m�#G -��!=�"(��"�+

�!���X�������#� 3%� ���K$���"��!"UG#"(���!��¢�� 'K$�����G#�.6*�m$&�#G#=)�9G��.������I�=)+Y�l�U-�3KOZ� �w".+Y���m�#G -��!=�"(��']J;� ���%��"���.¢��N$�����G#�.Im�����#�b£¡3X�z�4'�� ���l¤§� �.����-�� }l����"(���wJ>=)�!�b¦ �µ'�'�=��(�9�.��-����<"(� }©I_��� �1¤MJ�"(-����'���=����g��"��N¢V��"LJ J>��� �����#�R¦�'�=��(��� � }�=���A � ��?1���m�#G -��!=�"(�I"��2=����X��==<�� ���#���4\kG#"(��G#-������#���P"��$���� �U=�"(-�'�_2���m� G#-���=�"(�6 8 �U-�'#I©�!���p34�#���K+^��G �P���9�.�P£¨$���"m��-�G#� 'w¦ �µ']'�=��(���.�!-����K"(�x� �.����-����"U�#'P��".�P$���"��U=����K$���"U"�+,�!���.�R¦u'�=��(���#�vA � ��? �.����-��K=���A � ��?<�r��� G#-���=�"(��6w0<'NJ;�KJ>=����g'��#� =���!���p$���"U"�+ IZ����=�'2=�'N� ��"(-��(����"b���#�����#�N�����p$�-�O���=�G;:E¢�� �S=���+k�!��'Q�!��-�G ��-����K-�'��#���#'�']-������#�P'�"(34��a�U$Z� '<".+8G "(3%$&"('�=��!=�"(�6st�%��� 3X����¢��!�9�.�w=��w=�']$&"('�'�=�O����4��"���G���=�� �(�XG#"(��G -������#���pG "(3%$&"('�=��!=�"(�I©-�'�=����S'Q���.���X=��

�!���]+k"(��3¬"�+�-���= DU-��c������G#"�3%34"(�b'�� '�'�=�"(�W=���� �V��=��9� ��' 6 � "LJ�� ���#�#I���'YJ;�w�9�z�(�]3%� ���!=�"����#�I�!���#���<�����Y3X���S�p'�G#� �9����=�"('zJ>���#���1����=�',��"U�#',��".��'��#� 3§�!"ROZ�1��G���=�� �.��O����w\n�����%3%���S�K"������#��'J>��� ���]=��Y=�'Y-������ '�=�����O����L_�6����� ��� � � � �9��� � ~c�&�!~:AE~L|�~ F�� ~:� B��UA � D�}9A^��|�B�AED�� ��� � B�}9An��}�D���²��!D�D��XD�}9AYA � B�A2|�~:�2�9~L?LD�?��}X��B���B F�F D F \�D���D�}�A��z��|�D�_c|�B�}SAE~ F D���B�AED G�� ax~:�R�X~:��D � B�� F A �]��B��rA^��D�? d

� �!~L~ � d 8 ���K$���"U"�+z"�+ 8 ���#"(���#3��m6 ¶ 6 ¶ =�'<O���'�� ��"(��'�"(3%�w"�+������c=�������'<-�'�� ��O �SH8=�'�G���� �2������n6"! H�egf ° h$# =����!���#=��p$���"U"�+Y�!�9�:� ��"�-��9��-������#����=�G��:�!�#��/%�UT��.�V��=����b0<�(��� �#34�#��� $���"��!"UG#"(�G��.�l��"(��� �!�.��� G�� ap"(�Y34"(���N+^�.-����&�X$9������=�� '#6�s��]O&�#��=��*O �*$���"('U=����p�����P+k"(����"iJ>=����K���#343X��±) ��**+,� �.-� �9�0/ � D���DXD21(��?�Ak?4}�~K�&�!~:AE~L|�~ F3� ~:�4B��UA � D�}9A^��|�B�A D����"� � B�}9A^��}�D4�5²���D�D��XD�}9A � ~:�A � ��D�D5��B��rAn��D�?65�A � B�A5|�~:�2�9~L?LD�?2��}p��B���B F�F D F \�D���D�}lA��z��|�D�_PB�}&�%|�B�}lA ~ F D���B�AEDw~:}�D � B�� F A �2��B��rA�� d

� �!~L~ � d 02'�'�-�34��I�O7�RG "(���!������=�G��!=�"(�IL�!�9�:�������#�����r��=�'���'8�>$���".�!"UG#"(� � �!�9�:��'�"(�.'��#'g�!����/%�UT����?:�!=����>02�(���#� 3%� �V�;$���"�O���� 3§+k"(�z�!�����#�2$�������=��#',£wI�¤M�����@¦ IVJ>���#���2"(���13%�(� O&�>+^��-����&��6zH9-��@:�!���#��34"(����I � ���#3%��=���'�'�� G#-����w��'(�#�*J>��� �WG "(3%$&"('��#�*=��b$9�.�!�������#�q�EJ>=�G ��6988����G ���.�*�.'Y=��@�!���$���"m"�+©".+gH8=�'�G����#�����>���n6:! H�egf ° h$# IUJ;�P�����9���P�K���������("(������';�m'Q�!� 3=<��!�9�.�;=����!� ���EJ>=����#';�EJ�"=������#$&�#�����#���NG "($�=�� '>"�+ � 6 8 �9�.�<=�' I9�����<£�>@?&¤A>rI&¦B>>�.���W£BCLIq¤DCN�.���S¦EC1OZ�]=������#$&�#�����#���G#"�$�=�� '<"�+8�!���R�!�����#�w$9������=�� '<$9�.���!=�G#=�$9�.�!=����p=�� � 6>/%�*=������ $Z� �����#���PG "($�=��#'#I9J��K34�����*�!�9�:�£A><�.���S£DCN�����]�!���K'���34�c$9���Q�&�l£{J>=����W�!���K'!��34�c¢.�F�l����$&��I&�!�9�:�N��-���'N=��l�EJ;"b��= <Z�#��� ���$9�����������#�����m�#G -��!=�"(��']"�+ � Ig��'P��� �����#��=��HGN� �9��=��!=�"(�H�m6JIm6 ��6 8 ��� '2�U'����#3K< =�'P��� �����#��O7�G#"������#G��!=����b$9���Q�&�S£A>1��"*¦ECR������¤A>K\^���.�!���#�2���9���S�!"*¦B><�.���x¤A>�_�y�$������&�S¤A>>�!"b£�>N�.���¦B>ry9$9�.���&�*¦B>��!"4¤A>������l£DC�yq�.���W'�" "(�Iq��'>=��*H�=��(-����A�P: ¶ 6

A

B C

A

C

BA

0 0

0

1

C 1 S

1

B

Π1

2

1

2

2

1

H8=��(-����A�P: ¶ ± �;"(3KO�=���=����K�EJ;"4G#"�$�=�� '1".+ � =��l�p���r���.�("(�9����';�U'��!� 3L<Y6

¶(¶ I

Page 113: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

BE�%�����<';�U'��!� 3 <YIV$9�.���!=��#',£A>�IU¤A>�Im�.���@¦B>8�9� '(�<=���$�-m� � yVJ>��=����>$9�.���!=��#',£DC#I�¤DC������X¦EC�9� '(�2=���$�-m� ¶ 6 � "��!�1�!�9�:�;J>=�����=�� <�I������q$9������=�� '5+k"(����"LJ`�����N=���'�����-�G��!=�"���'�".+ � ������G��!� �(6�s��'������ '�'Y�!�9�:� <j=�'2}�~:A��p/%�UT������!=����P02�����#� 3%� ���>'�� ���!=����*\kJ>���#���P�����N$9���Q�!=��#'Y��������"(=����#�b=��b�G#"�3%$���� �����(����$��K"��c�!�����#����"m��� '�_rI������c�����#��� +k"(���������������9��=���=�"(��'�"�+&/ �mT#�����!=����;0<�(��� �#34�#����!� ���Z-�'Y��"�����=����p��=���� G ���.�%"�+©J>�9�.�Y�!���P$9������=�� '���"�-��!$�-m�!'Y'���"(-����*O&��6��1"iJ��F'��#� I:< ��?;�cJ;� ���=:�����9���#�w'2�U'����#3 �����R����=�'�=�3%$���=�� 'Z���9�.���!���5$�������=��#'����('��zJ;� ���=:C��� �����#�]"(-���$�-��©��=�'��!��=�O�-m�!=�"���'#68 ���R$���"m"�+�$���"mG �#�#��'<O �b'���"LJ>=���� �!�9�:�>=�+ � =�'>�pG#"(����� G �</%�UT�������=����R02�����#� 3%� ���<$���"���"mG "(��I�!���#��J;�4������= '(� �.�R�bG "(���!�!�.��=�G��!=�"��S��� ��������=����@�����p"(-���$�-��R��=�'��!��=�O�-m�!=�"��S=��H<�6ws��pO&�#�(=��O �X'���"LJ>=����K���9�.��¤A>;�����b¦B>5"(-m�!$�-�� � =�� <�68s��N��� ��"����NO ��� � ����� \ � _5�����N-�$�$&�#�;OZ"(-����"(�b�!���]�V-�3cOZ� �1".+���"�-�����'>"�+ � \kJ>��� �W��-��W=��l�4/ �mT#�����!=����R02�(���#�#34�#���<'������!=����V_r6��� + � � � 1m|�DE�&A �z��A � }�D�² F �)²���� F DR�&��~���B �#� F ��A �(5Y��B���A^��D�?K¤A>*B�}&�l¦B> � B F AD�z��A � ��}��� � ����� \ � _?�AEDE�9?cB�}&�*~$�mA � �UA � ��}�A � DP?��L?�A D�� < d� �!~L~ � d s��2$���" '��<����=�',G#����=�3MO �%'���"LJ>=����]�!�9�:�������#���<�r��=�'���'��P+^��-����&� $������&�W\k"(�5���3'(� ��'����2��_ J>��">$9������=�G =�$9�.���#'=��N�EJ;"1$9�����������#�:G#"($�=��#'©"�+ � �����w'�=�3K-����.�!� '��!���z'2�U'����#3 <�ILJ>=��!�R���#'�$&�#G���!"4¤A>������l¦B>��µ'"'U=�� JR6 8 ���P+^��-����&�@$������&� \^�����b�!���R"������#�>��"����#'Q�<$�������=��#'Y$�������=�G#=�$9�.��=����=��p�����>$9���!�.����� ���r��� G#-���=�"(�9_�J�"(��¢cJ>=�����=��4�R/%�UT�������=����>02�����#� 3%� ���;'�� ����=����PJ>��� ���>�!��� ���1�����J��#��� :E�����9��� �b���eDV-�=���� 3%� �V��'Y"(�@�!���#=���"(-���$�-��Y��=�'�����=�O�-��!=�"(�6 8 ���#����+k"(���.I9O �b���9�.�.�UT#=����w�����#=��"(-���$�-��2=��W����=�'1$9�����������#���r��� G#-���=�"(��'�� ���!=�����IqJ;�p�.���w��O����R�!"%3X�.¢��cG ����=�3%'>���#��������=����4�����#=��"(-���$�-��1=��b�����R'2�U'����#3 <�6e�� �R£A>�I¤A>2�����x¦B>1OZ�p$�������=��#'2��-�����=����*�����r�m�#G#-m�!=�"���"�+ � I���#��"��!� � � >rIJ>���#��� ¤A>

�����[¦B>wO&"��!�v�9� '��l=���$�-�� � 6�H9-��Q�!��� ��34"(���.I5��� �p£BC�I5¤DC4�����[¦EC OZ�b��-�����=�������$9�����������#����m� G#-���=�"(�["�+ � I5���#��"��!� � � CLI,J>���#���l¤DC%�����[¦EC O&"��!�j�9� '(�l=���$�-�� ¶ 6�71� G������;�!�9�:� ¤A>�����W¤DC<�����R=������#$&�#�����#���<G#"($�=��#'>"�+��!���R$9���Q�&�l¤�J>=)�!�b�!���]'���34�]¢.�F�*���.$Z�4\^��'>��� �9���#�S=��GN� ����=���=�"(� �m6JIm6 �V_�y���=�¢.� J>=�'��N+k"(�>¦B>������W¦EC�6� "LJRI���� � O&�N�.�b���3'��#��'����2�XJ>��"KG#"��V����"(��'�O&"��!�@£�>5=�� � >������b£BCY=�� � C]\^���#G#�����q�!�9�:�

�!���1+^��-����&� $9���Q�&� G����%G#"U"(����=��9�.���>OZ���EJ;� �#�@�!���2��==<�� ���#�������m�#G -��!=�"(��'!_�6��8�.���&� �o'5'����!�.���#���=�'5�!"p3%����=�G#=�"(-�'�� �K�(� ���#���.�!�R�.�b���m�#G -��!=�"(�b=��XJ>��=�G��l¤A>��µ'Y�����*¦B>��µ' 'U=���J =�� � >5=�'N�^�UD�}9A^��|�B F�!"4�!��� =���'U=�� J =�� <�6 ��G���=��F'(� '2�!��=�'2O �l��� ��=����#G��!=����X�#���(�#'N".+��!���]�EJ;"X$9���!�.����� ��!��=����������#'\^���#$����#'��#���!=����N�!����$9�����������#�����m� G#-���=�"(�q_rI('�"<�!�9�.���!����"('(�#�������U'2�U'Q�!�#3M�9��'g�!����'!��34�;O&�#�9� 'U=�"����'B<�y�'�� �cH�=��(-������P: Im6

0

AB1

C

B

0

0

0

C S

1

1

1

A

C

B

0 0

A

1

1

B

A

C

1

2

2

Π

2

1

1

2

2

1

1

2

1

1

H8=��(-������P: Im±,7>�#��=����#G��!=����p�#�����#'1"�+ � >Y�.��� � C1��" 3X��¢.�]� ���������("(��6�m$&�#G =��9G#����� �(Iq�!���*\k£A>�?�¦B>Q_<�����[\k£DC(?�¦EC�_1�#���(�#'P"�+ � ><����� � CP���#'�$Z� G ��=.'(� �.�S�����K���#34"('(�#��I�����b�����%\^£A>6?�¦ECr_������t\^£BC ?�¦B>�_;� ���(� '1".+ <[�����R�������#�l=��@�����#=��Y$�����G ��6 =�'Y�.O����N��"43%��¢.�'�-�G��W�]3%"U��=)�9G��.��=�"(�4O&�#G��.-�'��N=)�;"����.�4=�� '�"(�.'��#'����#��=����#G��!=����c34�#'�'!���(� ';�!"K�����X+k��"(3�$9������=�� '�!���.�>=��>G "(���!��"���']\^=n6o�.6�I�£A>>�.���*£DC�_�6

¶(¶ a

Page 114: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

/;� +k"�����$���"mG �#�#��=�����I1J;��$����#'��#���*�!����+k"(����"LJ>=�������"��!�.�!=�"(�±t��� ��� ����� \^£�>@?�¤A>�_X���#��"�����!���c34�#'�'����(�w'��#���N+k��"(3´£A>Y��"@¤A>Y=��W������� ��� ��"(-����S"�+������c$���"��!"UG#"����r��� G#-���=�"(��61s��c��"LJ+k"(��3X�����.�1'���"iJ���"LJt�!�����.�3'(� ��'!�.�2� J�"(��¢U' 6 =�� '("(¢.�#'g$9���Q�!=�� '�£A>������R£DCLI:-�$&"(�R=���$�-m�!' ������ ¶ ���#'�$Z� G �!= '(� �.�(64st�4'������ '�'w���9�.�]£A>P������£DCw+k"�����"LJ �!���%=���'�����-�G��!=�"���'R"�+�$���"��!"UG#"�� �������G��!� �(6 �<"LJ��F'��#�#I $���"('m=����#' �!���#3 J>=)�!�v�!��� =��p=���G#"(34=����S3%� '�'����(�#'4�����['��#����'4�����#=��"(-����("(=����X34�#'�'!���(� 'N+k"(�<�����#3l6 8 ���K"(���.�W3X����=�G =�"(-�'>O&�#�9� 'U=�"��2"�+ =�'<=��������p��� ��=����#G��!=�"��"�+z34�#'�'!�����#'2��"@�����W+k��"(3´£A>>�����S£BCL6<0 +k-����©��� '�G#��=�$���=�"(�W"�+ �µ'2G "m���w=�'<��'<+k"�����"LJ>'c\kJ����� G#"(3434�#���b�!���]���������#�Y�!"4����+k�#���!"%H8=��(-���� �P:;IK=��*"(�����#����"%G ������=�+ �4�!���P+k"(����"LJ>=����V_�±¶ 6�D�}&� ~$�mA�²U~:��}U² �XD�?�?#BL²UD�?[~ � �!~$�U}&���� "(O����.=���'�34�#'�'!���(� ' � ����� \^£�>@?�¤A>�_S�.���

� ��� � \^£A>6?�¦B>�_;+k��"(3u£A>;=�� � >�Iq�����*3%� '�'����(�#'�� ��� � \k£DC ?!¤DCr_Y������� ��� � \k£DC(?�¦EC�_�+k��"(3£BCN=�� � C4\k�����#'��p�����]�����K��"�-�������3%� '�'!�.�(�#'N'��#���PO �l£A><�����S£DC2��"%�����K"������#�<$9���@:��=��#' y5��'wJ��@�9� '(�X3%� �V��=�"(���#�I�£�>w������£BCKG#"�3%$�-m�!�%�����#'��b3%� '�'����(�#'K��G#G "(����=����W��"�����R$���"���"mG "(������9��=)�!=�"��W�.���*O9��'�� ��"(�b�����#=��E'm=�� J<_r6

� BE� � >�I '��#����'4¤A>]�����b3%� '�'����(��� ����� \k£A>�?�¤�>�_K�����v'��#����'%¦B>R�!���b3%� '�'!�.�(�� ��� � \^£BC(?�¦ECr_@\^�������!�V-�'K�����x\^£�>@?�¦B>�_]��=����#G ���#�j�#���(�b=�'w���#$�����G �#�jO �t�!���@��==:���#G��!�#�W�#�����X\k£DC(?�¦B>Q_�_�6

� BE� � CLI '��#����'4¤DCp�����b3%� '�'����(��� ����� \k£DC(?�¤BCr_K�����v'��#����'%¦ECK�!���b3%� '�'!�.�(�� ����� \^£�>�?�¦B>�_@\^�������!�V-�'K�����x\^£BC ?�¦ECr_]��=����#G ���#�j�#���(�b=�'w���#$�����G �#�jO �t�!���@��==:���#G��!�#�W�#�����X\k£A>�?�¦EC�_�_�6

Im6 � �#A�B���}*��}�|�~:�p��}U²p�XD�?�?#BL²UD�? � �!~:�ª�!~$�m}&���� ��� G#� =.'(� '�34�#'�'����(� '�� ��� � \^¤A>@?!£�>�_5�.���� ��� � \n¦B>@?!£�>�_;+k��"(3¬¤A>Y�.����¦B>;=��l��"�-������5".+ � >�Iq�����l3%� '�'!�.�(�#'�� ��� � \^¤DC(?!£DC�_>�.���� ����� \n¦EC ?!£BCr_;+k��"(3¥¤DC<�����W¦EC1=��*��"(-������,"�+ � C�6

� $9��'�'��#'<£A>Y=�� � >������c34�#'�'!���(� '�� ����� \n¤A>�?�£A>�_Y������� ����� \^¦EC ?!£DC�_R\^�����W���V-�'�����%\n¦B>�?!£�>�_;��=����#G��!� �W� ���(�]=�'Y��� $����.G#�#�*O �b�!���]��=���� G ���#�l�#���(�%\^¦EC ?!£A>Q_�_�6

� $9��'�'��#'<£DC2=�� � C<�����c34�#'�'!���(� '�� ��� � \n¤DC(?�£DCr_Y������� ��� � \^¦B>@?!£A>�_R\^�����W���V-�'�����%\n¦EC(?!£BCr_;��=����#G��!� �W� ���(�]=�'Y��� $����.G#�#�*O �b�!���]��=���� G ���#�l�#���(�%\^¦B>@?!£DC�_�_�6

s�����"LJ[G#���.=�3 �!���.�,¤A>������ ¦B>��o' 'm=�� J[=�� � >g=�'�=���� ���!=�G#���V�!"P¤A>8�����p¦B>��µ' 'm=�� J[=�� <�6�� 8 ��=�'��"(����'2O&�#G#��-�'��4=����!���K$9�����������#�©���m�#G -��!=�"(��"�+ � ><�.��� � C�I�����g$9���Q�!=�� '<+k"(����"LJ �����K$���"��!"UG#"(������9��=���=�"(�l\k=���G ��-���=����P£�>��.���%£BCr_�6 8 ���>'!��34�Y=�'�����-��>=��K�����>'2�U'����#3 <�I����mG �#$��5�!�9�:�,$9�����&�£A>�=�'>G#"������#G��!� ���!"%¤A>>�.���S¦EC<=���'Q�!���.�W"�+��!"%¤A>1������¦B>r6�e©=�¢���J>=�'��.Iq£DC2=�'>G#"(�����#G ���#����"¤DCw�����x¦B><=���'Q�!�#����"�+���"l¤DC]�����x¦ECL6 �<"LJ��F'��#�#IgO �S�!���4��� �9��=)�!=�"(��"�+ I��!��� 34�#'�'!���(� ''�� �#�*O �b�����Z$�������=��#';=��@�!���N$9�����������#�q���m�#G -��!=�"(�*"�+ � >������ � C>�����2������G ���.�%�!���N'���34�P��'��!���34�#'�'����(� 'Y'��#� �WO �%�!���N$�������=��#';=�� < \^�.6o��6)I������P3%� '�'����(�#'Y'��#� �lO �@¦B>;=�� � >;�����2�!��"('��P'��#���O ��¤A>]������£DC�I�������G��!�.����']=��,<,_�6 8 ��� ����+k"(���.I8�!��� 'U=�� J>'w"�+>¤A>P�����t¦B>R=����!���%$9�����������#����m� G#-���=�"(�l3X�.��=�G =�"(-�'��.�4G "(���!��"������ �bO � I9�����p�^�UD�}9A^��|�B F �!"p�!��� =��E'U=���J>'<=�� <�6��

