Definition 1. A sequential aggregate signature (SAS) scheme SAS = (KeyGen, AggSign, AggVerify) consists of three algorithms:

KeyGen(1k): KeyGen(1k) generates public and secret key pair (PKi,SKi)of each user Ui.

AggSign: AggSign takes as inputs a secret key SKi, a message mi∈{0,1}∗, and a sequential aggregate-so-far signature σ on messages m1,m2,⋯,mi−1 under respective public keys PK1,PK2,⋯,PKi−1, where m1 is the inmost message. If i=1, the aggregate-so-far σ is taken to be empty. It adds a signature on mi under SKi to the aggregate, outputting a sequential aggregate σ′ on all messages m1,m2,⋯,mi.

AggVerify: AggVerify takes as inputs a sequential aggregate signature σ, messages m1,m2,⋯,mi, and public keys PK1,PK2,⋯,PKi, outputs 1 if σ is a valid sequential aggregate (with m1 inmost) on the given messages under the given keys, otherwise outputs 0.

Fig. 1 shows how a sequential aggregate signature scheme works. SAS schemes can reduce bandwidth and save storage; moreover, when a SAS is verified, not only the valid but also the order in which each signer signed can be verified.

Let SAS = (KeyGen; AggSign; AggVerify) be a sequential aggregate signature scheme. To give the security model of SAS schemes, we consider the following game associated to a challenger C and a forger A. A’s advantage, AdvAggSig_A, is defined to be his probability to win in the game.

Setup. The aggregate forger A is provided with a public key PK, generated at random.

Queries. Proceeding adaptively, A requests sequential aggregate signatures with PK on messages of his choice. For each query, he supplies a sequential aggregate signature σ on some messages m1,m2,⋯,mi−1 under distinct keys PK1,PK2,⋯,PKi−1, and an additional message mi to be signed by the oracle under key PK (where i is at most N, a game parameter).

Response. Finally, A outputs i distinct public keys PK1,PK2,⋯,PKi. Here i is at most N. One of these keys must equal PK, the challenge key. Algorithm A also outputs messages m1,m2,⋯,mi, and a sequential aggregate signature σ by the i users, each on his corresponding message, with PK1 inmost.

The forger wins if the sequential aggregate signature σ is a valid sequential aggregate signature on messages m1,m2,⋯,mi under keys PK1,PK2,⋯,PKi, and σ is nontrivial, i.e., A did not request a sequential aggregate signature on messages m1,m2,⋯,mi∗ under keys PK1,PK2,⋯,PKi∗, where i∗ is the index of the challenge key PK in the forgery. Note that i∗ need not equal i. The probability is over the coin tosses of the key-generation algorithm and of A.

Definition 2. We say a sequential aggregate forger A (τ,qh,qs,N,ε)-breaks an N-user aggregate signature scheme in the sequential aggregate chosen-key model if: A runs in time at most τ; A makes at most qh queries to the hash function and at most qs queries to the aggregate signing oracle; AdvAggSig_A, is at least ε, and the forged sequential aggregate signature is by at most N users. A sequential aggregate signature scheme is (τ,qh,qs,N,ε) -secure against existential forgery in the sequential aggregate chosen-key model if no forger (τ,qh,qs,N,ε)-breaks it.

A binary [n, k]-code C is a linear subspace of dimension k of the linear space F2n. Elements of F2n are called words and elements of C are codewords. A code is usually given in the form of a (n−k)×n parity check matrix H. The codewords of C are words x that satisfies HxT=0. A syndrome s∈F2n−k is a vector s=HxT for a word x. The support of a word x=(x1,x2,⋯,xn) is defined as support(x)={i|xi≠0}. The Hamming weight of a word x denoted by wt(x) is the cardinality of support(x). The Hamming distance d(x,y) between two words x, y is defined as wt(x−y). The minimum distance d of a [n, k]-code C is min{d(x,y)|x≠y}. A syndrome s is said to be decodable according to a t-error correcting code if there exists a word x∈F2n such that s=HxT with wt(x)≤t. We recall that decoding a syndrome s is retrieving such a word x. Decoding in a random linear code is difficult, which we will restate soon later.

