Provably secure certificateless aggregate signature scheme with designated verifier in an improved security model

Due to the limited energy of underwater wireless sensor network (UwWSN) and the need to protect node location privacy, aggregate signature (AGGS) scheme which can batch verification signature is proposed to meet these requirements. Due to moving at high speed and the limited bandwidth of communication in vehicular ad hoc network (VaNET), certificateless aggregate signature (CTLAS) with the private key being generated by the signer itself and PKG (Private Key Generator) is proposed to solve the above problems. Recently, Yang et al. proposes a CTLAS scheme which can be applied into VaNET and Hua proposes an AGGS scheme which can be applied into UwWSN. This paper shows that Yang et al.'s CTLAS scheme and Hua's AGGS scheme both are not secure. In Yang et al.'s CTLAS scheme, an attacker can forge a signature assume that the attacker cannot know the masker key of PKG but the attacker can replace the public key of the signer. In Hua's AGGS scheme, a malicious node can forge a signature for any nodes after the malicious node obtains a temporary key. As an improvement, this paper also proposes an improved method for Yang et al.'s scheme and Hua's scheme respectively.

Cryptanalysis and improvement of a certificateless aggregate signature scheme

Cryptographic algorithm plays an important role in the teaching of network security course. Certificateless aggregate signature (CLAS) scheme is an important cryptographic algorithm in cryptography. Many CLAS schemes have been proposed with some property, such as designated verifier property. Designated verifier property makes it possible for a specific person to verify the signature which can be applied in many scenes, such as medicine and biology system and et al. In this paper, we analyze a CLAS scheme with designated verifier property proposed in 2020 which satisfies designated verifiability property, unforgeability property and non-transitivity property. However, we point out that the CLAS scheme does not satisfy the unforgeability as they claimed. We present two improved methods to overcome these existed security drawbacks. By analyzing the security of a CLAS scheme and proposing some improved methods, it can let students know how to better design a secure cryptographic algorithm in process of network security course.

Vehicular Ad-Hoc Network (VANET) is an open environment. In VANET, it needs protect some privacy information of the vehicle, such as the real identity of the vehicle, the number of the vehicle. Certificateless aggregate signature (CLAS) scheme can reduce the calculation cost and communication cost due to the aggregation property, which is important part of cryptography. In this paper, we present two CLAS schemes proposed recently and also give a security analysis on the two CLAS schemes. By security analysis on the both CLAS schemes, it finds that the two CLAS schemes can be forged by the malicious enemy by replacing the public key of the user but without knowing the master key of key generation center. At the same time, we also show that second CLAS scheme does not satisfy the tractability property. In other words, the malicious vehicle cannot be traced after it makes some malicious signatures. We also present an improved CLAS schemes based on the original CLAS scheme respectively. By some security analysis and efficiency analysis, it can find that the improved CLAS schemes both not only can overcome the security problem but also are still efficient.

The existing certificateless aggregate signature schemes have problems in terms of security and efficiency: some schemes are not secure, which does not satisfy the claimed unforgeability, others are secure, but the calculation and communication cost are large. Based on the comprehensive consideration of security and efficiency, this paper designs a new certificateless aggregate signature scheme without bilinear pairing, proves the security of the scheme under the random oracle model and computational Diffie-Hellman problem. The new scheme not only overcomes the security problem of the existing scheme, but also has a fixed length of aggregate signature. The user does not need to exchange a large amount of information when performing single signature, so that users can dynamically join the aggregate signature.

Ensuring the secure sharing of privacy-sensitive healthcare data is attracting considerable interest from researchers. Recently, Ogundoyin et al. designed a lightweight privacy-preserving authentication scheme named PAASH for smart health applications. Benil et al. proposed a public verification and auditing scheme named ECACS for securing e-health systems. Ogundoyin et al. and Benil et al. proposed an efficient certificateless aggregate signature (CLAS) scheme as their respective foundation signature schemes. They declared that their constructions were provably secure under the hardness assumption of cryptographic problems. In this work, we disprove their claim by analyzing the correctness and security of their underlying CLAS schemes. We first show that the batch verification process of n signatures for the CLAS scheme in PAASH is incorrect, and any public-key replacement attacker can easily break the scheme. We analyze the reasons for our attack and propose an improved scheme, named PAASH+. We then show that the CLAS scheme in ECACS fails to achieve correctness, an essential property that a cryptographic scheme should provide. As a result, it is impractical to deploy the designed PAASH and ECACS constructions in any real smart health applications.

Safe and efficient collection of users’ electronic consumption data is a basic function of the smart grid. Anonymous aggregate signature is a fine option to realize this feature, which can not only reduce the computing cost of the data center (DC) but also protect the user’s identity information from leaking. The security proofs of all known identity-based aggregate signature (IBAS) schemes were completed in the random oracle model (ROM). Regrettably, these schemes are not necessarily secure in real life. In this article, we first propose the system model and security demands of an identity-based designated verifier anonymous aggregate signature (IB-DVAAS) scheme for smart grids. We then come up with a concrete scheme, only the designated DC can check the validity of an aggregate signature, but it cannot recognize the real identity of the signers. Next, we display the security proofs in the standard model. Finally, we conduct an analysis on performance for six aggregate signature schemes. Only three pairing operations are required and hash-to-point operations are not used, the calculation cost of the new scheme is lower than that of other schemes.

