Cryptanalysis of Chang et al.'s signature scheme with message recovery

Recently, Chang et al., (2004) proposed a new digital signature scheme with message recovery and claimed that neither one-way hash functions nor message redundancy schemes were employed in their scheme. However, in this letter, two forgery attacks are proposed to show that Chang et al.'s signature scheme is not secure. To resist these attacks, the message redundancy schemes may still be used.     

Cryptanalysis of Shieh-Lin-Yang-Sun signature scheme

Due to the special requirements of the mobile code system, Shieh et al. (see IEEE Trans. Veh. Technol., vol.49, p.1464-73, July 2000) proposed some multisignature schemes based on a new digital signature scheme with message recovery. One major characteristic of these schemes is to avoid using one-way hash functions and message redundancy schemes. However, this causes some security flaw. An attack is proposed to show that the underlying signature scheme is not secure. To overcome the attack, the message redundancy schemes may be still used.     

Cryptanalysis of digital multisignature schemes for authenticating delegates in mobile code systems

Shieh et al. proposed two multisignature schemes for message recovery -the parallel multisignature scheme and the serial multisignature scheme - for authenticating delegates in mobile code systems. In this paper, we will show that Shieh et al.'s multisignature schemes are vulnerable to insider forgery attacks hence cannot achieve the security requirements they claimed.     

Attacks on Shieh-Lin-Yang-Sun digital multisignature schemes for authenticating delegates in mobile code systems

Shieh-Lin-Yang-Sun (see ibid., vol.49, p.1464-73, July 2000) proposed two digital multisignature schemes for authenticating delegates in mobile code systems. They claimed that both multisignature schemes can withstand attacks that aim to forge the signature. We present some forgery attacks on the two multisignature schemes, respectively. Our results show that Shieh et al. schemes are insecure against forgery attacks launched inside delegates.     

Forgery attacks on digital signature schemes without using one-way hash and message redundancy

Chang and Chang proposed a new digital signature scheme, and claimed the scheme can resist the forgery attack without using one-way hash function and any redundancy padding. This claim is very interesting to all designers, because conventionally a one-way hash function is required to resist the attacks. This article shows an existential forgery attack on the scheme, and shows that the scheme would still be insecure even if a secure one-way function were adopted in the scheme.     

Security Analysis of Randomize-Hash-then-Sign Digital Signatures

At CRYPTO 2006, Halevi and Krawczyk proposed two randomized hash function modes and analyzed the security of digital signature algorithms based on these constructions. They showed that the security of signature schemes based on the two randomized hash function modes relies on properties similar to the second preimage resistance rather than on the collision resistance property of the hash functions. One of the randomized hash function modes was named the RMX hash function mode and was recommended for practical purposes. The National Institute of Standards and Technology (NIST), USA standardized a variant of the RMX hash function mode and published this standard in the Special Publication (SP) 800-106. In this article, we first discuss a generic online birthday existential forgery attack of Dang and Perlner on the RMX-hash-then-sign schemes. We show that a variant of this attack can be applied to forge the other randomize-hash-then-sign schemes. We point out practical limitations of the generic forgery attack on the RMX-hash-then-sign schemes. We then show that these limitations can be overcome for the RMX-hash-then-sign schemes if it is easy to find fixed points for the underlying compression functions, such as for the Davies-Meyer construction used in the popular hash functions such as MD5 designed by Rivest and the SHA family of hash functions designed by the National Security Agency (NSA), USA and published by NIST in the Federal Information Processing Standards (FIPS). We show an online birthday forgery attack on this class of signatures by using a variant of Dean’s method of finding fixed point expandable messages for hash functions based on the Davies-Meyer construction. This forgery attack is also applicable to signature schemes based on the variant of RMX standardized by NIST in SP 800-106. We discuss some important applications of our attacks and discuss their applicability on signature schemes based on hash functions with ‘built-in’ randomization. Finally, we compare our attacks on randomize-hash-then-sign schemes with the generic forgery attacks on the standard hash-based message authentication code (HMAC).     

对2个基于身份签名方案的伪造攻击

对李—姜(2009)和谷—贾—姜(2011)依据Paterson方案(2006)分别提出的标准模型下基于身份的签名方案构造了3个有效的伪造攻击算法:攻击者在不得到任何签名用户私钥的情况下,仅通过选取随机参数以及多项式时间内的计算,便能够以显著的概率成功伪造任意用户对任意消息的有效签名。这些攻击算法显示李—姜和谷—贾—姜的基于身份签名方案都是不安全的。最后分析了方案遭受攻击的原因,并给出了2个可能的改进措施。     

Nyberg-Rueppel消息恢复盲签名的一般化和改进

给出Nyberg-Rueppel消息恢复签名方案的一般性盲化方法,由该方法可以得到其3个盲化方案,其中一个就是Camenisch等人的方案,另外两个则是新的。在这两个新的方案中,一个与已有方案效率相当,另一个因无需求逆运算而效率更高。使用填充技术和hash函数,得到在ROM(randomoraclemodel)和GM(genericgroupmodel)模型下抗适应性选择消息伪造的可证明安全的消息恢复盲签名方案。     

Hash function based on chaotic tent maps

In cryptographic applications, hash functions are used within digital signature schemes to provide data integrity (e.g., to detect modification of an original message). In this brief, we propose a new 2/spl lscr/ -bit iterated hash function based on chaotic tent maps. This hash function can be expected to have at least the same computational security against target attack, free-start target attack, collision attack, semi-free-start collision attack, and free-start collision attack as DM scheme.     