�� d �=a��"!�#$!&%AO m f^ORU Q W�����'(')!*%PO Y a,+&!SfhORQ fhd!*%PO YAa-+ ab]^]hO@]CO".2O1��/0!SfhWbd U�f�!&%21 a,+ O,f �2O@d3!Sf �@ab]4! W5!*%PO@f6+ m fhO@Ufhd7!&%PO6QSi2Q8! O@_:9No<; WnU ORmbO�+=# f^d W>+ �PO�+?!SW`W7\0! abf^d�@ ]ga;fh_ 52o AB#PUXO,dPO@O � W7dP]hi a;d a;]hi*)ROC!&%PO6m fhO@U Q�W��ED J abd��F J o G�H O$dPW-!SOC!&%AO ��+&/��@fhab] �2f�I O�+ O@d��LO \ O�!VU ORO@d�!&%PfgQXY)+SW W��Ca;d��5!&%Aa,!�W��KJ fgQ �L%PO�+NO"! a;] o�M JON4P�Q-R�SUTV!&%PO �=a,/A]�!Vi¶(¶ �

Page 115: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

/%������� ��'�'�-�34$��!=�"(�����9�.� � =�'P�@G#"������ G �]/%�UT#�����!=����p02�(���#�#34�#���P$���"���"mG "(�����9�.�PG "(3F:$&"('�� 'R�EJ>=�G#�p=���$9���!�.����� ��IqJ;� �9� '�� ���9�.�#I����mG#� $��wJ>=)�!����� �(��=��(=�O����]$���"(O���O�=���=��&��I�=�� � ><OZ"����¤A>2�����x¦B>1�9�.���NJ>=)�!��=�� �� � ����� \ � _2'����#$�']������"�-��!$�-m� � 6 8 ���K+^��G �P���9�.�N�����F��OZ"�����"(-��R:$�-�� � =�'Y��� ��=.'��#��+k��"(3¥�����]+^�.G �>�!�9�:�2¤�>>�����W¦B>>�.���]���l��"(��� '��<3X����"���=��&�%J>=����l�����w'���34�=���$�-��A'��.��-�� � 6 8 ��� ����+k"(���.I8�!�����x3K-�'��w"(-���$�-�� � =��x�����%+^��G �%".+]B�} �4���3'(� ��'�����=����,£A>ryz=��$9���Q�!=�G#-������;�!��=�'Y��"(����'�J>=����*���#'�$Z� G �1�!" �!���R'�$Z� G#=���Gw�.�3'(� ��'!�.�2� ���#'�G#��=�OZ� ���.OZ"('(�.6��U=���G ��!����'U=�� J>',"�+�¤A>z�.���X¦B>8=�� <x�����Y=����#���!=�G����m�!"R�!��� =�� 'U=���J>'5=�� � >rI�J��1G "(��G ��-����Y���9�.�5=��p�!���'2�U'Q�!�#3=<YIU�!�����b����'�"K�������5J>=�����=��� � ����� \ � _,'��!� $�'1�����@"�-��!$�-m� � \^�r��G �#$��YJ>=)�!�b��� �(��=��(=�O����$���"(O9��O�=���=)�&��_r6 8 ��=�'>G#"(34$������!� '>�����R$���"U"�+g"�+g�!���RG ����=�3W6� '�=����4��������"(��"(-�'>�����(-�34�#���!' I�J;�]"(O��!��=��@�����P+k"(����"LJ>=����c�EJ�"XG ����=�3%' ±��� + � � � 1m|�DE�&A �z��A � }�D�² F �)²���� F DP�&�!~���B �#� F ��A��(5���B��rAn��D�?c£DC�B�}&�*¤DC � B F A �z��A � ��} �� � ����� \ � _?�AEDE�9?cB�}&�*~$�mA � �UA ¶ ��}�A � DP?��L?�A D�� < dBE�b"(�����#����"K$���" '��2�!��=�';G ����=�3WI������<+^��-����&�4$9���Q�&�X=�'��x�.���@=��5J�"(��¢V'Y=��X�c'�=�3%=�������J;� �%��"

=��W�!���K$���"U"�+,"�+ �;���.=�3L�m6oa@��O&" '���6%\ 8 ���p"(���.�l��==<�� ��� ��G#�K=�'2���#��������=����X�!���c�#���(� 'N�!�9�:������]���#��=���� G �!� �6�_��� + � � � 1m|�DE�&A �z��A � }�D�² F �)²���� F Dw�&�!~���B �#� F ��A � 5;��B���A^��D�?p£BCSB�}&�*¦B> � B F A �z��A � ��}��� � ����� \ � _?�AEDE�9?cB�}&�*~$�mA � �UA;A � DP?#B��XD��:B F �qDP��}�A � DP?��L?�A D�� < d�m=�34=�������� �(I�����=�'�G#���.=�3 =�'�$���"('��#� O �c���.¢U=����<�����;+^��-����&�]$9���Q�&�K��'��tJ>��"N+k"(����"LJ>'8�<'�=�34=������

'����!�.���#���X�!" =��b�!���R$���"m"�+�"�+ �;����=�3 �U6�a4��O&" '���6�;"(3KO�=���=���� �;���.=�34'��U6�a�I �m6oaS����� �m6�alJ;�b"(Om����=�����G "(���!�!�.��=�G��!=�"��6 8 ��=�'K=�'wO&�#G#��-�'��.I

"(�v�!���b"(���*�9�����[¦B>w3K-�'Q� "(-���$�-�� � =�� <ª\ �;���.=�3 �m6�a(_�I5�����j£DC43K-�'Q� "(-���$�-�� ¶ =�� <\ �;����=�3��m6oa�_�64�N���!���4".�!��� �P�9�����I©O � �;���.=�3��m6�amI�$9������=�� 'P£DCw������¦B>23c-�'��]"(-���$�-��R�!���'!�.3%� '.����-���6 8 ��=�'>G#"(��G ��-����#'>�!���R$���"m"�+g"�+g�!���]���#343X�m68 ��� "(��� 3��U6 ¶ 6 ¶ =�'>��� ��=.'��#��+k��"(3«e��#343%� �U6�a�6 ¶ =��*�!���]'��!�����9�.���*J�� �*! �5��e ° � IZeg� � ° I # O7�'���"iJ>=����b�!�9�:�R=�+,�!��� ���p�r��=�'���'w�b$���"��!"UG#"����!���.�R=�'NG "(�����#G��]+k"��P��� � G�� a*����� G�� aX+^�.-����&�$9���Q�!=��#'#IZ�!��� ��"(���KG�����G "(��'�����-�G��w�@$���"���"mG "(��+k"��Pa@$9���Q�!=�� 'N�!�9�:�PG�������"(��� �!�.���K"(���c+^�.-����&�$9���Q�&�(6 8 ��=�'g=�'©=��]G#"��V���!����=�G ��=�"(�R�!"<e��#343X� �m6oa�6 ¶ I.�����w���V-�' 8 ��� "(��� 3 �m6 ¶ 6 ¶ =�'©=�34$���=��#��68 ���K+k"(����"LJ>=����%G "(��"(�������;�(I&����+k�#����=����@��"@G#"���G#-������ �V�]G "(3%$&"('�=��!=�"(�I&=�'<=�343%� ��=��.���#� �b���#��=.'��#�+k��"�3 �!����+^��G��*�!�9�.�l$9�.�!�������#�<G#"(34$&"('�=)�!=�"�� \kJ>��� �����!����'�G����#��-���=�����"�+]�!����34�#'�'����(� 'W=�'���m�#�X����� '2�U��G�����"(��=�T#� �q_5=�'z3%� ���#� �p�P'�$&�#G =�����G���'��<"�+ZG#"���G#-������ �V��G#"�3%$&"('�=)�!=�"(�*\kJ>���#���>�!������3'��#��'!���;�*G#"(���!��"(��'Y�����R'�G���� ��-���=����V_r6� ���:� ��� + ��� � �.-����� ~P�&�!~:A ~L|�~ F � ~:�cB��UA � D�}9An��|�B�AED�� ��� � B�}9An��}�DB�5²��!D�D��XD�}9A,A � B�AY|�~:�2�9~L?LD�?|�~:}�|��U���!D�}9A F �@\!D���D�}SA �z��|�D�_p|�B�}SAE~ F D���B�A D G � a�~:�R�X~:�!D � B�� F A �P��B���A^��D�? dYAa-+ !Vi 1�fgQ ab\P]hO !SWjQSf^_ /P]ha,!SO !*%PO6ORd>! f�+ O� J�� F �� D �� Q O��b_EO@d3! W��V!*%PO %PO�.Pa��bW7d QSi2Q8! O@_ 9 \ i f�! Q OR] �VoK?% /AQ�# fhd a�� ����-' � O".2O �"/0! f^W7d W���� U�f�!&% D J abd�� F J # YAa-+ !Vi 1 �@abdFQ fh_ /P]ga�! O !&%AO %PO�.2a��bW7d o; O�+ O-# �0/AO!SW�!&%AO �=a � !C!&%Aa,! !*%POEYAa,+&!SfhORQCD abd�� F %Aa m7O QSO1�"+ O"! f^d:� W-+ _Ea,!SfhWbd�!&%Aa,! 1 �2W ORQ dPW-!C%Aa m7O a ���LOcQSQ !SW #�1fgQ /AdAa;\P]hO !SW Q fh_ /P]ga�! O !*%PO@f6+$\ O�%Aa m f^W>+�f�! QSO@] �Vo�� a,!&%PO�+�#�1 dPO@O �PQ !SW + O1�Pf�+ O1�"! _EORQ Q a��bOcQ � + Wb_ !*%PO Y a,+ a;]h]^OR]O".2O �"/0! f^W7d W���� f^d W-+#�2O�+<! W �LW7_ZYA]^O�!SOC!&%PO %AO".Pa��7Wbd o

¶(¶��

Page 116: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

��� � ��� ������� ��������� ����������� ����� � � ���! �"�#��$ � ���%� � �&�(' � $ � � � ' � � �s��N��"LJ '���"LJ �!�9�:�;�!���#���2=�'��w'�=�����=��9G#��������=�34=����:�!=�"��K"(���UD�AED��r�p��}9��?�An��|�/%�UT#�����!=����N02�(���#�;:34�#���z$���"��!"UG#"(��'g���9�.�8G#"(34$Z"�'��<?LD*) �9D�}9An�^B F�F �:6z�U$Z� G#=���G������.�(I.��� �K$���"���"mG "(�UJ>��=�G��K�!� ��34=��9�:�!�#'J>=�����=��,+N��"(-�����'zG��.�4"����.�wOZ�YG "(34$Z"('��#�p'��eDV-��#����=������.�c+k"��z�.�z34"('��9I-+ � ¶ �!=�34�#' 6 8 ���1��"LJ;� �O&"(-�����=�'2���#��=.'(� ��O ��'���"LJ>=����b���9�.�P+k"(�P�.�7����� ���#��3%=���=�'Q�!=�Gc$���"���"mG "(� � I.+@��"�-�����'P"�+5�!������r���.�("(�9���©';�m'Q�!� 3�< \k'�� �cH8=��(-������2: ¶ _;G#����O&�R'�=�3c-����.���#�l=�� I-+p'��eDV-��#����=����g���m�#G -��!=�"(��'1"�+� 6802'�J��2���('��N'�� �#�@=��4�����2$���"U"�+"�+ 8 ���#"(���#3 �m6 ¶ 6 ¶ IU�����<��O�=���=��&�w�!"c'�=�3K-����.��� <t���#'�-�����';=���pG#"(�����!����=�G ��=�"(�@��"K�!���RG#"������ G �����#'�'<"�+©�����R/%�UT�������=����R02�����#� 3%� ���<$���"���"mG "(� � 6 �1"LJ;��'(�#� I��G "(���!�!�.��=�G��!=�"���=�'w"(���.�x��� ��= '(�#�v=)+Y�!���X'2�U'����#3 < �9�.���!' 6 � ��'(� ���!���#��� '�' I�'�=���G � � �!� ��34==:�9�.���#'RJ>=�����=��/+*��"(-�����'#Ig�!���4'2�U'����#3 < ����'�"l�9������']J>=)�!��=��0+l��"(-�����'#6@s��%G "(��G#��-���� �!�9�:��!���]$���"���"mG "(� � G����lO&�P'��eDV-�� ���!=��.���.�@G#"(34$Z"�'��#�l�.�134"('��BI1+�� ¶ ��=�34�#' 6st�4��� 3X�.��¢S�!���.�]=�����G ��-9����=)�&�(I©"(���4G��.�t$���" '��@�l3%"(��� �(�#��� �!���,'Q���.���#34�#���w���9�.�]'!� �U'

�!���.�<+k"��cB�} �R�����!� ��34=���=�'��!=�GP$���".�!"UG#"(�nI&+4��"(-�����'<"�+9I $9�.�!�������#���r�m�#G#-m�!=�"���'2"�+��!���]$���"��!"UG#"(�G��.��O&� $Z� ��+k�#G��!� �S'�=�3K-����.�!� ��=�� I-+@'��eDV-��#����=����,���m� G#-���=�"(��'R"�+5�!���4'���34�4$���"���"mG "(��6*\nfW"(����(� ���#������� �(I2+W��"(-�����'p"�+3t$9�����������#�5���m�#G -��!=�"(��'p"�+<��$���"���"mG "(�;G#���vOZ�b'�=�3K-����.���#�t=��43657+'��7DV-��#���!=����©���m�#G -��!=�"(��' 6 _ 8 �U-�'#I&�#'�'��#���!=������ �(I������R��� ���#��3%=���=�'Q�!=�G2'��eDV-�� ���!=��.�g��"LJ;� �1O&"(-����W=�'��� ��=.'��#�lO �*���#��-�G#=����%=)���!"p�����R$9���!�.����� ��G "(3%$&"('�=��!=�"(�@G#��'��]"�+ 8 ���#"(���#3 �m6 ¶ 6 ¶ 6 8 �9�.�1=�'#I����� ��� � � � �q�!8 D�A � ��DNBN�����!�#��3%=���=�'Q�!=�G>�&�!~:AE~L|�~ F � ~:�2B��UA � D�}9A^��|�B�A D�� ��� � B�}9A^��}�D ��²��!D�D:9�XD�}9A]A � B�A |�~:}�| F ���UD�?WB � AED��;+��!~$�U}&�:?�~ � |�~:�p� �m}9��|�B�A^��~:} d / � D�}35 � |�B�} ��D*?LD*) �qD�}9A^�^B F|�~:�2�9~L?LD��XB�A5�X~L?�A I-+�� ¶ A^���XD�? d

.0/�< = �>b�S%?@�z�A@,BCB � D 5;E F 5;GH@JIKB# LM@,?KNPOQE �SR<%N TVUWO �HOJXY O;BCG

Z �j�!��=�'p'��#G��!=�"(�[J��l$���� '��#���4�EJ;"���� '�-��)�!'#6\[Y���*�9��'��4"(���*=�' ��$���"��!"UG#"(��J>��=�G��j�!"(���#���.�!� '��� �K��]_^ � I2+^��-����&�K$�������=��#'5�����%�9�.'5$&"(� �m��"(3%=����UG#"(343K-���=�G��.��=�"(�cG#"(34$����r�m=��&�*\k=�6µ��6)I�O9�����a`J>=��m�!�q_r6b[Y���K'�� G#"(���S"(���w=�'1�%$���"��!"UG#"��©���9�.�<G����W�!"(���#�!�:�!�]��� �l�U-�3KOZ� �2"�+�+^��-��)�&�*$9������=�� 'O�-��1=�'Y���m$Z"����#���!=�����=��b�����R�U-�3KOZ� �>"�+8$�������=�G#=�$9�.��=����K$�������=��#' 6

[Y���PO�-�=�����=����cO���"UG�¢4+k"(�;OZ"����b"�+©�!���N��OZ"('��P$���"���"mG "(��'5J>=����ZO&�P�K�!�.����"(34=�T �#��\k'��AcV-�� �d`�!=������ �*G#"(34$&"('!��O����L_1$���"���"mG "(��IZ0N/be �*f >rI+k"(�N��-��!���#���!=�G��.���#�x/%�UT�������=����QeP�#��� �!����'NOZ���EJ;� �#�aW$�������=��#'w�����x�!"(���#���.�!=����*"(��� +^��-����&��$������&��6W7>�#G#���������9�.�w0N/be�g f h ���#��"��!� 'K���v�.-��!��� ���!=i`G��:�!�#�`/%�UT�������=����jeR� ���#������'p$���"���"mG "(��+k"(�k^ $9������=�� ' ���9�.� �!"����#���.�!� 'p-�$���"x�w+^��-��)�!'#6js���9��'��w$���� '��#���]�!���4$���"��!"UG#"(�80N/be �*f >P�.���x�����#��'���"LJ¨��"iJ§=��RG��.��O&� -�'�� �t�!"l��G���=��F'��%�!�����O&"('(�:`C���#'�G#��=�O&�#�����#'�-�����'#6

l��nm��� ������� �����������(oqp ���r�,��� ��s%���utwvyx{z}|�~H9"(�>�!��=�'<$���"��!"UG#"��©J��K�.'�'�-�3%�]�!�����#�c$�������=��#' ±;�!���c�(� ���#������I��4I&�������!���w��� G#=�$�=��#����'��9>6?�� C�6[Y���keP�#���#�!�.�8�9��'2����=���$�-��D'.����-����©6N02G G#"(����=����@��" GN���9��=���=�"(�0�m6JIm6 ¶ I�$9���Q�!=��#'�� >1�����0� C��� �#����"X"(-���$�-��1�!���w'!��34��'��.��-��%�&��IZ�����Iq=)+W�¨=�'1��"��1+^��-��)�&�(I9�!��� �j�&�����©6>02'1=�'1�F'U=����#���+k��"�3 �!���b$���"U"�+k'p"�+>�!���l=�3%$&"('�'�=�O�=���=)�&�(I©J>�9�.�4��=������#��' ��'�"(��-��!=�"(��=�'K���9�.�p+^��-����&��$9������=�� 'G��.�����2�9~:�rAg34�#'�'!�����#'2+k��"(3«$�����'U=�"(-�'<���m�#G -��!=�"(��' I������l�!��� ���K=�'<��"%3%�#����'1�!"X��=�'���=�����-�=�'��

¶(¶Lh

Page 117: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

O&� �EJ��#�#�%�!��"('��N�����4�����<G -������#����3%� '�'!�.�(�#' 6W[Y�U-�'#I�=)+�'�"(34�1+k���#'������#'�';G#"�-����4OZ�1=�������"U��-�G#� �=��b�����w'�=��(���.�!-����#' I��!��� �W�!��=�'YJ;"�-����*+k"(=��Z�!���]���3'��#��'!���;� �µ'P��G��!=�"(��'#6��5� �#Iq���(���#�#=���� "(�l'�-�G��+k��� '������#'�'<J;"(-�����$�-��N-�'<=��W�%G =���G -����.�1$���"(O����#3l6 � ��'(� ���!���#��� '�' I��!���wG���'��c"�+��!�����#�w$9������=�� '=�'*��=���� ��� �V�#±³��� �����!��� �����.���x"(���.�`�EJ;"�$9������=�� 'lJ>��"����#� � �!"[��� G#� =.'(������G�� '�=����9�.�!-�����6H9-��������#��3%"�����Iq=)�<��-�����'<"(-��1�!�9�:�2=)�<'�-��4G#� 'P=�+8�����c$�������=��#'>J>��"b�.���4��D�|�D�� �L��}U²]�%'�=��(�9�:�!-����G��.� ��"(=����!�.���������#�*"(�[�S+k��� '��['�����=�����6vH9"(����-��9�.���#� �(I>A��;~X$9���Q�!=��#'pG��.�[�#��'�=��.�����(��� �b"(�[�����J¡+k���#'�� '.����-���±��!�����@'�=�3%$��.� ���mG��9�.���(�R3%� '�'����(�#'������b'����Y�!���<+k���#'��b'�����=����c�!"p�ScU-������!���G#"���G��.���#�9�:�!=�"���"�+��!���]���mG��9�����(�#�0'.����-��#' 6 � "LJRIZ=��l�����]$���"���"mG "(��J>��=�G��l+k"(����"LJ>'>+k"��>������� �$9���Q�!=��#'#I�J��2���AcV-�=����1���9�.�,J>��� ���F'��#�Y�]$9�����&� '�=��(��'��]3%� '�'����(��IU=��,-�'��#'5+k��� '������ '�'����#��� �!�.���#�O �t�����X�EJ�"����#3%��=���=����W$9���Q�!=�� '#6�s��@��".�!�X���9�.�p=��t�!���X$���"���"mG "(��I�"(��� �������6eP�#��� �!���nIW�4I'�=��(��'2�X3%� '�'����(��I������������#��� +k"(���K"(��� �l=��<���#� ��'P�X$�-�O���=�Gw¢.�F�(6%[Y���K$���".�!"UG#"(�g=�'1���#'�G#��=�O&�#�=���H8=��(-���� � `Ea�6bH9"(�R'�=�3%$���=�G =��&�(IJ��b��'�'�-�34� �!�9�.�]�!���X'�=��(�9�.��-����4'�G����#34�X=�']�����9���#�t'�-�G���!���.������\ �(_>�.��'�" G "(������=���'��!��� '.����-�����6

