A Provably Secure Server-Aided Verification Signature

A server-aided verification signature scheme consists of a digital signature scheme and a server-aided verification protocol. By executing the server-aided verification protocol with the server, one can perform the verification of signatures with less computational cost compared to the original verification algorithm. This mechanism is therefore indispensable for low-power devices such as smart cards. The contributions of this paper are manyfold. Firstly, we introduce and define the existential unforgeability of server-aided verification signatures. We prove that the new notion includes the existing security requirements in server-aided verification signatures. Then, we analyze the Girault-Lefranc scheme in Asiacrypt 2005 and show that their scheme can be made secure in our model, but the computational cost is more than the claimed in the original scheme. After that, we propose the first server-aided verification BLS, which is existentially unforgeable in the random oracle model under the Bilinear Diffie-Hellman assumption. Finally, we consider the collusion and adaptive chosen message attack in server-aided verification signatures. For the first time in the literature, the security of server-aided verification signatures against such attacks is defined. We provide a concrete construction of a server-aided verification BLS secure against the collusion and chosen message attack.

Comment on “An efficient identity-based signature scheme with provable security”

A newly developed signature scheme, namely the Easy Simple Factoring-based (ESF) signature scheme is proposed in this paper. First, we construct a standard identification scheme based on the ESF assumption. Then, the standard identification scheme is converted to a signature scheme by utilizing the Fiat-Shamir transformation. Our signature scheme is provable secure in the random oracle model, and the security proof is shown. The efficiency analysis of our scheme is conducted and compared with the Full Domain Hash (FDH) signature scheme. Our scheme has a more powerful efficiency performance in signing and verifying algorithms than the FDH signature scheme when the public keys u and γ in our signature scheme are fixed to small bit lengths.

In ITST2006, Chen et al. presented two server-aided public key generation protocols for low-power devices and claimed that their protocols secure against collusion attack. In this paper, we point that if the servers collude with each other, those servers could obtain low-power devices' secret information, and they can get the plaintext from any ciphertext. We also present an improved server-aided standard RSA key generation protocol against the collusion attack.

<p style='text-indent:20px;'><b>I</b>dentity-<b>B</b>ased <b>B</b>roadcast <b>E</b>ncryption (<inline-formula><tex-math id="M1">\begin{document}$\textsf{IBBE}$\end{document}</tex-math></inline-formula>) is a novel concept that can efficiently and securely transmit confidential content to a group of authorized users without the traditional <b>P</b>ublic-<b>K</b>ey <b>I</b>nfrastructure (<inline-formula><tex-math id="M2">\begin{document}$\textsf{PKI}$\end{document}</tex-math></inline-formula>). After carefully exploring these areas, we have observed that none of the existing works have adopted the quantum-attack resistant cryptographic machinery <b>M</b>ultivariate <b>P</b>ublic-<b>K</b>ey <b>C</b>ryptography (<inline-formula><tex-math id="M3">\begin{document}$\textsf{MPKC}$\end{document}</tex-math></inline-formula>) with provable security. We are the <i>first</i> to design a quantum-safe <inline-formula><tex-math id="M4">\begin{document}$\textsf{IBBE}$\end{document}</tex-math></inline-formula> that solely relies on the <inline-formula><tex-math id="M5">\begin{document}$\textsf{MPKC}$\end{document}</tex-math></inline-formula> framework. Our proposed protocol has achieved <inline-formula><tex-math id="M6">\begin{document}$ \mathcal{O}(n) $\end{document}</tex-math></inline-formula>-size communication bandwidth and <inline-formula><tex-math id="M7">\begin{document}$ {n^3}\cdot\mathcal{O}\big(\max\big\{N, {\delta}^4\big\}\big) $\end{document}</tex-math></inline-formula>-size overhead storage without any security breach. Here, <inline-formula><tex-math id="M8">\begin{document}$ n $\end{document}</tex-math></inline-formula> is the number of variables for each multivariate polynomial, <inline-formula><tex-math id="M9">\begin{document}$ N $\end{document}</tex-math></inline-formula> represents the total number of system users, and <inline-formula><tex-math id="M10">\begin{document}$ \delta $\end{document}</tex-math></inline-formula> denotes a positive fixed-length. More positively, our design has achieved the <i>adaptive</i> <b>IND</b>istinguishable <b>C</b>hosen-<b>C</b>iphertext <b>A</b>ttack (<inline-formula><tex-math id="M11">\begin{document}$\textsf{IND-CCA}$\end{document}</tex-math></inline-formula>) security in the <b>R</b>andom <b>O</b>racle <b>M</b>odel (<inline-formula><tex-math id="M12">\begin{document}$\textsf{ROM}$\end{document}</tex-math></inline-formula>) under the hardness of standard <b>M</b>ultivariate <b>Q</b>uadratic (<inline-formula><tex-math id="M13">\begin{document}$\textsf{MQ}$\end{document}</tex-math></inline-formula>) problem. We emphasize that our system can also be immune against collusion attacks where several users come together to create an illicit decryption box.</p>

