Provably secure server-aided verification signatures

A server-aided verification signature scheme consists of a digital signature scheme and a server-aided verification protocol. With the server-aided verification protocol, some computational tasks for a signature verification are carried out by a server, which is generally untrusted; therefore, it is very useful for low-power computational devices. In this paper, we first define three security notions for server-aided verification signatures, i.e., existential unforgeability, security against collusion attacks and security against strong collusion attacks. The definition of existential unforgeability includes the existing security requirements in server-aided verification signatures. We then present, on the basis of existing signature schemes, two novel existentially unforgeable server-aided verification signature schemes. The existential unforgeability of our schemes can be formally proved both without the random oracle model and using the random oracle model. We also consider the security of server-aided verification signatures under collusion attacks and strong collusion attacks. For the first time, we formally define security models for capturing (strong) collusion attacks, and propose concrete server-aided verification signature schemes that are secure against such attacks.     

Forgery attacks on Kang et al.’s identity-based strong designated verifier signature scheme and its improvement with security proof

Recently, Kang et al. proposed a new identity-based strong designated verifier signature scheme (ID-SDVS) and identity-based designated verifier proxy signature scheme (ID-DVPS). They claimed that their schemes are unforgeable. However, we found out that their schemes are universally forgeable in the sense that anyone can forge valid ID-SDVS and ID-DVPS on an arbitrary message without the knowledge of the secret key of either the signer or the designated verifier. Finally, we propose an improved ID-SDVS which is unforgeable. We give formal security proof of universal unforgeability of our scheme. We also give an improved ID-DVPS.     

Generic Transformation from Weakly to Strongly Unforgeable Signatures

Current techniques for transforming unforgeable signature schemes （the forged message has never been signed） to strongly unforgeable ones （the forged message could have been signed） require supplementary components to be added onto the original key pairs of the schemes. In addition, some of them can only be applied to a certain type of signature schemes. In this paper, we propose a new generic transformation technique which converts any unforgeable signature scheme into a strongly unforgeable one without modifying any component in the original key pair. This makes our technique especially compatible for practical use. Our technique is based on strong one-time signature schemes. We show that they can be constructed efficiently from any one-time signature scheme that is based on one-way functions. The performance of our technique also compares favorably with that of current ones. Besides, it is shown in this paper that our transformation can further be applied to schemes satisfying only a weak variant of unforgeability without any further modification. Furthermore, our technique can also be used for constructing strongly unforgeable signature schemes in other cryptographic settings which include certificateless signature, identity-based signature, and several others. To the best of our knowledge, similar extent of versatility is not known to be supported by any of those comparable techniques. Finally and of independent interest, we show that our generic transformation technique can be modified to an on-line/off-line signature scheme, which possesses a very efficient signing process.     

An efficient short certificate-based signature scheme

Certificate-based cryptography combines the merits of traditional public key infrastructure (PKI) and identity-based cryptography. It does not have the key escrow problem in identity-based cryptography, and eliminates the certificate revocation problem and third-party queries in traditional PKI. In this paper, we first refine the security model of certificate-based signatures introduced in EuroPKI’07. We then present a short certificate-based signature scheme, which is proven to be existentially unforgeable against adaptive chosen message attacks in the random oracle model. Our scheme requires only one pairing operation (and three pre-computable pairing operations) in signature generation and verification. In addition, the signature size of our scheme is only one group element. To the best of our knowledge, the signature size of our scheme is the shortest and the computational cost is the lowest when compared with other concrete certificate-based signature schemes in the literature. This makes our scheme possess strong applicability in situations with limited bandwidth and power-constrained devices.     

Forgeability of Wang-Zhu-Feng-Yau’s Attribute-Based Signature with Policy-and-Endorsement Mechanism

Recently, Wang et al. presented a new construction of attribute-based signature with policy-and-endorsement mechanism. The existential unforgeability of their scheme was claimed to be based on the strong Diffe-Hellman assumption in the random oracle model. Unfortunately, by carefully revisiting the design and security proof of Wang et al.’s scheme, we show that their scheme cannot provide unforgeability, namely, a forger, whose attributes do not satisfy a given signing predicate, can also generate valid signatures. We also point out the flaws in Wang et al.’s proof.     

高效的基于格的环签名方案

安全高效的环签名方案有很多重要应用.文中提出了一种新的基于格的环签名方案并在标准模型下给出了正式的安全性证明.在标准的小整数解(SIS)困难假设下,该方案对适应性选择消息攻击是强不可伪造的.与现有的标准模型下基于格的环签名方案相比,新方案签名长度更短,计算效率更高,安全性更强.     

