On the Security of Some Aggregate Signature Schemes

Abstract

Aggregate signature scheme proposed by Boneh, Gentry, Lynn, and Shacham allows n signatures on n distinct messages from n distinct users to aggregate a single signature that convince any verifier that n users did indeed sign the n messages, respectively. The main benefit of such schemes is that they allow bandwidth and computational savings. In this paper, we question about whether the existing aggregate signature schemes satisfy the basic property that they can convince any verifier that every user indeed signed the message which should be signed by him. We show that Rückert et al.’s scheme, and Shim’s scheme do not satisfy the property. As a comparison, we investigate Boneh et al.’s scheme and show that under the assumption that each signer correctly signs one message, Boneh et al.’s scheme satisfies this property under two users' setting. Furthermore, we propose the concept of inside attack on aggregate signatures and give an improved aggregate signature scheme based on Shim’s scheme. We also prove that the improved scheme is secure against inside attack.

1. Introduction

An aggregate signature scheme as introduced by Boneh et al. [1] is a method for combining 𝑛 signatures from 𝑛 different signers on 𝑛 different messages into a single signature. This single signature (and the 𝑛 original messages) will convince the verifier that the 𝑛 signers did indeed sign the 𝑛 original messages (i.e., signer 𝑖 signed message 𝑚_𝑖 for 𝑖=1,…,𝑛). Typical applications for aggregate signatures are, for example, secure routing [2] or certificate chain compression [1]. The main benefit of aggregate signature is that it saves bandwidth, which makes it an optimal solution for networks of small, battery-powered devices that communicate over energy-consuming wireless channels [3].

Since Boneh et al.’s aggregate signature scheme, many aggregate signature schemes are proposed [4–10]. There even are aggregate proxy signature [11] and aggregate signcryption schemes [12]. However, about the security of aggregate signature schemes, only traditional unforgeability was discussed in all existing schemes. We question that whether every existing aggregate signature satisfies the basic property proposed by Boneh et al. that it convinces any verifier that, for all 1≤𝑖≤𝑛, signer 𝑖 indeed signed message 𝑚_𝑖 which should be signed by him; he didnot signed message 𝑚_𝑗. Because in some situation an aggregate signature may satisfy the verification, even though signer 𝑖 signed message 𝑚_𝑗. We call this attack an inside attack on aggregate signatures. We think this is an important issue to aggregate signatures. Shao [13] discussed the security of aggregate signatures, but its issue was another aspect. He pointed that every signer 𝑖 forges a signature 𝜎_𝑖^⋅=𝜎_𝑖⋅𝑑_𝑖 on message 𝑚_𝑖; here 𝜎_𝑖 is the true signature of message 𝑚_𝑖, when 𝑑₁⋅𝑑₂⋅…⋅𝑑_𝑛=1 and 𝑆=𝜎^⋅₁⋅𝜎^⋅₂⋅…⋅𝜎^⋅_𝑛 also satisfies the aggregate signature verification.

Recently, Rückert et al. [6] proposed the first aggregate signature in standard model. The scheme was based on the Boneh-Silverberg signature [14]. They proved its traditional unforgeability in the standard model while maintaining an optimal signature size and reasonable efficiency. However, in this paper, we show that Rückert et al.’s scheme does not satisfy the basic property that a verifier, given the aggregate signature along with the identities if the parties involved and their respective messages, can be convinced that signer 𝑖 indeed signed message 𝑚_𝑖 which should be signed by him. In 2010, Shim proposed an efficient ID-based aggregate signature scheme with constant pairing computations [8]. It is the first scheme whose number of pairing computation in verification is independent of the number of users. But, in this paper we point that Shim’s scheme also does not satisfy the basic property. As a comparison, we investigate Boneh et al.’s scheme [1] and show that under the assumption that each signer signs one message correctly, Boneh et al.’s scheme satisfies this property under two users’ setting. Furthermore, we propose an improved scheme based on Shim’s scheme and prove that the improved scheme is secure against the inside attack.

The rest of the paper is organized as follows. In Section 2 we introduce preliminaries and the computational assumption. Section 3 investigates the security of Rückert et al.’s aggregate signature. Section 4 investigates the security of the aggregate signature of Shim. As a comparison, we study Boneh et al.’s aggregate signature scheme in Section 5. The improved scheme is in Section 6. Section 7 concludes this paper.

