Linear and Lossy Identification Schemes Derive Tightly Secure Multisignatures

Abstract

For the multisignature schemes, the tight security in the plain public key (PPK) model is considered as one of the desirable features. In this paper, we give a generic construction of multisignature schemes which is tightly secure in the PPK and random oracle model. Our construction can capture the known tightly secure multisignature schemes. The generic construction is derived from the identification (ID) scheme which has two properties called the linearity and the lossiness. Thus, we can obtain new tightly secure multisignature schemes by applying our construction to existing linear and lossy ID schemes. Moreover, we consider the relationship between these two properties to shrink the conditions required for our generic construction. We propose a new property of ID schemes, called the difference soundness, and show that the combination of the linearity and the difference soundness implies the lossiness.