Undeniable signature is a special kind of digital signature with the characteristic .... mod N, then determines whether P knows the secret α by checking.
Threshold Undeniable RSA Signature Scheme
?
Guilin Wang1 , Sihan Qing1 , Mingsheng Wang1 , and Zhanfei Zhou2 1
Engineering Research Center for Information Security Technology; State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing 100080, P. R. China. {glwang, qsh, mshwang}@ercist.iscas.ac.cn http://www.ercist.ac.cn/ 2 Mathematics Department, College of Science and Technology, Nihon University, Tokyo 101-8308, Japan. {zhanfei zhou}@hotmail.com
Abstract. Undeniable signature has been extensively researched after Chaum and Antwerpen first proposed the concept of this special digital signature ten years ago. Up to now, however, almost all the existed schemes are based on discrete logarithm cryptosystems. In this paper, based on an improvement of the practical threshold RSA signature scheme proposed by Shoup at Eurocrypt’2000 and the first undeniable RSA signature scheme proposed by Gennaro, Krawczyk and Rabin at Crypto’97, we present the first, as we know, threshold undeniable RSA signature scheme. Our scheme is secure and robust since all the partial signatures are verifiable by adopting a discrete logarithm equality protocol proposed by Shoup.
1
Introduction
Undeniable signature is a special kind of digital signature with the characteristic that signature cannot be verified without the cooperation of the signer and cannot be denied by the signer if he has signed the signature indeed. (t, n) threshold signature is one kind of group-oriented signature, in which only the subsets with at least t members in a group U can generate a valid signature and any verifier can simply verify an alleged signature if he/she knows U ’s group public key. However, in a (t, n) threshold undeniable signature scheme, any subset of t members out of n, denoted by UB , can represent the group U to generate a signature, but without the cooperation of t members, a verifier cannot verify the validity of an alleged signature even if he knows U ’s group public key. At the same time, any subset of less than t members cannot generate, confirm or disavow a signature even if they cooperate maliciously. Generally speaking, a threshold undeniable signature scheme consists of the following three main sub-protocols. (1) Signing Protocol: t members in subset UB run this protocol to produce a valid signature for any message, but any attacker I cannot forge a valid ?
Supported by the National Key Basic Research Program of China (No. G1999035810) and the National Natural Science Foundation of China (No. 60083007).
signature of group U with non-negligent possibility unless I has corrupted at least t members or U ’s private signing key has been compromised to I (i.e., nonforgeability). (2) Confirmation Protocol: By running this protocol between prover UB , t members of U , and verifier V , V is convinced that an alleged signature is indeed signed by U . Confirmation protocol should satisfy the following three properties. – Completeness: A signature signed by group U will always be accepted by V if all the members in UB and V are honest (this means that they properly act as the protocol described). – Soundness: Even a cheating prover UB cannot convince the verifier V to accept an non-valid signature of U with non-negligent possibility. – Zero-knowledge: On input a message and its valid signature, any possible cheating verifier V interacting with a subset UB does not learn any information aside from the validity of the signature. (3) Denial Protocol: By running this protocol, prover UB ensures a verifier V that a signature is not signed by group U . Denial protocol also should satisfy the similar three properties as follows. – Completeness: A signature not signed by U will always pass through the denial protocol such that V believes that it is not U ’s signature if all the members in UB and V are honest. – Soundness: Even a cheating prover UB cannot successfully deny a valid signature of U with non-negligent possibility by running denial protocol. – Zero-knowledge: On input a message and a non-valid signature, any possible cheating verifier V interacting with a subset UB does not learn any information aside from the the fact that this non-valid signature is in fact not a valid signature of group U . Besides nonforgeability, a threshold undeniable signature should also be robust, meaning that corrupted members should not be able to prevent uncorrupted members from generating signatures. After Chaum and Antwerpen first proposed the conception of undeniable signature in [6], extensive researches are done to this special kind signature. Chaum [2] presented a zero-knowledge undeniable signature scheme with promising applications in copyright protection of electronic products. By combining the undeniable signature and group-oriented signature [7, 8], Harn and Yang [13] proposed the conception of (t, n) threshold undeniable signature, and presented two concrete schemes in respect of t = 1 and t = n. But Langford [14] pointed out that their (n, n) threshold undeniable signature scheme only possesses a security of 2-out-of-n, because any two adjacent members can generate a valid threshold signature. Lin etc. presented a general threshold undeniable signature scheme [16], but which is also subjected to Langford’s attack [14]. [15] generalized Chaum’s zero-knowledge undeniable signature [2] to a (t, n) threshold undeniable signature scheme with a dealer. However, unlike all the above schemes based
on discrete logarithm cryptosystems, Gennaro, Krawczyk and Rabin presented the first undeniable RSA signature scheme [12]. In this paper, we will construct the first, as we know, threshold undeniable RSA signature scheme with a dealer. Our Scheme are builded from an improvement to Shoup’s threshold signature scheme [20] and Gennaro etc.’s undeniable RSA signature scheme [12]. Our schemes are secure and robust because all the partial signatures are verifiable by adopting a discrete logarithm equality protocol proposed by Shoup [20]. The organization of this paper is as follows. Notations are described in § 2. Shoup’s discrete logarithm equality protocol [20] and Gennaro etc.’s undeniable RSA signature scheme are reviewed in § 3 and § 4 respectively. Then, we propose an improvement to Shoup’s threshold RSA signature and a newly threshold undeniable RSA signature scheme in § 5 and § 6 respectively. The last two sections are about some discussions and future work.
