Directed Transitive Signature on Directed Tree1

In early 2000’s, Rivest [1,2] and Micali [2] introduced the notion of transitive signature, which allows a third party with public key to generate a valid signature for a composed edge (vi,vk), from the signatures for two edges (vi,v j) and (v j,vk). Since then, a number of works, including [2,3,4,5,6], have been devoted on transitive signatures. Most of them address the undirected transitive signature problem, and the directed transitive signature is still an open problem. S. Hohenberger [4] even showed that a directed transitive signature implies a complex mathematical group, whose existence is still unknown. Recently, a few directed transitive signature schemes [7,8] on directed trees are proposed. The drawbacks of these schemes include: the size of composed signature increases linearly with the number of nested applications of composition and the creating history of composed edge is not hidden properly. This paper presents a RSA-Accumulator [9] based scheme DTTS—a Directed-Tree-Transitive Signature scheme, to address these issues. Like previous works [7,8], DTTS is designed only for directed trees, however, it features with constant (composed) signature size and privacy-preserving property. We prove that DTTS is transitively unforgeable under adaptive chosen message attack in the standard model.