Short Signatures from the Weil Pairing∗ Dan Boneh† Ben Lynn Hovav Shacham
[email protected] [email protected] [email protected] Abstract We introduce a short signature scheme based on the Computational Diffie-Hellman assump- tion on certain elliptic and hyper-elliptic curves. For standard security parameters, the signature length is about half that of a DSA signature with a similar level of security. Our short signature scheme is designed for systems where signatures are typed in by a human or are sent over a low-bandwidth channel. We survey a number of properties of our signature scheme such as signature aggregation and batch verification. 1 Introduction Short digital signatures are needed in environments with strong bandwidth constraints. For ex- ample, product registration systems often ask users to key in a signature provided on a CD label. When a human is asked to type in a digital signature, the shortest possible signature is needed. Similarly, due to space constraints, short signatures are needed when one prints a bar-coded digital signature on a postage stamp [50, 45]. As a third example, consider legacy protocols that allocate a fixed short field for non-repudiation [1, 32]. One would like to use the most secure signature that fits in the allotted field length. The two most frequently used signatures schemes, RSA and DSA, produce relatively long sig- natures compared to the security they provide. For example, when one uses a 1024-bit modulus, RSA signatures are 1024 bits long. Similarly, when one uses a 1024-bit modulus, standard DSA signatures are 320 bits long.