On the use of ECDSA with hierarchical public key delegation in identity-based scenarios

In 2009, Galindo and Garcia (Africacrypt) proposed the use of concatenated Schnorr signatures for hierarchical public key delegation, creating an efficient identity-based signature scheme (IBS). Essentially, the scheme builds upon the Schnorr signature scheme to generate a primary signature, part of which is then used as a secret key to produce signatures on subsequent messages. The resulting IBS is proven secure against existential forgery under adaptive chosen-message attacks in the identity-based setting using variants of the Forking Lemma. In this paper, our goal is to answer the following question: would it be feasible to build upon the widely used elliptic curve digital signature algorithm (ECDSA) scheme to obtain a similarly secure and efficient IBS? We answer this affirmatively, opening interesting possibilities not only for identity-based signatures with ECDSA but also for solutions such as secure credential delegation. This latter application is of particular interest considering the wide support for ECDSA in web- and cloud-oriented authentication systems (e.g., those based on JSON Web Tokens). We prove the security of the resulting scheme by combining the Bijective Random Oracle model and the existential unforgeability game in an identity-based setup. Our results also show that, despite its non-linear nature and more convoluted verification process than Schnorr signatures, ECDSA allows one to obtain signatures of roughly the same size as those of Galindo-Garcia's scheme while maintaining efficient performance.