Cryptanalysis and Performance Evaluation of Enhanced Threshold Proxy Signature Scheme Based on RSA for Known Signers

Abstract

In these days there are plenty of signature schemes such as the (𝑡,𝑛) threshold proxy signature scheme (Kumar and Verma 2010). The network is a shared medium so that the weakness security attacks such as eavesdropping, replay attack, and modification attack. Thus, we have to establish a common key for encrypting/decrypting our communications over an insecure network. In this scheme, a (𝑡,𝑛) threshold proxy signature scheme based on RSA, any 𝑡 or more proxy signers can cooperatively generate a proxy signature while 𝑡−1 or fewer of them cannot do it. The threshold proxy signature scheme uses the RSA cryptosystem to generate the private and the public key of the signers (Rivest et al., 1978). Comparison is done on the basis of time complexity, space complexity, and communication overhead. We compare the performance of four schemes (Hwang et al. (2003), Kuo and Chen (2005), Yong-Jun et al. (2007), and Li et al. (2007), with the performance of a scheme that has been proposed earlier by the authors of this paper. In the proposed scheme, both the combiner and the secret share holder can verify the correctness of the information that they are receiving from each other. Therefore, the enhanced threshold proxy signature scheme is secure and efficient against notorious conspiracy attacks.

1. Introduction

Today Internet is an inseparable part of our life and millions of people will be using the Internet. Reading the news, chatting with friends, purchasing a new product, and researching for a paper, the number of uses of the Internet is endless. One of the attractions of the Internet is that one can do almost anything from the comfort of his/her own home and with a relative sense of anonymity.

Unfortunately, the data going across the Internet may not be as secure as we would like to think. It is not especially difficult for a person with the right technical skills to intercept the data going from one computer to another. Usually this is not a problem; people do not really care if someone knows that they went to http://www.google.com/ and started researching Number Theory. However, if the intercepted data contains a credit card number, password, social security number, or some other private information, it becomes a whole different story.

Online banking and a host of other services rely heavily upon the security of credit card numbers, PINs, and other private information as it goes across the network. But if it is easy to intercept these numbers, how do these services work? The answer is cryptography.

In today’s commercial environment, establishing a framework for the authentication of computer-based information requires a familiarity with concepts and professional skills from both the legal and computer security fields. Combining these two disciplines is not an easy task because concepts from the information security field often correspond only loosely to concepts from the legal fields, even in situations where the terminology is similar. For example, from the information security point of view, “digital signature” means the result of applying to specific technical processes. The historical legal concept of “signature” is broader. It recognizes any mark made with the intention of authenticating the marked document [1].

In this research paper, we discuss threshold proxy signature scheme. In a (𝑡,𝑛) threshold proxy signature schemes, an original signer delegates a group of n proxy signers to sign message on behalf of him or her. When the proxy signature is created, 𝑡 or more proxy signers cooperate to generate valid proxy signatures and less than 𝑡 proxy signers cannot cooperatively produce valid proxy signatures. In essence, we have tested our enhanced threshold proxy signature scheme by undergoing some fruitful attacks.

2. Review of Threshold Proxy Signature Schemes

2.1. History of Threshold Proxy Signature Schemes

In the history of proxy signature technological development, the (1,𝑛) threshold proxy signature technique was the first to come. In (1,𝑛) proxy signature schemes, a legal proxy signature can be generated by a designated proxy signer by using a proxy signing key. The proxy signing key is computed from the original signer’s private key, but the private key should not be computed from the proxy signing key in any way. In the eye of a modern user, such schemes are simple but not flexible. In order to extend proxy signature schemes to fit various practical situations, many (𝑡,𝑛) threshold proxy signature schemes have been proposed. For example, we have (𝑡,𝑛) threshold proxy signature schemes that allow any 𝑡 or more proxy signers from a designated group of n members to cooperatively sign messages, while 𝑡−1 or fewer members cannot generate the legal proxy signature. In practice, the original signer can flexibly choose the threshold 𝑡. The approach agrees with (1,𝑛), (𝑡,𝑛), and (𝑛,𝑛) threshold delegations.

Rivest et al. [1] and Blakley firstly proposed the (𝑡,𝑛) threshold secret sharing scheme based upon Lagrange interpolating polynomial and linear projective geometry, respectively, in 1979. In a (𝑡,𝑛) threshold secret sharing scheme, secret holder delivers the distinct secret values (called shares or shadows) to n participants. At least 𝑡 or more participants can combine their shares and reconstruct the secret, but only 𝑡−1 or fewer members cannot. Based on these properties, secret sharing is an important part of modern cryptography and has been used in many fields of modern cryptography. In 1996, Mambo et al. [12] proposed the concept of proxy signature. In their schemes, the original signer can delegate his/her right to the proxy signers who can sign the message instead of the original signer.

Recently, many threshold proxy signature schemes were proposed. The history of threshold proxy signature schemes is made up in Table 1.

Table 1 

History of threshold proxy signature schemes.

The concept of threshold cryptosystems was also brought up by Denmedt and Frankel in 1991. They adapted the ElGamal public key cryptosystem and used the Lagrange interpolation or geometry to produce shadows.

To make proxy signature applicable to group-oriented situations, Sun [13] and Kim et al. [5] proposed a (𝑡,𝑛) threshold proxy signature in 1997, which is a variant of proxy signature by using the ideas of secret sharing and threshold cryptosystems. The basic strategy used in Kim et al.’s scheme is a random number generation.

2.2. Review of Kim et al.’s Scheme

2.2.1. The Random Number Generation Phase

This scheme requires a protocol to generate a random number among the group without the dealer. Let 𝑃₀ be the original signer, and let 𝑃₁,𝑃₂,…,𝑃_𝑛 be the n proxy signers of the proxy group.(1)Each proxy signer 𝑃_𝑖 selects secret polynomial of degree 𝑡−1 such that 𝑓_𝑖(𝑥)=𝑟_𝑖+𝑎_𝑖,1𝑥+𝑎_𝑖,2𝑥²+⋯+𝑎_{𝑖,𝑡−1}𝑥^𝑡−1mod𝑞, (1)where 𝑟_𝑖, 𝑎_𝑖,1, 𝑎_𝑖,2, and 𝑎_{𝑖,𝑡−1} are random numbers.(2)Then, each 𝑃_𝑖 computes 𝑓_𝑖(𝑗) mod 𝑞 and sends it to 𝑃_𝑗 for all 1≤𝑗<𝑛 and 𝑗≠𝑛. Furthermore, 𝑃_𝑖 computes 𝑔^𝑟𝑖,𝑔^𝑎𝑖,1,𝑔^𝑎𝑖,2,…,𝑔^{𝑎𝑖,𝑡−1}mod𝑝 (2) and broadcasts them.(3)After receiving 𝑓_𝑗(𝑖) (for 𝑗=1,2,…,𝑛 and 𝑗≠𝑖), 𝑃_𝑖 confirms that the validity of 𝑓_𝑗(𝑖) by checking whether or not 𝑔^{𝑓𝑗(𝑖)} satisfies the following equation: 𝑔^{𝑓𝑗(𝑖)}=𝑔^𝑟𝑗×𝑔^{𝑎𝑗,1𝑖1}×⋯×𝑔^{𝑎𝑗,𝑡−1𝑖𝑡−1}mod𝑝. (3)(4)If the verifications in Step 3 hold, each 𝑃_𝑖 computes the secret share 𝑆_𝑖=^𝑗=𝑛_𝑗=1𝑓_𝑗(𝑖) (4) and computes public outputs 𝑟=^𝑗=𝑛_𝑗=1𝑟_𝑗𝑔mod𝑝,_𝑎1=^𝑗=𝑛_𝑗=1𝑔^𝑗,1𝑔mod𝑝,_𝑎2=^𝑗=𝑛_𝑗=1𝑔^𝑗,2⋮𝑔mod𝑝,_𝑎𝑡−1=^𝑗=𝑛_𝑗=1𝑔^{𝑗,𝑡−1}mod𝑝. (5)

