A Novel Undeniable (t, n)-Threshold Signature with Cheater Identification
Abstract
:1. Introduction
- Although Lin and Wu claimed that no trusted third party is required for key generation, a secure cryptographic module is required in the group-signature-generation phase.
- There is a vulnerability: a dishonest signer still can forge a fake signature that the secure cryptographic module is unable to detect, which can result in a fake group signature. The corresponding cryptanalysis has been shown in [28], by Lin and Tseng in 2021.
- There is no security proof in Lin and Wu’s paper.
1.1. Contribution
- Standing from a forge attack from a dishonest signer by identification.
- Our scheme does not need any trusted third party or secure cryptographic module in any phase.
- We, formally, demonstrate the security proofs of the unforgeability and invisibility for our scheme.
1.2. Organization
2. Preliminaries
2.1. Non-Malleable Equivocable Commitments
- . On inputting the security parameter , the key generation algorithm outputs a public/trapdoor key pair .
- . On inputting the public key and a message m, the commitment algorithm outputs , where R is the random coin used in the algorithm. Here, is the commitment string, and is the decommitment string, which should be kept secret before opening.
- . On inputting the public key and the commitment/decommitment string , the verification algorithm , also known as the open algorithm, either outputs a message m or an invalid symbol
- is the algorithm that realizes the equivocable property. It takes as inputs the public key , strings for , a message , and the trapdoor key , and outputs such that .
- Correctness: If then .
- Hiding: For every message pair the distributions and are statistically close.
- Binding: There is no probabilistic polynomial-time algorithm that is able to output , such that and
2.2. Threshold Signatures
- Thresh-Key-Gen(), the distributed key-generation protocol. Taking as input the security parameter , in this protocol, n players jointly compute the public key and private keys for player , for .
- Thresh-Sig, the distributed signing protocol, which takes as a public input a message m to be signed, and private inputs for and . The output of the protocol is a signature .
2.3. The FDH Variant of Chaum’s Undeniable Signature Scheme
- Key Generation. On inputting the security parameter , the algorithm outputs the public key and the secret key , where x is randomly chosen from , , H: is a cryptographic hash function.
- Signing. Taking as inputs the public key , the secret key , and a message , the algorithm outputs the signature as .
2.4. Cheater Identification
2.5. Undeniable -Threshold Signature with Cheater Identification
- Key Generation. A verifiable -threshold secret sharing [42] for a secret x consists of n shares distributed to n parties. Any party can check the share they get during the phase. If the check does not hold, the protocol will abort and the cheater will be identified.
- Signature Generation. An undeniable signature that t parties cooperate, generates a valid signature that does not reveal any information of the party’s share. If any party sends out an invalid value that causes the signature to be invalid, the protocol will abort and the cheater will be identified.
- Confirmation Protocol. Given a message-signature pair, the group of t parties cooperates, to prove the validity of the signature that does not reveal any information about the party’s share. If any party sends out an invalid value that causes the proof to fail, the protocol will abort, and the cheater will be identified.
- Disavowal Protocol. Given a message-signature pair, the group of t parties cooperates, to prove the invalidity of the signature that does not reveal any information of the party’s share. If any party sends out an invalid value that causes the proof to fail, the protocol will abort and the cheater will be identified.
3. The Proposal Scheme
- Step 1:
- Each selects a random value , computes and , then broadcasts .
- Step 2:
- Each broadcasts . Let be the value decommitted by .
- Step 3:
- Each randomly generates a degree polynomial.
- Step 4:
- Each in G computes a shadow key.will be identified as a cheater, if Equation (4) does not hold.
- Step 5:
- After receiving shadow keys from the others, the secret key of each in G can be computed by as:Note that ’s share public key can be computed as:
- Step 1:
- Each computes their partial signature , computes , and broadcasts .
- Step 2:
- Each broadcasts . Let be the value decommitted by . Note that each can prove to others that they know s.t. using Chaum’s [7] zero-knowledge protocol, by replacing Z with , x with , and y with , respectively.If all are accepted, the players compute:
- Step 1:
- The verifier sends to , where are randomly chosen from , and h is a collision-resistant hash function.
- Step 2:
- performs Step 1 to Step 2 of the Signature Generation Phase, whereas the message M is replaced with D. Let be the result after Step 2 of the Signature Generation Phase. Note that, . Next, randomly chooses r and sends to the verifier.
- Step 3:
- The verifier then sends to .
- Step 4:
- then verify If the equation holds, then reveals r to the verifier; otherwise the protocol is terminated.
- Step 5:
- Finally, the verifier checksIf the equation holds, then the verifier accepts the signature Z; otherwise, it is rejected.
