Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2605.03230

SILMARILS: Information-Theoretic and Quantum-Secure Designated-Verifier Signatures

Hassan Khodaiemehr, Khadijeh Bagheri, Chen Feng, Dariia Porechna

Published May 4, 2026• 0 citations
arXivHTMLPDF

Abstract

SILMARILS is built from a minimal algebraic core over $\mathbb{F}_p$ using true randomness and perfect $2$-out-of-$2$ Shamir secret sharing. The framework supports both two-party and three-party modes. In the two-party setting, SILMARILS realizes a transferable designated-verifier (TDV) signature scheme. The designated verifier can simulate accepting transcripts indistinguishable from real ones, achieving Jakobsson-Sako-Impagliazzo DV security. The verifier may publish a receipt $r$ enabling public verification, yet even with $r$, no external party can tell whether a transcript was signed or simulated. As DV signatures permit simulation, standard EUF-CMA cannot hold for the designated verifier; instead, we prove $\mathsf{EUF\text{-}CMA}^{\neg\mathsf{DV}}$ security for all non-designated verifiers in both the random oracle model (ROM) and quantum random oracle model (QROM). In the three-party mode, adopting the broadcast model of Fitzi et al., we obtain a statistically secure signature protocol with simulation-based security and error $1/p$. We analyze security in the Pure IT model, the IT+ROM, and the QROM, extending the Fitzi et al. framework to quantum adversaries with classical I/O. Correctness, secrecy, transferability, and unforgeability for non-designated parties remain equivalent to simulation-based security. Thanks to its simple algebraic structure, SILMARILS offers very compact keys and signatures for the blockchain settings we target, where standardized PQC schemes are already more than sufficient. Our goal is not to compare SILMARILS with PQC, but to highlight its suitability for lightweight TDV authentication. A fair comparison with other DV schemes is omitted due to space and the complexity of aligning models.

DOI
10.48550/arxiv.2605.03230

Related papers

SILMARILS-MV: Information-Theoretically Secure Multi-Verifier Signatures with Dealer-Free Key Issuance and Linear Aggregation for Permissioned Blockchains

Khadijeh Bagheri, Hassan Khodaiemehr, Chen Feng

Permissioned blockchains authenticate transactions, votes and quorum certificates with computationally secure signatures, and post-quantum replacements inflate consensus traffic by orders of magnitude. Information-theoretic alternatives have required a trusted authority, quantum channels, per-signature interaction, or single-use keys with bounded transfer. We present SILMARILS-MV, a multi-verifier unconditionally secure signature in which a signature is the vector $α= A\,e(m)$ and each verifier holds a secret functional $c_i = Γ^T λ(x_i)$ derived from virtual anchors $Γ$ that nobody learns. Against unbounded adversaries corrupting up to $ω$ verifiers and any signers, and observing every decision, an honest verifier accepts a forged or invalid signature with probability at most $Q/q + 1/(q-1)$, a bound that is tight in its leading term. The scheme is strongly unforgeable, non-repudiable, transferable across unboundedly many hops, and linearly aggregatable. Keys are issued by the validators through perfectly secure MPC for $t < n/3$, without broadcast. To scale, we let the committee itself sign: in threshold notarization, finality certificates have constant size $32(ω+1)$ bytes and per-validator issuance cost no longer depends on $n$. Arbiter-verified keys give clients 32-byte signatures, robust redistribution supports membership changes and share refresh, and verifiers can be enrolled retroactively. A certificate verifies in 2.4 microseconds. In an analytic normal-case model at 1000 validators, threshold notarization needs 71 KiB of authentication traffic per validator per block, 22x less than ML-DSA-44 for admitted verifiers. In a Rust HotStuff prototype with 100 validators, SILMARILS-MV commits 2.8x more transactions per second than ML-DSA-44 with 67x less cryptographic CPU, and Monte-Carlo attacks match the bounds.