2.2.2. The Proxy Sharing Phase

(1)Group Key Generation. First, the proxy group must execute the above protocol to obtain the share 𝑠_𝑖 and the public outputs 𝑦_𝐺=𝑔^𝑎0 mod 𝑝, 𝐴_𝑗=𝑔^𝑎𝑗 mod 𝑝, where 𝑗=1,2,…,𝑡−1. (6)(2)Proxy Generation. The original signer computes 𝐾=𝑔^𝑘 mod 𝑝 and 𝑒=ℎ(𝑚_𝑤,𝐾), where 𝑘 is a random number, 𝑚_𝑤 is a warrant, and ℎ() is one way hash function. After this, 𝑃₀ computes 𝜎=𝑒×𝑥₀+𝑘mod𝑞, (7) where 𝑥₀ is a private key of the original signer. (3)Proxy Sharing. 𝑃₀ randomly chooses a polynomial such that 𝑓^′(𝑥)=𝜎+𝑏₁𝑥+𝑏₂𝑥²+⋯+𝑏_𝑡−1𝑥^𝑡−1, (8) where 𝑏₁, 𝑏₂, 𝑏_𝑡−1 are random numbers. Then, 𝑃₀ computes 𝑓^′(𝑖) and sends it to each 𝑃_𝑖 in a secret manner; 𝑃₀ also computes 𝐵₁=𝑔^𝑏1,𝐵₂=𝑔^𝑏2,…,𝐵_𝑡−1=𝑔^𝑡−1mod𝑝 (9) and publishes 𝑚_𝑤,𝐾,𝐵₁,𝐵₂,…,𝐵_𝑡−1(mod𝑝).(4)Proxy Share Generation. After receiving 𝑓^′(𝑖), each 𝑃_𝑖 has to validate 𝑓^′(𝑖) using 𝑔^{𝑓′(𝑖)}=𝑦₀^{ℎ(𝑚𝑤,𝐾)}𝐾^𝑡−1_𝑗=1𝐵_𝑗^𝑖𝑗mod𝑝, (10) where 𝑦₀ is the original signer’s public key. If it holds, each proxy signer, 𝑃_𝑖, computes the proxy sharing 𝜎^′_𝑖=𝑓^′(𝑖)+𝑠_𝑖×𝑒mod𝑞. (11)

2.2.3. The Proxy Issuing and Verification Phase

(1)The 𝑡 or more actual signers have to execute the random number generation phase to obtain the secret output 𝑠^′_𝑖 and public outputs 𝑦=𝑔^𝑐0,𝐶₁=𝑔^𝑐1,𝐶₂=𝑔^𝑐2,…,𝐶_𝑡−1=𝑔^𝑐𝑡−1mod𝑝, (12) where 𝑠^′_𝑖=𝑓^′(𝑖)=𝑐₀+𝑐^𝑖₁+𝑐₂^𝑖2+⋯+𝑐_𝑡−1𝑖^𝑡−1. (13)(2)Then each actual signer uses his proxy signature key to issue a partial proxy signature such that 𝑒^′=ℎ(𝑦,𝑚) and 𝛾_𝑖=𝑠^′_𝑖+𝜎^′_𝑖×𝑒mod𝑞, where 𝑚 is message. Then, each actual signer reveals 𝛾_𝑖.(3)Everyone can verify the validity of 𝛾_𝑖 by the following equation: 𝑔^𝛾𝑖=𝑦^𝑡−1_𝑖=1𝐶_𝑖^𝑗𝑖×𝑦₀^{ℎ(𝑚𝑤,𝐾)}𝐾^𝑡−1_𝑖=1𝐵_𝑖^𝑗𝑖mod𝑝×𝑦_𝐺^𝑡−1_𝑖=1𝐴_𝑖^{𝑗𝑖ℎ(𝑚𝑤,𝐾)ℎ(𝑦,𝑚)}mod𝑝. (14)(4)If the previous verification holds, the signature, on 𝑚 is (𝑚,𝑇,𝑒^′,𝑘,𝑚_𝑤), where 𝑇=𝑐₀+𝜎×𝑒^′=𝑓^′(0)+𝑓(0)×𝑒^′ can be computed by applying the Lagrange formula. (5)To verify the validity of the signature, anyone can examine the following equation: 𝑦^′=𝑔^𝑇×𝑦₀^{ℎ(𝑚𝑤,𝐾)}𝐾^−𝑒𝑖mod𝑝,𝑒^′=ℎ𝑦^′,𝑚. (15)

2.3. Security Analysis of Kim et al. and Related Schemes

The Kim et al.’s [13] scheme has been shown insecure by Sun et al. [6] using the public key updating attack. Kim et al. proposed two types of threshold proxy signature schemes, which were the proxy-protected scheme and the proxy-unprotected scheme. In the proxy-protected scheme, the original cannot impersonate a proxy signer to issue a valid proxy signature. The proxy signing key combines the original signer’s secret sharing key and a secret value among the 𝑡 proxy signers. Therefore, the original signer cannot obtain the proxy signing keys. This property is called proxy-protected. One major drawback in Kim et al.’s scheme is that the actual signers cannot be identified. This can be very inconvenient for internal auditing. Kim et al.’s scheme does not satisfy the known signer’s requirement, proxy protection requirement, and the time constrain requirement. It does not satisfy the known signer’s requirement as the actual signer cannot be identified. Also, it is necessary for a verifier to use the public information to check the validity of proxy signature. If the pubic information is not authenticated, the original signer is able to execute the (𝑡,𝑛) threshold proxy signature scheme to generate a valid proxy signature key by himself; that is, he plays the roles of the original signer and the proxy signers simultaneously. This is because a verifier is unable to distinguish whether the public information is created by the legal proxy group or by others (a dishonest original signer or unauthorized group). Hence, it does not satisfy the proxy protection requirement. This scheme does not have the ability to put time constraints on the threshold delegation.

In order to remedy the problem of unknown signers, Sun et al. [6] revised Kim et al.’s [13] proxy-protected type threshold proxy signature scheme and made the actual signers able to be identified. Sun et al.’s scheme is also insecure since any 𝑛−1 proxy signers in the group can conspire to obtain secret key needed by the remainder of the group. Also, the computational as well as communicational overhead of Sun’s scheme is high. With 𝑡 or more proxy signers, it issues a proxy signature which has to generate and share a random number among them. In essence, it requires several expansion modular exponential computations and communications.

Unfortunately, Zhang’s scheme [13] has also shown to be insecure by Lee, Hwang, and Wang. They have shown a dishonest proxy signer can cheat to get a signature which is generated by the original signer on any message with the condition that a conventional digital signature scheme is a variation of ElGamal type signature.

