Security analysis of a publicly verifiable data possession scheme for remote storage

As an essential technology of cloud computing, the cloud storage can exactly satisfy the demand of users with the service of scalability, ubiquitous access and low maintenance cost. However, moving data to the cloud servers will bring some significant security challenges due to the loss of the physical data possession. In order to verify the data integrity, many verifiable data possession schemes have been proposed in last several years. Very recently, Tang and Zhang proposed a new publicly verifiable data possession (PVDP) scheme for remote storage. They claimed that their scheme was suitable for checking the storage correctness and secure against various types of attacks. In this paper, we analyze the security of Tang and Zhang’s PVDP scheme and prove that it is vulnerable to the data recovery attack. We also demonstrate that PVDP scheme works incorrectly with a concrete instance. Our analysis shows that their scheme is not suitable for practical applications. Our work can help cryptographers and engineers design and implement more secure and efficient public auditing schemes for the cloud storage data.