{"id":"60a02f32-f51b-4c87-acee-7c28350c187f","arxiv_id":"1908.05366","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":1.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey of pairing-based identity-based signatures tabulates signature sizes on JPBC curves and suggests two compression tricks, one of which makes signatures unverifiable.","lead":"An arXiv note surveys pairing-based identity-based signature schemes and tabulates signature byte sizes across seven JPBC curve types. It also proposes point compression and hash truncation to shrink signatures, but the hash truncation method breaks verification.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 4's hash-shortening trick is unsound: replacing h with R=h mod r makes the Sakai-Kasahara Schnorr signature unverifiable, so the paper's second claimed size reduction does not hold.","rationale":"The reader's weakest_assumption correctly identifies the core flaw in the paper's second shortening method. The central claim is that two methods shorten signatures; the first, point compression, is standard and technically sound (modulo implementation details). The second, replacing the hash h with R=h mod r, is unsound because it breaks the verification equation: the verifier needs the full h to check H1(m || w) == h, but R does not reconstruct h. The paper's Table 7 applies this flawed method to the Sakai-Kasahara Schnorr scheme, producing the smallest signature sizes in the paper, and the conclusion explicitly recommends this scheme as the shortest. Therefore, the paper's headline contribution is invalid as stated, and the REJECT verdict is justified. I do not see another concern that is more load-bearing: the point compression method is correctly described in concept, though the appendix code has minor bugs (e.g., the sqrtP function for primes ≡ 1 mod 4 is not provided), but those are not central to the abstract's promise. The survey portions appear largely accurate, but the second claimed contribution is not. Hence, I agree with the reader's verdict and recommend no change.","tokens_in":14175,"tokens_out":3972,"duration_ms":38858,"concrete_test":"Implement the Sakai-Kasahara Schnorr scheme from Section 3.3 using JPBC's f.properties. Sign a message m, producing (h,S). Compute R = h mod r and transmit (R,S) to a verifier who runs the original verification algorithm: w = en(S,g2) * en(CA, -R P2), then check H1(m || w) == R. The check fails because H1(m || w) is a 256-bit value and R is its 158-bit residue; the equality holds only with probability about 2^-158. This demonstrates that the modified signature does not verify, so the shortening method is not a valid signature scheme.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's second shortening method, proposed in Section 4, claims that the Sakai-Kasahara Schnorr signature (h,S) can be rewritten as (R,S) where R = h mod r, because the verification pairing en(CA,-hP2) only uses h modulo r. This is load-bearing for the Table 7 entries that list compressed Schnorr signatures as 20-byte hash plus compressed G1. The reasoning is invalid. In the original scheme, verification computes w = en(S,g2) * en(CA,-h P2) and then checks H1(m || w) == h. When h is replaced by R, the scalar multiplication uses R, so the recomputed w matches the signer's e, but the verifier cannot compare H1(m || w) to the discarded h. The paper does not specify a modified verification; if one tries to check H1(m || w) == R, the equality holds only with negligible probability because H1 outputs a full-length hash and R is its residue modulo r. Thus (R,S) is not a valid signature under the stated verification algorithm, and Table 7's signature sizes for the Schnorr scheme are unachievable. This directly undermines the abstract's claim of two shortening methods and the conclusion's recommendation of the compressed Schnorr signature as the shortest.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper surveys identity-based signature (IBS) schemes in the context of the JPBC pairing library, tabulates group element sizes for several pairing-friendly curve types, and presents signature-size calculations for six schemes (Sakai–Ohgishi–Kasahara, Paterson, Sakai–Kasahara ElGamal and Schnorr analogs, Xun Yi, plus the library-implemented Cha–Cheon and Paterson–Schuldt). It then proposes two methods to further reduce signature size: point compression of G1 elements (discarding the y-coordinate and storing a one-byte prefix) and hash-component shortening for the Sakai–Kasahara Schnorr scheme, either by truncating the hash to 20 bytes or by replacing it with its residue modulo the group order r. The paper concludes that the compressed Sakai–Kasahara Schnorr scheme gives the shortest