**Adaptively Secure Fully Homomorphic Signatures Based on Lattices**

*Xavier Boyen and Xiong Fan and Elaine Shi*

**Abstract: **In a homomorphic signature scheme, given the public key and a vector of signatures $\vec{\sigma}:= (\sigma_1, \ldots, \sigma_l)$ over $l$ messages $\vec{\mu}:= (\mu_1, \ldots, \mu_l)$, there exists an efficient algorithm to produce a signature $\sigma'$ for $\mu = f(\vec{\mu})$. Given the tuple $(\sigma', \mu, f)$, anyone can then publicly verify the validity of the signature $\sigma'$.

Inspired by the recent (selectively secure) key-homomorphic functional encryption for circuits, recent works propose fully homomorphic signature schemes in the selective security model. However, in order to gain adaptive security, one must rely on generic complexity leveraging, which is not only very inefficient but also leads to reductions that are ``unfalsifiable''.

In this paper, we construct the first \emph{adaptively secure} homomorphic signature scheme that can evaluate any circuit over signed data. For {\it poly-logarithmic depth} circuits, our scheme achieves adaptive security under the standard {\it Small Integer Solution} (SIS) assumption. For {\it polynomial depth} circuits, the security of our scheme relies on sub-exponential SIS --- but unlike complexity leveraging, the security loss in our reduction depends only on circuit depth and on neither message length nor dataset size.

**Category / Keywords: **

**Date: **received 6 Nov 2014, last revised 14 Nov 2015

**Contact author: **xfan at cs umd edu

**Available format(s): **PDF | BibTeX Citation

**Note: **This paper is currently under submission to a conference. This work is subsequent to the the recent works by Gorbunov et al. (2014/463) and Wichs (2014/451), but concurrent with the more recent work by Gorbunov et al. (2014/897).

**Version: **20151114:143229 (All versions of this report)

**Short URL: **ia.cr/2014/916

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]