2
Notations
Our systems consist of a dealer D and a group U with n members Ui (i = 1, 2, · · · , n). Let t be the threshold value and B denote a subset of size t in the index set {1, 2, · · · , n}. The notation x ∈R X means that an element x is selected randomly and uniformly from set X. In this paper, the RSA modulus N is selected as the product of two large secure primes p and q, i.e. there exist two primes p0 , q 0 such that p = 2p0 + 1, q = 2p0 + 1 and N = pq. Let M = p0 q 0 , and L(N ) denote the bit-length of N . ∗ We denote by QN the subgroup of squares in ZN . For any integer x, let J (x|N ) denote the Jacobi symbol symbol of x respect to the base N . In addition, ∗ with J (x|N ) = 1. Then we we denote by JN the subgroup of elements x ∈ ZN ∗ know that QN ⊂ JN ⊂ ZN . Moreover, QN is cyclic of order M and JN is cyclic of order 2M .
3
Discrete Logarithm Equality Protocol
As a key of modern cryptography, knowledge proving plays an important role in constructing varied protocols and schemes. Among of them, the most extensively used knowledge proving protocols are based on discrete logarithm cryptosystems [3]. In this section, we briefly review a discrete logarithm equality protocol proposed by Shoup [20], which is an improvement to a well-known interactive protocol, due to Chaum and Pedersen [5]. ∗ . QN ’s order is not Let g1 , g2 are two generators of the subgroup QN of ZN known. The prover P possesses a secret number α ∈ ZM such that logg1 h1 = logg2 h2 = α, i.e. h1 = g1 α and h2 = g2 α . By running the following protocol between the prover P and the verifier V , P convinces V that he indeed pos¯ be a hash sesses the secret α but does not reveals which is it to V . Let H
function, whose output is an l1 -bit interger, where l1 is a second security parameter (l1 = 128, say). For convenience, we will simply denote this protocol as DLE(g1 , h1 ; g2 , h2 ; α). DLE(g1 , h1 ; g2 , h2 ; α) Protocol (1) P randomly selects w ∈R [0, · · · , 2L(N )+2l1 −1], computes a1 = g1w mod N, a2 = ¯ 1 ||g2 ||h1 ||h2 ||a1 ||a2 ) and r = αc + w. Then, P publishes g2w mod N, c = H(g 4
P roofP = (r, c) as the proof of knowing the secret α. (2) From the proof (r, c), V first computes a1 = g1r h−c 1 mod N and a2 = g2r h−c mod N , then determines whether P knows the secret α by checking 2 ¯ 1 ||g2 ||h1 ||h2 ||a1 ||a2 ). c ≡ H(g
4
Gennaro etc.’s Undeniable RSA Signature
In this section, we briefly review the first undeniable RSA signature scheme constructed by Gennaro etc. [12]. In their scheme, the signer publishes the RSA modulus and a sample signature but keeps the usual key pair secretly. The confirmation and denial of a signature are to check whether certain relations between the signature and the sample signature hold. Stage 1: Setting System Parameters If user P want to use this system, he first chooses two large secure primes p = 2p0 + 1 and q = 2q 0 + 1 and let the RSA modulus as N = pq. Then he chooses the key pair e, d ∈ [1, ϕ(N )−1] such that ed = 1 mod ϕ(N ). In addition, ∗ P selects an element w ∈ ZN of order at least p0 q 0 as the sample message and computes the sample signature Sw = wd mod N . At last, P publishes his public key information (N, w, Sw ) but keeps his private key information (e, d) secretly. Where, d is used to generate signature and e to verify signature. Furthermore, P chooses a secure parameter l (usually it can be set as 1024). Stage 2: Generation of Undeniable Signature As in regular RSA signature scheme, if user P want to sign a message m, he computes Sm = md mod N and publishes (m, Sm ) as his signature on message m. Stage 3: Confirmation Protocol A verifier V can not alone verify whether an alleged signature (m, Sm ) is signed by P , because V does not know P ’s verification key e (in fact, P does not publish this information at all). But V and P can run the following confirmation protocol to convince V that (m, Sm ) is P ’s signature on message m. (3-1) V randomly selects two numbers c1 , c2 ∈R [1, N ], computes the value c1 c2 C = Sm Sw mod N and sends it to P . (3-2) After received C, P computes and sends the value R = C e mod N to V .
