Paper 2001/060

The Security of Practical Two-Party RSA Signature Schemes

Mihir Bellare and Ravi Sandhu


In a two-party RSA signature scheme, a client and server, each holding a share of an RSA decryption exponent $d$, collaborate to compute an RSA signature under the corresponding public key $N,e$ known to both. This primitive is of growing interest in the domain of server-aided password-based security, where the client's share of $d$ is based on its password. To minimize cost, designers are looking at very simple, practical protocols based on the early ideas of Boyd, but their security is unclear. We analyze a class of these protocols. We suggest two notions of security for two-party signature schemes and provide proofs of security for the schemes in our class based on assumptions about RSA and the hash function underlying the scheme.

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. Unknown where it was published
SignaturesRSAmulti-party computation
Contact author(s)
mihir @ cs ucsd edu
2002-06-10: last of 2 revisions
2001-07-29: received
See all versions
Short URL
Creative Commons Attribution


      author = {Mihir Bellare and Ravi Sandhu},
      title = {The Security of Practical Two-Party RSA Signature Schemes},
      howpublished = {Cryptology ePrint Archive, Paper 2001/060},
      year = {2001},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.