�������������������� "!����#$�%�'&(��)*#+)-,.!��/!�#10 �����������2-!�&43657)-898/:;����)*�/!�<4=>�%�9?4@�A#+�%B*)*�/!C�D��E��F:-GH@I� "!��J#9!��K2-!�&MLN57�J:-#9#+!�8/�O:P�Q<Q���R1�/:(3H5SH)-���Q!CT

0*U�V > )-�Q<WV C )*R-#9!�!�:P�4)I#$)-�Q<:P,X��)*�O!���Y*ZQ)-8KG[:P���%:\=>8��

] )N^_V � �$?:`:P89!�8�)I#+)-��<:P,ba`cd���%�K89�/#+���RIe � )-�Q<f89!��Q<Q8K�%���/:gV�h] ��^M "!���Y>ije >lk e C Z=>?!�#9! k <!��:-�/!�8>�J:P����)*�/!��Q)*�9�%:P�mU

n U�V > )-�Q<WV C ��:-�9?f89!��Q<oYp�/:(@1Uq U�rs!���Y � <!��:-�/!t�9?!p,.!�8989)*R-!p�9?Q)*�K@u#9!��J!��%B-!�<(Gv#+:P,wV � ���x�9?!t�Q#9!�B;�%:P�Q8H#+:P�Q�Q<mUH@G[:-#+,�8�yzi|{O}J~ ] T���Y > ��Y C ^�)-�Q<W89!��Q<Q8�y��/:xV > )-�Q<WV C U

�U��t!��:-�/!x�"&My � �9?!x,.!�898+)*R-!x#9!��J!��%B-!�<��`&�V � ���M�9?!��Q#+!�B"�%:P��8�8/�/!���G[#9:P,��IU�V ��+?Q!��92;8W=>?!��9?Q!�#f�9?!�,.!�8989)*R-!�y � ��8f)�B*)-����<|89��RP�Q)*�9�#9!�:P�|�9?!���)*��!���Y ] )-�Q<)-�:-�9?!�#�ZQ�O:P8989�%����&�<Q���O!�#9!��N��ZQ��)*��!��[^$U6� G�8/:ZQV � G[:-#9=F)*#+<Q8�y � �/:xVOh-U

� U�V � <!��:-�/!�8K�`&gy �h �9?!C,.!�8989)*R-!C�9?�)*�K�%�F#9!��J!��%B-!�<oG[#9:P,�V�h����(�9?!p�Q#9!�B;�%:P�Q8F8/�/!��sUV � :P�Q�/����98K)-���J:-#+<����R.�/:x�9?Q!CGv:P����:�=>���QR1#$�Q�%!�8F��)-8/!�<W:P�W�9?!C!J�)-,����Q)*�9��:P�f:-G�y �)-�Q<fy �h ����>)-���6B�)-����<�89�%RP��)*�9�#9!�8C:P��,.!�8989)*R-!�81�J:P�N�9)-���Q���RW�9?Q!x��)*�O!���Y�)*#9!�G[:-#��9?!g89)-,.!B*)-���!CT�Z�9?Q!��f:P��/�����T�U�.�\���`�\�g�[��� Z":P�Q�/����K)�<!�G )-�Q�%��B*)-���!-U

H8=��(-����A� ` a�±802-������#���!=�G��.���#��/be +k"(�b[Y�����#� �8���Q�!=��#'

02'zJ��1J>=����VJ>=�'�� �!"R=���G#"(��$Z"��!�.��� �z��"���"mG "(��� `EaN=����!"]�P$���".�!"UG#"(��J>=)�!�k^b$9���Q�!=��#'�J��<'Q���.����pO���"(�����#�>G ����=�3ª+k"(�������RG#"(34$&"('�=)�!=�"��X�!�9�.�l+k"(�>�p'�=�34$����2������� �w$������&�b'�� ���!=�����6

¶(¶ �

Page 118: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

) ��**+,� ���©� �9� �N?�?��U�XD*A � B�APA � D@?��)²�}&B�A �U��D%?L| � D��XDo� ��?SD21(��?�AED�}9An�^B F�F ��?LD�|��U�!DlBL²�B���}�?�AB���B��&A^� ��DN| � ~L?LD�}@�XD�?�?#BL²UD1B�A^A�BU|��L? d / � D�}35 � �!~:A ~L|�~ F ���XaX��?<B]?LD�|��U�!D��&�!~:A ~L|�~ F � ~:� ���� �*f >A � B�A,|�B�} ��DP|�~:�2�9~L?LD��N?LD*) �qD�}9A^�^B F�F ���z��A � ��}lBP?��i?�AED��¥~ � ^l��B��rA^��D�?65g��} � � ��| � �>�4B�� ��D�|�~:�XD� B�� F A��(5 � ~:�wB�} �]��] ^ d� �!~L~ � d s��t$���" '��������x�����#"����#3 O � G#"��V���!����=�G ��=�"(��6¥02'�'�-�34���!�9�.���j'��#��=�� '�"�+c0N/be �*f >$���"��!"UG#"(��'b�����x��-�� '��ScU-��#���!=������ �(I2'�-�G��¡���9�.�*=�� '�"(34�[\^"(�*������_ "�+w�����#3lI<���������3'��#��'!���;�'�-�G#G#� �#��� ��=��*+k"(=���=����K���(��� �#34�#���1J>=��!�l��"(�a`E��� �(��=��(=�O����2$���"(O9��O�=���=)�&�(6zs��]J>=����'���"LJ �!�9�:�2=��'�-�G����cG#��'��.I�J;�PG#���bG#"���'�����-�G��2�]+k"(���(� ��¥+k"����!���P'�=����9�.�!-����N'�G����#34�NJ>��"p'�-�G#G#� �#��'>J>=������"(�a`E��� �(��=��(=�O����c$���"(O9��O�=���=)�&�(6k[Y��=�']J>=����8�����#��OZ� =��xG#"��V���!����=�G ��=�"(����"l�����%'��#G -���=)�&��".+;�!���'�=��(�9�.��-����P'�G����#34��602'2�����#���K�����,^�$9������=�� 'N�����W�!���c���3'(� ��'����2�WG�����G#"(���!��"(�g-�$S�!"4�>"�+��!���#3lIZ�!���#���w3X� �

O&�X���m� G#-���=�"(��']J>���#���X�EJ�"S"(�R�!�����#�X".+��!���%$9���Q�!=�� 'c�.���4G#"(����-�$����#�6 �<"LJ��F'��#�#I,=���'�-�G��j�G��.'���Im���(���#� 3%� �V�5��"�����' '.��G#-�"(-�'�� �(6,�N� �!���1"������#�,�9�����IU��� � ���m�#G -��!=�"(�%=��4J>��=�G��%������������� �$9���Q�!=��#']�����4��"(���#'��c3K-�'Q�cO&�%G "(�����#G���6 [Y��� ��� +k"�����I8���(���#�#34�#���wG�����"(��� ��OZ� +k"(=����#��=����!���G��.'��P�!�9�:�<�r����G ���.�b"(���]$�������=�G#=�$9�.��=����K$������&�b=�'YG#"(����-�$m�!�#��6st�w�9��'Q�NG#����=�3u�!�9�.�<J>���#� �¥$���� �U'<����� eP�#��� �!���g=������S�r��� G#-���=�"(��I�=��<G��.����"��<+k"(=����!���

���(���#� 3%� �V�#60[Y��=�'K=�'cO&�#G#��-�'��6� >w�����\� C �o'�'U=�� J>'p"�+Y�����@34�#'�'����(� 'p'��#��� O ��� \k$���� �U=�����w_2�����c=���� �V��=�G#����6RH9-��Q�!��� ��34"(���.IZ�!���#=��2���#G =�'�=�"(�S3%��¢V=����X$���"UG#� '�'PO9��'��#��"(�S�����#=��D'U=�� J =�'�����!�#��3%=���=�'Q�!=�G�66[Y���#��� +k"(����I������F��3K-�'Q�p"(-���$�-��c�����X'���34� '.����-���6Ws��X'Q�!���#'�'K���9�.�w�!��=�'w=�'=������ '�$&�#G ��=.'��N"�+©��"LJ 3X�.�7�4�r��� G#-���=�"(��'��9� '(�P$9�.'�'�� ��\n�����X=�'��.��'�"w��"��Y���#$&�#����� ���1�.�Y�����q"(��!���]'��#G -���=)�&�*"�+������R'�=��(�9�.��-����P'�G����#34�wO&�#=���� -�'�� �q_�6

[Y�V-�'#Iq=���3K-�'��>O&�N�!���]G#��'��P���9�.�������P+k"(=����#�@�r��� G#-���=�"(�l=�';"(���NJ>��� ���R�!���P�(� ���#������=�'������"(���#'��]$9�.���&�(6 0<'NJ;�4�9� '(�43%� ���!=�"����#�IJ�� O�-�=������@+k"(�����#�� +k"(�N����� '�=��(�9�.��-����p'�G����#34��¡J>��"t-�'��#'��b6_[Y���W+k"(���(�#�� ���#G �#= '(�#'X��'4=���$�-m�@�x$�-�O���=�G '(� ��=���G��.��=�"(�d`C¢���� ��� IY�.�����G G#�#'�'2�!"X�4'�=��(��=����4"(�!�.G#���]��'�'�"UG#=��.�!� �WJ>=����W����=�'1¢����(6� OZ� �(=���'>O �lG���"U"('�=����@�.�<�!�.����"(3"(���*"�+1�!���W$9�.���!=��#' I�'��(� � h I;�����`��'�'�"UG#=��.�!=����S�!��� '��#��=)�9G��:�!=�"��d`E¢.�F� ��3�J>=����j����=�'p$������&��6Z ���!-�=)�!= '���� �(IVJ>=����X$���"(O9��O�=���=)�&� ¶ � ^�IU����=�'5=�',�����<$9�.���&� J���"K$���� �m'5�����<���#���#�!� �qJ����#�!�{+k"(=���'�����@���(�"��� 3#� �V�#6�H9"(�w�$���5".����� �c$9���Q�!=��#'#Ig�����4+k"(���$�#�% G���"U"('"�#'p��¢ �F��$9��=��#I©+k"(�wJ���=�G���=��¢V��"LJ>' OZ"����v�����b'�=��(��=���������� '$�#��=��9G#�.�!=�"(�v¢$���m' 6 [����#��I& �(=.'$�#'K�����*���3'�� ��'����2�'� �����¢$���S$9�.=���'1+k"(�N� �(�©�����K=���=���=��$���.�%G#"(����-�$m���#��$9�.���!=��#' 6� ��"iJM=�� '�"(¢$� ')�´������'�=�3K-����.��� '<�������"$�(�#'�"�+���������"(���#'��>$�������=(�#'�=��4�����N'"�AcV-�� �V��=��$�*���+�#G -��!=�"(��'Y"�+ �z��"��!"UG#"�� � `Ea�IVJ>=����,����';��������3'$�#��'!���;�(6 Z �W$9�.���!=�G#-������#I-¬J�"(��¢V'<��'Y+k"��(��"iJ>' ±

� Z �X�$�(�.�r��� G#-���=�"(��'�J���� ���2�����<�"�#G =�$�=��#���0/.'��9>21����3/."$4�� C�1$4"�<��".�;G "�4�4�-�$���� �I5u$��61 �U'�����#=�4&4�"��(�.I�+k"��(��"iJ>=����N�����2$�4�"��!"UG#"��.�r��1�G ���.�71�'�'�$8�#G#=)�.�#��6W[���=�'5=�','���4�1�=�������+k"�4QJ91 4���1.'�����:4��#G =�$�=��#���!'>��" ��".�<-�'��R'�=��(��=����p¢$�F�U'<��-�4�=���� '�-�G��;1��<���+�#G -��!=�"(�6

� Z �=1$�(���r��� G#-���=�"(��'%J����>4��������W�$�#���>4�1$�1=�' '�"�3#�l-���G "�4�4�-�$���� �³$.1$4Q�&� �@?�A�q� h I;�����+k"�4�����4B $��(1 �m'<�����C4�"��(�w"�+��@?�I�+k"�����"LJ>=����%�����K$�4�".�!"UG#"���1�����-�'�=����@�����K'�=��(��=����-`E¢ �F�J���=�G��W=)�B1�'�'�"mG =61.���#�bJ>=����!�@?=���=���=61$���.�(6

� Z �D1$�(�E�r��� G#-���=�"(��'wJ����>4��%�����4���#���>4�1$�,=�'R�����4-���G#"$4�4�-�$���� � � h Ig����� +k"�4����>4) $��61 �U'������4�"����Y"�+"� h +k"�����"LJ>=����1�����>$�4�"��!"UG#"$��6 �1"LJ���'���4 I�=��K����=�'5G�1�'��.IF¨��"-�#',��"��&�.1 '��>�����1�'�'�"UG#=(1.��� ��'�=��(��=����-`C¢$�F��6 � �F'$��4Q�����>�(�#'�'#I�=)�R��"-�#'�.1 '��#1�G#G>�#'�']�!"*����� '�=��(��=����*"�4�1.G��(�

¶(¶ °

Page 119: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

1�'�'�"UG#=(1.��� �cJ>=�������3b\kJ���=�G��K=�'2� h �µ'�$�-�O���=�G9'��>4�=���G 1.��=�"(�d`C¢$����_r62[����>4�� +k"$4���I� �r��� G#-����#'�����#'"�@'�=��(�.1.��-�4�� 'wO �D1�G#G>�#'�'�=�����=��!']"�4�1�G�����6 Z ��$.1$4Q�!=�G#-��(1$4#I�+k"�4�61�O8����'�� >@?�� Cw���.1.�w=��4"�#G�� =.'$�#'1��-�4�=����p�����R'�=�3K-��(1.�!=�"(�IU=��bcV-��>4�=��#'>�����R'�=��(�.1.��-�4��P"$4�1�G>�(�N+k"�4C����\ ��?�� >@?��FCr_r6

��� ~:�r�@�i�&A^��~:}�?3� Z + 1.� 1�� �b$&"(=����I��¥G#"$4�4�-�$��!'B1 $.1$4��&� �@?EA��� h I�������< �.1�����'��u�����'�=�� ��=����-`C¢$�F�*���.1.�P=�'�1�'�'�"UG#=61:����SJ>=)���K� ?�\�����=�'2=�'2�����c" ���.�l'"�#G�4"� �]=�m+k"�4�3#1.�!=�" �b���.1:�� ? �.1�'!_�65���b�����R"�������4���1����I9=)+�1:��1�� �b$&"(=�����ªG#"�4"4�-�$m�!' � h I�������< 1�O&"�4Q�!']\ 1������"-�#'���".�>'�-�G G������S=�b+k"�4��(=���V_�6

[���4�"(-�����"�-�� ����� 1�O&"('��:`����#'�G�4�=�O8��`'�=�3K-��61.��=�" �I 3%" ��=��!"$4�' ��1�G��=�r��� G#-���=�" � 1����jJ�1�=���'+k"�41�� ���+�#G -��!=�" �t=��xJ���=�G��D�r��1.G ��� ��" ���4$.1$4Q�&��=�'RG#"�4"4�-�$m� 1����������,1��$4���� 3#�����w=�']+k"�=(�(���6Z +���"@'�-�G�� ���+�#G -��!=�" ��"UG#G#-�4�'#IZ������� 1�O&"�4Q�!'#6N�2�����>4�J>=�'"��I=��W�����c�.4�'��N+k"(=��(��� �r��� G#-���=�" ��I G���� G�¢V'S=�+R�����x-���G#"�4"4�-�$m������ h =�'@��������������4�1$�P=������=�'<���+� G#-���=�" �6 Z +���"���I1������� 1�O&"�4���'>\kJ>=)����"�-��,'�-�G G��>���=����w=��K��������4�1.�!=����:1N+k"�4����>42��_�6��2�����>4�J>=�'"��I�J �B��1('$�B1��C���+�#G -��!=�" �=��J���=�G�� � h =�'K�����b�$����>4�1$��1���� 1.��4��>�#37���� =�'c+k"�=(�(���6 Z �j'�-�G��=1�G�1�'��.I '�-�G#G>������'X=����������4�1.�!=����71p+k"$4����>42�<1�'Y+k"�����"LJ>'#602'5J�� �.1 '��N37����!=�" �����I�1.��4��>�#37����;G�1��@" ���.�pO8�<+k"(=��(���4=)+ ����1�G���� � " ���2$�1$4��&�4=�'z+ 1�-����&�(6

�m=���G��@O �D1�'�'�-�34$��!=�" � � h =�'���"��pG "�4�4�-�$�����I�J �!�.1 '��@���.1.�K"����@"�+Y�����!4�� G#=�$�=(�����'J�9>]"$4� C 1$4"�]G "�4�4�-�$�����y�J>=)����"(-m����"('�'1".+8��������4�1$��=)�&�(I���� ��� >�O8�P�����RG#"$4�4�-�$������W$.1 4��&�(62\ks ����"��������1.� $��61 �U'K�����!4�"��(� 'K"�+1OZ".���'��" ���#'��4$.1 4��!=��#' � h 1����\� C =�������b'�=�3K-��61:�!=�"��6 _ � "LJRI'�=���G��P�����1���4��>�#37����YJ�1�'Y+k"(=(����IUJ��]¢���"LJ ����1.��� C���"-�#'���"��>"(-m�!$�-���� h �µ'>=��$�-��"' 1$��-���©IJ���=�G���3#��1���']���.1.�c=������ + 1.-�������t=��v�U���#$ � 6![���=�'cG 1���" ��� � �.1�$�$8���=)+ � C 4��#G>�#= '�����EJ�"' 1$��=��t'�=�� �.1:�!-�4"�#'c"����������(1�O8�����4J���=�G��v=)�K'������;� h =�t����=�'%���+�#G -��!=�" �6 � "iJRI�� CpG���� 1$4"�.�4�� G�� =.'���� 1cG#"�4"4�� G �Y'�=�� �.1:�!-�4"���´" � � h �µ'�=��$�-���-�'�=���w�������(1�O8�����<+ 4�"(3�� h =��!'"���)+ 6Y\ Z �@+ 1.G ��IO �������@'�=�3K-��(1.�!=�" �I©����=�'c'�=�� �.1:�!-�4"�X=�'w�������4�1:����jO � 1�G G�� '�'�=�����=���'w'�=�� �.1:�!-�4"�@"�4�1.G��(�.6 _�<"LJ �F'$��4#IZ=� 1�����=)�!=�" �I&� C23K-�'Q����1('$� 4"�#G�� =.'$�� 1 ' 1$��=��l'�=�� ��1.�!-�4"��� �Z+ 4�"(3 �9>�I9J����>4���� �G#"���'���=��!-m���#'�� h �µ';'�=�� �.1.��-�4��1" �,1]'Q��4�=����w���.1.��G#" ����1�=��'&�61.O*�>��� 1�����1���=v�*��4"�����37�#'�'�1��$���&��6s =����@"('��>4�J����>��34=���K$�4�"(O.1.O�=(��=��&�p�������61�O8��������=����"���1.$�$*��1$4�=��!1�� �X$�4��F'U=�"(-�'9�r��� G#-���=�" ��IO8�#G 1.-�'��� C�=�'E��" ���#'���1����4G���"U"('�� ';=)�!'z$&"�4���=�" � "�+Z�������61.O*�>�.1.�&4�1�����"(3l6H[��V-�'#Im$�4���'U=�"(-�'"�.�=�������b'�=�3K-��(1.�!=�" �I������b'�=�� ��=�����"�4�1.G��(�%J91�' ���F'��>4QcV-��>4�=���vJ>=���� 1�'Q��4�=����G " ����1�=���=���!��6H9-�4�������4�3%"$4���IUO �X�����)1�'�'�-�34$��!=�" �X���.1.��� � A� �©IU�����2"�4�1�G>�(�cU-���42�XO �#u=�X����=�' ���+�#G -��!=�" �J�1�'%��� "ND���D�}9A��!"b����� 'Q��4�=����*-�$&" ��J���=�G��#� �g=�':1*'�=����.1.�!-�4���6wsD� G#"���G���-����p���.1:��� ��=�':1' 1$��=��W'�=�� ��1.�!-�4"�w"�� 1X37�#'�'�1����.I 1����l���.1:��$��=�%��"�� cU-���42�l�����K'�=�� ��=���%"�4�1�G����]J>=)���l����=�'37�#'�'�1����.6 [�����4���+k"�4��.I.«"(-���$�-��!'�� � 1����*����=�'Y=�'�1p'�-�G#G>�#'�'Q+k-���+k"$4����>42�(6