(3-3) After received R, V check whether R ≡ mc1 wc2 mod N holds. If yes, then V accepts Sm as P ’s signature on message. Otherwise, V and P has to run the denial protocol to determine whether Sm is indeed not signed by P . Stage 4: Denial Protocol V and P can run the following denial protocol to convince V that Sm is not P ’s signature on message m. (4-1) V randomly selects two numbers c1 ∈R [1, l] and c2 ∈R [1, N ], sends c1 c2 C1 = mc1 wc2 mod N and C2 = Sm Sw mod N to P . (4-2) After received (C1 , C2 ), P searches all possible values in [1, l] to find a number r such that (m/Sm e )r = C1 /C2 e mod N . If such r was found, then P sends it V . (4-3) V checks whether r ≡ c1 . If yes, V convinces that Sm is not signed by P . Otherwise, V believes that P is trying to deny his own signature. [12] proved two theorems about the completeness, soundness and zero- knowledge of above confirmation protocol and denial protocol. Gennaro etc.’s theorems show that their scheme is secure. In practice, secure parameter l can be selected as a small number, but P and V can run denial protocol several times to guarantee security without loss efficiency. For example, let l = 1024 and running the denial protocol for ten times, then 1/2100 security level can be reached. In other words, the probability of occurring the following event is less than one in a million: V believes that Sm is not signed by P , but in fact Sm is P ’s signature on message m.
5
Improved Threshold RSA Signature Scheme
In this section, we present an improved threshold RSA signature to Shoup’s scheme [20], which has the same security level and is more efficient compared to Shoup’s scheme. Furthermore, it seems intractable to directly generalize Shoup’s scheme to undeniable environments, but our scheme can be generalized as a threshold undeniable signature if the methods used in [12] are adopted. In the essence, we simplify the signing equation of Shoup’s scheme. Now, we first describe our improved threshold signature scheme, then compare the security and efficiency between our scheme and Shoup’s. 5.1
Description of Threshold RSA Signature Scheme
The dealer D chooses a RSA modulus N as the product of two large secure primes described in section 2. The dealer D also chooses the RSA public exponent e as ∗ a prime such that n < e < min{p0 , q 0 }, and the secret exponent d ∈ ZM is the integer which satisfies de = 1 mod M . Stage 1. Distribution of Secrets
(1-1) The dealer D randomly selects a polynomial f (x) with order less than Pt−1 (t − 1). Let f (x) = j=0 aj xj ∈ ZM [x], where a0 = d and aj ∈R ZM (j = 1, 2, · · · , t − 1). (1-2) Dealer D computes di as follows and sends di to member Ui secretly: di = f (i)(n!)−1 mod M,
i = 1, 2, · · · , n.
(1)
For any index subset B with t elements, it is easy to see that these di satisfy the following equation according to the Lagrange interpolation formula: d=
X
di · λBi mod M,
where λBi =
i∈B
X j∈B\{i}
j · n! ∈ Z. j−i
(2)
(1-3) Dealer D randomly selects a generator v of QN and computes: vi = v di mod N ∈ QN ,
i = 1, 2, · · · , n.