Recently, Boneh et al. proposed the concept of an aggregate signature, introduced security models for such signatures, and also presented some applications. An aggregate signature scheme is a digital signature that supports aggregation: Given n signatures on n distinct messages from n distinct users, it is possible to aggregate all these signatures into a single short signature. This single signature, along with the n original messages will convince verifiers that the n users did indeed sign the n original messages respectively, i.e., user i signed message Mi for i = 1, ..., n. In this paper, however, we find that their security model has some defects. The capacity that the adversaries possess was constrained according to the standard security definition of signatures. We propose an improvement of the Boneh’s scheme by presenting a new security model and giving a formal proof in random oracle model.

An aggregate signature is a single short string that convinces any verifier that, for all 1 ≤ i ≤ n, signer S i signed message M i , where the n signers and n messages may all be distinct. The main motivation of aggregate signatures is compactness. However, while the aggregate signature itself may be compact, aggregate signature verification might require potentially lengthy additional information – namely, the (at most) n distinct signer public keys and the (at most) n distinct messages being signed. If the verifier must obtain and/or store this additional information, the primary benefit of aggregate signatures is largely negated.This paper initiates a line of research whose ultimate objective is to find a signature scheme in which the total information needed to verify is minimized. In particular, the verification information should preferably be as close as possible to the theoretical minimum: the complexity of describing which signer(s) signed what message(s). We move toward this objective by developing identity-based aggregate signature schemes. In our schemes, the verifier does not need to obtain and/or store various signer public keys to verify; instead, the verifier only needs a description of who signed what, along with two constant-length “tags”: the short aggregate signature and the single public key of a Private Key Generator. Our scheme is secure in the random oracle model under the computational Diffie-Hellman assumption over pairing-friendly groups against an adversary that chooses its messages and its target identities adaptively.KeywordsSignature SchemeSecurity ProofRandom Oracle ModelAggregate SignatureSignature QueryThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Vehicular ad hoc networks (VANETs) have become an essential part of the intelligent transportation system because they provide secure communication among vehicles, enhance vehicle safety, and improve the driving experience. However, due to the openness and vulnerability of wireless networks, the participating vehicles in a VANET system are prone to a variety of cyberattacks. To secure the privacy of vehicles and assure the authenticity, integrity, and nonrepudiation of messages, numerous signature schemes have been employed in the literature on VANETs. The majority of these solutions, however, are either not fully secured or entail high computational costs. To address the above issues and to enable secure communication between the vehicle and the roadside unit (RSU), we propose a certificateless aggregate signature (CLAS) scheme based on hyperelliptic curve cryptography (HECC). This scheme enables participating vehicles to share their identities with trusted authorities via an open wireless channel without revealing their identities to unauthorized participants. Another advantage of this approach is its capacity to release the partial private key to participating devices via an open wireless channel while keeping its identity secret from any other third parties. A provable security analysis through the random oracle model (ROM), which relies on the hyperelliptic curve discrete logarithm problem, is performed, and we have proven that the proposed scheme is unforgeable against Type 1 (FGR1) and Type 2 (FGR2) forgers. The proposed scheme is compared with relevant schemes in terms of computational cost and communication overhead, and the results demonstrate that the proposed scheme is more efficient than the existing schemes in maintaining high-security levels.

PCAS: Cryptanalysis and improvement of pairing-free certificateless aggregate signature scheme with conditional privacy-preserving for VANETs

Aggregate signature is widely used in special occasions where the signatures on many different messages generated by many different users need to be compressed into one single signature. This paper presents an efficient certificate-based aggregate signature (CBAS) scheme from bilinear pairing. In the random oracle model, the new scheme is proven existentially unforgeable against adaptive chosen message attacks under the computational Diffie-Hellman assumption. The signature verification of the new scheme only needs constant pairing computations, which improves the efficiency of communication and computation, and it is more suitable for the applications in resource-constrained network environment.

A new attack against a novel certificateless aggregate signature scheme with constant pairing computations is presented. To enhance security, a new certificateless signature scheme is proposed first. Then a new certificateless aggregate signature scheme with constant pairing computations based on the new certificateless signature scheme is presented. Security analysis shows that the proposed certificateless aggregate signature scheme is provably secured in the random oracle.

In this paper, we propose two certificateless aggregate signature schemes, which are the first aggregate signature schemes in the CL-PKC. The first scheme CAS -1 reduces the costs of communication and signer-side computation but loses on storage, while CAS - 2 minimizes the storage but sacrifices the communication. We can choose one of the above schemes by the consideration of the implementation requirement. Our schemes do not need the public key certificate anymore and achieve the trust level 3, the same level with traditional PKI. Both of the schemes are proven secure in the random oracle model(ROM) by assuming the intractability of the computational Diffie-Hellman(CDH) problem over groups with bilinear maps.

Certificateless aggregate signature can provide an efficient way to verify a large amount of signatures from different users. This feature makes it very useful in the environments with low bandwidth communication, low storage, and low computability. Recently, Chen et al. proposed a new certificateless aggregate signature scheme. They claim that their scheme is provably secure under the computational Diffie–Hellman problem. Unfortunately, this paper shows that Chen et al.'s scheme is insecure, it cannot resist Type I and Type II adversaries, and the corresponding attacks are given. Furthermore, we also show their scheme exists a more powerful attack, namely, anyone can forge a certificateless signature on an arbitrary message in this attack. Finally, we discuss the reason to produce such attacks and give the corresponding suggestions to resist such attacks. Copyright © 2015 John Wiley & Sons, Ltd.