Hybrid signature scheme

Abstract

A signature scheme is provided in which a message is divided in to a first portion which is hidden and is recovered during verification, and a second portion which is visible and is required as input to the verification algorithm. A first signature component is generated by encrypting the first portion alone. An intermediate component is formed by combining the first component and the visible portion and cryptographically hashing them. A second signature component is then formed using the intermediate component and the signature comprises the first and second components with the visible portion. A verification of the signature combines a first component derived only from the hidden portion of the message with the visible portion and produces a hash of the combination. The computed hash is used together with publicly available information to generate a bit string corresponding to the hidden portion.

We claim: 
     
         1 . A method at a correspondent of digitally signing a message comprising a recoverable portion and a visible portion, said method comprising:
 encoding said recoverable portion using an encryption function to obtain a first signature component;   computing a second signature component as a function of said first signature component, said visible portion and a private key associated with said correspondent; and   providing a signature comprising said first signature component, said second signature component and said visible portion as signature components.