Goppa codes are subfield subcodes of particular alternant codes with efficient decoding algorithm. Goppa codes are widely used in coding-based cryptography. For given integers m and t, Goppa codes are of length n=2m, of dimension k = n − mt and are t-correcting. The density of decodable syndromes is approximately 1t! [13]. We denote by DecodeH the decoding algorithm associated with a Goppa Code of parity check matrix H.

In order to establish the security of the CFS signature and the pro-posed SAS, we introduce some problems on coding theory.

Definition 3. Goppa Bouned Decoding Problem (GBD): Given a random (n−k)×n binary matrix H, a syndrome s∈F2n−k, output a word e∈F2n of weight wt(e)≤n−klog2⁡n such that s=HeT.

The associated decision problem of GBD is NP-complete [28].

Definition 4. Multiple Goppa Bounded Decoding (MGBD): Given a random (n−k)×n binary matrix H, an arbitrary number c>0 and a syndrome s∈F2n−k , output a word e∈F2n of weight wt(e)≤cn−klog2⁡n such that s=HeT.

The associated decision problem of MGBD is conjectured to be NP-complete, too [29].

Definition 5. We say an algorithm A is (τ,ε)-solves MGBD(GBD) if A runs in time at most τ, and outputs a word e∈F2n of weight wt(e)≤cn−klog2⁡n (wt(e)≤n−klog2⁡n) with at least probability ε, such that s=HeT.

Lemma 1. There is no algorithm A which is (τ,ε)-solves MGBD and GBD.

Let Wn,t={e∈F2n|w(e)≤t}, l=⌊log2|Wn,t|⌋, To describe the CFS signature and the proposed SAS, we need a one to one function ϕ:Wn,t→{0,1}l. For the construction of such function ϕ and its inverse ϕ−1, refer to [30].

The basic idea of code-based cryptography is using a certain code which has efficient decoding algorithm with trapdoor information as private key and publishing the random look like variant of this code as public key.

The first code-based signature is the CFS signature which was introduced by Courtois, Finiasz and Sendrier at Asiacrypt 2001 [13]. The CFS signature is obtained by applying full hash domain approach to the Niederreiter public key cryptosystem. The CFS signature we will describe below is a minor modification of the original CFS signature, and this modified CFS signature enables us to prove its security more reasonable in random oracle [15,30]. The CFS signature consists of three algorithms which are described as follows:

SystemParameters: Two integers m,t∈N.

CFSKeyGen (1κ): CFSKeyGen (1κ) generates a [n, k, d]-binary Goppa code C (n=2m, k=n-mt, d = 2t+1) with parity check matrix H0, then C is a t-error correcting code, let its efficient decoding algorithm is DecodeH0. CFSKeyGen (1κ) generates a random (n−k)×(n−k) invertible matrix S and a random n×n permutation matrix P. Let H=SH0P, then H is a parity check matrix of the code C′ which is a permuted code of C. C′ is also a t-error correcting Goppa code, let its efficient decoding be DecodeH(obtained from S, P, DecodeH0). Finally, CFSKeyGen (1κ) outputs H as the public key, and the corresponding private key is DecodeH.

Sign: Let h:{0,1}∗→{0,1}n−k be a hash function. Let r=⌈log2(t!)⌉. To sign a message m, Sign does

choose s randomly from {0,1}r;

Let z=ϕ(x) then the signature on m is (z,s).

Verification: Let x=ϕ−1(z). The signature is valid if and only if HxT=h(m‖s) holds.

Security of the CFS Signature: The security of the CFS signature is based on two assumptions: One is the intractability of GBD as stated in Lemma1; the other is the intractability of the Permuted Goppa Code Distinguish (PGD) which we will describe below.

Definition 6. Permuted Goppa Code Distinguish Problem (PGD): Given H generated by CFSKeyGen (1κ) as the public key in the CFS signature, the Permuted Goppa Code Distinguish Problem is to distinguish H from a parity check matrix of a random linear code.

Definition 7. We say an algorithm A is (τ,ε)-solves PGD if A runs in time at most τ, and can distinguish H from a parity check matrix of a random linear code with probability at least 12+ε.

Lemma 2 ( [13,15]). There is no algorithm A which is (τ,ε)-solves PGD.