In 1991, Desmedt and Frankel proposed a threshold RSA signature scheme. This technique allows 𝑡 out of 𝑛 individuals to generate a signature for a message. The signature is on the behalf of group of n members; hence, we also call it group signature. Rivest et al. [1] extended the concepts and principles from Desmedt and Frankel’s threshold RSA signature to develop a threshold RSA proxy signature scheme.

In 1999, Okamoto et al. [14] also suggested an enhanced proxy signature scheme based on both the Mambo-Usuda-Okamoto and Kim-Park-Won schemes. Later on, Sun, Lee, and Hwang examined the security of the Sun-Hsieh scheme based on the Kim-Park-Won scheme and proved that the scheme is not nonrepudiable. And also, a slightly modified version was suggested by them.

Hwang et al. [7] have shown that Sun’s scheme has a security weakness. An adversary can impersonate a legal proxy signer to generate a proxy signature and the real proxy signer cannot deny having signed the proxy signature.

Lee et al. [15] have proposed the generalization of the (𝑡₁/𝑛₁−𝑡₂/𝑛₂) proxy signature scheme based on factorization of the square root modulo of a composite number. They proposed three kinds of proxy signature schemes: the (𝑡/𝑛−1), the (1−𝑡/𝑛), and the (1−1) proxy signature schemes. In this, the actual original signer cannot deny delegating the warrant or proxy signature either.

Tzeng et al. [16] have proposed a batch verification scheme for multiple proxy signature to reduce proxy verification time. The proposed scheme is not efficient because it does not verify each proxy signature separately, but somehow it is secure because it can detect forged multiple proxy signatures without failure.

Hwang et al. [17] have proposed a multiproxy multisignature scheme which allows any 𝑢 or more proxy signers from a designated group of 𝑣 proxy signers to sign messages on behalf of any 𝑡 or more original signers from a group of 𝑛 original signers in total. In this, they only make (𝑢,𝑣) proxy signers to sign on behalf of them.

Lu et al. [18] have proposed a proxy signature scheme which allows the original signer to revoke delegations whenever necessary. In this, the authentication server will not issue the time-stamp unless the delegation has not been revoked or the delegation period specified in the warrant has not expired.

Yang et al. [19] have proposed an improvement of Hsu et al.’s scheme that is somewhat efficient in terms of computational complexity and communication cost. Different from Hsu et al.’s, the original signer only computes a common proxy share and broadcasts it to the proxy group. As compared with Hsu et al.’s scheme, the secret shares calculations is not required.

Tzeng et al. [20] have proposed a threshold multiproxy multisignature scheme with (𝑡₃,𝑛₃) shared verification. They have proposed the security on the basis of one-way hash function and discrete logarithm problem. They considered only a few attacks.

Tzeng et al. [21] have presented security analysis of the Hwang-Lin-Lu scheme. The Hwang-Lin-Lu scheme is vulnerable to forge attack.

Hwang et al. [22] have presented a generalized version of proxy signature scheme. A generalization version of the (𝑡₁/𝑛₁−𝑡₂/𝑛₂) proxy signature scheme is based on the elliptic curve discrete logarithm problem only. In this paper, the actual original signer cannot deny delegating the warrant or the proxy signature.

In 2001, Hsu et al. proposed a nonrepudiable threshold proxy signature scheme. Tsai et al. [23] proposed a scheme to remedy the weakness of the Hsu-Wu-Wu scheme. In this, neither the original signer nor a malicious proxy signer can forge the legal proxy signature.

Li et al. [24] have presented a generalized version of proxy signature scheme. A generalization version of the (𝑡₁/𝑛₁−𝑡₂/𝑛₂) is based on the discrete logarithm problem only. They discussed three kinds of proxy signature schemes: the (𝑡/𝑛−1), the (1−𝑡/𝑛), and the (1−1) proxy signature schemes. The actual original signer cannot deny delegating the warrant or the proxy signature.

Hwang et al. [25] have discussed Hwang and Shi’s scheme without using a one-way hash function. In their scheme, an original signer needs not send a proxy certificate to proxy signer through secure channels. This scheme is vulnerable to the public key substitution attacks.

Hwang et al. [26] have presented a cryptanalysis of Sun’s threshold proxy signature scheme. They have shown only that the secret key can be compromised by collusion attack.

Raman Kumar et al. [27] have presented a new scheme which includes the features and benefits of four schemes: Hwang et al., Wen et al., Geng et al. and Feng et al. They have compared these schemes and optimized their own proposed scheme on the basis of different parameters.

2.4. Review of Hwang et al.’s Scheme

In the HLL scheme, Hwang et al. [7] proposed a practical and efficient (𝑡,𝑛) threshold proxy signature scheme based on the RSA cryptosystem. This scheme uses only an RSA digital signature scheme and a simple Lagrange formula to share the proxy signature key.

There are three types of participants in the scheme: the original signer, the 𝑛 proxy signer, and the combiner. The original signer allows a group of 𝑛 proxy signers to sign a message. The combiner can be the secretary of the original signer. The proposed threshold proxy signature scheme can be divided into three phases:(1)The proxy sharing phase;(2)The proxy issuing phase;(3)The verification phase.

In the proxy generation phase, the original signer computes the partial proxy signing keys from his private key and sends them to each designated proxy signer. In the proxy signature issuing phase, the proxy signers cooperatively create a valid signature on a message 𝑀. In the verification phase, the verifier can identify not only the original signer, but also the actual signers. 𝑃₀ stands for the original signer and 𝑃₁,𝑃₂,…,𝑃_𝑛 stand for the 𝑛 proxy signers. 𝑁_𝑖 is a public RSA modulus for 𝑃_𝑖 such that 𝑁_𝑖 is a public RSA modulus for 𝑃_𝑖 and 𝑁_𝑖=𝑝_𝑖×𝑞_𝑖, where 𝑝_𝑖 and 𝑞_𝑖 are two secret large primes, while 𝑑_𝑖 is the private key for 𝑃_𝑖 and its corresponding public key is 𝑒_𝑖, such that 𝑑_𝑖×𝑒_𝑖=1 mod Φ(𝑁_𝑖), where Φ(𝑁_𝑖)=(𝑝_𝑖−1)×(𝑞_𝑖−1). The parameters 𝑒_𝑖 and 𝑁_𝑖 can be published. The parameters 𝑑_𝑖 and Φ(𝑁_𝑖) are kept secret by the holder. [𝑀]^𝑑𝑖mod𝑁_𝑖 represents 𝑀 signed with 𝑃_𝑖’s private key 𝑑_𝑖, and [𝑀]^𝑒𝑖mod𝑁_𝑖 represents 𝑀 encrypted with 𝑃_𝑖’s public key 𝑒_𝑖 using the ordinary RSA cryptosystem. The message 𝑚_𝑤 stands for a warrant that is minted by the original signer and it contains important information such as the validity period of the proxy key, the identities of the proxy signers, and the original signer. In the proposed scheme, let 𝑁₀<𝑁_𝑖(𝑖=1,2,…,𝑛).

2.4.1. The Proxy Sharing Phase

Assume that an original signer 𝑃₀ delegates the power to sign messages to 𝑛 members during 𝑠 stipulated period. The steps to generate the proxy key are as follows.

(1) Proxy Generation. 𝑃₀ produces the group proxy signing key 𝐷 and proxy verification key 𝐸, where 𝐷=𝑑₀^𝑚𝑤modΦ𝑁₀,𝐸=𝑒₀^𝑚𝑤modΦ𝑁₀, (16) where 𝑚_𝑤=(𝑃+𝑇+𝑟) mod Φ(𝑁₀).