Z ��4"�#3#1�=��'1�!",1��.1$� �mT>�w�����K$�4�"(O.1�O�=���=)�&�@���.1:�� '�-�G G��>���'R=�l����=�'<+k"�4�����4;�(62H8=(4�'���Iq=)�2=�'� 1.'2�p�!"R'"���>���.1.�zJ�����#&��"+� '���"�� 1�O&"�4��#I(�����>'�=�3K-��(1.�!=�" �K"�+&�����>'"�AcV-������=61$�3���+� G#-���=�" ��',=�'�9D�� � D�|�AnI�1����X���.1.��� �o' 'U=�� J =�%����=�';'�=�3K-��(1.�!=�" �%=�';=�������!=�G 1$�9��"C1 4���1$� �r�+�#G#-m�!=�"��6,H9-�4�������4(`34"�4��.I������R$�4�"(O.1�O�=(��=)�&� ���.1.�� h =�'������R=�������!=��&�@"�+������4\^-���G#"�4"4�-�$m����9_>��������4�1$��=�b�����N�.4�'Q�+k"(=��(��<1.��4��>�#37������AcV-.1$��' ¶ � ^ ����1�G���� �(6W[����R+ 1�G �Y���.1.��� h =�'YG���"('���� 1$����1��l"�+©�!=�37�N3#1�¢$� '��"���=v�*��4"���G>�2O8�#G 1.-�'��2�����1'�=�3c-��61.��=�" � =�'�$8��4Q+ �#G �#6W[�����4"� +k"�4"��IU�����<G���"(=�G>�<".+�� h O ��'��"+� '��"��13#1�¢$�1�� �(��=�� �>4�����G��P�!" �����wO8���.1 'U=�"$4Y"�+ �b6zs �wG " ��G���-����P����1.��«'�-�G G��>���'N=��b+k"�4��-`=���XJ>=�����$�4�"(O�1�O�=(��=��&� ¶ � ^��!=�3#� '<�����p$�4�"�O.1�O�=���=��&�b���.1.�)�«'�-�G#G>������'w=���+k"(=���=���,1��$4���� 3#�����\kJ���=�G��l=�')��" �a`*��� ����=��(=�O����L_r6 [���=�'>G#" ����4�1���=�G �!'Y�����R'��#G -�4�=)�&�b"�+������R'�=�� �.1.��-�4��P'�G����#37��6

¶(¶,+

Page 120: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

l��nm��� ������� �����������(oqp ���r�,��� ��s%���utwvyx�� | �����

H8=)�!T#=31����bf;1.-�4��>4 ! Hzf � � # $�4"�#'"�����1]$�4�"���"mG "��9+k"�4z�����2/%�UT 1�����=����e:������4�1$��',$�4�"(O��(� 3§���.1:��!"$�(��4�1.��� ')1�� �S�%] ^ � I%+ 1�-��)�&��$.1 4��!=��#' 6,[���� =(4N$�4�"��!"UG#"$�8=�'N+k"$42�����p=���+k"�4�3,1.��=�" �a`C�����#"�4"� �!=�G1����p-��.1�-���������!=�G 1.���� 34" ���>��6 �<"LJ �F'$��4#IU=� 1�����=)�!=�"��w�!"<������$&"(=��V��`C��"-`E$&"(=��� �����EJ;"�4�¢qIV�����F�1�'�'�-�37�X����1.� ��'���4;�t��4�=�$��(� �]"�+>$�1$4���=(�#'w=�']G#" �����#G�����vJ>=)���'1��t=����1$�N\^a1`E$�1$4��&��_]O�4�"F1���G 1�'Q�G��.1��������n6�0<' J � �.1 '��l'���"LJ��`=����+�#G��!=�"�� �m6��6 ¶ I5�(=.'$�� 1x$�-�O���=�G:`E¢ �F�v=���+ 4�1.'���4�-�G ��-�4��@+k"$4'�=�� �.1.��-�4��w'�G���� 3#� '#I=)�2=�'<$&"('�'�=�O��(�w��"X=�3%$����#37����1'�� G#-�4"�pO�4�"F1���G 1�'Q�)1�34" ���4����4"���w$.1$4���=(� '����1.�YG#"�3%$&"('�� 'Y'��ScU-�����!=(1$�(� �(6W[��V-�'#I31p$�4�"��!"UG#"$�Z+k"�4�02/be g f g� C =�' ���>4�=.'$��*O �@'�-�O�'���=���-��!=�� �� ���Y=����1$�9a1`C$.1$4 � �cO�4���1���G 1.' � $�4�=�34= � = '���=� � ���1$�4�� � �mG�������+�H8= � T#=�1����%f;1�-�4���4B! Hzf � � # J>= � ��E4�� � �mG���� � ` a�6N�m=��G�� �E4�� � �UG���� � ` a#1���� � ���c$�4�� � �UG��$����+5H�= � T =�1�����f;1�-�4���4 !µHzf � � # O�� � �G���3%$��('��P'"�AcV-���� � =61$���.��I � ���:4�� '�-�� � =�� �p$�4�� � �UG���� 1 ��'�� G��(3%$��('"�#'>'��ScU-��� � =(1$�(� �(6����� ��� � � � �q�.- �2?�?��m�XD*A � B�APA � D���DWD21(��?�Ak?*B�?��)²�}&B�A �m�!D%?L| � D��XD@A � B�AR��?WD21(��?�AED�}9An�^B F�F �?LD�|��U��DpBL²�B���}�?�A1| � ~L?LD�}��XD�?�?#BL²UDKB�A^ACBU|��L? d / � D�}35�A � D��!D4D21(��?�Ak?pB*��B�}&�U~:�p���:D��w�&�!~:A ~L|�~ F � ~:�B��UA � D�}9A^��|�B�A D��,�����LB�}9An��}�D��<D�}�D���B F ?KA � B�AYAE~ F D���B�AED�?<� ]{^ � I � B�� F A �c��B��rAn��D�?pB�}&�W|�~:�2�9~L?LD�??LD*) �9D�}9An�^B F�F �XB�} �N�9~ F �.}�~:�p�^B F } �U� ��D��c~ � A^���XD�? d02'PJ �4'"� �LJ§=��x�+�#G � =����*�U6 � I�= � =�'P$��('�'�=�O��(� � �!���+�#G - � �43#1�� �SG���$�=(� '���+91�� 1.- � ����� � =i`

G 1 � ��c/%�UT 1�� � =����e:������4�1$��'©$�4�� � �UG��$��G�� ��G -�4�4"�� � � �(I.O7�1 �(���UG 1 � =���9� 1�G��%���+�#G - � =�� � 1>-���=�cV-��=���� � =)�.��4 � �.1 � =�'YG��(3%3�� �<1����l¢�� �LJ�� � �#1$�(�Z$.1$4 � =(� '#6

[����*H8= � T#= `Qf;1.-�4��>4]$�4�� � �mG�����G�1���O8�!1$� � ��4"���=��t'�-�G�� 1WJ91 � � �.1 � 1�-���= cV-��@=���������=�'1$�����UG 1 � �� � ��=��7'��mG�1 � =�� ���.+ � ���W0N/be �*f > J>= � ��=��$�4�� � �mG�����6�s �SG 1�� � ���>4���+ ��4�� 4�-�� � ���0N/�e �*f >w$�4�� � �UG�����'K=�j$.1 4�1$���(���N\ 4�1 � ���>4 � �.1��['"�AcV-���� � =61$���.��_�I5=�34$�4�� 'U=�� � � ��� 4��(-����jG��(3k`$������m= � �!��+ � ���<4�� '�-�� � =���x$�4�� � �mG�����6 Z �[$.1$4 � =�G#-��(1$4#I"�(-�4p$�4�� � �mG�����=�'#��+ � ���*'�1�37�<4��(-����G���3%$������m= � � 1�' � ���>-�������4"�.�U=� �]H8= � T =i`Qf 1�-�4��>4�$�4�� � �UG����n6�\�sD�>' � 4�� '�' � �.1 �$� ���Y+ 1�G �"� �.1 �%� ���0N/�e �*f ><'�-�O�$�4�� � �UG�����'PG 1���O8�C���+�#G - � ���t=��$�1$4�1$���(�>�gJ>= � ��=�� � ���p02/be%g f g� CP$�4�� � �UG��$�>�U~LD�?}�~:A©=�34$��.� � �.1 �&� ���c0N/�e g f g� C $�4�� � �mG�����= � '����)+zG 1���G���3%$��('��]=�W$.1$4�1$�(������6;7 1 � ���>4#I&O7�'�(-�4=�34$��('�'�=�O�=���= � ��4"�#'�-�� � I�J��]¢�� �LJ � ��1 � = � =����������j|�B�}9}�~:A�O*�RG��(3%$��('"��*=�*$.1$4�1$�(�����n6 _

l��nm�)( ������� �����������(oqp ���r�,��� ��s%���utwvyx � |* �:� $y����o,+

Z � � ��=�-�-"�#G � =����]J � ����-�G>4�=�O*� 1/.�4�� � �mG����10 ��4 � ���32 �mT�1�� � =�����e:������4�1$��-4.�4��(O��(� 350 ��4.^6..1$4 � =���-#IJ���=�G��4G�1�� � �$�(��4�1 � �NB�} �R} �m� ��D��2~ � � B�� F A �>��B��rA^��D�?�6 �&�iJ �F'$��4 I � ��=�-�.�4�� � �mG�����=�- ���7.�� ����� � =61$�=� � ��� �98�3cO*�>4:��0;..1 4 � =�G#=�..1 � =�� �'..1$4 � =(��-#6P[����>4��<0 ��4��.I5=��!�18�4=-�� ��� =�� ��I � ���>.�4�� � �UG��$��G�1��� ��� �4O*�NG�1$4�4�=(���>�18 � 0 ��4�^ � ���1� 3?..1$4 � =(��-P\�J�����4"� 3%=�-�1=-��#G�8�4�= � �?.�1$4�1�37� � ��4!_�68s �@- � 4���-�-� ��1 �A� ���B0 1�G �A� �.1 �A� ��� �98�3cO*�>4C��0D..1 4 � =���-�3=8 - � O*� ���1��1$4�= � ��34=�Gz=�� � ���3-�� G�8�4�= � �E..1$4�1�3#� � �>4=�-�� 8�� � � � J3�%4���1�-�� ��-#65H8=(4�- � I(J��1J>=�-�� � ���&.�4�� � �UG���� � � 4�8��X=�F.��$�.� � �(34=61$� � =�3#�.6z�+� G�� ����IJ �G8 -��!1H-�=����.1 � 8�4��?-�G����#37�<1���� � ��=�-w=�-E� ���.�I-"�#G�8�4��>0 ��4E.���� � � �(34=61$� ` � =�3#� 1��3'$��4�-�1$4�=���- I1���� 1#.��$�.� � �(34=61$� �98�3KO8��4;��0�-�=�� �.1 � 8�4���-#6�@8�4@.�4�� � �UG����g=�-2G�� � - � 4�8�G � ���O �J.�4"��-���� � =��� 1 � 4�1�� -�0 ��4�3,1 � =���� � ��1 �@� 1.¢$��-:1F-��Ac98����d`

� =(1$�(� �cG��(3�.��1-�1�O����10K2beL.�4�� � �UG���� 0 ��4 ^ � ¶ ..1$4 � =(��-5J���=�G�� � ���(�>4�1 � ��- ^ �WaM0 1�8�� � �#..1$4 � =���-#I0@2�e%gON > f g�N � IB1����P.�4�� � 8�G>��-!1Q-"�Ac98��� � =61$���.�[G��(3�.��1-�1�O��(�l0@2beR.�4�� � �mG����;0 ��4 ^S..1$4 � =(��-J���=�G�� � ������4�1 � ��-^ � I�0 1�8�� � �T..1$4 � =(��-#I&0@2be�g f gONC#6�[�����I��(=.'$��J��8�4U.�4�� � �mG�����0 �$4<O�4��F1��d`G 1�- � 1�3�� � � � ��4����V..1 4 � =���-�J���=�G�� � ���(�>4�1 � ��-/� ���V0 1�8�� � �?..1$4 � ��I90@2be �*f >rI�J �RG 1�� 1�. .�� �>�18�4� 4�1�� -W0 ��4�3#1 � =�� �!1����H�(O � 1�=��l0K2be�g f g�NCX0 �$4�1�� �6^86

¶ I �

Page 121: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

[����N=���� 1�0 ��4 � ��� � 4�1�� -�0 ��4�3,1 � =����4=�-�G>���1-"��� ��4����(1 � ��� � � � ���2=��� 1�-5O*�>��=��� � ���&.�4�� � �UG����0 ��4U2%�UT 1�� � =���Je:������4�1$��-;0 ��4 � ��4"���:.�1$4 � =(��- 6 [����=-��$��8 � =�� �G0 ��4 � ��� � ��4"��� `�..1$4 � ��O�4��F1���G 1�- �1�-�-�8�37��- � JB�-`�..1 4 � �vO�4��F1���G�1�- � \�J���=�G��[=�- � 4�= 'm=(1$��_r6 � -�=�� � � J3�-`)..1$4 � �vO�4���1���G 1�- � I 1���4"��� `37�� � � � 1 0 4���-�� �61�O8���5G 1��[O8�!4���1�G������6 ��1 'U=��� 1���4��>�� � � � ��=�-C�(1�O*�>��I � ��� � JB�I.��(=�� �G���3%3=8���=�G�1 � =�� � -<J>= � � � ���Qe:������4�1$�E1$4"�#-�8��4G#=��� � 6 8&1.G�� ..1 4 � �J-"�����-w= � -NG>�61�=�3#��� 0 4���-���61.O*�>� � � � ��� e)����>4�1$�nI�1���� � ��� e)����>4�1$�Z=��G>��8�����- � ��� � J3��4"�#G�� =.'$�� �61�O8����-;=��-�=����1�� �>-�=��-`�.1 � 8�4�� � �.1 � = � .�4�� � 8�G>��- 6]��8�4K��������4�1$� � 4�1�� -W0 ��4�3#1 � =�� �*J>=(���©JB��4�¢W=�� � ���=-�1�37�c3#1�������4#6s �#8 -�� � ���p0@2be�g�N > f gON � .�4�� � �mG���� � �!�.1 '��71$����..1 4 � =���-4\ 1�..1$4 � 0 4��(3 � ���;e:������4�1$��_�1���4��>�� � 1#4�1������(3 �(1�O8����6�[������I � 1.G�� ..1$4 � �H.�4�=.' 1 � �>�.�T-"���� - � ��=�- �61�O8��� � � � ���Je:������4�1$��I&J�� �� ����l=��G>��8�����-B1$�(�*�61�O8����-�=�*= � -/-�=�� �.1 � 8�4���-#6�[��98 -#I9J �E.�4��('���±����� ��� � � ���g�� �2?�?��m�XDlA � B�AwA � D��!D�D21(��?�Ak?�B�?��)²�}&B�A��U�!Db?L| � D��XD*A � B�A]��?SD21(��?�AED�}9An�^B F�F �?LD�|��U��DYBL²�B���}�?�Ag| � ~L?LD�} �XD�?�?#BL²UD�B�A^ACBU|��L?65 � ~:�YB�����D��!?#B��r��D�?5���U}9}9��}U²P��}4A^���XDg�9~ F �(\ 3�_ d / � D�}35A � D���D�D21(��?�A�?WB �����LB�}9A^��}�D �<D�}�D���B F ?p�&��~:AE~L|�~ F ? � ~:���X\ ����� 3�_p��B��rA^��D�?65KA � B�AwAE~ F D���B�A D�?�B�} �} �U� ��D��c~ � � B�� F A �]��B��rA^��D�?wB�}&�*|�~:�2�9~L?LD�?N?LD*) �9D�}9An�^B F�F � d

����� ���� �� ? ��� Y @ ��� N ���6R�@J? ��� ? � ��� U ��� E � ? �� G � ? �� ? � > �� � N � ? ������� U�G

Z � � � ��-C-"�"! � ��� �$# �%!�� ��-&�����4E1���1�8 �('7�� � 1 � ��� � � � � ����1�8 � ���� � �)! 1 � ���'�� ���>�*���+#��,�)!��7��1-!�����+��!�8 � ��� �.��-21�-�-&��� ����#1V8��,� c98��B1����.!��('.'F� �������� � �)�.��4�/�s �;-�� �0# � �.1 � ��6-�8,!���11'�� ���>�32� � ��-U.��1-�-4�65���� � ��1-!�� �(�F'$�=2%�87�1�� � ����+9K�$4�����'#��� � / e)����>4�1$��- � �.1 � !��('�.��1-���-:!����,!�8�4"4���� � �.�-20 ��4<;�} � �98,'$58��4C��0D0 1�8�� � �M..1 4 � ����-�/�s �X- � 4���-�- � �.1 � �� � ����1�8 � ����� � �6!�1 � ���.'�� �����8� � -�����0=2-� � ��-� � � .���-�-&�)5��(�;0 ��4 � ���K..1$4 � �(��- � �C1���4"���K���>8��,��c 8���1����>!��('.'F���>����� � �)�.��4�-"2*#%� � � ��8 � -��('7���� � ��4 ��1$� ������.?/ [��,��-@��-A5*��! 1�8 -"��1��$4������� �'� � 1B!��('.'F� �C����� � �)�.��41-'��18�� � - � �H-����.'8����� ���V2%�87 1�� � ������9U��4��>�"'7�� � .�4��-5��(��'D2�1�����# �)�.1 '��V.�4��('$�� � �.1 �X� �,��-<! 1���� � � 58�:1-!��,���F'$��0 ��4K� � ^ �FE #�����G!��('�.���-&� � ��� �H��-C4��Sc98,�(4"��I/ [����>4��<0 ��4��F2 � ����-��J������ � �)�.��4�-�'=8 - � !��('7�0 4��-' �18 � -&����� � ���6-;�7- � ��' K 1���� 1�-V-�8 !��I2�1�-�-�8 'L��� � � �����(4)�r� ��- � ��,!>�L��-:1�� 1�8 �('7�� � 1 � ������ � � ���1�8 � ���� � �)! 1 � ��B'F� �����NMO/

Z � � 8,� � �.'$��� �(2 � �����r� ��- � ��,!>�U��0 8��,��c 8��P������ � ���.�>4�-2������. -Q�� � ��� 1�8 � ����� � �6!�1 � ���L'�� ������0 �$4� ���;0 �$�(���0#%��� ��4"� 1�-�� �I/�R��"!�1$�(� � �.1 � �18�4E���0#��>4�5���8����.��-�5.1�-����� � � ��� 1F5,�(�)� � �M��0 � ����1���'���4(`-�1 42� � � ��~:�r�!~$�'-&���������'7��-�-�1�����-%0 4��(' ���������+�"!�8 � ��� � � �1�� � � ����4�/ � �0#A2S��08� 1F!��F-4��� �.1 � 8�4"�1$��-�����,!>��8�����- � ���V-���-�-4��� �������� � ���.�>4"2 � ���� � ���� � ����- � ..1$4 � �(��-P!�1��;��1�-&���.���,��- � ����18,��-"�J5*� `� # ����T'7��-�-�1��$��-3-4��� ����>��� � �,��-2���+��!�8 � ��� �!1����>'7��-�-�1�����-3-4��� ��������#1�� �v�*��4���� � �r����!�8 � ��� �?/Z �K� 8�4 ��-K�18 �U� �.1 �U� �,��-P��- �� �18����I/�[��.1 � ��-"2U#��E�(�.'$� 1 � 4�1�� -�0 ��44',1 � �����'0 4��(' 1$�6'��1- � 1��7�2%�87 1�� � ����+9K��4"���"'7�� � .�4�� � �8!��$�V5.1�-��� � � -&�����.1 � 8�4��=-4!����"'7��-�2 � �<1?.�4�� � �8!��$� � ��1 � !��('k`.��1-���-W!����,!�8�4"4���� � �.�X#������>8��,��c98��Y������ � ���.�>4�-&���*��- � /"2%��®"1$�6'��1- � 1��7�6.�4�� � �*!����32µ¯@# �P'#��1��� ��1 �K� �,��- � 4�1�� -�0 ��44',1 � �����;1�.�.��6����-U0 �$4�1�� �H.�4�� � �8!���� � �.1 � 8 -"��- � ���=-&��� �.1 � 8�4��E-&!�����'#�:0 �$4-&��� �,��� �71���� '$��44��0 �8�� �L'#��-�-�1�����-&� ��� �(/�[�� ��-P��- � �����.1 � 8�4�1 ��8�-��:��0 � ���E-4��� �.1 � 8�4"�E-4!����"'7�1���� 1$����¢�� �0#�� .�4�� � �8!��$��-Z����������B#B��4�¢>�� � �,��-<#91 �-/

