💻 computer science

Efficient Pairing-Free Partially Blind Strong Designated-Verifier Signatures for Edge Environments

This paper presents a new, pairing-free partially blind strong designated-verifier signature scheme that ensures fine-grained privacy and non-transferability with low computational overhead, making it highly suitable for resource-constrained edge environments like IoT and vehicular networks.

Original authors: Panayiotis Kalogeropoulos, Panayiotis Kotzanikolaou, Christos Pilichos

Published 2026-09-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Panayiotis Kalogeropoulos, Panayiotis Kotzanikolaou, Christos Pilichos

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, a signature is usually a public act. When you sign a document online, anyone who sees the signature and has the right key can verify that it came from you. This transparency is useful for contracts and public records, but it creates a problem for privacy. Imagine a doctor sending a confidential report to a specific insurance adjuster. If that report is signed in a standard way, anyone who intercepts it could verify it was sent by the doctor. This turns a private exchange into public evidence, potentially exposing sensitive details to strangers or allowing the message to be shared beyond its intended recipient. To solve this, cryptographers have developed a tool called a designated-verifier signature. In this system, a message is signed in such a way that only one specific person—the designated verifier—can confirm it is real. To everyone else, the signature looks like random noise, offering no proof of its origin. This protects the privacy of the exchange, ensuring that even if the message is stolen, it cannot be used as transferable evidence against the sender.

However, real-world scenarios often require a bit more nuance. Sometimes, the person signing a message needs to see some public information, like a date or a location code, but must remain completely blind to the private content, such as a specific medical diagnosis or a financial amount. This is known as a partially blind signature. Combining these two needs—a signature that is both partially blind and restricted to a single verifier—is a difficult cryptographic challenge. Existing solutions for this have relied on complex mathematical operations that are slow and energy-hungry, making them impractical for small, battery-powered devices like those found in cars, drones, or smart sensors. These devices often operate in environments where milliseconds matter and power is scarce.

A team of researchers from the University of Piraeus has introduced a new method to solve this problem, creating a system that is both privacy-preserving and highly efficient. They developed a new type of signature scheme that allows a sender to hide private details while including public context, all while ensuring that only the intended recipient can verify the message. The key innovation is that their system avoids the heavy, slow mathematical calculations that have plagued previous attempts. Instead of using complex pairing operations that drain battery life and slow down processing, their method relies on standard, faster elliptic-curve math. This makes it possible to run these privacy protections on small, resource-constrained devices without sacrificing speed or security.

The researchers tested their new system on a Raspberry Pi 4, a small computer often used to represent the capabilities of modern edge devices like roadside sensors in traffic networks or communication hubs for drone swarms. They found that the system could generate a signature in about 1.5 milliseconds and verify it in roughly 0.6 milliseconds. These times are fast enough to handle the high-speed, real-time demands of safety-critical applications, such as vehicles broadcasting their location to avoid collisions or drones coordinating in a swarm. In a test where the device used all four of its processor cores to handle multiple tasks at once, the system could verify nearly 6,000 messages per second. This level of performance suggests that the technology is ready for real-world deployment in environments where devices must be both secure and efficient.

Beyond just speed, the researchers also looked at the security of the system. They proved mathematically that the scheme works as intended: the signer cannot learn the hidden private message, and the designated verifier cannot create a fake signature that looks like it came from the signer, nor can they prove to a third party that the signer actually sent the message. This last point is crucial for non-transferability; it means the verifier cannot take the signature and show it to a judge or a news outlet to prove the sender's involvement, because the verifier could have generated an identical-looking signature themselves. The researchers also identified flaws in a previous, popular method for achieving similar goals, showing that the older equations did not actually work as claimed. By discarding those flawed approaches and building a new, pairing-free system, they have provided a more reliable foundation for privacy.

The practical implications of this work are significant for the growing network of connected devices. In a world where cars talk to roads, drones talk to each other, and medical sensors talk to hospitals, protecting the privacy of these exchanges is essential. If a vehicle broadcasts its location, it should be able to do so in a way that only the traffic management center can verify, without allowing a hacker to track the car's movements or use the message to frame the vehicle's owner. The new system allows for this kind of selective verification while keeping the computational cost low enough for the small chips inside these devices. The researchers made their code available to the public, inviting others to test and build upon their work. By removing the heavy mathematical burden of previous systems, they have opened the door for privacy-preserving authentication to become a standard feature in the edge environments that are increasingly shaping our daily lives.

Technical Summary: Efficient Pairing-Free Partially Blind Strong Designated-Verifier Signatures for Edge Environments

Problem Statement
Traditional digital signatures allow any party with the signer's public key to verify authenticity, which can compromise privacy in sensitive scenarios. Designated Verifier Signature Schemes (DVSS) address this by restricting verification to a specific recipient, ensuring non-transferability. However, existing Partially Blind Designated Verifier Signature Schemes (PB-DVSS) face significant limitations in resource-constrained edge environments (e.g., IoT, VANETs, UAVs). Current constructions, such as those by Xu et al. and Cao et al., rely heavily on computationally expensive bilinear pairings and often involve multi-round interactions. Furthermore, the authors identify a fundamental algebraic inconsistency in the foundational scheme by Xu et al. [12] that prevents it from achieving correctness as originally stated. These inefficiencies and correctness issues hinder the deployment of privacy-preserving authentication in real-time edge systems where low latency and high throughput are critical.

