Besides enjoying short signatures, our scheme is fully re-randomizable which is a useful property for many applications. Our result also constitutes a proof that the impossibility of unilateral structure-preserving signatures in the Type-III setting result of Abe et al.~(Crypto 2011) does not apply to constructions in which the message space is dual in both source groups. Besides checking the well-formedness of the message, verifying a signature in our scheme requires checking $2$ Pairing Product Equations (PPE) and require the evaluation of only $5$ pairings in total which matches the best existing scheme and outperforms many other existing ones. Reducing the number of pairings in the verification equations is very important when combining structure-preserving signature schemes with Groth-Sahai proofs as the number of pairings required for verifying Groth-Sahai proofs for PPE equations grows linearly with the number of pairing monomials in the source equations.
We give some examples of how using our new scheme instead of existing ones improves the efficiency of some existing cryptographic protocols such as direct anonymous attestation and group signature related constructions.Category / Keywords: public-key cryptography / Original Publication (with major differences): CT-RSA 2016 Date: received 4 Oct 2015, last revised 25 Nov 2015 Contact author: e ghadafi at ucl ac uk Available format(s): PDF | BibTeX Citation Version: 20151125:170945 (All versions of this report) Short URL: ia.cr/2015/961 Discussion forum: Show discussion | Start new discussion