Because of Lemma 2, we can apply Lemma 1 to permuted Goppa code. In fact, we have

Definition 8. Permuted Goppa Code Bounded Decoding (PGBD): Given H generated by CFSKeyGen (1κ) as the public key in the CFS signature, an arbitrary number c>0 and a syndrome s∈F2n−k, the Permuted Goppa Code Bounded Decoding Problem is to output a word e∈F2n of weight wt(e)≤cn−klog2⁡n(=ct, since n−k=mt, n=2m) such that s=HeT. We say an algorithm A is (τ,ε)-solves PGBD, if A runs in time at most τ, and can output the demanding vector e with at least probability ε.

Lemma 3 ( [13]). There is no algorithm A which is (τ,ε)-solves PGBD.

We firstly introduce some notations for vectors. We write a vector as x and its length |x|. The elements of x are x1,x2,⋯,x|x|. For a vector x, x|ab denotes the subvector contains elements xa,xa+1,⋯,xb. Suppose z∈{0,1}l, where l=⌊log2|Wn,t|⌋, if needed, n−k−l 0’s can be padded to z to obtain an n−k dimension vector z¯=(00⋯0⏟n−k−l‖z). Meanwhile, for a vector z=(00⋯0⏟n−k−l‖z), the unpadding of z is denoted by z^=x.Henceforward, we denote by M the message vector whose elements are m1,m2,⋯,mi, and denote by H the public key vector whose elements are H1,H2,⋯,Hi.

The proposed SAS consists of three algorithms which are described below:

SystemParameters: Two integers m,t∈N.

KeyGen (1κ): For each user Ui (1≤i≤n), KeyGen (1κ) generates the key pair (Hi,DecodeHi) (Hi is the public key, and the corresponding private key is DecodeHi) just as CFSKeyGen (1κ) does in the CFS signature.

AggSign: The inputs are a secret key DecodeHi, a message mi∈{0,1}∗, and a sequential aggregate-so-far signature σ′=(z′,s1,s2,⋯,si−1) on messages M(message vector whose elements are m1,m2,⋯,mi−1) under public keys H(public key vector whose elements are H1,H2,⋯,Hi−1). Let h:{0,1}∗→{0,1}n−k be a hash function. Let r=⌈log2(t!)⌉. To sign, AggSign does

choose si randomly from {0,1}r;

Let z=ϕ(x), then the sequential aggregate signature on messages M(whose elements are m1,m2,⋯,mi−1) under public keys H( whose elements are H1,H2,⋯,Hi−1) is σ=(z,s1,s2,⋯,si).

AggVerify: The input is a sequential aggregate signature σ=(z,s1,s2,⋯,si) on messages M under public keys H. To verify, let i=|H|=|M|, set zi=z. Then for j=i,i−1,⋯,1, compute mj−1=Hj(ϕ−1(zj))T⊕(h(H|1j,M|1j,sj) and set zj−1=mj−1^. Accept if z0=0.

Correctness of the proposed scheme. From the process of AggVerify, we know that (1)z0=H1(ϕ−1(z1))T⊕h(H1,m1,s1)^

On the other hand, if the sequential signature is computed correctly, from the process AggSign we have, (2)z1=ϕ(DecodeH1(h(H1,m1,s1)⊕0)which implies H1(ϕ−1(z1))T⊕h(H1,m1,s1)=0. Hence, if the sequential aggregate signature is valid, we have z0=0.

In this section, we prove the security of the proposed SAS in the random oracle model, we will prove the security of our scheme based on the assumption in lemma 3.

To make the proof easier, we firstly prove the following lemma.

Lemma 4. There is a forger A (τ,qh,qs,N,ε)-breaks the proposed SAS, if and only if there is an forger B(τ′,qh,qs,N′,ε)-breaks the proposed SAS with the target public key is the last key in the key sequence.

Proof: The lemma can be immediately obtained by the observation that during the AggVerify phase of our scheme, supposing σ=(z,s1,s2,⋯,si) on messages M under public keys H, each sequential aggregate signature on M|1j under H|1j (1≤j≤i) can also be achieved.

Henceforward, we suppose that matrix-vector multiplication, exclusive or of vectors and the computation of ϕ and ϕ−1 take unit time. The security of our scheme is obtained from the following theorem.

