Matrioska: A Compiler for Multi-key Homomorphic Signatures

• Published in: Security and Cryptography for Networks Vol. 11035; pp. 43 - 62
• Main Authors: Fiore, Dario, Pagnin, Elena
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2018; Springer International Publishing
• Series: Lecture Notes in Computer Science
• ISBN: 9783319981123; 3319981129
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-319-98113-0_3

Multi-Key Homomorphic Signatures (MK-HS) enable clients in a system to sign and upload messages to an untrusted server. At any later point in time, the server can perform a computation C $$C$$ on data provided by t $$t$$ different clients, and return the output y $$\mathsf {y}$$ and a short signature σC,y $$\sigma _{C, \mathsf {y}}$$ vouching for the correctness of y $$\mathsf {y}$$ as the output of the function C $$C$$ on the signed data. Interestingly, MK-HS enable verifiers to check the validity of the signature using solely the public keys of the signers whose messages were used in the computation. Moreover, the signatures σC,y $$\sigma _{C, \mathsf {y}}$$ are succinct, namely their size depends at most linearly in the number of clients, and only logarithmically in the total number of inputs of C $$C$$ . Existing MK-HS are constructed based either on standard assumptions over lattices (Fiore et al. ASIACRYPT’16), or on non-falsifiable assumptions (SNARKs) (Lai et al., ePrint’16). In this paper, we investigate connections between single-key and multi-key homomorphic signatures. We propose a generic compiler, called Matrioska, which turns any (sufficiently expressive) single-key homomorphic signature scheme into a multi-key scheme. Matrioska establishes a formal connection between these two primitives and is the first alternative to the only known construction under standard falsifiable assumptions. Our result relies on a novel technique that exploits the homomorphic property of a single-key HS scheme to compress an arbitrary number of signatures from t different users into only t signatures.