Thư viện số Văn Lang: Journal of King Saud University - Computer and Information Sciences, Volume 25, Issue 1

ORIGINAL ARTICLE

Provably secure certificateless strong designated verifier signature scheme based on elliptic curve bilinear pairings

SK Hafizul Islam

^*

, G.P. Biswas

Department of Computer Science and Engineering, Indian School of Mines, Dhanbad 826 004, Jharkhand, India

Received 10 March 2012; revised 1 May 2012; accepted 26 June 2012 Available online 5 July 2012

KEYWORDS

Certificateless cryptography;

Elliptic curve cryptosystem;

Designated verifier;

Digital signature;

Bilinear pairing

Abstract Diffie and Hellman first invented the public key cryptosystem (PKC) wherein the public key infrastructure (PKI) is used for the management of public keys; however, the PKI-based cryp- tosystems suffer from heavy management trouble of public keys and certificates. An alternative solution to the PKI is Shamir’s identity-based cryptosystems (IBC), which eliminate the need of public key certificates; however, the most important shortcoming of IBC is thekey escrow problem.

To cope with these problems, Al-Riyami and Paterson proposed a novel scheme of certificateless PKC (CL-PKC) by combining the advantages of PKI and IBC. Since then, several certificateless signature schemes have been designed and most of them have been analyzed and proven insecure against different types of adversaries. Besides, the researchers have given very less attention to the certificateless strong designated verifier signature (CL-SDVS) scheme. Therefore, we proposed a CL-SDVS scheme using elliptic curve bilinear parings in this paper. Our scheme, which is prov- ably secure in the random oracle model with the intractability of BDH and CDH assumptions, sup- ports all desirable security necessities of the CL-SDVS scheme such asstrongness,source hidingand non-delegatability. The rigorous security analysis and comparison with others guarantee the better performance of the proposed scheme.

ª2012 King Saud University. Production and hosting by Elsevier B.V. All rights reserved.

1. Introduction

Diffie and Hellman (1976)first invented the public key crypto- system (PKC) and after which a public key infrastructure

(PKI) has been developed, where different methods are used for generating and maintaining the public keys using the cor- responding public key certificates. However, the PKI-based cryptosystems mainly suffer from problems such as (1) the sen- der must authenticate the public key of the receiver by verify- ing the corresponding certificate prior to the communication, thereby requiring additional computational cost; (2) PKI- based systems have the serious problems of certificate creation, storage, revocation, delivery, etc. These problems can prevail over the identity-based cryptosystem (IBC) (Shamir, 1984), which can avoid the need of public key certificate. In IBC, a user’s identity is used as public key and a trusted third party called PKG (private key generator) generates the correspond- ing private key by binding the user’s identity and its own

* Corresponding author. Tel.: +91 8797369160; fax: +91 326 2296563.

E-mail addresses:hafi786@gmail.com,hafizul.ism@gmail.com(SK Hafizul Islam),gpbiswas@gmail.com(G.P. Biswas).

Peer review under responsibility of King Saud University.

Production and hosting by Elsevier

King Saud University

Journal of King Saud University – Computer and Information Sciences

www.ksu.edu.sa www.sciencedirect.com

1319-1578ª2012 King Saud University. Production and hosting by Elsevier B.V. All rights reserved.

http://dx.doi.org/10.1016/j.jksuci.2012.06.003

private key. Although Shamir proposed a smartcard-based digital signature scheme using IBC, no practical identity-based encryption/decryption scheme (IBE) was devised.Boneh and Franklin (2001)first designed a practical IBE scheme in the elliptic curve group (Miller, 1985; Koblitz, 1987) using bilinear pairings. In IBE, a public key can be revoked easily by binding the date to the public key (Boneh and Franklin, 2001), and there is no need for the exchange of public keys before the communication takes place. Despite the advantages of IBE, the inherent problem, called private key escrow, makes it unsuitable for real-life applications where privacy of users is of great concern in all respects. In IBE, the assumption for a PKG to be fully trusted is not possible for open networks. Be- cause the PKG knows the private keys of all users, a malicious PKG can impersonate any user in the system easily.

With the advantages of both IBE and PKI,Al-Riyami and Paterson (2003)proposed the certificateless public key crypto- system (CL-PKC) that has received a lot of attention in recent years. The CL-PKC eliminates theprivate key escrow problem of IBE and the need of public key certificate as found in PKI.

In CL-PKC, each user has a full private key that consists of two secrets comprising the identity-based private key gener- ated by PKG and the PKI-based private key chosen by the user himself. The PKG has no ability to get access to the full private key of the user, and thus the man-in-the-middle attack is impossible by the dishonest PKG.

The designated verifier signature (DVS) scheme (Jakobsson et al., 1996) allows the original signer,Alice(say) to generate a signature that only be verified by a designated verifier Bob (say). Further, in any DVS scheme,Bobcan prove to a third party that the signature was generated byAlice. As a result, the public verification of DVS scheme annihilates the signer’s privacy protection. To meet this goal, another signature scheme, called strong DVS (SDVS) has been proposed by Jakobsson et al. in the same paper (Jakobsson et al., 1996).

In this scheme, Bob is unable to convince an outsider that the signature was generated byAliceor himself. This is because Bobcan compute an identical signature that cannot be distin- guished from the signatures created byAlice,and the private key of Bob is strictly required in the verification phase. It means the SDVS scheme satisfies thestrongnessandrepudia- tionproperties as required in other secure cryptosystems.

1.1. Literature review

Recently, several certificateless signature (CLS) schemes have been proposed in the literature. The first CLS scheme is pro- posed by Al-Riyami and Paterson in their seminal paper (Al- Riyami and Paterson, 2003), but the protocol is not secure as demonstrated byHuang et al. (2005), and then they built a model for the CLS scheme.Gorantla and Saxena (2005)pro- posed a new efficient and secure CLS scheme as they have claimed, butCao et al. (2006)proved that it could not resist thepublic key replacementattack.Yum and Lee (2004)define the new construction of the CLS scheme however, Hu et al.

