Attacks on One Designated Verifier Proxy Signature Scheme

Abstract

In a designated verifier proxy signature scheme, there are three participants, namely, the original signer, the proxy signer, and the designated verifier. The original signer delegates his or her signing right to the proxy signer, then the proxy signer can generate valid signature on behalf of the original signer. But only the designated verifier can verify the proxy signature. Several designated verifier proxy signature schemes have been proposed. However, most of them were proven secure in the random oracle model, which has received a lot of criticism since the security proofs in the random oracle model are not sound with respect to the standard model. Recently, by employing Water's hashing technique, Yu et al. proposed a new construction of designated verifier proxy signature. They claimed that the new construction is the first designated verifier proxy signature, whose security does not rely on the random oracles. But, in this paper, we will show some attacks on Yu et al.'s scheme. So, their scheme is not secure.

1. Introduction

The concept of proxy signature was first introduced by Mambo et al. [1] in 1996. Proxy signature is very useful when a user, called an original signer, wants to delegate his or her signing rights to the other user, called a proxy signer. In a proxy signature scheme, the proxy signer can generate a valid signature on behalf of the original signer. Anyone can verify the authenticity of the purported signature by using the public keys of the original signer and proxy signer. But, when a verifier receives a proxy signature, he should not only verify the correctness by a given verification procedure, but also be convinced of the original signer’ agreement on the signed message. Proxy signature schemes have been suggested for use in a number of applications, including electronic commerce, e-cash, and distributed shared object systems.

Unlike standard signature, In order to protect signature privacy, Jakobsson et al. [2] introduced a new primitive named designated verifier proofs in 1996. Such a proof enables a prover convince a designated verifier that a statement is true, while the designated verifier cannot use the proof to convince others of this fact, since the designated verifier himself can simulate such a proof. Furthermore, Jakobsson et al. proposed a designated verifier signature scheme in the sense that only the designated verifier can be convinced that a signature is produced by the claimed signer. Jakobsson et al. also discussed a stronger concept called strong designated verifier signature in the same paper.

In 2003, based on the concepts of proxy signatures and designated verifier signatures, Dai et al. [3] consider a scenario where the proxy signer wishes to protect his signing privilege from knowing by other parties. In other words, the proxy signer only wants to convince the designated receiver that he has signed the specific message. They proposed such a scheme called designated verifier proxy signature, which provides authentication of a message without providing a nonrepudiation property of traditional digital signature. A designated verifier proxy signature scheme can be used to convince the designated verifier and only the designated verifier whether a signature is valid or not. This is due to the fact that the designated verifier can always generate a valid signature intended for himself that is indistinguishable from an original signature. This kind of signature is useful in electronic commerce applications. Unfortunately, Wang [4] pointed out there exists a forgery attack in Dai et al.’s scheme. Huang et al. [5] proposed a short designated verifier proxy signature from pairings to improve the communication efficiency. Lu and cao [6] proposed a designated verifier proxy signature with message recovery in 2005. Zhang and Mao [7] proposed a novel ID-based designated verifier proxy signature scheme. Although several designated verifier proxy signature schemes have been proposed. However, most of them were proven secure in the random oracle model, which has received a lot of criticism since the security proofs in the random oracle model are not sound with respect to the standard model. Recently, by employing Water’s hashing technique [8], Yu et al. [9] proposed a new construction of designated verifier proxy signature scheme. They claimed that the new construction is the first designated verifier proxy signature scheme, whose security does not rely on the random oracles. But in this paper, we will show some attacks on their scheme. So, their scheme is not secure.

The paper is organized as follows. In the next section, we will review Yu et al.’s designated verifier proxy signature scheme. The attacks on Yu et al.'s scheme are presented in Section 3. Finally, Section 4 concludes the paper.

2. Review of Yu et al.’s Designated Verifier Proxy Signature Scheme

In this section, we review the designated verifier proxy signature scheme proposed by Yu et al.. There are three participants in Yu et al.’s scheme, namely, Alice, Bob, and Cindy, who act as the original signer, the proxy signer, and the designated verifier, respectively. Yu et al.’s scheme consists of the following algorithms.

2.1. Setup

The system parameters are as follows. Let (𝐺,𝐺_𝑇) be bilinear groups, where |𝐺|=|𝐺_𝑇|=𝑝 for some prime, 𝑔 is a generator of 𝐺. 𝑒 denotes an admissible pairing 𝐺×𝐺→𝐺_𝑇. Pick 𝑢′,𝑚′∈𝐺 and vectors ^→𝑢=(𝑢_𝑖),𝑚^→=(𝑚_𝑖) of length 𝑛, whose entries are random elements from 𝐺. The public parameters are (𝐺,𝐺_𝑇,𝑒,𝑢^,𝑚^,^→𝑢,𝑚^→).

