Transitive Signatures Based on Factoring and RSA

We present novel realizations of the transitive signature primitive introduced by Micali andRivest [11]. Our first scheme, FBTS-1, is proven transitively unforgeable under adaptive chosen-message attack assuming factoring is hard. We then present a hash-based modification, FBTS-2achieving shorter signatures by eliminating the need for “node certificates”, and provable underthe same factoring assumption in the random oracle model. We also provide an answer to anopen question raised in [11] regarding the security of their RSA based scheme, by showing that itis transitively unforgeable under adaptive chosen-message attack assuming the security of RSAunder one-more-inversion. Finally we present a similar hash-based modification of this schemethat results in a performance improvement.