(2006)demonstrated that the scheme was not secure against thepublic key replacementattack. To remove the security flaws ofYum and Lee (2004), Hu et al. (2006)proposed an improved CLS scheme. Two efficient CLS schemes (Yap et al., 2006;

Choi et al., 2007) were also presented and their security is pro- ven based on the model proposed inHuang’s et al. (2005), but

Zhang and Feng (2006)demonstrated that the former scheme (Yap et al., 2006) was vulnerable to thepublic key replacement attack.Zhang et al. (2006)proposed an improved CSL model using the model proposed in (Huang et al., 2005).Xu et al.

(2008)proposed a CLS scheme for mobile wireless cyber-phys- ical systems, andChen et al. (2007)presented an efficient and secure CLS scheme for the environment where immediate revocation of the public keys is required. Yang et al. (2007) designed a certificateless universal designated verifier signature (CL-UDVS) scheme, which is proven to be secure in the ran- dom oracle model (Bellare and Rogaway, 1993) against differ- ent types of adversaries. However,Guozheng and Fan (2009) showed that theXu et al. (2008)scheme is vulnerable to amali- cious PKG attackandYang et al. (2007)scheme is not secure against thepublic key replacementandmalicious PKGattacks.

Zhang and Zhang (2008) proposed an efficient CLS scheme, which is secure in the random oracle model based on the hard- ness assumption of BDH problem whereasLi and Liu (2011) proposed another CLS scheme and provided only informal security analysis.

Recently, certificateless short signature schemes have re- ceived great attention due to its shorter length. The short sig- nature schemes are appropriate for low-bandwidth, low- storage and low-computation environments such as bar-coded digital signature on postage stamps. In 2006, Huang et al.

(2006) first introduced the security notion and construction of a certificateless short designated verifier signature (CL- sDVS) scheme with the intractability of Gap Bilinear Diffie–

Hellman (GBDH) problem (Boneh and Franklin, 2001) in the random oracle model. Unfortunately, their scheme is vul- nerable to malicious PKG attacks.Du and Wen (2007), and Chen et al. (2008)proposed two CL-sDVS schemes based on parings and analyzed that the schemes were provably secured.

However, Fan et al. (2009) proved that the scheme (Du and Wen, 2007) did not resist the public key replacement attack and then developed a modified scheme to improve the security of the earlier scheme.Tso et al. (2011)andChoi et al. (2011) independently proposed two provably secure CL-sDVS schemes, but the latter scheme is proven vulnerable against thepublic key replacementattack (Tian et al., 2011).

1.2. Motivations and contributions

Based on the pioneer work ofAl-Riyami and Paterson (2003), many of CLS and CL-short signature schemes have been pro- posed in recent years; however, most of the previous schemes cannot meet desired security and computation efficiency. From the literature, it can be seen that the researchers have been gi- ven very less attention to the certificateless strong designated verifier signature (CL-SDVS) scheme. In 2009, Hongzhen and Qiaoyan proposed a CL-DVS scheme using pairings and states that is secure against all adversaries, and satisfies all the necessary properties of DVS scheme. However, the compu- tation cost of the scheme is high as three parings and one par- ing-based exponentiation computation are required for the signature generation and verification. Recently, Yang et al.

(2009) and Xiao et al. (2010) independently designed two CL-SDVS schemes based on elliptic curve bilinear pairings.

However, Zhang and Xie (2011) analyzed that Xiao et al.

scheme is vulnerable to both the public key replacementand malicious PKGattacks.

In this paper, we designed a CL-SDVS scheme based on ECC and bilinear pairings. The formal security analysis of our scheme proves that it is strongly secure against various adaptive chosen messages and identity adversaries in the ran- dom oracle model. We also compared our scheme with a num- ber of related CLS schemes in terms of security and computation efficiency, and found improved performance.

1.3. Roadmap of the paper

The remainder of the paper is structured as follows. Section 2 describes some preliminaries and Section 3 describes the defini- tion and attack model of a CL-SDVS scheme. Section 4 ex- plains the proposed CL-SDVS scheme and Section 5 discusses the formal security analysis of our scheme. The com- parisons of the proposed scheme with other are presented in Section 6 and, finally, Section 7 concludes the paper.

2. Technical backgrounds

This section describes the concept of bilinear parings and some related computational problems as required in the paper.

2.1. Bilinear pairings

LetG_qbe an additive cyclic group with prime orderq(qP2^k), Gmbe a multiplicative group of the same prime orderq. Let

^

e:GqGq!Gmbe an admissible bilinear mapping that satis- fies the following properties:

Bilinearity:The bilinear map^e:GqGq!Gmis said to be bilinear if for all P, Q2Gq and a;b2RZ_q; ^eðaP;bQÞ ¼

^eðP;QÞ^abholds.

Non-degeneracy: There exists P, Q2Gq such that

^eðP;QÞ–1m, where 1_m is an identity element ofG_m. Note that the map^edoes not send all pairs inGq·Gqto the iden- tity in Gmthat is ifPis a generator of the group Gqthen

^eðP;PÞis a generator of the groupG_m.

Computability:There must be an efficient algorithm, which can compute^eðP;QÞfor allP,Q2G_q.

A bilinear map is called an admissible bilinear map if it satis- fies the three properties defined above. In general,Gqis a group of points on an elliptic curve, andG_mis a multiplicative subgroup of a finite fieldE/F_q. The map^ewill be derived either from the mod- ified Weil pairing or from Tate pairing over a finite field. A more comprehensive description about bilinear pairings, selection of suitable parameters, elliptic curves and these groups can be found inBoneh and Franklin (2001)for efficiency and security.

Bilinear Diffie–Hellman parameter generator (BDH-PG): A BDH-PG G is defined as a probabilistic polynomial time bounded algorithm that takes the security parameter k2Z^þ as input and outputs a uniformly random tuple ðq;^e;G_q;G_m;PÞof bilinear parameters.

