基于椭圆曲线的盲代理盲签名方案

针对现有签名方案不能同时保护代理签名者和消息拥有者安全的问题,提出一种基于椭圆曲线的盲代理盲签名方案。该方案不需要可信方,在隐藏代理签名者身份信息的同时,盲化需要签名的消息。分析结果表明,该方案满足盲代理签名和代理盲签名的安全特性,能有效保护代理签名者和用户的身份隐私。     

Certificateless multi-proxy signature

Multi-proxy signature is a scheme that an original signer authorizes a proxy group as his proxy agent and later only the cooperation of all proxy signers in the proxy group could sign messages on behalf of the original signer. To our best knowledge, most of the existing multi-proxy signature schemes are proposed in public key infrastructure or identity-based setting. However, due to avoiding the inherent escrow problem of identity-based cryptography and yet not requiring certificates to guarantee the authenticity of public keys, certificateless public key cryptography has become an attractive paradigm on which many cryptographical primitives are based. In this paper, a generic construction and a formal security model of certificateless multi-proxy signature (CLMPS) are firstly defined. A concrete CLMPS scheme is also proposed, which is proven to be existentially unforgeable against adaptively chosen warrant attacks and chosen message and identity attacks in the random oracle model under the computational Diffie-Hellman assumption.     

Efficient ID-based proxy multi-signature scheme secure in random oracle

Proxy signature schemes enable an entity to delegate its signing rights to any other party, called proxy signer. As a variant of proxy signature primitive, proxymultisignature allows a group of original signers to delegate their signing capabilities to a single proxy signer in such a way that the proxy signer can sign a message on behalf of the group of original signers. We propose a concrete ID-based proxy multi-signature scheme from bilinear pairings. The proposed scheme is existential unforgeable against adaptively chosen message and given ID-attack in random oracle model under the computational Diffie-Hellman (CDH) assumption. The fascinating property of new scheme is that the size of a proxy multi-signature is independent of the number of original signers. Furthermore the proposed scheme is simple and computationally more efficient than other ID-based proxy multisignature schemes.     

高效的基于格的环签名方案

安全高效的环签名方案有很多重要应用.文中提出了一种新的基于格的环签名方案并在标准模型下给出了正式的安全性证明.在标准的小整数解(SIS)困难假设下,该方案对适应性选择消息攻击是强不可伪造的.与现有的标准模型下基于格的环签名方案相比,新方案签名长度更短,计算效率更高,安全性更强.     

强不可伪造的在线/离线签名方案

针对标准模型下签名方案效率低的问题,利用目标抗碰撞杂凑函数和变色龙哈希函数,提出了一种在线/离线签名方案。在签名消息到来之前,离线阶段进行重签名的大部分计算,并将这些运算结果保存起来;在签名消息到来时,利用离线阶段保存的数据能在很短的时间内生成消息的在线重签名。在标准模型下,证明了新方案在适应性选择消息攻击下满足强不可伪造性。分析结果表明,新方案在效率上优于已有的标准模型下签名方案,在线签名算法仅需要1次模减法运算和1次模乘法运算,适合于计算能力较弱的低端计算设备。     

Identity-based strong designated verifier signature schemes: Attacks and new construction

A strong designated verifier signature scheme makes it possible for a signer to convince a designated verifier that she has signed a message in such a way that the designated verifier cannot transfer the signature to a third party, and no third party can even verify the validity of a designated verifier signature. We show that anyone who intercepts one signature can verify subsequent signatures in Zhang-Mao ID-based designated verifier signature scheme and Lal-Verma ID-based designated verifier proxy signature scheme. We propose a new and efficient ID-based designated verifier signature scheme that is strong and unforgeable. As a direct corollary, we also get a new efficient ID-based designated verifier proxy signature scheme.     