𝑃 is the validity period of proxy signatures, 𝑇 is the sum of identities of 𝑃₀,𝑃₁,…,𝑃_𝑛, and 𝑟 is a random number.

Then 𝑃₀ publishes {𝑚_𝑤,𝐸,[𝑚_𝑤,𝐸]^𝑑0mod𝑁₀}.

(2) Proxy Sharing. 𝑃₀ selects a 𝑡−1 degree polynomial, 𝑓(𝑥)=𝐷+𝑎₁𝑥+⋯+𝑎_𝑡−1𝑥^𝑡−1modΦ𝑁₀, (17) where 𝑎₁, 𝑎₂,…,𝑎_𝑡−1 are random numbers. Meanwhile, 𝑃₀ calculates proxy signer 𝑃_𝑖’s partial proxy signing key 𝑘_𝑖=𝑓(𝑖) and sends [[𝑘_𝑖]^𝑑0mod𝑁₀,𝑘_𝑖]^𝑒𝑖 mod 𝑁_𝑖 to the proxy signer 𝑃_𝑖.

2.4.2. Proxy Share Generation

When proxy signer 𝑃_𝑖 receives [[𝑘_𝑖]^𝑑0mod𝑁₀,𝑘_𝑖]^𝑒𝑖 mod 𝑁_𝑖, he or she can get {[𝑘_𝑖]^𝑑0mod𝑁₀,𝑘_𝑖} by his or her secret key 𝑑_𝑖. And then 𝑃_𝑖 confirms the validity of 𝑘_𝑖 and keeps it secret.

(1) The Proxy Signature Issuing Phase. Let 𝑇 denote the group members including any 𝑡 or more proxy signers who want to generate a proxy signature on message 𝑀 on behalf of 𝑃₀ cooperatively. Each proxy signer 𝑃_𝑖 uses the partial proxy signing key 𝑘_𝑖 to generate the partial signature 𝑠_𝑖=𝑀^𝑘𝑖mod𝑁₀. (18) Then 𝑃_𝑖 sends {[𝑠_𝑖,𝑖]^𝑑𝑖mod𝑁_𝑖,𝑠_𝑖} to the combiner.

When the combiner receives all partial signature 𝑠_𝑖 from 𝑃_𝑖, firstly, he or she verifies the validity of the partial proxy signature by checking if [𝑠_𝑖,𝑖]^{𝑑𝑖⋅𝑒𝑖}mod𝑁_𝑖=(𝑠_𝑖,𝑖) or not. If all partial signatures are valid, the combiner computes the value of 𝑣=_{𝐼𝐷𝑎,𝐼𝐷𝑏∈𝑇𝑎>𝑏}𝐼𝐷_𝑎−𝐼𝐷_𝑏,𝑣𝐿𝑖=_{𝐼𝐷𝑎,𝐼𝐷𝑏∈𝑇𝑎>𝑏}𝐼𝐷_𝑎−𝐼𝐷_𝑏^𝑡_{𝑗=1,𝑗≠𝑖}−𝐼𝐷_𝑗𝐼𝐷_𝑖−𝐼𝐷_𝑗. (19) Here, _{𝑗=1,𝑗≠𝑖}𝐼𝐷_𝑖−𝐼𝐷_𝑗isafactorof^𝑡_{𝐼𝐷𝑎,𝐼𝐷𝑏∈𝑇𝑎>𝑏}𝐼𝐷_𝑎−𝐼𝐷_𝑏. (20)

So 𝑣𝐿𝑖 is an integer and the combiner need not compute the inverse of ^𝑡_{𝑗=1,𝑗≠𝑖}𝐼𝐷_𝑖−𝐼𝐷_𝑗. (21)

Finally, the combiner generates the signature 𝑆 as follows: 𝑆=_𝑖∈𝑇𝑠_𝑖^𝑣𝐿𝑖mod𝑁₀. (22)

The result of proxy signature is {𝑣,𝑆}.

2.4.3. The Proxy Signature Verification Phase

The verifier can verify the signature signed on behalf of the original signer by the following equation: 𝑆^𝐸=𝑀^𝑣mod𝑁₀. (23)

The original signer can differentiate the actual signer from the signature 𝑠_𝑖^{𝑑𝑖𝑒𝑖}mod𝑁_𝑖=𝑠_𝑖. Then the original signer can trace the actual signers by 𝑒_𝑖.

2.5. Conclusions from the Threshold Proxy Signature Schemes

All analyses indicated that the scheme fails to satisfy all the requirements except one or two. So, an enhanced threshold proxy signature scheme must satisfy all of the following basic requirements which can be called proxy requirements [7, 9–11].

(1) Secrecy. The original signer’s private key is very important. It must be kept secret. If it is discovered, the security of the system is ruined. Therefore, the system must ensure that the private key never gets derived from any information such as the sharing of the proxy signing key or the original signer’s public key. Furthermore, no proxy signers should be able to cooperatively derive the original signer’s private key.

(2) Proxy Protected. Only a delegated proxy signer can generate his partial proxy signature. Even the original signer cannot masquerade as a proxy signer to generate a partial proxy signature. This property protects the authority of the proxy signer.

(3) Unforgeability. A valid proxy signature can only be cooperatively generated by 𝑡 or more proxy signers. Nondelegated signers have no capability to generate a valid proxy signature. Also, (𝑡−1) or less proxy signers have no capability of forging a valid proxy signature.

(4) Nonrepudiation. Any valid proxy signature must be generated by 𝑡 or more proxy signers. The verifier can make sure that the signed message is a correct one by using the proxy signing keys. The original signer cannot deny having delegated the power of signing messages to the proxy signers. Furthermore, the proxy signers cannot deny that they have signed the message.

(5) Time Constraint. The proxy signing keys can be used only during a stipulated period. Once expired, proxy signing keys become invalid; as a result, the signing capability of the proxy signers disappears. However, the original signer’s private key can be repeatedly used. This is more suitable for use in the real world.

(6) Known Signers. For internal auditing purposes, the system is able to identify the actual signers in the original signer’s private key. The proxy signer has the capability to sign on the behalf of the original signer, but from the proxy signing key, the proxy signer cannot recover the original signer’s private key.

3. Our Scheme

The concept of threshold cryptosystems was first proposed by Katzenbeisser [28]. They adapted the ElGamal [3] public key cryptosystem and used the Lagrange interpolation or geometry to produce the shadows. In the history of proxy signature technological development, the (1,𝑛) threshold proxy signature technique was the first to come [7]. In (1,𝑛) proxy signature schemes [12, 14, 29], a legal proxy signature can be generated by a designated proxy signer by using a proxy signing key. However, in a (𝑡,𝑛) threshold proxy signature scheme, the original signer delegates the power of signing messages to a designated proxy group of 𝑛 members. Any 𝑡 or more proxy signers of the group can cooperatively issue a proxy signature on the behalf of the original signer, but (𝑡−1) or fewer proxy signers cannot. Previously, all of the proposed threshold proxy signature schemes, for instance, Lee et al. [30], ElGamal [2], Sun [13], and Mambo et al. [12], have been based on the discrete logarithm problem. However, the recently proposed threshold proxy signature schemes are based on the RSA cryptosystem [1] and the Lagrange coefficient. In 2003, Hwang et al. [7] proposed a practical and efficient (𝑡,𝑛) threshold proxy signature scheme based on the RSA cryptosystem. This scheme uses only an RSA digit signature scheme and a simple Lagrange formula to share the proxy signature key. In 2004, Wang et al. [8] pointed out a problem on the correctness of the HLL scheme. In 2005, Kuo and Chen [9] also indicated two security weaknesses in the HLL scheme and proposed a new scheme to overcome these weaknesses.