2.2. Complexity assumptions

In this section, we define the following computational prob- lems, which are assumed hard to break by any polynomial time bounded algorithm, on the elliptic curve group.

Definition 1 (Elliptic curve discrete logarithm problem (ECDLP)). Given a random instance (P,Q)2Gq, find an integera2RZ_qsuch thatQ=aP.

Definition 2 (Computational Diffie–Hellman (CDH) prob- lem). Given a random instance (P,aP,bP)2G_q for any a;b2RZ_q, computation ofabPis hard to the groupGq. Definition 3 (Computational Diffie–Hellman (CDH) assump- tion). A probabilistic polynomial time bounded adversaryA is said to break the CDH problem with negligible probability, if for a given random instance (P,aP,bP)2G_q of the CDH problem, where a;b2RZ_q are unknown to A, the advantage Adv^CDH_A;Gq ¼PrhAðP;aP;bPÞ ¼abP:a;b2RZ_qi

ofAin solving CDH problem is negligible.

Definition 4 (Bilinear Diffie–Hellman (BDH) problem). Given a random instance (P,aP,bP,cP)2G_qand for anya;b;c2RZ_q, it is impossible to compute^eðP;PÞ^abc.

Definition 5 (Bilinear Diffie–Hellman (BDH) assumption). If G is a BDH parameter generator, the polynomial time bounded adversaryAbreaks the BDH problem with negligi- ble probability, if for a given random instance (G_q,G_m,e, - P,aP,bP,cP), where the tuple (Gq,Gm,e) is the output of the BDH-PG G for sufficiently large security parameter k2Z^þ;ðP;aP;bP;cPÞ 2G_q and a;b;c2RZ_q, then the advan- tage Adv^BDH_G;AðkÞ ¼Prh

AðP;aP;bP;cPÞ ¼^eðP;PÞ^abc:a;b;c2R

Z_qi

ofAin solving BDH problem is negligible.

3. Model of CL-SDVS scheme 3.1. Definition of CL-SDVS scheme

In any CL-SDVS scheme, three entities are involved, namely the PKG, a signer and a designated verifier. The CL-SDVS scheme consists of the following algorithms:

Setup:It takes the security parameterk2Z^þas inputs and then generates PKG’s master secret keymskand the sys- tem’s parameterX.

Partial-Private-Key-Extract: It takesmsk, and an identity IDiof the userias inputs and outputs the partial private keyDifor the useri.

Set-Secret-Value: It takes the system’s parameter X, an identityIDiof the userias inputs and outputs a random numberx_ias the secret value of the userID_i.

Set-Private-Key:It takes the system’s parameterX, partial private keyD_i, secret valuex_iof the user ID_iand outputs the full private keyskiofIDi.

Set-Public-Key:It takes the system’s parameter X, secret value xi of IDi as inputs and outputs the full public key pkiofIDi.

CL-SDVS-Sign:It takes the system’s parameter X, full private key ski of the signer IDi, a message m2{0, 1}^*, full public key pk_j of the designated verifier IDj as inputs and then outputs a signature r on the message m.

CL-SDVS-Verify:It takes the system’s parameter X, full public keypkiof the signerIDi, private keyskjof the desig- nated verifier ID_j and a message-signature pair (r,m) as inputs and then outputs ‘true’ if the signature r is valid.

Otherwise, outputs ‘false’.

CL-SDVS-Simulation:The designated verifier IDj executes this algorithm to produce an identical signaturer⁰, which is indistinguishable from the signature rgenerated by the original signerIDi.

3.2. Attack model of CL-SDVS scheme

There are three types of adversaries with different capabilities in any certificateless CL-PKC system: the Type I adversaryAI

is an outsider who can access the system’s parameters only, the Type II adversary AIIis a dishonest user, and the Type III adversaryAIIIis a malicious PKG. The description of these adversaries is given below.

Type I adversaryAI.This type of adversary only knows the public parameters and tries to obtain PKG’s master private key to impersonate any user in the system.

Type II adversary AII.This type of adversary (public key replacement attacker) has no knowledge about users’ par- tial-private-keys, but can replace users’ public keys with a value of his own choice.

Type III adversaryAIII.This type of adversary (malicious PKG) has the knowledge about users’ partial-private-keys, but cannot replace users’ public keys.

The resilience of the attack made by the adversary AI is related to the security of the PKG key generation and this attack is not a strong attack, while the adaptive chosen mes- sage and identity attack caused by other two adversaries are considered as powerful attacks. The existential unforgeability of a CL-SDVS scheme against the adaptive chosen message and identity attack is defined (Yum and Lee, 2004; Hu et al., 2006; Yap et al., 2006; Zhang et al., 2006; Zhang and Feng, 2006; Huang et al., 2006; Choi et al., 2007; Du and Wen, 2007; Zhang and Zhang, 2008; Chen et al., 2008) by the following challenge-response games Game 1 and Game 2 played between a challenger Cand the adver- saryAIIorAIII.

Game 1:The challengerCplays this game with an adaptive chosen message and identity adversaryAIIfor breaking CL- SDVS scheme.

Setup:The challengerCtakes the security parameterk2Z^þ and runs the setup algorithm to generate the PKG’s secret key mskand the system’s parameter X. Then C sends X toAIIwhile keepingmsksecret.

Hash queries: The adversaryAIIcan request the hash value for any input.

Partial-Private-Key-Extract queries: The adversary AII

can ask for the partial private key of the user ID_i, C then computes the corresponding Di and sends it to AII.

Set-Secret-Value queries:The adversaryAIIcan ask for the secret value of the user IDi, C then computes the corre- sponding secret valuex_iand sends it toAII.

Set-Public-Key queries:The adversaryAIIcan asks for the full public key of the userIDi,Cthen computes the corre- spondingpk_iand send it toAII.