2. Preliminary

2.1. The Bilinear Pairing

Let 𝐺₁ be a cyclic additive group generated by 𝑃, whose order is a prime 𝑞, and 𝐺₂ a cyclic multiplicative group of the same order. Let 𝑒∶𝐺₁×𝐺₁→𝐺₂ be a pairing map which satisfies the following conditions.(1) Bilinearity: for any 𝑃,𝑄,𝑅∈𝐺₁, we have 𝑒(𝑃+𝑄,𝑅)=𝑒(𝑃,𝑅)𝑒(𝑄,𝑅) and 𝑒(𝑃,𝑄+𝑅)=𝑒(𝑃,𝑄)𝑒(𝑃,𝑅). (2.1)  In particular, for any 𝑎,𝑏∈𝑍_𝑞, 𝑒(𝑎𝑃,𝑏𝑃)=𝑒(𝑃,𝑃)^𝑎𝑏=𝑒(𝑃,𝑎𝑏𝑃)=𝑒(𝑎𝑏𝑃,𝑃).(2) Nondegeneracy: there exists 𝑃,𝑄∈𝐺₁, such that 𝑒(𝑃,𝑄)≠1.(3) Computability: there is an efficient algorithm to compute 𝑒(𝑃,𝑄) for all 𝑃,𝑄∈𝐺₁.

The typical way of obtaining such pairings is by deriving them from the Weil-pairing or the Tate-pairing on an elliptic curve over a finite field.

2.2. Gap Diffie-Hellman (GDH) Groups

Let 𝐺 be a cyclic additive group of prime order 𝑞, and let 𝑃 be a generator of 𝐺.(1)The decisional Diffie-Hellman (DDH) problem is to decide whether 𝑐=𝑎𝑏 in 𝑍/𝑞𝑍 for given 𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃∈𝐺. If so, (𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃) is called a valid Diffie-Hellman tuple.(2)The computational Diffie-Hellman (CDH) problem is to compute 𝑎𝑏𝑃 for given 𝑃,𝑎𝑃,𝑏𝑃∈𝐺.

Definition 2.1. The advantage of an algorithm F in solving the computational Diffie-Hellman problem on group 𝐺 is AdvCDH_F=PrF(𝑃,𝑎𝑃,𝑏𝑃)=𝑎𝑏𝑃∶∀𝑎,𝑏∈𝑍_𝑞. (2.2) The probability took over the choice of 𝑎,𝑏 and F’s coin tosses. An algorithm F is said to be (𝑡,𝜀)-breaks the computational Diffie-Hellman problem on group 𝐺 if F runs in time at most 𝑡, and AdvCDH_F is at least 𝜀.

Definition 2.2. A group 𝐺 is said to be (𝑡,𝜀)-gap Diffie-Hellman (GDH) group if the decisional Diffie-Hellman problem in 𝐺 can be efficiently computable and there exists no algorithm (𝑡,𝜀)-breaks the computational Diffie-Hellman problem on group 𝐺.

2.3. Security Model of Aggregate Signature

We take identity-based aggregate signature (IBAS) for example to give the definition of aggregate signature and its security model. An identity-based aggregate signature is composed of five algorithms [5]: key generation by the private key generation center (PKG), private key extraction by the PKG for individual users, signing by an individual user, aggregation of multiple individual signatures, and verification of an identity-based aggregate signature.

KeyGen
Take a security parameter 𝜆 as input and output system parameters params and master key msk.

KeyExt
Take params, msk. and a user identity ID as input and output a user private key 𝑆_ID.

Sign
Take private key 𝑆_ID and a message 𝑀 as input and output an individual identity-based signature 𝜎_ID.

Agg
Given 𝑛 signatures (𝜎₁,…,𝜎_𝑛) along with 𝑛 users’ identities (ID₁,…,ID_𝑛) and 𝑛 messages (𝑀₁,…,𝑀_𝑛), output an aggregate signature 𝜎_Agg.

Verify
Given an aggregate signature 𝜎_Agg, the message, and identities’ pair list {(𝑀₁,ID₁),…,(𝑀_𝑛,ID_𝑛)}, verify the aggregate signature that if it is valid.

2.3.1. Security Model against Traditional Existential Forgery Attack

An IBAS scheme should be secure against traditional existential forgery under an adaptive chosen-message and an adaptive-chosen-identity attack. We formalize the security model as follows. The adversary’s goal is the existential forgery of an aggregate signature. We give the adversary the power to choose the identities on which it wishes to forge a signature, the power to request the identity-based private key on all but one of these identities. The adversary’s advantage is defined as its probability of success in the following game.

Setup. The adversary is given the needed parameters and an identity ID₁ at random.

Extraction Queries
Given an identity ID_𝑖 (𝑖≠1), the challenger returns the private key 𝑆_ID𝑖 corresponding to ID_𝑖.

Signature Queries
Proceeding adaptively, the adversary may request signatures with respect to identity ID_𝑖 on messages of his choice.

Response
Finally, the adversary outputs 𝑛−1 additional identities (ID₂,…,ID_𝑛), 𝑛 messages (𝑀₁,…,𝑀_𝑛) and an aggregate signature 𝜎 with respect to these 𝑛 identities, and 𝑛 messages (𝑀₁,…,𝑀_𝑛).

