[cryptography] short signature scheme?

Paul Crowley paul at ciphergoth.org
Mon Nov 8 12:10:36 EST 2010


On 08/11/10 15:51, Jonathan Katz wrote:
> I am looking for a short signature scheme (certainly shorter than RSA
> signatures, as short as possible would be nice...) that is *patent-free*
> and (less important) easy to implement. Any suggestions?

I'm surprised you're not choosing the DDH scheme proposed by Eu-Jin Goh,
Stanislaw Jarecki, Nan Wang and yourself:

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.81.8245

AFAIK the the shortest signatures are 2k bits long (where roughly 2^k 
operations are needed to break the scheme) and this is 3k bits.  I know 
of no patent-free short-signature schemes with better reductions.
-- 
   __
\/ o\ Paul Crowley, paul at ciphergoth.org
/\__/ http://www.ciphergoth.org/



More information about the cryptography mailing list