- Step 1:
- The verifier chooses, uniformly at random, an integer s from , where k should be mutually agreed. Besides, the verifier randomly chooses . Then, the verifier sends to the group .
- Step 2:
- performs Step 1 to Step 2 of the Signature Generation Phase, whereas the message M is replaced with D. Let be the result after Step 2 of the Signature Generation Phase, .
- Step 3:
- The group chooses and tests ifThe equality of Equation (6) means that is equal to the value s chosen by the verifier. Since there are at most choices of s, is able to find the correct , with at most trials. Note that if Z, indeed, is equal to , then can only guess the correct with probability , since “” implies . Next, uses a commitment scheme to commit the correct , which is the one that makes Equation (6) hold, and sends the commitment C of to the verifier.
- Step 4:
- The verifier then sends a to .
- Step 5:
- If , then sends and the decommitment string D to the verifier.
- Step 6:
- The verifier accepts if C opens via D and .
4. Security Proof
4.1. Unforgeability
- First, participates in the key generation protocol to jointly compute a public key y for the undeniable threshold signature scheme.
- Next, is allowed to request the group of players to sign on messages , and the signer group jointly performs the signing protocol to generate the corresponding signatures .
- Besides, is also allowed to send message-signature pairs , and the signer group performs the confirmation/disavowal protocol with the pairs.
- At the end, the adversary outputs a message-signature pair for it, under the public key y, with probability of at least .
4.1.1. Simulation for the Key Generation Phase
- selects a random value , and computes and broadcasts . Meanwhile, broadcasts commitments for .
- Each player broadcasts . Let be the value decommitted from using .
- then rewinds to Step 2. Now, can compute a new , such that, is decommitted to using . This can be done by adopting the algorithm of the trapdoor commitment scheme.
- Next, chooses and sets a polynomial , satisfying and for .
- simulates the remaining parts of the protocol, following the procedure of the Key Generation Phase shown in Section 3.
- At the end of the simulation of this phase, a public key is outputted.
4.1.2. Simulation for the Signature Generation Phase
- selects a random value , computes and broadcasts . Meanwhile, broadcasts commitments for .
- Next, each player broadcasts . Let be the result decommitted from using .
- queries the signature oracle with M, to obtain a signature Z, and, then, rewinds to Step 2. Now, is able to compute a new , such that, decommits to
- At the end of the simulation, a signature is outputted.
4.1.3. Simulating the Confirmation/Disavowal Protocol
4.2. Invisibility
- First, participates in the key generation protocol to jointly compute a public key y, for the undeniable threshold signature scheme.
- Next, is allowed to request the group of players to sign on messages , and the signer group jointly performs the signing protocol, to generate the corresponding signatures .
- Besides, is, also, allowed to send message-signature pairs , and the signer group performs the confirmation/disavowal protocol with the pairs.
- At some point, outputs a message that has never been queried before and is given challenge signature . The generation of follows the rules below. First, a coin toss b hidden from ’s view is determined. Second, is a valid signature on , if ; is uniformly chosen from the signature space at random if .
- keeps making queries as before, except when:
- making a signing query with ;
- making a confirmation/disavowal query with .
- At the end, the adversary outputs a guess , such that , with probability at least .
Simulation
- To simulate the key generation protocol, the distinguisher plays the role of and does the same to simulate as the forger does in the unforgeability proof, shown in Section 4.1.1.
- To simulate the signature generation protocol, the distinguisher plays the role of and does the same to simulate as the forger does in the unforgeability proof, shown in Section 4.1.2.
- To simulate the confirmation/disavowal protocol, the distinguisher plays the role of and does the same to simulate as the forger does in the unforgeability proof, shown in Section 4.1.3.
- At some point, the adversary outputs a message to the distinguisher . Then, forwards to the oracle of Chaum’s invisibility game, to obtain a signature . Finally is sent to .
5. Comparison and Analysis
5.1. Security Properties
- Share distribution center. The scheme does not need a trusted third party or secure cryptographic module.
- Security proof. Security proof for unforgeability and invisibility are provided.
- Cheater identification. The scheme can detect cheaters in the signing and key distributed phase.
- Avoid single point of failure. The scheme would not suffer from a single point of failure problem, which means just one malfunction or fault of a participator would not cause the whole phase to stop working.
5.2. Computational Complexity
- Individual signature. The time for computing exponent generated by each individual participants.
- Group signature. The time for computing the exponent of the group-signing generation.
- Confirmation protocol. The time for computing the exponent of the confirmation protocol.