∗ In addition, D chooses an element u ∈ ZN such that the Jacobi symbol of u is −1, i.e. J (u|N ) = −1. (1-4) D publishes or broadcasts N, e, n, u, v and all vi (i = 1, 2, · · · , n).
Stage 2. Generation and Verification of Partial Signatures If member Ui want to sign an original message m0 , then Ui first computes the digest m as H(m0 ), if J (H(m0 )|N ) = 1 m= . (3) H(m0 )u, if J (H(m0 )|N ) = −1 This forces that J (m|N ) = 1. Now, Ui computes his partial signature as follows: Si = m2di mod N.
(4)
Last, Ui runs the DLE(v, vi ; m2 , Si ; di ) protocol (where m2 is computed under mod N ) for constructing the proof P roofUi to show the validity of partial signature Si by revealing that logv vi = logm2 Si (= di ). Ui publishes or broadcasts (i, m, Si , P roofUi ) as his partial signature message. Stage 3. Generation and Verification of Threshold Signature If there is at least t honest members (i.e., they generated valid partial signatures), then by choosing any t honest members Ui (i ∈ B and |B| = t), each member can compute the threshold RSA signature S as follows: 4 Y S = Si 2λBi mod N (= m4d mod N ); (5) i∈B
A verifier can check the validity of a threshold signature (m0 , S) by the following equality S e ≡ m4 mod N. (6)
Of course, the m in above equality has been processed by the equation (3). We have accomplished the description of our improvement to Shoup’s scheme. The essential improvement is that Shoup’s signing equation, displayed by the following equation (7), is modified as equation (5) in our scheme. S¯ = S a mb mod N = m4ad+b mod N.
(7)
Where, a, b are two public integers such that 4a + eb = 1 since gcd(4, e) = 1, and S is determined by equation (5). 5.2
Discussions of Threshold RSA Signature Scheme
Now, we will briefly discuss the validity, security and efficiency of our scheme. Theorem 1. (Validity of the Scheme) If at least t honest members produced valid partial signatures and correct proofs, then the threshold signature determined by equation (5) satisfies the signature verification equation (6). Proof. According to (2), for index subset BP ⊆ {1, 2, · · · , n} with t elements we know that there exists an integer k such that i∈B (λBi ·di ) = d+kM . Therefore, from equation (5) and (4), we have P Q 4d λ S = i∈B Si 2λBi mod N = m i∈B i Bi mod N (8) = m4d+4kM mod N = m4d+kφ(N ) mod N = m4d mod N. On the other hand, ed = 1 mod M , so there exists an integer k¯ such that ¯ . Hence, ed = 1 + kM e
¯
S e = (m4d ) mod N = m4+4kM mod N = m4 mod N. So, the signature S on message m satisfies the verification equation (6).
(9) t u
Theorem 2. (Unforgeability of the Scheme) An attacker I can forge a valid signature to message m in our scheme if and only if he can forge a valid signature to the same message in Shoup’s scheme. Proof. If attacker I can forge a valid signature S to message m in our scheme such that S e = m4 mod N . Then, by using the public parameters a and b of Shoup’s scheme, attacker I can compute a value S¯ = S a mb mod N . Following reasonings show that S¯ is the valid signature to message m in Shoup’s scheme: ¯ e = (S a mb )e mod N = (S e )a mbe mod N (S) = m4a+eb mod N = m mod N. So attacker I has successfully forged the signature on message m in Shoup’s scheme. On the other hand, if attacker I can forge a valid signature S¯ to message m in Shoup’s scheme such that S¯e = m mod N . Then, let S = S¯4 mod N . We have S e = (S¯4 )e mod N = (S¯e )4 mod N = m4 mod N. Above equalities show that attacker I has successfully forged the signature S on message m in our scheme. t u
Furthermore, as Shoup did in [20], the following theorem holds. Theorem 3. (Security of the Scheme) In the random oracle model for hash ¯ our threshold signature scheme is secure (robust and non-forgeable) function H, assuming the standard RSA scheme is secure. In addition, comparing with Shoup’s scheme, our threshold signature scheme possesses several advantages as follows. – Simple Signing Equation. The signing equation in our scheme is S = m4d mod N , which is simpler than Shoup’s signing equation S¯ = S a mb mod N . In general, a and b are large integers, and one of them must be negative. Therefore, computing a signature in Shop’s scheme is lower than in our scheme. – Protecting the Modulus. Because one of the two parameters a and b is negative integer in Shoup’s scheme, one inverse, S −1 mod N or m−1 mod N , has to be computed before generating every threshold signature. Once the inverse element cannot be found (of course, this case occurs in a negligent possibility because factoring RSA modulus is difficult.), a factor of N has been found and this RSA cryptosystem is crashed then. Therefore, Shoup’s signing equation does a negative effect in protecting the RSA modulus N . But, our scheme is immune to this problem. – Scalability. Our scheme can be generalized to a threshold undeniable signature scheme (see section 5 of this paper), but Shoup’s scheme seems intractable to generalize to this case. – Public Exponent. In fact, the public exponent e in our scheme can be ∗ selected as any element of ZM , not necessarily a prime. In addition, in order to verify the honesty of the dealer D, verifiable secret sharing [17] or publicly verifiable secret sharing schemes [21, 18] can be introduced. But the discussion about these problems is out the scope of this paper.