Public-Key-Replacement queries: The adversary AII can choose a new public key P⁰_i for the user ID_i and asks to replace the old public key Pi by P⁰_i. Then AII setsP⁰_i as the new public key ofID_iandCrecords it.

CL-SDVS-Sign queries: The adversaryAIIcan ask for a signature of the chosen message mi with signer’s identity ID_iand designated verifier’s identityID_j. ThenCexecutes CL-SDVS-Signalgorithm and outputs a message-signature pair (m_i,r_i) and returns it toAII.

CL-SDVS-Verify queries: The adversary AII can ask for the verification of a message-signature pair (m_i,r_i) with signer’s identityIDiand verifier’s identityIDj,Cthen runs CL-SDVS-Verify algorithm and outputs true if (mi,ri) is valid. Otherwise, outputs false.

Forgery: At the end of game AII outputs a valid forged tuple (m^*,r^*) with signer’s identityID_iand verifier’s identity IDj. The adversaryAIIcan win the above game if the fol- lowing holds:

(a) The signaturer^*is a valid signature of the messagem^* with signer’s identityID_iand verifier’s identityID_j. (b) The messagem^*has never been submitted to the CL- SDVS-Sign oracle with signer’s identity IDiand verifier’s identityID_j.

(c) The identitiesIDiandIDjhave never been submitted to the oracle Partial-Private-Key-Extract and Set-Secret- Value-Extract.

Definition 6. The probability that an adversaryAIIcan forge the CL-SDVS scheme under the adaptively chosen message and identity is defined asAdv^CMA_CLSDVS;A

IIðkÞ. The CL-SDVS signa- ture scheme is secure against the polynomial time bounded adversaryAII, if the probability of success to win game Game 1 defined above is negligible, i.e.,Adv^CMA_CLSDVS;A

IIðkÞ6e.

Game 2: This challenge-response game is played between the challengerCand an adaptive chosen message and identity adversaryAIII.

Setup:The challengerCtakes the security parameterk2Z^þ and runs the setup algorithm to generate the PKG’s secret key msk and the system’s parameter X. Then C sends X toAIIIwhile keeping themsksecret.

Hash queries: The adversaryAIIIcan request the hash value for any input.

Partial-Private-Key-Extract queries:The adversaryAIIIcan ask for the partial private key of the userIDi,Cthen com- putes the correspondingDiand sends it toAIII.

Set-Secret-Value queries: The adversary AIII can ask for the secret value of the userIDi,Cthen computes the corre- sponding secret valuex_iand sends it toAIII.

Set-Public-Key queries:The adversaryAIIIcan ask for the full public key of the userID_i,Cthen computes the corre- spondingpkiand sends it toAIII.

CL-SDVS-Sign queries: The adversaryAIIIcan ask for a signature for the chosen message miwith signer’s identity IDiand verifier’s identityIDj. ThenCexecutesCL-SDVS- Sign algorithm to output a message-signature pair (m_i,r_i) and then returns it toAIII.

CL-SDVS-Verify queries:The adversaryAIIIcan ask for the verification of a message-signature pair (mi,ri) with signer’s identityID_iand verifier’s identityID_j,Cthen runs CL-SDVS-Verify algorithm and outputs true if (mi,ri) is valid. Otherwise, outputs false.

Forgery: At the end of this game, AIII outputs a forged tuple (m^*,r^*) with signer’s identityID_iand verifier’s identity IDj. The adversaryAIIIcan win the above game if the fol- lowing holds:

(a) The signaturer^*is the valid signature of the messagem^* with signer’s identityIDiand verifier’s identityIDj. (b) The messagem^*has never been submitted to the CL- SDVS-Sign oracle with signer’s identity IDi and verifier’s identityID_j.

(c) The identitiesIDiandIDjhave never been submitted to the oracles Partial Set-Secret-Value and Public-Key- Replacement.

Definition 7. Now, we defineAdv^CMA_CLSDVS;A

IIIðkÞ as the prob- ability that an adaptively chosen message and chosen identity adversaryAIIIcan win the Game 2. The CL-SDVS scheme is secure against AIIIadversary ifAdv^CMA_CLSDVS;A

IIIðkÞ is negligi- ble, i.e.,Adv^CMA_CLSDVS;A

IIIðkÞ6e.

Definition 8. The CL-SDVS scheme is existentially unforge- able against adaptive chosen message and chosen identity attack if it is secure against the adversaries AII and AIII, i.e., if both Adv^CMA_CLSDVS;A

IIðkÞ6e and Adv^CMA_CLSDVS;A

IIIðkÞ6e

hold simultaneously.

4. The proposed CL-SDVS scheme

In this section, we describe our secure and computationally efficient CL-SDVS scheme, which is developed based on ellip- tic curve bilinear pairings. We assume thatAlice, the original signer with identity IDA, has the full private key skA= (- D_A,x_A) and public keypk_A= (Q_A,P_A), andBobis the desig- nated verifier who has the identity IDB, full private key sk_B= (D_B,x_B) and full public key pk_B= (Q_B,P_B). The pro- posed CL-SDVS scheme consists of the following algorithms:

Setup:This algorithm takes a security parameterk2Z^þas input, and returns a system’s parameter and a master key.

Givenk, the PKG does the following:

(a) Choose an additive elliptic curve cyclic group (Gq, +) of prime order qP2^k, a multiplicative group (G_m,Æ) of the same prime order q and an admissible bilinear pairing map ^e:G_qG_q!G_m as defined in Boneh and Franklin (2001).

(b) Choose a numbers2RZ_pand a generator pointPof the groupGq, and computeP0=sP, where (s,P0=sP) is the private/public key pair of PKG.

(c) Choose three secure and one-way cryptographic hash functions H1:f0;1g!Gq; H2:f0;1gGq!Z_q and H3:f0;1gGmGm!Z_q. The hash function H₁ is called themap-to-pointhash function (Boneh and Franklin, 2001), which is used to map a random binary string of arbi- trary length to a point of the elliptic curve groupGq, while H2andH3are the general hash functions (i.e., SHA family, MD family, etc.).