The adversary wins if the aggregate signature 𝜎 is a valid signature on (𝑀₁,…,𝑀_𝑛) under ID₁,ID₂,…,ID_𝑛 and the adversary did not request the private key for ID₁ and did not request a signature on 𝑀₁ under ID₁.

2.3.2. Security Model against Inside Existential Forgery Attack

We defined one new secure concept of aggregate signature as inside attack. It means the included signers to generate an aggregate signature 𝑉 on messages (𝑀_𝑗1,𝑀_𝑗2…,𝑀_𝑗𝑛) for identities (ID₁,…,ID_𝑛). But, they claim that they generate an aggregate signature 𝑉 on messages (𝑀₁,𝑀₂…,𝑀_𝑛) for identities (ID₁,…,ID_𝑛), here(1)(𝑀₁,𝑀₂…,𝑀_𝑛)≠(𝑀_𝑗1,𝑀_𝑗2…,𝑀_𝑗𝑛),(2)𝑉 really satisfies the aggregate signature verification equation on messages (𝑀₁,𝑀₂…,𝑀_𝑛) for identities (ID₁,…,ID_𝑛).

The concept of inside attack is closely related to the basic property of aggregate signature that it should convince any verifier that every user indeed signed the message which should be signed by him.

3. The Security of the Aggregate Signature Rückert et al.’s Scheme

3.1. Brief Review of Rückert et al.’s Scheme

In Rückert et al.’s scheme [6], two groups 𝐺₁ and 𝐺₂ of prime order 𝑙 and a multilinear map 𝑒 are used; 𝑔 is a generator of 𝐺₁. If 𝑎₁,…,𝑎_𝑛∈𝑍, and 𝑥₁,…,𝑥_𝑛∈𝐺₁, then 𝑒(𝑥^𝑎1₁,𝑥^𝑎2₂,…,𝑥^𝑎𝑛_𝑛)=𝑒(𝑥₁,𝑥₂,…,𝑥_𝑛)^{𝑎1𝑎2⋯𝑎𝑛}. Rückert et al.’s scheme comprises five algorithms.

Key Generation
The key generation algorithm takes as input the security parameter. It randomly selects 2𝑛 elements 𝑎_1,0,𝑎_1,1,…,𝑎_𝑛,0,𝑎_𝑛,1∈{1,…,𝑙−1}. The algorithm computes 𝑢_1,0=𝑔^𝑎1,0,𝑢_1,1=𝑔^𝑎1,1,…,𝑢_𝑛,0=𝑔^𝑎𝑛,0,𝑢_𝑛,1=𝑔^𝑎𝑛,1 (3.1) and returns the private key and the public key pair: sk=𝑎_1,0,𝑎_1,1,…,𝑎_𝑛,0,𝑎_𝑛,1,pk=𝑢_1,0,𝑢_1,1,…,𝑢_𝑛,0,𝑢_𝑛,1. (3.2)

Signature Issue
It accepts as input a message 𝑚=(𝑚₁,…,𝑚_𝑛)∈{0,1}^𝑛 as well as signing key sk=(𝑎_1,0,𝑎_1,1,…,𝑎_𝑛,0,𝑎_𝑛,1) and computes the signature 𝜎=𝑔^{∏𝑛𝑖=1𝑎𝑖𝑖,𝑚}.

Signature Verification
It returns 1 iff 𝑒(𝜎,𝑔,…,𝑔)=𝑒(𝑢_1,𝑚1,𝑢_2,𝑚2,…,𝑢_{𝑛,𝑚𝑛}).

Signature Aggregation
It builds an aggregate signature 𝑆 on messages 𝑚⁽¹⁾,…,𝑚^(𝑞), under public keys pk⁽¹⁾,…,pk^(𝑞), respectively. It outputs the triple (pk,𝑀,𝑆). Here 𝑆=∏^𝑞_𝑖=1𝜎^(𝑖), pk={pk⁽¹⁾,…,pk^(𝑞)}, 𝑀={𝑚⁽¹⁾,…,𝑚^(𝑞)}, and 𝜎^(𝑖) is the signature on message 𝑚^(𝑖) produced by the user with public key pk^(𝑖).

