Permutation signature

CoSV94 Don Coppersmith, Jacques Stem, Serge Vaudenay Attacks on the Birational Permutation Signature Schemes Crypto 93, LNCS 773, Springer-Verlag, Berlin 1994, 435-443. 

Usually, the secrecy and signature schemes constructed from this trap-door one-way family of permutations are also called RSA. However, there are several variants of those, as will be seen in Section 2.5. This can lead to confusion. 

A third important question is if the signature scheme can be broken without breaking the trap-door one-way permutations. However, this question only came up later see Section 2.5. 

Existential forgery is even possible with a key-only attack in all signature schemes built from trap-door one-way permutations as described in Section 2.4 The attacker chooses a value and calls it a signature, computes the permutation with the pubhc key, and calls the result a message. 

Subsequently, one tried to find constructions on possibly weaker abstract assumptions. In [BeMiSS, BeMi92], the assumption is the existence of a trap-door one-way family of permutations. This assumption was used for the efficient construction in [DiHe76] (see Section 2.4) however, a much more complicated construction was needed to avoid the problems mentioned in Section 2.5. It has a lot in common with one-time signatures and tree authentication. The constructions could be extended to arbitrary one-way permutations, i.e., not necessarily with trapdoors, in [NaYu89]. In a sense, this is not too surprising because no trap-doors were needed in the informal constructions of one-time signatures md tree authentication (see Section 2.4) either. Finally, the result was extended to any oneway function [Romp90]. The main problem in the last two cases was to construct appropriate hash functions. 

All types of fail-stop signature schemes, as far as service is concerned, could be built very early on the abstract assumption that a claw-intractable family of permutation pairs exists, i.e., the assumption from [G0MR88], except that trap-doors are not even needed see [Pfit89, PfWa90],... 

This section presents a special class of standard fail-stop signature schemes with one risk bearer, where the structure of the key-generation protocol is a rather special case of that allowed in Definition 7.1. Almost all existing constructions belong to this class. (The theoretical construction based on bit commitments or one-way families of permutations from pZ)aPP94] does not.)... 

In this book, we need determinants only marginally so let us limit ourselves to several remarks. In the theory of determinants, well-expounded in any first course on Algebra, one begins with the concepts of permutation and its signature. A permutation P of numbers 1, 2, , N assigns, to the original order, another order according to the scheme... 

The permutation of operands is now detected (unless the two operands have the same signature, which has a probability of 1/A of occurring). The permutation of operators is also detected because the evolution of signatures depends on it ... 

---