TY - GEN

T1 - Matrioska: A Compiler for Multi-key Homomorphic Signatures

AU - Fiore, Dario

AU - Pagnin, Elena

PY - 2018

Y1 - 2018

N2 - Multi-Key Homomorphic Signatures (MK-HS) enable clients in a system to sign and upload messages to an untrusted server. At any later point in time, the server can perform a computation C on data provided by t different clients, and return the output y and a short signature σC,y vouching for the correctness of y as the output of the function C on the signed data. Interestingly, MK-HS enable verifiers to check the validity of the signature using solely the public keys of the signers whose messages were used in the computation. Moreover, the signatures σC,y are succinct, namely their size depends at most linearly in the number of clients, and only logarithmically in the total number of inputs of C . Existing MK-HS are constructed based either on standard assumptions over lattices (Fiore et al. ASIACRYPT’16), or on non-falsifiable assumptions (SNARKs) (Lai et al., ePrint’16). In this paper, we investigate connections between single-key and multi-key homomorphic signatures. We propose a generic compiler, called Matrioska, which turns any (sufficiently expressive) single-key homomorphic signature scheme into a multi-key scheme. Matrioska establishes a formal connection between these two primitives and is the first alternative to the only known construction under standard falsifiable assumptions. Our result relies on a novel technique that exploits the homomorphic property of a single-key HS scheme to compress an arbitrary number of signatures from t different users into only t signatures.

AB - Multi-Key Homomorphic Signatures (MK-HS) enable clients in a system to sign and upload messages to an untrusted server. At any later point in time, the server can perform a computation C on data provided by t different clients, and return the output y and a short signature σC,y vouching for the correctness of y as the output of the function C on the signed data. Interestingly, MK-HS enable verifiers to check the validity of the signature using solely the public keys of the signers whose messages were used in the computation. Moreover, the signatures σC,y are succinct, namely their size depends at most linearly in the number of clients, and only logarithmically in the total number of inputs of C . Existing MK-HS are constructed based either on standard assumptions over lattices (Fiore et al. ASIACRYPT’16), or on non-falsifiable assumptions (SNARKs) (Lai et al., ePrint’16). In this paper, we investigate connections between single-key and multi-key homomorphic signatures. We propose a generic compiler, called Matrioska, which turns any (sufficiently expressive) single-key homomorphic signature scheme into a multi-key scheme. Matrioska establishes a formal connection between these two primitives and is the first alternative to the only known construction under standard falsifiable assumptions. Our result relies on a novel technique that exploits the homomorphic property of a single-key HS scheme to compress an arbitrary number of signatures from t different users into only t signatures.

U2 - 10.1007/978-3-319-98113-0_3

DO - 10.1007/978-3-319-98113-0_3

M3 - Paper in conference proceeding

SN - 978-3-319-98112-3

T3 - Lecture Notes in Computer Science

SP - 43

EP - 62

BT - Security and Cryptography for Networks

A2 - Catalano, Dario

A2 - De Prisco, Roberto

PB - Springer

T2 - 11th International Conference on Security and Cryptography for Networks, SNC 2018

Y2 - 5 September 2018 through 7 September 2018

ER -