Aggregate Verification
It takes as input a set of public keys pk={pk⁽¹⁾,…,pk^(𝑞)}, a set of messages 𝑀={𝑚⁽¹⁾,…,𝑚^(𝑞)}, and an aggregate signature 𝑆. It returns 1 iff ^𝑞_𝑖=1𝑒𝑢^(𝑖)_{1,𝑚1(𝑖)},𝑢^(𝑖)_{2,𝑚2(𝑖)},…,𝑢^(𝑖)_{𝑛,𝑚𝑛(𝑖)}=𝑒𝑆,𝑔,…,𝑔. (3.3)

3.2. The Security of Rückert et al.’s Scheme

In Rückert et al.’s scheme, let 𝑛=2, two users 𝐴₁, 𝐴₂ with private key and pubic key pairs: sk⁽¹⁾=𝑎⁽¹⁾_1,0,𝑎⁽¹⁾_1,1,𝑎⁽¹⁾_2,0,𝑎⁽¹⁾_2,1,pk⁽¹⁾=𝑢⁽¹⁾_1,0,𝑢⁽¹⁾_1,1,𝑢⁽¹⁾_2,0,𝑢⁽¹⁾_2,1,sk⁽²⁾=𝑎⁽²⁾_1,0,𝑎⁽²⁾_1,1,𝑎⁽²⁾_2,0,𝑎⁽²⁾_2,1,pk⁽²⁾=𝑢⁽²⁾_1,0,𝑢⁽²⁾_1,1,𝑢⁽²⁾_2,0,𝑢⁽²⁾_2,1, (3.4) respectively.

Let 𝑚⁽¹⁾=(𝑚₁⁽¹⁾,𝑚₂⁽¹⁾), 𝑚⁽²⁾=(𝑚₁⁽²⁾,𝑚₂⁽²⁾) be two messages. Then 𝜎⁽¹⁾=𝑔^{𝑎1(1)1,𝑚(1)⋅𝑎2(1)2,𝑚(1)}is the signature on 𝑚⁽¹⁾ by 𝐴₁, 𝜎⁽²⁾=𝑔^{𝑎1(2)1,𝑚(2)⋅𝑎2(2)2,𝑚(2)} is the signature on 𝑚⁽²⁾ by 𝐴₂. So the aggregate signature produced by users 𝐴₁, 𝐴₂ is 𝑆=𝜎⁽¹⁾⋅𝜎⁽²⁾=𝑔^{𝑎1(1)1,𝑚(1)⋅𝑎2(1)2,𝑚(1)+𝑎1(2)1.𝑚(2)⋅𝑎2(2)2,𝑚(2)}. (3.5) The aggregate verification equation 𝑒𝑢⁽¹⁾_1,𝑚1(1),𝑢⁽¹⁾_2,𝑚2(1)⋅𝑒𝑢⁽²⁾_1,𝑚1(2),𝑢⁽²⁾_2,𝑚2(2)=𝑒𝑔,𝑔^{𝑎1(1)1,𝑚(1)⋅𝑎2(1)2,𝑚(1)+𝑎1(2)1,𝑚(2)⋅𝑎2(2)2,𝑚(2)}=𝑒𝑆,𝑔 (3.6) holds.

However, when 𝑚₁⁽¹⁾=𝑚₁⁽²⁾, 𝑚₂⁽¹⁾=0, 𝑚₂⁽²⁾=1, 𝑎⁽¹⁾_1,𝑚1(1)=𝑎⁽²⁾_1,𝑚1(2)=1, and 𝑎⁽¹⁾_2,0+𝑎⁽²⁾_2,1=𝑎⁽²⁾_2,0+𝑎⁽¹⁾_2,1, The equation 𝑎⁽¹⁾_1,𝑚1(1)⋅𝑎⁽¹⁾_2,𝑚2(1)+𝑎⁽²⁾_1,𝑚1(2)⋅𝑎⁽²⁾_2,𝑚2(2)=𝑎⁽¹⁾_1,𝑚1(2)⋅𝑎⁽¹⁾_2,𝑚2(2)+𝑎⁽²⁾_1,𝑚1(1)⋅𝑎⁽²⁾_2,𝑚2(1), (3.7) holds. So when the user with public key pk⁽¹⁾ signs 𝑚⁽²⁾, the user with public key pk⁽²⁾ signs 𝑚⁽¹⁾, they generate aggregate signature 𝑆^∗=𝑔^{𝑎1(1)1,𝑚(2)⋅𝑎2(1)2,𝑚(2)+𝑎1(2)1.𝑚(1)⋅𝑎2(2)2,𝑚(1)}, (3.8) and also satisfies the aggregate verification equation 𝑒𝑢⁽¹⁾_1,𝑚1(1),𝑢⁽¹⁾_2,𝑚2(1)⋅𝑒𝑢⁽²⁾_1,𝑚1(2),𝑢⁽²⁾_2,𝑚2(2)=𝑒𝑆^∗,𝑔. (3.9)

In this situation, the aggregate signature cannot convince the verifier that signer 𝑖 signed message 𝑚_𝑖. So Rückert et al.’s aggregate signature is not secure; it does not satisfy the property that a verifier, given the aggregate signature along with the identities if the parties involved and their respective messages, can be convinced that signer 𝑖 indeed signed message 𝑚_𝑖 which should be signed by him. It is not secure against the inside forgery attack.

