Breaking and Repairing Trapdoor-Free Group Signature Schemes from Asiacrypt'2004

• 作 者: Xin-Yi Huang Willy Susilo Yi Mu Fu-Tai Zhang
• 机 构: School of Information Technology and Computer Science,University of Wollongong,Wollongong,NSW 2522,A
• 出 处: 计算机科学技术学报(英文版)
• 发表日期: 2007年1期
• 关键词: digital signature cryptography information security

Group signature schemes allow a member of a group to sign messages anonymously on behalf of the group.In case of later dispute, a designated group manager can revoke the anonymity and identify the originator of a signature.In Asiacrypt2004, Nguyen and Safavi-Naini proposed a group signature scheme that has a constant-sized public key and signature length, and more importantly, their group signature scheme does not require trapdoor.Their scheme is very efficient and the sizes of signatures are smaller than those of the other existing schemes.In this paper, we point out that Nguyen and Safavi-Naini’s scheme is insecure.In particular, it is shown in our cryptanalysis of the scheme that it allows a non-member of the group to sign on behalf of the group.And the resulting signature convinces any third party that a member of the group has indeed generated such a signature, although none of the members has done so.Therefore is in case of dispute, even the group manager cannot identify who has signed the message.In the paper a new scheme that does not suffer from this problem is provided.