(d) The system parameters, represented by the vector X¼ fGq;Gm;^e;q;P;P0;H1;H2;H3g, is known to every- one associated with the system; however, the master keymsk=sis private and only known to PKG.

Partial-Private-Key-Extract: This algorithm takes the sys- tem’s parameter X, the master private key s and a user’s identityID_i2{0, 1}^*as inputs and generates the partial pri- vate key for the userIDias follows:

(a) ComputeQi=H1(IDi).

(b) Compute the partial private keyD_i=sQ_iand send to the userIDithrough a secure and authenticated channel.

Set-Secret-Value:The userID_ipicks a numberxi2RZ_q, com- putesPi=xiPand setsxias his secret value.

Set-Private-Key:The userID_isetssk_i= (D_i,x_i) as his full private key.

Set-Public-Key:The user IDi sets pki= (Qi,Pi) as his full public key.

CL-SDVD-Sign:The signerAlicechooses a numberr2RZ_q and then generates a designated verifier signature on a mes- sagem2{0, 1}^*for the designated verifier Bob in the fol- lowing way:

(a) Computeg¼^eðDA;Q_BÞandh=H2(m,xAPB).

(b) ComputeR¼^eðP0;Q_BÞ^rhandt=H3(m,g,R).

(c) ComputeV=rhP0+tDAandS¼^eðV;Q_BÞ.

(d) Output the signature (R,S) and send to Bob for verification.

CL-SDVD-Verify:On receiving the signature (R,S) and the messagem, the verifierBobdoes the following:

(a) Computeg¼^eðQ_A;DBÞandt=H3(m,g,R).

(b) ComputeS⁰⁰=RÆg^tand check whetherS⁰⁰=Sholds.

If so,Bobaccepts the signature (R,S), otherwise he rejects the signature.

CL-SDVS-Simulation: Bobcan efficiently produce a valid signatureðR;b bSÞ on a message m intended for himself as follows:

(a) Choose a number ^r2RZ_q, compute ^g¼^eðQ_A;DBÞ and

^h¼H₂ðm;x_BP_AÞ.

(b) ComputebR¼^eðP0;Q_BÞ^{^r^h}and^t¼H3ðm;^g;bRÞ.

(c) ComputebS¼bRg^{^t} and output the signatureðbR;bSÞ.

It can be verified that the simulatedðbR;bSÞis a valid signa- ture on a given messagem.

Correctness of the proposed scheme: Since g¼^eðDA;Q_BÞ ¼^eðQ_A;DBÞ and t=H3(m,g,R). Therefore, we obtain

S¼^eðV;Q_BÞ

¼eðrhP^ 0þtDA;Q_BÞ

¼eðrhP^ 0;Q_BÞ^eðtDA;Q_BÞ

¼eðP^ 0;Q_BÞ^rh^eðDA;Q_BÞ^t

¼eðP^ 0;Q_BÞ^rh^eðQ_A;DBÞ^t

¼Rg^t

This proves the correctness and soundness of the proposed CL-SDVS scheme. h

5. Security analysis of the proposed CL-SDVS scheme In this section, we present the security proof of the proposed CL-SDVS scheme against different adversaries with different powers in the random oracle model (Bellare and Rogaway,

1993). We also show that our scheme satisfies other security properties such as strongness,source hiding andnon-delegat- ability of an SDVS scheme (Yang et al., 2009; Xiao et al., 2010). Note that the security of the proposed scheme depends on the hardness assumption of ECDLP, BDH and CDH prob- lems in the elliptic curve group.

5.1. Unforgeability against Type I adversary

Theorem 1. The proposed CL-SDVS scheme is existentially unforgeable against Type I adversary AI with the hardness assumption of ECDLP in the elliptic curve group.

Proof. The adversary AI has the knowledge about system’s parameter X¼ fGq;G_m;e;^q;P;P₀;H₁;H₂;H₃g, where P0=sP. The adversaryAIcan impersonate any userIDiin the system if the master private key msk=s is known to him. Note that there is no use of certificate of the public key P_i=x_iP; therefore, knowing the maser private key msk,A_I can impersonate the userIDiby choosing a randomxiof his choice. To knows,AItries to obtain it from the PKG’s public key P₀, however, it is computationally infeasible to derives fromP0 due to the difficulties of solving the ECDLP in the elliptic curve groupG_q. As far as we know, there is no polyno- mial time bounded algorithm so far, which can solve the ECDLP problem with non-negligible advantage. Thus, the proposed CL-SDVS scheme is secure against the adversary AIunder the ECDLP problem. h

5.2. Unforgeability against Type II adversary (resilience against public key replacement attack)

Theorem 2. The proposed CL-SDVS scheme is existentially unforgeable under the adaptive chosen message and identity attacks against the adversaryAIIin random oracle model if the BDH problem is hard to break by a polynomial time bounded algorithm.

Proof. Assume that the probabilistic polynomial time bounded adversaryAIIwho can breach our CL-SDVS scheme under the adaptively chosen message and identity attacks in the random oracle model with probabilityeand within a time boundt, then we show that there exists an algorithmCthat can useAIIas black box to solve the BDH problem with a non-negligible prob- ability and within the polynomial timet. That is, for given a ran- dom instance (P,aP,bP,cP)2G_q and for the unknowns a;b;c2RZ_q; Ccan computeeðP;^ PÞ^abc. To solve the BDH prob- lem,CsetsX¼ fGq;Gm;^e;q;P;P0¼aP;H1;H2;H3g, returns it toAIIand then replies in the following way:

Hash queries to H₁: Assume that AIIis allowed to ask at mostqH1timesH1queries andCmaintains an initial-empty listL^list_H1that consists of the tuple of the form (ID_i,Q_i,d_i) to avoid any collision and inconsistency. Suppose the adver- sary AII asks a H₁ query with ID_i, C then responds as follows:

(a) IfID_i=ID_A, then returnQ_i=H1(ID_i) =bPand add the tuple (ID_i,Q_i,^) to the listL^list_H1.

