How to sign given any trapdoor permutation

Reviewer: Catherine Ann Meadows

A trapdoor permutation is one that is easy to compute but difficult to invert unless some further information is known. The most straightforward way to use a trapdoor permutation for digital signatures is to make the permutation public but keep its inverse secret. The owner of the secret can sign a message by computing the inverse of the function on the message, while others who do not know the secret can verify the signature by computing the public function on the signed message and verifying that the original message is obtained. No trapdoor permutation can be guaranteed to be difficult to invert on its entire domain, however. Moreover, a trapdoor permutation may have algebraic properties that make it possible to compute new signed messages from old signed messages. In this paper, the authors show how to use trapdoor permutations to construct a digital signature scheme that is secure in the very strong sense that an attacker who may obtain a signature on any message she or he chooses cannot use the information to construct signatures of her or his own. This scheme works for any trapdoor permutation. It begins by using a pair of trapdoor permutations f 0 and f 1 and a random seed a to sign a single bit; either a zero or a one is signed depending on whether the inverse of f 0 a or of f 1 a is computed. Further pairs of trapdoor permutations are used to sign a second random seed bit by bit; this seed and the first pair of functions are used to sign a second bit, and so forth. The authors show how more compact signatures can be achieved by arranging the scheme in a tree structure. The results of this paper have also been used by Naor and Yung and by Rompel to show that one-way permutations and one-way functions are sufficient for secure digital signature schemes. The authors point out that the algorithms described in this paper can be used as an introduction to the more complex schemes described in those papers.