Theorem 1. If there is a (τ,qh,qs,N,ε) forger A to break the proposed SAS, then there exists an algorithm (τ′,ε′) B to solve the Permuted Goppa Code Bounded Syndrome Decoding of Problem (PGBD) for c=2, with (3)ε′≥(1/12r2r)N(qs+1)−qsε,τ′≤τ+(qH+NqS+N)(3N+1)+3N+2 where r=⌈log2(t!)⌉.

Proof: If A is (τ,qh,qs,N,ε) forger to break the proposed SAS. From Lemma 4, we can assume, without loss of any generality, that the forgery aggregate signature generated by A has the target public key is the last key i.e., the N-th key in the public key sequence.

Below we will show that if there is an algorithm A is (τ,qh,qs,N,ε) forger to break the proposed SAS, we can construct an algorithm B which is (τ′,ε′)-solves PGBD for c=2, which contradicts the assumption in lemma 3. The algorithm B is constructed as follows:

B is given a parity check matrix H of a random [n, k, d]-binary permuted Goppa code (n=2m, k=n-mt, d = 2t+1), a challenge syndrome y∈{0,1}n−k, B’s goal is to find x∈{0,1}n with wt(x)≤2t such that HxT=y. B sends H as the target public key to A. B runs A and answers its oracle queries as follows.

Hash queries: The random hash function h has two properties: i.e., the property that the outputs of h are random and the property that one output from t! outputs is decodable. B simulates the hash function as follows.

B maintains a list of tuples <H(j),M(j),s(j),w(j),z(j),c1(j),c2(j)> as the hash queries’ list. We call this list the h-list. When A queries the hash oracle at point <H,M,s> B responds as below:

If the query <H,M,s> is already on the h-list, then B finds the entry <H,M,s,w,z,c1,c2> and outputs w as the answer to the query, i.e., w=h(H,M,s).

2.1 c1′=1: B sets w←w0, z←∗, c2←∗ (∗ is a placeholder value.).

2.2 c1′=0: If i<N and c1=1, B sets w←w0, z←∗, c2←∗. If i<N and c1=0, B sets w←Hiz0T⊕ϕ(z′)¯, and sets z←z0, c2←∗. If i=N, B generates another coin c2∈{0,1} such that Pr[c2=0]=1t!−1. If i=N, c1=1 and c2=1, B sets w←w0, z←∗. If i=N, c1=1 and c2=0, B sets w←Hz0T⊕ϕ(z′)¯⊕y, z←z0. If i=N, c1=0, B sets w←Hz0T⊕ϕ(z′)¯, z←z0 and c2←∗.

3. Finally, B adds <H,M,s,w,z,c1,c2> to the h-list, and responds to the query as w=h(H,M,s).

In all cases, B’s response, w, is indistinguishable from the random oracle.

Aggregate signature queries: A supplies a sequential aggregate signature σ′=(z′,s1,s2,⋯,sN−1) on messages M|1N−1 under keys H|1N−1. A requests a sequential aggregate signature on message M (MN=m), under keys H (HN=H). Firstly, B uses AggVerify to ensure that σ′ is the correct sequential aggregate signature on M|1N−1 under keys H|1N−1. If σ′ is incorrect, B responds with a placeholder value ∗. Otherwise, B runs the hash algorithm on (H, M) to obtain <H,M,s,w,z,c1,c2>. If c1=0, B responds to the query with σ←(ϕ(z),s1,s2,⋯,s), we will show later that σ is the correct sequential aggregate signature on (H, M). Otherwise, B reports failure and terminates.

B’s output:At last, algorithm A halts and produces a correct forgery sequential aggregate signature σ∗=(z∗,s1,s2,⋯,sN) on (H∗,M∗), where HN∗=H, and (H∗,M∗) is not queried to the aggregate signature queries. B now runs the hash algorithm on (H∗,M∗,sN), and obtains <H∗,M∗,s,w,z,c1,c2>. If c1=1 and c2=0, B then computes x=z⊕ϕ−1(z∗) and outputs x, we will show later that HxT=y with wt(x)≤2t.

This completes the description of algorithm B.

Claim 1. If A makes a valid sequential aggregate signature query on (H, M) with HN=H, supplying a correct sequential aggregate signature σ′=(z′,s1,s2,⋯,sN−1) on messages M|1N−1 under keys H|1N−1, then either B reports failure and halts or B’s output σ←(ϕ(z),s1,s2,⋯,s) is the correct sequential aggregate signature on (H, M).

