一种基于自验证公钥的门限代理签名方案的安全性分析
Security Analysis of a Threshold Proxy Signature Scheme Using Self certified Public Keys
作者：鲁荣波(吉首大学 数学与计算机科学学院, 湖南 吉首 416000)；何大可(西南交通大学 信息安全与国家计算网格实验室, 四川 成都 610031)；王常吉(中山大学 计算机科学系，广东 广州 510275)
Author：(College of Mathematics and Computer Sci., Jishou Univ., Jishou 416000,China)；(Lab. of Info. Security and National Computing Gird, Southwest Jiaotong Univ., Chengdu 610031, China)；(Dept. of Computer Sci., Sun YatSen Univ., Guangzhou 510275,China)
收稿日期：2006-12-14 年卷（期）页码：2008,40(2):91-95
期刊名称：工程科学与技术
Journal Name：Advanced Engineering Sciences
关键字：门限代理签名；代理签名；门限签名；自验证公钥；基于身份
Key words：threshold proxy signature; proxy signature; threshold signature; self certified public key; ID based
基金项目：国家自然科学基金资助项目（60503005）;湖南省自然科学基金资助项目（07JJ6110）；湖南省教育厅资助项目(07C522)
中文摘要
Xue和Cao提出了一种基于自验证公钥的门限代理签名方案，然而，该方案是不安全的。给出了对该方案一种攻击：攻击者获得一个合法的原始签名人发送给代理签名人的签名了的授权证书以及代理签名人生成的一个有效的代理签名后，能够伪造出一个新的对相同消息的代理签名，而原始签名人变为攻击者自己，由于验证者并不能验证代理签名人到底是代表谁生成了代理签名，这样，攻击者就获得了与合法原始签名人相同的权益。特别地，代理签名人代表原始签名人生成的门限代理签名可以被转化为普通的门限签名。分析了该方案存在安全漏洞的原因并提出了改进措施，改进措施能有效地弥补原方案存在的安全缺陷。
英文摘要
Xue and Cao proposed a threshold proxy signature scheme using self certified public keys, but this scheme was insecure. An attack against this scheme was proposed. By this attack, an adversary could forge an illegal proxy signature. That is, based on the proxy signature generated by proxy signers on a message on behalf of an original signer, an attacker could forge a valid threshold proxy signature on the same message which seemed generated by these proxy signers on behalf of this attacker himself. After producing a forged proxy signature, the adversary had the same authority with the original signer to the proxy signer, and the verifier could not distinguish which one was the real original signer. Especially, this attack was used to change proxy signatures into threshold signatures belonging to the group that actually generated the proxy signatures. The causes of the security deficiencies existing in this scheme were analyzed and an improvement which could resolve these security deficiencies was further proposed.
【关闭】
