Certificateless undeniable signature scheme

In this paper, we present the first certificateless undeniable signature scheme. The scheme does not suffer from the key escrow problem, which is inherent in identity based cryptosystems. Also it can avoid the onerous management of certificates. Particularly, by using some cryptographic and mathematical techniques, we guarantee that the scheme’s two component protocols satisfy the properties of zero-knowledge proofs. To address the security issues, we extend security notions of undeniable signatures to the complex certificateless setting, and consider two different types of adversaries. Based on these formally defined security notions, we prove that in the random oracle model, the certificateless undeniable signature scheme is secure in the sense of existential unforgeability under the Bilinear Diffie-Hellman assumption, and is secure in the sense of invisibility under the Decisional Bilinear Diffie-Hellman assumption.     

两种可验证环签名方案的安全性分析与改进

指出李晓琳等人的两个可验证环签名方案提出分析都不满足不可伪造性,即环中成员可以冒充其他成员生成有效的环签名,而真实签名者身份验证算法却将签名者的身份指向后者。针对上述两方案存在的安全缺陷,分别提出了改进方案,通过将真实签名者身份验证算法与签名者的私钥、公钥及消息的签名有机地结合起来使得攻击者在不知道签名者私钥的情况下无法伪造其他签名者的有效签名,从而提高了原方案的安全性。     

A new ring signature scheme with signer-admission property

In this paper, we introduce an extended ring signature scheme in which the actual signer has the ability to admit to having signed a document at his will. Generally speaking, this scheme can be considered as an extension and improvement of the ring signature suggested by Rivest et al. in 2001. The proposed scheme is called signer-admission ring signature which combines the idea of the designated confirmer signatures proposed by Chaum in 1994 and the designated verifier proofs proposed by Jakobsson et al. in 1996. This paper presents a scenario explaining why the signer-admission property is valuable in real-life applications. An actual signer may possibly want to expose himself if, in doing so, he will acquire an enormous benefit. Here, we propose a generic construction of the signer-admission ring signature as well as a demonstration modified from Rivest et al.’s scheme to achieve signer-admission.     

Lattice-based deniable ring signatures

In cryptography, a ring signature is anonymous as it hides the signer’s identity among other users. When generating the signature, the users are arranged as a ring. Compared with group signatures, a ring signature scheme needs no group manager or special setup and supports flexibility of group choice. However, the anonymity provided by ring signatures can be used to conceal a malicious signer and put other ring members under suspicion. At the other extreme, it does not allow the actual signer to prove their identity and gain recognition for their actions. A deniable ring signature is designed to overcome these disadvantages. It can initially protect the signer, but if necessary, it enables other ring members to deny their involvement, and allows the real signer to prove who made the signed action. Many real-world applications can benefit from such signatures. Inspired by the requirement for them to remain viable in the post-quantum age, this work proposes a new non-interactive deniable ring signature scheme based on lattice assumptions. Our scheme is proved to be anonymous, traceable and non-frameable under quantum attacks.

     

Cryptanalysis of a Generalized Ring Signature Scheme

The concept of ring signature was first introduced by Rivest et al. in 2001. In a ring signature, instead of revealing the actual identity of the message signer, it specifies a set of possible signers. The verifier can be convinced that the signature was indeed generated by one of the ring members; however, the verifier is unable to tell which member actually produced the signature. A convertible ring signature scheme allows the real signer to convert a ring signature into an ordinary signature by revealing secret information about the ring signature. Thus, the real signer can prove the ownership of a ring signature if necessary, and the the other members in the ring cannot prove the ownership of a ring signature. Based on the original ElGamal signature scheme, a generalized ring signature scheme was proposed for the first time in 2008. The proposed ring signature can achieve unconditional signer ambiguity and is secure against adaptive chosen-message attack in the random oracle model. By comparing to ring signatures based on RSA algorithm, the authors claimed that the proposed generalized ring signature scheme is convertible. It enables the actual message signer to prove to a verifier that only she is capable of generating the ring signature. Through cryptanalysis, we show that the convertibility of the generalized ring signature scheme cannot be satisfied. Everyone in the ring signature has the ability to claim that she generates the generalized ring signature.     