Recently, Celik et al. proposed a lookup-table (LUT)-based embedding mechanism for spread-spectrum watermarks, in which the content distribution server sends an encrypted content to the client, then the client uses his or her personalized decryption LUT to decrypt the received content, meanwhile embeds his or her personalized watermark into the content. They also provided a brief analysis on the security of the LUT-based embedding in terms of the collusion attack on watermarked contents. However, we find that the LUT-based embedding is vulnerable to not only the collusion attack on watermarked contents but the collusion attack on decryption LUTs as well, due to the fact all clients share the same long-term encryption LUT. In this paper, we present a theoretical analysis on the collusion security of the LUT-based embedding mechanism. The analysis shows that the collusion attack on decryption LUTs is more effective than the collusion attack on watermarked contents. Based on our analysis, the content distribution system proposed by Celik et al. can only be used for package sale, which limits its applications. In order to extend the applications, we suggest that the encryption and decryption LUTs of the LUT-based client-side embedding should be set as short-term keys instead of long-term keys. Finally, simulations are carried out to illustrate and validate our theoretical analysis.

Unmanned aerial vehicle (UAV) is an attractive application because of its flexibility and economy. It may use a digital signature scheme to protect commands sent to UAVs. Moreover, the digital signature scheme should guarantee the real-time performance of UAVs executing commands and protect the signer’s privacy. Therefore, we proposed an attribute-based proxy signature (ABPS) scheme supporting flexible threshold predicate for UAV networks and proved its security. It has existential unforgeability under selective-predicate and chosen message attacks (EUF-sP-CMA) and can protect the signer’s privacy. We analyzed its computation costs based on experimental data and communication costs. The analysis results indicate that our ABPS scheme has less computation costs than other ABPS schemes and is at the same level as other ABPS schemes on communication costs.

Though anonymity of ring signature schemes has been studied in many literatures for a long time, these papers showed different definitions and there is no consensus. Recently, Bender et al. proposed two new anonymity definitions of ring signature which is stronger than the traditional definition, that are called anonymity against attribution attacks/full key exposure. Also, ring signature schemes have two levels of unforgeability definitions, i.e., existential un-forgeability (eUF) and strong existential unforgeability (sUF). In this paper, we will redefine anonymity and unforgeability definitions from the standpoint of universally composable (UC) security framework. First, we will formulate new ideal functionalities of ring signature schemes for each security levels separately. Next, we will show relations between cryptographic security definitions and our UC definitions. Finally, we will give another proof of the Bender et al.'s ring signature scheme following the UC secure definition by constructing a simulator to an adversary of sUF, which can be adaptable to the case of sUF under the assumption of a standard single sUF signature scheme.

A unified framework of identity-based sequential aggregate signatures from 2-level HIBE schemes

One of the most efficient post-quantum signature schemes is Rainbow whose hardness is based on the multivariate quadratic polynomial (MQ) problem. ELSA, a new multivariate signature scheme proposed at Asiacrypt 2017, has a similar construction to Rainbow. Its advantages, compared to Rainbow, are its smaller secret key and faster signature generation. In addition, its existential unforgeability against an adaptive chosen-message attack has been proven under the hardness of the MQ-problem induced by a public key of ELSA with a specific parameter set in the random oracle model. The high efficiency of ELSA is derived from a set of hidden quadratic equations used in the process of signature generation. However, the hidden quadratic equations yield a vulnerability. In fact, a piece of information of these equations can be recovered by using valid signatures and an equivalent secret key can be partially recovered from it. In this paper, we describe how to recover an equivalent secret key of ELSA by a chosen message attack. Our experiments show that we can recover an equivalent secret key for the claimed 128-bit security parameter of ELSA on a standard PC in 177 s with 1326 valid signatures.

