On Delegatability of Some Strong Designated Verifier Signature Schemes

Abstract

A strong designated verifier signature scheme makes it possible for a signer to convince a designated verifier that she has signed a message in such a way that the designated verifier cannot transfer the signature to a third party, and no third party can even verify the validity of a designated verifier signature. In 2005, Lipmaa, Wang, and Bao identified a new essential security property, non delegatability, of designated verifier signature schemes. Briefly, in a non delegatability designated verifier signature scheme, neither a signer nor a designated verifier can delegate the signing rights to any third party without revealing their secret keys. However, this paper shows that four recently proposed strong designated verifier signature schemes are delegatable. These schemes do not satisfy non delegatability secure requirement of strong designated verifier signature schemes.

1. Introduction

Ensuring the integrity and the authenticity of the origin of a message is one of the goals of cryptography, and standard authentication tools are digital signatures. Digital signature schemes allow a receiver of a signature, Bob, to verify that the signature received is indeed sent by the sender, Alice. And Bob can convince any third party that Alice has indeed sent him the message. This is also referred to as nonrepudiation in the sense that Alice cannot deny the fact that she has sent a signature to Bob. Nonrepudiation is a very useful property for the authenticity of the origin of a message when dispute could occur at some later time. On the other hand, in numerous applications such as tender, electronic voting, or electronic auctions, the public verification and nonrepudiation properties of a signature are not desired. Let us consider the following example [1].

Suppose that a public institution initiates a call for tenders, asking some companies to propose their prices for a set of instruments and tasks to be accomplished. The institution may require the companies to sign their offers in order to make sure that they are actually authentic and originated from whom they claim to be. This is a valid requirement, but no company involved in this process desires its offer to affect other tenders’ decisions. That is, a company may capture a competitor’s signed offer on the transmission line (to the institution) and prepares its offer consequently in order to increase its chance to be selected by the institution. The here raised question is about the conflict between authenticity and privacy.

To satisfy the above requirements in signature schemes, Jakobsson et al. [2] firstly proposed the concept of strong designated verifier signatures (SDVS). A SDVS scheme is special type of digital signature which provides message authentication without nonrepudiation. In a SDVS scheme, suppose Alice, the signer, has sent a signature to Bob, the designated verifier. Bob can use his private key to verify the validity of the signature. But Bob cannot prove to a third party that Alice has created the signature. Since Bob can efficiently simulate signatures that are indistinguishable from Alice’s signature. The SDVS fit into various cryptographic applications such as privacy preserving cloud computing [3] and social networks [4]. They also are useful in some new fields, such as cognitive computing [5], where a brainy robot needs to authenticate its owner and keeps no evidences of its owner’s authentication.

After Saeednia et al. [1] formalized the notion of SDVS in 2003, many SDVS schemes have been proposed [6–18]. Based on nondelegatability proposed by Lipmaa, Wang, and Bao in 2005, an essential security property of designated verifier signature schemes, Huang et al. [14] proposed a security model for SDVS scheme. The model is stricter than the previous one [11]. All schemes [6–13] are insecure in Huang et al.’s model. In a nondelegatability designated verifier signature scheme, neither a signer nor a designated verifier can delegate the signing rights to any third party without revealing their secret keys. Recently, four strong designated verifier signature schemes are proposed [15–18]. However, in this work, we show that the four schemes are delegatable. So, they are insecure.

The remainder of this paper is organized as follows. Some basic concepts are introduced in Section 2. In Section 3, we review four designated verifier signature schemes and present delegation attacks on them. Finally, Section 4 concludes the paper.

2. Preliminaries

In this section, we briefly review the basic concepts of bilinear pairings and model of strong designated verifier signatures.

2.1. Basic Concepts on Bilinear Pairings

Let 𝐺₁ be a cyclic additive group and 𝐺₂ a cyclic multiplicative group of the same order 𝑞. An admissible bilinear pairing is a map 𝑒∶𝐺₁×𝐺₁→𝐺₂, which satisfies the following properties.(i)Bilinearity. One has   𝑒(𝑎𝑃,𝑏𝑄)=𝑒(𝑃,𝑄)^𝑎𝑏 for all 𝑃,𝑄∈𝐺₁, 𝑎,𝑏∈𝑍^∗_𝑞. This can also be stated as 𝑒(𝑃+𝑄,𝑅)=𝑒(𝑃,𝑅)𝑒(𝑄,𝑅) and 𝑒(𝑃,𝑄+𝑅)=𝑒(𝑃,𝑄)𝑒(𝑃,𝑅) for all 𝑃,𝑄,𝑅∈𝐺₁.(ii)Nondegeneracy. There exists 𝑃,𝑄∈𝐺₁, such that 𝑒(𝑃,𝑄)≠1.(iii)Computability. There is an efficient algorithm to compute 𝑒(𝑃,𝑄) for all 𝑃,𝑄∈𝐺₁.