6
Threshold Undeniable RSA Signature Scheme
In this section, we propose a threshold undeniable RSA signature scheme with fine properties. As we know, this is the first threshold undeniable signature scheme based on RSA cryptosystem so far. In our scheme, by using Shamir’s secret scheme [19], the dealer D distributes the RSA signing and verifying key pair (e, d) to all n members of group U , such that each subgroup of t honest members can generate undeniable RSA signature. At the same time, any t cooperative members can represent group U to confirming or disavowing an alleged signature. In addition, the honesty of each participating member is verifiable in all the three procedures of signature’s generation, confirming and denying. In the essence, this scheme is constructed by combining the Gennaro etc.’s undeniable RSA signature scheme in section 4 and the improved threshold RSA
signature scheme in section 5. But to many details, skillful processing are conceived to construct a secure and practical scheme. Now, we describe the scheme in detail. Stage 1: System Initialization After selecting a RSA modulus N as the form defined in section 2, the dealer D chooses the signing and verifying key pair as (e, d), such that ed = 1 mod M and e is a prime. Supposing n, the number of members in group U , satisfies n < min{p0 , q 0 }. In addition, let e¯ = e4−1 mod M . Stage 2: Distribution of Secrets (2-1) The dealer D chooses two random polynomials f (x), g(x) ∈ ZM [x], such that f (0) = d and g(0) = e¯. Then, D computes the sub-keys as follows. di = f (i)(n!)−1 mod M,
e¯i = g(i) · (n!)−1 mod M,
i = 1, 2, · · · , n.
Hence, to any subset B of size t in {1, 2, 3, · · · , n}, sub-keys di , e¯i satisfy the following properties (λBi displayed in (2)): X X d= di · λBi mod M, e¯ = e¯i · λBi mod M. (10) i∈B
i∈B
(2-2) The dealer D selects a random generator w of QN and computes: Sw = w4d mod N, Swi = w2di mod N,
Tw = w4¯e mod N. Twi = w2¯ei mod N,
i = 1, 2, · · · , n.
(11)
∗ such that it’s (2-3) The dealer D randomly chooses a fixed element u in ZN Jacobi value respect to N is −1, i.e.
J (u|N ) = −1,
∗ u ∈R ZN .
(12)
(2-4) The dealer D publishes N, n, u, w, Sw , Tw and Swi , Twi (i = 1, 2, · · · , n), but sends di and e¯i to Ui secretly. (2-5) Ui verifies the following equations: Swi ≡ w2di mod N, Q Sw ≡ j∈B Swj 2λBj mod N,
Twi ≡ w2¯ei mod N. Q Tw ≡ j∈B Twj 2λBj mod N.
(13)
Where, B can be any subset with t elements of {1, 2, · · · , n}. If finding any of the above equations does not hold, Ui proclaims this fact, then the dealer D is considered to be failed in distributing the secrets. Otherwise, the dealer is successful. Stage 3: Generation and Verification of Partial Signature (3-1) If the member Ui wants to sign the original message m0 , he first computes message digest m of m0 by using equation (3) such that we always have J (m|N ) = 1.