代理盲签名方案的安全性分析

代理签名是指原始签名人将签名权力委托给代理签名人，由代理签名人代表原始签名人对消息进行签名。盲签名是指签名人不知道所签消息的具体内容。Zhao和Liu结合代理签名和盲签名的特性提出了一种代理盲签名，该文指出Zhao和Liu提出的代理盲签名方案存在广泛的伪造攻击、原始签名人的伪造攻击和消息拥有者的伪造攻击等安全缺陷，并提出了改进的方案，改进后的方案可以有效地避免原始签名人和消息拥有者的伪造攻击。     

基于双线性对的代理盲签名

代理签名让原始签名者可以将其数字签名权力委托给代理签名者,使其能够代理原始签名者签发指定的数字消息;盲签名使用户能将给定的消息让别人签发,而又不泄漏任何有关的信息给签名者。文中结合两者的优点,利用基于椭圆曲线上的Weil配对的双线性映射,构造了一个基于双线性对的代理盲签名方案,并对其安全性进行了分析。     

可验证环签名方案的分析和改进

通过对罗大文等提出的无证书的可验证环签名方案(罗大文, 何明星, 李虓. 无证书的可验证环签名方案. 计算机工程, 2009, 35(15): 135-137)和可验证的代理环签名方案(罗大文, 何明星, 李虓.可验证的代理环签名方案. 西南民族大学学报:自然科学版, 2009, 35(3):608-611)进行分析,指出这两个可验证环签名方案不满足不可否认性,即环中的成员可以冒充环内其他成员生成有效的环签名,并使验证者相信签名是后者所为。针对上述问题,利用签名者的私钥产生秘密值,提出了改进的可验证环签名方案,安全性分析表明改进的方案克服了原方案的安全缺陷,满足可验证环签名的所有安全要求。     

一个可证安全的高效的代理盲签名方案

代理盲签名结合了代理签名和盲签名的优点,在电子商务等领域有着广阔的应用前景。目前大多数代理盲签名的安全性是启发式分析,没有形式化证明,并且大多没有考虑多一伪造攻击。提出了一个新型的代理盲签名安全模型,并在该模型下提出了一个基于双线性对的代理盲签名方案,并在随机预言机模型下,证明了其在选择消息/授权文件攻击下是不可伪造的,其安全性可分别规约为CDH问题和Chosen-Target CDH问题。分析表明,该方案满足代理盲签名的主要安全要求,而且和已有的方案相比,本方案更加高效。     

新的代理盲签名方案及其在电子现金中的应用*

在普通的代理签名中,原始待签消息对代理签名者来说是完全可见的,而在现实应用中,原始待签消息可能含有原始签名者或消息接收者的一些机密,这时让代理签名者看到待签消息的明文是不合理的。针对这一问题,将盲签名的体制引入代理签名中,给出了一个新的代理盲签名方案。通过分析表明,该方案不仅能满足代理盲签名所要求的所有性质,而且代理密钥的传输无须使用安全的秘密通道;同时,可以应用到电子现金等现实领域中。     

An efficient CCA-secure cryptosystem over ideal lattices from identity-based encryption

We first construct an efficient IND-sID-CPA secure IBE cryptosystem from ideal lattices, and proceed with its security proof under the standard model in detail. Then with an asymptotically efficient strongly unforgeable one-time signature, we propose a new CCA secure public key encryption (PKE) scheme over ideal lattices by universal paradigm of IBE transformation. Performance of the resulting PKE system is very close to the underlying IBE scheme and its security can be tightly reduced to decisional R-LWE hardness assumption. Compared with known CCA secure PKE schemes from standard lattices, our new scheme is simpler and more efficient.     

一个前向安全无证书代理签名方案的安全性分析*

对一个前向安全无证书代理签名方案进行分析,指出这个方案既不具有不可伪造性,也不具有前向安全性。证明了该方案对于公钥替换攻击是不安全的,即敌手通过替换原始签名者和代理签名者的公钥可以伪造该代理签名者对任意消息的代理签名,给出了伪造攻击方法。指出该方案不具备前向安全性的原因,即该签名方案的代理密钥更新算法没有利用时段标识,代理签名没有明确包含时段信息。     

Security weaknesses of a signature scheme and authenticated key agreement protocols

At ACISP 2012, a novel deterministic identity-based (aggregate) signature scheme was proposed that does not rely on bilinear pairing. The scheme was formally proven to be existentially unforgeable under an adaptive chosen message and identity attack. The security was proven under the strong RSA assumption in the random oracle model. In this paper, unfortunately, we show that the signature scheme is universally forgeable, i.e., an adversary can recover the private key of a user and use it to generate forged signatures on any messages of its choice having on average eight genuine signatures. This means, that realizing a deterministic identity-based signature scheme in composite order groups is still an open problem. In addition, we show that a preliminary version of the authenticated key exchange protocol proposed by Okamoto in his invited talk at ASIACRYPT 2007 is vulnerable to the key-compromise impersonation attack and therefore cannot be secure in the eCK model. We also show that the two-party identity-based key agreement protocol of Hölbl et al. is vulnerable to the unknown key-share attack.     