[ ��4"� 0 �$4&'#1$�(� �(2;�18�4 � 4�1�� -W0 ��4&'#1 � ��� �\#B��4�¢ - 1�-G0 �������0#;-"/^] � �B_ 58� 1 .�4�� � �*!����U0 �$41�8 � ���� � �6! 1 � ��?2%�87 1�� � ����P9K��4"����'#��� � /�sD������������1A'�� �,�)�.��6.�4�� � �8!��$� _ K �3`8M � �.1 � #3�$4�¢9-1�-/0 �������0#;-#±

¶ I ¶

Page 122: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� 821-!��'..1$4 � �J��-/�(� '��� � ���A������ � ���.�>4 � `�1�- 1�8m�*�(�6�(1$42�.��� . 8 � /

� Z 0216..1$4 � �!� � �.1�- 1������ - � 4�8,! � ��� �J�� _ � �?-&��� � 1��(� '�����'7��-�-�1������ #%� � �D� � -&-���!�4�� �¢ �F� � 3 � 2 � ����j� � -&��� � -;8 .�� � � `���� �� - � � 1�� K #�����4"��� ������ � ��-Y!�� �,! 1 � ���1 � ��� �UMO/

� Z 0@1:..1 4 � � � � �.1�-�1��T�� - � 4�8,! � ��� �L�� _ � � '��>4&��0 �,1=�(� '���G-4��� ��1 � 8�4"�1� � �<1 '#��-�-�1����� #%� � � 1 . 8,5��)�6!b¢$��� ��3 h 2 � �����_� � '$��44���.��- � ��1 � � ��-#1 ' 1$�6��� -&��� �.1 � 8�4��G0 ��4 � ���'7��-�-�1������3`��)� /

s ����� #5- � 1 � �V�18�4 � ������4"�"'l±����� ��� � � ����� �9�,8�� _ � � ; � ��� �U� � �&��� � � ��� � �:��;�� � ���� � � ; �� �!�����0; �� � ��� �5²�� ��� � ����� � � � � ��� � �P; ��� 1(��� ����� � ;���� � � � � �:��² � ; ��� � ���)² � ; �m� � � � � � � ���! �m� � � ���"�:� � 5 � ���!� � � � � � ������ �$# � ��%2² ����� %4; '&�� ²J; �(# � � % & � � &�� ²)� & ² � ; �*% � �+� � � � ��8��, � �.- %�� � � ��� _ K �3`*M � � ��� ; &����$#� %���/ _ ;�� #0� � � % & � �$# ; ���$� � 5 ; �(# � �� �3` >6?212121 ?=� `43 � � ;+� � % &5� �6� � � � ��& ) � � � % &�� ²�� � / � ��� 5 � �7- %�� � � ���8� _ K �3`3>&M�?2121�1 ? _ K8� `434MW;������9��� � �: � � ��� �0; ��;&���� ��²�% ��� / ����<- %������ � /�5 � � ��� � � ���%@� �=� � ��� �0%>% ���� � � �? �L!�� �,!���8����.5 � � � � ��� � � �.1 � � � ��-�� � � 1 � 1$�(��!>�(��1$4:� �0# -�8,!���1��D1�8 �('7�� � 1 � ��� � � � � ���1�8 � ���� � �6! 1 � ��B'�� ���>�I! 1��D58�1-!��,�(��'�������T.�4�1-! � �6!>�-/ Z �H.�1$4 � �6!�8��61$4�2�4��Sc98,�(44�� � � ���M���d` �)����..1$4 � �)!"��.�1 � ��� �J��0�1 � 4�8�- � ���!..1 4 � ��#�� � 1�-�-&����� -A������ � ��@.�>4�- � �<��'���4;� ��A+�"!�8 � ��� �H��-1!���� 1$4"�.��6'�.�4�1-! � �6! 1 �3/\K'BD8�4 � ����44'F�$4��-2%-�8,!�� 1 ..1$4 � � !��18�����8 - � 58�G8 -���� � �#� �(4���! � �.� �)'F.��(�"'7�� �5�4��F1��,!�1�- � / M �&�0#���'���4�2 # ��� �!� � � �������L�)'F.���4 � 1�� � -4!����1$4&���D#����>4��;[�������4"�"'K�*/ � / ¶ !�1��58�%1�. .��6����I/ 9K-Z# � �.1 '$� '7�� � ��� �����I2D-���!�8�4"�:.�4�� � �8!�����-/��0 � ��� 8 -"� '#1�� �T���7'��*!�1 � ��� � -/��0 15�4��F1��,!�1�- � .�4&�)'L� � � '��-/CB 8�4 � ����4&'���4"�-2 ��'��4�����4 � �.�6'�.�4�� '$�:4��18���� ���L!��(���,!F�-2 ��� 1��7�T�-�.'����4���8����I2*',1�� �.5�4��F1��,!�1�- � -<',1 �.58�@-&�)'=8�� � 1������18 -�� ����A+�"!�8 � ���I/ [�����D$���>.��(�� � ����4"����- � �.1 �� &� � &�� � ���M-���!�8�4"�=.�4�� � �8!���� 2D8��,��c 8��+����� � �E@.��4�-Y!�1���58� 1$�����8! 1 � �� � �7� 1-!�� 5�4��F1�� ! 1�- � K 57�� ���=.�4�� � �8!���� ����-&��������4 MO/�[����>4��<0 ��4��F2 1�8 � ���� � �)! 1 � �� 2 �*7�1�� � �����$9K�$4�����'#��� � ! 1���5*�=8�-���?/FK0,!��18�4�-"�-2 � �,��- ���+��- ��� � !��.1�� ��� � ���$0 1-! �4� �.1 �4� ���%-��"!�8�4��B.�4�� � �8!����(� � -"����08#%�(��� � � � !��('F.��1-"���H..1$4�1$�(�����4��4P!�� �,!�8�4�4"�� � � �(/ �&�0#���'���4�2 � � � �-��-:'7� 1�� � �.1 � � � -U-"�"!�8�4&� � ����-K�18.1 4�1�� � �>�� ���� ���M- � 1����d` 1$��� ����-"� ��� �� � 2.1���� 1#.�� �7-4�6!�1$� 5�4��F1��,! 1�- � !��.1������>� ��-)� � � ���"!���-�-�1$42�-/

����G H F � ? TVUWO;IKB � E G

F@8�4:#B��4$D;�(� 1 '$��-��1.8�� 1 �98,'$58��4@��0 ��1 � 8�4�1$�Hc98���- � ��� � -�/�B ��4�- � 2 1�� 8���4���-���� '���0c98���- � ��� ���-Y#���� � ����4V��4���� � � � ��-@.��1-�-4�65���� � �T!�� � - � 4�8 ! � 4�1���� �('.�67>�� .�4�� � �8!�����-U0 ��4�1�8 � ���� � �)! 1 � ��2%�87 1�� � ����Qe)����>4�1$��- � �.1 � -"�Ac98���� � �61$���.��!��('�.���-��-2 0 ��4.; � � ^ 1����D1��7� � 8 '$5*�>4V��0B0 1�8�� � �..1$4 � ����-"/JI+��!�� ���?2F� � ��- 8��KD�� �0#�� #���� � ���>4��$4 � � � � � ��- .��1-�-&�65��(� � �Z!�� � - � 4�8 ! � 1)��� � ��4&'.�� ��- � �6!.�4�� � �8!���� � �.1 �6� �>4&'.��.1 � ��-����4+ 4��18�����-,1�����-��Sc98��� � �(1$�(� � !��-'F.��1-���- � � �6'7��-�2$0 �$4�-��('7�IML �NL�I-+ � ¶ /H9�� � � ����4kc98���- � ����� � �.1 � 1$44��-"��-=0 4��-' � � ��-+#B��4$DH��- � �O@���� 1 4"� 1$�)��- � �6!!��-'F. 8 � 1 � ��� �.1 �-'�� ���>��0 ��442%�87�1�� � ���� 9U��4��>�"'7�� �4� �.1 � # � � � 1$�����0#I..1$4�1$�(������1����A!�� �,!�8�4�4"�� �!��-'F.��1-&� � ��� �?0 ��4b^ �-E �$4Z'F��4"�@0 1�8�� � �>..1$4 � ����-"/

¶ I I

Page 123: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� ��� ������� ��� ���

� 9���� [ � ��� eA��8 -���. .8��9 � ���,�(��-��F2���1����91F'#���,��-4!��I2 [ 1$4&!������$�-2 1���� e)����j[/-�8��,��DU/ 9.�4�1F! � �)! 1$�81����>.�4�� � 1-5��!�6-���!�8�4"��!��F1 �6� � ��� �a` 4���-&��- � 1�� � �$4��18 .F-&��� �.1 � 8�4��U-&!�����'#�F/Z � [ �(�,��4X2��>�(�(1$4��F2+���,� � ��4"2#" #%$ ; ����� � &�� � %'& -( �����)(%&+* ��,.-0/.13254768686 29�����i`8,'7��: ;<;<=U��0?> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 21.�1�����-�F<G<G H7F%I%= /�I7.�4&��� ���>4J ��4"�61��,2#F%=<=<=*/

� 9 � � � K 1��.1 9�� ����8,��I/ ] �"! � 8�4�� ��� � ��- � � � ��� !��('�.�����A*� � � ��0 -��-'#� .�4��(5a`�(��'F-B�� � 8 '$5*�>4 � ������4L�(/M9NON8PEQSRTRVU7W�XEY[Z]\ N^Y_W8`<abR<cdY_eTf8g7R%UOUOUhR�M#i�j9`bk�aTNblTRi�j7m#n�ao\pjhq7r9i9n<WOq9N9s9t<uTv3YwPCl8/

� 9W[x=7: � eA��8 -���. .8��9 � ���,�(��-��1����!e)����%[/-�8��,��D /�y�8�1�-&� ` �\�.!��(�� � 4"�z���*!�1 � ��� �G��0���4���8 .-&��� �.1 � 8�4���-"/�MTNONOPEQSROR<W%P9sb\pjTNEY{\�i7|Vs^YSk�sOm#ROtO}O}b~<R#~�}b~S2�F%=%=7:(/

� 291$4{=9: � 23�F1-73291$4�1�DU/h�U�0# � �@�1�:5*���1� ��� � ���<5��(1-!�D ` 5��9AE-4�6'=8��(1 � ��� �@5.1$4�44�(�>4"/ Z � / %�� ���� 4 �(#����d�d� Db&�/ - �9� &�@ / � �M � @0�(# ; '& � � � �_� � ��/ -C@0�� %�D ��&5���������' 2 � D<� 2..1�����-�: =<��HC:%:�G*2hF�=<=7:(/

� 2 � [ + � � ���1-�� 2 ��.1$������1���� [ �6!���1$��� ��� [ 1 4��-/OF ���:` #�1p��1F!"!�8 '=8��61 � ��4�-���9 ����!����d`� 4�1$�6�)7����1$� � ��4 ��1 � �!��� � � �,���(� � 1$�$-&��� �.1 � 8�4���-"/ Z �4[���4��B���(����-"� � �?2&���,� � ��4"23" #%�$ ; ����� � &�� � %'& -( �����)(%&+* ��� ,.2 ��,�-?/.1�� �<� 2T������8,'7��I%�8GM��0�> ����A@ % ��B � �� �&�� � ��/ -C@0�� %�D ��&5������� 2�.�1�����-�F<I���H7F%;8G*/KI7.�44�� ���>4�` J ��4��(1��,2C: + + � /

� 2 K [�� + : � [ 1��98��>�T2���8,'B2T9���0 4���� � K � I�1�� � ��-"2 I*�����8��� [ �6! 1 �6�32�1�����eV8 ��-���. .8� � ��4(`-&�(1�� �,/¡ U� �a` �� � ��4�1F! � �!����7>��4��-`�D�� �0#��(��� ���F/¢D � "�£ ¤�� @ % � ;�� �_� � ��/ -C@0'&�� (-2F%= KA� M��!: =<;���HC:<:<: ;*2o: +�+ :(/

� 2�� 1 + F � K � �.1$���I2�� 1p���>4"/¦¥F�.!"���� � '=8�� � ��..1$4 � �J.�4�� � �8!�����-V8 -&��� �D!��(44!�8,� � 4�1���� �-'L�)7 11`� ��� �I/ Z �§����1��6B.�"������S5.1�8 'D2 ��,� � ��4�28" #%$ ; ����� � &�� � %'& -( �����)(%&%¨ ��,.-0/.132©� �8ª 2�1����8,'7�.G<I%�#��0d> ����A@ % ��B � �� � &�� � ��/ -C@*�� %�D ��&5������� / I7.�44�� �$��4"2]: + + F*/

� 2,B�=7: � K 1�� 23� ����� 1���� [ 1 ��� ���O# B.4�1�� D-�)��I/ Z ���� � � � �7` 5.1�-��� �� !�4S� . � ��� � 0 4��-' � ���? �"����.�1-�(44�� �,/ Z �¦���-��«1�(�)�61��?2F��,� � ��4�27" #%$ ; ����� � &�� � %'& -( �����)(%&§* ��,.-0/.13247686%ª 2%�1�$��8,'7��F9: E + ��0¬> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 21..1�����-3F9: E H9F<F + /I7.�44�� ���>4 J ��4"�61��,2hF%=<=7:(/

� 2,B [ ;<; � [ 1��98��>�U2 ��8,'B2 � 1�8��.B.�>��,'#1��I2&1���� I*�����8��� [ �6! 1 �6�3/­ U� �a` �� � ��4�1F! � �!���T7>��4��1`D�� �0#��(������;1����\� � -71�. .��)�6!�1 � ��� � -BK �>A � ������� 1F5 - � 4�1-! � MO/ Z � / %�� �����$#�&�� (�� �_�

:�F E

Page 124: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

���� 1�� ����;&5���� " ���h@ ;��h" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%�& �_� � ��/ -C@0'&�� (-27..1�����-: = E Hb:<:�F*2#���,�6!�1��1�,2 Z ���6��� �(��-�2#FpH � [ 1p� : + ;<;*/

� 2be + F � [ �(� �(4;2��>�(�61 4��1���� F ����Ke�������4����6!��I/,F �%��� @��,�� �F.�4�� ��0 -;��0 D�� �0#����� ���F/ Z �¥E4 ����- � BW/ 2 4&�6!�D �����32����,� � ��4"2#" #%$ ; ����� � &�� � %'& -( �����)(%&�* ��,.-0/.132�� �%4 29�����i`8,'7��IO�8=���0�> ����A@ % �xB � �� � &�� � ��/ -C@*�� %xD ��&5������� 2 ..1�����- E + =�H �OF�= /<I7.�44�� �$��4�`J ��4"�61��,2o: + + F8/

� 2be.« + G � ¥E4 �,���@2�44�6!�D$�>�(� 2 � � � �>4 e)�"'.'#�>�32-1���� K 1p�8���«:4�1p�*� � 7F/ [ 4�8�- � �>�:` 5.1�-���� � 4�1F!"������A � ��� -&��� � - � ��1�� � �8�8'F�18�-Z! 1�-"�;1���� � ���1'#1�DS�� �#��0�1�� � �8�8'F�18�-Z!��.1�� ���F/ Z �/ %�� �����$#�&�� (��!�_� ���� D &�� �� " ���h@ ;��V" � £ � D � "�£ �O2 ..1�����-4�OG<IpH �8�<� /�9K-�-��8!"�61 � �����0 ��4��3�('�. 8 � �� � [ 1F!��,����>4S�-2]��1�� 8�1$4S��: + + G*/

� 2<]¬=8F � 23�F1-7>291$4�14DD1����j�&���98��.1 ] ����������3/NI � 4&�)! � .����!� ���('L�(1$� � �)'#�L��Q-4�6'=8��61 � ��� �1���� ��A � 4�1-! � ��� �?/ Z � / %�� ��� � � �� " ���h@ ;��d" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%'& �_�� ��/ -C@*;&�� ( � D 132 � � 2#F%=<=8F*/

� 2<]7I7=7: � K 1��J2B� �����?2 2�����]?� ���?2 1������U� � 1 � I+�.1F!��.1-'B/ I+� �$4 � -4��� ��1 � 8�4"��-&0 4��(' � ���? �"���M.�1-�(44�� �,/ [ 1��98 -4!�4&��. � 2 � �=1�. .8� 1$4B�� 9 I Z 9��<RH� � [�F%=<=7:-/Y9��$1F�(�61F5��(�0 4��('�MTNON8PEQ)RORT|VsOr8PTNhk�Y)lVN7i�j��#k%sO` Y_WO`<abR�`#i�XbkTR8i�XClVN9s9i7|VNCl8RVU#Wh\<n9lT\Vmhl�Y[M9N<Zon*2F%=<=7:-/

� 23�18h=<= � B31-5�4&�)!��V23��8�� � � /E¥F�.!"�(��� � .�4��7��0 - � �.1 � 1�!��('.'L� ��� �� �98,'$58��4B�6����-Z�� 1��B��d`� �>4S� 1$�3/ Z �F2�1$4 � � 4"����>���32F���,� � ��4"28" #%$ ; ����� � &�� � %�& -( �����)(%& * � � ,.2 ��,.-0/.14768686 2%�1�$��8,'7��: ;<=8IK��0¬> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 21..1�����-"� E :�H9�1�1�,/I7.�44�� ���>4 J ��4"�61��,2hF%=<=<= /

� 2 � + I �  Y��D��J2�1$4&��!,1���� 2W�(4��(� � � @ � 7"'#1����I/��3���(�)��-4��� �d` 0 4��>��1-!"!�8,'=8��(1 � ��4�- 1����!0 1-���i`- � �1.H-4��� ��1 � 8�4"�V-&!�����'#��-P#%� � � �18 �&� 4��>��-"/ Z � ? 1$� � ��4.BD8,' �(2����,� � ��4"2C" #%$ ; ����� �&�� � %'& -( �����)(%& * ��� ,�2 ��,.-?/.1 � � � 2^������8 '#��:�F E(E ��0�> ����A@ % �¦B � �� � &��� ��/ -C@*�� %�D ��&5������� 2 ..1�����-;�8;<= H � + �,/KI7.�44�� ���>4 J ��4"�61��,2]: + + I*/

� 2<R + E � [ �(� �(4�2������61$4"�;1���� � �,�(���6��. R;�1�F1 #�1p�(/ R 1���� �(' ��4�1F!��(��-�1$4"�H.�4�1-! � �6!�1$�w��9..1$4�1��,���-' 0 ��4(����-&�����,�� � ���L!��(��� � .�4�� � �8!�����-"/ Z � & %�� " � £ � � � � � % �������� � � ��/ -C@0�� %1; �(# � ��/6/ @*��&5� ; ;& � � D ����@ % &� &F27..1�����-E�8FpH7I E /S9K-�-��8!"�(1 � ��� ��0 �$4�3�('�. 8 � ��� � [ 1-!�� ����>4S�(2¬: +�+ E /

� 2�4�1 +�+�� I � �<0 1�� 2�4�1���� -�/ , ����0&�� � &�� ( / @�� � &5���6� & ��� �>%4;�� % @���[@ % � ; �(#�� & ( &� ;��� � % '& �,� ; �� � * � @*& � #�&�� ( &�� / % &�$ ; � &F/ � � K � ����-4��-�2�¥�����������$�� Z � - � � � 8 � �F��0[@��!���� �����1�%�-2b¥Q������� � �$��I2 [����   � � ���>4��61���� -"2?: + + + /

� 2�4&� + ; � K 1p�*��� 2�4&���I/ 1 ��� 1 %4; � � - ;�% ���� D � ��&5�� &%¨�� & ��� 1 �����0� �����)(%& ��% ��� � � �� � �9�9� � � �� � ����� / % &�$ ; � &>; �(# % ���$# ��/�� � ��4�-���8�- � 8,5��)��-�� �� �,2o: + + ;*/

� 2 I7=7: � ¥�'L'#1��98������#2�4"��-�-�� � 1���� ��1-!Sc98���- I � �>4 �I/ e:4��18 . -&�����.1 � 8�4���-�#%� � � ��� `!"���� � 4����1�8! 1 � ��� �?/ Z � «�#�1�� ������«1�6'B2 �� � � �$4"2 / %�� �����$#�&�� (�� �_� � ��������� % � ; �'& � � ;���� ��%��9� � � - � � / %4; ��'&5��� ; �(# 1 ��� ��%'& &�� / @�� � &5���6� & � %�& -( �)(�%&; -�� & �

:�F��

Page 125: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

/ � ��47686%ª 2x�1����8,'#� : + + FQ��0 > ����A@ % ��B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2&..1�����-: + =�H9F%=<� /KI7.�4&��� ���>4"2bF%=%=7:(/

� 2 I7=8F � K 1�� 23� ����� 1����G9��6�)!���I8�(���$��445*�>4��,/ 9K. .��)�6!�1 � ��� � -=��0P'=8�� � ���6����� 1$4V0 ��44'F- � �!�4L�7. � �1��4�1�.��8�(/ [ 1�� 8�-&!�44��. � �(5 � 1-�����J58�G.*�>4�-�� �.1$� !��('L':8��,�6!�1 � ��� �I2#F%=<=8F*/

� 2>� + � � [ �(� �(4U2������61$4"� 1���� [ � � �6�$8�� �,/.���>4 � ��0��8�� �?.*�>4&'=8 � 1 � ��� � -z����� �d` ��� � ��4�1-! � ���$�7��>4��-` D ��� #����� �$��5.1�-"��T� �<1��8� � 4�1�. � � ��4B.*�>4&'=8 � 1 � ��� �I/�¤�� @ % � ;���_� � %'& -( ��� ��)(%&F2 + K E M'��:�� + HC: �%� 2]: +�+ � /

� �91-' + I � ��1�� �91-'7��,��-&!��I/�¥F�.!"���� � 1���� ��������4�1$�6�)7���!��4��18�. -&�����.1 � 8�4���-�/ Z � ? 1$� � ��4BD8,'��(2 �� � � �$4"28" #%$ ; ����� � &�� � %'& -( �����)(%&.* ��� ,.2 ��,.-0/ 1 � � � 2��1����8,'#��:�F E-E��0�> ����A@ % � B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����-M�8�8GpH �OI + / I7.�44�� ���>4 J ��4��(1��,2: + + I8/

� �91-' + ; � ��1�� ] �������.1$4����91-'#���,��-4!��I/!�,%�� @9- D & ( � ; A@ % � D ����� / � �$; �(# / ;%&4/ ���� Db&9� ��� / � �Y;�� �$# � �)���� � & � � % ���� >�)( ;�% &��� / / %�� � � � /X/ � � K � ����-&��-"2O¥W[x� ���8�44�6!��I2: + + ;*/ K ��-�-"/h¥W[x�  U�,/0: F<G<F%= 2#��1$4 � 8�� �Qe���4�4"� J ��4"�61��,2#«V��� - � 1��,7-/

� �91�� + G � R 1����91���� ��� �3/OD A@K#�&5� � &�� D ����@ % � £ @ � '&8- ;�% & � ��/ -C@0 ; ;& � � ; �(# " -�- � &5� ; '& � � �O/� � K � ����-&��-"2 ? ���67"'#1���� Z � - � � � 8 � �E��0 I*!��(���,!��F2IR���� � �1� � I%�7:p=<= 2 Z -�4�1$��� 20��8����: + + G8/

� �91��h=<= � R 1��§�91���� ��� � / I+�"!�8�4&� � �C1����.!��('�.��1-4� � ��� �E��0U'=8�� � �i`)..1$4 � �A!�4S� . � �1��4�1�.��,�)!/.�4��-`� �8!�����-"/^¤�� @ % � ;��J�_� � %�& -( �����)(%&F20: E KL: M'��:�� E H7F%=<F*2hF%=%=<= /

� �91��h=7: � R 1����91���� ��� � /����,�!���>4�-�1 �(���@!��('F.��1-�1-5��(�$-���!�8�44� � �C��9 ����# ..1$4�1��,���-' 0 �$4�!�4L�7.a`� �1�$4�1�.�� �6!V.�4�� � �8!�����-"/ Z � / %�� ��� � 4 �(# �{�d�3� Db&�/ - �9� &�@ / � � � @*�(# ; ;& � � ���_�� ��/ -C@*�� %�D ��&5�������§�' 2 � D<� 2�..1�����-�: E � HC: �OG*2#F%=<=7:-/

� �E¥3;<I � K 1p�*���§���.1�8,' 1���� ��1��d` � �����4&��D ¥����>4 � -"�-/I9P-"�"!�8�4�� 1����6.�44��� 1-!z�7`).�4�� � �"! � ����.�4�� � �8!���� 0 ��4 � 4�1���-&'.� ��� �� ��.8��4�-�� ��1$�U���0 ��44',1 � �����$5*� � #��>��>�$4��F1�� �67 1 � ����� -"/ Z �[ /4F������87�D��,2$���,� � ��4"2%" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-0/ 132 � ��� 2��1����8,'7�EF%� E��0�> ����A@ % ��B � �� � &�� � ��/ -C@*�� % D ��&5������� 24..1�����- :<:p;�HC: �8I8/7I7.�4&��� ���>4�` J �>4��(1��,2: + ;8I8/

� �,B�=7: � R 1��­�91���� ��� �21���� [ 1 4&! B ��-4!����6���I/���,���$��4�-�1$�����D!��('�.���-�1-5����X!��('.'.� � '7�� � -"/Z � ���-��«1�(�)�61��?2���,� � ��4�29" #%$ ; ����� � &�� � %�& -( �����)(%& * ��,.-?/.132 47686%ª 2O�1����8,'#�F9: E + ��0]> ����A@ % �3B � �� � &�� � ��/ -C@0�� %3D ��&5������� 2�.�1�����-3: + H9�8= /�I7.�44�� �$��4 J ��4��(1��,2F%=<=7:-/

� �,BH[ + ; � 9K� ����-����.1��I2 � 1F�(4 B.4�1��KD$�>�32)1���� ���61���� ��- [/-4���18�� ��-"/ ¥21�-L� !��('7� H ��1�-S��1� �,�!�*��-&�)5��(�.! 1�-"�I/ Z � «1F��-�1� ��85*�>4��,22���,� � ��4"23" #%$ ; ����� � &�� � %'& -( �����)(%& *��� ,.2 ��,�-?/.1 � �� 2o�1�$��8,'7�+: �<= E ��0E> ����A@ % � B � �� � &�� � ��/ -C@*�� % D ��&5������� 2..1�����-�G%�7:�H7G%I<G*/�I .�4&��� ����4 J �>4��(1��,20: +�+ ; /

:�F<G

Page 126: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� �be.� + ; � R 1����91���� ��� � 2�F������ eV�$���4"�"�6!��?2%1���� I+�.1-����1$���z�8�3/M[����'4�1���� �(' ��4�1F!��(�'#� � � � � �����1�%�-2�4����8��-&� � ���I/ Z � / %�� ��� �96 �� " ���h@ ;��C" � £ Db&�/ - �9� &�@ / � � 1 �������%'&��_� � ��/ -C@0'&�� ( � D 132 � � 2�..1��$��-�F%= + H9F9: ; 2o: + + ; /

� ���.1<;8G � K 1p�*��� ����1�8,'B/�I+�"!�8�4&� � ��#%� � ���18 � ������ � ��@,! 1 � ��� �0��[ 4�1���-�1-! � �����!-S� - � �"'�- � �',14D$��5,���J5�4�� � ����4V�(5 -����(� � �-/ � ��/6/ @0��&5� ; ;& � � �"�_� ���� " � £�2�F�; KL: =(M��!: = E =�H: =��1� 2 F�! � �-5*�>4�: + ;8G*/

� ����� + G � ] �� � ��� �������I/ 9:!�!���-�-T#%� � ��. -"��8�� ���O�8'�-"/ Z � ¥Z/ K 1 #;-�� � 1������ /�e����6��!-2��,� � ��4�2 � %'& -( �)(�%4; -�� &%¨ / ��� &5� & ; �(# "�� (0��% &��� / �O2��1����8,'#� : =<F + ��0 > ����A@ % �B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����-�F E F H7F�� E /�I7.�44�� �$��4 J ��4"�61�� 2]: + + G*/

� �E«�F I7=7: � eA��� �$1����,� K �.��4���-&!>��,7��,2 �����.1 � ��1�� «:1 � 7-2ARB1�0 1-��� F@- � 4�� �7- D8�(2%1���� 9��.1-'I*'.� � �?/%¥F�.!"���� � 1������ � �d` �� � �>4�1-! � �!��� � � �a` '#1$�(��� 1-5����V!��('.'L� � '7�� � / Z �M2W�(4��(� �� @ � 7�',1����I2 �� � � �$4"2?" #%$ ; ����� � &�� � %'& -( �����)(%&�* ��� ,.2 ��,.-0/.1 47686%ª 2o�����i`8,'7�xF%=��OG&��0?> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 21.�1�����-A�OI<G H � + �,/�I7.�4&��� ���>4J ��4"�61��,2#F%=<=7:-/

� �E« � R�=7: � R 1�� �91���� ��� � 2h���-��«1�(�6�(1��I2T¥E4���7 � � � 4�1�� D 231����J9������TR&��-���?/"2��61F!�D7` 5��2A>!�� �a`!�8�4"4���� � 7>��4��-`�D�� �0#��(��� ���:4��Sc98,�(4"��-/�('7���F1,K �������UM 4��18�����-"/ Z � / %�� ��� �8� % # " �h��h@ ;��T" � £ Db&4/ - �9� &�@ / � � 1 ��� ��%'&+�_� � ��/ -C@0;&�� ( � D 132 � � 2�..1��$��- G<I%=�H9G<I + 2F%=<=7:-/

� �<]�=9: � ��1��§�91-'7��,��-&!��71�����9����.1A]0�7-L�F1���-$D 1p�F1 /]¥��.!��(�� � � � �a` � 4�1�� -W0 ��4�1F5��(��1�� � �8�7`'F��8 -Z'=8�� � �i`)-�� �0# !�4"������ � �61$� -L� - � ��' #%� � �T�1. � �����.1$� 1���� �8�*'.� � �,4����1�8! 1 � ��� �I/Z � 2W�(4��(� � � @ � 7"'#1����?2 ���,� � ��4"2 " #%$ ; ����� � &�� � %'& -( �����)(%&­* � � ,.2 ��,.-0/.147686%ª 29������8,'7�.F%=��8G:��03> ����A@ % ��B � �� � &�� � ��/ -C@*�� %�D ��&5������� 2 ..1��$��- + E Hb:<: ; /I7.�44�� ���>4 J ��4"�61��,2hF%=<=7:(/

� �<]�=<F � ��1��¦�91-'7�� ��-&!��<1�����9 ���.1X]0�7-L�F1���-$D 1p�F1 / K � �.1F'L�)!�1-!�!�8,':8��61 � ��4�-�/ Z � [ � � ��$8�� �,28�� � � �$4"2o" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-0/.132 47686V4 2 ] ��! � 8�4��  &� � ��-�� �3�('�. 8 � ��4 I*!��(�� !��-2 ..1�����-��7:�H9I%� /�I .�4&��� ����4 J �>4��61��,2hF%=%=8F*/

� � [ + + 1 � ��1�� �91-'7��,��-&!�� 1���� [ 1$4$D98 - [ �)!�������-"/ � 4�� �8�� �J���C7>��4��-`�D�� �0#��(��� ��� � ��1 � 1�98,'$58��4J^ ��- � ���>.�4�� ��8,! � ��0 � #3� -�1�0 �>.�44�6'7��-"/ Z � ��1-!Ac98���- I � �>4 �I22���,� � ��4"2" #%$ ; ����� � &�� � %'& -( �����)(%&­* ��� ,.2 ��,.-0/.1�� �8� 2��1����8,'7��:�G + F ��0.> ����A@ % �B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����-�: =<I HC:�F<F8/�I7.�44�� �$��4 J ��4"�61�� 2]: + +�+ /

� � [ + + 5 � ��1�� �91-'#���,��-4!�� 1���� [ 1$4$D98 - [ �6!�������-�/ I+��.�1$4�1-5 �(�6� � � 1���� ���.!"�(���,!z� 0 �$4�������4&�)!>��4��18 . -&��� �.1 � 8�4��F-&!�����'#��-"/ Z � [ �6!��.1 ��� ? ������>4"2E���,� � ��4"23" #%$ ; ����� �&�� � %'& -( �����)(%&�* ��,.-0/ 132 � �8� 20�1����8,'#� :p�<�<�G��0x> ����A@ % � B � �� � &�� � ��/ �-C@*�� %�D ��&5������� 2 ..1��$��-;�#: E H9� E = /KI7.�4&��� ���>4 J ��4��(1��,2o: + + + /

� � � + G � ] �� � �����������1����Q[���445*��� � 4S� � - � ������4�-���?/� B��#P�$4��18 .6-4��� �.1 � 8�4"�&-4!����"'7��-�/Z ��9���0 4"�� � K � I�1�� � ��-�2 ��,� � ��4�2�" #%$ ; ����� � &�� � %�& -( �����)(%&�* � � ,.2 ��,.-0/.1� � � 2�������8 '#� + G%=T��0�> ����A@ % ��B � �� � &�� � ��/ -C@*�� % D ��&5������� 2�..1�����-§:�I9:�Hb: ;7:(/I7.�44�� ���>4�` J ��4��(1��,2o: + + G*/

:�F%�

Page 127: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� ��4�1 + I � R&���.1$��­��4�1F'#�>4"/�£ � #%@ � ;�% ��� � & ( � �_��D ����@ % � & �� / %4; ��'&5� ;�� � %'& -( �)(�%4; -��0&5�/ %�� � � ��� / � � K � ����-4��-�2����,�!����4�-&� � �G��0V9:'�- � �>4 �.1F'D20: + + I*/

� � I + I � ��1�� �91F'#���,��-4!���1���� [ 1$4 D 8�-6I � 1����(�>4"/ ¥F�.!"���� � �$4��18 . -&��� �.1 � 8�4��6-&!����"'7��-0 ��4!�61 4���� ��4��18 . -�/ Z �S238�4 � «1 �6��- DS�32B��,� � ��4�2�" #%$ ; ����� � &�� � %'& -( �����)(%& *��,.-0/ 132�� � � 28�1�$��8,'7� : F + �V��0�> ����A@ % ��B � �� � &�� � ��/ -C@0�� %xD ��&5������� 2 ..1�����-�#: =�H9�OF��,/KI7.�4&��� ���>4 J ��4��(1��,20: + + I*/

� � I + +�� R&���.1$�����4�1F'#�>4�1���� J �)! � ��4 I+� �18 .?/�I*��� �.1 � 8�4��%-&!����"'7��-�5.1�-���:� � � ���3- � 4���� �R�I89 1�-�-�8,'�. � ��� �I/ Z � / %�� ��� � �� " � £ � � � � � % ������� � � � ��/ -C@0�� %1; �(# � ��/ �/ @*��&5� ; ;& � � ��D ����@ % &� & 2D..1�����-;�8��H7G<F8/ 9�� [ .�4���-�-"2 � � � : + +�+ /

� � �7� + : � K 1p�*�������.1�8,' 1�����¥"8 ���������� 1����B�z� - � /%e)4��18�. -&��� �.1 � 8�4���-"/ Z � K � �.1 �� ? /K 1p�*����-�2$�� � � �$4"2%" #%$ ; ����� � &�� � %�& -( �����)(%& * ��� ,.2 ��,.-0/.1�� �8ª 2��1����8,'7�EG��8I��0�> ����A@ % ��B � �� � &�� � ��/ -C@*�� % D ��&5������� 24..1�����- F<G%I H7F%�8G8/7I7.�4&��� ���>4�` J �>4��(1��,2: + + :-/

� K 1-' + = � Z � 1�� 2 �"��4�4"� K 1F'F���1 4 �I/ � 1 �8'7�� � -S� - � �"'�-�1����B!�4"������ � �61 � '7�"!���1��,��-4' #%� � �.�4�� � 1-5����V-��"!�8�4&� � � 1��F1-��� - � 1-5�8 -�� 5O�J�����,�!�*��� 8.1$��-"/ Z �OI-�.14@0e������ #91�-�-��>4"23��a`� � ��4"2x" #%$ ; ����� � &�� � %�& -( �����)(%& * ��,.-?/.132 � � � 2E�1�$��8,'7�H�<= E ��0 > ����A@ % �B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����- E F�;�H E(E G8/�I7.�44�� �$��4 J ��4"�61�� 2]: + + = /

� K 1-'+=%= � Z � 1�� K 1F'F���1 4 �I/8¥F�.!"���� � !�� �,!�8�4�4"�� � 7���4��-`�D�� �0#����� ��� �� � ��� 1�8*A*�(�6�(1$4S�K- � 4&����'F� ���>�3/ Z �=291 4 � � 4"����>���32$��,� � ��4�2<" #%$ ; ����� � &�� � %'& -( �����)(%& * � � ,.2 ��,.-0/.14768686 2%�1�$��8,'7��: ;<=8IK��0¬> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 21..1�����-"� E :�H9�1�1�,/I7.�44�� ���>4 J ��4"�61��,2hF%=<=<= /

� K 1-'+=<F � Z � 1�� K 1-'F���1$4 �I/�F �W��`).�4�� � �8!�����-"/ 9�� 1-���61-5��(� 1 � MTNTN8PEQSROR�UOUOU^Y `7i#\�Z]\�YLi�aEY `��bR \��7i�jbR�h\�m%ZhidYwPCl82?F�=<=8F*/

� K�K  �=<= � K 1����8� K ���(��� 27� � � � � �61 K #B��4$DU2�1���� [ ���,�]  1���4�/¬ U� �,'#1$���(� 1F5��(�<!>4S� . � �1��4�1 `.��8�(/�D � "�£ ¤ � @ % � ;��J� � � ��/ -C@0'&�� (-2 E = KwF(M'� E + :�H � E I*2 9U.�4&���¬F%=<=<=*/

� K B�=7: � Z � 1�� K 1-'���1$4 �=1���� ¥��6�)!��,�(4��=BD8 �4��-�1�DS� / 9 � ��� � �����>4>!��('L'.� � '#��� � -4!����"'7�5.1�-"���� ����4���8 . -�#%� � � �,����������4�����4�/�MTNON8P�QSROR<W�P7sb\pjTN^Y�\�i7|Vs Y)k�sOm#R<tT}O}C~(2F%=<=7:-/

� K ��I%� � ? �,� � @.����� K �v�7��1���� [ 1$4 � ��� ¥ �B���(�)',1��I/¬  �O# �,��4���! � ��� � -<����!�4L� . � �1�$4�1�.��8�-/���d�d� 1 %4; � � � � � �>� �2��%�/.; ;& � � 1 ��� ��%'& 2 Z [�`LF%F,K[� M'� ���1�VH9�8GO�,2# &��� /?: + I%� /

� K ]�  + � � � � � � �,�61 K #B��4$DU2C�$��� 4"�z�J] � � -�.,���"!��I2.1���� [ � �,�¬  1���4"/ K ���(� � 1$��-&��� ��� � -�� I-����0 `���0 �$4&!"��� �G.�4�� � ��! � ��� � ��0 �,���(� � 1$� ��70 ��4&'#1 � ��� �I/ Z � / %�� ��� 4 � �� " ���h@ ;��¬" � £Db&4/ - �9� &�@ / � � 1 ��� ��%'& �_� � ��/ -C@*;&�� ( � D 132 � � 2o: + + � /

� K [ =<= � �&�z� �����,��� K � �,��-�1���� I*�����8��� [ �6!�1$�6� / � 1$4�1 �(�(�>��4"�� 8,!��65,���6� � �'0 �$41���0 ��44',1 � �����d`� ������4�� � �)! 1$�����H-��"!�8�4��.!��-'F. 8 � 1 � ��� �I/ Z � [ ���,�(4@2������61$4"�-2 ���,� � ��4"2�" #%$ ; ����� � &��� %'& -( �����)(%& * ��,.-0/ 132 4768686 2��1����8,'7��:p;<;<=;��0o> ����A@ % �^B � �� � &�� � ��/ -C@0�� %D ��&5������� 2�..1�����-�I��VH + F*/ I7.�4&�������4 J �>4��61��,2bF%=<=%= /

:�F<I

Page 128: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� K  �I + ; � � � � � �,�61 K #3�$4$DU2 [ � �,�T �1��$4"2 1����+9Y'L� � I�1$�.1F�3/O�3� � !�8�4"4��� � 7���4���D�� �0#��(��� ���F/Z � / %�� ��� �96 �� " ���h@ ;��V" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%�& �_� � ��/ -C@0'&�� ( � D 132 � � 2: + + ;*/

� BCB I7;<; � � 44�(����B.�"���$�-2 9Y'F��- B �61 � 2+1����J9 �,� I+�.1-'.�(4�/ � �>4��-` D ��� #����� �$�@.�4�� ��0 -/��0 ������d`� � � �(/E¤�� @ % � ;��J�_� � %'& -( �����)(%& 2?:<� I<I H + �,2]: + ;<; /