cs.CRCross-listedarXiv:2610.31814•Oct 26, 2026

A Hash-Based Quantum-Resistant Designated Verifier Signature Scheme

P. Thanalakshmi, R. Anitha, Neelamegam Anbazhagan +3 more

Digital signatures are unsuitable for specific applications that are sensitive on a personal or commercial level because they are universally verifiable. Jakobsson et al. proposed the Designated Verifier Signature (DVS) system, which only allows the intended verifier to validate a message’s signature. It prohibits the disclosure of a conviction to a third party. This functionality is useful in applications that require both authenticity and signer privacy, such as electronic voting and tender calls. The vast majority of current DVS schemes are based on difficult number theory problems such as integer factorization or discrete log problems over various groups. The development of a large-scale quantum computer would render these schemes unsafe. As a result, it is critical to develop quantum-resistant DVS methods. In both quantum and classical computers, signatures based on one-way functions are more efficient and secure. They have several advantages over digital signatures based on trapdoor functions. As a result, hash-based signatures are now considered viable alternatives to number-theoretic signatures. Existing hash-based signatures, on the other hand, are easily verifiable by anyone. As a result, they do not protect the signer’s identity. In addition, they are one-time signatures. This paper presents a hash-based multi-time designated verifier signature scheme that ensures signer anonymity. The unforgeability of the signature scheme is also tested in the random oracle model under chosen message attack. The properties such as non-transferability and non-delegatability are investigated.

Mathematics•May 11, 2022•12 citations

LaSDVS : A Post-Quantum Secure Compact Strong-Designated Verifier Signature

S. Poddar, Sweta Mishra, Tapaswini Mohanty +2 more

Digital signatures are fundamental cryptographic primitives that ensure the authenticity and integrity of digital communication. However, in scenarios involving sensitive interactions -- such as e-voting or e-cash -- there is a growing need for more controlled signing mechanisms. Strong-Designated Verifier Signature (SDVS) offers such control by allowing the signer to specify and restrict the verifier of a signature. The existing state-of-the-art SDVS are mostly based on number-theoretic hardness assumptions. Thus, they are not secure against quantum attacks. Moreover, Post-Quantum Cryptography (PQC)-based SDVS are inefficient and have large key and signature sizes. In this work, we address these challenges and propose an efficient post-quantum SDVS (namely, LaSDVS) based on ideal lattices under the hardness assumptions of the Ring-SIS and Ring-LWE problems. LaSDVS achieves advanced security properties including strong unforgeability under chosen-message attacks, non-transferability, non-delegatability, and signer anonymity. By employing the algebraic structure of rings and the gadget trapdoor mechanism of Micciancio et al., we design LaSDVS to minimize computational overhead and significantly reduce key and signature sizes. Notably, our scheme achieves a compact signature size of $\mathcal{O}(n\log q)$, compared to $\mathcal{O}(n^2)$ size, where $n$ is the security parameter, in the existing state-of-the-art PQC designs. To the best of our knowledge, LaSDVS offers the \textit{smallest private key and signature size} among the existing PQC-based SDVS schemes.

arXiv:2504.16571•Apr 23, 2025•0 citations

Quantum Designated Verifier Signature Scheme with Semi-Trusted Third-Party

Ling Zhang, Jiahao Zhang, Xin Xiang-jun +1 more

Abstract Designated verifier signature (DVS) schemes can be applied in many scenes, such as E-voting and E-bidding use DVS attributes to protect the secret of participants. Most traditional DVS schemes are vulnerable to quantum computer attacks. Then, an identity-based semi-trusted third-party quantum DVS (STQDVS) scheme is proposed, which is safe for quantum means of attack. In new STQDVS scheme, the third participant prepares entangled Bell states and allocates them to the signer and the designated verifier (DV). The signer uses the identity information as her public key and the measurement results of corresponding quantum sequences as her private key to generate the signature. The DV applies the identity information as his public key and the measurement results of corresponding quantum sequences as her private key to verify the signature. Non-transferability and hidden origin are guaranteed by the fact that the DV can generate the same signature as the signatory by means of a simulated signature step. Security analysis has shown that attacks such as forgery, inter-resending, and impersonation are ineffective for the proposed scheme and that even third-party cannot forge signatures. On the other hand, the whole process of the scheme does not require any quantum key distribution protocols, quantum one-way functions, and quantum state exchange tests, which makes the STQDVS scheme relatively simple and more efficient than similar schemes.

