Reduction-Centric Non-programmable Security Proof for the Full Domain Hash in the Random Oracle Model

Abstract

The security proofs which do not rely on the programmability of the Random Oracle Model (ROM) have the advantage that the reduction of the proof can be actually constructed. This feature contrasts with reductions that rely on the programmability, because hash functions with programmability capacities are not known to exist in the level required in actual proofs of security for important cryptographic schemes. Recent work in Asiacrypt 2010 by Fischlin et al. [7] has shown that proofs without programmability are not likely to exist for the Full Domain Hash (FDH) signature scheme. We propose the strengthening of the one-wayness of the trapdoor permutation underlying the FDH. More formally, we assume one-way trapdoor permutations that cannot be inverted in a number of points of the domain, even when the adversary has access to the inverter oracle for a restricted number of queries, say ℓ. This approach resembles the one-more RSA problem studied by Bellare et al. [1], a generalization of the regular one-wayness assumption. We show that even in the naive case, where the sign and hash queries are less than ℓ, a non-programmable security reduction is possible in Fischlin’s model. We also study the more general case where the number of sign and hash queries is greater than ℓ.

This research was supported in part by NTT Information Sharing Platform Laboratories and JSPS Global COE program “Computationism as Foundation for the Sciences”.