4. The Security of Shim’s Aggregate Signature Scheme

4.1. Brief Review of Shim’s Scheme

Shim’s scheme [8] comprises five algorithms.

Setup. Given security parameter 𝑘∈𝑍, the algorithm works as follows.(1)Generate a prime 𝑞, a cyclic additive group 𝐺₁ and a cyclic multiplicative group 𝐺₂ of prime order 𝑞, a generator 𝑃 in 𝐺₁ and an admissible pairing 𝑒∶𝐺₁×𝐺₁→𝐺₂.(2)Pick a random 𝑠∈𝑍^⋅_𝑞 and set 𝑃_pub=𝑠𝑃.(3)Choose cryptographic hash functions 𝐻₁∶{0,1}^∗→𝐺₁ and 𝐻₂∶{0,1}^∗→𝑍_𝑞.

The system parameters are ⟨𝑞,𝐺₁,𝐺₂,𝑒,𝑃,𝑃_pub,𝐻₁,𝐻₂⟩.

Extract
For a given string ID∈{0,1}^∗.(1)Compute 𝑄_ID=𝐻₁(ID)∈𝐺₁.(2)Set the private key 𝑆_ID to be 𝑠⋅𝑄_ID, where 𝑠 is a master secret.

Sign
Given a private 𝑆_ID and a message 𝑀∈{0,1}^∗.(1)Choose 𝑟∈_𝑅𝑍^∗_𝑞 and compute 𝑈=𝑟⋅𝑃∈𝐺₁.(2)Compute ℎ=𝐻₂(ID,𝑀,𝑈)∈𝑍_𝑞 and 𝑉=𝑆_ID+ℎ⋅𝑟⋅𝑃_pub∈𝐺₁. The signature on 𝑀 is 𝜎=(𝑈,𝑉).

Agg
For the aggregating set of users 𝑆, assign to each user an index 𝑖, ranging from 1 to 𝑘=|𝑆|. (1)Each user 𝐴_𝑖∈𝑆 computes signature 𝜎_𝑖=(𝑈_𝑖,𝑉_𝐼) on a message 𝑀_𝑖∈{0,1}^∗.(2) Compute 𝑉=∑^𝑘_𝑖=1𝑉_𝑖 and output 𝜎=(𝑈₁,…,𝑈_𝑘,𝑉) as an aggregate signature on (𝑀₁,…,𝑀_𝑘)for(ID₁,…,ID_𝑘).

AVerify
Given an aggregate signature 𝜎=(𝑈₁,…,𝑈_𝑘,𝑉) as above.(1)Compute 𝑄_𝑖=𝐻₁(ID_𝑖) and ℎ_𝑖=𝐻₂(ID_𝑖,𝑀_𝑖,𝑈_𝑖) for 𝑖=1,…,𝑘.(2)Verify whether 𝑒(𝑉,𝑃)=𝑒(∑^𝑘_𝑖=1[𝑄_𝑖+ℎ_𝑖⋅𝑈_𝑖],𝑃_pub) holds or not. If it holds, accept the aggregate signature 𝜎=(𝑈₁,…,𝑈_𝑘,𝑉).

4.2. Attack on Shim’s Scheme

Let ID₁ be an identity of signer 𝐴₁ and let ID₂ be an identity of signer 𝐴₂. They claim that they generate an aggregate signature 𝜎=(𝑈₁,𝑈₂,𝑉) on messages (𝑀₁,𝑀₂) for identities (ID₁,ID₂). Then, 𝐴₁ should sign 𝑀₁, and 𝐴₂ should sign 𝑀₂. That is to say, they should do as following: (1)𝐴₁ and 𝐴₂ choose 𝑟₁,𝑟₂∈_𝑅𝑍^∗_𝑞 and compute 𝑈₁=𝑟₁⋅𝑃 and 𝑈₂=𝑟₂⋅𝑃, respectively.(2)𝐴₁ and 𝐴₂ compute 𝑉₁=𝑆₁+𝐻₂ID₁,𝑀₁,𝑈₁⋅𝑟₁⋅𝑃_pub,𝑉₂=𝑆₂+𝐻₂ID₂,𝑀₂,𝑈₂⋅𝑟₂⋅𝑃_pub, (4.1)  respectively. (3) They generate aggregate signature 𝜎=(𝑈₁,𝑈₂,𝑉) on messages (𝑀₁,𝑀₂) for identities (ID₁,ID₂). Here 𝑉=𝑉₁+𝑉₂.

But, if the aggregate signature satisfies the verification equation, can the verifier be convinced that 𝐴₁ indeed has signed 𝑀₁, and 𝐴₂ indeed has signed 𝑀₂? They may cooperate to do on purpose as following: (1)𝐴₁ and 𝐴₂ Choose 𝑟₁,𝑟₂∈_𝑅𝑍^∗_𝑞 and compute 𝑈₁=𝑟₁⋅𝑃 and 𝑈₂=𝑟₂⋅𝑃. (2)𝐴₁ and 𝐴₂ compute 𝑉^∗₁=𝑆₁+𝐻₂ID₂,𝑀₂,𝑈₂⋅𝑟₂⋅𝑃_pub,𝑉^∗₂=𝑆₂+𝐻₂ID₁,𝑀₁,𝑈₁⋅𝑟₁⋅𝑃_pub (4.2)  respectively. They have not signed 𝑀₁ and 𝑀₂, respectively. (3) They claim that they generate aggregate signature 𝜎=(𝑈₁,𝑈₂,𝑉^∗) on messages (𝑀₁,𝑀₂) for identities (ID₁,ID₂). Here 𝑉^∗=𝑉^∗₁+𝑉^∗₂.

Since 𝑉^∗=𝑉^∗₁+𝑉^∗₂=𝑉₁+𝑉₂=𝑉, the verification equation 𝑒𝑉^∗,𝑃=𝑒𝑄₁+ℎ₁𝑈₁+𝑄₂+ℎ₂𝑈₂,𝑃_pub (4.3) Holds. 𝐴₁ and 𝐴₂ succeed in forging aggregate signature for (ID₁,ID₂) on (𝑀₁,𝑀₂).

The weakness of Shim’s scheme against this inside forgery attack is due to the separation of the message signed and the private key in the signing equation 𝑉=𝑆_ID+ℎ⋅𝑟⋅𝑃_pub∈𝐺₁.

5. The Security of Boneh et al.’s Aggregate Schemes

We can investigate the security of Boneh et al.’s aggregate signature scheme [1] to provide further illustration to this flaw of about two schemes.

5.1. Brief Review of Boneh et al.’s Scheme

In Boneh et al.’s aggregate signature, two cyclic multiplicative groups 𝐺₁ and 𝐺₂ of prime order and a bilinear map 𝑒∶𝐺₁×𝐺₁→𝐺₂ are used. 𝑔 is a generator of 𝐺₁. The scheme employs a hash function ℎ∶{0,1}^⋅→𝐺₂.

Boneh et al.’s aggregate signature scheme comprises five algorithms.

Key Generation
For a user, pick random 𝑥←𝑍_𝑝, and compute 𝑣=𝑔^𝑥. The user’s public key is 𝑣∈𝐺₁, and secret key is 𝑥∈𝑍_𝑝.

Signing
Given the secret key 𝑥 and a message 𝑚∈{0,1}^⋅, compute ℎ=ℎ(𝑚), and the signature 𝜎=ℎ^𝑥.

Verification
Given user’s public key 𝑣, a message 𝑚, and a signature 𝜎, compute ℎ=ℎ(𝑚); accept if 𝑒(𝑔,𝜎)=𝑒(𝑣,ℎ) holds.

Aggregation
For the aggregating set of users 𝑈, assign to each user an index 𝑖, ranging from 1 to 𝑘=|𝑈|. Each user 𝑢_𝑖∈𝑈 provides a signature 𝜎_𝑖∈𝐺₂ on a message 𝑚_𝑖∈{0,1}^⋅of his choice. Compute the aggregate signature 𝜎=∏^𝑘_𝑖=1𝜎_𝑖.

Aggregate Verification
Given an aggregate signature 𝜎 for an aggregating set of users 𝑈, indexed as before, and given the original messages 𝑚_𝑖∈{0,1}^⋅ and public keys 𝑣_𝑖 for all users 𝑢_𝑖∈𝑈. Compute ℎ_𝑖=ℎ(𝑚_𝑖) for 1≤𝑖≤𝑘, and accept if 𝑒(𝑔,𝜎)=∏^𝑘_𝑖=1𝑒(𝑣_𝑖,ℎ_𝑖) holds.