•Jun 5, 2023•0 citations

A quantum designated multi-verifiers signature scheme based on LIOP states

Ling Zhang, Qi Gui, Xiangjun Xin +1 more

Based on a set of locally indistinguishable orthogonal product (LIOP) states, a quantum designated multi-verifier signature scheme (LIOP-QDMVS) is proposed. In this scheme, each verifier can independently verify partial signature without exchanging information with other verifiers. The protocol can address the issue of excessive power from individual verifiers, as the signature is accepted as valid only when all verifiers confirm its validity. Additionally, all designated verifiers can collaborate to simulate signatures from the signer, that achieve the non-transferability and source hiding of the protocol. Furthermore, the scheme does not require any third-party involvement, and no entangled states need to be prepared during signature generation. It is proven that the LIOP-QDMVS owns unforgeability, correctness, theoretical information security, and designated verifier properties, as well as it is resistant to replay attacks and impersonation attacks. Therefore, LIOP-QDMVS offers better security and efficiency.

Modern Physics Letters A•Aug 10, 2024•0 citations

K-Waay:Fast and Deniable Post-Quantum X3DH without Ring Signatures

Daniel Collins, Loïs Huguenin-Dumittan, Ngoc Khanh Nguyen +2 more

The Signal protocol and its X3DH key exchange core are regularly used by billions of people in applications like WhatsApp but are unfortunately not quantum-secure. Thus, designing an efficient and post-quantum secure X3DH alternative is paramount. Notably, X3DH supports asynchronicity, as parties can immediately derive keys after uploading them to a central server, and deniability, allowing parties to plausibly deny having completed key exchange. To satisfy these constraints, existing post-quantum X3DH proposals use ring signatures (or equivalently a form of designated-verifier signatures) to provide authentication without compromising deniability as regular signatures would. Existing ring signature schemes, however, have some drawbacks. Notably, they are not generally proven secure in the quantum random oracle model (QROM) and so the quantum security of parameters that are proposed is unclear and likely weaker than claimed. In addition, they are generally slower than standard primitives like KEMs. In this work, we propose an efficient, deniable and post-quantum X3DH-like protocol that we call K-Waay, that does not rely on ring signatures. At its core, K-Waay uses a split-KEM, a primitive introduced by Brendel et al. [SAC 2020], to provide Diffie-Hellman-like implicit authentication and secrecy guarantees. Along the way, we revisit the formalism of Brendel et al. and identify that additional security properties are required to prove a split-KEM-based protocol secure. We instantiate split-KEM by building a protocol based on the Frodo key exchange protocol relying on the plain LWE assumption: our proofs might be of independent interest as we show it satisfies our novel unforgeability and deniability security notions. Finally, we complement our theoretical results by thoroughly benchmarking both K-Waay and existing X3DH protocols. Our results show even when using plain LWE and a conservative choice of parameters that K-Waay is significantly faster than previous work.

