Keyless Digital Multi-Signature Generation via Balanced Search Tree
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital signature schemes face issues with key management, including unlimited signature generation, unauthorized key usage, and reliance on Certificate Authorities, which can lead to forged signatures and difficulty in tracking signature limits.
Innovation Solution
A system and method for generating keyless digital multi-signatures that receive multiple signature requests, construct a balanced search tree, compute hash values, and create an aggregate signature within a height limitation, allowing for efficient and limited signature generation while tracking requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a private key is issued to a signer for digital signature generation, then the signer can create digital signatures, but the signer can produce an unlimited number of signatures and the private key can be stolen by unauthorized entities
Solution Approach 1:
The private key is segmented into two parts: a first part stored by the signer and a second part stored by the server. Both parts are required to generate a digital signature, preventing unauthorized signature generation while allowing the signer to create signatures when needed. This segmentation resolves the contradiction by maintaining security without limiting legitimate signature generation.
Solution Approach 2:
A server acts as an intermediary that holds the second part of the private key and collaborates with the signer to generate digital signatures. The server verifies the signer's identity and controls the signature generation process, preventing unauthorized entities from generating signatures while enabling legitimate signers to create signatures on demand.
2Reliability
If the private key is shared between the legitimate signer and a server to reduce unauthorized signature risk, then signature security is improved, but the system complexity increases
Solution Approach 1:
The private key is divided into two segments stored in different locations (signer's device and server). This segmentation provides security through distributed key storage while keeping the system relatively simple by using standard cryptographic key splitting techniques rather than complex multi-party computation protocols.
3Reliability
If a time-stamping service is used to mitigate risk between private key loss and revocation, then signature validity verification is improved, but the scheme is limited to public-key infrastructure only
Solution Approach 1:
The system performs self-verification of signature validity by checking whether the signer's current public key can verify the signature, without requiring external time-stamping services. This self-service approach provides signature validity verification while maintaining flexibility to work with different cryptographic schemes beyond just public-key infrastructure.
4Reliability
If a numerical tag is included at each step in the hash chain to limit signature generation, then signature tracking is improved, but the customer server can bypass the limitation by not checking the numerical tags
Solution Approach 1:
The verification process merges the numerical tag check with the existing hash chain verification in a single unified process. The verifier checks both the hash chain integrity and the numerical tag sequence simultaneously, ensuring signature generation limits are enforced without requiring separate verification steps, thus avoiding increased complexity.
Data Source
AI summary
A method of generating a keyless digital multi-signature is provided. The method includes receiving multiple signature generation requests from one or more client computers, building subtrees based on the signature generation requests, and constructing a search tree including the subtrees. The method also includes assigning explicit length tags to leaf nodes of the search tree to balance the search tree and applying a hash function to each of the search tree nodes. The root hash value and the height of the search tree make up a generated aggregate signature request, followed by receiving an aggregate signature based on the aggregate signature request. The keyless digital multi-signature is generated based on the aggregate signature and contains an implicit length tag to verify that the number of signature generation requests is limited. The aggregate signature is generated if the height of the search tree does not exceed a predetermined height limitation.