Paper 2006/184

On Signatures of Knowledge

Melissa Chase and Anna Lysyanskaya


In a traditional signature scheme, a signature $\sigma$ on a message $m$ is issued under a public key $\pk$, and can be interpreted as follows: "The owner of the public key $\pk$ and its corresponding secret key has signed message $m$." In this paper we consider schemes that allow one to issue signatures on behalf of any NP statement, that can be interpreted as follows: "A person in possession of a witness $w$ to the statement that $x \in L$ has signed message $m$." We refer to such schemes as \emph{signatures of knowledge}. We formally define the notion of a signature of knowledge. We begin by extending the traditional definition of digital signature schemes, captured by Canetti's ideal signing functionality, to the case of signatures of knowledge. We then give an alternative definition in terms of games that also seems to capture the necessary properties one may expect from a signature of knowledge. We then gain additional confidence in our two definitions by proving them equivalent. We construct signatures of knowledge under standard complexity assumptions in the common-random-string model. We then extend our definition to allow signatures of knowledge to be \emph{nested} i.e., a signature of knowledge (or another accepting input to a UC-realizable ideal functionality) can itself serve as a witness for another signature of knowledge. Thus, as a corollary, we obtain the first \emph{delegatable} anonymous credential system, i.e., a system in which one can use one's anonymous credentials as a secret key for issuing anonymous credentials to others.

Available format(s)
Publication info
Published elsewhere. this is the full version of a paper which will appear in CRYPTO 06
signature schemesNIZKproof of knowledgeUCanonymous
Contact author(s)
mchase @ cs brown edu
2006-08-08: revised
2006-06-02: received
See all versions
Short URL
Creative Commons Attribution


      author = {Melissa Chase and Anna Lysyanskaya},
      title = {On Signatures of Knowledge},
      howpublished = {Cryptology ePrint Archive, Paper 2006/184},
      year = {2006},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.