A leakage-resilient cryptosystem remains secure even if arbitrary, but bounded, information about the secret key (and possibly other internal state information) is leaked to an adversary. Denote the length of the secret key by n. We show: 1. A full-fledged signature scheme tolerating leakage of n - n~ε bits of information about the secret key (for any constant ε > 0), based on general assumptions. 2. A one-time signature scheme, based on the minimal assumption of one-way functions, tolerating leakage of (1/4 - ε)·n bits of information about the signer's entire state. 3. A more efficient one-time signature scheme, that can be based on several specific assumptions, tolerating leakage of (1/2 - ε)·n bits of information about the signer's entire state. The latter two constructions extend to give leakage-resilient t-time signature schemes. All the above constructions are in the standard model.
展开▼