- Disavowal protoco.l: The time for computing the exponent of the confirmation protocol.
6. Conclusions
Author Contributions
Funding
Institutional Review Board Statement
Informed Consent Statement
Data Availability Statement
Acknowledgments
Conflicts of Interest
References
- Jakobsson, M.; Sako, K.; Impagliazzo, R. Designated verifier proofs and their applications. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Saragossa, Spain, 12–16 May 1996; Springer: Berlin/Heidelberg, Germany, 1996; pp. 143–154. [Google Scholar]
- Li, Y.; Susilo, W.; Mu, Y.; Pei, D. Designated verifier signature: Definition, framework and new constructions. In Proceedings of the International Conference on Ubiquitous Intelligence and Computing, Hong Kong, China, 11–13 July 2007; Springer: Berlin/Heidelberg, Germany, 2007; pp. 1191–1200. [Google Scholar]
- Lipmaa, H.; Wang, G.; Bao, F. Designated verifier signature schemes: Attacks, new security notions and a new construction. In Proceedings of the International Colloquium on Automata, Languages, and Programming, Lisbon, Portugal, 11–15 July 2005; Springer: Berlin/Heidelberg, Germany, 2005; pp. 459–471. [Google Scholar]
- Steinfeld, R.; Bull, L.; Wang, H.; Pieprzyk, J. Universal designated-verifier signatures. In Proceedings of the International Conference on the Theory and Application of Cryptology and Information Security, Taipei, Taiwan, 30 November–4 December 2003; Springer: Berlin/Heidelberg, Germany, 2003; pp. 523–542. [Google Scholar]
- Saeednia, S.; Kremer, S.; Markowitch, O. An efficient strong designated verifier signature scheme. In Proceedings of the International Conference on Information Security and Cryptology, Taipei, Taiwan, 30 November–4 December 2003; Springer: Berlin/Heidelberg, Germany, 2003; pp. 40–54. [Google Scholar]
- Chaum, D.; Van Antwerpen, H. Undeniable signatures. In Proceedings of the Conference on the Theory and Application of Cryptology, Santa Barbara, CA, USA, 20–24 August 1989; Springer: New York, NY, USA, 1989; pp. 212–216. [Google Scholar]
- Chaum, D. Zero-knowledge undeniable signatures. In Proceedings of the Workshop on the Theory and Application of of Cryptographic Techniques, Aarhus, Denmark, 21–24 May 1990; Springer: Berlin/Heidelberg, Germany, 1990; pp. 458–464. [Google Scholar]
- Kurosawa, K.; Heng, S.H. 3-move undeniable signature scheme. In Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, 22–26 May 2005; Springer: Berlin/Heidelberg, Germany, 2005; pp. 181–197. [Google Scholar]
- Damgård, I.; Pedersen, T. New convertible undeniable signature schemes. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Saragossa, Spain, 12–16 May 1996; Springer: Berlin/Heidelberg, Germany, 1996; pp. 372–386. [Google Scholar]
- Michels, M.; Stadler, M. Efficient convertible undeniable signature schemes. In Proceedings of the 4th Annual Workshop on Selected Areas in Cryptography (SAC’97), Ottawa, ON, Canada, 11–12 August 1997; pp. 231–244. [Google Scholar]
- Duan, S. Certificateless undeniable signature scheme. Inf. Sci. 2008, 178, 742–755. [Google Scholar] [CrossRef]
- Kurosawa, K.; Furukawa, J. Universally composable undeniable signature. In Proceedings of the International Colloquium on Automata, Languages, and Programming, Reykjavik, Iceland, 7–11 July 2008; Springer: Berlin/Heidelberg, Germany, 2008; pp. 524–535. [Google Scholar]
- Ogata, W.; Kurosawa, K.; Heng, S.H. The security of the FDH variant of Chaum’s undeniable signature scheme. In Proceedings of the International Workshop on Public Key Cryptography, Les Diablerets, Switzerland, 23–26 January 2005; Springer: Berlin/Heidelberg, Germany, 2005; pp. 328–345. [Google Scholar]
- Rawal, S.; Padhye, S.; He, D. Lattice-based undeniable signature scheme. Ann. Telecommun. 2022, 77, 119–126. [Google Scholar] [CrossRef]
- Yun, S. The Blockchain based Undeniable Multi-Signature Scheme for Protection of Multiple Authorship on Wisdom Contents. J. Korea Internet Things Soc. 2021, 7, 7–12. [Google Scholar]
