Sandwich BUFF: Achieving Non-resignability Using Iterative Hash Functions

We revisit the BUFF transform, which was proposed by Cremers et al. (S&P’21) as a means to achieve security properties beyond standard unforgeability for digital signature schemes. One of these properties, non-resignability (NR), has recently drawn some attention due to a strong impossibility result for the original definition of the property. Recent follow-up work then considered a variant (sNR) of the original definition, and showed that it is satisfied by the BUFF transform when the underlying hash function is modeled as a random oracle—while the original impossibility result still applies for the plain model. This raises the natural question of whether the BUFF transform satisfies sNR in a more fine-grained use of the random oracle model, when we consider a real-life iterative-hash-function design (such as Merkle-Damgård or Sponge) and instead idealize the round function. Our discoveries in this direction are two-fold: