Attack on Chen et al.'s certificateless aggregate signature scheme

Cryptanalysis and improvement of a certificateless aggregate signature scheme

Cryptographic algorithm plays an important role in the teaching of network security course. Certificateless aggregate signature (CLAS) scheme is an important cryptographic algorithm in cryptography. Many CLAS schemes have been proposed with some property, such as designated verifier property. Designated verifier property makes it possible for a specific person to verify the signature which can be applied in many scenes, such as medicine and biology system and et al. In this paper, we analyze a CLAS scheme with designated verifier property proposed in 2020 which satisfies designated verifiability property, unforgeability property and non-transitivity property. However, we point out that the CLAS scheme does not satisfy the unforgeability as they claimed. We present two improved methods to overcome these existed security drawbacks. By analyzing the security of a CLAS scheme and proposing some improved methods, it can let students know how to better design a secure cryptographic algorithm in process of network security course.

Vehicular Ad-Hoc Network (VANET) is an open environment. In VANET, it needs protect some privacy information of the vehicle, such as the real identity of the vehicle, the number of the vehicle. Certificateless aggregate signature (CLAS) scheme can reduce the calculation cost and communication cost due to the aggregation property, which is important part of cryptography. In this paper, we present two CLAS schemes proposed recently and also give a security analysis on the two CLAS schemes. By security analysis on the both CLAS schemes, it finds that the two CLAS schemes can be forged by the malicious enemy by replacing the public key of the user but without knowing the master key of key generation center. At the same time, we also show that second CLAS scheme does not satisfy the tractability property. In other words, the malicious vehicle cannot be traced after it makes some malicious signatures. We also present an improved CLAS schemes based on the original CLAS scheme respectively. By some security analysis and efficiency analysis, it can find that the improved CLAS schemes both not only can overcome the security problem but also are still efficient.

The existing certificateless aggregate signature schemes have problems in terms of security and efficiency: some schemes are not secure, which does not satisfy the claimed unforgeability, others are secure, but the calculation and communication cost are large. Based on the comprehensive consideration of security and efficiency, this paper designs a new certificateless aggregate signature scheme without bilinear pairing, proves the security of the scheme under the random oracle model and computational Diffie-Hellman problem. The new scheme not only overcomes the security problem of the existing scheme, but also has a fixed length of aggregate signature. The user does not need to exchange a large amount of information when performing single signature, so that users can dynamically join the aggregate signature.

Ensuring the secure sharing of privacy-sensitive healthcare data is attracting considerable interest from researchers. Recently, Ogundoyin et al. designed a lightweight privacy-preserving authentication scheme named PAASH for smart health applications. Benil et al. proposed a public verification and auditing scheme named ECACS for securing e-health systems. Ogundoyin et al. and Benil et al. proposed an efficient certificateless aggregate signature (CLAS) scheme as their respective foundation signature schemes. They declared that their constructions were provably secure under the hardness assumption of cryptographic problems. In this work, we disprove their claim by analyzing the correctness and security of their underlying CLAS schemes. We first show that the batch verification process of n signatures for the CLAS scheme in PAASH is incorrect, and any public-key replacement attacker can easily break the scheme. We analyze the reasons for our attack and propose an improved scheme, named PAASH+. We then show that the CLAS scheme in ECACS fails to achieve correctness, an essential property that a cryptographic scheme should provide. As a result, it is impractical to deploy the designed PAASH and ECACS constructions in any real smart health applications.

Due to the limited energy of underwater wireless sensor network (UwWSN) and the need to protect node location privacy, aggregate signature (AGGS) scheme which can batch verification signature is proposed to meet these requirements. Due to moving at high speed and the limited bandwidth of communication in vehicular ad hoc network (VaNET), certificateless aggregate signature (CTLAS) with the private key being generated by the signer itself and PKG (Private Key Generator) is proposed to solve the above problems. Recently, Yang et al. proposes a CTLAS scheme which can be applied into VaNET and Hua proposes an AGGS scheme which can be applied into UwWSN. This paper shows that Yang et al.'s CTLAS scheme and Hua's AGGS scheme both are not secure. In Yang et al.'s CTLAS scheme, an attacker can forge a signature assume that the attacker cannot know the masker key of PKG but the attacker can replace the public key of the signer. In Hua's AGGS scheme, a malicious node can forge a signature for any nodes after the malicious node obtains a temporary key. As an improvement, this paper also proposes an improved method for Yang et al.'s scheme and Hua's scheme respectively.

An aggregate signature (AS) scheme combines multiple signatures which is generated by many different users into a single one. This feature is very beneficial for diminishing storage cost, bandwidth and verification cost. Many previous attempts have been made for designing AS schemes, while the former security models have not clearly addressed coalition attacks, and most of the existing AS schemes cannot resist these kinds of attacks. In this study, the authors provide a modified security model of certificateless AS (CLAS) schemes and then give a new CLAS scheme. The security of their present scheme can be rigorously proved based on the computational Diffie-Hellman assumption in the random oracle model. Furthermore, their scheme can resist such coalition attacks, i.e. an AS in their scheme is valid iff all single signatures used to generate the AS are valid.

A new attack against a novel certificateless aggregate signature scheme with constant pairing computations is presented. To enhance security, a new certificateless signature scheme is proposed first. Then a new certificateless aggregate signature scheme with constant pairing computations based on the new certificateless signature scheme is presented. Security analysis shows that the proposed certificateless aggregate signature scheme is provably secured in the random oracle.

In this paper, we propose two certificateless aggregate signature schemes, which are the first aggregate signature schemes in the CL-PKC. The first scheme CAS -1 reduces the costs of communication and signer-side computation but loses on storage, while CAS - 2 minimizes the storage but sacrifices the communication. We can choose one of the above schemes by the consideration of the implementation requirement. Our schemes do not need the public key certificate anymore and achieve the trust level 3, the same level with traditional PKI. Both of the schemes are proven secure in the random oracle model(ROM) by assuming the intractability of the computational Diffie-Hellman(CDH) problem over groups with bilinear maps.

An aggregate signature refers to a signature, by which n signatures σ1,...,σn corresponding to n messages m1,...,mn and n users u1,...,un can be transformed into a single short signature . Besides, anyone can be convinced by the single short signature that the n messages m1,...,mn were definitely signed by the n users u1,...,un correspondingly. The concept of certificateless cryptography is proposed, so as to settle the key escrow problem in ID‐based cryptography and eliminate the demand for certificates in certified cryptography. A certificateless signature scheme was proposed by Chen et al. in 2014, which was extended into a certificateless aggregate signature scheme. In this paper, two attacks are firstly provided, so as to indicate that the certificateless signature scheme is insecure against a Type I adversary and a Type II adversary. And then, it is demonstrated that the certificateless aggregate signature scheme is not able to achieve the security levels they claimed due to the weaknesses of the certificateless signature scheme. Copyright © 2016 John Wiley & Sons, Ltd.

CL-ASS: An efficient and low-cost certificateless aggregate signature scheme for wireless sensor networks

Certificateless aggregate signature scheme is a very effective technique for ad hoc networks such as vehicular ad hoc network. An aggregate scheme aggregates the individual signature, which reduces the computational overhead and useful in the areas, where bandwidth limitation is a major issue. Recently, Malhi and Batra proposed a certificateless aggregate signature scheme for vehicular ad hoc networks and proved the scheme mathematically secure against possible types of security attacks. In this paper, we present the cryptanalysis of the scheme while applying some concrete attack “honest but curious”. The additional contribution to this paper is an improvement of the certificateless aggregated signature scheme.

Vehicular ad hoc networks (VANETs) have become an essential part of the intelligent transportation system because they provide secure communication among vehicles, enhance vehicle safety, and improve the driving experience. However, due to the openness and vulnerability of wireless networks, the participating vehicles in a VANET system are prone to a variety of cyberattacks. To secure the privacy of vehicles and assure the authenticity, integrity, and nonrepudiation of messages, numerous signature schemes have been employed in the literature on VANETs. The majority of these solutions, however, are either not fully secured or entail high computational costs. To address the above issues and to enable secure communication between the vehicle and the roadside unit (RSU), we propose a certificateless aggregate signature (CLAS) scheme based on hyperelliptic curve cryptography (HECC). This scheme enables participating vehicles to share their identities with trusted authorities via an open wireless channel without revealing their identities to unauthorized participants. Another advantage of this approach is its capacity to release the partial private key to participating devices via an open wireless channel while keeping its identity secret from any other third parties. A provable security analysis through the random oracle model (ROM), which relies on the hyperelliptic curve discrete logarithm problem, is performed, and we have proven that the proposed scheme is unforgeable against Type 1 (FGR1) and Type 2 (FGR2) forgers. The proposed scheme is compared with relevant schemes in terms of computational cost and communication overhead, and the results demonstrate that the proposed scheme is more efficient than the existing schemes in maintaining high-security levels.

PCAS: Cryptanalysis and improvement of pairing-free certificateless aggregate signature scheme with conditional privacy-preserving for VANETs

Safe and efficient collection of users’ electronic consumption data is a basic function of the smart grid. Anonymous aggregate signature is a fine option to realize this feature, which can not only reduce the computing cost of the data center (DC) but also protect the user’s identity information from leaking. The security proofs of all known identity-based aggregate signature (IBAS) schemes were completed in the random oracle model (ROM). Regrettably, these schemes are not necessarily secure in real life. In this article, we first propose the system model and security demands of an identity-based designated verifier anonymous aggregate signature (IB-DVAAS) scheme for smart grids. We then come up with a concrete scheme, only the designated DC can check the validity of an aggregate signature, but it cannot recognize the real identity of the signers. Next, we display the security proofs in the standard model. Finally, we conduct an analysis on performance for six aggregate signature schemes. Only three pairing operations are required and hash-to-point operations are not used, the calculation cost of the new scheme is lower than that of other schemes.