Secure and efficient pairing-based digital signatures

Digital signatures are one of important primitives of public-key cryptography. An ideal signature scheme should be provably secure in the standard model with weak assumption and tight reduction. It should also offer short parameters (e.g. public key, signing key and signature), signing efficiency, and verification efficiency. However, such an ideal signature scheme does not exist due to inherent tradeoffs in signature construction. Bilinear pairing is a popular mathematical tool towards constructing ideal signature schemes. In this thesis, we improve some well-known signature schemes constructed from bilinear pairings in terms of security and/or efficiency. The thesis is composed of the following nine chapters. In Chapter 1, we introduce the evaluation of digital signatures in terms of security model, hard problem, reduction probability, parameter size, signing efficiency and verification efficiency. In Chapter 2, we introduce the background of digital signatures including the definition of digital signatures, the development of bilinear pairings and proposed signature schemes in the literature. In Chapter 3, we improve short signatures with a tighter security reduction without random oracles. The Hofheinz-Kiltz signature scheme [HK08] is the first signature scheme whose signatures are less than 320 bits (80-bit security) in the standard model. However, their security reduction to the q-SDH assumption is loose. We utilize a new programmable hash function to construct short signature scheme such that the security proof has a tighter reduction. Taking security loss into account, for 80-bit security, our stateless signature scheme produces 286-bit signature only compared to 306 bits by [HK08]; our stateful signature scheme offers 207-bit signature only compared to 266 bits by [HK08]. In Chapter 4, we improve Waters signature scheme [Wat05] with a tighter security reduction. The Waters signature scheme is the first provably secure scheme under the CDH assumption in the standard model. However, the security reduction is loose and dependent on the number of signature queries. We tighten the security