Crescenzo, 2008

Abstract

One of the earliest identification schemes was proposed by Beth in [6]. Since its introduction, variations and generalizations of this scheme have been considered, and, recently, the property of security against passive impersonation was shown, under a weak unforgeability assumption on the hashed El Gamal signature scheme, for two such variants: one in the standard (i.e., not identity-based) and one in the identity-based model. However, the security of both protocols under active and concurrent impersonation attacks was left open.

In this paper we prove that very minor modifications to these schemes result in schemes that satisfy security under active and concurrent impersonation attacks, assuming a one-more-dlog assumption. The resulting protocols are just as efficient as the original variants, which are, in turn, somewhat more efficient (but less general) of the original one proposed by Beth.