Signature Schemes from Identification Schemes

There are currently two main techniques for constructing signature schemes in the random oracle model. The first technique uses the “full-domain hash” approach, and several schemes designed using this approach were introduced in the previous chapter. Here we cover the second central method, in which signature schemes are derived from so-called identification schemes. We note up front that there is a rich literature studying identification schemes in their own right; however, we limit ourselves to a discussion of only those aspects that are most directly relevant to the construction of signature schemes.