signatures.","tokens_in":14405,"tokens_out":12393,"duration_ms":113347,"significance":"The survey and the size tables are useful practical references for implementors choosing pairing curves and IBS schemes. The point-compression technique, if implemented as described, is a standard and valid method, and the paper provides Java code for it. However, the proposed hash-compression methods are not fully sound as presented: the modulo-r method is invalid because the verifier cannot reconstruct the hash from its residue, and the truncation method needs an explicit redefinition of the verification equation. The algebraic verification steps for the underlying schemes are mostly correct, though some proof notation is sloppy. Since the paper's core contribution includes the shortening methods, the correctness issues must be fixed before the paper can be accepted.","major_comments":[{"comment":"The claim that the Sakai–Kasahara Schnorr signature (h,S) can be rewritten as (R,S) with R = h mod r is incorrect. In the verification procedure of Section 3.3, the verifier computes w = en(S,g2) * en(CA, -hP2) and then checks H1(m||w) == h. If the signature is changed to (R,S), the scalar multiplication can use R only because -hP2 = -(h mod r)P2, so the recomputed w matches the signer's e. However, the verifier cannot check H1(m||w) == h because h is not transmitted and cannot be recovered from R. If the check is changed to H1(m||w) == R, the equality holds only with negligible probability (r/2^|H1|). Therefore this proposed method does not yield a valid signature, and the corresponding size reductions claimed in the text and reflected in Table 7 are unachievable under the stated verification algorithm.","section":"Section 4, paragraph 'When computing the verification step - en(CA, -hP2)'"},{"comment":"The alternative hash-shortening method (truncating H1 to 20 bytes) is not fully specified. The paper states that the hash value can be shortened 'using the techniques that are used to generate Ethereum or Bitcoin addresses' but does not give the modified verification algorithm. If h is replaced by h' = truncate20(H1(m||e)), then the verification step in Section 3.3 must be changed to compare H1'(m||w) with h', where H1' is the truncated function. Without this explicit modification, the scheme is under-specified, and the 20-byte hash entries in Table 7 for the Schnorr scheme are not tied to a defined algorithm. The paper should define H1' and state the resulting sign and verify procedures.","section":"Section 4, Ethereum-style hash truncation"}],"minor_comments":[{"comment":"Step 4 computes h1 = H(ZA), but h1 is never used in the signature or verification; only h and xza appear. This unused variable should be removed or the description corrected.","section":"Section 3.3, Sakai–Kasahara ElGamal analogue"},{"comment":"In the Paterson and Xun Yi proofs, the notation en(g1,g2)^{h0+VA*h1} and en(g1,g2)^{(r+h*CA)*x} uses group elements (VA, CA) as exponents, which is mathematically ill-formed. Replace these with the correct bilinearity steps, e.g., en(VA,g2)^{h1} = en(CA,P2)^{h1}.","section":"Sections 3.2 and 3.4, proof equations"},{"comment":"The sentence 'If Y is odd we append 02 before X value. If Y is odd we append 03.' contains a typo; the second condition should read 'If Y is even we append 03.' The accompanying Java code is correct.","section":"Section 4, point compression description"},{"comment":"The 'with compression' hash size is listed as 20 bytes for every curve, including d201 (where |r| = 23 bytes) and a1 (where |r| = 128 bytes). This is consistent with fixed 20-byte truncation but not with the R = h mod r method; the text should clarify which hash-compression variant is being used in the table.","section":"Table 7, Sakai–Kasahara Schnorr row"},{"comment":"Only the d159 parameters are given in the body; the bit-lengths for d201 and d224 appear in Table 1 but the text does not state them explicitly. Adding a sentence would improve readability.","section":"Section 2, type D curves"}],"recommendation":"major_revision","confidential_remarks":"The reader's report recommends reject; I agree that Section 4's modulo-r claim is a genuine error. However, I see the error as localized and correctable (by removing or rewriting the modulo claim and by explicitly defining the truncation-based variant), and the survey, size tables, and point-compression code retain value. I therefore recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a decent survey of five identity-based signature schemes with JPBC curve-size tables, but its second claimed size-shortening method is unsound, and the first is standard point compression. If you're looking for a citation for compressed IBS sizes, use the original ECC literature, not this.