An Eecient Existentially Unforgeable Signature Scheme and Its Applications

A signature scheme is existentially unforgeable if, given any polynomial (in the security parameter) number of pairs where S(m) denotes the signature on the message m, it is computationally infeasible to generate a pair (m k+1 ; S(m k+1)) for any message m k+1 = 2 fm 1 ; : : :m k g. We present an existentially unforgeable signature scheme that requires at most 6 times the amount of time needed to generate a signature using RSA (which is not existentially unforgeable), and point out applications where its use is desirable.