1. The document presents an improved security proof for the Camenisch-Lysyanskaya signature-based synchronized aggregate signature scheme. 2. It describes the modified Camenisch-Lysyanskaya signature used in the security proof for the Lee-Lee-Yung synchronized aggregate signature scheme. The modified signature replaces the original interactive assumption with the non-interactive 1-MSDH assumption. 3. The authors provide an overview of their security proof, which uses a simulator to convert a signature adversary against the synchronized aggregate signature into a forger against the underlying modified Camenisch-Lysyanskaya signature. This establishes the security of the synchronized aggregate signature under the 1-

1. 1
Improved Security Proof for the Camenisch-
Lysyanskaya Signature-Based Synchronized
Aggregate Signature Scheme
Masayuki Tezuka Keisuke Tanaka
Tokyo Institute of Technology
ACISP 2020 Full presentation slide
Version: 2020/12/23

2. Digital Signature
2
Signer Verifier
(", $)
(&', (')
&'
Verify

3. Aggregate Signature
3
("#, %#)
Signer 1
('(), *())
Signer 2
('(#, *(#)
Signer +
('(,, *(,)
⋮
("), %))
(",, %,)
("), %))
("#, %#)
⋮
(",, %,)

4. Aggregate Signature
4
("#, %#)
Signer 1
('(), *())
Signer 2
('(#, *(#)
Signer +
('(,, *(,)
⋮
("), %))
(",, %,)
"), ⋯ , ", , Σ
Aggregate
Signature

5. Aggregate Signature
5
("#, %#)
Signer 1
('(), *())
Signer 2
('(#, *(#)
Signer +
('(,, *(,)
⋮
("), %))
(",, %,)
"), ⋯ , ", , Σ
Aggregate
Signature
('(), '(#, ⋯ , '(, )
Verify

6. Types of Aggregate Signature
6
• Full aggregate signature [BGLS03]
• Sequential aggregate signature (SeqAS)
[LMRS04]
• Synchronized aggregate signature (SyncAS)
[GR06,AGH10]
etc…

7. Full Aggregate Signature [BGLS03]
7
Signer 1 Signer 2 Signer !
⋯
#$ #% #&
⋯
Σ

8. Sequential Aggregate Signature (SeqAS)
[LMRS04]
8
Signer 1
Signer 2 Signer !
Σ# Σ$ Σ%
Sign
Sign Sign
⋯
⋯

9. Synchronized Aggregate Signature (SyncAS)
[GR06,AGH10]
9
Signer 1 Signer 2 Signer !
⋯
Time
#$
#%
&$ &% &'
&′$ &′% &′'
⋯ Σ
Σ′
⋯

10. Synchronized Aggregate Signature (SyncAS)
[GR06,AGH10]
10
Signer 1 Signer 2 Signer !
⋯
Time
#$
#%
&$ &% &'
&′$ &′% &′'
⋯ Σ
Σ′
⋯
Application
・ Log data
・ Sensor data
・ Blockchain protocol

11. Syntax of SyncAS [AGH 10]
11
Signer 1 Signer !
⋯
)me
#$
#%
&$ &'
&′$ &′'
⋯
⋯
Σ′
*+$
,+$
*+'
,+'
Setup(1/
, 11
) → **
KeyGen(**) → (*+, ,+)
Verify(*+, 4, &) → 0 or 1
AggVerify *+8, 48 89$
'
, Σ → 0 or 1
Aggregate *+8, 48, &8 89$
'
→ Σ
Sign(,+, #, 4) → &

12. EUF-CMA Security for SyncAS
in the Certified-Key Model [AGH 10]
12
Challenger Adversary

13. EUF-CMA Security for SyncAS
in the Certified-Key Model [AGH 10]
13
("", "$∗
)
"" ← Setup(1)
, 1*
)
"$∗
, +$∗
← KeyGen("")
Challenger Adversary
,-./ ← 1

14. EUF-CMA Security for SyncAS
in the Certified-Key Model [AGH 10]
14
("", "$∗
)
("$, '$)
accept or reject
"" ← Setup(1*
, 1+
)
"$∗
, '$∗
← KeyGen("")
, ← , ∪ {"$}
Challenger Adversary
0123 ← 1
Cert
query

15. EUF-CMA Security for SyncAS
in the Certified-Key Model [AGH 10]
15
("", "$∗
)
("$, '$)
accept or reject
( or skip
)
σ ← Sign('$∗
, ,-./, ()
,-./ ← ,-./ + 1
"" ← Setup(12
, 13
)
"$∗
, '$∗
← KeyGen("")
4 ← 4 ∪ {"$}
Challenger Adversary
,-./ ← 1
Cert
query
Signing
query

