Are there any practical implementation of a homomorphic hashing or signature scheme?

Question

A homomorphic hash function is a function $H : A \to B$ between two sets with some algebraic structure $(A, *)$ and $(B, \star)$ such that

$H$ is collision resistant, i.e. it is hard to find $x \neq y$ such that $H(x) = H(y)$ and
$H$ is a homomorphism, i.e. $H(x * y) = H(x) \star H(y)$.

Are there any practical realizations of such a homomorphic hash function, or even a homomorphic signature scheme (i.e., where we can "add" valid signatures to get a signature of the "sum" of two messages)?

Even better, are there even any libraries implementing this?

You might want to add an additional constraint; the Identity function pedantically meets all the requirements listed; it is hard (impossible) to find $x \neq y$ with $I(x) = I(y)$, and for it homomorphic with any operation $\star$, that is, $I(A \star B) = I(A) \star I(B)$ — poncho, Feb 27 '13 at 22:20
@sashank, Your question is very broad. It would help if you gave more specific requirements specific to your particular problem, about exactly what algebraic structure you have on $A$ and $B$ in your particular application. Also, on this site we expect you to do some background research of your own to learn what is already known. — D.W., Feb 27 '13 at 22:20
Appears these system frequently depend upon the hardness of discrete log. I'd be interested in seeing a post-quantum homomorphic hash. — Jeff Burdges, Mar 24 '16 at 14:17

D.W. · Answer 1 · 2013-02-27T22:19:22.687

There's plenty of research in this area. I'll give you just a small sampling:

Speeding Up Homomorpic Hashing Using GPUs. Kaiyong Zhao. ICC 2009.
Transitive Signature Schemes. Silvio Micali, Ronald Rivest. CT-RSA 2002.
Homomorphic Signature Schemes. Robert Johnson, David Molnar, Dawn Song, David Wagner. CT-RSA 2002.
Sanitizable Signatures. Giuseppe Ateniese, Daniel H. Chou, Breno de Medeiros, Gene Tsudik. ESORICS 2005.
Linearly Homomorphic Signatures over Binary Fields and New Tools for Lattice-Based Signatures. Dan Boneh, David Freeman. PKC 2011.
Homomorphic Signatures for Polynomial Functions. Dan Boneh, David Freeman. Eurocrypt 2011.
Homomorphic MACs: MAC-Based Integrity for Network Coding. Shweta Agrawal, Dan Boneh. ACNS 2009.
On Homomorphic Signatures for Network Coding. A. Yun. IEEE Trans. Computers.

Like I said, this is only a small subset of the available research in this area. I found most of these through about 5 minutes with Google Scholar. I recommend you start by doing a literature review to familiarize yourself with the research literature on this subject: search to find as many relevant papers as possible; read each such paper; for each paper you find, read the related work section and bibliography to try to identify other relevant papers, and also use Google Scholar or other sites to find other papers that cite that paper that might be relevant; for each additional relevant paper you find, repeat the process.

After you have done this process, you should be in a better position to ask a more narrowly targeted question with a particular set of requirements -- or, if you're lucky, you might have found a solution to your particular problem already described in the literature!

score 2 · Answer 2 · answered Sep 10 '14 at 14:39

There is at least one secure, homomorphic hash function that I know of. It's found in the paper "On-the-Fly Verification of Rateless Erasure Codes for Content Distribution" located here:

http://pdos.csail.mit.edu/papers/otfvec/paper.pdf

The paper was published in the 2004 IEEE Symposium on Security & Privacy. Section IV describes the scheme and subsections IV.D and IV.E provide efficiency improvements (computational and space, respectively). Its security based on the difficulty of finding discrete logarithms in a large group. Whether or not the scheme is 'practical' is a function of the level of security desired, application domain, and the tolerance of the users.

For this scheme, there is no publicly available library implementation that I'm aware of (none of the authors' webpages have any code for it). It is stated in the paper that the authors themselves used the gmp library to implement it. You might be able to contact them and get a copy of their implementation. But, since the paper was published a decade ago, it's unlikely that they still have the code

score 1 · Answer 3 · edited Jun 18 '17 at 17:16

1

Hash function of tree-list (such as bitstring) by list content with log number of multiplies per concat. This gives the same hash for every equal tree-list branch by list content regardless of its internal structure (and computes the exponents cumulatively by 2 multiplies in each next branch), and leafs can be the random primes for bit0/bit1 or any secureHash. I suspect its secure cuz subsetSum is nphard. The simplest case is a list of bits. Given 4 192 bit random primes (bit0 bit1 x y) and a bitstring b to hash,

hash384=pair( (sum<index i in b>((b[i]?bit1:bit0)*x^i))%y, (x^size(b))%y )

See my according github repo: benrayfield/homomorphiclistdedup

edited Jun 18 '17 at 17:16

e-sushi

17,891
12
83
229

answered Jun 18 '17 at 13:46

Ben Rayfield

11
2

If this is a homomorphic hash, what are the operators $*$ and $\star$ that it is homomorphic over? – poncho Jun 18 '17 at 17:28
list concat (like add), and if you want to concat n times (like multiply) you can do that in log number of concats like exponent by squaring. – Ben Rayfield Jun 19 '17 at 20:39

Are there any practical implementation of a homomorphic hashing or signature scheme?

3 Answers3

Linked

Related