Methodology
The authors propose a new cryptographic primitive: the Partially Blind Strong Designated-Verifier Signature Scheme (PB–SDVSS). The construction is designed to operate entirely over standard prime-order elliptic-curve groups, eliminating the need for bilinear pairings.

Protocol Structure: The scheme involves three entities: a Signer ( $S$ ), a Designated Verifier ( $V$ ), and a User ( $U$ ). It supports a message pair $(m, \text{info})$ , where $m$ is a private message component (blinded by the user) and $\text{info}$ is public information visible to the signer.
Algebraic Core: The protocol utilizes standard elliptic curve operations (point multiplication, scalar addition) and hash functions modeled as Random Oracles.
- Signing: The user blinds the request using random values ( $u_1, u_2, d$ ) and interacts with the signer. The signer computes responses based on their secret key and the blinded challenge. The user then unblinds the response to form the final signature $\sigma = (x^\star, \alpha^\star, \text{sig}_1, \text{sig}_2)$ .
- Verification: The designated verifier uses their secret key to check two conditions: a hash consistency check ( $\alpha^\star = H(m, \text{info}, x^\star)$ ) and an algebraic verification equation involving the signer's public key, the verifier's public key, and the signature components.
- Simulation: A key feature of Strong DVSS is that the designated verifier can simulate valid signatures without the signer's interaction. The authors provide an algorithm for the verifier to generate signatures indistinguishable from real ones, ensuring non-transferability.
Security Model: The scheme is proven secure in the Random Oracle Model (ROM) under the Computational Diffie–Hellman (CDH) assumption. The security properties include:
- Perfect Partial Blindness: The signer learns nothing about the private message $m$ beyond the agreed public $\text{info}$ .
- Strong One-More Unforgeability: An adversary cannot produce more valid signatures than the number of signing interactions they have completed.
- Designated-Verifier Non-Transferability: The verifier cannot convince a third party of the signature's origin because they can generate indistinguishable transcripts themselves.

Key Contributions

Pairing-Free Efficiency: The authors present the first PB–SDVSS construction that completely eliminates bilinear pairings, relying solely on standard elliptic-curve operations. This contrasts with existing schemes (e.g., Xu et al. requiring 7 pairings, Cao et al. requiring 4) that are computationally heavy for edge devices.
Cryptanalysis of Existing Literature: The paper provides a rigorous algebraic analysis revealing that the scheme proposed by Xu et al. [12] contains fundamental inconsistencies that prevent it from achieving correctness, justifying the exclusion of this scheme from performance benchmarks.
Formal Security Framework: A unified formal definition for PB–SDVSS is established, combining partial blindness with strong designated-verifier properties. Formal proofs are provided for perfect partial blindness, strong one-more unforgeability (under CDH), and non-transferability.
Open-Source Implementation and Evaluation: The authors provide a fully open-source implementation and conduct extensive experimental evaluations on a Raspberry Pi 4, representing a typical IoT edge gateway.

Experimental Results
The evaluation was conducted on a Raspberry Pi 4 (ARM Cortex-A72) using NIST P-256 and other elliptic curves.

Performance: On NIST P-256, the scheme achieves a signing time of approximately 1.5 ms and a verification time of 0.6 ms.
Throughput: The single-core system supports ~656 signing operations per second and ~1,544 verification operations per second. With four-core parallel execution, throughput increases to ~2,607 signings/sec and ~5,984 verifications/sec.
Comparison: Compared to pairing-based baselines (Cao, Sharma, Zhang–Wen) implemented on the same hardware, the proposed scheme demonstrates significant speedups. For instance, in the OpenSSL setting, PB–SDVSS achieves up to 7.5x higher signing throughput and 27.5x higher verification throughput compared to the Zhang–Wen baseline.
Robustness: The verification cost remains stable even when processing invalid or malformed signatures, indicating resistance to denial-of-service attacks via malformed inputs.
Overhead: The signature size is compact at 130 bytes (1040 bits) for NIST P-256, suitable for bandwidth-constrained environments.

Significance and Claims
The paper claims that PB–SDVSS is a highly suitable cryptographic building block for privacy-sensitive and resource-constrained environments. By removing the computational bottleneck of bilinear pairings, the scheme enables fine-grained message privacy and non-transferable authentication in scenarios such as:

UAV Swarms: Where leaders sign blinded aggregates of swarm data for Ground Control Centers.
Vehicular Ad Hoc Networks (VANETs): Supporting location privacy while allowing trusted Roadside Units (RSUs) to verify safety beacons.
IoT and Edge Computing: Providing lightweight authentication for medical IoT, smart homes, and decentralized systems.

The authors emphasize that the scheme fits within the strict latency budgets (often < 50 ms) required for safety-critical applications like V2I communication. They conclude that the combination of theoretical security proofs and practical embedded performance validates the scheme's utility for next-generation edge authentication systems. Future work is identified as integrating the scheme into real-world VANET and UAV swarm environments and exploring proof-carrying variants for non-delegatability.

More like this