对称本原签名的下界
Lower Bounds on Signatures from Symmetric Primitives
摘要：
我们证明了每次构造的一次性签名方案从一个随机的预言机达到黑箱安全最多$2^{(1+o(1))q}$，其中$q$是总的甲骨文查询所要求的密钥生成，签名和验证算法。也就是说，任何这样的方案都可以被（计算上无界的）对手对oracle进行$2^{(1+o(1))q}$查询以接近$1$的概率破坏。这在查询的数量上是一个常数因子，因为对Lamport的一次性签名（Lamport '79）的简单修改使用对oracle的$q$查询来实现$2^{(0.812-o(1))q}$黑盒安全性。我们的结果还扩展到随机排列和理想密码预言机（查询数量中损失了一个常数因子）。由于对称基元（如分组密码、散列函数和消息认证码）可以通过对上述预言机的恒定数量的查询来构造，因此当构造是黑箱时，我们得到了由对称基元构造的签名方案的效率的下界.这可以被视为签名方案和对称原语之间固有的效率差距的证据。
英文摘要：
We show that every construction of one-time signature schemes from a random oracle achieves black-box security at most $2^{(1+o(1))q}$, where $q$ is the total number of oracle queries asked by the key generation, signing, and verification algorithms. That is, any such scheme can be broken with probability close to $1$ by a (computationally unbounded) adversary making $2^{(1+o(1))q}$ queries to the oracle. This is tight up to a constant factor in the number of queries, since a simple modification of Lamport's one-time signatures (Lamport '79) achieves $2^{(0.812-o(1))q}$ black-box security using $q$ queries to the oracle. Our result extends (with a loss of a constant factor in the number of queries) also to the random permutation and ideal-cipher oracles. Since the symmetric primitives (e.g. block ciphers, hash functions, and message authentication codes) can be constructed by a constant number of queries to the mentioned oracles, as corollary we get lower bounds on the efficiency of signature schemes from symmetric primitives when the construction is black-box. This can be taken as evidence of an inherent efficiency gap between signature schemes and symmetric primitives.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
