Practical Universal Designated Verifier Transitive Signature Proof Scheme for Graph-Based Data Systems

Transitive signatures are a special type of homomorphic signature proposed by Turing Award winners Micali and Rivest, which are highly suitable for authenticating dynamically growing graph-based data systems. In such a signature scheme, anyone with the signer's public key is allowed to generate a signature for a composed edge $(i,k)$, from two signatures on adjacent edges $(i,j)$ and $(j,k)$. To prevent the problem of malicious dissemination of signatures by verifiers leading to data privacy leakage, researchers have proposed a series of universal designated verifier transitive signature (UDVTS) schemes. However, existing work requires that the designated verifier create its own secret-public key pair using the public key parameters provided by the signer. Besides, these schemes suffer from significant performance defects due to expensive pairing or exponentiation operations. In this work, we design a pairing-free and exponentiation-free UDVTS proof scheme based on the SM2 digital signature algorithm and a zero-knowledge proof scheme. We prove the security of our construction based on rigorous cryptographic assumptions. The performance comparison with related work shows that our UDVTS proof scheme has an optimal computational cost and desirable communication cost. For example, compared to the state-of-the-art work, we reduce the signing cost by $70.54\%$ and the designated verification cost by $96.05\%$.