Signatures Through Approximate Representations by Quadratic Forms

Abstract

We propose a signature scheme where the private key is a random (n, n)-matrix T with coefficients in ℤ_m=ℤ/mℤ, m a product of two large primes. The corresponding public key is A,m with A = T^⊤T. A signature y of a message z ∈ ℤ_m is any y∈(ℤ_m)ⁿ such that y^⊤ Ay approximates z, e.g. $\left| z-{{y}^{T}}Ay \right|<4{{m}^{{{2}^{-n}}}}$. Messages z can be efficiently signed using the private key T and by approximating z as a sum of squares. Even tighter approximations | z− y^⊤Ay| can be achieved by tight signature procedures. Heuristical arguments show that forging signatures is not easier than factoring m. The prime decomposition of m is not needed for signing messages, however knowledge of this prime decomposition enables forging signatures. Distinct participants of the system may share the same modulus m provided that its prime decomposition is unknown. Our signature scheme is faster than the RSA-scheme.