� B�] [ ;<� � [ �6!���1$���o� /0B ��-4!�����4�27  1��,!��L9 /8]?� �,!��?2�1���� [ �6!���1$��� [ �>4�4&� ��� /?¥21�-S���)'F.��1-�-4�i`5,�(�)� � �6.�4��7��0 -30 ��4 �,��- � 4&�65�8 � ���T!�� � -"�� -�8 -&.�4��(5��(�"'�-"/ � & � % & ��@*��$# � ��/ -C@0'&�� (-2:SKL:0M�� F%��H E + 2]: + ;%� /

� B�]7I + +�� � 44�(��� B.�"�����-2 K 4���4 ] 1�.,���� � 2�1�����9��,�I+�.1F'L��4"/ [ 8�� � ��.��(��� � �,��� � ��4�1-! � �����:7���4��D�� �0#��(������;.�4�� ��0 -"8�������4%�������4�1 �31�-�-�8,'F. � ����� -"/¬D � "�£ ¤�� @ % � ;���� � � ��/ -C@*A�&�� (-2bF + K_: M��!:�H7F�; 2]: +�+ + /

� B [ =<= � [ 1 ��� �,�(1�-B � � 7"�$1���� � ���)� [ 1�8�4���4�/�B.4��('S..1$4 � �61 �-!���� -&��- � ���,!z� � �;�����(5�1$�-5�4��F1��d`! 1�- � / Z � / %�� ��� �<4 �(# " ���h@ ;��?" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%'&O�_� � ��/ -C@*;&�� (� D 132 � � 2�..1�����-;� + ��H7G%= E 2#F%=<=<=*/

� B F + I � ¥��6�6!�� �(4���B 8 �4��-�14D8� 1���� [@1 � -�8.1�DS�7F�D 1-'F� � �,/JI � 1 � ��- � �)! 1$� 7��>4��+D�� �0#��(������V.�4��-`� �8!�����- � � .�4�� ���J'F� � 8��(1$4:.����!� ���('L�(1$�24��>�61 � ��� � -�/ Z � 238�4 � «:1$�6��-$DS�32E���,� � ��4"2" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-0/.132 � � � 2b������8 '#�§:�F + ����0^> ����A@ % �.B � �� �&�� � ��/ -C@0�� %�D ��&5������� 2�.�1�����-.: ��H E = /�I .�4&��� ����4 J �>4��(1��,20: +�+ I*/

� B F + ; � ¥��6�6!�� �(4���B 8 �4��-�14D8��1����k[�1 � -�8�1�DS�(F D 1-'�� � �,/ 9P.�4�1F! � �)! 1$��1����6.�4�� � 1-5��!�=-"�"!�8�4��-&!�����'#�B0 ��4A. 8 5��6�)!������$��44��@31-5��(�3-"�"!>4�� � -��.1$44�� ��1����$� � - 1�. .��6�)! 1 � ��� ��-"/ Z ��«:1-��-�1 ��858��4�� 2 ���,� � ��4"2 " #%$ ; ����� � &�� � %'& -( �����)(%& * ��� ,.2 ��,.-0/.1�� �� 2d�1����8,'#�: �8= E ��0]> ����A@ % �3B � �� � &�� � ��/ -C@0�� %3D ��&5������� 2�.�1�����- E F H9�8� /�I7.�44�� �$��4 J ��4��(1��,2: + + ;*/

� B I7;8I � 9:'��1- B �61 � 1���� 9 �,�!I+�.1F'L��4"/¦�U�0# � � .�4����$�+�1��8�4�-"����0_� � 4�1-! � �6! 1 �$-�����8 � ������ �$������ � ��@ !�1 � ��� ��1����G-&�����.1 � 8�4��K.�4��(5����"'�-"/ Z �T9 ����4��O# [ /KF������87�D��,2����,� � ��4"2" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-?/.132 � ��� 2¬�1����8,'#�+F%� E ��0�> ����A@ % �§B � �� �&�� � ��/ -C@0�� %�D ��&5������� 2�.�1�����-.: ;<� HC: + �,/KI7.�44�� ���>4 J ��4"�61��,2o: + ;8I8/

� e1$4)=<= � I*�6'�-����_e:1$4 @��KD$�>�3/ � ; ; � ;�� ��B ; ;& � � ¨ 1 ��� #0� ; �� �_� - % &�$ ; � & &�� ���� 4Tª � ������[@ %'&F/:F�� RB���(�(�!��� 9K-�-��8!"�61 � ��-�2 Z �,!-/ 2CF%=<=%= /

� eM2 � I+�.14@ eV�$�� #�1�-�-"��4;1���� [ �(�,��4H2 ���(�(1$4��F/ ] �"! � 8�4"� � � � ��- ��� !�4L� . � �1�$4�1�.��8�-/MTNTN8PEQSROR�UOUOU^Y)|Tl�Y[aC|Ol�` Y_W<`<aCR�aCl<W8shl8R�Z0\pMo\VshR�P#i%PhW<sbl8R%m<X�Y[M9N<Zon*/

� e�e [ ;<� � F�����/e������4��"�)!��I2 I-�.14@ e����� #�1�-�-���4�2 1���� I*�(�!�*��� [ �)! 1$�)�3/��U�0# � �T!�� � - � 4�8,! �4�1���� �(' 0 8�� ! � ��� � -�/E¤ � @ % � ;��J�_� ���� " � £�2 E(E K �SM'� I + F H9;<=8I82KF�! � �(58��4�: + ;<�*/

� e.�YR + +V� R&��-�1$44���ke)�����1$4��,2�I+�.1-�?� 1$�(���8�32�1����6[�1$�IR 1-5 ��I/CI+�"!�8�4��:�.1�-"�d` 1����d`�-4��� �G-4���-`�.1 � 8�4���-A#%� � � ��8 �@� ���74�1���� �-' ��4�1-!����-/ Z �­��1-!Sc 8���- I � �>4 �I2 ���,� � ��4"2�" #%$ ; ����� �&�� � %'& -( �����)(%& * ��� ,�2 ��,.-?/.1 � �8� 2^������8 '#��:�G + F ��0�> ����A@ % �¦B � �� � &��� ��/ -C@*�� %�D ��&5������� 2 ..1�����-�:�F E HC: E + /KI7.�44�� ���>4 J ��4"�61��,2]: + + + /

:�F%;

Page 129: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� e.« + � � F����� eV�$���4"�"�6!�� 1������U8 �1� «)4�1 # !"7��*DU/ � � ��� !��('F.��1-4� � ��� � ��0H7>��4��1`D�� �0#��(������=.�4��7��0%-L� - � ��'F-�/ D � "�£ ¤ � @ % � ;�� � � � ��/ -C@*;&�� (-2]F<G,KL:0M��!: � + HC: + F*2: + + �*/

� e@] R + G � ]�/aeV� ���,2 � /8] ��,!�����I251���� � /8R;8 -��S58�(/42 �87�1�� � �����1��$4�����'#��� � #%� � ��1�8 � ����� � �i`! 1 � ��� �]�7F15�-���4L� 1 � ��� � - 1����%1�. .��)�6!�1 � ��� � -I��� � ���(�>4�1 � �� ���8�85�4&��� 1���� �)��KD&0 1�8�� � -"/Z � / %�� �����$#�&�� (�� �_� ��������� �� �� / � ��%�� &�� ( � � � � � % ������� � � ����-����(# ; � � � � ��/ �-C@*;&�� (��2��% � % &�'&5� ;��C" -�- � &5� ; ;& � � � � � �)� " ��� � 2�..1��$��-�F%�8I H9F%;8I*20: + + G*/

� e [ ;�� � I+�.14@Pe����� #�1�-�-���4�1���� I8�(���8��� [ �6!�1$�6� / � 4��-5.1-5,���6��- � �)! ���,!�4L�7. � �����I/�¤ � @ % � ;�� �_�� ��/ -C@*�� %@; �(# Db&9� �� /�D ��&5������� �O2hF%; KwF-M�� F<I%=�H7F + + 289K.�44�(��: + ;��,/

� e [ R�;8G � I+�.14@{e������ #91�-�-��>4"2 I*�����8��� [ �6!�1$�6� 2�1���� ���.1$4�����-TRB1-!�D��"� / [���� D�� �0#��(������!��('�.�����A*� � �V��0 �� � �>4�1-! � �!���3.�4�� ��0 -L�7- � ��'F-�/ Z � / %�� ��� 4 � �� " ���h@ ;��ODb&4/ - �9� &�@ /� � � @*�(# ; ;& � � ���_� � ��/ -C@0�� %�D ��&5������� 27..1�����-�F + :�H E =��,2]: + ;8G*/

� e [ R�;<; � I+�.14@ e������ #91�-�-��>4"2I8�(���8��� [ �)! 1$�)�32*1�����R;� �.1$����R%������- � /@9��,���(� � 1$�4-4��� �.1 � 8�4"�-&!�����'#��-���!�8�4"��1���1-�� - � 1��.1�. � �!����!�� �1-"��d` '#��-�-�1�����1 ��� 1-!�D9-�/ D � "�£ ¤�� @ % � ;��� � � ��/ -C@0'&�� (-20: I,KwF(M'� F�;7:�H E =%; 2 9U.�4&����: + ;<;*/

� e [ R�; +�� I+�.14@{e������ #91�-�-��>4"2 I*�����8��� [ �6!�1$�6� 2�1���� ���.1$4�����-TRB1-!�D��"� / [���� D�� �0#��(������!��('�.�����A*� � �!��0:��� � ��4�1-! � ���$�G.�4�� ��0 `�-L� - � ��'F-�/ D � "�£ ¤�� @ % � ;�� �_� � ��/ -C@0'&�� (-2: ; K_: M��!: ;<��H9F%=<; 2*B.�"5�4�8.1$4S��: + ; + /

� e [ ? ;%� � F�����we�������4����6!��I2.I8�(���8��� [ �)! 1$�)�32�1���� 9��*� ? ��������4�-�� �I/ � 4�� ��0 - � �.1 � �*�������� � � �,�� �Y5 8 �C� ���"��4�� 1$�)��,� � �:1����C1Y'#� � � � �=��0U!>4S� . � ����4�1�.��,�6!B.�4�� � �*!���� ����-4��� �I/Z � / %�� ��� 4 � �� �{�d�3� Db&4/ - �9� &�@ / � � � @0�(# ; '& � � � �_� � ��/ -C@0�� %�D ��&5��������' 2 � D<� 27..1�����-�:�I��VHC:p;8I*/ Z ¥d¥d¥ �3�('�. 8 � ��4 I7�8!"��� � � � 4���-�-�2�: + ;<� /

� e [ ? ;<I$1 � F����� e������4��"�)!��I2.I*�����8��� [ �)! 1$�)�3291���� 9��8� ? ��� ���>4�-�� �I/ �&�0# � �Q.��(1p�=1��O�'#��� � 1$�$�F1-'7�6��4 1B!��('�.��(� � ������-�- � ������4���' 0 ��4:.�4�� � �8!��$��-1#%� � ��� � ����- � ',11`����4&� � �(/ Z � / %�� ��� ª8� �� " ���h@ ;��o" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%'& �_� � ��/ -C@*;&�� (� D 132 � � 2�..1�����-�F9: ; H7F<F + 2o: + ;8I8/

� e [ ? ;<IF5 � F�����we�������4����6!��I2.I8�(���8��� [ �)! 1$�)�32�1���� 9��*� ? ��������4�-�� �I/ �U�0# � �!.�4�� ��� 1$�(�  � - � 1 � �"'7�� � -.��� 7��>4��-` D ��� #����� �$� 1���� 1�'#� � � � � �����1�%� ��0P!�4S� . � �1��4�1�.��,�)!.�4�� � �8!���� ����-&��� �I/ Z ��9 ����4��O# [ / F������87�D��,23��,� � ��4�2C" #%$ ; ����� � &�� � %'& -( �����)(%&* ��,.-0/.132 � ��� 2��1����8,'#� F%� E ��0§> ����A@ % ��B � �� � &�� � ��/ -C@*�� %�D ��&5������� 2..1�����-�:�I9:�HC:p;8G*/�I .�4&��� ����4(` J �>4��61��,2]: + ;8I*/

� e F + F � I+�.14@ e�����*#91�-�-��>4#1����GR 1�0 1F�(� F@- � 4�� � -$D8�-/ Z �8� 1$44�61�� � -&��� �.1 � 8�4���-�1���� � � �a`�� � �>4�1-! � �!����7��>4��-` D�� �0#��(������".�4�� ��0 - 1$4"�E�Ac98,�!�$1 �(�� � / Z �.¥E4 ����- � BW/�2 4&�6!�D �����32 ��a`� � ��4"2b" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-0/ 132� �%4 2D..1�����-�F%F%;�H7F����,/ I7.�44�� �$��4�`J ��4"�61��,2o: + + F8/Q] ��! � 8�4��. U� � ��-P�� �3�-'F. 8 � ��4 I*!��(���,!��  U�,/hI��8= /

� eV��� + ; � F����� eV������4����6!��I/ I+��!�8�4"�:'=8�� � � `�..1 4 � � !��('�. 8 � 1 � ��� �I/ [ 1��98 -4!�4&��. � /S9��$1F�(�61F5��(�0 4��(' MTNTN8PEQwUOUTU^YwUC\8l�`#k Z�YwU#W#\��%Zhi%jOj�Y_i#|�Y�\<nTR k�`7W8`#R�PTP�Y[MTN8Zon*2d: + + ; /

:�F +

Page 130: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� eV��� =7: � F�����_eV������4����6!��I/ � @0�(# ; '& � � � �_� � %�& -( �)(�%&; -�� & / �91-'$5�44�� ��� ���,���$��4�-&� � �� 4���-�-"2oF%=<=9:(/

� eV��� =8F � F����� e������4"�"�)!��I/ �3� �,!�8�4�4���� � 7>��4��-`�D�� �0#��(��� ����#%� � � � �)'L��� �;4"�z�8��-4� � ��I/ Z �/ %�� ��� � � �� " ���h@ ;��]" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%'& �_� � ��/ -C@0;&�� ( � D 132 � � 2..1�����- E(E F H E �8= 2hF�=<=8F*/

� e � R + ; � F������eV�$���4"�"�6!��?2U2 �(4��-� � � @ � 7"'#1��I2�1���� R&���.1$�� R%���$��- � / I+�>��0 `����������F1 � ��� �#%� � � !�� � � 4����(����Q.�4��1..1��F1 � ��� ��� �$4�� #��.1 � ��0��1��8 ���1-�� �1�18�4C�(1�. � �1.I/ Z ��U8 ����«)4�1 # !"7��*DU2����,� � ��4"2%" #%$ ; ����� � &�� � %'& -( �����)(%&�* ��,.-?/.132 � �� 2��1����8,'#�: ���OF���0�> ����A@ % ��B � �� � &�� � ��/ -C@0�� %xD ��&5������� 29..1�����-�:�G E HC: �<;*292���4"�6��?2C: + + ; /I7.�44�� ���>4 J ��4"�61��,/

� � Z ] ] + +�� �����.1��¦� �1�- � 1��I2 R;8 -�-������ Z '�..1����)�61-7�7��,28] ��� � ��T9+/,] ���8��I2.1���� [ �6!���1$��� ] 8,58�-/9 .�-���8�� ��4�1���� �(' �������4�1 � ��4V0 4��(' 1��O�I� ���:` #�1p� 0 8��,! � ��� �I/�D � "�£ ¤�� @ % � ;���_� � ��/ -C@0'&�� (-2bF�; K �SM'��: E ���VHC: E + � 2C: + + + /

� �(]�=%= � I � 1��,��- � �(1 #¢��1$4"�"!�DS��1����H9 ���.1 ]0� -S��1�� - D 1p��1 /�9 �.1�. � ���$���!� -"�"!�8�4�� � ��4���-�� �����!�4L�7. � �1��4�1�.��8�C�A�� � 4�� � 8 !"�����!��8!�8�4"4����,!z�-2@4"�"'����8��� �!��4�1�-�8�4"��-�/ Z �I291 4 � � 4�� `�����>�32 ��,� � ��4�2<" #%$ ; ����� � &�� � %�& -( �����)(%&.* ��� ,.2 ��,�-?/.1 4768686 2V������8 '#�x: ;<=<I��0�> ����A@ % � B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����-§: + = H7F%=<� / I7.�44�� ���>4 J ��4��(1��,2F%=<=<=*/

� �< �=7: � 9 � � �-��������18*A,1�����«A�)'  U�189����?/JI-��..1$4�1 � ��� �����"!"��-&��� � K ���#� `_�B���(�)',1��=0 4��('K �v�7�:` � �>�(�6'#1�� ��� !�4L� . � �1�$4�1�.�� �6!��$4��18 .�-"/ [ 1��98 -&!>4&��. � / 9�� 1-�(�(1-5����Q0 4��('MTNTN8PEQSROR8W�P9sb\pj9N^Y{\�i7|�s YSk�sOm 2�F�=<=7:(/

� ���18h=<= � 9 � � �-��������18*A / 9 � ���:` 4��18�����.�4�� � �*!����/0 ��4 � 4&��..1$4 � � � � K �v�7�:` � �>�(�6'#1��I/ Z �/ %�� �����$#�&�� (����_� ���� " B 1 D �A��� � � � � � % ������� 2%�1����8,'7�.:p; E ;���0�> ����A@ % �xB � �� � &��� ��/ -C@*�� %�D ��&5������� 2 ..1�����- E ;8GpH E + �,/KI7.�44�� ���>4�` J ��4��(1��,2#F%=<=<= /

� «@] ]¬=7: � ��� 8��d`_�$��� ����«1�6'B2O��� ��� Z �L] �6'B2F1���� K � � �.�U� � �L] ���-/]¥F�L!��(��� � 1����F-"�"!�8�4��'#��'$58��4�������� � ��� �B�� �$4��18 .H-&��� �.1 � 8�4��M-&!�����'#��-"/ Z � K / ? � �?2*���,� � ��4"2 � � � D �4768686 2��98,'+5*�>4�F%=9:�GP���+] �"! � 8�4"�E &� � ��- ����3�('�. 8 � ��4JI*!"����,!>�-21..1�����-3:�G%=�Hb: �7:(/I7.�44�� ���>4 J ��4"�61��,2hF%=<=7:(/

� « � + ; � ���+�x«1���6�61�� 1����§¥E4���7 � � � 4�1��KDU/ Z ����� � � � �C��-&!>4��0#A/ Z � �U8��1��«)4�1 #W!�7z�0DU2����,� � ��4"2" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-0/.132 � �� 2b������8 '#�§: ���OF#��0^> ����A@ % �.B � �� �&�� � ��/ -C@0�� %�D ��&5������� 2�.�1�����-.: � + HC: ;8G*2�2���4"�6���I2]: +�+ ; / I7.�4&�������4 J �>4��61��,/

� ] 1F'�I +V� ] ��-��)�(�Z] 1-'�.���4 � /b�3� � - � 4�8 ! � ��� � �,���(� � 1$�7-4��� ��1 � 8�4"��-A0 4��(' 1@�����:`3#91p�:0 8��,! � ��� �I/[@��!����,�)! 1$��R���.���4 � [@��!����,�)! 1$��R���.���4 � � I ] ` + ;*2I R ZZ � � �>4 �.1 � �����.1$�32 F�! � �-5*�>4: + I + /

� ] ���h=7: � �&���98��.1G] ��������(� / � 1$4�1$���(�>��!��(���d` � �1-�-4�� � 1���� !�� � - � 1�� � ` 4���8����5-"�"!�8�4�� � #3�1`..1$4 � � !��-'F. 8 � 1 � ��� �I/ Z �����+��«1���6�61��I29�� � � �$4"2�" #%$ ; ����� � &�� � %'& -( �����)(%& *��,.-0/ 132 47686%ª 2��1����8,'7� F9: E + ��0�> ����[@ % �­B � �� � &�� � ��/ -C@*�� % D ��&5������� 2..1�����-�:�I9:�HC:p; + /�I .�4&��� ����4 J �>4��(1��,2bF%=%=7:(/

: E =

Page 131: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� ] ��.h=7: � � �>�����>4�] ��.,'#1�1 / I � 1 � ��- � �6!�1$�*7>��4��-`�D�� �0#��(��� ���;.�4��7��0 -�0 4��(' �,���1.��.1�� � �����9�Ac98.1 `� ��� � -"/ [ 1��98 -&!>4&��. � /*9�� 1-�(�(1-5����X0 4��(' MTNON8P�QSROR<W�P7sb\pjTN^Y�\�i7|Vs Y)k�sOm#R<tT}O}C~�R8}8e9c,2F%=<=7:-/

� ] ] [�� =7: � [ �1-"��- ] ��-$D���� 2�9 ���.1 ]0� -S��1�� - D 1p��1 2 I*�����8��� [ �6!�1$�6� 2$] ��� � �� RB���*7���I2�1����9 �.1F' I*'.� � �?/ [ 8 � 8.1$�����Y�������.8�������� � !��('L'.� � '#��� � -"/ Z � �3���6���V23� � �I2$���,� � ��4"2" #%$ ; ����� � &�� � %'& -( �����)(%& * "�D � " ��,�-?/.1�47686%ª 2�������8 '#�+F<F��8;'��0�> ����A@ % �B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����- E ;<G H �8=7:-/�I7.�44�� �$��4 J ��4"�61�� 2hF%=<=9:(/

