Blind Delegation of Quantum Digital Signature

This protocol performs the task of Quantum Digital Signature such that the Signer does not get to know the content of the message being signed. It ensures that the owner cannot deny at a later stage having signed the message, a receiver cannot fake or alter the QDS and the verifier can use the above two properties to verify if the sent message is signed by the genuine sender, thus, satisfying properties of transferability, non-repudiation, and unforgeability.

Assumptions

Honest majority assumption: assumes that more than half the number of participating parties are honest. In the present case, at least two parties are honest.
It requires authenticated classical channel and insecure quantum channels.

Outline

The Blind QDS Protocol consists of 5 stages: setup, key distribution, message blinding, signing and verification. Each pair of participants share a unique key using Simon et al.'s QKD Algorithm.

Setup

There are 3 participants. The owner is the one who will transform the message into a matrix form and blind it. The signer will sign it. The verifier is the one who checks if a signature matches a message.

Key Distribution

All three pairs establish their pairwise quantum key matrices using the QKD protocol.

Message Blinding

The owner of the message now converts the message into matrix format. Then (s)he blinds the message matrix using the key shared with the verifier by multiplying the matrices. Now, (s)he encrypts the blind message with the key shared with the signer by multiplying the matrices. Finally, (s)he sends the encrypted matrix and the determinant of the blinded matrix to the signer and only the determinant of the message matrix to the verifier.

Signing

The signer creates a signature for the blinded message which means that he does not know the message matrix. He decrypts the encrypted message with his shared key to obtain the blinded message and checks its authenticity by comparing its determinant value with the received value. He then creates the signature using the blinded message and the key shared with the verifier and sends it to the verifier.

Verification

The verifier decrypts the signature using his key shared with the signer. Next, he un-blinds the blinded message using the key shared with the owner. He verifies the message matrix by comparing its determinant value with the received value.

Notations

$K_{AB}$ : Set of quantum key matrices shared between Owner and Signer.
$K_{BC}$ : Set of quantum key matrices shared between Signer and Verifier.
$K_{AC}$ : Set of quantum key matrices shared between Owner and Verifier.
$M$ : Set of message matrices to be signed.
$M'$ : Set of Blinded message matrices.
$M''$ : Set of Blinded and Encrypted message matrices.
$S$ : Set of Signature matrices.
$\alpha$ : Number of elements in every set.

Hardware Requirements

Requires Simon et al.'s QKD setup.
Insecure quantum and authenticated classical channels.

Properties

The protocol provides security against both the forgery and repudiation attacks.
The protocol can sign long messages and is not restricted to binary ones.
The protocol has the ability to detect errors due to the usage of Fibonacci, Lucas and Fibonacci-Lucas matrices.
The protocol uses the setup of Simon et al.'s QKD algorithm to distribute quantum keys.

Pseudo Code

Every pair of parties share different quantum key matrices $K_{AB}$ , $K_{AC}$ and $K_{BC}$ respectively using Simon et al.’s QKD algorithm. The key matrices $K_{AB}$ , $K_{AC}$ and $K_{BC}$ are either Fibonacci or Lucas or Fibonacci-Lucas matrices. The protocol consists of 5 stages:

Setup
1. The owner who transforms the message into an $n$ -square matrix and blinds the matrix.
2. The signer who signs the blind message.
3. The verifier who checks if a signature matches the message.
Key Distribution
1. Every pair uses Simon et al.'s QKD protocol to establish their pairwise key matrices $\{K_{AB}^{1},K_{AB}^{2},...,K_{AB}^{\alpha }\}=K_{AB}$ between Owner and Signer; $\{K_{BC}^{1},K_{BC}^{2},...,K_{BC}^{\alpha }\}=K_{BC}$ between Signer and Verifier; $\{K_{AC}^{1},K_{AC}^{2},...,K_{AC}^{\alpha }\}=K_{AC}$ between Owner and Verifier.
Message Blinding
1. The Owner transforms the message into matrices $(M_{1},M_{2},...,M_{\alpha })=M$ where $M_{k}=(m_{tj})_{n\times n}$ , $k\in \{1,2,...,\alpha \},t,j\in \{1,2,...,n\}$ .
2. The Owner blinds the message matrix using $K_{AC}$
  $M'_{k}=M_{k}\times K_{AC}^{k}k\in \{1,2,...,\alpha \}$
3. The Owner now encrypts the message matrix using $K_{AB}$
  $M''_{k}=M'_{k}\times K_{AB}^{k}k\in \{1,2,...,\alpha \}$
4. Finally, the Owner sends $(M''_{k},det(M'_{k}))$ to the Signer, and $det(M_{k})$ to the Verifier.
Signing
1. The Signer decrypts $M''_{k}$ with the key $K_{AB}^{k}$ to obtain $M'_{k}$ .
  $M'_{k}=M''_{k}\times (K_{AB}^{k})^{-1}$
  where $(K_{AB}^{k})^{-1}$ denotes the inverse matrix of $K_{AB}^{k}$ .
2. If the determinant of $M'_{k}$ recovered by the Signer is not equal to the value of the determinant obtained from the Owner, the Signer aborts the protocol. Otherwise, he performs the next step.
3. He signs the blind message $M'_{k}$ using $K_{BC}^{k}$ . The signature is
  $S^{k}=M'_{k}\times K_{BC}^{k}$
4. He then sends the signature $S=\{S^{1},S^{2},...,S^{\alpha }\}$ to the Verifier.
Verification
1. The Verifier decrypts the signature $S$ using $K_{BC}^{k}$ to obtain the blind message $M'$ .
  $M'_{k}=S^{k}\times (K_{BC}^{k})^{-1}$
2. The Verifier then un-blinds the message $M'$ using $K_{AC}^{k}$ to obtain the message $M$ .
  $M_{k}=M'_{k}\times (K_{AC}^{k})^{-1}$
3. He then checks if the determinant of $M$ obtained from the signature is the same as $det(M)$ obtained from the Owner. If it holds, he verifies the following equations:
  $det(S^{k})=det(M'_{k}K_{BC}^{k})=det(M'_{k})\times det(T_{p}^{n})$
  $=(-1)^{n}det(M'_{k})=(-1)^{2n}det(M_{k})$