16. EUF-CMA Security for SyncAS
in the Certified-Key Model [AGH 10]
16
("", "$∗
)
("$, '$)
accept or reject
( or skip
)
σ ← Sign('$∗
, ,-./, ()
,-./ ← ,-./ + 1
"" ← Setup(12
, 13
)
"$∗
, '$∗
← KeyGen("")
4 ← 4 ∪ {"$}
"$8, ⋯ , "$: = "$∗
, ⋯ , "$< ,
(8, ⋯ , (:, ⋯ , (< , Σ)
Challenger Adversary
,-./ ← 1
Cert
query
Signing
query

17. EUF-CMA Security for SyncAS
in the Certified-Key Model [AGH 10]
17
!"#, ⋯ , !"& = !"∗
, ⋯ , !") ,
*#, ⋯ , *&, ⋯ , *) , Σ)
The adversary wins if:
1. is valid.
2. Never queried *& for the signing oracle.
3. All keys !"#, ⋯ , !") are registered.

18. SyncAS Based on Bilinear Group
18
Scheme Assumption pk
size
Agg sig
size
Agg Ver
(in parinig)
GR06 CDH + ROM ID 3 3
AGH10 CDH 1 3 ! + 3
AGH10 CDH + ROM 1 2 4
LLY13 OT-LRSW + ROM 1 2 3
Most efficient
scheme

19. SyncAS Based on Bilinear Group
19
Scheme Assumption pk
size
Agg sig
size
Agg Ver
(in parinig)
GR06 CDH + ROM ID 3 3
AGH10 CDH 1 3 ! + 3
AGH10 CDH + ROM 1 2 4
LLY13 OT-LRSW + ROM 1 2 3
Most efficient
scheme ☹ Interactive assumption !

20. Non-Interactive Assumption
20
Adversary
Instance
Solution
Example
DDH, CDH, DL,
SXDH, qSDH
etc…

21. Interactive Assumption
21
Adversary
Instance
Solution
Oracle
!"
O(#)
$"
Example
LRSW [LRSW99], PS [PS16] etc…

22. (OT-)LRSW Assumption [LRSW99]
22
Adversary
Instance
Solution
Oracle
!"
O$,& (')
(), *, *+, ,, -, . = -$
, 0 = -&
)
(!, 2, 3, 4)
! ∉ !" , ! ∈ 78
∗
, 2 ∈ *, 3 = 2&
, 4 = 2$:;$&
(2", 2"
&
, 2"
$:;<$&
)
2" ← *

23. Our Contribution
23
Scheme Assumption pk
size
Agg
sig size
Agg Ver
(parinig)
GR06 CDH + ROM ID 3 3
AGH10 CDH 1 3 ! + 3
AGH10 CDH + ROM 1 2 4
LLY13 OT-LRSW + ROM 1 2 3
LLY13
(New Proof)
1-MSDH-2 + ROM
☺
Non-interactive
and static
assumption !

24. Security proof for LLY SyncAS
24
OT-LRSW
assumption
[LRSW99]
CL Sig [CL04]
OT-EUF-CMA
LLY AggSig
[LLY10]
EUF-CMA
[CL04]
[LLY13]
ROM

25. Security proof for LLY SyncAS
25
OT-LRSW
assumption
[LRSW99]
CL Sig [CL04]
OT-EUF-CMA
LLY AggSig
[LLY10]
EUF-CMA
1-MSDH-2
assumption
[PS18]
Modified
CL Sig [PS18]
OT-EUF-CMA
[CL04]
[LLY13]
[PS18]
Our
Contribution
ROM
ROM

26. Our Contribution
26
LLY SyncAS
[LLY10]
EUF-CMA
1-MSDH-2
assumption
[PS18]
Modified
CL Sig [PS18]
OT-EUF-CMA
[PS18]
Our
Result
ROM
① ② ③
④

27. ① !-MSDH-2 Assumption [PS18]
27
Adversary
Instance ", $, $%, &, ', '()
, '*+()
,-.
/0.
, '1
, '1*(
Solution (2, 3, ℎ
5
678, ℎ
9
6 +:(6))
If we fix ! = 1,
we can regard 1-MSDH-2
as a staAc assumpAon.
2 ≠ 0, deg P ≤ !,
F + 2 and 3(F) are relative prime.