� ] ] R�=8F � �&���98��.1H] �������>�(�32Q9����.1H]0� -S��1�� - D 1p��1 2B1���� [@1$�PRB1-5,��?/ F�� � ���D!��('�.��1-4�i`� ��� � ��0E1�8 � ���� � �)! 1 � �� 2 �87�1�� � ���� 1���4"����'#��� � / Z � / %�� ��� � � �� " ���h@ ;��]" � £Db&4/ - �9� &�@ / � � 1 ��� ��%'& �_� � ��/ -C@*;&�� ( � D 132 � � 27..1�����-�GT: �VH7G<F E 2hF%=%=8F*/

� ] R I ? + +V� 9 ����1 ]0� -S��1�� - D 1p��1 2 R;� � RP�!����- � 2�9:'.� � I�1$�.1-� 2 1���� I � ��0 1�� ? ����0=/� -���8�� � �8�8' -L� - � ��'F-�/ Z �­�&� #�1$4��­�B�z� - 1���� �91 4��6��-����+9 ��1-'F-�2 ��,� � ��4�-"2�D ���� ������$# "�% � ;�� &�� � %'& -( �)(�%4; -�� & 2T������8,'7�.:�I<G%;V��0�> ����A@ % ��B � �� � &�� � ��/ -C@0�� %D ��&5������� /�I7.�4&�������4 J ��4"�61�� 2]: + +�+ /

� ] I � ;<F � ] ��-��)�(�@] 1-'�.���4 � 2 R;�(58��4 � ¥Z/ I+� ��- � 14D 281���� [ 1$4�-��.1 �(���:/ � ��1�-��F/b[���� 58�87 1��d`� �����?��������4�1$��-:.�4��(5��(�"'B/�" � £ 1 %&; � �"; ��;& � � ��� � / %��)(�%4;�/6/ &�� (�>I; � ( @ ; ( � �; �(# Db&9� �� / � � 132 / >0"�D<� 2��UK E M'� E ;8F H �8=9:(2]: + ;8F*/

� ]?� - + +�� 9 ����1 ]0� -S��1�� -$D 1p�F1*/ � -���8�� � �8�8' -S� - � �"'�-"/ [ 1�- � ��4 � - � ����-&��-"2 [ Z [12 �91-'k`5�4&��� ���F2 [ 1�-�-�1-!��98 -"� ��� -"2�: + + + /

� ]?� -)=8F � 9 ����1�]0�7-L�F1���-$D 1p�F1 / ���,� c98��F-&�����.1 � 8�4���- 1����­�$��44��@31-5��(�74�1������(' 0 8��,! � ��� ��-0 4��(' � ��� K �b` K�K �5-"��..1$4�1 � ��� �I/ Z � [ � � �l�$8�� �,2.���,� � ��4"2h" #%$ ; ����� � &�� � %�& -C� �����)(%&.* ��,.-0/.132 47686V4 2F] �"! � 8�4"�� U� � ��-V����3�('F.�8 � �>4 I*!��(�� !��-2�..1�����-�G + IpH�7:�F*/�I7.�4&��� ���>4 J ��4��(1��,2bF�=<=8F*/

� [ ��4 + = � R 1 ��.�� [ �>4$D5�(�F/�9 !>��4 � ��@��� � ���(� � 1$�C-4��� ��1 � 8�4"�-/ Z � e1�(�(����-�2 4�1�-�-�1$4��I2����,� � ��4"2" #%$ ; ����� � &�� � %'& -( �����)(%& * ��,.-?/.132 � �O� 2¬�1����8,'#��� E GG��0�> ����A@ % �§B � �� �&�� � ��/ -C@0�� %�D ��&5������� 2�.�1�����-�F9: ; H7F E ; /KI7.�44�� ���>4 J ��4"�61��62��>4��)��I20: + + = /

� [ �(� I%� � e1 4S�L]�/ [ ���(����4"/IRP���"'#1���� �- �8� .�� � ����-&��-�1���� � ��- � -30 ��4B.�4&�)',1 �6� � �-/�¤�� @ % � ;�� �_�� ��/ -C@*�� %@; �(# Db&9� �� /�D ��&5������� �O2]: E � E =<=�H E :�I*2C: + I%� /

� [ R + F � I*�(�!�8��� [ �6! 1 �6� 1���� � �,�(���6��.>R&���F1 #91p�(/ I+�"!�8�4��A!��-'F. 8 � 1 � ��� �I/ Z � ���F1���B.�"������d`5.1�8,'B25��,� � ��4�29" #%$ ; ����� � &�� � %'& -( �����)(%&<¨ ��,.-0/.132 � �8ª 28������8,'7��G<I%�M��0�> �����[@ % ��B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2�.�1�����- E + F H �8=�� /�I7.�44�� �$��4"2]: + + F*/

� [ R�=9: � I*�(�!�8��� [ �6!�1$�6�B1���� ] ��� �,��� R��z�87"���I/ I �18���������-�-T��� � ��� . 8 5��6�)!:`�D �z�G'�� ���>�3/Z � ���-��«1�(�)�61��?2���,� � ��4�29" #%$ ; ����� � &�� � %�& -( �����)(%& * ��,.-?/.132 47686%ª 2O�1����8,'#�F9: E + ��0?> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 2�..1�����-3G��OF H7G��8G*/�I7.�4&��� ���>4 J ��4(`�61�� 2hF%=<=9:(/

: E :

Page 132: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� [ R�=<F � I*�(�!�8��� [ �6!�1$�6�&1���� R&� ��1$��H]Q/ RP�!����- � / [ �6!>4��1.�1 �8'7�� � - 4��z�8��-&� � ��I/ Z � 291$4 �� 4��������� 2)��,� � ��4�2 / %�� �����$#�&�� (��=�_� ���� � %'& -( �)(�%4; -���� % � � 1 %4; � � ; +���� , D9"� � � � � % ������� 2��1����8,'7� F<F<IT:>��0�> ����[@ % �+B � �� � &�� � ��/ -C@0�� %§D ��&5������� 2C..1�����-: � + Hb: � E /KI7.�4&��� ���>4 J ��4��(1��,2bF�=<=8F*/

� [ R J + +�� I*�(�!�8��� [ �)! 1$�)�32 [ �6!��.1 ��� RB1-5,��?2.1���� I�1$�)�(� J 1����.1��I/ J �>4&��@.1-5��(�)4�1���� �-' 0 8��,! `� ��� � -"/ Z � / %�� ��� � 6 �� ���d�d� Db&4/ - �9� &�@ / � � � @0�(# ; '& � � � �_� � ��/ -C@*�� %�D ��&���������§�' 2 � D<� 2�..1��$��-�:�F%=�Hb: E = / Z ¥3¥d¥ �3�('�. 8 � ��4 I7�8!"��� � � � 4"��-�-�2¬: + + + /

�  �1�� + : � [ � �,�] �1��$4"/�2W� � !��('.'.� � '7�� � 8 -4�� �=.�-���8�� ��4�1���� �(' ����-�-"/^¤�� @ % � ;��7�_� � %�& -C� �����)(%& 2D�UK[F(M�� G9:�HC: G%; 2C: + + :(/

�  :R + I � [ � �,�� �1��$4�1���� F�'7��4:RB���� �1�$��I/� U8,'$58��4(` � ������4"� � �6!+!�� � - � 4�8 ! � ��� � -���02��� `!"���� � . -"��8�� �1` 4�1���� �(' 0 8��,! � ����� -"/ Z � / %�� ��� � � ��.�{�d�3� Db&4/ - �9� &�@ / � �+ � @0�h�# ; '& � � � �_� � ��/ -C@*�� %�D ��&5�������§�' 2 � D<� 2]: + + I*/

�  ���; +�� [ � �,�� �1���4�1���� [ � � ���$8�� �,/ ���,���$��4�-�1$��� ���:`3#91p� �.1�-"� 0 8��,! � ����� -�1���� � ���"��4!�4L�7. � �1��4�1�.��,�)!�1�.�.��6�)! 1 � ��� � -�/ Z � / %�� �����$#�&�� (����_� ���� 1�� ���� & �5 & %�� " ���h@ ;��" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%�&��_� � ��/ -C@*;&�� (-2D..1��$��- E(E H � E 2(I+� 1 ��� ���-2 ? 1�-��a`�� � � � �I2o:�G HC: I [ 1 ��: + ; + / 9�� [ /

� � I*]�;%= � [ 1$4�-��.1$�����:/ � � 1�-"�-2WR&�(58��4 � ¥Z/ I+� ��- � 14D 2 1����G] ��-"�6���T] 1-'F.���4 � /CRB��1-!��,��� �1���4"���"'7�� � ��� � ���@.�4���-����,!��V��0 0 1�8�� � -�/�¤ � @ % � ;��7�_� ���� " � £�2#F<I,KwF-M�� F<F%;�H7F E �,2: + ;<=*/

� � ? + � � 2W�(4��(� � � @ � 7�',1����#1���� [ �6!��.1 ��� ? 1-�������4�/ Z �70 ��4&'#1 � ��� �d` � ������4�� � �6!$. -"��8�� ��-&���1`�.1 � 8�4���-C1���� 58�87 1�� � ����<1���4��>�"'7�� � 0 ��4���� � ^�� E /j[ �"!���� �6! 1 �<R���.���4 � RB� `-���1$4&!���RB��.���4 � R � F%;<;<FBK�� + =<; E =(MO2 Z 2 [ R���-"� 1$44!�� K ���8��-&�����I2]: +�+ � /

� � ? =%= � 2W�(4��(� � � @ � 7�',1���� 1���� [ �6!��.1$�>� ? 1F������>4"/ �3�-'F.��1-&� � ��� � 1������� � ����44� � �.�4���-��>4S� 1 � ��� �Q��0;-"�"!�8�4��!4"� 1-! � ���$�>-S� - � �"'�-"/ Z � / %�� ��� � �� " � £ � � � � � % �������� � � ��/ -C@0�� %�; �(# � ��/6/ @*��&5� ; ;& � � �xD ����@ % &� & 2�..1��$��-�FO�OG H7F<GO�,/ 9�� [ .�4"��-�-�2� � � F%=<=%= /

� R 1-5hI +�� [ �6!���1$���@RB1-5,��?/ K ���-� � 1 �6�67>�� -4��� ��1 � 8�4"��- 1�-B�� � 4�1-! � 1-5��(� 1�-'0 1-! � ��44�67�1 � ��� �I/[@��!����,�)! 1$� RB��.���4 � [ Z [B/-]�� I�/1[%Rb`_F9:�F*2 [!Z [ ] 1-5���4�1 � ��4L�V0 ��4��3�('�. 8 � ��4 I8!"�i`��,!>�-2o��1��98.1$4L��: + I + /

� R 1-5#;<= � [ �6!���1$���F$/ RB1-5,���I/ � 4��(5.1-5,���6��- � �)!�1 ���1��44� � �,' 0 ��4 � ��- � �� �6.�44�6'#1$�6� � �(/�¤�� @ % � ;���_� B�@ / ��� % 1 ��� ��%'&F20: F9��: F%;�HC: E ; 2o: + ;<= /

� RB���7=9: � ] ��� �,��� R��z�87"���I/� � %�� � � � � � � �$# ( � � &��� / @�� � &5� �6� & �O/ � � K � ����-&��-"2 [ 1�-(`-�1-!��98 -"� ��� - Z ��- � � � 8 � �V��0H[ �"!���� �������%�(2C��8���� F%=%=7:(/

� R�« + +�� R 1���� �(' RP�)!��.1$4�� -�� � 1��������+� «1���6�61��I/ F�� � ���X!�� �,!�8�4�4���� � !��('�.���-&� � ��� �H��07��>4��-` D ��� #����� �$�G.�4�� ��0 -"/ Z � ��1-!Ac98���-"I � ��4��I2&��,� � ��4�2^" #%$ ; ����� � &�� � %'& -( ��� ��)(%& * ��� ,�2 ��,.-?/.1 � �8� 2�������8,'7��:�G + F ��0.> ����A@ % � B � �� � &�� � ��/ -C@0�� %D ��&5������� 2�..1�����- E :<:'H E F%� /KI7.�44�� ���>4 J ��4��(1��,2o: + + + /

: E F

Page 133: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� R&�(' + = � ��������R&�('�.8���3/!F����:`3#91p�G0 8�� ! � ��� � - 1$4�������!���-�-�1$4L� 1����H-�8��.!"���� � 0 ��4;-"�"!�8�4��-&��� �.1 � 8�4���-"/ Z � / %�� ��� 484 �(# " ���h@ ;��o" � £ Db&�/ - �9� &�@ / � � 1 ��� ��%'& �_� � ��/ �-C@*;&�� ( � D 132 � � 2�.�1�����- E ;<I H E + � 2 291$� � �)'F��4"�-2 [ 1$4L�+�(1����I2?: + + = /*9�� [ /

� R�I7;%� � [ �6!���1$���KFX/-R 1F5,��C1����§�$�\�*4����+F$/�I+��1$�(�)� � /8RB1���� �-'L�)7��� 1$���1�$4&� � �,'�- ��� �98,'k`5*�>4 � ������4S�-/ � ��/6/ @*��&5� ; ;& � � � &�� -C@ % � ; �(# ; -�- � &5�$# /.; ���� /.; '&5� �O2 E + � F E + HF<G%� 2]: + ;<� /

� R�I*9�I%; � R&���.1$��>]�/,R%������- � 2 9 � � I+�.1F'L��4"2-1����J] �����.1$4 �>9 �����"'#1��I/ 9 '7� � ��� �?0 �$43�(5d`� 1-���,����)�,���(� � 1$��-&�����.1 � 8�4���- 1����:. 8,5��6�6! `�D �z�1!>4S� . � ��-S� - � �"'�-"/ � ��/6/ @0��&5� ; ;& � � ��_� ���� " � £�2CF9: KwF(M'��:�F�=�HC:�F%�*2 B.�"5�4�8.1$4L��: + I�; /

� I*!�� + : � ���61�8�- � / I8!���� ��4"4"/�¥F�L!��(��� � -&��� �.1 � 8�4��&�������4�1 � ������0 ��4$-&'#1$4 � !�1$4 � -�/�¤�� @ % � ;���_� � %'& -( �����)(%& 2D�UK E M'� F E + H7F<G%F*2]: +�+ :(/

� I+�.1<; E � 9 �,��I+�.1-'.�(4�/ F�� � ���$�$����>4�1 � ��� ����08!>4S� . � ����4�1�.��,�6!�1$�(�!�K- � 4���� �;. -���8�� ��4�1���� �('-��Sc 8���,!>��-"/ Z ��" � £ 1 %4; � �"; ��'& � � � � � ��/ -C@*�� %�Db& � �� / �O2#�1����8,'7� :(2D..1�����-E ;�H ���,2]: + ; E /

� I+�.1<;8G � 9 �,��I+�.1F'L��4"/ Z ����� � � � �7` 5.1�-���� !�4L�7. � �1-L�7- � ��'F-!1���� -&��� �.1 � 8�4��'-&!����"'7��-"/ Z �e:����4��$��R;�(5*�>4 � 2��61�D5���z�71���� K 1p�8������.1�8,'B2����,� � ��4�-�2h" #%$ ; ����� � &�� � %'& -( ��� ��)(%&+* ��,�-?/.132 � � � 2T������8,'7��: + �E��0�> ����A@ % ��B � �� � &�� � ��/ -C@*�� %�D ��&5������� 2..1�����-;�OI H7G E /�I7.�44�� �$��4 J ��4"�61��,2o: + ;8G8/

� I*�(� ;<� � ���1-���.��6I8�(���$��44',1��?/ 1 ��� ;�% &��� / ��;&5� �_� � ��� &8-(;&5� ��@ % $�� /*I7.�44�� �$��4�` J ��4"�61��,28: + ;<� /� I7� �h=7: � K 1 #����:�61�� � � ��� I7� � �,/ � 4�1-! � �)! 1$��0 �$44#�1$4 ��-���!�8�4"�U��4��18 .6-&��� �.1 � 8�4��/-4!����"'7��-�/

Z � / %�� ��� � �� " � £ � � � � � % ������� � � � ��/ -C@0�� %+; �(# � ��/6/ @0��&5� ; '& � � ��D ����@T�% &� & 2D..1�����-�F<F<G H7F E �,/ 9�� [ .�4���-�-�2 �����¦F%=<=7:(/

� I � � + G � [ 1$4 D 8�-�I � 1����(�>4"2��$� 1��d` [ 1 4&! � �!��� � � 1�8?2 1���� ��1�� �91F'#���,��-4!��I/ B31-��4.5��6����-&��� �.1 � 8�4���-"/ Z �G] �18,��-��:/�e�8,�(�����18D1���� �$��1��d`L��1F!Ac98���-+y@8,��-�c98.1 � �>4"22�� � � �$4�-"2" #%$ ; ����� � &�� � %'& -( �����)(%& * ��� ,.2 ��,.-0/.1 � � � 2�������8 '#� + FT:I��0§> ����A@ % �B � �� � &�� � ��/ -C@0�� %�D ��&5������� 2 .�1�����-�F%= + H7F9: + /�I7.�44�� �$��4 J ��4"�61�� 2]: + + G*/

� Id[x=7: � 9 �,�0I-�.1-'.�(4 1������ 1$�>�7[�1�8,',1��I/ Z '�.�4�� �����:� ���6���� /����.�����C-&��� �.1 � 8�4��"-4!����"'7��-�/Z � ���-��«1�(�)�61��?2���,� � ��4�29" #%$ ; ����� � &�� � %�& -( �����)(%& * ��,.-?/.132 47686%ª 2O�1����8,'#�F9: E + ��0?> ����A@ % ��B � �� � &�� � ��/ -C@0�� %ED ��&5������� 2�..1�����- E G<G H E �8I*/�I7.�4&��� ���>4 J ��4(`�61�� 2hF%=<=9:(/

� I78�� � [ 1����98=I78��.1��I/X9����1��4&� � �,'.�6!A��� � 4�� � 8,! � ����� � �J!�� �,���� � ������4S�-/ [ Z [ !��18�4�-"�� 1�8���� � �� B 1$����F%=%=7:(/ ] �"! � 8�4"� � � � ��-1 � 1-���61-5��(�V0 4��('M9NON8PEQSRTRVN8M#W9k%sOr YSnT|Tl�YZ]\�N^Y_W<`<aCR Zhi<`8MOabR����#}b~�R*/

� [ ? ;8I � [ 1$4 � ��w[��('�..1 1���� �B� 1 � ����4 ? ���(� / R 1���� �(' -"����0 ` 4���� 8,!"�)5,�(�)� � �=1���� 7���4��D�� �0#��(������Z�� � �>4�1-! � �!���X.�4��7��0 -A��0 .��1-�-"��-�-&��������0 ����0 ��44',1 � ��� �?/ Z � 4 � �� " ���h@ ;��Db&4/ - �9� &�@ / � � � @*�(# ; ;& � � � �_� � ��/ -C@0�� % D ��&5������� 2&.�1�����-G�8I<F H �8;<F*2P]4��-9 � �$���(��-"2C�91$�)��0 ��4��,�61*2C: F HC: �)F�! � �(5*�>4�: + ;8I*/ Z ¥d¥3¥Z/

: E(E

Page 134: Signature Schemes and Applications to Cryptographic ...groups.csail.mit.edu/cis/theses/anna-phd.pdf · j kc=?

� J ��4{=9: � ¥E4&�6! J �>4�����8��3/.I-����0 ` 5��6�����.1-5��(�:!>4������� � �(1$� !��>4 � �E@ ! 1 � ��-&0 4��(' � ���A#����(�4..1-��4&��� �,/[ 1��98 -4!�4&��. � 2 � �,1�. .*��1$4Z��J9�I Z 9��<RA� � [�F%=%=7:(2oF%=<=7:-/

� � 1��8;8F � 9 ����4���#5�:/� 1��,/ [�������4L�#1�����1�. .��6�)! 1 � ��� ��-"��0 � 4�1�. � � ��4"0 8��,! � ��� ��-"/ Z � / %�� ���4O� % #��{�d�3� Db&4/ - �9� &�@ / � � � @0�(# ; '& � � �O�_� � ��/ -C@*�� %¦D ��&5������� �' 2 � D<� 2..1�����-�;<=�H + :-2]: + ;<F*/

� � 1��8;<� � 9 ����4���#¢�:/6� 1��,/��U�0# � �H������>4�1 � ��1����D��A*!��.1�� ���>-"�"!�4"� � -"/ Z � / %�� ��� 4 � �����d�d� Db&�/ - �9� &�@ / � � � @0�(# ; '& � � � �_� � ��/ -C@0�� %�D ��&5������� �' 2 � D<� 2 ..1�����-: �8F Hb: �8I*2o: + ;<� /

: E �