On the Security of a Certificateless Proxy Signature Scheme with Message Recovery

Abstract

A proxy signature scheme allows a proxy signer to sign messages on behalf of an original signer within a given context. It has lots of practical applications in distributed systems, grid computing, mobile agent applications, distributed shared object systems, global distribution networks, and mobile communications. Recently, Padhye et al. proposed a certificateless proxy signature scheme with message recovery and claimed the scheme is secure against both of the two types of adversaries. However, in this paper, we will show that Padhye et al.’s scheme is not secure against the Type I adversary. The analysis shows their scheme is not secure for practical applications.

1. Introduction

The proxy signature scheme is an important cryptographic mechanism, which was introduced first by Mambo et al. [1] in 1996. In the scheme, the original signer could delegate his signing capability to the proxy signer. After that, the proxy signer could sign a message on behalf of the original signer. The proxy signature has been widely used in distributed shared object systems, grid computing, mobile agent environment and global distribution networks, where delegation of rights is quite common [2, 3].

Recently, certificateless public key cryptography was studied widely since it could solve the certificate management problem in the traditional public key cryptography and the problem in the identity-based public key cryptography. Many certificateless key agreement schemes [4–6] and certificateless signature schemes [7–9] have been proposed for different applications. To satisfy the applications in the certificateless environment, many certificateless proxy signature (CLPS) schemes [10–17] have been proposed. In 2005, Li et al. [10] proposed the first CLPS scheme. Later, Yap et al. [11] and Lu et al. [12] found that Li et al.’s scheme is not secure at all. Lu et al. [12] also proposed an improved CLPS scheme. In 2009, Chen et al. [13] proposed the first security model for the CLPS scheme. They also proposed a new CLPS scheme and demonstrated it was provably secure in the security model. To improve performance, several other CLPS schemes [14–16] with provably security were also proposed. All the above CLPS schemes are based on bilinear pairings. The performance of these schemes [10–16] is not satisfactory since the bilinear pairing operation is very complicated. To avoid bilinear pairing operation, Padhye and Tiwari [17] proposed a certificateless proxy signature scheme with message recovery. They also proved their scheme is secure against chosen message and identity attacks in the random oracle model. In this letter, we will show and discuss the security of Padhye et al.’s scheme and show it is not secure against the Type I adversary.

The rest of the paper is organized as follows. Section 2 gives a review of Padhye et al.’s scheme. Section 3 discusses the security problem in Padhye et al.’s scheme. Finally, we conclude the paper in Section 4.

2. Review of Padhye et al.’s Scheme

In this section, we will review Padhye et al.’s scheme. For convenience, some notations used in the paper are described in the Abbreviations section.

Padhye et al.’s CLPS scheme is composed of ten algorithms, which are Setup, Partial-Private-Key-Extract, Set-Secret-Value,. Set-Private-Key, Set-Public-Key, DelGen, DelVerif, PKGen, PSign, and PSVerif. The details of these algorithms are described as follows.

Setup. Taking a security parameter 𝑘 as inputs, the KGC runs this algorithm to generate the system parameters. (1)KGC chooses a 𝑘-bit prime 𝑝, generates an elliptic curve 𝐸 over finite field 𝐹_𝑝, generates a group 𝐺 of elliptic curve points on 𝐸 with prime order 𝑛, and determines a generator 𝑃 of 𝐺.(2)KGC chooses the master key mk=𝑥∈𝑍^∗_𝑛 and computes the master public key 𝑃_pub=𝑥⋅𝑃.(3)KGC chooses four cryptographic secure hash functions 𝐻_𝑖∶{0,1}^∗→𝑍^∗_𝑛, where 𝑖=1,2,3,4.(4)KGC publishes params={𝐹_𝑝,𝐸,𝐺,𝑃,𝑃_pub,𝐻₁,𝐻₂,𝐻₃,𝐻₄} as system parameters and secretly keeps the master key 𝑥.

Partial-Private-Key-Extract. Taking a user’s identity ID_𝑈, system parameters params, and the master key 𝑥 as inputs, KGC runs the algorithm to generate the user’s partial private key.(1)KGC generates a random number 𝑘_𝑈∈𝑍^∗_𝑛 and computes 𝐾_𝑈=𝑘_𝑈⋅𝑃 and ℎ_𝑈=𝐻₁(ID_𝑈,𝐾_𝑈).(2)KGC computes 𝑑_𝑈=(𝑘_𝑈+ℎ_𝑈𝑠)mod𝑛 and sends (𝑑_𝑈,𝐾_𝑈) to the user through a secure channel.

Set-Secret-Value. Taking system parameters params as inputs, the user 𝑈 runs the algorithm to generate the secure value.(1)𝑈 generates a random number 𝑥_𝑈∈𝑍^∗_𝑛 and computes 𝑃_𝑈=𝑥_𝑈⋅𝑃.(2)𝑈 sets 𝑥_𝑈 as the secret value.

Set-Private-Key. Taking the secret value 𝑥_𝑈 and the partial private key 𝑑_𝑈 as inputs, the user sets sk_𝑈=(𝑥_𝑈,𝑑_𝑈) as his private key.

Set-Public-Key. Taking 𝑃_𝑈 and 𝐾_𝑈 as inputs, the user sets pk_𝑈=(𝑃_𝑈,𝐾_𝑈) as his public key.

DelGen. Taking system parameters params, the original signer OS’s private key sk_OS=(𝑥_OS,𝑑_OS), the proxy signer PS’s public key pk_OS=(𝑃_OS,𝐾_OS), and a warrant message 𝑚_𝜔 as inputs, the original signer OS runs this algorithm to generate a delegation on the warrant message 𝑚_𝜔.(1)OS generates a random number 𝑟_OS∈𝑍^∗_𝑛 and computes 𝑅_OS=𝑟_OS⋅𝑃.(2)OS computes 𝜎_OS=((𝑥_OS+𝑑_OS)𝑒_OS+𝑟_OS)mod𝑛 and sends the delegation (𝑚_𝜔,𝑅_OS,𝜎_OS) to the proxy signer PS, where 𝑒_OS=𝐻₂(𝑚_𝜔,ID_OS,𝐾_OS,𝑃_OS,𝑅_OS).

DelVerif. Take the delegation (𝑚_𝜔,𝑅_OS,𝜎_OS), system parameters params, and OS’s public key pk_OS=(𝑃_OS,𝐾_OS) as inputs; PS runs the algorithm to verify the validity of the delegation.(1)PS computes 𝑒_OS=𝐻₂(𝑚_𝜔,ID_OS,𝐾_OS,𝑃_OS,𝑅_OS) and ℎ_OS=𝐻₁(ID_OS,𝐾_OS).(2)PS checks whether the equation 𝜎_OS⋅𝑃=𝑒_OS(𝑃_OS+𝐾_OS+ℎ_OS𝑃_pub)+𝑅_OS holds. If it holds, PS accepts the delegation; otherwise, PS rejects the delegation.

PKGen. Taking system parameters params, the delegation (𝑚_𝜔,𝑅_OS,𝜎_OS), and PS’s private key sk_PS=(𝑥_PS,𝑑_PS) as inputs, PS runs the algorithm to generate his proxy private key.(1)PS computes 𝑒_PS=𝐻₃(𝑚_𝜔,ID_PS,𝐾_PS,𝑃_PS).(2)PS computes 𝐷_PS=(𝜎_OS+𝑒_PS(𝑥_PS+𝑑_PS))mod𝑛 and sets 𝐷_PS as the proxy key.

PSign. Taking a message 𝑚∈{0,1}^∗, system parameters params, and the proxy private key 𝐷_PS as inputs, PS runs this algorithm to generate a proxy signature.(1)PS generates a random number 𝑟_PS∈𝑍^∗_𝑛 and computes 𝑅_PS=𝑟_PS⋅𝑃.(2)PS computes 𝑡_PS=(𝑚∣∣𝐻₄(𝑚)+(𝑅_PS)_𝑥)mod𝑛, where (𝑅_PS)_𝑥 denotes the 𝑥-coordinates of the elliptic curve group point 𝑅_PS.(3)PS computes 𝑒=𝐻₅(𝑡_PS,𝑃_OS,𝐾_PS,𝑃_PS) and 𝜎_PS=(𝑟_PS−𝑒𝐷_PS)mod𝑛.(4)PS outputs (𝑚_𝜔,𝜎_OS,𝑅_OS,𝑡_PS,𝜎_PS) as the proxy signature.

PSVerif. Taking the proxy signature (𝑚_𝜔,𝜎_OS,𝑅_OS,𝑡_PS,𝜎_PS), the message 𝑚, OS’s public key pk_OS=(𝑃_OS,𝐾_OS), PS’s public key pk_PS=(𝑃_PS,𝐾_PS), and system parameters params as inputs, the verifier 𝑉 runs this algorithm to verify the validity of the proxy signature.(1)𝑉 computes 𝑒_OS=𝐻₂(𝑚_𝜔,ID_OS,𝐾_OS,𝑃_OS,𝑅_OS), ℎ_OS=𝐻₁(ID_OS,𝐾_OS), 𝑒_PS=𝐻₃(𝑚_𝜔,ID_PS,𝐾_PS,𝑃_PS), ℎ_PS=𝐻₁(ID_PS,𝐾_PS), and 𝑒=𝐻₅(𝑡_PS,𝑃_OS,𝐾_PS,𝑃_PS).(2)𝑉 computes ∣∣𝐻₄(𝑚)=𝑡_PS−(𝜎_PS⋅𝑃+𝑒(𝑒_OS(𝑃_OS+𝐾_OS+ℎ_OS⋅𝑃_pub)+𝑅_OS + 𝑒_PS(𝑃_PS + 𝐾_PS + ℎ_PS⋅𝑃_pub)))_𝑥.(3)𝑉 checks whether the hash result of the recovered 𝑚 is equal to 𝐻₄(𝑚). If they are equal, 𝑉 accepts the signature; otherwise, 𝑉 rejects the signature.

3. Security Analysis of Padhye et al.’s Scheme

There are two types of adversaries with different capabilities in CLPS schemes. They are known as Type I adversaries and Type II adversaries. The Type I adversary 𝐴_I models an outsider adversary, who could replace the public key of any user with a value of his choice, but he does not have access to the master key. The Type II adversary 𝐴_II models the malicious KGC who has access to the master key, but he cannot replace the user’s public key replacement. Padhye et al. claimed their scheme was secure against both of the two types of adversaries. In this section, we will show that a Type I adversary 𝐴_I could generate a legal delegation of any warrant message and a legal proxy signature of any message.

3.1. Attack on the Delegation

Let OS be the original signer with identity ID_OS and the public key pk_OS=(𝑃_OS,𝐾_OS). Let 𝐴_I be a Type I adversary. 𝐴_I could generate a proxy signature of a message 𝑚 and the warrant message 𝑚_𝜔 through the following steps.(1)𝐴_I generates a random number 𝑙_𝐴∈𝑍^∗_𝑛 and computes ℎ_OS=𝐻₁(ID_OS,𝐾_OS) and 𝑃^′_OS=𝑙_𝐴⋅𝑃−𝐾_OS−ℎ_OS⋅𝑃_pub.(2)𝐴_I replaces pk_OS=(𝑃_OS,𝐾_OS) with pk^′_OS=(𝑃^′_OS,𝐾_OS).(3)𝐴_I generates a random number 𝑟_𝐴∈𝑍^∗_𝑛 and computes 𝑅_𝐴=𝑟_𝐴⋅𝑃.(4)𝐴_I computes 𝜎_𝐴=(𝑙_𝐴𝑒_𝐴+𝑟_𝐴)mod𝑛 and sends the delegation (𝑚_𝜔,𝑅_𝐴,𝜎_𝐴) to the proxy signer PS, where 𝑒_𝐴=𝐻₂(𝑚_𝜔,ID_OS,𝐾_OS,𝑃^′_OS,𝑅_𝐴).

Since 𝑃^′_OS=𝑙_𝐴⋅𝑃−𝐾_OS−ℎ_OS⋅𝑃_pub and 𝑅_𝐴=𝑟_𝐴⋅𝑃, then we have 𝑒_𝐴𝑃^′_OS+𝐾_OS+ℎ_OS𝑃_pub+𝑅_𝐴=𝑒_𝐴𝑙_𝐴⋅𝑃−𝐾_OS−ℎ_OS⋅𝑃_pub+𝐾_OS+ℎ_OS𝑃_pub+𝑟_𝐴⋅𝑃=𝑒_𝐴⋅𝑙_𝐴⋅𝑃+𝑟_𝐴⋅𝑃=𝑒_𝐴⋅𝑙_𝐴+𝑟_𝐴𝑃=𝜎_𝐴⋅𝑃. (1)

Therefore, the generated delegation could pass the proxy signer PS’s verification and 𝐴_I generates a delegation of a warrant message 𝑚_𝜔 successfully.

3.2. Attack on the Proxy Signature

Let OS be the original signer with identity ID_OS and the public key pk_OS=(𝑃_OS,𝐾_OS). Let PS be the original signer with identity ID_PS and the public key pk_PS=(𝑃_PS,𝐾_PS). Let 𝐴_I be a Type I adversary. 𝐴_I could generate a delegation of a warrant message 𝑚_𝜔 through the following steps.(1)𝐴_I generates two random number 𝑙_OS,𝑙_PS∈𝑍^∗_𝑛 and computes ℎ_OS=𝐻₁(ID_OS,𝐾_OS), ℎ_PS=𝐻₁(ID_PS,𝐾_PS), 𝑃^′_OS=𝑙_OS⋅𝑃−𝐾_OS−ℎ_OS⋅𝑃_pub, and 𝑃^′_PS=𝑙_PS⋅𝑃−𝐾_PS−ℎ_PS⋅𝑃_pub.(2)𝐴_I replaces pk_OS=(𝑃_OS,𝐾_OS) and pk_PS=(𝑃_PS,𝐾_PS) with pk^′_OS=(𝑃^′_OS,𝐾_OS) and pk^′_PS=(𝑃^′_PS,𝐾_OS) separately.(3)𝐴_I generates a random number 𝑟_OS∈𝑍^∗_𝑛 and computes 𝑅_OS=𝑟_OS⋅𝑃,   𝑒_OS=𝐻₂(𝑚_𝜔,ID_OS,𝐾_OS,𝑃^′_OS,𝑅_𝐴) and 𝜎_OS=(𝑙_OS𝑒_OS+𝑟_OS)mod𝑛.(4)𝐴_I generates a random number 𝑟_PS∈𝑍^∗_𝑛 and computes 𝑅_PS=𝑟_PS⋅𝑃, 𝑡_𝑃𝑆=(𝑚∣∣𝐻₄(𝑚)+(𝑅_PS)_𝑥)mod𝑛, 𝑒_PS=𝐻₃(𝑚_𝜔,ID_PS,𝐾_PS,𝑃^′_PS), 𝑒=𝐻₅(𝑡_PS,𝑃^′_OS,𝐾_PS,𝑃^′_PS) and 𝜎_PS=(𝑟_PS−𝑒(𝜎_OS+𝑒_PS𝑙_PS))mod𝑛.(5)PS outputs (𝑚_𝜔,𝜎_OS,𝑅_OS,𝑡_PS,𝜎_PS) as the proxy signature.

Since 𝑃^′_OS=𝑙_OS⋅𝑃−𝐾_OS−ℎ_OS⋅𝑃_pub, 𝑃^′_PS=𝑙_PS⋅𝑃−𝐾_PS−ℎ_PS⋅𝑃_pub, 𝜎_OS=(𝑙_OS𝑒_OS+𝑟_OS)mod𝑛, 𝑅_OS=𝑟_OS⋅𝑃 and 𝑅_PS=𝑟_PS⋅𝑃, then we have 𝜎_PS⋅𝑃+𝑒𝑒_OS𝑃^′_OS+𝐾_OS+ℎ_OS⋅𝑃_pub+𝑅_OS+𝑒_PS𝑃^′_PS+𝐾_PS+ℎ_PS⋅𝑃_pub=𝑟_PS−𝑒𝜎_OS+𝑒_PS𝑙_PS𝑒⋅𝑃+𝑒_OS𝑙_OS⋅𝑃−𝐾_OS−ℎ_OS⋅𝑃_pub+𝐾_OS+ℎ_OS⋅𝑃_pub+𝑟_OS⋅𝑃+𝑒_PS𝑙_PS⋅𝑃−𝐾_PS−ℎ_PS⋅𝑃_pub+𝐾_PS+ℎ_PS⋅𝑃_pub=𝑟_PS−𝑒𝜎_OS+𝑒_PS𝑙_PS𝑒⋅𝑃+𝑒_OS𝑙_OS⋅𝑃+𝑟_OS⋅𝑃+𝑒_PS𝑙_PS⋅𝑃=𝑟_PS⋅𝑃−𝑒𝜎_OS+𝑒_PS𝑙_PS𝑙⋅𝑃+𝑒_OS𝑒_OS+𝑟_OS+𝑒_PS𝑙_PS⋅𝑃=𝑟_PS⋅𝑃−𝑒𝜎_OS+𝑒_PS𝑙_PS𝜎⋅𝑃+𝑒_OS+𝑒_PS𝑙_PS⋅𝑃=𝑟_PS⋅𝑃. (2) Therefore, the generated signature could pass the verification and 𝐴_I generates a signature successfully.

4. Conclusion

In this paper, we have demonstrated that Padhye et al.’s CLPS scheme with message recovery is not secure against the Type I adversary by giving concrete attacks. The analysis shows their scheme is not secure for practical applications. We will try to give a countermeasure to overcome weaknesses in their scheme in the future.

Abbreviations

𝑝:	A large prime number
𝐹𝑝:	A finite field
𝐸:	An elliptic curve defined by the equation 𝑦2=𝑥3+𝑎𝑥+𝑏, where 𝑎,𝑏∈𝐹𝑝 and   Δ=4𝑎3+27𝑏2≠0
𝐺:	The group consists of points on 𝐸 and the infinite point 𝑂
𝑛:	The order of 𝐺, where 𝑛 is a large prime number
𝑃:	A generator of group 𝐺
(𝑥,𝑃pub)∶	The master/public key pair of the key generation centre (KGC)
𝑈:	A user
ID𝑈:	The identity of 𝑈
𝑑𝑈:	The partial private key of 𝑈
𝑥𝑈:	The secret value of  𝑈
sk𝑈:	The private key of  𝑈
pk𝑈:	The public key of 𝑈
OS:	The original signer
PS:	The proxy signer
𝐷PS:	The proxy key.

Acknowledgments

The authors thank the editors and the anonymous reviewers for their valuable comments. This research was supported by National Natural Science Foundation of China (nos. 61202447 and 61201180), Natural Science Foundation of Hebei Province of China (no. F2013501066), Northeastern University at Qinhuangdao Science and Technology Support Program (no. xnk201307), Beijing Natural Science Foundation (no. 4132055), and Excellent Young Scholars Research Fund of Beijing Institute of Technology.