2.2. Complexity Assumptions

Definition 1 (bilinear Diffie-Hellman (BDH) problem). Given randomly chosen 𝑃∈𝐺₁, as well as 𝑎𝑃,𝑏𝑃,𝑐𝑃 (for unknown randomly chosen 𝑎,𝑏,𝑐∈𝑍^∗_𝑞), compute 𝑒(𝑃,𝑃)^𝑎𝑏𝑐.

Definition 2 (BDH assumption). The BDH assumption (𝑡,𝜀) holds in the bilinear setting (𝐺,𝐺₂,𝑒,𝑞,𝑃), if there is no probabilistic polynomial-time adversary 𝐴 that runs in time at most 𝑡 and Pr[𝑎,𝑏,𝑐∈𝑍^∗_𝑞∶𝑒(𝑃,𝑃)^𝑎𝑏𝑐←𝐴(𝑎𝑃,𝑏𝑃,𝑐𝑃)]>𝜀.

2.3. Model of Strong Designated Verifier Signature Scheme

Here, we introduce the concept of strong designated verifier signature in identity-based setting. An identity-based strong designated verifier signature scheme (IDSDVS) consists of five algorithms (that may be randomized) as follows.(i)Parameter Generation (Setup) is an algorithm that accepts a security parameter 𝑘 and outputs a string consisting of system parameters and master key.(ii)Key Extraction (Extract) is an algorithm that accepts system parameters and master key and an arbitrary string ID∈{0,1}^∗ outputs a private key 𝑈_ID. Here ID is the user's identity and will be used as the user's public key.(iii)Signature Generation (Sign) is an algorithm that accepts system parameters, the signer's private key 𝑈_ID, a message 𝑚, and the designated verifier's public key ID_𝑉 and outputs the signature 𝛿 on the message 𝑚.(iv)Designated Verification (Ver) is an algorithm that accepts system parameters, the signer's identity ID_𝑆, a message 𝑚, the designated verifier's public key ID_𝑉, and private key 𝑢_𝑉 and the signature 𝛿 on the message 𝑚 outputs either accept or reject as the verification decision.(v)Transcript Simulation is the algorithm that the designated verifier runs to produce identically distributed transcripts which are indistinguishable from the signature produced by the signer.

The IDSDVS scheme should satisfy the following security properties.(i)Correctness. A properly formed IDSDVS must be accepted by the verifying algorithm.(ii)Nontransferability. We require an IDSDVS scheme to be nontransferable. The nontransferability property is ensured by a transcript simulation algorithm that can be performed by all designated verifiers to produce an indistinguishable signature from the one that should be produced by the signature holder.(iii)Unforgeability. It is computationally infeasible to construct a valid IDSDVS signature without the knowledge of the private key of either the signer or the designated verifier.(iv)Nondelegatability. It requires an adversary to “know” a secret key of a signer or a designated verifier if the adversary can produce a valid signature on a message.

3. Four Designated Verifier Signature Schemes and Attacks on Them

3.1. Lee et al.’s Scheme

Lee et al.’s scheme [16] can be described as follows.

