Post-Quantum Sanitizable Signatures from McEliece-Based Chameleon Hashing

TL;DR

This paper presents the first transparent, code-based post-quantum sanitizable signature scheme that allows controlled message modification while maintaining security, based on McEliece cryptosystem and chameleon hashing.

Contribution

It introduces a novel post-quantum sanitizable signature scheme using McEliece-based chameleon hashing with formal security proofs and a new transparency property.

Findings

Scheme is existentially unforgeable under syndrome decoding hardness

Achieves perfect transparency with specific weight constraints

Provides formal security proofs in the random-oracle model

Abstract

We introduce a novel post-quantum sanitizable signature scheme constructed upon a chameleon hash function derived from the McEliece cryptosystem. In this design, the designated sanitizer possesses the inherent trapdoor of a Goppa code, which facilitates controlled collision-finding via Patterson decoding. This mechanism enables authorized modification of specific message blocks while ensuring all other content remains immutably bound. We provide formal security definitions and rigorous proofs of existential unforgeability and immutability, grounded in the hardness of syndrome decoding in the random-oracle model, where a robust random oracle thwarts trivial linear hash collisions. A key innovation lies in our precise characterization of the transparency property: by imposing a specific weight constraint on the randomizers generated by the signer, we achieve perfect transparency, rendering sanitized signatures indistinguishable from freshly signed ones. This work establishes the first transparent, code-based, post-quantum sanitizable signature scheme, offering strong theoretical guarantees and a pathway for practical deployment in long-term secure applications.