Signatures in the Multi-Unforgeability Setting

Quantum computers may soon be able to compute discrete logarithms, but the high resource cost will likely restrict attackers to only a limited number of such computations. Traditional digital signature schemes —such as, , and — are easy targets for such restricted attackers: a single discrete logarithm computation suffices to recover the secret key, enabling the attacker to forge an arbitrary number of signatures. This work explores whether signature schemes can be designed in such a way that forging multiple signatures is significantly harder than a single discrete logarithm computation. To formalize this, we introduce the notion of multi-unforgeability, where a signature scheme is said to be k -unforgeable if it is computationally infeasible for an adversary to produce valid signatures on k distinct messages. Our main technical contribution is to propose two novel digital signature schemes, both featuring constant-size signatures. The first scheme builds upon the signature scheme in bilinear groups, and we show that breaking k -unforgeability requires solving k independent Diffie-Hellman instances. The second scheme is based on the Chevallier-Mames signature scheme over prime-order groups without pairings; in this case, breaking k 2 -unforgeability is as hard as solving k many Diffie-Hellman instances. Both schemes significantly raise the difficulty of large-scale forgery, offering enhanced security in scenarios where multiple signatures may be targeted.