Strong unforgeability in group signature schemes

A signature scheme is strongly unforgeable if no adversary can produce a new valid signature σ on a message M even after seeing some signatures on M. We define strong unforgeability of group signature schemes and explain why the strong unforgeability of a group signature scheme is necessary. This relatively new security concept was not considered when Bellare–Micciancio–Warinschi established their security model, what we call the BMW security model, of group signature schemes. We show that a scheme proposed at Eurocrypt'06 that was proven secure in the BMW security model is not strongly unforgeable. We also present a method to convert this scheme into a strongly unforgeable group signature scheme preserving the security in the BMW security model.     

新的无可信私钥生成中心的盲签名方案

为了消除基于身份公钥密码体制中密钥托管带来的安全隐患,设计了一个基于身份的无需可信私钥生成中心（PKG）的盲签名方案。在随机预言机模型中证明了新方案对普通攻击者和半诚实的PKG的自适应选择消息和身份攻击是存在不可伪造的,安全性归约为计算Diffie-Hellman问题;而对恶意PKG的伪造攻击,合法签名者可以通过追溯算法向仲裁方证明签名是伪造的。     

A novel nonrepudiable threshold multi-proxy multi-signature scheme with shared verification

Tzeng et al. proposed a new threshold multi-proxy multi-signature scheme with threshold verification. In their scheme, a subset of original signers authenticates a designated proxy group to sign on behalf of the original group. A message m has to be signed by a subset of proxy signers who can represent the proxy group. Then, the proxy signature is sent to the verifier group. A subset of verifiers in the verifier group can also represent the group to authenticate the proxy signature. Subsequently, there are two improved schemes to eliminate the security leak of Tzeng et al.’s scheme. In this paper, we have pointed out the security leakage of the three schemes and further proposed a novel threshold multi-proxy multi-signature scheme with threshold verification.     

紧致安全的基于身份的签名方案

本文提出了第一个紧致安全的基于身份的签名(IBS)方案.我们的构造基于Bellare等人提出的基于证书思想的通用转化方法,包括两个组件,即选择消息攻击下不可伪造安全(EUF-CMA安全)的签名方案S,和多用户场景中选择消息攻击&动态密钥窃取攻击下不可伪造安全(MU-EUF-CMAcorr安全)的签名方案S.组件S的公私钥用作IBS的主公钥和主私钥,用户id的签名私钥包含了组件S所产生的一对公私钥,以及主私钥对id和S的公钥的签名证书.用户对消息的签名包含了组件S的公钥和证书,以及S的私钥对此消息的签名.IBS的安全性可以紧致归约到组件S的EUF-CMA安全性和组件S的MU-EUF-CMAcorr安全性.最后,我们给出了组件S和S的实例化,并分别在随机预言机模型和标准模型下得到了紧致(与几乎紧致)EUF-CMA&CIA安全的IBS方案.     

一个高效的基于身份的同时签名方案

提出了一个新的基于身份的同时签名方案,此方案能更好地体现同时签名的公平性。分析表明,与现存方案相比,所提方案具有较高的效率。在随机预言模型下,可证明该方案在适应性选择消息攻击下是存在不可伪造的。     

门限多代理多签名方案*

将门限签名体制引入到多代理多签名方案中,首次提出了一个门限多代理多签名方案。新方案不仅能实现多个原始签名人将签名权委托给多个代理签名人,还能将每个代理人的密钥进行分享,实现一定数量的原始签名人就能授权,一定数量的代理签名人就能产生有效的代理签名。另外,新方案还可以控制代理签名的有效时间和回收代理签名权。