Let 𝑝 and 𝑞 be two large primes such that 𝑞∣𝑝−1 and 𝑔 an element of 𝑍^∗_𝑝 of order 𝑞. The message to be signed is 𝑚∈𝑍_𝑝. Let signer Alice’s public key be 𝑦_𝐴=𝑔^𝑥𝐴mod𝑝, where 𝑥_𝐴∈𝑍^∗_𝑞 is her secret key, and designated verifier Bob’s public key be 𝑦_𝐵=𝑔^𝑥𝐵mod𝑝, where 𝑥_𝐵∈𝑍^∗_𝑞 is his secret key. One-way hash function 𝐻 outputs values in 𝑍_𝑞. Suppose that Alice wants to send a strong designated verifier signature (𝑡,𝑐,𝑟,𝑠) with a message 𝑚 to Bob.(i)Signature generation. Alice chooses two random numbers 𝑘₁ from 𝑍^∗_𝑞 and 𝑘₂ from 𝑍_𝑞 and generates a signature (𝑡,𝑐,𝑟,𝑠) as follows: 𝑡=𝑔^𝑘1mod𝑝,𝑐=𝑚𝑦^𝑘2_𝐵mod𝑝,𝑟=𝐻𝑚,𝑔^𝑘2,𝑠=𝑘₁⁻¹𝑥_𝐴𝑟−𝑘₂mod𝑞. (1)(ii)Message Recovery and Verification. Upon receiving (𝑡,𝑐,𝑟,𝑠) from Alice, Bob recovers the message and verifies the signature by computing 𝑚=𝑐𝑡^𝑠𝑦_𝐴^{−𝑟𝑥𝐵}𝑟mod𝑝,_?=𝐻𝑚,𝑦^𝑟_𝐴𝑡^−𝑠. (2)(iii)Transcript Simulation. Bob can simulate the designated verifier signature (𝑡,𝑐,𝑟,𝑠) of 𝑚. Bob selects two random values 𝑤₁∈𝑍^∗_𝑞 and 𝑤₂∈𝑍_𝑞. Then he computes (𝑡,𝑐,𝑟,𝑠) as follows: 𝑡=𝑦^𝑤1−1_𝐴mod𝑝,𝑐=𝑚𝑦^{𝑥𝐵𝑤1−1𝑤2}_𝐴mod𝑝,𝑟=𝐻𝑚,𝑦^{𝑤1−1𝑤2}_𝐴𝑠=𝑤₁𝑟−𝑤₂mod𝑞. (3)

Attack on Lee et al.’s Scheme. Assume that the signer discloses 𝐷=𝑦^𝑥𝐴_𝐵 or the designated verifier discloses 𝑦^𝑥𝐵_𝐴(=𝑦^𝑥𝐴_𝐵) to any third party 𝑇. Given any message 𝑚^∗, 𝑇 selects two random values 𝑑₁∈𝑍^∗_𝑞 and 𝑑₂∈𝑍_𝑞. Then he computes (𝑡^∗,𝑐^∗,𝑟^∗,𝑠^∗) as follows: 𝑡^∗=𝑦^𝑑1−1_𝐴𝑐mod𝑝,_∗=𝑚^∗𝐷^{𝑑1−1𝑑2}𝑟mod𝑝,_∗=𝐻𝑚,𝑦^{𝑑1−1𝑑2}_𝐴,𝑠^∗=𝑑₁𝑟^∗−𝑑₂mod𝑞. (4)𝑇generates a simulated signature (𝑡^∗,𝑐^∗,𝑟^∗,𝑠^∗). Bob verifies whether 𝑟^∗=𝐻(𝑚,𝑦^𝑟∗_𝐴𝑡^{∗−𝑠∗}) and recovers message 𝑚^∗=𝑐^∗(𝑡^∗𝑠∗𝑦^−𝑟∗_𝐴)^𝑥𝐵mod𝑝. The verification accepts since 𝑐^∗𝑡^∗𝑠∗𝑦^−𝑟∗_𝐴^𝑥𝐵=𝑚^∗𝐷^{𝑑1−1𝑑2}𝑦^{𝑑1−1(𝑑1𝑟∗−𝑑2)}_𝐴𝑦^−𝑟∗_𝐴^𝑥𝐵=𝑚^∗𝐷^{𝑑1−1𝑑2}𝑦^{−𝑑1−1𝑑2}_𝐴^𝑥𝐵=𝑚^∗,𝐻𝑚^∗,𝑦^𝑟∗_𝐴𝑡^{∗−𝑠∗}=𝐻𝑚^∗,𝑦^𝑟∗_𝐴𝑦^𝑑1−1_𝐴^{−(𝑑1𝑟∗−𝑑2)}=𝐻𝑚^∗,𝑦^{𝑑1−1𝑑2}_𝐴=𝑟^∗. (5) Therefore, Lee et al.’s scheme is delegatable.

3.2. Yang et al.’s Scheme

Yang et al.’s certificateless strong designated verifier signature scheme [18] consists of the following six algorithms.(i) Setup. Given a security parameter 𝑙, a KGC chooses two groups 𝐺₁ and 𝐺₂ of the same prime order 𝑞>2^𝑙 and a modified Tate pairing map 𝑒: 𝐺₁×𝐺₁→𝐺₂. 𝑃 is a generator of group 𝐺₁; then the KGC selects two distinct cryptographic hash functions  𝐻₁:{0,1}^∗→𝐺₁, 𝐻₂:{0,1}^∗×𝐺³₁→𝑍^∗_𝑞, picks a random 𝑠∈𝑍^∗_𝑞 as the master key, computes the system public key 𝑃₀=𝑠𝑃, and publishes params∶={𝑙,𝐺₁,𝐺₂,𝑒,𝑞,𝑃,𝑃₀,𝐻₁,𝐻₂} but keeps 𝑠 secret.(ii) Partial-Private-Key-Extract. Given an identity ID_𝑖∈(0,1)^∗, 𝑖∈{𝐴,𝐵}, this paper assumes that user 𝐴 is the signer and 𝐵 is the designated verifier, the KGC computes 𝑄_𝑖=𝐻₁(ID_𝑖), 𝑑_𝑖=𝑠𝑄_𝑖, and sends 𝑑_𝑖 to a user with identity ID_𝑖 as his partial private key by a secure channel.(iii) User-Key-Extract. On inputs 𝑝𝑎𝑟𝑎𝑚𝑠 and the user’s identity ID_𝑖(𝑖∈{𝐴,𝐵}), the algorithm picks a random 𝑥_𝑖∈𝑍^∗_𝑞 as the user’s secret value and computes 𝑝𝑘_𝑖=𝑥_𝑖𝑃 as his public key.(iv) CLSDVS-Sign. On inputs 𝑝𝑎𝑟𝑎𝑚𝑠, signer 𝐴’s identity ID_𝐴, his private key pair (𝑑_𝐴,𝑥_𝐴), and a message 𝑚∈(0,1)^∗, the algorithm works as follows.(1)Pick a random value 𝑟∈𝑍^∗_𝑞 and compute 𝑈=𝑟𝑃. (2)Compute ℎ=𝐻₂(𝑚,𝑈,𝑝𝑘_𝐴,𝑥_𝐴𝑝𝑘_𝐵)∈𝑍^∗_𝑞.(3)Compute 𝑉=𝑟𝑃₀+ℎ𝑑_𝐴 and 𝑇=𝑒(𝑉,𝑄_𝐵).

The signature on message 𝑚 is 𝜎=(𝑈,𝑇).(v) CLSDVS-Verify. To verify a signature 𝜎 on a message 𝑚 for an identity ID_𝐴 with public key 𝑝𝑘_𝐴, the designated verifier 𝐵 acts as follows.(1)Parse 𝜎=(𝑈,𝑇).(2)Compute ℎ=𝐻₂(𝑚,𝑈,𝑝𝑘_𝐴,𝑥_𝐵𝑝𝑘_𝐴)∈𝑍^∗_𝑞. (3)Accept the signature and return 1 if and only if the following equation holds: 𝑇=^?𝑒𝑈+ℎ𝑄_𝐴,𝑑_𝐵. (6)(vi) CLSDVS-Simulation. The designated verifier 𝐵 cannot prove to a third party that a signature 𝜎=(𝑈,𝑇) on a message 𝑚 has been produced by signer 𝐴 since he can also create an indistinguishable signature 𝜎 on 𝑚 by the following means.(1)Pick randomly 𝑟^′∈𝑍^∗_𝑞, and compute 𝑈^′=𝑟^′𝑃.(2)Set ℎ^′=𝐻₂(𝑚,𝑈^′,𝑝𝑘_𝐴,𝑥_𝐵𝑝𝑘_𝐴).(3)Compute 𝑇^′=𝑒(𝑈^′+ℎ^′𝑄_𝐴,𝑑_𝐵).

The signature on the message 𝑚 is 𝜎^′=(𝑈^′,𝑇^′).

