# What is the notion behind proxy re-signatures?

Concept of Proxy Signatures serving the main purpose of delegation is clear.

But what exactly is proxy re-signatures? How and why is it performed? Does it use the same warrant generating and proxy signing mechanisms?

Thanks!

-
You might get a quicker answer at cstheory.stackexchange.com. –  Qiaochu Yuan Mar 1 '11 at 15:24

The way cryptographic signatures work in public key cryptosystems is as follows: Alice has a private key $d$ and a public key $e$. Everyone knows $e$, and presumably only Alice knows $d$. In order to "sign" a message, Alice writes, for instance, "This is Alice, and I approve this message" (plus some hash to ensure that the signature really belongs to that particular message) and then uses her private key to encrypt this message. Everyone receives a cryptotext which they can decrypt with Alice's public key to read the message. Since, presumably the only person who knows Alice's private key is Alice, and the only way to encrypt a message that will get decrypted with the public key is to use the private key, this assures the reader that it is indeed Alice who approves of the message.

In a proxy signature scheme, you have the same situation as in real life proxys. Alice doesn't want to take the trouble to sign a bunch of stuff, so she delegates this responsibilty to Bob. Bob will sign messages in Alice's name. However, Alice does not want to tell Bob what her private key is so that Bob can sign the messages in Alice's name, so a set-up has to be provided whereby Alice gives Bob enough information so that Bob can sign Alices's name on the messages, without having the necessary information to go ahead an read all of Alice's mail with her private key.

This is often done by the use of a "proxy-server" or an intermediary, who mediates between Bob and Alice; Bob signs his name, and the proxy "translates" Bob's signature into a valid Alice signature in some way (for example, the proxy and Bob are each given partial information about the private key, which is not enough by itself to break Alice's key, and each can generate a "partial" Alice-signature. They are then combined into a full signature.) The proxy must be trusted, however, because if the proxy and Bob cooperate, then they can fake Alice's signature on any document, well beyond those that were originally delegated to him.

In a proxy re-signature scheme, the idea is that the proxy is only semi-trusted (so protecting Alice's key and signature does not depend on the proxy not cooperating with Bob to usurp Alice's prerrogatives).

Here, the proxy takes a valid signature from Alice in a document, and translates it into a valid signature from Bob in the same document or other documents, which are then further counter-signed by Bob for validity. The process is meant to be such that in order to do the translation, the proxy does not learn anything about Alice's signing key or Bob's; thus, there can be no cooperation between Bob and the proxy to fake Alice's signature. Moreover, the resignature is meant to be done without access to either key, so that Alice and Bob can keep their keys secure and off-line.

That said, I don't really know much about the mechanics of how one sets these up, so I cannot answer that part of your question.

-