An Identity Based Strong Bi-Designated Verifier (t, n) Threshold Proxy Signature Scheme

Transcription

1 An Ideny Based Srong B-Desgnaed Verfer ( n Threshold roxy Sgnaure Scheme Sunder Lal and Vandan Verma Deparmen of Mahemacs Dr. B.R.A. (Agra Unversy Agra (U Inda E-mal- sunder_lal2@redffmal.com vandanverma@redffmal.com Absrac: roxy sgnaure schemes have been nvened o delegae sgnng rghs. The paper proposes a new concep of Idenfy Based Srong B-Desgnaed Verfer hreshold proxy sgnaure (ID-SBDVTS schemes. Such scheme enables an orgnal sgner o delegae he sgnaure auhory o a group of n proxy sgners wh he condon ha or more proxy sgners can cooperavely sgn messages on behalf of he orgnal sgner and he sgnaures can only be verfed by any wo desgnaed verfers and ha hey canno convnce anyone else of hs fac. Keywords: ID Based Crypography roxy Sgnaures Threshold roxy Sgnaures Blnear arng Desgnaed Verfers. 1. Inroducon Cerfcae based crypography allows a user o use an arbrary srng unrelaed o hs deny as hs lc key. When anoher user wans o use hs lc key she has o oban an auhorzed cerfcae ha conans hs lc key. Ths creaes he cerfcae managemen problem. To address hs problem Shamr [13] nroduced he concep of ID based crypography n In IDbased lc key crypography (ID-KC user s lc key s derved from ceran aspecs of hs deny (emal address phone no. ec. and a rused hrd pary called key generang cener (KGC generaes secre key for he users. Mambo e al [11] nroduced he concep of proxy sgnaures n In a proxy sgnaure scheme an orgnal sgner delegaes hs sgnng capably o anoher user called proxy sgner. roxy sgner sgns message on behalf of he orgnal sgner however proxy sgnaures are dfferen from he orgnal sgnaures. In he same year Jakobsson e al [2] proposed he concep of desgnaed verfer sgnaures (DVS. In DVS schemes only he desgnaed verfer can check he valdy of he sgnaures bu canno convnce any hrd pary abou he valdy of he sgnaures. Saeedna e al [12] nroduced he feaure of srongness n DVS n Srong Desgnaed Verfer Sgnaure (SDVS scheme forces he desgnaed verfer o use hs secre key a he me of verfcaon. Snce hen several SDVS [ ] schemes have been proposed. In 2003 Desmed [1] rased he problem of generang mul-desgnaed verfer scheme. owever he frs b-desgnaed verfer sgnaure scheme usng blnear maps was proposed by Lagullaume e a [9] n In 2006 he auhors [7] proposed he ID-based srong b-desgnaed verfer sgnaure scheme. They also proposed he frs ID based srong b-desgnaed verfer proxy sgnaure schemes n whch he desgnaed proxy sgnaure can only be verfed by he wo desgnaed verfers usng her secre keys. Zhang [15] and Km e al [4] ndependenly consruced a hreshold proxy sgnaure scheme. In a ( n hreshold proxy sgnaure scheme he orgnal sgner delegaes pars of hs sgnng power o a group of n proxy sgners such ha or more proxy sgners poolng her shares of delegaon can generae proxy sgnaures bu any (-1 or fewer proxy sgners canno creae a vald proxy sgnaure. The frs ID based hreshold proxy sgnaure scheme was proposed by Xu e al [16] n 2004 and he frs ID-based desgnaed verfer hreshold proxy sgnaure scheme was proposed by Juan e al [3] n In such schemes he desgnaed verfer 1

