HDWSA2: A Secure Hierarchical Deterministic Wallet Supporting Stealth Address and Signature Aggregation

Hierarchical Deterministic Wallet (HDW) and Stealth Address (SA) are widely used in cryptocurrency communities due to their functionality and security. In the preliminary version of this work (ESORICS 2022), we formally define the syntax and security models of Hierarchical Deterministic Wallet supporting Stealth Address (HDWSA), capturing the functionality and security requirements imposed by the practice in cryptocurrency. We propose a concrete HDWSA construction and prove its security in the random oracle model. Note that when applied in blockchain, in practice, signature aggregation could reduce the cost of computation, storage, and communication dramatically. In this full version, we develop HDWSA definition to further support signature aggregation (referred to as HDWSA<inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula>). In particular, we first formally define HDWSA<inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula>, which, besides enjoying all the virtues of HDWSA on functionality and security, allows multiple signatures on different messages to be aggregated into one signature. We propose a concrete HDWSA<inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> construction and prove its security in the random oracle model. We implement the HDWSA<inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> construction and the experimental results show that verification of an aggregate signature is about 13<inline-formula><tex-math notation="LaTeX">$\boldsymbol{\times }$</tex-math></inline-formula> faster than sequential verification of all the individual signatures. We can reduce the size of signatures in a single block by about 60% after aggregation.