- Loh, J.C.; Heng, S.H.; Tan, S.Y.; Kurosawa, K. On the invisibility and anonymity of undeniable signature schemes. J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. (JoWUA) 2020, 11, 18–34. [Google Scholar]
- Yuen, T.H.; Heng, S.H. Security-mediated certificateless undeniable signature scheme. In Third International Congress on Information and Communication Technology; Springer: Singapore, 2019; pp. 25–32. [Google Scholar]
- Aleksandrova, E.B.; Shkorkina, E. Using Undeniable Signature on Elliptic Curves to Verify Servers in Outsourced Computations. Autom. Control Comput. Sci. 2018, 52, 1160–1163. [Google Scholar] [CrossRef]
- Desmedt, Y.G. Threshold cryptography. Eur. Trans. Telecommun. 1994, 5, 449–458. [Google Scholar] [CrossRef]
- Camenisch, J.; Drijvers, M.; Lehmann, A.; Neven, G.; Towa, P. Short threshold dynamic group signatures. In Proceedings of the International Conference on Security and Cryptography for Networks, Amalfi, Italy, 14–16 September 2020; Springer: Cham, Switzerland, 2020; pp. 401–423. [Google Scholar]
- Battagliola, M.; Longo, R.; Meneghetti, A.; Sala, M. Threshold ECDSA with an offline recovery party. Mediterr. J. Math. 2022, 19, 1–29. [Google Scholar] [CrossRef]
- Komlo, C.; Goldberg, I. FROST: Flexible round-optimized Schnorr threshold signatures. In Proceedings of the International Conference on Selected Areas in Cryptography, Virtual Event, 19–23 October 2020; Springer: Cham, Switzerland, 2020; pp. 34–65. [Google Scholar]
- Li, Y.; Wang, C.; Zhang, Y.; Yang, X.; Huang, H. Secure obfuscation for encrypted threshold signatures. J. Commun. 2020, 41, 61–69. [Google Scholar] [CrossRef]
- Ruffing, T.; Ronge, V.; Jin, E.; Schneider-Bensch, J.; Schröder, D. ROAST: Robust Asynchronous Schnorr Threshold Signatures. Cryptology ePrint Archive, Report 2022/550, 2022. Available online: https://ia.cr/2022/550 (accessed on 10 May 2022).
- Harn, L.; Yang, S. Group-oriented undeniable signature schemes without the assistance of a mutually trusted party. In Proceedings of the International Workshop on the Theory and Application of Cryptographic Techniques, Balatonfüred, Hungary, 24–28 May 1992; Springer: Berlin/Heidelberg, Germany, 1992; pp. 133–142. [Google Scholar]
- Lin, C.H.; Wang, C.T.; Chang, C.C. A group-oriented (t, n) undeniable signature scheme without trusted center. In Proceedings of the Australasian Conference on Information Security and Privacy, Wollongong, NSW, Australia, 24–26 June 1996; Springer: Berlin/Heidelberg, Germany, 1996; pp. 266–274. [Google Scholar]
- Lin, T.Y.; Wu, T.C. Undeniable (t, n)-threshold signature scheme with cheater identification. J. Chin. Inst. Eng. 1998, 21, 775–780. [Google Scholar] [CrossRef]
- Lin, Y.B.; Tsengg, Y.F. Cryptanalysis on Lin and Wu’s Undeniable (t, n)-Threshold Signature Scheme with Cheater Identification. In Proceedings of the 2021 International Symposium on Intelligent Signal Processing and Communication Systems (ISPACS), Hualien City, Taiwan, 16–19 November 2021; pp. 1–2. [Google Scholar]
- Wang, G.; Qing, S.; Wang, M.; Zhou, Z. Threshold undeniable RSA signature scheme. In Proceedings of the International Conference on Information and Communications Security, Chongqing, China, 19–21 November 2021; Springer: Berlin/Heidelberg, Germany, 2001; pp. 221–232. [Google Scholar]
- Wang, G.l.; Qing, S.H. A threshold undeniable signature scheme without a trusted party. J. Softw. 2002, 13, 1758–1764. [Google Scholar]
- Lee, N.Y.; Hwang, T. Group-oriented undeniable signature schemes with a trusted center. Comput. Commun. 1999, 22, 730–734. [Google Scholar] [CrossRef]
- Hwang, S.J.; Liao, H.C. A Group-Oriented Undeniable Signature Scheme for Unlikely Signers and Verifiers. J. Appl. Sci. Eng. 2006, 9, 45–54. [Google Scholar]
- Liu, Y.; Liu, T. A novel threshold signature scheme based on elliptic curve with designated verifier. In Proceedings of the International Conference on Artificial Intelligence and Security, New York, NY, USA, 26–28 July 2019; Springer: Cham, Switzerland, 2019; pp. 332–342. [Google Scholar]