We compare the performance of four schemes, Hwang et al. [7], Kuo and Chen [9], Yong-Jun et al. [11], and Li et al. [10], with the performance of a scheme that has been proposed by the authors of this paper earlier and proposed an enhanced secure threshold proxy signature scheme. In the proposed scheme, both the combiner and the secret share holder can verify the correctness of the information that they are receiving from each other. Therefore, the enhanced threshold proxy signature scheme is secure and efficient against notorious conspiracy attacks. Table 2 gives the comparison of threshold proxy signature schemes based on the proxy requirements of each scheme.

Table 2 

A comparison of threshold proxy signature schemes based on proxy requirements.

4. Security Analysis of the Proposed Scheme

4.1. Factorization of the RSA Module

Factoring 𝑛: the fastest known factoring algorithm developed by Pollard is the General Number Field Sieve [1], which has running time for factoring a large number of size 𝑛, of order 𝑂exp649log𝑛^1/3loglog𝑛^2/3. (24) The method relies upon the observation that if integers 𝑥 and 𝑦 are, such that 𝑥≠𝑦 (mod 𝑛) and 𝑥²=𝑦²(mod𝑛), then gcd(𝑥−𝑦,𝑛) and gcd(𝑥+𝑦,𝑛) are nontrivial factors of 𝑛.

Tables 3(a) and 3(b) give the number of operations needed to factor 𝑛 with the GNFS method and the time required if each operation uses one microsecond, for various lengths of the number 𝑛 (in decimal digits).

Table 3 

(a) The number of operations needed to factor 𝑛 with GNFS method. (b) Computing 𝜙(𝑛) without Factoring “𝑛.”

Computing 𝜙(𝑛) without factoring “𝑛”:

assume that 𝑛=𝑝×𝑞, 𝑝<𝑞,

since (𝑞+𝑝)²−(𝑞−𝑝)²=4𝑝𝑞=4𝑛,

then (𝑞+𝑝)²=4𝑛+(𝑞−𝑝)² so 𝑞+𝑝=4𝑛+(𝑞−𝑝)²;

guess 𝑞−𝑝 and then find 𝑞+𝑝, so 𝜑(𝑛)=𝑛−(𝑝+𝑞)+1.

Example 1. Suppose 𝑛=221(4𝑛=884).
So, 𝑞−𝑝=4 and 𝑞+𝑝=30; then 𝜑(𝑛)=221−30+1=192 and 𝑝=13, 𝑞=17, 𝑛=13×17.

4.2. Lattices and Lattice Reduction of RSA Module

4.2.1. Lattice-Based Attacks on RSA

The following attacks have been tested for RSA modules:(i)Hastad’s attack;(ii)Franklin-Reiter attack;(iii)extension to Wiener’s attack.

4.2.2. Lattices and Lattice Reduction

Given a set of 𝑚 linearly independent vectors, {𝑏₁,…,𝑏_𝑚} in 𝑅^𝑛, the set of all real linear combinations of these vectors 𝑉={∑^𝑚_𝑖=1𝑎_𝑖𝑏_𝑖∶𝑎_𝑖∈𝑅} is a vector subspace.

Gram-Schmidt process [28] takes one basis {𝑏₁,…,𝑏_𝑚} and produces a basis {𝑏^∗₁,…,𝑏^∗_𝑚} which is pairwise orthogonal: 𝑏^∗₁=𝑏₁,𝜇_𝑖,𝑗=𝑏_𝑖,𝑏^∗_𝑗𝑏^∗_𝑗,𝑏^∗_𝑗𝑏,for1≤𝑗<𝑖≤𝑛,_∗𝑖=𝑏_𝑖−^𝑖−1_𝑗=1𝜇_𝑖,𝑗𝑏^∗_𝑗. (25)

Example 2. Consider 𝑏₁=20,𝑏₂=11,𝑏^∗₁=𝑏₁=20,𝜇_2,1=𝑏₂,𝑏^∗₁𝑏^∗₁,𝑏^∗₁=12,𝑏^∗₂=𝑏₂−𝜇_2,1=01. (26) Given a set of basis vectors {𝑏₁,…,𝑏_𝑚} in 𝑅_𝑛 and 𝑚≤𝑛, a lattice 𝐿={∑^𝑚_𝑖=1𝑎_𝑖𝑏_𝑖∶𝑎_𝑖∈𝑍} is a set of all integer linear combinations of the 𝑏_𝑖.

Definition 3. A basis {𝑏₁,…,𝑏_𝑚} is called LLL reduced if the associated Gram-Schmidt basis {𝑏^∗₁,…,𝑏^∗_𝑚} satisfies 𝜇_𝑖,𝑗≤12𝑏for1≤𝑗<𝑖≤𝑚,_∗12≥34−𝜇²_{𝑖,𝑖−1}𝑏^∗_𝑖−1²for1<𝑖≤𝑚. (27)
For all nonzero, ‖𝑏₁‖≤2^(𝑚−1)/2‖𝑥‖, we have 𝑏₁≤2^𝑚/4Δ^1/𝑚,Δ=det𝐵^𝑇𝐵^1/2. (28)

4.2.3. Security Levels of the RSA Module on Different Platforms

The following are the creation of key in seconds for different security levels which can be used for encryption and decryption.

The fields in Tables 4(a) and 4(b) have been generated by varying the values of security levels for both the Pentium and AlphaStation, respectively. It shows the various parameters generated for different security levels.

Table 4 

(a) Security levels of the RSA module on a 90 MHz Pentium platform. (b) Security levels of the RSA module on a 255 MHz digital AlphaStation.

4.2.4. A General Coalition Attack against Threshold Signature Schemes

Though our modification can withstand the forgery attack suffered by the said to be [7, 9–11] threshold group signature scheme, there is a general coalition attack against threshold signature schemes. In the ordinary threshold signature scheme, the group’s secret key is 𝑓(0), and each member 𝑈_𝑖 has the secret share 𝑓(𝑥_𝑖). If 𝑡 or more malicious members pool their secret shares together, they can recover 𝑓(0) by applying the Lagrange interpolating polynomial. Then each one of them can alone compute valid signatures for new messages on behalf of the group afterwards without the cooperation of other signers and without being detected by verifiers. Obviously, this violates the group’s signing policy. Otherwise, if such coalition is permissive, other signers would follow this kind of dishonesty. Thus, each user can also alone compute valid group signatures after one coalition. It is terrible for threshold signature schemes. This coalition attack is inherent in many threshold signature schemes using threshold secret share scheme, as long as the secret key can be recovered from secret shares.

4.2.5. The Probability of Catching a User

The probability of catching a user in enhanced threshold proxy signature scheme depends on the number of identity pairs used in it. The more the pairs used, the greater the chance of catching the anonymous user. The probability of catching the anonymous user is 11−2^𝑛, (29) where 𝑛 is the number of pairs used.