•Aug 14, 2024•0 citations
SILMARILS is built from a minimal algebraic core over Fp\mathbb{F}_pFp​ using true randomness and perfect 222-out-of-222 Shamir secret sharing. The framework supports both two-party and three-party modes. In the two-party setting, SILMARILS realizes a transferable designated-verifier (TDV) signature scheme. The designated verifier can simulate accepting transcripts indistinguishable from real ones, achieving Jakobsson-Sako-Impagliazzo DV security. The verifier may publish a receipt rrr enabling public verification, yet even with rrr, no external party can tell whether a transcript was signed or simulated. As DV signatures permit simulation, standard EUF-CMA cannot hold for the designated verifier; instead, we prove EUF-CMA¬DV\mathsf{EUF\text{-}CMA}^{\neg\mathsf{DV}}EUF-CMA¬DV security for all non-designated verifiers in both the random oracle model (ROM) and quantum random oracle model (QROM). In the three-party mode, adopting the broadcast model of Fitzi et al., we obtain a statistically secure signature protocol with simulation-based security and error 1/p1/p1/p. We analyze security in the Pure IT model, the IT+ROM, and the QROM, extending the Fitzi et al. framework to quantum adversaries with classical I/O. Correctness, secrecy, transferability, and unforgeability for non-designated parties remain equivalent to simulation-based security. Thanks to its simple algebraic structure, SILMARILS offers very compact keys and signatures for the blockchain settings we target, where standardized PQC schemes are already more than sufficient. Our goal is not to compare SILMARILS with PQC, but to highlight its suitability for lightweight TDV authentication. A fair comparison with other DV schemes is omitted due to space and the complexity of aligning models.
Permissioned blockchains authenticate transactions, votes and quorum certificates with computationally secure signatures, and post-quantum replacements inflate consensus traffic by orders of magnitude. Information-theoretic alternatives have required a trusted authority, quantum channels, per-signature interaction, or single-use keys with bounded transfer. We present SILMARILS-MV, a multi-verifier unconditionally secure signature in which a signature is the vector α=A e(m)α= A\,e(m)α=Ae(m) and each verifier holds a secret functional ci=ΓTλ(xi)c_i = Γ^T λ(x_i)ci​=ΓTλ(xi​) derived from virtual anchors ΓΓΓ that nobody learns. Against unbounded adversaries corrupting up to ωωω verifiers and any signers, and observing every decision, an honest verifier accepts a forged or invalid signature with probability at most Q/q+1/(q−1)Q/q + 1/(q-1)Q/q+1/(q−1), a bound that is tight in its leading term. The scheme is strongly unforgeable, non-repudiable, transferable across unboundedly many hops, and linearly aggregatable. Keys are issued by the validators through perfectly secure MPC for t<n/3t < n/3t<n/3, without broadcast. To scale, we let the committee itself sign: in threshold notarization, finality certificates have constant size 32(ω+1)32(ω+1)32(ω+1) bytes and per-validator issuance cost no longer depends on nnn. Arbiter-verified keys give clients 32-byte signatures, robust redistribution supports membership changes and share refresh, and verifiers can be enrolled retroactively. A certificate verifies in 2.4 microseconds. In an analytic normal-case model at 1000 validators, threshold notarization needs 71 KiB of authentication traffic per validator per block, 22x less than ML-DSA-44 for admitted verifiers. In a Rust HotStuff prototype with 100 validators, SILMARILS-MV commits 2.8x more transactions per second than ML-DSA-44 with 67x less cryptographic CPU, and Monte-Carlo attacks match the bounds.
Digital signatures are unsuitable for specific applications that are sensitive on a personal or commercial level because they are universally verifiable. Jakobsson et al. proposed the Designated Verifier Signature (DVS) system, which only allows the intended verifier to validate a message’s signature. It prohibits the disclosure of a conviction to a third party. This functionality is useful in applications that require both authenticity and signer privacy, such as electronic voting and tender calls. The vast majority of current DVS schemes are based on difficult number theory problems such as integer factorization or discrete log problems over various groups. The development of a large-scale quantum computer would render these schemes unsafe. As a result, it is critical to develop quantum-resistant DVS methods. In both quantum and classical computers, signatures based on one-way functions are more efficient and secure. They have several advantages over digital signatures based on trapdoor functions. As a result, hash-based signatures are now considered viable alternatives to number-theoretic signatures. Existing hash-based signatures, on the other hand, are easily verifiable by anyone. As a result, they do not protect the signer’s identity. In addition, they are one-time signatures. This paper presents a hash-based multi-time designated verifier signature scheme that ensures signer anonymity. The unforgeability of the signature scheme is also tested in the random oracle model under chosen message attack. The properties such as non-transferability and non-delegatability are investigated.