\n\nWhat is good: Section 3's scheme descriptions are algebraically correct; the verification equations check out. The tables of G1/G2/GT sizes for the JPBC curves are mostly right, modulo some rounding. The DNA-storage motivation is concrete and makes the size question worth asking. The appendix has actual Java code for point compression/decompression, which a practitioner might adapt.\n\nSoft spots: The hash-shortening trick in Section 4 is wrong. The original Sakai-Kasahara Schnorr verification checks H1(m||w) == h. If you replace h by R = h mod r, the verifier can't recover h, and checking against R succeeds only with negligible probability. So the (R,S) signature is not valid under the stated scheme, and the Table 7 entries for that scheme are wrong. This isn't a minor optimization issue; it's the paper's only non-standard contribution. Point compression is real but it's textbook SEC 1; presenting it as a new method without citation to the standard is misleading. There are also small numerical inconsistencies in Table 1 (d159, f, g bit sizes) and sloppy reuse of the symbol r for both the group order and a random scalar. The 'Systematization of Knowledge' title overpromises: the paper covers five schemes plus three in libraries, not a systematic treatment of the field.\n\nVerdict: The survey part could be a useful workshop note if the unsound claim were removed and the compression standard cited. As-is, the central contribution fails. I'd recommend reject, but not desk reject—a referee should catch this and the authors could resubmit a corrected version that drops the hash-shortening claim.","headline":"A competent survey of IBS schemes and JPBC curve sizes, but the paper's only novel size-shortening method is mathematically invalid; reject, but the survey part may be salvageable.","tokens_in":14934,"tokens_out":3211,"would_cite":false,"duration_ms":32930,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that identity-based signatures become much shorter when the pairing curve has small group elements and the signature's point and hash components are compressed, with the Schnorr-type Sakai-Kasahara scheme reaching 40…","keywords":["identity-based signatures","pairing-based cryptography","short signatures","point compression","signature size","pairing curves","Schnorr-type signatures","synthetic DNA authentication"],"falsifier":"Run the paper's verification procedure on a shortened Schnorr signature: sign one message, store $(R,S)$ with $R = h \\bmod r$, and try to verify using the published check $H_1(m \\| w) = h$; because the verifier receives only $R$, it cannot reconstruct $h$, so the check must be weakened to a residue comparison. To settle the claim, find two distinct messages whose hashes are congruent modulo $r$ and show the same $(R,S)$ verifies for both, which would demonstrate that the shortened signature is no longer bound to a single message.","tokens_in":13961,"feed_emoji":"🔐","tokens_out":13044,"duration_ms":113529,"temperature":0.7,"pith_summary":"Identity-based signatures are usually compared by security, but this paper treats signature size as the design target: it surveys a set of pairing-based signature schemes, measures how each curve's group-element sizes determine the byte length of each signature, and proposes two generic shrinkages. The first is elliptic-curve point compression: a point $(x,y)$ can be sent as $x$ plus one parity byte, because the curve equation $y^2 = x^3 + ax + b$ recovers $y$, cutting a $G_1$ component from $2n$ bytes to $n+1$. The second is specific to the Sakai-Kasahara Schnorr analogue: the paper claims the hash $h$ in the signature $(h,S)$ can be replaced by $R = h \\bmod r$, on the grounds that the verifier's scalar multiplication only sees $h$ modulo the group order $r$. Together these methods produce the paper's headline numbers: the shortest listed signatures fall to 40 bytes on the type-G curve, and several schemes drop below 50 bytes. The concrete motivation is applications that need very short signatures, such as the paper's earlier proposal for signing synthetic DNA.","feed_headline":"Identity-based signatures can shrink to 40 bytes","feed_subtitle":"Curve choice and two compression tricks cut the shortest listed signature from 72 to 40 bytes.","key_machinery":"The load-bearing object is the signature tuple, whose entries are elements of the two source groups $G_1$ and $G_2$ of the bilinear pairing, of the scalar ring $Z_r$, or of a hash; the byte size of each entry is fixed by the curve parameters (the prime $q$, group order $r$, and embedding degree $k$), so the whole comparison reduces to reading element sizes off a curve table. The two mechanisms doing the work are point compression (the curve equation $y^2 = x^3 + ax + b$ determines $y$ from $x$ up to sign, so