For example, if 𝑛=5, then the chance of catching a user is 0.97.

4.2.6. An Algorithm to Check Primality of Any General Number Given

The algorithm is as follows.

Input: integer 𝑛>1.(1)If 𝑛=𝑎^𝑏 for integers 𝑎>0 and 𝑏>1, output composite.(2)Find the smallest r such that 𝑜_𝑟(𝑛)>log²(𝑛).(3)If 1<gcd(𝑎,𝑛)<𝑛 for some 𝑎≤𝑟, output composite.(4)If 𝑛≤𝑟, output prime. For 𝑎=1 to ⌊𝜑(𝑟)log(𝑛)⌋ do if (𝑋+𝑎)^𝑛≠𝑋^𝑛+𝑎(mod𝑋^𝑟−1,𝑛), output composite.(6)Output prime.

Here 𝑜_𝑟(𝑛) is the multiplicative order of 𝑛 modulo 𝑟, log is the binary logarithm, and 𝜑(𝑟) is Euler’s totient function of 𝑟.

If 𝑛 is a prime number, the algorithm will always return prime: since 𝑛 is prime, Steps 1 and 3 will never return composite. Step 5 will also never return composite because Step 2 is true for all prime numbers 𝑛. Therefore, the algorithm will return prime either in Step 4 or in Step 6.

Conversely, if 𝑛 is composite, the algorithm will always return composite: if the algorithm returns prime, then this will occur in either Step 4 or Step 6. In the first case, since 𝑛≤𝑟, 𝑛 has a factor 𝑎≤𝑟 such that 1<gcd(𝑎,𝑛)<𝑛, which will return composite. The remaining possibility is that the algorithm returns prime in Step 6. The authors’ paper proves that this will not happen because the multiple equalities tested in Step 5 are sufficient to guarantee that the output is composite [31].

4.2.7. An Algorithm to Determine If a Number Is a Probable Prime

The Fermat primality test is a probabilistic test to determine if a number is a probable prime. The algorithm is as follows. Inputs: 𝑛: a value to test for primality; 𝑘: a parameter that determines the number of times to test for primality Output: composite if 𝑛 is composite, otherwise probably prime

repeat 𝑘 times: pick 𝑎 randomly in the range [1,𝑛−1] if 𝑎^𝑛−1≢1 (mod 𝑛), then return composite

Return Probably Prime. Using fast algorithms for modular exponentiation, the running time of this algorithm is 𝑂(𝑘×log²𝑛×loglog𝑛×logloglog𝑛), where 𝑘 is the number of times we test a random 𝑎 and 𝑛 is the value we want to test for primality [32].

4.2.8. The Commonly Supported and Used Algorithms in Protocol

Here are some of the more commonly supported and used algorithms in protocol (see Table 5).

Table 5 

The commonly supported and used algorithms used in protocol.

5. Performance Analysis of the Proposed Scheme

The analysis reports of the proposed hypothesis for enhanced threshold proxy signature scheme are given as the following.

5.1. Entropy

In this case, the value of entropy is the measure of the tendency of a process, to be entropically favored or to proceed in a particular direction. Moreover, entropy provides an indication for a specific encryption method. We have analyzed our hypothesis on the basis of entropy generated.

Figure 1 shows that entropy for enhanced threshold proxy signature scheme. Figure 2 shows the compression ratio required in each scheme. Table 6 lists the name and compression ratio required in each scheme.

Table 6 

Compression ratio (in %) for threshold proxy signature schemes.

Figure 1 

Entropy for the enhanced threshold proxy signature scheme.

Figure 2 

Radar chart showing compression ratio required in each scheme.

5.2. Floating Frequencies/Intuitive Synthesis

Floating frequencies/intuitive synthesis in its completed three parts entirety takes full advantage of the time complexity, space complexity, and communication overhead provided by the digital medium. We have calculated floating frequency of the threshold proxy signature scheme. Figure 3 shows that floating frequencies/intuitive synthesis for the enhanced threshold proxy signature scheme.

Figure 3 

Floating frequencies/intuitive synthesis for the enhanced threshold proxy signature scheme.

5.3. ASCII Histogram

The ASCII histogram proved to be very useful since it helped enormously in debugging code involving probability calculations with simple print statements. Probabilistic simulations are extremely hard to test because the results of a given operation are never strictly the same. However, they should have the same probability distribution, so by looking at the rough shape of the histogram, it tells you if your calculations are going in the right direction. In this context, we have calculated ASCII histogram for our threshold proxy signature scheme. Figure 4 shows that ASCII Histogram for enhanced threshold proxy signature.

Figure 4 

ASCII histogram for enhanced threshold proxy signature scheme.

5.4. Autocorrelation

This is mathematical representation of the degree of similarity between a given time series and a lagged version of itself over successive time intervals. It is the same a calculating the correlation between two different time series, except that the same time series is used twice—once in its original form and once lagged one or more time periods. The term can also be referred to as “lagged correlation” or “serial correlation”. In this, we have calculated autocorrelation for threshold proxy signature scheme. Figure 5 shows the Autocorrelation for the enhanced threshold proxy signature scheme.

Figure 5 

Autocorrelation for enhanced threshold proxy signature scheme.

5.5. Histogram Analysis

A histogram is a graphical representation showing a visual impression of the distribution of data. We have analyzed histogram of for all threshold proxy signature schemes.

Detailed View. The detailed view of the histogram analysis of all schemes can be represented as follows.

Experiment 1. Histogram analysis of ⟨1HLL⟩. File size 12581 bytes. Descending sorted on frequency.

Figure 6 shows that radar chart showing histogram analysis for HLL threshold proxy signature scheme. Table 7 lists the histogram analysis for the HLL threshold proxy signature scheme.

Table 7 

Histogram analysis for the HLL threshold proxy signature scheme.

Figure 6 

Radar chart showing histogram analysis for the HLL threshold proxy signature scheme.

Experiment 2. Histogram analysis of ⟨2KUOCHEN⟩. File size 11733 bytes. Descending sorted on frequency.

Figure 7 shows that radar chart showing histogram Analysis for KUOCHEN threshold proxy signature scheme. Table 8 lists the histogram analysis for the KUOCHEN threshold proxy signature scheme.

Table 8 

Histogram analysis for the KUOCHEN threshold proxy signature schemes.

Figure 7 

Radar chart showing histogram analysis for the KUOCHEN threshold proxy signature scheme.

Experiment 3. Histogram Analysis of ⟨3GENGVRF⟩. File size 11259 bytes. Descending sorted on frequency.

Figure 8 shows that radar chart showing histogram analysis for the GENGVRF threshold proxy signature scheme. Table 9 lists the histogram analysis for the GENGVRF threshold proxy signature scheme.

Table 9 

Histogram analysis for the GENGVRF threshold proxy signature schemes.

Figure 8 

Radar chart showing histogram analysis for the GENGVRF threshold proxy signature scheme.

Experiment 4. Histogram ANALYSIS of ⟨4FNGVERF⟩. File size 12067 bytes. Descending sorted on frequency.

Figure 9 shows that radar chart showing histogram analysis for the FNGVRF threshold proxy signature scheme. Table 10 lists the histogram analysis for the FNGVRF threshold proxy signature scheme.

Table 10 

Histogram analysis for the FNGVERF threshold proxy signature schemes.

Figure 9 

Radar chart showing histogram analysis for the FNGVRF threshold proxy signature scheme.

