Digital signatures provide scalable authentication with non-repudiation and are vital tools for the Internet of Things (IoT). Many IoT applications harbor vast quantities of resource-limited devices often used with cloud computing. However, key compromises (e.g., physical, malware) pose a significant threat to IoTs due to increased attack vectors and open operational environments. Forward security and distributed key management are critical breach-resilient countermeasures to mitigate such threats. Yet forward-secure signatures are exorbitantly costly for low-end IoTs, while cloud-assisted approaches suffer from centrality or non-colluding semi-honest servers. In this work, we create two novel digital signatures called Lightweight and Resilient Signatures with Hardware Assistance (LRSHA) and its Forward-secure version (FLRSHA). They offer a near-optimally efficient signing with small keys and signature sizes. We synergize various design strategies, such as commitment separation to eliminate costly signing operations and hardware-assisted distributed servers to enable breach-resilient verification. Our schemes achieve magnitudes of faster forward-secure signing and compact key/signature sizes without suffering from strong security assumptions (non-colluding, central servers) or a heavy burden on the verifier (extreme storage, computation). We formally prove the security of our schemes and validate their performance with full-fledged open-source implementations on both commodity hardware and 8-bit AVR microcontrollers.

翻译：数字签名提供可扩展的认证功能并具备不可否认性，是物联网（IoT）的重要工具。许多物联网应用部署了大量资源受限的设备，这些设备常与云计算协同工作。然而，由于攻击途径增多和开放的运行环境，密钥泄露（如物理攻击、恶意软件）对物联网构成重大威胁。前向安全性和分布式密钥管理是应对此类威胁的关键抗泄露对策。但前向安全签名对低端物联网设备而言成本极高，而云辅助方法则受限于中心化或非共谋的半诚实服务器假设。本研究提出了两种新型数字签名方案：硬件辅助的轻量级韧性签名（LRSHA）及其前向安全版本（FLRSHA）。这些方案以接近最优的效率实现签名，同时保持较小的密钥和签名尺寸。我们协同运用多种设计策略，例如通过承诺分离消除昂贵的签名操作，并采用硬件辅助的分布式服务器实现抗泄露验证。我们的方案在实现数量级级提升的前向安全签名速度与紧凑的密钥/签名尺寸的同时，避免了强安全假设（非共谋、中心化服务器）或验证方过重负担（极端存储与计算需求）。我们通过形式化证明验证了方案的安全性，并在商用硬件和8位AVR微控制器上通过完整的开源实现验证了其性能。