- Gennaro, R.; Goldfeder, S. Fast Multiparty Threshold ECDSA with Fast Trustless Setup. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS ’18), Toronto, ON, Canada, 15–19 October 2018; Association for Computing Machinery: New York, NY, USA, 2018; pp. 1179–1194. [Google Scholar] [CrossRef]
- Dolev, D.; Dwork, C.; Naor, M. Nonmalleable cryptography. SIAM Rev. 2003, 45, 727–784. [Google Scholar] [CrossRef]
- Di Crescenzo, G.; Ishai, Y.; Ostrovsky, R. Non-interactive and non-malleable commitment. In Proceedings of the Thirtieth Annual ACM Symposium on Theory of Computing, Dallas, TX, USA, 24–26 May 1998; pp. 141–150. [Google Scholar]
- Crescenzo, G.D.; Katz, J.; Ostrovsky, R.; Smith, A. Efficient and non-interactive non-malleable commitment. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Innsbruck, Austria, 6–10 May 2001; Springer: Berlin/Heidelberg, Germany, 2001; pp. 40–59. [Google Scholar]
- Damgard, I.; Groth, J. Non-interactive and reusable non-malleable commitment schemes. In Proceedings of the Thirty-Fifth Annual ACM Symposium on Theory of Computing, San Diego, CA, USA, 9–11 June 2003; pp. 426–437. [Google Scholar]
- Gennaro, R. Multi-trapdoor commitments and their applications to proofs of knowledge secure under concurrent man-in-the-middle attacks. In Proceedings of the Annual International Cryptology Conference, Santa Barbara, CA, USA, 15–19 August 2004; Springer: Berlin/Heidelberg, Germany, 2004; pp. 220–236. [Google Scholar]
- MacKenzie, P.; Yang, K. On simulation-sound trapdoor commitments. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Interlaken, Switzerland, 2–6 May 2004; Springer: Berlin/Heidelberg, Germany, 2004; pp. 382–400. [Google Scholar]
- Ishai, Y.; Ostrovsky, R.; Zikas, V. Secure multi-party computation with identifiable abort. In Proceedings of the Annual Cryptology Conference, Santa Barbara, CA, USA, 17–21 August 2014; Springer: Berlin/Heidelberg, Germany, 2014; pp. 369–386. [Google Scholar]
- Feldman, P. A practical scheme for non-interactive verifiable secret sharing. In Proceedings of the 28th Annual Symposium on Foundations of Computer Science (sfcs 1987), Los Angeles, CA, USA, 12–14 October 1987; pp. 427–438. [Google Scholar]
- Galbraith, S.D.; Mao, W. Invisibility and anonymity of undeniable and confirmer signatures. In Proceedings of the Cryptographers’ Track at the RSA Conference, San Francisco, CA, USA, 13–17 April 2003; Springer: Berlin/Heidelberg, Germany, 2003; pp. 80–97. [Google Scholar]
- Pointcheval, D.; Stern, J. Security proofs for signature schemes. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Saragossa, Spain, 12–16 May 1996; Springer: Berlin/Heidelberg, Germany, 1996; pp. 387–398. [Google Scholar]
Notation | Meaning |
---|---|
public key | |
secret key | |
trapdoor key | |
m | message |
commitment string/decommitmenet string | |
n | number of users |
t | threshold value |
the probability that event E happens |
Schemes | Share Distribution | Security Proof | Cheater Identification | Avoid SPOF 1 |
---|---|---|---|---|
[27] | no | no | no 2 | yes |
[29] | no | no | yes | yes |
[30] | yes | no | yes | no |
[31] | no | no | no | yes |
[32] | no | unforgeability | yes | yes |
[33] | key generation phase | unforgeability | yes | yes |
[14] | yes | yes | no | no |
Ours | yes | yes | yes | yes |
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |
© 2022 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Tseng, Y.-F.; Lin, Y.-B. A Novel Undeniable (t, n)-Threshold Signature with Cheater Identification. Symmetry 2022, 14, 1118. https://doi.org/10.3390/sym14061118
Tseng Y-F, Lin Y-B. A Novel Undeniable (t, n)-Threshold Signature with Cheater Identification. Symmetry. 2022; 14(6):1118. https://doi.org/10.3390/sym14061118
Chicago/Turabian StyleTseng, Yi-Fan, and Yan-Bin Lin. 2022. "A Novel Undeniable (t, n)-Threshold Signature with Cheater Identification" Symmetry 14, no. 6: 1118. https://doi.org/10.3390/sym14061118