2 can only verfy he hreshold proxy sgnaures. The paper presens he exenson of Juan e al [3] scheme o b-desgnaed verfer. In our proposed scheme any of he wo desgnaed verfers can check he valdy of he hreshold proxy sgnaures bu hey canno convnce any hrd pary abou he valdy of he sgnaure. Anyone of hem can check he valdy of he sgnaures even f he s no aware of oher s deny. Our scheme s useful n he suaons where he sgnaure verfer does no wan o rely on a sngle source for he rueness of he sgnaures. The res of he paper s organzed as follows secon 2 conans some prelmnares abou blnear parngs and Gap Dffe ellman group. In secon 3 we presen our ID-SBDVTS scheme. In secon 4 we analyze s secury and concludng remarks n secon Defnons 2.1 Blnear parngs Le G 1 be a cyclc addve group generaed by whose order s a large prme number q and G 2 be a cyclc mulplcave group wh he same order q. Le e: G 1 G 1 G2 be a map wh he followng properes: Blneary: e (a bq = Q ab Q G 1 and a b Z q *. Non-degeneracy: Q G 1 such ha e ( Q 1 he deny of G 2. Compuably: There s an effcen algorhm o compue e ( Q Q G 1. Such parngs may be obaned by suable modfcaon n he Wel-parng or he Tae-parng on an ellpc curve defned over a fne feld. 2.2 Compuaonal problems Decsonal Dffe-ellman roblem (DD: Gven a b c n G 1 decde wheher c = ab mod q. Compuaonal Dffe-ellman roblem (CD: Gven a b n G 1 compue ab Blnear Dffe-ellman roblem (BD: Gven a b c n G 1 compue abc n G 2. Gap Dffe-ellman roblem (GD: A class of problems where DD can be solved n polynomal me bu no probablsc algorhm exss ha can solve CD n polynomal me. 3. Ideny Based Srong B-Desgnaed Verfer ( n Threshold roxy Sgnaure Scheme. Our scheme s an exenson of Juan e al [3] scheme. The sngle desgnaed verfer s exended o b-desgnaed verfer o form our ID-SBDVTS scheme. In our scheme we have assumed Alce as he orgnal sgner S = { 1 2 n } as he group of n proxy sgners and Bob and Cndy as he wo desgnaed verfers and KGC sands for key generang cenre. The scheme s dvded no sx sages: seup key-generaon secre-share generaon proxy-share generaon proxy-sgnaure generaon and proxy sgnaure verfcaon. Seup: For a gven secury parameer k G 1 s a GD group prme order q>2 k generaed by and e: G 1 G 1 G2 s a blnear map. KGC chooses a maser key s Z q * and ses = s. Chooses wo crypographc hash funcons 1 : {01} * Zq * 2 : {01} * G 1 Zq * and 3 :{01} * G 1 G 2 Zq *. The sysem parameers (q G 1 G 2 e are made lc and s s kep secre wh KGC. Key generaon: Gven a users deny ID KGC compues hs lc key Q ID = 1 (ID and he assocaed secre key S ID = s -1 Q ID.. 2

3 Secre share generaon: The proxy group apples a ( n verfable secre sharng scheme o generae secre shares for all he proxy sgners n S as follows: Each S = { 1 2 n } randomly chooses a ( - 1 degree polynomal f l x 1 ( al x ao wh random coeffcens a l Z * q and lshes A l = a l l = 0 1 l sends f ( o va a secure channel for. On recevng f ( can valdae by checkng he equaly 1 n f ( k Ak If holds each compues hs secre share r fk ( and k 0 k 1 lshes U = r. roxy share generaon: Each proxy sgner S ges hs own proxy sgnng key share as follows: The orgnal sgner Alce frs randomly chooses r w Z * q and compues U w = r w Q IDA. h w = 2 (m w U w V w = (r w + h w S IDA The sgnaure on m w s w = (U w V w. Fnally Alce sends w and m w o each S To verfy a sgnaure he proxy sgner compues h w = 2 (m w U w and acceps he sgnaure ff V w = U w + h w Q IDA and reecs oherwse. If he sgnaure w s acceped compues S = S ID + V w as hs own proxy secre. randomly chooses a ( - 1 degree polynomal g l x 1 ( bl x S wh random l 1 coeffcens b l G 1 and lshes B l = b l for l = B o can be compued by each proxy sgner as B o = U w + (Q ID + h w Q IDA. Furhermore sends g ( o va a secure channel for. On recevng g ( can valdae by checkng he equaly g ( k Fnally compues hs proxy sgnng key share SK. 1 B k k 0 1 SK g k ( and lshes k 0 roxy sgnaure generaon: Le D = { 1 2 } be he group of proxy sgners who wan o sgn message m on behalf of he orgnal sgner Alce. Apply he Lagrange nerpolaon formula o compue X = Q IDB Q IDC G V = X S ID Y G r V { } Y Y U 0 U 1 Le = 3 (m U Y. Each D compues V = U + SK and σ = (U V be hs own proxy sgnaure share. On recevng σ he desgnaed clerk valdaes by checkng V = U SK If holds hen σ s he vald ndvdual proxy sgnaure share on m. If all he ndvdual 3