Digital signatures are fundamental cryptographic primitives that ensure the authenticity and integrity of digital communication. However, in scenarios involving sensitive interactions -- such as e-voting or e-cash -- there is a growing need for more controlled signing mechanisms. Strong-Designated Verifier Signature (SDVS) offers such control by allowing the signer to specify and restrict the verifier of a signature. The existing state-of-the-art SDVS are mostly based on number-theoretic hardness assumptions. Thus, they are not secure against quantum attacks. Moreover, Post-Quantum Cryptography (PQC)-based SDVS are inefficient and have large key and signature sizes. In this work, we address these challenges and propose an efficient post-quantum SDVS (namely, LaSDVS) based on ideal lattices under the hardness assumptions of the Ring-SIS and Ring-LWE problems. LaSDVS achieves advanced security properties including strong unforgeability under chosen-message attacks, non-transferability, non-delegatability, and signer anonymity. By employing the algebraic structure of rings and the gadget trapdoor mechanism of Micciancio et al., we design LaSDVS to minimize computational overhead and significantly reduce key and signature sizes. Notably, our scheme achieves a compact signature size of O(nlog⁡q)\mathcal{O}(n\log q)O(nlogq), compared to O(n2)\mathcal{O}(n^2)O(n2) size, where nnn is the security parameter, in the existing state-of-the-art PQC designs. To the best of our knowledge, LaSDVS offers the \textit{smallest private key and signature size} among the existing PQC-based SDVS schemes.
Abstract Designated verifier signature (DVS) schemes can be applied in many scenes, such as E-voting and E-bidding use DVS attributes to protect the secret of participants. Most traditional DVS schemes are vulnerable to quantum computer attacks. Then, an identity-based semi-trusted third-party quantum DVS (STQDVS) scheme is proposed, which is safe for quantum means of attack. In new STQDVS scheme, the third participant prepares entangled Bell states and allocates them to the signer and the designated verifier (DV). The signer uses the identity information as her public key and the measurement results of corresponding quantum sequences as her private key to generate the signature. The DV applies the identity information as his public key and the measurement results of corresponding quantum sequences as her private key to verify the signature. Non-transferability and hidden origin are guaranteed by the fact that the DV can generate the same signature as the signatory by means of a simulated signature step. Security analysis has shown that attacks such as forgery, inter-resending, and impersonation are ineffective for the proposed scheme and that even third-party cannot forge signatures. On the other hand, the whole process of the scheme does not require any quantum key distribution protocols, quantum one-way functions, and quantum state exchange tests, which makes the STQDVS scheme relatively simple and more efficient than similar schemes.
Based on a set of locally indistinguishable orthogonal product (LIOP) states, a quantum designated multi-verifier signature scheme (LIOP-QDMVS) is proposed. In this scheme, each verifier can independently verify partial signature without exchanging information with other verifiers. The protocol can address the issue of excessive power from individual verifiers, as the signature is accepted as valid only when all verifiers confirm its validity. Additionally, all designated verifiers can collaborate to simulate signatures from the signer, that achieve the non-transferability and source hiding of the protocol. Furthermore, the scheme does not require any third-party involvement, and no entangled states need to be prepared during signature generation. It is proven that the LIOP-QDMVS owns unforgeability, correctness, theoretical information security, and designated verifier properties, as well as it is resistant to replay attacks and impersonation attacks. Therefore, LIOP-QDMVS offers better security and efficiency.
The Signal protocol and its X3DH key exchange core are regularly used by billions of people in applications like WhatsApp but are unfortunately not quantum-secure. Thus, designing an efficient and post-quantum secure X3DH alternative is paramount. Notably, X3DH supports asynchronicity, as parties can immediately derive keys after uploading them to a central server, and deniability, allowing parties to plausibly deny having completed key exchange. To satisfy these constraints, existing post-quantum X3DH proposals use ring signatures (or equivalently a form of designated-verifier signatures) to provide authentication without compromising deniability as regular signatures would. Existing ring signature schemes, however, have some drawbacks. Notably, they are not generally proven secure in the quantum random oracle model (QROM) and so the quantum security of parameters that are proposed is unclear and likely weaker than claimed. In addition, they are generally slower than standard primitives like KEMs. In this work, we propose an efficient, deniable and post-quantum X3DH-like protocol that we call K-Waay, that does not rely on ring signatures. At its core, K-Waay uses a split-KEM, a primitive introduced by Brendel et al. [SAC 2020], to provide Diffie-Hellman-like implicit authentication and secrecy guarantees. Along the way, we revisit the formalism of Brendel et al. and identify that additional security properties are required to prove a split-KEM-based protocol secure. We instantiate split-KEM by building a protocol based on the Frodo key exchange protocol relying on the plain LWE assumption: our proofs might be of independent interest as we show it satisfies our novel unforgeability and deniability security notions. Finally, we complement our theoretical results by thoroughly benchmarking both K-Waay and existing X3DH protocols. Our results show even when using plain LWE and a conservative choice of parameters that K-Waay is significantly faster than previous work.