Attack on Yang et al.’s Scheme. Since in CLSDVS-Verify algorithm, 𝑇=𝑒𝑈+ℎ𝑄_𝐴,𝑑_𝐵=𝑒𝑈,𝑑_𝐵𝑒𝑄_𝐴,𝑑_𝐵^ℎ. (7)

When one third party 𝑊 gets (𝑉₁,𝑉₂)=(𝑥_𝐴𝑝𝑘_𝐵,𝑒(𝑄_𝐴,𝑑_𝐵)), 𝑊 picks a random value 𝑟^∗∈𝑍^∗_𝑞, and computes 𝑈^∗=𝑟^∗𝑃,ℎ^∗=𝐻₂𝑚^∗,𝑈^∗,𝑝𝑘_𝐴,𝑉₁,𝑇^∗=𝑉^ℎ∗₂𝑒𝑃₀,𝑟^∗𝑄_𝐵. (8)

𝑊 can obtain a simulated signature 𝜎^∗=(𝑈^∗,𝑇^∗). Because ℎ^∗=𝐻₂𝑚^∗,𝑈^∗,𝑝𝑘_𝐴,𝑉₁=𝐻₂𝑚^∗,𝑈^∗,𝑝𝑘_𝐴,𝑥_𝐵𝑝𝑘_𝐴,𝑇^∗=𝑉^ℎ∗₂𝑒𝑃₀,𝑟^∗𝑄_𝐵=𝑒ℎ^∗𝑄_𝐴,𝑑_𝐵𝑒𝑟^∗𝑃,𝑑_𝐵=𝑒ℎ^∗𝑄_𝐴+𝑈^∗,𝑑_𝐵. (9) So, 𝜎^∗=(𝑈^∗,𝑇^∗) is a valid signature. Therefore, Lee et al.’s scheme is delegatable.

3.3. Lee et al.’s Scheme

Lee et al.’s strong designated verifier signature scheme [15] is as follows.

Let 𝑝 and 𝑞 be two large primes such that 𝑞∣𝑝−1 and 𝑔 an element of 𝑍^∗_𝑝 of order 𝑞. Let the signer Alice’s public key be 𝑦_𝐴=𝑔^𝑥𝐴mod𝑝, where 𝑥_𝐴∈𝑍^∗_𝑞 is her secret key, and designated verifier Bob’s public key 𝑦_𝐵=𝑔^𝑥𝐵mod𝑝, where 𝑥_𝐵∈𝑍^∗_𝑞 is his secret key. One-way hash function 𝐻 outputs values in 𝑍_𝑞. Suppose that Alice wants to send a strong designated verifier signature with a message 𝑚 to Bob.(i)Signature Generation. Alice selects a random value 𝑘∈𝑍^∗_𝑞. She computes 𝑟, 𝑠, and 𝑡 as follows: 𝑟=𝑔^𝑘mod𝑝,𝑠=𝑘+𝑥_𝐴𝑟mod𝑞,𝑡=𝐻𝑚,𝑦^𝑠_𝐵mod𝑝. (10)

Then, the signature is 𝜎=(𝑟,𝑡).(ii)Signature Verification. Upon receiving 𝑚 and 𝜎, Bob can verify the validity of the signature by checking whether 𝑡=𝐻(𝑚,(𝑟𝑦^𝑟∗_𝐴)^𝑥𝐵mod𝑝).(iii)Signature Simulation. Bob can simulate the transcript 𝜎^′=(𝑟^′,𝑡^′) for the message 𝑚 by selecting a random number 𝑘^′∈𝑍^∗_𝑞 and compute 𝑟^′ and 𝑡^′ as follows: 𝑟^′=𝑔^𝑘′mod𝑝,𝑡^′=𝐻𝑚,𝑟^{′𝑦𝑟′𝐴𝑥𝐵}mod𝑝. (11)

Attack on Lee et al.’s Scheme. Assume that the signer discloses 𝑦^𝑥𝐴_𝐵 or the designated verifier 𝑦^𝑥𝐵_𝐴(=𝑦^𝑥𝐴_𝐵) to any third party 𝑇. Given any message 𝑚^∗, 𝑇 selects a random number 𝑘^∗∈𝑍^∗_𝑞 and computes 𝑟^∗=𝑔^𝑘∗𝑡^∗=𝐻𝑚^∗,𝑦^𝑘∗_𝐵𝑦^𝑥𝐵_𝐴^𝑟∗mod𝑝. (12)𝑇 generates a simulated signature (𝑡^∗,𝑟^∗). Bob verifies whether 𝑡^∗=𝐻(𝑚^∗,(𝑟^∗𝑦^𝑟∗_𝐴)^𝑥𝐵mod𝑝). The verification accepts since 𝐻𝑚^∗,𝑟^∗𝑦^𝑟∗_𝐴^𝑥𝐵𝑚mod𝑝=𝐻^∗,𝑔^𝑘∗𝑦^𝑟∗_𝐴^𝑥𝐵𝑚mod𝑝=𝐻^∗,𝑦^𝑘∗_𝐵𝑦^𝑥𝐵_𝐴^𝑟∗mod𝑝. (13) Therefore, Lee et al.’s scheme is delegatable.

