一类无证书签名方案的密码学分析与启示

无证书签名方案简化了传统公钥基础设施(PKI)对公钥证书的需求，必须考虑公钥替换攻击。通过对明-王方案、Li-Cheng-Sun方案、 曹-Paterson-寇方案的分析，指出三个方案使用公钥对代替用户单一公钥的方法不能抵抗公钥替换攻击。采用“绑定”技术对该类方案进行改进，改进后的方案满足Rafael-Ricardo关于无证书的一般模式，可以抵抗公钥替换攻击。最后指出设计无证书签名方案时，不能直接套用基于身份的签名方案，必须注意无证书签名方案的环境要求。

Cryptanalysis and revelation of some certificateless signatures

The Certificateless Signature (CLS) scheme simplifies the need of certificates in the Public Key Infrastructure (PKI), thus the CLS scheme is vulnerable to key replacement attacks. The schemes proposed by Ming-Wang, Li-Cheng-Sun and Cao-Paterson-Kou were analyzed. It is shown that these schemes are insecure because of an adversary who replaces the public key of a signer can forge valid signatures. Then the schemes were improved by binding technology, which satisfied a definition of Rafael-Ricardo's certificateless general mode. Finally, it was shown that the identity-based cryptosystem signature scheme cannot be applied to CLS directly when a CLS scheme is designed.