Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Journal of Applied Cryptography

A framework for universally composable non-committing blind signatures

Masayuki Abe, Miyako Ohkubo

Published Jan 1, 2012• 9 citations
Publisher

Abstract

This paper studies non-committing type of universally composable (UC) blind signature protocols where an adversary does not necessarily commit to a message when requesting a signature. An ordinary UC blind signature functionality requires users to commit to the message to be blindly signed. It is thereby impossible to realise in the plain model. This paper first shows that even non-committing variants cannot be realised in the plain model. We then characterise UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. The usefulness of the characterisation is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.

DOI
10.1504/ijact.2012.045581

Related papers

A Framework for Universally Composable Non-Committing Blind Signatures.

Masayuki Abe, Miyako Ohkubo

A universally composable (UC) blind signature functionality requres users to commit to the message to be blindly signed. It is thereby impossible to realize in the plain model. This paper shows that even non-committing variants of UC blind signature functionality can not be realized in the plain model. We characterize UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. Usefulness of the characterization is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.

•Jan 1, 2009•0 citations

UC-Secure Non-interactive Public-Key Encryption

Jan L. Camenisch, Anja Lehmann, Gregory Neven +1 more

The universal composability (UC) framework enables the modular design of cryptographic protocols by allowing arbitrary compositions of lower-level building blocks. Public-key encryption is unarguably a very important such building block. However, so far no UC-functionality exists that offers non-interactive encryption necessary for modular protocol construction. We provide an ideal functionality for non-committing encryption (i.e., public-key encryption secure against adaptive corruptions) with locally generated, and therefore non-interactive, ciphertexts. As a sanity check, we also provide a property-based security notion that we prove to be equivalent to the UC notion. We then show that the encryption scheme of Camenisch et al. (SCN '16) based on trapdoor permutations securely implements our notion in the random-oracle model without assuming secure erasures. This is the best one can hope to achieve as standard-model constructions do not exist due to the uninstantiability of round-optimal adaptively secure message transfer in the standard model (Nielsen, Crypto '02). We illustrate the modular reusability of our functionality by constructing the first non-interactive signcryption scheme secure against adaptive corruptions without secure erasures in the UC framework.

IEEE Computer Security Foundations Workshop (CSFW)•Aug 1, 2017•7 citations

Universally Composable Blind Signatures in the Plain Model

Aslak Bakke Buan, Kristian Gjøsteen, Lillian Kråkmo

In the universal composability framework, we define an ideal functionality for blind signatures, as an alternative to a functionality recently proposed by Fischlin. Fischlin proves that his functionality cannot be realized in the plain model, but this result does not apply to our functionality. We show that our functionality is realized in the plain model by a blind signature protocol if and only if the corresponding blind signature scheme is secure with respect to blindness and non-forgeability, as defined by Juels, Luby and Ostrovsky.

•Jan 1, 2006•6 citations

A Framework for Efficient Fully-Equipped UC Commitments.

Eiichiro Fujisaki

We present a general framework for constructing non-interactive universally composable (UC) commitment schemes that are secure against adaptive adversaries in the non-erasure setting under a single re-usable common reference string. Previously, such “fully-equipped ” UC commitment schemes are only known in [8, 9], with an unavoidable overhead of O(κ) in the sense of communication and computational complexities; meaning that to commit λ bits, the communication and computational costs require O(λκ), where κ denotes the security parameter. Efficient construction of a fully-equipped UC commitment scheme was a long-standing open problem. We introduce a cryptographic primitive, called all-but-many encryptions (ABMEs), and prove that it is a translation of fully-equipped UC commitment in the primitive level. We then construct ABMEs from cryptographic primitives that we call a probabilistic pseudo random function family and extractable sigma protocols – the former is a probabilistic version of a pseudo random function family and the latter is a special kind of sigma (i.e., canonical 3-round public-coin HVSZK) protocols with some extractability. We provide fully-equipped UC commitment schemes from ABMEs under DDH and DCR-based assumptions, respectively. In particular, the DCR-based scheme is the first fully-equipped UC commitment scheme with optimal expansion factor Ω(1); to commit κ bits, the communication and computational costs are Ω(κ). We further construct a fully-equipped UC commitment scheme from a general assumption (in which trap-door permutations exist), which is far more efficient than the previous construction [9], because, unlike [9], our construction does not require non-interactive zero-knowledge proof systems. 1