Experiment 5. Histogram analysis of ⟨5THRSPROX⟩. File size 16897 bytes. Descending sorted on frequency.
Figure 10 shows that Radar Chart showing histogram analysis for the enhanced threshold proxy signature scheme. Table 11 lists the histogram analysis for enhanced threshold proxy signature scheme.
Figure 11 shows that radar chart showing overall histogram analysis for all threshold proxy signature schemes. Table 17 lists the histogram analysis for the overall threshold proxy signature schemes.

Table 11 

Histogram analysis for the enhanced threshold proxy signature schemes.

Figure 10 

Radar chart showing histogram analysis for the enhanced threshold proxy signature scheme.

Figure 11 

Radar chart showing overall analysis for all threshold proxy signature schemes.

5.6. Collusion Attack

The collusion attack is an action carried out by a given set of malicious users in possession of a copy of protected content that join together in order to obtain at the end of the attack procedure an unprotected asset. The attack is carried out by properly combining the protected copies of the multimedia documents collected by the colluders, according to the type of content and the kind of adopted protection system.

When the protection is assured by a data hiding algorithm, the collusion usually can take place in one of two different application frameworks: multimedia fingerprinting and ownership verification. In multimedia fingerprinting, a content owner, to protect his/her copyright, embeds a different code into each copy of the content distributed to each customer in order to be able to trace possible illegal usage of data and discover the source of the leakage of information; in this case, then, each colluder possesses a slightly different copy of the same multimedia content, and the attack consists in averaging all documents they have, trying to produce a new document in which the watermark is no longer present. If the number of averaged documents is large enough, the attack is very effective even without the introduction of perceptually significant degradation between the averaged multimedia document and the original one. In ownership verification, a content owner, to demonstrate that he/she is the authorized holder of the distributed content, embeds always the same code, linked to his/her identity, into different watermarked documents before they are distributed to the customers in such a way that the hidden code can be used to prove ownership in court if someone will infringe on his/her copyrights; in this case, then, each colluder possesses different multimedia documents, with the same hidden code, so that the attack is carried out by estimating the watermark by means of an average of all the different contents they have (this approach is suitable only for data-hiding systems in which the hidden watermark does not depend on the host data). Then the estimated watermark can be removed from all the documents hiding in it or even falsely inserted in other ones to generate fake watermarked documents [33].

One advantage of enhanced threshold proxy signature schemes is that they can prevent a “collusion attack” in which two key generation servers communicate with each other to get useful information about the user’s private key. In essence, Figure 19 shows the overall communication architecture for the secure threshold proxy signature scheme based on RSA cryptosystem for known signers.

5.7. Security of RSA Signature

 Existential forgery using a key-only attack: Choose a random 𝑦 Compute 𝑥=𝑒_𝑘(𝑦) We have 𝑦=sig_𝑘(𝑥), a valid signature of 𝑥. Existential forgery using a known message attack: Suppose 𝑦=sig_𝑘(𝑥) and 𝑦^′=sig_𝑘(𝑥^′) Can check 𝑒_𝑘(𝑦𝑦^′mod𝑛)=𝑥𝑥^′mod𝑛 So 𝑦𝑦^′mod𝑛=sig_𝑘(𝑥𝑥^′mod𝑛). Existential forgery using a chosen message attack: To get a signature for 𝑥, find 𝑥₁𝑥₂=𝑥mod𝑛 Query for signatures of 𝑥₁ and 𝑥₂.

5.8. Forgery Attack

RSA function is a multiplicative homomorphism; for all 𝑥, 𝑦, 𝑓(𝑥)𝑓𝑦𝑓𝑥𝑦mod𝑛=𝑓mod𝑛,₋₁𝑥𝑦mod𝑛=𝑓⁻¹(𝑥)𝑓⁻¹𝑦mod𝑛. (30) More generally, 𝑓⁻¹𝑥_𝑖mod𝑛=𝑓⁻¹𝑥_𝑖mod𝑛. (31) The property not only is exploited in most forgery attacks on RSA signatures, but also enhances recent security proofs.

5.9. Friedman Test

The Friedman test is a nonparametric statistical test developed by the US economist Milton Friedman. Similar to the parametric repeated measures ANOVA, it is used to detect differences in treatments across multiple test attempts. The procedure involves ranking each row (or block) together, then considering the values of ranks by columns. Applicable to complete block designs, it is thus a special case of the Durbin test. The Friedman test is used for one-way repeated measures analysis of variance by ranks. In its use of ranks, it is similar to the Kruskal-Wallis one-way analysis of variance by ranks. We have tested our hypothesis against the Friedman test [31].

Figure 12 shows the chart showing Friedman test for all threshold proxy signature schemes.

Figure 12 

Chart showing Friedman test for all threshold proxy signature schemes.

6. Implementation and Comparison of the Proposed Scheme

The implementation of the schemes has been done.

6.1. Time Complexity

When determining the time complexity of an algorithm, we measure how fast the computing requirements grow as the size of the input grows.

6.1.1. Readings

Readings are taken for two scenarios described below. Each reading shown in Table 11 is the average of 30 readings.

Scenario 1: when number of threshold signers, 𝑡=1.

Scenario 2: when number of threshold signers, 𝑡=𝑛.

Table 12 shows the readings of execution time (in microseconds) when the number of threshold signers is equal to 11 and Table 13 shows the readings of execution time (in microseconds) and when the number of threshold signers is equal to number of proxy signers.

Table 12 

Variation of time with number of signers for scenario 1 (𝑡=1).

Table 13 

Variation of time with number of signers for scenario 2 (𝑡=𝑛).

6.1.2. Graphs

We plot the graphs with the following:(1)execution time (in microseconds) on 𝑌-axis, (2)number of proxy signers (𝑁) on 𝑋-axis.

Scenario 1: when number of threshold signers, 𝑡=1.

Scenario 2: when number of threshold signers, 𝑡=𝑛.

6.1.3. Results

Figures 13(a), 13(b), 14(a), and 14(b) show that for both scenarios, Geng et al. scheme has the maximum time complexity and the proposed scheme has the minimum time complexity; also Fengying et al.’s time complexity falls very near the proposed scheme. We find that the proposed and Fengying et al.’s schemes have minimum time complexities. The time complexity of HLL scheme is more in case of scenario 1 (for 𝑡=1) but less in case of scenario (𝑡=𝑛). This is because it has an extra constant overhead to verify the validity of the stipulated period. As this overhead is constant, hence, for scenario 1, HLL scheme has more time complexity as compared to other schemes. The proposed scheme has less time complexity as compared to other schemes because it need not compute the inverse when we compute the value of Lagrange coefficient (Figure 15), which makes the scheme more efficient [11]. Also, we do not verify message warrant, which saves the extra overhead, that was incurred in case of KC scheme.

(a)

(b)

Figure 13 

(a) Comparison of schemes based on time complexity when 𝑡=1. (b) Three-dimensional view for comparison of schemes based on time complexity when 𝑡=1.

(a)

(b)

Figure 14 

(a) comparison of schemes based on time complexity when 𝑡=𝑛. (b) Three-dimensional view for comparison of schemes based on time complexity when 𝑡=𝑛.

Figure 15 

Comparison of schemes based on time complexity when 𝑡=1 and 𝑛.

