Security analysis of the certificateless signature scheme proposed at SecUbiq 2006

  • Authors:
  • Je Hong Park;Bo Gyeong Kang

  • Affiliations:
  • ETRI, Network & Communication Security Division;Samsung Electronics Co., LTD.

  • Venue:
  • EUC'07 Proceedings of the 2007 conference on Emerging direction in embedded and ubiquitous computing
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we show that the certificateless signature scheme proposed by Yap, Heng and Goi at SecUbiq 2006 is insecure against a key replacement attack and a malicious-but-passive KGC attack, respectively. The former implies that anyone who replaces a signer's public key can forge valid signatures for that signer without knowledge of the signer's private key. The latter supposes the malicious-but-passive KGC, which generates system parameters based on the information of the target user to impersonate. Our results are based on the fact that the private key of the YHG scheme has the form of a BLS multisignature generated by the KGC and the user. Finally, we review the vulnerability of several certificateless signature schemes under theses attacks.