完美前向安全的基于身份认证密钥协商方案

现有的基于身份的一轮认证密钥协商方案没能实现强的完美前向性.采用强不可伪造的签名算法对临时公钥进行签名,提出一种改进的基于身份认证密钥协商方案.首先,对Boneh和Boyen提出的强不可伪造的短签名方案进行改造,提出一种强不可伪造的基于身份签名方案;然后,将新签名方案与Ni等人提出的eCK安全的基于身份一轮认证密钥协商方案相结合,提出新的密钥协商方案.进一步,为了实现新方案的可证明安全性,在对比分析eCK-PFS模型和eCK模型的基础上,融合现有安全模型,定义了基于身份认证密钥协商方案分析的强安全模型ID-eCK-PFS.在ID-eCK-PFS模型下,通过安全性规约,证明了新提出的基于身份认证密钥协商方案实现了强安全性,包括抗密钥泄露伪装、抗临时秘密泄露和完美前向安全性等.     

Efficient attribute-based signature and signcryption realizing expressive access structures

This paper addresses the open problem of designing attribute-based signature (ABS) schemes with constant number of bilinear pairing operations for signature verification or short signatures for more general policies posed by Gagné et al. in Pairing 2012. Designing constant-size ABS for expressive access structures is a challenging task. We design two key-policy ABS schemes with constant-size signature for expressive linear secret-sharing scheme (LSSS)-realizable monotone access structures. Both the schemes utilize only 3 pairing operations in signature verification process. The first scheme is small universe construction, while the second scheme supports large universes of attributes. The signing key is computed according to LSSS-realizable access structure over signer’s attributes, and the message is signed with an attribute set satisfying the access structure. Our ABS schemes provide the existential unforgeability in selective attribute set security model and preserve signer privacy. We also propose a new attribute-based signcryption (ABSC) scheme for LSSS-realizable access structures utilizing only 6 pairings and making the ciphertext size constant. Our scheme is significantly more efficient than existing ABSC schemes. While the secret key (signing key or decryption key) size increases by a factor of number of attributes used in the system, the number of pairing evaluations is reduced to constant. Our protocol achieves (a) ciphertext indistinguishability under adaptive chosen ciphertext attacks assuming the hardness of decisional Bilinear Diffie–Hellman Exponent problem and (b) existential unforgeability under adaptive chosen message attack assuming the hardness of computational Diffie–Hellman Exponent problem. The security proofs are in selective attribute set security model without using any random oracle heuristic. In addition, our ABSC achieves public verifiability of the ciphertext, enabling any party to verify the integrity and validity of the ciphertext.     

几个改进的LKK代理签名方案分析

强不可伪造性和对安全信道依赖性的分析是对LKK代理签名方案安全性分析的重要内容之一。对文献[6-8]中的改进的LKK代理签名方案进行安全性分析,指出文献[6,7]中的方案仍存在缺陷并给出攻击方法,指出文献[8]中方案是一个具有强不可伪造性的不需要安全信道的方案。     

不需要可信任方的匿名代理签名方案

匿名代理签名是特殊的代理签名,设计不需要可信任方参与的匿名代理签名方案是代理签名的一个重要研究方向。该文分析了两个该类方案的安全性,在此基础上给出了一个新的不需要可信任方的匿名代理签名方案。该方案具有强不可伪造性,且签名结果不含冗余数据。并以新方案为基础设计了两个匿名代理多重签名方案。     

标准模型下基于身份代理盲签名方案

由于现有的基于身份代理盲签名方案要么没有得到形式化的安全证明,要么仅在随机预言（Random Oracle,RO）模型下可证明安全,提出一种标准模型下的基于身份代理盲签名方案。该方案的基本签名算法采用了Paterson等人提出的基于身份签名机制。在Paterson等人提出的标准安全模型基础上,引入代理签名敌手模型,并参考盲签名的安全模型,提出基于身份代理盲签名的标准模型。在此安全模型下,该方案被证明满足不可伪造性和盲性,具有可证明安全性。     

A note on an identity-based ring signature scheme with signer verifiability

Recently, Herranz presented an identity-based ring signature scheme featuring signer verifiability where a signer can prove that he or she is the real signer by releasing an authorship proof. In this paper we show that this scheme is vulnerable to a key recovery attack in which a user’s secret signing key can be efficiently recovered through the use of two known ring signatures and their corresponding authorship proofs. In addition, we present a simple method to fix this security vulnerability by slightly modifying the authorship proof. Our modified scheme simplifies the original scheme and improves performance. To show that the modified scheme is unforgeable, we define two types of unforgeability notions for both signatures and authorship proofs. In these notions an adversary has opening capability to confirm the real signers of ring signatures and thus can manipulate authorship proofs in an adaptive way. We then prove that our modified scheme is secure in terms of these unforgeability notions.     