The goal of a signcryption scheme is to achieve the same functionalities as encryption and signature together, but in a more efficient way than encrypting and signing separately. To increase security and reliability in some applications, the unsigncryption phase can be distributed among a group of users, through a (t, n)-threshold process. In this work we consider this task of threshold unsigncryption, which has received very few attention from the cryptographic literature up to now (maybe surprisingly, due to its potential applications). First we describe in detail the security requirements that a scheme for such a task should satisfy: existential unforgeability and indistinguishability, under insider chosen message/ciphertext attacks, in a multi-user setting. Then we show that generic constructions of signcryption schemes (by combining encryption and signature schemes) do not offer this level of security in the scenario of threshold unsigncryption. For this reason, we propose two new protocols for threshold unsigncryption, which we prove to be secure, one in the random oracle model and one in the standard model. The two proposed schemes enjoy an additional property that can be very useful. Namely, the unsigncryption protocol can be divided in two phases: a first one where the authenticity of the ciphertext is verified, maybe by a single party; and a second one where the ciphertext is decrypted by a subset of t receivers, without using the identity of the sender. As a consequence, the schemes can be used in applications requiring some level of anonymity, such as electronic auctions.

Confidentiality and authenticity are two fundamental security requirement of Public key Cryptography. These are achieved by encryption scheme and digital signatures respectively. Wireless sensor networks are commonly used for critical security tasks such as intrusion or tamper detection, and therefore must be protected. The article proposes a provable secure signcryption scheme in Random oracle model for wireless security. It enables nodes to authenticate each other by keeping the information confidential. Also achieve data integrity in the communication. Security of the scheme is based on q-Diffie Hellman Problem. We modify the scheme proposed by Libert et al. and proposed a provably secure scheme with respect to security under assumptions of Strong Diffie-Hellman (SDH) and Diffie-Hellman Inversion (DHI) in the random oracles.

An efficient provably secure identity-based blind signature (IBBS) scheme based on bilinear pairings is proposed. Assuming the intractability of the q-Strong Diffie-Hellman problem, our IBBS is unforgeable under adaptive chosen-message and ID attack. Because of avoiding using the inefficient MapToPoint function, our IBBS can offer advantages in runtime over the schemes available. Based on this ID-based blind signature scheme, we describe the first ID-based threshold blind signature (TBS) and show that it has security properties of unforgeability and robustness.

With the popularity of vehicular ad-hoc networks (VANETs), the secure communications between the vehicle and vehicle as well as between the vehicle and infrastructure have attracted people’s great attention. Vehicle privacy protection (including vehicle identity privacy and location privacy), high mobility, density, and limited bandwidth are also a problem that cannot be negligible. In VANETs, it is necessary to design a message authentication protocol to ensure data transmission security, vehicle anonymity, and unlinkability. Considering the resource-constrained environments, the certificateless aggregate signature (CLAS) scheme can compress <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula> signatures of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula> messages from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula> vehicles into a single signature, which reduces the signature verification time and storage overhead at the roadside unit. Based on the aforementioned analysis, we design a fully aggregated conditional privacy-preserving CLAS scheme (CPP-CLAS) for VANETs. Instead of using the expensive bilinear pairings and map-to-point hash function operations, the proposed CPP-CLAS scheme uses the elliptic curve cryptosystem (ECC) and general hash functions. Also, with the use of CLAS technology, the computation and communication cost of the scheme are significantly reduced. In addition, based on the elliptic-curve discrete logarithm problem (ECDLP), we prove that the CPP-CLAS scheme is existential unforgeability under adaptively chosen message attacks (EUF-CMAs). Performance and security analyses show that the CPP-CLAS scheme is more efficient and secure than other existing related schemes.

Based on the GDH signature (short signature scheme) a probabilistic signature scheme is proposed in this paper with security proof. Then a new threshold proxy signature from bilinear pairings is proposed as well by using the new probabilistic signature scheme and the properties of the Gap Diffie-Hellman (GDH) group (where the Computational Diffie-Hellman problem is hard but the Decisional Diffie-Hellman problem is easy to solve). Our constructions are based on the recently proposed GDH signature scheme of Bonel et al.’s article. Bilinear pairings could be built from Weil pairing or Tate pairing. So most our constructions would be simpler, but still with high security. The proposed threshold proxy signature is the first one which is built from bilinear pairings. At the end of this paper security and performance of the threshold proxy signature scheme is also analyzed.