one parity bit plus $x$ encodes a point) and hash reduction modulo the group order, which the paper applies to the Sakai-Kasahara Schnorr signature by replacing $h$ with $R = h \\bmod r$ because the verification scalar multiplication $-hP_2$ acts through $Z_r$. The second mechanism is what makes the Schnorr analogue uniquely small; without it, the 32-byte full hash would dominate that signature's size.","core_discovery":"On its own terms, the paper's contribution is a size taxonomy plus two compression rules. For each scheme (Sakai-Ohgishi-Kasahara, Paterson, Sakai-Kasahara in both El-Gamal and Schnorr forms, Xun Yi, and the already-implemented Cha-Cheon and Paterson-Schuldt), the signature is a tuple of group elements, and the paper determines the byte cost of each element from the curve's prime size and embedding degree. The first compression rule is universal: any $G_1$ point in a signature can be stored as its $x$-coordinate plus one parity byte, since the curve equation recovers $y$, so a $2n$-byte $G_1$ component becomes $n+1$ bytes. The second rule targets the Schnorr analogue, whose signature is $(h, S)$: because verification computes $-hP_2$ and scalar multiplication reduces the scalar modulo $r$, the paper asserts that $h$ may be stored as $R = h \\bmod r$, an element of $Z_r$, rather than as a full 32-byte hash. The paper then tabulates the resulting sizes across the seven curve types and concludes that the compressed Schnorr analogue is the shortest scheme, at 40 bytes on the 149-bit type-G curve and 41 bytes on the type-F and d159 curves.","pith_inferences":["The hash-reduction rule, if valid, would generalize as a design principle: any signature component that enters verification only through scalar multiplication in a prime-order group can be stored as its residue modulo $r$, but each scheme must be checked because verification often also compares hash outputs directly.","The 40-byte figure depends on the specific library curves; regenerating curves at the same bit sizes with different primes could change decompression performance (especially for primes $\\equiv 1 \\pmod 4$) without changing byte sizes, so the size ranking is stable while the timing ranking may not be.","A direct experiment can isolate the riskiest step: implement the compressed Schnorr analogue and verify a batch of signatures; if any signature produced by the shortened signer fails verification, the failure points to the replacement of $h$ by $h \\bmod r$.","The taxonomy suggests a design rule for future identity-based signature schemes: keep $G_2$ elements out of the signature, since they are the largest entries in asymmetric pairings, and prefer constructions whose only group component is a compressed $G_1$ point."],"forward_implications":["On the paper's tables, the shortest identity-based signature is the compressed Sakai-Kasahara Schnorr analogue at 40 bytes on the type-G curve and 41 bytes on the type-F and d159 curves, down from 70 to 72 bytes uncompressed.","For every scheme whose signature contains a $G_1$ point, point compression alone cuts that component from $2n$ to $n+1$ bytes and applies even to schemes already built into the libraries, such as Cha-Cheon and Paterson-Schuldt.","For the DNA-signature application, pairing-based signatures plus compression bring a signature from 128 bytes (512 DNA base pairs) down to about 40 to 41 bytes (160 to 164 base pairs).","Decompression depends on the curve: the paper notes a simple square-root formula when the prime satisfies $p \\equiv 3 \\pmod 4$ and a more general routine otherwise, so an implementation must dispatch on curve type.","If $G_2$ elements could also be compressed, the schemes that carry a $G_2$ entry (Sakai-Ohgishi-Kasahara, Paterson, Sakai-Kasahara El-Gamal) would shrink further; the paper leaves that as future work."],"supporting_citations":[{"why":"supplies the Java pairing-based cryptography implementation platform whose curve-property files define every group size measured in the tables.","marker":"[5]"},{"why":"defines the standard-model signature scheme already present in the library; its all-$G_1$ signature is a baseline row in the comparison.","marker":"[15]"},{"why":"defines one of the surveyed pairing-based signature schemes, contributing a $G_1$ plus $G_2$ size row.","marker":"[16]"},{"why":"defines the El-Gamal and Schnorr analogue schemes; the Schnorr analogue is where the paper applies its hash-reduction shortening.","marker":"[18]"},{"why":"defines a surveyed $G_1$ plus $G_2$ signature scheme whose sizes are tabulated.","marker":"[14]"},{"why":"defines the surveyed $G_1$ plus $G_1$ signature scheme used as a short-signature comparison point.","marker":"[22]"},{"why":"supplies the MNT curve construction behind the type-D