(3-2) Ui computes the partial signature of m as following: Smi = m2di mod N.
(14)
Then, Ui runs the DLE(w2 , Swi ; m2 , Smi ; di ) protocol (where, w2 and m2 all are computed in mod N ) and constructs the proof P roofUi to indicate that logw2 Swi = logm2 Smi (= di ). (3-3) Using P roofUi , any member can verify whether the partial signature Smi is signed by Ui . Stage 4: Generation of Threshold Undeniable Signature If there are t members Ui (i ∈ B and |B| = t) who have generated valid partial signatures, then the threshold undeniable signature Sm on message m can be computed by the following equation: Y Sm = Smi 2λBi mod N (= m4d mod N ). (15) i∈B
Stage 5: Confirmation Protocol After getting the consent of t members Ui (i ∈ B and |B| = t), V can run the following confirming protocol with these t members to check whether an alleged signature (m, Sm ) is signed by group U . (5-1) V selects two random numbers c1 , c2 ∈R [1, N ], computes the following challenger C and sends or broadcasts it to every member Ui (i ∈ B): c1 c2 Sw mod N. C = Sm
(16)
(5-2) After Ui received C, he computes his partial response Ri as: Ri = C 2¯ei mod N.
(17)
Using the protocol DLE(w2 , Twi ; C 2 , Ri ; e¯i ), Ui produces the proof P roofUi and broadcasts (Ri , P roofUi ). Obtained this information, each member can verify the validity of Ri . If all these t members have produced their correct partial responses Ri , then the response R can be determined by the following equation, and be sent to V : 4 Y 2λBi R= Ri mod N (= C 4¯e mod N ). (18) i∈B
(5-3) V verifies whether the following equality holds after he received R: R ≡ m4c1 w4c2 mod N.
(19)
If yes, then V accepts the signature (m, Sm ), i.e. he believes that Sm is U ’s valid signature on message m. Otherwise, the denial protocol has to be run to determine whether (m, Sm ) is not a signature of U .
Stage 6: Denial Protocol When t members Ui (i ∈ B and |B| = t) agree to deny an alleged signature (m, Sm ), V and Ui (i ∈ B) run the following denial protocol. (6-1) V selects two random numbers c1 ∈R [1, l], c2 ∈R [1, N ], then he computes (C1 , C2 ) as follows and sends or broadcasts them to every Ui (i ∈ B). C1 = mc1 wc2 mod N,
c1 c2 C2 = Sm Sw mod N.
(6-2) All Ui (i ∈ B) use their sub-keys e¯i to compute: Y Y (C2 2¯ei )2λBi mod N. Sm 4¯e = (Sm 2¯ei )2λBi mod N, C2 4¯e = i∈B
(20)
(21)
i∈B
Then they search all possible values in [1, l] to find a number r such that the following equation holds, and send this r to the verifier V : (m4 /Sm 4¯e )r = C14 /C2 4¯e mod N.
(22)
(6-3) V verifies whether r ≡ c1 . If yes, then V rejects the signature Sm , i.e. V believes that Sm is not group U ’s signature on message m. Otherwise, V considers that these members Ui (i ∈ B) is trying to deny U ’s threshold signature Sm deliberately.
7
Analysis of the Proposed Scheme
Now, we give a brief discussion about the validity and security of the above threshold undeniable RSA signature scheme. First, it is not difficult to verify the completeness of our scheme according to the descriptions, i.e. if all t members are honest and have produced valid partial signatures, then the determined threshold undeniable signature will pass through the confirmation protocol. Second, Shamir’s secret sharing scheme [19] is used to distributing secrets in our scheme, so it can be concluded that an attacker I cannot generate a valid threshold undeniable signature if the number of members controlled by I is less than t. Third, in all the three procedures of generation, confirmation and denial of undeniable signature, all the corrupted members will be identified, because each participating member has to run the DLE protocol for constructing necessary proof to indicate that they have operated properly in these three procedures. Last, from the security of Gennaro etc.’s scheme [12], one can conclude that each sub-key will not be compromised when each member uses it to confirm or deny undeniable signature. Hence, we have successfully proposed a secure, robust and efficient threshold undeniable signature scheme with a dealer.