Intrusion-resilient identity-based signature: Security definition and construction

Traditional identity-based signatures depend on the assumption that secret keys are absolutely secure. Once a secret key is exposed, all signatures associated with this secret key have to be reissued. Therefore, limiting the impact of key exposure in identity-based signature is an important task. In this paper, we propose to integrate the intrusion-resilient security into identity-based signatures to deal with their key exposure problem. Compared with forward-secure identity-based signatures and key-insulated identity-based signatures, our proposal can achieve higher security. The proposed scheme satisfies that signatures in any other time periods are secure even after arbitrarily many compromises of base and signer, as long as the compromises do not happen simultaneously. Furthermore, the intruder cannot generate signatures pertaining to previous time periods, even if she compromises base and signer simultaneously to get all their secret information. The scheme enjoys nice average performance. There are no cost parameters including key setup time, key extract time, base (signer) key update time, base (signer) key refresh time, signing time, verifying time, and signature size, public parameter size, base (signer) storage size having complexity more than O(log T) in terms of the total number of time periods T in this scheme. We also give the security definition of intrusion-resilient identity-based signature scheme and prove that our scheme is secure based on this security definition in the random oracle model assuming CDH problem is hard.     

一种随机化部分盲签名方案

现有的部分盲签名方案很少考虑随机性,且对随机性的严格证明也较少。为此,基于双线性对,提出一种可证明安全性的随机化部分盲签名方案,该方案中的随机性参数由签名者与签名接收者选择的随机数共同生成,并从正确性、随机性、不可链接性、不可伪造性等方面给出严格证明。分析结果表明,与原有方案相比,该方案的安全性更高。     

可否认的基于属性的指定证实人签名方案

为了使签名人具有否认无效签名的权利, 首次提出可否认的基于属性的指定证实人签名模型, 构造了一个可否认的基于属性的指定证实人签名方案。在该方案中, 签名者和指定的证实人均可对签名的有效性进行确认, 并且可以否认无效的签名。最后, 对方案的正确性进行了分析, 并在随机预言模型下证明了其安全性。分析表明, 本方案具有不可伪造性, 并能抵抗合谋攻击。     

代理签名者身份保护的代理签名体制

电子世界中,签名权力的委托通过代理签名来解决。代理签名是原始签名者将他的签名权委托给代理签名者的一种签名体制,代理签名者代表原始签名者进行签名。2002年,K.Shum和K.Wei提出的体制中,可以隐藏代理者的身份。如果仅仅通过代理签名,没有人能够确定代理签名者的身份。而且,如果必要的话,可信任机构可以揭示代理签名者的身份。然而,Narn-YihLee指出K.Shum的签名体制不满足强不可否认性。最后,我们提出一种代理签名体制,这种签名体制能克服以上指出的弱点。新体制满足强不可否认性。     

Time-selective convertible undeniable signatures with short conversion receipts

Undeniable signatures were introduced in 1989 by Chaum and van Antwerpen to limit the self-authenticating property of digital signatures. An extended concept - the convertible undeniable signatures - proposed by Boyar, Chaum, Damgård and Pedersen in 1991, allows the signer to convert undeniable signatures to ordinary digital signatures.In this article, we present a new efficient convertible undeniable signature scheme based on bilinear maps. Its unforgeability is tightly related, in the random oracle model, to the computational Diffie-Hellman problem and its anonymity to a non-standard decisional assumption. The advantages of our scheme are the short length of the signatures, the low computational cost of the signature and the receipt generation. Moreover, a variant of our scheme permits the signer to universally convert signatures pertaining only to a specific time period. We formalize this new notion as the time-selective conversion. We also improve our original scheme from CT-RSA’05 by reducing the length of the generated receipts: their size is now logarithmic in the number of time periods.     

多个签名者强指定验证者签名方案

指定验证者签名可以实现签名者选择所期望的验证者验证签名的有效性,从而达到控制数字签名任意传播的目的,基于双线性对构造了一个新的基于身份的多签名者强指定验证者签名方案。新方案中多个签名者将隐藏的私钥以及进行哈希的消息发送给签名收集者,使得签名收集者无法利用签名者的私钥任意伪造签名,也不能对任意的消息进行签名,由签名收集者进行的多签名者强指定验证者签名方案缩短了签名时间和签名长度,并且减小了单个签名者权利过大的可能性。该签名体制可以用于多人联名上书的情况。新方案在BDH问题和DLP问题的困难性假设下,在基于身份的多签名者强指定验证者签名的不可伪造性和不可转发性概念下是安全的。     