4 proxy sgnaure shares for m are vald hen he clerk compuesv V. The proxy 1 sgnaure on m s σ = (m V w m w U V roxy sgnaure verfcaon: To verfy he proxy sgnaure σ he desgnaed verfers Bob (and Cndy compue Q IDC = Q -1 IDB X (Bob Y * = S IDB Q IDC U( Q ID and acceps he sgnaure ff V = U + nv w ( Q ID. 4. Secury analyss: In hs secon we analyze he secury of he proposed ID-SBDVS schemes. 4.1 Correcness: The followng equaon gves he correcness of he scheme for Bob V 1 V 1 1 U U ( U U U s s. SK n 1 k 1 1 ID ID ( QID U Vw V = U + nv w ( Q ID ( 1 S Q SK g k nv w (. 4.2 Srongness: In he proposed scheme proxy sgnaures are generaed n such a manner ha only he wo desgnaed verfer Bob and Cndy can check he valdy of he sgnaures usng hs secre key. ence our scheme provdes he srongness propery. 4.3 roxy proeced: Alce canno generae a vald sgnaure share on behalf of snce he does no have any nformaon abou he secre key S ID of each. ence our scheme s proxy proeced. 4.4 Secrecy: In our proposed scheme he orgnal sgner Alce secre key canno be derved from any nformaon such as he shares of he proxy sgnng key proxy sgnaure ec. Even f ou of n proxy sgners collaboraes o delver he proxy share hey canno calculae he Alce secre key. ence our scheme s secure. V n w n 4

5 5. Concluson: In hs paper we have presened a new concep of Ideny based srong b-desgnaed verfer ( n hreshold proxy sgnaure scheme. The proposed scheme can also be vewed as a double hreshold sgnaure scheme as uses hreshold n sgnaure generaon and sgnaure verfcaon phase. The scheme s applcable n he suaons where recever wans he sgnaures o be verfed by wo desgnaed persons and no one oher han hese wo desgnaed persons can check he rueness of he sgnaures. References: 1.Y.Desmed. Verfer-Desgnaed Sgnaures Rump Sesson Crypo 03 ( M.Jakobsson K.Sako K.R.Impalazzo. Desgnaed verfer proofs and her applcaons. Eurocryp 1996 LNCS #1070 Sprnger-Verlag Xu L-Juan Xu Qu-Lang Zheng Zh-hua. Ideny based desgnaed verfer hreshold sgnaure scheme Journal of Compuer Applcaons ( S.Km S.ark D.Won. roxy sgnaures revsed roc. Informaon and Communcaon Secury (ICICS 97 LNCS#1334 Sprnger-Verlag K. Kumar G.Shalaa Ashuosh Saxena. Ideny based srong desgnaed verfer sgnaure scheme. Crypography eprn Archve Repor 2006/134. Avalable a hp://eprn.acr.org/2006/134.pdf 6. Sunder Lal Vandan Verma. Ideny based srong desgnaed verfer proxy sgnaure scheme. Crypography eprn Archve Repor 2006/394. Avalable a hp://eprn.acr.org/2006/394.pdf 7. Sunder Lal Vandan Verma. Some deny based srong b-desgnaed verfer sgnaure scheme. Crypography eprn Archve Repor 2007/193. Avalable a hp://eprn.acr.org/2007/193.pdf 8. Sunder Lal Vandan Verma. Ideny based srong b-desgnaed verfer proxy sgnaure scheme. Crypography eprn Archve Repor 2008/024. Avalable a hp://eprn.acr.org/2008/024.pdf 9. F.Lagullaume D.Vergnaud. Mul-desgnaed verfers sgnaures. ICICS 2004 LNCS #3269 Sprnger-Verlag R.Lu Z.Cao. Desgnaed verfer proxy scheme wh message recovery. Appled Mahemacs and Compuaon 169( M. Mambo K. Usuda and E. Okamoo. roxy sgnaures for delegang sgnng operaon revsed In roc. Of 3 rd ACM conference on compuer and communcaon secury (CCS S.Saeedna S.Kreme O.Markowch. An effcen srong desgnaed verfer sgnaure scheme. ICICS 2003 LNCS #2971 Sprnger-Verlag A. Shamr. ID based cryposysems and sgnaure scheme. Crypo 84 LNCS #196 Sprnger-Verlag G. Wang. Desgnaed verfer proxy sgnaure for e-commerce. IEEE Inernaonal Conferences on Mulmeda and Expo (ICME 2004 CD-ROM ISBN Tape Tawan J.Xu Z.Zheng D.Feng. ID based hreshold proxy sgnaure Crypography eprn Archve Repor 2004/250. Avalable a hp://eprn.acr.org/2004/250.pdf 16.K.Zhang. Threshold proxy sgnaure schemes roc. Informaon Secury Workshop (ISW 97 LNCS#1396 Sprnger-Verlag