5.2. The Security of Boneh et al.’s Scheme

In Boneh et al.’s scheme, given an aggregate signature of two different messages 𝑚₁ and 𝑚₂ under two users with public keys 𝑣₁ and 𝑣₂, respectively, if 𝑒𝑣₁,ℎ₁⋅𝑒𝑣₂,ℎ₂=𝑒𝑣₂,ℎ₁⋅𝑒𝑣₁,ℎ₂, (5.1) then, it will be impossible to know whether signer 𝑖 signed message 𝑚_𝑖, and Boneh et al.’s scheme will have the same flaw as that of Rückert et al.’s scheme. But if 𝑒𝑣₁,ℎ₁⋅𝑒𝑣₂,ℎ₂=𝑒𝑣₂,ℎ₁⋅𝑒𝑣₁,ℎ₂, (5.2) then 𝑒𝑔^𝑥1,ℎ₁⋅𝑒𝑔^𝑥2,ℎ₂=𝑒𝑔^𝑥2,ℎ₁⋅𝑒𝑔^𝑥1,ℎ₂,𝑒𝑔,ℎ^𝑥1₁⋅𝑒𝑔,ℎ^𝑥2₂=𝑒𝑔,ℎ^𝑥2₁⋅𝑒𝑔,ℎ^𝑥1₂,𝑒𝑔,ℎ^𝑥1₁ℎ^𝑥2₂=𝑒𝑔,ℎ^𝑥2₁ℎ^𝑥1₂,ℎ^𝑥1₁ℎ^𝑥2₂=ℎ^𝑥2₁ℎ^𝑥1₂,ℎ^{𝑥1−𝑥2}₁=ℎ^{𝑥1−𝑥2}₂,ℎ₁=ℎ₂,ℎ𝑚₁=ℎ𝑚₂. (5.3) So if the hash function ℎ is secured, ℎ(𝑚₁)≠ℎ(𝑚₂), then, under the assumption that each signer signs one message correctly, Boneh et al.’s scheme does not suffer the same flaw as about two schemes under two users.

6. An Improvement of Shim’s Identity-Based Aggregate Signature Scheme

6.1. The Improved Scheme

The improved scheme comprises five algorithms.

Setup. Given security parameter 𝑘∈𝑍, the algorithm works as follows.(1)Generate a prime 𝑞, a cyclic additive group 𝐺₁ and a cyclic multiplicative group 𝐺₂ of prime order 𝑞, two random generators 𝑃 and 𝑄 in 𝐺₁, and an admissible pairing 𝑒∶𝐺₁×𝐺₁→𝐺₂.(2)Pick a random 𝑠∈𝑍^⋅_𝑞 and set 𝑃_pub=𝑠𝑃.(3)Choose cryptographic hash functions 𝐻₁∶{0,1}^∗→𝐺₁ and 𝐻₂∶{0,1}^∗→𝑍_𝑞.

The system parameters are ⟨𝑞,𝐺₁,𝐺₂,𝑒,𝑃,𝑃_pub,𝐻₁,𝐻₂⟩.

Extract
For a given string ID∈{0,1}^∗.(1)Compute 𝑄_ID=𝐻₁(ID)∈𝐺₁.(2)Set the private key 𝑆_ID to be 𝑠⋅𝑄_ID, where 𝑠 is a master secret.

Sign
Given a private 𝑆_ID and a message 𝑀∈{0,1}^∗.(1)Choose 𝑟∈_𝑅𝑍^∗_𝑞 and compute 𝑈=𝑟⋅𝑃∈𝐺₁.(2)Compute ℎ=𝐻₂(ID,𝑀,𝑈)∈𝑍_𝑞 and 𝑉=ℎ𝑆_ID+𝑟⋅𝑄∈𝐺₁. The signature on 𝑀 is 𝜎=(𝑈,𝑉).

Agg
For the aggregating set of users 𝑆, assign to each user an index 𝑖, ranging from 1 to 𝑘=|𝑆|. (1)Each user 𝐴_𝑖∈𝑆 computes signature 𝜎_𝑖=(𝑈_𝑖,𝑉_𝐼) on a message 𝑀_𝑖∈{0,1}^∗.(2)Compute 𝑉=∑^𝑘_𝑖=1𝑉_𝑖 and output 𝜎=(𝑈₁,…,𝑈_𝑘,𝑉) as an aggregate signature on (𝑀₁,…,𝑀_𝑘)for(ID₁,…,ID_𝑘).

Averify
Given an aggregate signature 𝜎=(𝑈₁,…,𝑈_𝑘,𝑉) as above.(1)Compute 𝑄_𝑖=𝐻₁(ID_𝑖) and ℎ_𝑖=𝐻₂(ID_𝑖,𝑀_𝑖,𝑈_𝑖) for 𝑖=1,…,𝑘.(2)Verify whether 𝑒(𝑉,𝑃)=𝑒(𝑃_pub,∑^𝑛_𝑖=1ℎ_𝑖𝑄_ID𝑖)𝑒(𝑄,∑^𝑛_𝑖=1𝑈_𝑖) holds or not. If it holds, accept the aggregate signature 𝜎=(𝑈₁,…,𝑈_𝑘,𝑉).

6.2. Security of the Improved Scheme

Following the method in [10], it is easy to prove that the improved scheme is secure against the traditional existential forgery under an adaptive chosen message and an adaptive-chosen identity attack. Here, we only show that our improvement is secure against the inside attack proposed by us.