Homomorphic signature schemes for single-source and multi-source network coding

To solve the problems of pollution attacks of single-source and multi-source network coding,two homomorphic signature schemes for network coding were proposed.In homomorphic signature for single-source network,the message hash value was signed on the elliptic curve,then the message,hash value and the signature of hash value were output,and the receiving node could verify the signature,the elliptic curve signature based on homomorphism could resist intra/inter-generation pollution attacks.Homomorphic signature from pairings for multi-source network coding could resist pollution attacks,and the introduction of timestamp made it be capable to resist replay attacks.In the random oracle model,it proves that two schemes are all secure under the selective attacks.Analysis shows that two schemes can effectively improve the verification efficiency.     

破解新型的轻量级数字签名方案

由于RSA、ECC签名方案计算效率低,不适用于无线传感器网络、低廉智能卡、无线射频RFID等特殊应用领域。为设计适用于计算能力有限的小计算设备上的签名方案,Wang等人结合散列认证技术,提出了一种新型的轻量级数字签名方案。针对该新型轻量级数字签名方案,给出了由签名公钥求解其等价签名私钥的多项式时间算法。使用等价签名私钥,对手可以对任意消息伪造签名,从而破解了他们结合散列认证技术提出的数字签名方案。     

Improvement of ID-based proxy re-signature scheme with pairing-free

As an all-important cryptographical technique, proxy re-signature (PRS) is broadly applied to distributed computation, copyright transfer and hidden path transfer because it permits a proxy to translate an entity’s signature into another entity’s signature on the identical message. Most existing PRS schemes make use of time-consuming pairing computation. Recently, to discard time-consuming pairing operator and complicated certificate-management, Wang et al. proposed two efficient pairing-free ID-based PRS schemes, and declared that their schemes were provably secure in the ROM. Very unluckily, in this investigation, we point out that Wang et al.’s schemes suffer from attacks of universal forgery by analyzing their security, i.e., any one can fabricate a signature on arbitrary data. After the relevant attacks are shown, the reasons which result in such attacks are analyzed. Finally, to address the above-mentioned attacks, we put forward an improved ID-based PRS scheme. The improved scheme not only preserves all advantages of Wang et al.’s scheme, but also is demonstrated to be provably secure in the ROM. Compared with the other two ID-PRS schemes, our improved ID-PRS scheme offers more advantages in respect of the overall performance and security.

     

一种面向群组通信的通用门限签密方案

基于椭圆曲线密码体制和Schnorr数字签名体制,建立了一个同时具有(t,n)门限签密和(k,l)共享验证功能的通用门限方案.该方案克服了Wang等人方案的安全缺陷和Hsu等人方案的弱点;以较小的通信代价和高效的运算在群组通信中实现了保密性和认证性;在不暴露接收组的私钥和消息m的情况下,利用公开验证功能实现了发送方的不可抵赖性;另外,该方案还可以防止消息的猜测攻击,从而实现了语义安全性.     

两种签密方案的安全性分析及改进

签密是能够在同一算法中提供认证性和机密性的密码方案,而所需要的计算量、通信成本和密文长度比先签名后加密的分开来实现要低,有较多的实际应用需求。多签密方案是多个签密者对同一明文执行签密操作。该文分析了两个签密方案:Li等(2006)提出的签密方案和Zhang等(2008)提出的多签密方案,并通过选择明文攻击证明二者不能不具有语义安全性,并在此基础上提出了改进的方案,采用隐藏消息明文方法抵抗选择明文攻击,采用多签密成员签名认证的方法防止多成员签密密文被篡改,可抵抗选择明文攻击和选择身份攻击,达到语义安全性。     

对一类群签名方案的伪造攻击

该文对王晓明等(2003)和林松等(2006)最近依据Tseng-Jan(1999)群签名方案各自提出的一种改进群签名设计了两种伪造攻击策略。利用该伪造攻击,攻击人不需要任何签名者的保密身份信息和秘密密钥信息,只是通过选取随机参数、改变原方案的部分设计步骤就能成功伪造出群成员证书,进而伪造出验证有效的群签名,从而威胁到群签名人的合法权益。该文的伪造攻击策略对Lee-Chang(1998)群签名、Tseng-Jan群签名及由其演化而来的所有群签名方案都具有效性,从而证明该类群签名方案全都是不安全的。     

一种强不可伪造无证书签名方案的密码学分析与改进

无证书密码体制是无线网络中一种非常有效安全保护工具.2016年,Hung等人提出了标准模型下一种强不可伪造性的无证书签名方案,该方案声称在抗哈希碰撞问题和计算Diffle-Hellman困难问题假设下是安全不可伪造的.事实上,该方案对类型II敌手是不安全的.本文给出对Hung等的方案的安全性分析,并证明对于类型II敌手可以伪造出合法签名,针对存在问题提出一种改进的无证书签名方案.     