8
Future Work
In the future research, we will consider to generalize our threshold undeniable RSA signature scheme to the distributing environment where there is no the help of a dealer or a trusted party. Some of relevant works have been done by Frankel, MacKenzie and Yung [11], Damg˚ ard and Koprowski [9].
References 1. J. Boyar, D. Chaum, I. Damg˚ ard, and T. Pedersen. Convertible Undeniable Signatures. In Crypto’90, LNCS 537, pp. 189-205. Springer-Verlag, 1991. 2. D. Chaum. Zero-Knowledge Undeniable Signatures. In: Eurocrypt’90, LNCS 473, pp. 458-464. Springer-Verlag, 1991. 3. J. Camenisch, and M. Michels. Proving in Zero-knowledge that a Number Is the Product of Two Safe Primes. In Eurocrypt’99, LNCS 1592, pp.107-122. SpringerVerlag, 1999. 4. D. Chaum, and T.P. Pedersen. Transferred Cash Grows in Size. In Eurocrypt’92, LNCS 658, pp. 390-407. Springer-Verlag, 1993. 5. D. Chaum, and T.P. Pedersen. Wallet Databases With Observers. In Crypto’92, LNCS 740, pp. 89-105. Springer-Verlag, 1993. 6. D. Chaum, and H. Van Antwerpen. Undeniable Signatures. In Crypto’89, LNCS 435, pp. 212-216. Springer-Verlag, 1989. 7. Y. Desmedt. Society and Group Oriented Cryptography: A New Concept. In Crypto’87, LNCS 293, pp. 120-127. Springer-Verlag, 1988. 8. Y. Desmedt, and Y. Frankel. Threshold Cryptosystems. In Crypto’89, LNCS 435, pp. 307-315. Springer-Verlag, 1990. 9. I. Damg˚ ard, and M. Koprowski. Practical Threshold RSA Signature Without a Trusted Dealer. In Eurocrypt 2001 (to appear). Available from http://www.daimi. au.dk/ ivan/papers.html 10. I. Damg˚ ard, and T. Pedersen. New Convertible Undeniable Signature Schemes. In Eurocrypt’96, LNCS 1070, pp. 372-386. Springer-Verlag, 1996. 11. Y. Frankel, P. D. MacKenzie, and M. Yung. Robust Efficient Distributed RSA-Key Generation. In 30th STOC, pp. 663-672. ACM, 1998. 12. R. Gennaro, H. Krawczyk, and T. Rabin. RSA-Based Undeniable Signature. In Crypto’97, pp. 132-148. Springer-Verlag, 1997. 13. L. Harn, and S. Yang. Group-Oriented Undeniable Signature Schemes without the Assistance of a Mutually Trusted Party. In Auscrypt’92, LNCS 718, pp. 133-142. Springer-Verlag, 1993. 14. S.K. Langford. Weakness in Some Threshold Cryptosystems. In Crypto’ 96, LNCS 1109, pp. 74-82. Springer-Verlag, 1996. 15. N.-Y. Lee, and T. Hwang. Group-Oriented Undeniable Signature Schemes with a Trusted Center. Computer Communications, 1999, 22: 730-734. 16. C.-H. Lin, C.-T. Wang, and C.-C. Chang. A Group-Oriented (t, n) Undeniable Signature Scheme without Trusted Center. In: Information Security and Privacy, ACISP’96, LNCS 1172, pp. 266-274. Springer-Verlag, 1996. 17. T.P. Pedersen. No-Interactive and Information-Theoretic Secure Verifiable Secret Sharing. In Crypto’91, LNCS 576, pp. 129-140. Springer-Verlag, 1992. 18. B. Schoenmakers. A Simple Publicly Verifiable Secret Sharing Scheme and Its Application to Electronic Voting. In Crypto’99, LNCS 1666, pp. 148-164. SpringerVerlag, 1999. 19. A. Shamir. How to Share a Secret. Communications of the ACM, 1979, 22(11): 612-613. 20. V. Shoup. Practical Threshold Signatures. In Eurocrypt’2000, LNCS 1807, pp. 207-220. Springer-Verlag, 2000. Avalaible from http://www.shoup.net/papers/ 21. M. Stadler. Publicly Verifiable Secret Sharing. In Eurocrypt’96, LNCS 1070, pp. 191-199. Springer-Verlag, 1996.