可证安全的无证书代理环签名方案

代理环签名可使代理者以匿名的方式进行代理签名, 具有很多优点。首先给出无证书代理环签名方案的最强安全模型, 并利用双线性映射提出一个高效的无证书代理环签名方案。在所定义的最强的安全模型下, 方案给出了严格的安全证明, 它的安全性基于计算Diffie-Hellman问题的困难性。分析显示该方案满足诸如无条件匿名性、强不可伪造性等安全性质。鉴于该方案的安全、高效和无证书管理的优点, 它可广泛应用于电子政务、移动代理系统等方面。     

对一种代理签名方案的密码学分析和改进

对 Fu-Kou-Xiao 具有代理匿名性的代理签名方案进行分析,指出该方案不具备强不可伪造性。给出了一种伪造攻击,利用这种攻击,一个恶意的原始签名人可以成功伪造代理签名密钥,从而可以假冒诚实的代理签名人生成验证有效的代理签名。分析了方案不安全的原因,在此基础上提出了一个改进的代理密钥生成算法来修正Fu-Kou-Xiao的方案。     

无证书限制性部分盲签名方案的分析与改进

无证书限制性部分盲签名方案不满足限制性,用于电子现金系统时会出现用户重复消费而无法被检测出的情况。为解决该问题,提出一种改进方案,将原方案中签名者的2个部分签名绑定在一起,从而防止在签名阶段伪造出任何形式且无需满足限制性的消息的有效签名。理论分析结果表明,改进方案满足限制性、部分盲性和不可伪造性。     

Comments on “verifiable outsourced attribute-based signature scheme”

Ren and Jiang recently published a “verifiable outsourced attribute-based signature scheme” in Multimedia Tools and Applications. In this note, we first provide two attacks on the verifiability of the semi-signatures of this scheme by showing that a malicious signing-cloud service provider (S-CSP) can always cheat the signer unlike the authors’ claim. Moreover, one of these attacks also implies that an untrusted S-CSP can always forge signatures contrary to the claimed unforgeability against chosen message attacks. Therefore, this scheme unfortunately does not satisfy the main security properties for a delegated signature scheme.

     

一种可撤销匿名性的环签名方案

环签名提供了匿名发布信息的有效方法,现有环签名方案存在不可追踪签名者真实身份的问题。基于身份密码体制和双线性对技术,提出了一种环签名方案,方案除了满足无条件匿名性和不可伪造性,还满足可撤销匿名性,必要时由PKG（Private Key Generator）充当仲裁验证者,达到定位真实签名者的目的。     

Forgeability of Wang-Zhu-Feng-Yau’s Attribute-Based Signature with Policy-and-Endorsement Mechanism

Recently, Wang et al. presented a new construction of attribute-based signature with policy-and-endorsement mechanism. The existential unforgeability of their scheme was claimed to be based on the strong Diffe-Hellman assumption in the random oracle model. Unfortunately, by carefully revisiting the design and security proof of Wang et al.’s scheme, we show that their scheme cannot provide unforgeability, namely, a forger, whose attributes do not satisfy a given signing predicate, can also generate valid signatures. We also point out the flaws in Wang et al.’s proof.     

Forgery attacks on Kang et al.’s identity-based strong designated verifier signature scheme and its improvement with security proof

Recently, Kang et al. proposed a new identity-based strong designated verifier signature scheme (ID-SDVS) and identity-based designated verifier proxy signature scheme (ID-DVPS). They claimed that their schemes are unforgeable. However, we found out that their schemes are universally forgeable in the sense that anyone can forge valid ID-SDVS and ID-DVPS on an arbitrary message without the knowledge of the secret key of either the signer or the designated verifier. Finally, we propose an improved ID-SDVS which is unforgeable. We give formal security proof of universal unforgeability of our scheme. We also give an improved ID-DVPS.     

一种基于身份的代理环签名方案

代理签名方案能够委托签名权利,环签名方案能够实现匿名签名,由此提出一种基于身份的代理环签名方案.通过将原始签名人扩展到环中,使验证者只能确定原始签名人及代理签名人来自某个环,无法获知委托人以及签名人的具体身份.理论分析证明该方案具有正确性、不可伪造性、匿名性和可区分性.     

签名长度固定的基于身份门限环签名方案

在门限环签名中,任意n个成员组中的t个可以代表整个成员组产生(t,n)门限环签名,而对实际的签名者却具有匿名性。为了设计签名长度是常量的门限环签名方案,通过使用双线性对技术,提出了一种无需随机预言机的基于身份的门限环签名方案。最后,通过对方案的安全性进行分析,指出方案满足无条件匿名性以及在Diffie-Hellman 逆(DHI)困难问题的假设下满足选择消息和身份攻击下的存在不可伪造性。