2.2. Keygen

Alice picks randomly 𝑥_𝑎,𝑦_𝑎∈𝑍^∗𝑝 and sets her secret key 𝑘_𝑎=(𝑥_𝑎,𝑦_𝑎). Then she computes her public key: 𝑝𝑘_𝑎=𝑝𝑘_𝑎𝑥,𝑝𝑘_𝑎𝑦=(𝑔^𝑥𝑎,𝑔^𝑦𝑎).(2.1) Similarly, Bob’s secret key is 𝑠𝑘_𝑏=(𝑥_𝑏,𝑦_𝑏), and the public key is 𝑝𝑘_𝑏=𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦=(𝑔^𝑥𝑏,𝑔^𝑦𝑏).(2.2) Cindy’s secret key is 𝑠𝑘_𝑐=(𝑥_𝑐,𝑦_𝑐), and the public key is 𝑝𝑘_𝑐=𝑝𝑘_𝑐𝑥,𝑝𝑘_𝑐𝑦=(𝑔^𝑥𝑐,𝑔^𝑦𝑐).(2.3)

2.3. DelegationGen

Let 𝑊 be an n-bit message called warrant to be signed by the original signer and 𝑊_𝑖 denotes the 𝑖-bit of, and let 𝑤⊆{1,2,…,𝑛} be the set of all 𝑖 for which 𝑊_𝑖=1. The original signer picks a random 𝑟_𝑎∈𝑍_𝑝 and computes the delegation 𝜎_𝜔=(𝜎_𝜔1,𝜎_𝜔2) and sends it to the proxy signer Bob, where 𝜎_𝜔1=𝑔^{𝑥𝑎𝑦𝑎}𝑢^_𝑖∈𝑤𝑢_𝑖^𝑟𝑎𝜎_𝜔2,=𝑔^𝑟𝑎.(2.4)

2.4. ProxySign

Let 𝑀 be an n-bit message to be signed by the proxy signer Bob and 𝑀_𝑖 denotes the 𝑖-bit of, and let 𝑚⊆{1,2,…,𝑛} be the set of all 𝑖 for which 𝑀_𝑖=1. The proxy signature is generated as follows. First, the proxy signer Bob picks two random values 𝑟^𝑎,𝑟_𝑏∈𝑍_𝑝. Then the proxy signature 𝜎=(𝜎₁,𝜎₂,𝜎₃) on 𝑀 is constructed as 𝜎₁=𝑒⎛⎜⎜⎝𝜎_𝜔1𝑢^_𝑖∈𝑤𝑢_𝑖^𝑟′𝑎𝑔^{𝑥𝑏𝑦𝑎}𝑚^_𝑖∈𝑚𝑚_𝑖^𝑟𝑏,𝑝𝑘_𝑐𝑥𝜎₂⎞⎟⎟⎠,𝜎=₃𝜎_𝜔2𝑔^𝑟′𝑎,=𝑔^𝑟𝑏.(2.5)

2.5. Verification

To check whether 𝜎=(𝜎₁,𝜎₂,𝜎₃) is a valid proxy signature on the message 𝑀 under the warrant, Cindy uses her secret key to verify whether the following equation holds:𝜎₁=𝑒𝑝𝑘_𝑎𝑥,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖∈𝑤𝑢_𝑖,𝜎₂^𝑥𝑐𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝜎₃^𝑥𝑐.(2.6)

2.6. Transcript Simulation

Cindy can use her private key to compute a signature on an arbitrary message 𝑀^∗ with the warrant 𝑊^∗. She picks two random values 𝑟₁,𝑟₂∈𝑍^∗𝑝 and computes 𝜎^∗=(𝜎^∗1,𝜎^∗2,𝜎^∗3), where 𝜎𝜎^∗2_∗3=𝑔^𝑟1,𝜎_∗1=𝑔^𝑟2,=𝑒𝑝𝑘_𝑎𝑥,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖_∈𝑤∗𝑢_𝑖,𝜎_2∗^𝑥𝑐𝑒𝑚^_{𝑖∈𝑚∗}𝑚_𝑖,𝜎_3∗^𝑥𝑐.(2.7)

3. Attacks on Yu et al.’s Designated Verifier Proxy Signature Scheme

In this section, we will give some attacks on Yu et al.’s designated verifier proxy signature scheme.

3.1. Attack 1

On receiving the delegation 𝜎_𝜔=(𝜎_𝜔1,𝜎_𝜔2) and the warrant, the attacker randomly selects 𝑟^∗𝑎∈𝑍_𝑝 and alters the delegation as 𝜎^∗𝜔=(𝜎^∗𝜔₁,𝜎^∗𝜔₂), where 𝜎_𝜔1^∗=𝜎_𝜔1𝑢^_𝑖∈𝑤𝑢_𝑖^𝑟∗𝑎𝜎,(3.1)_∗𝜔2=𝜎_𝜔2𝑔^𝑟∗𝑎.(3.2)

3.2. Attack 2

On receiving the proxy signature 𝜎=(𝜎₁,𝜎₂,𝜎₃) on one message 𝑀, everybody can forge another valid proxy signature 𝜎^∗=(𝜎^∗1,𝜎^∗2,𝜎^∗3) on 𝑀 as follows: 𝜎_1∗=𝜎₁⋅𝑒⎛⎜⎜⎝𝑚^_𝑖∈𝑚𝑚_𝑖^𝑟∗𝑏,𝑝𝑘_𝑐𝑥𝜎_∗2⎞⎟⎟⎠,𝜎_∗3=𝜎₂,=𝜎₃𝑔^𝑟∗𝑏(3.3)𝑟^∗𝑏∈𝑍_𝑝 is  a  random  number.

In fact, because 𝜎=(𝜎₁,𝜎₂,𝜎₃) is valid proxy signature, the following verification equation holds: 𝜎₁=𝑒𝑝𝑘_𝑎𝑥,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖∈𝑤𝑢_𝑖,𝜎₂^𝑥𝑐𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝜎₃^𝑥𝑐.(3.4) Then, 𝜎^∗1=𝜎₁⋅𝑒⎛⎜⎜⎝𝑚^_𝑖∈𝑚𝑚_𝑖^𝑟∗𝑏,𝑝𝑘_𝑐𝑥=𝑒𝑝𝑘_𝑎𝑥⎞⎟⎟⎠,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖∈𝑤𝑢_𝑖,𝜎₂^𝑥𝑐𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝜎₃^𝑥𝑐⋅𝑒⎛⎜⎜⎝𝑚^_𝑖∈𝑚𝑚_𝑖^𝑟∗𝑏,𝑝𝑘_𝑐𝑥=𝑒𝑝𝑘_𝑎𝑥⎞⎟⎟⎠,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖∈𝑤𝑢_𝑖,𝜎₂^𝑥𝑐𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝜎₃^𝑥𝑐⋅𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝑔^𝑟∗𝑏^𝑥𝑐=𝑒𝑝𝑘_𝑎𝑥,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖∈𝑤𝑢_𝑖,𝜎₂^𝑥𝑐𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝜎₃𝑔^𝑟∗𝑏^𝑥𝑐=𝑒𝑝𝑘_𝑎𝑥,𝑝𝑘_𝑎𝑦^𝑥𝑐𝑒𝑝𝑘_𝑏𝑥,𝑝𝑘_𝑏𝑦^𝑥𝑐⋅𝑒𝑢^_𝑖∈𝑤𝑢_𝑖,𝜎₂^𝑥𝑐𝑒𝑚^_𝑖∈𝑚𝑚_𝑖,𝜎^∗3^𝑥𝑐.(3.5) So,𝜎^∗=(𝜎^∗1,𝜎^∗2,𝜎^∗3)is  a  valid  proxy  signature  on𝑀.

3.3. Attack 3

Anyone who gets 𝑔^{𝑥𝑎𝑦𝑎} can personate the original signer to delegate signing rights of the original signer. On the other hand, in some scenarios the original signer may reveal 𝑔^{𝑥𝑎𝑦𝑎} without revealing his private key (𝑥_𝑎,𝑦_𝑎) to make confusion about the delegation of signing rights on purpose.

3.4. Attack 4

Similarly, anyone who gets 𝑔^{𝑥𝑏𝑦𝑏} can personate the proxy signer to generate proxy signatures. On the other hand, in some scenarios the proxy signer may reveal 𝑔^{𝑥𝑏𝑦𝑏} without revealing his private key (𝑥_𝑏,𝑦_𝑏) to make confusion about the production of proxy signatures on purpose.

4. Conclusion

A designated verifier proxy signature scheme can be used to convince the designated verifier and only the designated verifier whether a signature is valid or not. This is due to the fact that the designated verifier can always generate a valid signature intended for him that is indistinguishable from an original signature. This kind of signature is useful in electronic commerce applications. Recently, Yu et al. proposed a new construction of designated verifier proxy signature scheme. As for the security, they classified the potential adversaries into three kinds according to their attack power and proved that their scheme is unforgeable against all kinds of adversaries in the standard model. But, in this paper, we show some attacks on their scheme. So, their scheme is not secure.