Discrete-Log-Based Signatures May Not Be Equivalent to Discrete Log

Pascal Paillier (1) , Damien Vergnaud (2)

1 Gemplus Card International - Cryptography Group
2 LMNO - Laboratoire de Mathématiques Nicolas Oresme

We provide evidence that the unforgeability of several discrete-log based signatures like Schnorr signatures cannot be equivalent to the discrete log problem in the standard model. This contradicts in nature well-known proofs standing in weakened proof methodologies, in particular proofs employing various formulations of the Forking Lemma in the random oracle Model. Our impossibility proofs apply to many discrete-log-based signatures like ElGamal signatures and their extensions, DSA, ECDSA and KCDSA as well as standard generalizations of these, and even RSA-based signatures like GQ. We stress that our work sheds more light on the provable (in)security of popular signature schemes but does not explicitly lead to actual attacks on these.

Mots clés: discrete logarithm; signatures; standard model; random oracle model; separation; algebraic reduction

Domaines: Cryptographie et sécurité [cs.CR]

Pascal Paillier, Damien Vergnaud. Discrete-Log-Based Signatures May Not Be Equivalent to Discrete Log. 2005, pp.1-20. ⟨hal-00019352⟩