28. Sign(&', ) ∈ +,)
).
← +,, 0 ← 1∗
, 3 ← 04
5 ← 06
, 7 ← 54
, 8 ← 09
3:9
7:;9
< ← ().
, 0, 3, 5, 7, 8)
KeyGen(==)
&' = (?, @, A) ← +,
B
C ← 1∗
, D ← C9
,
E ← C4
, + ← C6
=' = (C, D, E, +)
② Modified CL Signature (MCL Sig) [PS18]
28
== = (=, 1, 1F, G)
Verify =', ), <
G 0, E = G(3, C) ?
G 0, + = G(5, C) ?
G 5, E = G(7, C) ?
G 03:
7:.
, D = G(8, C) ?

29. ② Modified CL Signature (MCL Sig) [PS18]
29
If the !-MSDH-2 assumption holds,
the modified CL signature is EUF-CMA secure.
(! is a bound on the number of signing queries. )
If the 1-MSDH-2 assumption holds,
the modified CL signature is OT-EUF-CMA secure.
Theorem [PS18]
We only use

30. ③ LLY SyncAS [LLY13]
30
!! = (!, %, %&, ', (, )*, )+, ),)
Public key and Secret key
. ← ∏12*
3
.1 = ∏12*
3
)* 4 56 7 )+(4)89 :,;6 56
Σ ← (., 4)
Signature on a message = ∈ ?@ in time period 4
Aggregate signature
.1 ← )* 4 56 7 )+(4)89 :,;6 56, A ← (.1, 4)
BC1 = D1 ← ?@, !C1 = E1 ← (56

31. ④ Overview of Our Security Proof
31
Simulator Adversary
(SyncAS)
Challenger
(MCL)

32. ④ Overview of Our Security Proof
32
Simulator Adversary
(SyncAS)
! ← #$
Challenger
(MCL)
%&
!
(!(, *, +,
,, -, .)

33. ④ Overview of Our Security Proof
33
("", "$∗)
Cert
query
Program hash
'()*
← ,- (.′)
0 ← ,1 .′ ,
2′ ← ,3 .′, 24
Σ∗
Simulator Adversary
(SyncAS)
Hash
query
Signing
query
2 ← 67
Challenger
(MCL)
"$
2
(28, ', 0,
9, (, :)
;∗
.8 ← [=],

34. ④ Conversion from MCL Sig to LLY SyncAS
34
!" ← (%"
&
, (", )" ← ("
*+, ," ← ("
*+, -" ← ,"
*+,
." ← ("
/+-"
0+
1/+)"
0+/+)
MCL signature
Σ ← %&
, (, ), ,, -, . = 5
"67
8
." = 5
"67
8
(-01 /+
)0+/+ , 9
Σ ← . = 5
"67
8
." = 5
"67
8
:7 9 /+:; 9 <= >,0+ /+ , 9
II. Change (-01
to :7 9 , ) to :; 9 ,
%" to :? 9, %" .
I. Force signers to use same %"
&
, (", )", ,", -".

35. References 1/2
35
[AGH10] Ahn, Green, and Hohenberger.
Synchronized aggregate signatures: new definiAons, construcAons and
applicaAons. (ACM CCS 2010)
[BGLS03] Boneh, Gentry, Lynn,and Shacham.
Aggregate and verifiably encrypted signatures from bilinear maps.
(EUROCRYPT 2003)
[CL04] Camenisch and Lysyanskaya.
Signature schemes and anonymous credenAals from bilinear maps.
(CRYPTO 2004)
[GR06] Gentry and Ramzan.
IdenAty-based aggregate signatures. (PKC 2006)

36. References 2/2
36
[LMRS04] Lysyanskaya, Micali, Reyzin, and Shacham.
Sequential aggregate signatures from trapdoor permutations.
(EUROCRYPT 2004)
[LLY 13] Lee, Lee, and Yung.
Aggregating CL-signatures revisited: Extended functionality and better
efficiency. (FC 2013)
[LRSW99] Lysyanskaya, Rivest, Sahai, and Wolf.
Pseudonym systems. (SAC1999)
[PS16] Pointcheval and Sanders.
Short Randomizable Signatures. (CT-RSA 2016)
[PS18] Pointcheval and Sanders.
Reassessing security of randomizable signatures. (CT-RSA 2018)

37. Appendix: Modified CL Signature
37
!! = (!, %, %&, ')
KeyGen(!!)
)* = (+, ,, - ) ← /0
1 ← %∗
, 3 ← 14
,
5 ← 16
, / ← 14
!* = (1, 3, 5, / )
Sign()*, ;)
;<
← /0, = ← %∗
, > ← =6
? ← =@
, A ← ?6
, B ← =4
>C4
ACD4
E ← (;<
, =, >, ?, A, B)
Verify !*, ;, E
' =, 5 = '(>, 1) ?
' =, / = '(?, 1) ?
' ?, 5 = '(A, 1) ?
' =>C
AC<
, 3 = '(B, 1) ?