Eikoh Chida

A CDH-based Ordered Multisignature Scheme Provably Secure without Random Oracles

Ordered multisignature scheme is a signature scheme to guarantee both validity of an electronic document and its signing order. Although the security of most of such schemes has been proven in the random oracle model, the difficulty of implementation of the random oracle implies that the security should be proven without random oracles, i.e., in the standard model. A straightforward way to construct such schemes in the standard model is to apply aggre- gate signature schemes. However, the existing schemes based on the CDH problem are inefficient in the sense that the number of computations of the bilinear maps and the length of public keys depend upon the length of (a hash value of) the message. Therefore, in this paper, we propose a CDH-based ordered multisignature scheme which is provably secure in the standard model under a moderate attack model. Its computational cost for the bilinear maps and the size of public key are independent of the length of (a hash value of) the message. More specifically, in comparison with the existing schemes, the public key length is reduced to three group elements from 512 group elements while the computational cost is reduced to 0.85msec from 1.6msec.

A structured aggregate signature scheme

In multisignature scheme, verifiying the signing order is sometimes very important. A multisignature scheme in which generated signatures reflect the structure of signers, e.g. signing order, is called structured multisignature scheme and many such schemes have been proposed so far. Structured multisignature schemes are dedicated to represent not only serial/parallel signer structures but also mixture of serial and parallel signer structures. In most structured schemes, the signature size depends on the number of signers. There are some structured schemes which can generate fixed-size signatures, but these schemes do not have order-flexibility, i.e. public keys arranged for one signer structure cannot be used for other signer structure. On the other hand, a sequential multisignature scheme is one type of structured multisignature schemes, which is dedicated to represent the serial signer structure. Some sequential multisig-nature scheme like sequential aggregate signature schemes can generate fixed-size signatures and have order-flexibility but no structured aggregate signature scheme has been proposed so far. In this paper, we construct a structured aggregate scheme which provides order-flexiblity, the fixed-size signature and applicability to mixed signer structures by extending the sequential aggregate signature scheme by Boldyreva et al.

Spending Offline Divisible Coins with Combining Capability

In the purchase with electronic money customers are sometimes required to spend multiple electronic coins at a time. In case of physical coins a customer simply grabs multiple coins and hands them out to a merchant. Likewise, the customer spends multiple electronic coins just by giving all coins to the merchant. However, we can expect one step further in the electronic coins. There is room to create a combined coin from multiple coins. If the combining leads to an efficient spending, the customer as well as the merchant and the bank can get benefit of the reduction of cost. There is a proposal by Chaum for the combining operation in the online cash, but no method has been proposed for offline coins up to now. Thus we seek a way to spend offline electronic coins in a combined form without assistance of an issuing bank. The combining reduces either computational complexity associated with the spending or communication complexity between the customer and the merchant. We propose a method to achieve combining capability in the Eng-Okamoto offline divisible electronic cash, and show that (2n - 2)|p| - (n - 1)|q| bits of the message length can be reduced in the combining of n coins under the parameter of moduli p and q satisfying q|p-1. If preliminary computation is allowed, the verification cost is also slightly reduced. Significantly, even after combining coins, the bank can identify overspenders.