curve rows.","marker":"[12]"},{"why":"supplies the BN curve construction behind the type-F row with small $G_1$ elements.","marker":"[2]"},{"why":"motivates the work with synthetic-DNA signatures and provides the base-pair conversion numbers used in the conclusion.","marker":"[9]"},{"why":"supplies the address-truncation technique the paper cites as an analogy for shortening hash components.","marker":"[21]"}],"fun_headline_variants":["Two tricks cut identity-based signature to 40 bytes","Curve choice shrinks identity-based signatures","Identity-based signatures: taxonomy and size cuts","Shortest identity-based signature: 40 bytes via compression","Implementation notes: how to shrink identity-based signatures"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that the verifier's computation of $-h$ times a group point sees only the remainder of $h$ modulo the group order, so the signer may send $h \\bmod r$ instead of the full hash; if verification must compare the full hash value, the second shortening method fails.","fun_headline_variants_meta":{"raw":{"variants":["Two tricks cut identity-based signature to 40 bytes","Curve choice shrinks identity-based signatures","Identity-based signatures: taxonomy and size cuts","Shortest identity-based signature: 40 bytes via compression","Implementation notes: how to shrink identity-based signatures"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000216,"raw_usage":{"total_tokens":1473,"prompt_tokens":1030,"completion_tokens":443,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":646,"completion_tokens_details":{"reasoning_tokens":371}},"tokens_in":646,"tokens_out":443,"duration_ms":4405,"temperature":1.0,"reasoning_tokens":371,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:15:39.711438+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the paper's verification procedure on a shortened Schnorr signature: sign one message, store $(R,S)$ with $R = h \\bmod r$, and try to verify using the published check $H_1(m \\| w) = h$; because the verifier receives only $R$, it cannot reconstruct $h$, so the check must be weakened to a residue comparison. To settle the claim, find two distinct messages whose hashes are congruent modulo $r$ and show the same $(R,S)$ verifies for both, which would demonstrate that the shortened signature is no longer bound to a single message.","supporting_citations":[{"cited_title":"Jpbc: Java Pairing Based Cry ptog- raphy","cited_arxiv_id":null,"evidence_quote":"supplies the Java pairing-based cryptography implementation platform whose curve-property files define every group size measured in the tables."},{"cited_title":"Efficient Identity-B ased Sig- natures Secure in the Standard Model","cited_arxiv_id":null,"evidence_quote":"defines the standard-model signature scheme already present in the library; its all-$G_1$ signature is a baseline row in the comparison."},{"cited_title":"Cryptosystems Based on Pa iring, SCIS 2000-C20, Jan","cited_arxiv_id":null,"evidence_quote":"defines one of the surveyed pairing-based signature schemes, contributing a $G_1$ plus $G_2$ size row."},{"cited_title":"Id Based Cryptosystems with Pairing on Elliptic Curve","cited_arxiv_id":null,"evidence_quote":"defines the El-Gamal and Schnorr analogue schemes; the Schnorr analogue is where the paper applies its hash-reduction shortening."},{"cited_title":"Id-Based Signatures from Pairings on Ellip tic Curves","cited_arxiv_id":null,"evidence_quote":"defines a surveyed $G_1$ plus $G_2$ signature scheme whose sizes are tabulated."},{"cited_title":"); BigInteger Xcord = new BigInteger(1,xbytes); BigInteger Ycord = new BigInteger(1,ybytes); String prefix = null; if((Ycord.mod(TWO)).compareTo(BigInteger.ZERO) == 0) { prefix =","cited_arxiv_id":null,"evidence_quote":"defines the surveyed $G_1$ plus $G_1$ signature scheme used as a short-signature comparison point."},{"cited_title":"New Explicit Conditions of Elliptic Curve Traces for FR-Reduction","cited_arxiv_id":null,"evidence_quote":"supplies the MNT curve construction behind the type-D curve rows."},{"cited_title":"Pairing-Friendly Elliptic Cur ves of Prime Order","cited_arxiv_id":null,"evidence_quote":"supplies the BN curve construction behind the type-F row with small $G_1$ elements."},{"cited_title":"Digital Signatures to Ensure the Authenticity and Integrity of Syn thetic DNA Molecules","cited_arxiv_id":null,"evidence_quote":"motivates the work with synthetic-DNA signatures and provides the base-pair conversion numbers used in the conclusion."},{"cited_title":"Ethereum: A Secure Decentralised Generalised Trans- action Ledger","cited_arxiv_id":null,"evidence_quote":"supplies the address-truncation technique the paper cites as an analogy for shortening hash components."}],"review_version":1}