Figures 13(a), 13(b), 14(a), and 14(b) show that for both scenarios, the execution time increases with the increase in the number of proxy signers. This is because as the number of proxy signers increases, the number of computations also increases, due to, which the execution time increases. The number of computations increases because for each proxy signers, following parameters have to be computed.(1)RSA modulus, 𝑁_𝑖.(2)Private key, 𝑑_𝑖.(3)Public key, 𝑒_𝑖.(4)𝑝_𝑖 and 𝑞_𝑖. (5)Φ(𝑁_𝑖).(6)𝐾_𝑖.

The more the number of proxy signers, the more the computations. The graphs generated also confirm this point. Also, we observe that in the graphs in Figures 14(a) and 14(b) the execution time is more in case of 𝑡=𝑛 than in case of 𝑡=1. It is because the number of computations increases with the number of threshold signers as well. For each threshold signer, the following computations have to done.(1)Partial proxy signatures, 𝑠_𝑖.(2)The Lagrange coefficient, 𝐿_𝑖.

The more the number of threshold proxy signers, the more the computations as confirmed by the graphs generated.

Scenario 3: when number of threshold signers, 𝑡=1 and 𝑛.

Table 14 shows the readings of execution time (in microseconds) when the number of threshold signers is equal to 1 and is equal to number of proxy signers, where number of Signers 𝑁=15, days = 80, and threshold number of Signers 𝑁=15.

Table 14 

Variation of time with number of signers for scenario 3.

Scenario 3:  when number of threshold signers, 𝑡=1 and 𝑛.

6.2. Space Complexity

The space complexity of a program is the number of elementary objects that this program needs to store during its execution. We generate graphs to analyze the space complexity of the schemes.

6.2.1. Estimation Based on Number of Variables

Table 14 lists the name and number of variables required in each scheme. Beside the variables shown in Table 14, a character string is required to store the message 𝑀 which has to be signed.

6.2.2. Graphs

We plot the graphs with the following:(1)memory overhead (in terms of number of variables) on 𝑦-axis,(2)Number of proxy signers (𝑁) on 𝑥-axis.

The graphs have been shown in Figures 16 and 17.

Figure 16 

Comparison of schemes based on space complexity when 𝑡=1.

Figure 17 

Comparison of schemes based on space complexity when 𝑡=𝑛.

6.2.3. Results

Figures 16 and 17 have been generated by varying the values of 𝑛 for both scenarios in Table 15, which shows the memory overhead in terms of memory variables required for each scheme. In Figures 16 and 17, we see that for both scenarios, the proposed scheme has the maximum space complexity and the HLL scheme has the minimum space complexity. The complexity of KC, Geng et al., and Fengying et al. scheme falls between the two schemes’ space complexity with KC and Fengying et al. schemes having the same space complexity. We note that in Table 4, the proposed scheme requires only (𝑛+3) more variables than the HLL scheme, which has the minimum space complexity. For example, the proposed scheme requires only 4 extra variables than the HLL scheme for 𝑁=1, which has the minimum space complexity, and for 𝑁=𝑛, the proposed scheme requires only 13 more variables than the HLL scheme. Also, this difference can be easily accommodated with the development of very large storage devices. Hence, we can see that the space complexities of the schemes are almost equal and the performance of the schemes in the case of the space complexity is almost the same.

Table 15 

Space Requirements of the Schemes.

Scenario 1: when number of threshold signers, 𝑡=1.

Scenario 2: when number of threshold signers, 𝑡=𝑛.

Figures 16 and 17 also show that for both the scenarios, the space complexity increases with the increase in the number of proxy signers. This is because as the number of proxy signers increases, the number of variables also increases due to which the memory requirements increase. Memory overhead increases because for each proxy signers, the following parameters are required.(1)RSA modulus, 𝑁_𝑖.(2)Private key, 𝑑_𝑖.(3)Public key, 𝑒_𝑖.(4)𝑝_𝑖 and 𝑞_𝑖. (5)Φ(𝑁_𝑖).(6)𝐾_𝑖.

The more the number of proxy signers, the more the memory requirements. The figures generated also confirm this point.

Also, we observe in the graphs that memory overhead is more in the case of 𝑡=𝑛 than in the case of 𝑡=1. It is because the number of variables increases with the number of threshold signers as well. For each threshold signer, the following variables have to be declared.(1)Partial proxy signatures, 𝑠_𝑖.(2)The Lagrange coefficient, 𝐿_𝑖.

The more the number of threshold proxy signers, the more the memory requirements as confirmed by the graphs generated.

6.3. Communication Overhead

The communication overhead includes two types of communication in the schemes:(1)number of transmissions;(2)number of broadcasts.

6.3.1. Comparison of the Schemes

Table 6 shows the communication overhead for each scheme for various phases. In Figure 6, we find that the communication overhead of all the schemes is the same.

6.3.2. Results

Figure 18 has been generated from Table 15, which can be referred to to find the number of transmissions and broadcasts to compute the communication overhead for all the schemes. Table 16 can be referred to to find the comparison between threshold proxy signature schemes based upon proxy requirements. As evident from Figure 18, the communication overhead of all the schemes is the same.

Table 16 

Comparison of communication overheads of the threshold proxy signature schemes.

Table 17 

Figure 18 

Comparison of schemes based on communication overhead.

Figure 19 

Overall communication architecture for secure threshold proxy signature scheme based on RSA cryptosystem.

Figure 19 shows the overall communication architecture for the secure threshold proxy signature scheme based on RSA cryptosystem for known signers. It sends a message after logging in to the system. It also sends a message to the other client using the secure threshold proxy signature scheme based on the RSA cryptosystem for known signers. In this, the delegates can send the message to the n proxy signers with security. After sending the message, it logs out from the system. We have improved the results after improving the performance of four schemes: Hwang et al. [7], Kuo and Chen [9], Yong-Jun et al. [11], and Li et al. [10], with the performance of a scheme that has been proposed by the authors of this paper earlier. In this paper, we compared the various threshold proxy signature schemes based on how they violate proxy signature requirements. Table 16 summarizes the comparison of four threshold proxy signature schemes: Kim et al.’s scheme, Sun’s scheme, HLL scheme, and Wen et al.’s scheme. We also propose a new scheme which includes the features and benefits of the two schemes: Fengying et al. and Geng et al. The main advantages of our proposed scheme are as follows.(i)It achieved the property of nonrepudiation.(ii)Anyone cannot forge the legal proxy signature.(iii)The verifier can identify the actual proxy signer of its group.(iv)It also provides more refined result against its time complexity, space complexity, and communication overhead. (v)The proposed scheme is secure and efficient against notorious conspiracy attacks.

7. Conclusion

As the proxy signature is the solution to the delegation of signing capabilities in any electronic environment, in this paper, various threshold proxy signature schemes have been compared based on whether they fulfill the proxy signature requirements or not and proposed an enhanced secure threshold proxy signature scheme. Some of these schemes are based on an RSA cryptosystem for known signers, as the RSA cryptosystem is a popular security technique. In this, we also propose a new scheme which includes the features and benefits of the two schemes: Fengying et al. and Geng et al. The implementation of the encryption and decryption functions justifies the real-life applicability of the proposed scheme. In this, we have analyzed our enhanced threshold proxy signature scheme for various parameters. In essence, the results show that the enhanced threshold proxy signature scheme is an efficient one and it can provide great capabilities for various applications.

Acknowledgment

The authors wish to thank many anonymous referees for their suggestions to improve this paper.