An efficient CCA-secure cryptosystem over ideal lattices from identity-based encryption

We first construct an efficient IND-sID-CPA secure IBE cryptosystem from ideal lattices, and proceed with its security proof under the standard model in detail. Then with an asymptotically efficient strongly unforgeable one-time signature, we propose a new CCA secure public key encryption (PKE) scheme over ideal lattices by universal paradigm of IBE transformation. Performance of the resulting PKE system is very close to the underlying IBE scheme and its security can be tightly reduced to decisional R-LWE hardness assumption. Compared with known CCA secure PKE schemes from standard lattices, our new scheme is simpler and more efficient.     

无双线性对的基于身份多代理签名方案

现有基于身份的多代理签名方案采用计算量大的双线性对运算,总体计算开销较高。基于椭圆曲线上的加法循环群,提出一种不使用对运算的基于身份多代理签名方案,其中,用户私钥产生、代理签名授权和多代理签名算法均来源于Schnorr的短签名机制。在随机预言模型下,新方案的不可伪造性被规约为多项式时间敌手求解离散对数问题,具有可证明安全性。对比分析表明,新方案计算开销更低。     

可证安全的无证书代理环签名方案

代理环签名可使代理者以匿名的方式进行代理签名, 具有很多优点。首先给出无证书代理环签名方案的最强安全模型, 并利用双线性映射提出一个高效的无证书代理环签名方案。在所定义的最强的安全模型下, 方案给出了严格的安全证明, 它的安全性基于计算Diffie-Hellman问题的困难性。分析显示该方案满足诸如无条件匿名性、强不可伪造性等安全性质。鉴于该方案的安全、高效和无证书管理的优点, 它可广泛应用于电子政务、移动代理系统等方面。     

基于椭圆曲线的可证明安全的签密方案

签密方案可以同时实现保密和认证,且实现代价小于加密和签名之和,但大多数签密方案都没有严格的安全证明。为此,基于椭圆曲线群上的困难问题提出一个可证明安全的签密方案。方案仅需要一次双线性对运算,实现快速。在标准模型下,证明该方案既具有密文不可区分性与签名不可伪造性,也具有不可否认性、前向安全性和公开可验证性。     

一种子秘密演化的群体代理签名方案

针对目前群体代理签名方案中授权代理信息共享方法单一的问题,提出一种子秘密演化的群体代理签名方案.该方案在依赖于CDH问题的困难性以及双线性映射的基础上,运用细胞自动机理论和多项式共享方法构建出授权代理信息双子秘密,从而使得共享秘密能够随着代理签名次数进行演化更新,提高了授权代理信息的安全性.并且对方案的正确性、安全性和效率进行了分析.该方案无可信任中心,效率更高,不仅在群体代理签名可证安全模型下被证明具有群体代理签名不可伪造性,而且能够追踪代理者合谋滥用代理签名的情况.与现有的群体代理签名方案相比,该方案具有更高的安全性.     

强不可伪造的代理多签名方案

对Liu等提出的标准模型下的代理多签名方案(LIUZHENGHUA,HU YUPU,MA HUA.Secure proxy multi-signature scheme in the standard model[C]//Proceedings of ProvSec2008,LNCS 5324,Berlin:Springer-velag,2008:127 - 140)进行了安全性分析和改进.通过研究Liu方案的不可伪造性,证明了其只是弱不可伪造,并提出了对它的一个改进方案,同时给出了详细的安全性证明.该改进方案克服了Liu方案中存在的安全性缺陷,是一个具有强不可伪造性的代理多签名方案,安全性更强.     

A new certificateless aggregate signature scheme

Aggregate signatures are useful in special areas where the signatures on many different messages generated by many different users need to be compressed. In this paper, we study aggregate signatures in certificateless public key settings. We first present the notion and security model of certificateless aggregate signature schemes. Then we give an efficient certificateless aggregate signature scheme. Our scheme is existentially unforgeable under adaptive chosen-message attacks assuming the computational Diffie–Hellman problem is hard.