Take two signers as example, let ID₁ be the identity of signer 𝐴₁, and ID₂ the identity of signer 𝐴₂. If they cooperate to do as following:(1)𝐴₁ and 𝐴₂ Choose 𝑟₁,𝑟₂∈_𝑅𝑍^∗_𝑞 and compute 𝑈₁=𝑟₁⋅𝑃 and 𝑈₂=𝑟₂⋅𝑃. (2)𝐴₁ and 𝐴₂ compute 𝑉^∗₁=𝐻₂ID₂,𝑀₂,𝑈₂𝑆_ID1+𝑟₂𝑄,𝑉^∗₂=𝐻₂ID₁,𝑀₁,𝑈₁𝑆_ID2+𝑟₁𝑄, (6.1)  respectively. Note that they have not signed 𝑀₁ and 𝑀₂, respectively. (3) They claim that they generate aggregate signature 𝜎=(𝑈₁,𝑈₂,𝑉^∗) on messages (𝑀₁,𝑀₂) for identities (ID₁,ID₂). Here 𝑉^∗=𝑉^∗₁+𝑉^∗₂.

But, when 𝜎=(𝑈₁,𝑈₂,𝑉^∗) is a valid aggregate signature on messages (𝑀₁,𝑀₂) for identities (ID₁,ID₂), the following equation holds: 𝑒𝑉^∗,𝑃=𝑒𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID1+𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID2,𝑃_pub𝑒𝑄,𝑈₁+𝑈₂. (6.2) In fact 𝑒𝑉^∗,𝑃=𝑒𝐻₂ID₂,𝑀₂,𝑈₂𝑆_ID1+𝑟₂𝑄+𝐻₂ID₁,𝑀₁,𝑈₁𝑆_ID2+𝑟₁𝐻𝑄,𝑃=𝑒₂ID₂,𝑀₂,𝑈₂𝑄_ID1+𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID2,𝑃_pub𝑒𝑄,𝑈₁+𝑈₂. (6.3) If 𝑒𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID1+𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID2,𝑃_pub𝑒𝑄,𝑈₁+𝑈₂=𝑒𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID1+𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID2,𝑃_pub𝑒𝑄,𝑈₁+𝑈₂, (6.4) then 𝑒𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID1+𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID2,𝑃_pub=𝑒𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID1+𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID2,𝑃_pub. (6.5) So 𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID1+𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID2=𝐻₂ID₂,𝑀₂,𝑈₂𝑄_ID1+𝐻₂ID₁,𝑀₁,𝑈₁𝑄_ID2,𝐻₂ID₂,𝑀₂,𝑈₂−𝐻ID₁,𝑀₁,𝑈₁𝑄_ID2=𝐻₂ID₂,𝑀₂,𝑈₂−𝐻ID₁,𝑀₁,𝑈₁𝑄_ID1𝑄_ID2=𝑄_ID1. (6.6)

This is impossible. So the inside attack is not successful in improved scheme in two signers’ setting.

In 𝑛 signers’ setting, if they generate an aggregate signature 𝑉 on messages (𝑀_𝑗1,𝑀_𝑗2…,𝑀_𝑗𝑛) for identities (ID₁,…,ID_𝑛). But they claim that they generate an aggregate signature 𝑉 on messages (𝑀₁,𝑀₂…,𝑀_𝑛) for identities (ID₁,…,ID_𝑛), here (𝑀₁,𝑀₂…,𝑀_𝑛)≠(𝑀_𝑗1,𝑀_𝑗2…,𝑀_𝑗𝑛). Then the probability of 𝑉 satisfying the aggregate signature verification equation on messages (𝑀₁,𝑀₂…,𝑀_𝑛) for identities (ID₁,…,ID_𝑛) is equal to the probability of the following equation holding𝐻₂ID_𝑗1,𝑀_𝑗1,𝑈_𝑗1−𝐻ID₁,𝑀₁,𝑈₁𝑄_ID1+𝐻₂ID_𝑗2,𝑀_𝑗2,𝑈_𝑗2−𝐻ID₂,𝑀₂,𝑈₂𝑄_ID2+⋯+𝐻₂ID_𝑗𝑛,𝑀_𝑗𝑛,𝑈_𝑗𝑛−𝐻ID_𝑛,𝑀_𝑛,𝑈_𝑛𝑄_ID𝑛=O. (6.7) Here O denotes the identity of the cyclic additive group 𝐺₁. So the improved aggregate signature scheme is secured against the inside attack.

7. Conclusion

In this paper, we analyse the security of some aggregate signature schemes. We show that Rückert et al.’s scheme cannot convince the verifier that every signer indeed signed the message which should be signed by him. Shim’s scheme also suffers such flaw. As a comparison, we investigate Boneh et al.’s scheme and show that under the assumption that each signer signs one message correctly, Boneh et al.’s aggregate scheme can convince the verifier that every signer indeed signed the message which should be signed by him under two users. Furthermore, we propose the concept of inside attack on aggregate signatures and give an improved scheme based on Shim’s scheme. We also prove that the improved scheme is secured against the inside attack.