•Jan 1, 2012•1 citation

Equivocal Blind Signatures and Adaptive UC-Security.

Aggelos Kiayias, Hong-Sheng Zhou

We study the design of practical blind signatures in the universal composability (UC) setting against adaptive adversaries. We introduce a new property for blind signature schemes that is fundamental for managing adaptive adversaries: an equivocal blind signature is a blind signature protocol where a simulator can construct the internal state of the client so that it matches a simulated transcript even after a signature was released. We present a general construction methodology for building practical adaptively secure blind signatures: the starting point is a 2-move “lite blind signature”, a lightweight 2-party signature protocol that we formalize and implement both generically as well as number theoretically: formalizing a primitive as “lite ” means that the adversary is required to show all private tapes of adversarially controlled parties; this enables us to conveniently separate zero-knowledge (ZK) related security requirements from the remaining security properties in the primitive’s design methodology. We then focus on the exact ZK requirements for building blind signatures. To this effect, we formalize two special ZK ideal functionalities, single-verifier-ZK (SVZK) and single-prover-ZK (SPZK) and we investigate the requirements for realizing them in a commit-and-prove fashion as building blocks for adaptively secure UC blind signatures. SVZK can be realized without relying on a multi-session UC commitment; as

•Jan 1, 2007•0 citations

UNIVERSALLY COMPOSABLE BLIND SIGNATURE FUNCTIONALITY

Shirley Cheung, C. H. LEE, Yunlei Zhao

Blind signatures play a critical role in digital cash systems. In this paper, we investigate the blind signature functionality in the framework of universally composable (UC) security — the strongest security guarantees up to now for cryptographic protocols over the Internet. We present the universally composable blind signature functionality, [Formula: see text]. Our approach is based on a new UC signature functionality [Formula: see text], which is a modified version of the original signature functionality [Formula: see text] presented by Canetti. We also prove that [Formula: see text] and [Formula: see text] are actually equivalent with respect to non-adaptive adversaries. Our result is of both theoretical and practical consequence to future research studies and practical implementations of digital cash systems with universally composable security.

International Journal of Information Technology & Decision Making•Dec 1, 2004•0 citations
This paper studies non-committing type of universally composable (UC) blind signature protocols where an adversary does not necessarily commit to a message when requesting a signature. An ordinary UC blind signature functionality requires users to commit to the message to be blindly signed. It is thereby impossible to realise in the plain model. This paper first shows that even non-committing variants cannot be realised in the plain model. We then characterise UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. The usefulness of the characterisation is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.
A universally composable (UC) blind signature functionality requres users to commit to the message to be blindly signed. It is thereby impossible to realize in the plain model. This paper shows that even non-committing variants of UC blind signature functionality can not be realized in the plain model. We characterize UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. Usefulness of the characterization is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.
The universal composability (UC) framework enables the modular design of cryptographic protocols by allowing arbitrary compositions of lower-level building blocks. Public-key encryption is unarguably a very important such building block. However, so far no UC-functionality exists that offers non-interactive encryption necessary for modular protocol construction. We provide an ideal functionality for non-committing encryption (i.e., public-key encryption secure against adaptive corruptions) with locally generated, and therefore non-interactive, ciphertexts. As a sanity check, we also provide a property-based security notion that we prove to be equivalent to the UC notion. We then show that the encryption scheme of Camenisch et al. (SCN '16) based on trapdoor permutations securely implements our notion in the random-oracle model without assuming secure erasures. This is the best one can hope to achieve as standard-model constructions do not exist due to the uninstantiability of round-optimal adaptively secure message transfer in the standard model (Nielsen, Crypto '02). We illustrate the modular reusability of our functionality by constructing the first non-interactive signcryption scheme secure against adaptive corruptions without secure erasures in the UC framework.
In the universal composability framework, we define an ideal functionality for blind signatures, as an alternative to a functionality recently proposed by Fischlin. Fischlin proves that his functionality cannot be realized in the plain model, but this result does not apply to our functionality. We show that our functionality is realized in the plain model by a blind signature protocol if and only if the corresponding blind signature scheme is secure with respect to blindness and non-forgeability, as defined by Juels, Luby and Ostrovsky.
We present a general framework for constructing non-interactive universally composable (UC) commitment schemes that are secure against adaptive adversaries in the non-erasure setting under a single re-usable common reference string. Previously, such “fully-equipped ” UC commitment schemes are only known in [8, 9], with an unavoidable overhead of O(κ) in the sense of communication and computational complexities; meaning that to commit λ bits, the communication and computational costs require O(λκ), where κ denotes the security parameter. Efficient construction of a fully-equipped UC commitment scheme was a long-standing open problem. We introduce a cryptographic primitive, called all-but-many encryptions (ABMEs), and prove that it is a translation of fully-equipped UC commitment in the primitive level. We then construct ABMEs from cryptographic primitives that we call a probabilistic pseudo random function family and extractable sigma protocols – the former is a probabilistic version of a pseudo random function family and the latter is a special kind of sigma (i.e., canonical 3-round public-coin HVSZK) protocols with some extractability. We provide fully-equipped UC commitment schemes from ABMEs under DDH and DCR-based assumptions, respectively. In particular, the DCR-based scheme is the first fully-equipped UC commitment scheme with optimal expansion factor Ω(1); to commit κ bits, the communication and computational costs are Ω(κ). We further construct a fully-equipped UC commitment scheme from a general assumption (in which trap-door permutations exist), which is far more efficient than the previous construction [9], because, unlike [9], our construction does not require non-interactive zero-knowledge proof systems. 1
We study the design of practical blind signatures in the universal composability (UC) setting against adaptive adversaries. We introduce a new property for blind signature schemes that is fundamental for managing adaptive adversaries: an equivocal blind signature is a blind signature protocol where a simulator can construct the internal state of the client so that it matches a simulated transcript even after a signature was released. We present a general construction methodology for building practical adaptively secure blind signatures: the starting point is a 2-move “lite blind signature”, a lightweight 2-party signature protocol that we formalize and implement both generically as well as number theoretically: formalizing a primitive as “lite ” means that the adversary is required to show all private tapes of adversarially controlled parties; this enables us to conveniently separate zero-knowledge (ZK) related security requirements from the remaining security properties in the primitive’s design methodology. We then focus on the exact ZK requirements for building blind signatures. To this effect, we formalize two special ZK ideal functionalities, single-verifier-ZK (SVZK) and single-prover-ZK (SPZK) and we investigate the requirements for realizing them in a commit-and-prove fashion as building blocks for adaptively secure UC blind signatures. SVZK can be realized without relying on a multi-session UC commitment; as
Blind signatures play a critical role in digital cash systems. In this paper, we investigate the blind signature functionality in the framework of universally composable (UC) security — the strongest security guarantees up to now for cryptographic protocols over the Internet. We present the universally composable blind signature functionality, [Formula: see text]. Our approach is based on a new UC signature functionality [Formula: see text], which is a modified version of the original signature functionality [Formula: see text] presented by Canetti. We also prove that [Formula: see text] and [Formula: see text] are actually equivalent with respect to non-adaptive adversaries. Our result is of both theoretical and practical consequence to future research studies and practical implementations of digital cash systems with universally composable security.