标题： 一种基于同源的紧凑后量子强指定验证者签名方案 显示英文标题

标题： A Compact Post-quantum Strong Designated Verifier Signature Scheme from Isogenies

摘要： 数字签名是提供数字通信中认证和完整性的关键密码工具。 然而，隐私敏感的应用程序，如电子投票和数字现金，需要更严格的验证模型以确保机密性和控制。 强 指定验证者签名（SDVS）方案通过使签名者指定一个特定的验证者来解决这一需求，确保只有该方可以验证签名。 现有的SDVS构造主要基于数论假设，因此容易受到量子攻击。 尽管已经提出了后量子替代方案，特别是基于格的方案，但它们通常涉及较大的密钥和签名大小。 在本工作中，我们引入了$\mathsf{CSI\text{-}SDVS}$，一种新颖的基于同源的SDVS方案，提供了紧凑且抗量子的替代方案。 我们的构造建立在CSIDH的理想类群作用框架和CSI-FiSh的签名技术之上，并依赖于多目标群作用逆问题（MT-GAIP）的难度。 $\mathsf{CSI\text{-}SDVS}$实现了强大的安全保证；即，在随机预言模型下的选择消息攻击下强不可伪造性（SUF-CMA）、不可转移性（NT）和签名者身份的隐私性（PSI）。 值得注意的是，$\mathsf{CSI\text{-}SDVS}$中的密钥和签名的大小均为$\mathcal{O}(\lambda)$，相比现有后量子SDVS方案中的典型$\mathcal{O}(\lambda^2)$界限有了显著改进，从而使其成为最紧凑的基于PQC的SDVS方案之一，并且是唯一基于同源的后量子安全构造。 显示英文摘要

摘要： Digital signatures are essential cryptographic tools that provide authentication and integrity in digital communications. However, privacy-sensitive applications, such as e-voting and digital cash, require more restrictive verification models to ensure confidentiality and control. Strong Designated Verifier Signature (SDVS) schemes address this need by enabling the signer to designate a specific verifier, ensuring that only this party can validate the signature. Existing SDVS constructions are primarily based on number-theoretic assumptions and are therefore vulnerable to quantum attacks. Although post-quantum alternatives, particularly those based on lattices, have been proposed, they often entail large key and signature sizes. In this work, we introduce $\mathsf{CSI\text{-}SDVS}$, a novel isogeny-based SDVS scheme that offers a compact, quantum-resistant alternative. Our construction builds on the ideal class group action framework of CSIDH and the signature techniques of CSI-FiSh, and relies on the hardness of the Multi-Target Group Action Inverse Problem (MT-GAIP). $\mathsf{CSI\text{-}SDVS}$ achieves strong security guarantees; namely, Strong Unforgeability under Chosen-Message Attacks (SUF-CMA), Non-Transferability (NT), and Privacy of Signer's Identity (PSI), in the random oracle model. Remarkably, both the keys and signatures in $\mathsf{CSI\text{-}SDVS}$ are of size $\mathcal{O}(\lambda)$, representing a significant improvement over the typical $\mathcal{O}(\lambda^2)$ bounds in existing post-quantum SDVS schemes, thereby making it among the most compact PQC-based SDVS schemes and the only post-quantum secure construction based on isogenies.