Proof: Firstly, we introduce some notations. For each j, 1≤j≤N, B’s hash algorithm associates with input (H|1j, M|1j) a tuple <H1j,M1j,s(j),w(j),z(j),c1(j),c2(j)>. If B does not abort, then c1(j)=0, c2(j)=∗ for 1≤j≤N. It is reasonable to assume that (H|1j, M|1j) is queried to the hash query before it is signed, for the hash function is random oracle. Hence, from the hash algorithm, we obtain that z=z(N),z′=ϕ(z(N−1)), s=s(N) and s(j)=sj (1≤j≤N−1). Also from the hash algorithm, we know that (4)z′=ϕ(z(N−1))=h(H1N,M1N,s)⊕HzT (5)z(j)=ϕ−1(h(H1j+1,M1j+1,s(j+1))⊕Hj+1(z(j+1))T) (6)z(j)=ϕ−1(h(H1j+1,M1j+1,s(j+1))⊕Hj+1(z(j+1))T)(1≤j≤N−2) H1(z(1))T⊕h(H1,m1,s(1))=0

The last equation shows that σ←(ϕ(z),s1,s2,⋯,s) is a valid sequential aggregate signature on (H, M).

Claim 2: If A outputs a valid nontrivial forgery sequential aggregate signature σ∗=(z∗,s1,s2,⋯,sN) on (H∗,M∗), then B either reports failure and halts or outputs the correct solution x such that HxT=y with wt(x)≤2t.

Proof: We use the same notations introduced in Claim 1. If B does not abortion, then c1(N)=0, c2(N)=0. Hence, from the hash algorithm, we know that (7)h(H∗,M∗,sN)=H(z(N))T⊕ϕ(z(N−1))¯⊕y

Thus, (8)H(ϕ−1(z∗))T=h(H∗,M∗,sN)⊕ϕ(z(N−1))=H(z(N))T⊕ϕ(z(N−1))⊕y⊕ϕ(z(N−1))=H(z(N))T⊕y

And hence, we can obtain that if we set x=z(N)⊕ϕ−1(z∗), then HxT=y with wt(x)≤2t.

It remains to show that the success probability ε′ that B outputs x is at least (1/12r2r)N(qs+1)−qsε. We define three events as below:

E1: B does not abort during the qs aggregate signature queries phase.

E2: A outputs a valid and nontrivial forgery sequential aggregate signature.

E3: B does not abort during the output phase.

Then B succeeds in giving the correct solution if all of the above events happen, i.e., ε′=Pr[E1∧E2∧E3]=Pr[E1]⋅Pr[E2|E1]⋅Pr[E3|E1∧E2].

On the other hand, we have the following three claims.

Claim 3. Pr[E1]=(12r)(N−1)qs.

Proof: If B does not abort during each aggregate signature query, then all c1(j)=0(1≤j≤N−1), which implies the probability that B does not abort during each signature query is (12r)(N−1). Hence, the probability that B does not abort during the qs signature queries is Pr[E1]=(12r)(N−1)qs.

Claim 4. Pr[E2|E1]≥ε.

Proof: Trivially.

Claim 5. Pr[E3|E1∧E2]=(12r)N .

Proof: If B does not abort during the output phase, then all c1(j)=0(1≤j≤N−1), c2(N)=0 which implies the probability that B does not abort during the output phase is (12r)(N−1).12r=(12r)N . Hence, Pr[E3|E1∧E2]=(12r)N.

Combine the results of the above claims, we obtain immediately that ε′≥(1/12r2r)N(qs+1)−qsε.

The running ting τ′ of B equal to the running time τ plus the time of B’s time to respond A’s qH hash queries and qs aggregate signature queries, each hash query involves at most N matrix-vector multiplication, at most N+1 exclusive or of vectors and at most N computation of the function ϕ. Each aggregate signature query needs at most N hash queries, at most N computation of ϕ and ϕ−1, N exclusive or of vectors. At last, in order to give x, B needs one exclusive or of two vectors and N hash queries. Then, the total time of B’s is at most (9)τ+(qH+NqS+N)(3N+1)+3N+2