Identity-Based Sequential Aggregate Signature from RSA

Sequential aggregate signature (SAS) schemes allow multiple signers to sequentially produce a short signature of different messages and also allow signers to attest to these messages as well as the order in which they signed. Identity-based signature (IBS) schemes allow a signer to sign a message, in which the signature can be verified by his identity. At CCS 2007, Boldyreva et al. proposed an identity-based sequential aggregate signature from pairings on elliptic curves, which have the merits of both SAS and IBS schemes. In this paper, we present and prove secure an identity-based sequential aggregate signature scheme, which is not based on pairings but based on RSA.