(b) Else, ifIDi=IDB, then returnQi=H1(IDi) =cPand add the tuple (ID_i,Q_i,^) to the listL^list_H1.

(c) Else, returnQ_i=H₁(ID_i) =d_iP, and add the tuple (IDi,Qi,di) to the listL^list_H1, wheredi2RZ_q.

Partial-Private-Key-Extract queries:The algorithmCmain- tains an initial empty-listL^list_ppke, which contains the tuple of the form (ID_i,D_i,x_i,P_i). On receiving a Partial-Private- Key-Extractquery onIDi,Cfirst recovers the tuple (IDi, - Q_i,d_i) from the listL^list_H1 and then replies as follows:

(a) If (ID_i=IDA, IDB), then C aborts the protocol execution.

(b) Else (ID_i„ID_A,ID_B),Cexecutes the following:

– If the listL^list_ppke contains a tuple (IDi,Di,xi,Pi) and if D_i„ ^,Cthen returnsD_ias answer toAII. Else,C chooses a number di2RZ_q and returns Di=di(aP) as thepartial private keytoID_i, and then adds it to the listL^list_ppke.

– If the listL^list_ppkedoes not contain a tuple (IDi,Di,xi,Pi), C then chooses a number di2RZ_q and returns Di= di(aP) to IDi. Afterwards, C sets (xi,Pi) = (^,^) and includes (ID_i,D_i,x_i,P_i) in the listL^list_ppke.

Public-Key-Extract queries: When AII submits a Public- Key-Extract query for the user ID_i, C searches the list L^list_ppke for a tuple (IDi,Di,xi,Pi), which is indexed by IDi

and then returns the output as follows:

(a) If a tuple (ID_i,D_i,x_i,P_i) is found in the listL^list_ppke and – IfPi„ ^, thenCreturnsPias an answer.

– Else (P_i=^),Cchooses a numberxi2RZ_q, computes Pi=xiP, returnsPi as an answer and then inserts (x_i,P_i) into the listL^list_ppke.

(b) Else (there is no such (IDi,Di,xi,Pi) inL^list_ppkeÞ; Cchooses ax_i2RZ_q, setsD_i=^andP_i=x_iP, outputsP_ias an answer and inserts the tuple (xi,Pi) to the listL^list_ppke.

Set-Secret-Value queries: Assume that AII asks a Set- Secret-Valuequery for the userIDi,Cfirst looks into the list L^list_ppkeand then replies in the following way:

(a) If (ID_i=ID_A,ID_B), thenCaborts the simulation.

(b) Else (IDi„IDA,IDB),Csearches the listL^list_ppkeand – If the listL^list_ppkecontains a tuple of the form (ID_i,D_i,x-

i,Pi), Cchecks whether Di=^holds. If so, Cexe- cutes the Partial-Private-Key-Extract query to obtain Di. If Pi=^, C executes the Public-Key- Extract query to obtain (xi,Pi=xiP). Then, C returns x_i and adds the full private key (D_i,x_i) to the listL^list_ppke.

– Else, (there is no tuple such (ID_i,D_i,x_i,P_i) inL^list_ppkeÞ; C executes the Partial-Private-Key-Extract query to obtainD_iand thePublic-Key-Extract queryto obtain (xi,Pi). Then,Creturnsxiand adds the full private key (D_i,x_i) to the listL^list_ppke.

Public-Key-Replacement queries:Suppose the adversaryAII

makes aPublic-Key-Replacementquery onðIDi;P⁰_iÞ; Cthen searches the listL^list_ppke and returns the output as follows:

(a) If the listL^list_ppke contains a tuple of the form (IDi,Di,xi, P_i),C setsP_i¼P⁰_i¼x⁰_iP and then updates the tuple (ID_i, Di,xi,Pi) toIDi;Di;x⁰_i;P⁰_i

.

(b) Else (there is no such tuple in the list L^list_ppkeÞ; C sets Di¼?;Pi¼P⁰_i¼x⁰_iP and then adds the tuple

ID_i;?;x⁰_i;P⁰_i

to the listL^list_ppke.

Hash queries to H2: The algorithmCmaintains an initial- empty list L^list_H2, which contains the tuple of the form (ID_i,ID_j,m_i,R_1i,h_i) and AIIis allowed to ask at mostq_H2 times H2 queries. If AII requests a H2 hash value for

(m_i,R_1i) with the signer identityID_iand designated verifier’s identityIDj,Creturns the outputs in the following way:

(a) If (ID_i,ID_j,m_i,R_1i,h_i) is found in the listL^list_H2; Cthen outputshias an answer.

(b) Else (no such tuple is found there),Cchooses a num- berhi2RZ_q, returns it as the answer and inserts the tuple (ID_i,ID_j,m_i,R1i,h_i) into the listL^list_H2.

Hash queries to H3:We assume thatAIIcan askH3queries at mostqH3times andCmaintains an initial-empty listL^list_H3of tuple (ID_i,ID_j,m_i,g_i,R_i,t_i). WhenAIImakes aH₃queries on (mi,gi,Ri) with the signer identityIDiand designated veri- fier’s identityID_j,Creturns the answer as follows:

(a) If a tuple (IDi,IDj,mi,gi,Ri,ti) exists inL^list_H3; Cthen returnst_ias the output.

(b) Else,Cchooses ati2RZ_q, returns it as the answer and then adds (IDi,IDj,mi,gi,Ri,ti) to the listL^list_H3.

