![](bg2.png)
graphic primitive associated with a fuzzy key setting,
and is a kind of a pair of linear encoding and error
correction methods that we will detail later. (Taka-
hashi et al., 2017) then gave a generic construction of
a fuzzy signature scheme for a fuzzy key setting from
the combination of a linear sketch scheme (that is as-
sociated with the same fuzzy key setting) and an or-
dinary signature scheme that has some homomorphic
properties regarding signing/verification keys. They
then gave two instantiations of concrete fuzzy signa-
ture schemes via their generic construction, where for
each construction, they specified a fuzzy key setting,
constructed a linear sketch scheme, and then com-
bined it with (a modified variant of) an existing or-
dinary signature scheme.
Linear Sketch. The main focus in this paper is on
a linear sketch scheme. As mentioned earlier, this
primitive can be understood as a pair of linear en-
coding and error correction methods. It is associated
with a fuzzy key setting and an abelian group K , and
consists of two algorithms
2
: “Sketch” and “DiffRec”
(where the second algorithm stands for “difference re-
construction”). The first algorithm can be used to gen-
erate a “sketch” c of an element s ∈ K using a fuzzy
data x as a “key” (or a “mask”). The second algorithm
takes as input two sketches c and c
0
, where c (resp.
c
0
) is supposedly a sketch of an element s ∈ K (resp.
s
0
∈ K ) generated by using fuzzy data x (resp. x
0
),
and outputs the difference ∆s = s −s
0
if the two fuzzy
data x and x
0
are “close” (according to the threshold
t specified in the fuzzy key setting). In (Takahashi
et al., 2017), it is required that a linear sketch scheme
satisfies additional “linearity” and “weak simulatabil-
ity” properties that are used in the security proof for
the generic construction.
Our Motivation. Although the security of the un-
derlying linear sketch scheme is very important for
the security of the fuzzy signature schemes con-
structed from the generic construction of Takahashi
et al., a linear sketch scheme is a relatively new prim-
itive, and what security properties its definition and
the existing constructions satisfy, has not been well
understood. As mentioned above, in the formaliza-
tion in (Takahashi et al., 2017), a linear sketch scheme
is associated with a fuzzy key setting, which in turn
specifies the underlying metric space and distribution
of fuzzy data. So far, we only have two concrete con-
structions of linear sketch schemes: the first scheme
2
A linear sketch scheme actually also has the setup al-
gorithm Setup that outputs a public parameter used by the
other algorithms, but we omit them in the explanation in the
introduction. The formal definition appears in Section 3.
(denoted by “S
CRT
”) is based on the Chinese remain-
der theorem, and the second one (denoted by “S
Hash
”)
is based on a universal hash function family, and the
fuzzy data space for these constructions is the space
[0,1)
n
with the L
∞
-distance. Since the constructions
S
CRT
and S
Hash
seem tailored to this specific metric
space, they have to inherently deal with non-integer
numbers and furthermore they cannot be used with
fuzzy key settings with other natural metrics for bio-
metric authentication such as the edit distance and
Hamming distance over bit strings.
In fact, the earlier papers (Takahashi et al., 2015;
Matsuda et al., 2016) left the treatment of real num-
bers somewhat ambiguous, and Yasuda et al. (Yasuda
et al., 2017) showed that the linear sketch schemes
S
CRT
and S
Hash
could be vulnerable to so-called “re-
covering attacks” (which recover fuzzy data x and an
element s from a sketch c = Sketch(s,x)), if the real
numbers in these schemes are treated in an inappro-
priate way. Concurrently to (Yasuda et al., 2017), the
treatment of real numbers was unambiguously speci-
fied in (Takahashi et al., 2017), and with their treat-
ment the attacks by (Yasuda et al., 2017) were shown
to no longer work. However, this situation suggests
that care must be taken in the definition of linear
sketch schemes.
The main motivation of this paper is to contribute
to deepening our understanding of this primitive, so
that we can come up with better constructions and ap-
plications, which potentially could lead to future new
constructions of fuzzy signatures (with fuzzy key set-
tings that are different from the existing schemes).
1.2 Our Contributions
In order to deepen our understanding of a linear
sketch scheme, in this paper we clarify a new aspect
of the security properties achieved by the existing lin-
ear sketch schemes.
More specifically, in Section 4, we introduce se-
curity of a linear sketch scheme against “recovering”
attacks, which directly captures the resistance against
the attacks of (Yasuda et al., 2017). Namely, it re-
quires that recovering fuzzy data x from a sketch c
(and a public parameter pp) is hard. Our formaliza-
tion uses the notion of average min-entropy (Dodis
et al., 2008), which naturally corresponds to the hard-
ness of guessing a secret given some leakage. Then,
as our main technical results, we show that the two
linear sketch schemes in (Takahashi et al., 2017), S
CRT
and S
Hash
, satisfy sufficient level of security against
recovering attacks (when the treatment of real num-
bers in (Takahashi et al., 2017) is taken into account),
which are respectively shown in Sections 5 and 6.
On the Security of Linear Sketch Schemes against Recovering Attacks
77