Universal Designated-Verifier Signatures

Motivated by privacy issues associated with dissemination of signed digital certificates, we definea new type of signature scheme called a ‘Universal Designated-Verifier Signature’ (UDVS). A UDVSscheme can function as a standard publicly-verifiable digital signature but has additional functional-ity which allows any holder of a signature (not necessarily the signer) to designate the signature toany desired designated-verifier (using the verifier’s public key). Given the designated-signature, thedesignated-verifier can verify that the message was signed by the signer, but is unable to convinceanyone else of this fact.We propose an efficient deterministic UDVS scheme constructed using any bilinear group-pair.Our UDVS scheme functions as a standard Boneh-Lynn-Shacham (BLS) signature when no verifier-designation is performed, and is therefore compatible with the key-generation, signing and verifyingalgorithms of the BLS scheme. We prove that our UDVS scheme is secure in the sense of ourunforgeability and privacy notions for UDVS schemes, under the Bilinear Diffie-Hellman (BDH)assumption for the underlying group-pair, in the random-oracle model. We also demonstrate ageneral constructive equivalence between a class of unforgeable and unconditionally-private UDVSschemes having unique signatures (which includes the deterministic UDVS schemes) and a class ofID-Based Encryption (IBE) schemes which contains the Boneh-Franklin IBE scheme but not theCocks IBE scheme.