Immunizing public key cryptosystems against chosen ciphertextattacks

Three methods for strengthening public key cryptosystems in such a way that they become secure against adaptively chosen ciphertext attacks are presented. In an adaptively chosen ciphertext attack, an attacker can query the deciphering algorithm with any ciphertext except for the exact object ciphertext to be cryptanalyzed. The first strengthening method is based on the use of one-way hash functions, the second on the use of universal hash functions, and the third on the use of digital signature schemes. Each method is illustrated by an example of a public key cryptosystem based on the intractability of computing discrete logarithms in finite fields. Security of the three example cryptosystems is formally proved. Two other issues, namely, applications of the methods to public key cryptosystems based on other intractable problems and enhancement of information authentication capability to the cryptosystems, are also discussed     

A Robust User Authentication Scheme Using Dynamic Identity in Wireless Sensor Networks

In modern, wireless sensor networks (WSNs) stand for the next evolutionary and innovative development step in utilities, industrial, building, home, shipboard, and transportation systems automation. The feature of WSNs is easy to deploy and has wide range of applications. Therefore, in distributed and unattended locations, WSNs are deployed to allow a legitimated user to login to the network and access data. Consequently, the authentication between users and sensor nodes has become one of the important security issues. In 2009, M. L. Das proposed a two-factor authentication for WSNs. Based on one-way hash function and exclusive-OR operation, the scheme is well-suited for resource constrained environments. Later, Khan and Algahathbar pointed out the flaws and vulnerabilities of Das’s scheme and proposed an alternative scheme. However, Vaidya et al. found that both Das’s and Khan–Algahathbar’s schemes are vulnerable to various attacks including stolen smart card attacks. Further, Vaidya et al. proposed an improved two-factor user authentication to overcome the security weakness of both schemes. In this paper, we show that Vaidya et al.’s scheme still exposes to a malicious insider attack that seriously threatens the security of WSNs. Furthermore, we propose an improve scheme that mends those vulnerabilities.     

Security analysis and improvement of two attribute-based signature schemes

In order to overcome the drawbacks of current attribute-based signature (ABS) schemes in terms of security,efficiency and signing policy,Ma,et al.and Cao,et al.respectively proposed a threshold ABS with single attribute au-thority and a multi-authority ABS with signing policy supporting AND,OR,threshold gates,and presented the security proof of their schemes under computational Diffie-Hellman assumption.Both schemes were demonstrated have security pitfalls by presenting specified attacks against them.Specifically,their schemes are all vulnerable to forgery attack.Thus,they are not feasible for practical applications.In addition,the cause of the flaws in these ABS schemes are presented,as well as an improvement of Ma et al.'s scheme.     

A practical quadratic residues based scheme for authentication and privacy in mobile RFID systems

In this paper we propose a novel approach to authentication and privacy in mobile RFID systems based on quadratic residues and in conformance to EPC Class-1 Gen-2 specifications. Recently, Chen et al. (2008) [10] and Yeh et al. (2011) [11] have both proposed authentication schemes for RFID systems based on quadratic residues. However, these schemes are not suitable for implementation on low-cost passive RFID tags as they require the implementation of hash functions on the tags. Consequently, both of these current methods do not conform to the EPC Class-1 Gen-2 standard for passive RFID tags which from a security perspective requires tags to only implement cyclic redundancy checks (CRC) and pseudo-random number generators (PRNG) leaving about 2.5k–5k gates available for any other security operations. Further, due to secure channel assumptions both schemes are not suited for mobile/wireless reader applications. We present the collaborative authentication scheme suitable for mobile/wireless reader RFID systems where the security of the server–reader channel cannot be guaranteed. Our schemes achieves authentication of the tag, reader and back-end server in the RFID system and protects the privacy of the communication without the need for tags to implement expensive hash functions. Our scheme is the first quadratic residues based scheme to achieve compliance to EPC Class-1 Gen-2 specifications. Through detailed security analysis we show that the collaborative authentication scheme achieves the required security properties of tag anonymity, reader anonymity, reader privacy, tag untraceability and forward secrecy. In addition, it is resistant to replay, impersonation and desynchronisation attacks. We also show through strand space analysis that the proposed approach achieves the required properties of agreement, originality and secrecy between the tag and the server.