3.4. Ki et al.’s Scheme

Ki et al.’s strong designated verifier signature scheme [17] is as follows.(i)Setup. Let 𝐺 be an additive group and 𝐺_𝑇 a multiplicative group. Let 𝑒∶𝐺×𝐺→𝐺_𝑇 be a symmetric bilinear map, where 𝐺 and 𝐺_𝑇 have prime order 𝑞. 𝑃 is a random generator of 𝐺. The algorithm selects 𝑠∈𝑍^∗_𝑞 at random and computes 𝑃_pub←𝑠𝑃∈𝐺. It also selects two collision-resistant cryptographic hash functions,   𝐻₀∶{0,1}→𝐺 and 𝐻∶{0,1}^∗→{0,1}^𝜆. The algorithm outputs the master secret key, msk=𝑠, and its corresponding public parameters, params=(𝐺,𝐺_𝑇,𝑞,𝑒,𝑃,𝑃_pub,𝐻₀,𝐻).(ii)Key-Extract. For given identity ID, it computes 𝑄_ID=𝐻₀(ID)∈𝐺 and 𝑠𝑘_ID←𝑠𝑄_ID.(iii)IDSig. For given message 𝑚∈{0,1}^∗, verifier’s identity ID_𝑉, and signer’s secret key 𝑠𝑘_ID𝑆=𝑠𝐻₀(ID_𝑆), it computes 𝑄_ID𝑉←𝐻₀(ID_𝑉)∈𝐺 and 𝑇𝐾←𝑒(𝑠𝑘_ID𝑆,𝑄_ID𝑉)∈𝐺_𝑇. It selects 𝑟∈𝑍^∗_𝑞 and computes 𝜃←𝑟𝑃∈𝐺 and 𝑘_𝑑←𝑒(𝑟𝑃_pub,𝑄_ID𝑉). It computes 𝜂←𝐻(𝑘_𝑑‖𝑇𝐾) and 𝜏←𝐻(𝜂‖𝜃‖𝑚). The signature on a message is 𝜎=(𝜃,𝜏).(iv)IDVerify. For a given signature 𝜎=(𝜃,𝜏), message 𝑚, and verifier’s secret key 𝑠𝑘_𝐼𝐷𝑉, it computes 𝑄_𝐼𝐷𝑆←𝐻₀(𝐼𝐷_𝑆), 𝑇𝐾^′←𝑒(𝑄_ID𝑆,𝑠𝑘_ID𝑉), 𝑘^′_𝐷←𝑒(𝜃,𝑠𝑘_ID𝑉), and 𝜂^′←𝐻(𝑘^′_𝐷‖𝑇𝐾^′). It tests if 𝐻(𝜂^′‖𝜃‖𝑚)?₌𝜏 holds. If the equality holds, then it outputs valid; otherwise, it outputs invalid.

Attack on Ki et al.’s Scheme. Obviously any third party 𝑇 can generate valid signature when they get 𝑇𝐾=𝑒(𝑠𝑘_ID𝑆,𝑄_ID𝑉). So, Ki et al.’s scheme is delegatable.

4. Conclusion

Strong designated verifier signatures provide authentication of a message, without, however, having the nonrepudiation property of traditional signatures. They convince one and only one specified recipient that they are valid, but unlike standard digital signature, nobody else can be convinced about their validity or invalidity. The reason is that the designated verifier in these schemes is able to create a signature intended to himself, that is, indistinguishable from a “real” signature. Strong designated verifier signatures fit into various cryptographic applications where privacy preservation is needed. Recently, four strong designated verifier signature schemes are proposed. However, in this work, we show that the four schemes are delegatable. That is to say, in their scheme the signer or the designated verifier can delegate the signing right to any third party by releasing a piece of information related to but different from their secret keys. This enables a third party to simulate the signer's signatures. So, these schemes do not satisfy nondelegatability secure requirement of strong designated verifier signature scheme.

Conflict of Interests

The authors of the paper do not have any conflict of interests.