CL-SDVD-Sign queries:Assume thatAIIcan ask at most qStimesCL-SDV-Signqueries toC. WhenAIIasks for a signature on a chosen messagem_i2{0, 1}^*with the signer’s identity IDi and designated verifier’s identity IDj, Cthen responds as follows:

(a) IfIDi„IDAandIDj„IDB,Ccomputes the private key (D_i,x_i) = (d_i(aP),x_i) of ID_i, chooses a numberr_i2RZ_q, the valueshi,tifrom the listsL^list_H2 andL^list_H3, respectively, and then computes the signature as given below:

– Computeg_i¼^eðDi;Q_jÞand setH₂(m_i,x_iP_j) =h_i – ComputeRi¼^eðP0;Q_jÞ^rihiand setH3(mi,gi,Ri) =ti. – ComputeV_i=r_ih_iP₀+t_iD_iandSi¼^eðVi;Q_jÞ.

– Output the signature (Ri,Si).

(b) IfID_j„ID_BandID_i„ID_A,CcomputesID_j’s private key (Dj,xj) = (dj(aP),xj), chooses a numberrj2RZ_q, col- lects the valuesh_j,t_jfrom the listsL^list_H2 andL^list_H3, respec- tively, and then computes the signature as follows:

– Computeg_j¼^eðQ_i;DjÞand setH2(mi,xjPi) =hj. – ComputeRj¼^eðP0;Q_jÞ^rjhjand setH₃(m_i,g_j,R_j) =t_j. – Compute Sj¼Rjg^t_j^j and output the signature (R_j,S_j).

(c) Otherwise, abort the protocol’s execution.

CL-SDVS-Verify queries:Assume thatAIIcan ask at most qVtimesCL-SDVD-Verifyqueries toC. WhenAIImakes a CL-SDVS-Verify query on the input signature (R,S) with the signer’s identity ID_i and designated verifier’s identity IDj,C checks whether (IDi,IDj) = (IDA,IDB) or (IDi,IDj)

= (ID_B,ID_A) holds.

(a) If it holds,Caborts the protocol execution.

(b) Else,Ccomputes the private key (D_j,x_j) = (d_j(aP),x_j) of IDj and verifies the signature using the proposed CL-SDVS-Verifyalgorithm.

Forgery:Finally, the adversaryAIIgenerates a valid forged signature (R^*,S^*) on a chosen messagem^* for the signer’s identity ID_i and designated verifier’s identity ID_j with non-negligible probability. If (IDi,IDj)„(IDA,IDB) or (ID_i,ID_j)„(ID_B,ID_A) holds,Coutputs ‘failure’ and termi- nates the protocol execution; otherwise outputs a valid sig- nature (R^*,S^*) witht^*on the chosen messagem^*. Therefore, from the valid signature (R^*,S^*),Ccan compute

S¼ReðQ_A;SBÞ^t )eðQ_A;SBÞ ¼ ðS=RÞ^1=t )eðbP;acPÞ ¼ ðS=RÞ^1=t )eðP;PÞ^abc¼ ðS=RÞ^1=t

Thus, the BDH problemeðP;PÞ^abc¼ ðS=RÞ^1=t is solved for the given random tuple (P,aP,bP,cP)2Gq, where a;b;c2RZ_q are unknown toC. However, it is known that the BDH problem is unsolvable by any probabilistic polynomial time bounded algorithm, and hence, our CL-SDVS scheme is secure in the random oracle model under the adaptive chosen message and identity attacks against the adversaryAII. h

5.3. Unforgeability against Type III adversary (resilience against malicious PKG attack)

Theorem 3. The proposed CL-SDVS scheme is existentially unforgeable against the adversary AIII under the adaptive chosen message and identity attacks in the random oracle model provided the CDH problem is intractable in the elliptic curve group Gq.

Proof. Suppose that an adversaryAIIIcan forge the proposed CL-SDVS scheme with probabilityeand within a time bound t, then there exists a probabilistic polynomial time bounded algorithmC, which can solve an instance of the CDH problem with non-negligible probability. That is, for given a random instance (P,aP,bP)2G_q, wherea;b2RZ_q; CoutputsabP. To solve the CDH problem,Cselects a numberk2RZ_q and sets the system’s parameter X¼ fGq;G_m;^e;q;P;P₀¼kP;H₁;H₂; H3g, returns (X,k) toAIIIand then answersAIII’s queries in the following way. In order to avoid collisions and consistently respond toAIII’s queries,Ckeeps an initial-emptyPartial-Pri- vate-Key-Extract list L^list_ppke, which consists of a tuple of the form (ID_i,x_i,P_i).

Hash queries to H₁:Assume thatAIII can ask at mostq_H1 timesH1queries toC. The algorithmCmaintains an initial- empty listL^list_H1that contains the tuple of the form (ID_i,Q_i,d_i).

WhenAIIImakes aH1query onIDi,Cbehaves as follows:

(a) Search the listL^list_H1and respond with the previous value diif a tuple (ID_i,Qi,di) is found.

(b) Else, returnQi=H1(IDi) =diP, and include the tuple (ID_i,Q_i,d_i) into the listL^list_H1, wheredi2RZ_q.

Public-Key-Extract queries: When AIII queries on input ID_i,Csearches the listL^list_ppkeand answers as follows:

(a) If the listL^list_ppke contains a tuple of the form (IDi,xi,Pi) and

– IfIDi=IDA,CreturnsPi=aPas an answer and inserts (IDi,^,Pi) intoL^list_ppke.

– IfIDi=IDB,CreturnsPi=bPas an answer and inserts (IDi,^,Pi) intoL^list_ppke.

– IfID_i„ID_A,ID_B,Creturns the previousP_ias the answer.

(b) Else (there is no such tuple),Cpicks a numberx_i2RZ_q, returnsPi=xiPas the answer and then adds the tuple (ID_i,x_i,P_i) to the listL^list_ppke.

Set-Secret-Value queries:WhenAIIIasks for aSet-Secret- Valuequery withIDi,Cperforms as follows:

(a) If (ID_i=ID_A,ID_B), thenCterminates the process.

(b) Else (IDi„IDA,IDB), C searches the list L^list_ppke and answers as follows:

– If the list L^list_ppke contains a tuple (IDi,xi,Pi) and if P_i=^,Cexecutes thePublic-Key-Extractquery in order to obtain (IDi,xi,Pi), returnsxias the answer and inserts the tuple (ID_i,x_i,P_i) to the listL^list_ppke.

– Else (there is no tuple such tuple inL^list_ppkeÞ; Cthen exe- cutes thePublic-Key-Extractquery to obtain (IDi,x-

i,P_i). Subsequently,C saves the value and adds the secret keyxito the listL^list_ppke.

Hash queries to H₂: The adversaryAIIIis allowed to ask utmostqH2timesH2queries toC. The algorithmCmain- tains an initial-empty list L^list_H2 that contains tuples of the form (ID_i,ID_j,mi,R_1i,hi). When AIIImakesH2 queries on (mi,R1i) with the signer identityIDiand designated verifier’s identityID_j,Creturns the previous value from the listL^list_H2if a tuple of the form (IDi,IDj,mi,R1i,hi) is found; otherwise, it chooses ahi2RZ_q, returns it as the answer and then adds (IDi,IDj,mi,R1i,hi) to the listL^list_H2.

Hash queries to H₃: The adversaryAIIIis allowed to ask utmostqH3timesH3queries toC. The algorithmCmain- tains an initial-empty list L^list_H3 that contains tuples of the form (ID_i,ID_j,mi,g_i,R_i,t_i). When AIII makes H3 queries on (mi,gi,Ri) with the signer identityIDiand designated ver- ifier’s identityID_j,Creturns the previous valuet_ifromL^list_H3 if a tuple of the form (IDi,IDj,mi,gi,Ri,ti) existed; other- wise,Cchooses a numbert_i2RZ_q, returns it as the answer and then adds the tuple (IDi,IDj,mi,gi,Ri,ti) into the list L^list_H3.

CL-SDVD-Sign queries:Assume thatAIIIcan ask at most qStimesCL-SDV-Signqueries toC. WhenAIIIasks for a signature on message m_i2{0, 1}^*chosen by him with the signer’s identity IDi and designated verifier’s identityIDj, Cresponds as follows:

(a) IfIDi„IDAandIDj„IDB,Ccomputes the private key (D_i,x_i) = (k(d_iP), x_i) ofID_i, chooses a numberr_i2RZ_q, recovershiandtifrom the listsL^list_H2andL^list_H3respectively, and then computes the signature as follows:

– Computeg_i¼^eðDi;Q_jÞand setH2(m_i,x_iPj) =hi. – ComputeRi¼^eðP0;Q_jÞ^rihiand setH3(mi,gi,Ri) =ti. – ComputeV_i=r_ih_iP₀+t_iD_iandSi¼^eðVi;Q_jÞ.

– Output the signature (Ri,Si).

(b) IfID_j„ID_BandID_i„ID_A,Ccomputes the private key (Dj,xj) = (k(djP), xj) ofIDj, chooses a numberri2RZ_q, recoversh_iandt_ifrom the listsL^list_H2andL^list_H3respectively, and then computes the signature as follows:

– Computeg_j¼^eðQ_i;D_jÞand setH2(mi,xjPi) =hj. – ComputeRj¼^eðP0;Q_jÞ^rjhjand setH₃(m_i,g_j,R_j) =t_j. – Compute Sj¼Rjg^t_j^j and output the signature (R_j,S_j).

(c) Otherwise, terminate the protocol execution.

CL-SDVS-Verify queries:Assume thatAIIIcan ask at most qVtimesCL-SDVD-Verifyqueries toC. WhenAIIImakes aCL-SDVS-Verifyquery on the input signature (R,S) with the signer’s identityIDiand verifier’s identityIDj, then C checks whether (IDi,IDj) = (IDA,IDB) or (IDi,IDj) = (ID-

B,ID_A) holds.

(a) If it holds,Cterminates the protocol execution.

(b) Otherwise, C computes the private key (Dj,xj) = (rj(kP),xj) of IDj to verify the signature by using theCL-SDVS-Verifyalgorithm.

Forgery: Eventually, the adversary AIII outputs a valid forged signature (R^*,S^*) on the chosen messagem^*for the signer IDi and designated verifier IDj with non-negligible probability. If (IDi,IDj)„(IDA,IDB) or (IDi,IDj)„(ID-

B,ID_A) holds,Coutputs ‘failure’ and stops the protocol exe- cution. Otherwise,Csearches the listL^list_H2for the tuple of the

form m;x_iP_j;h_i

. If no such tuple is found, Coutputs

‘failure’; otherwise, C outputsabP¼x_iP_j as the solution of the CDH problem.

Hence,Cbreaks the CDH problem for given (P,aP,bP)2G_q, where a;b2RZ_q are unknown. Thus, the proposed CL-SDVS scheme is secure in the random oracle model under the adaptive chosen message and identity attacks against the adversary AIII. h

Theorem 4. The proposed CL-SDVS scheme satisfies the strongness, source hiding and non-delegatability properties of a strong designate verifier signature scheme.

Proof. The proposed CL-SDVS scheme is astrong designated verifier signature scheme. For the verification of the signature (R,S), the private keysk_B= (D_B,x_B) ofBob(designated veri- fier) is required and thus, an outsider can neither verify the sig- nature (R,S) nor prove thatAlice(original signer) orBobhas generated the signature. Therefore, the strongnessproperty is satisfied in our proposed CL-DSVS scheme. It can be noted that Bobcan generate a simulated signature ðR;b SÞ, which isb indistinguishable from the normal signature (R,S) created by Alice. Therefore, an outsider cannot identify that (R,S) is signed byAliceorBobeven if all the private keys are known.

Thus, thesource hidingproperty is achieved in our scheme. In addition, Bob cannot prove to an outsider that the signature (R,S) is computed either by him orAlice. Suppose that (R⁰,S⁰) is chosen at random from the set of all valid signatures designed for Bob, then the probability Pr[(R,S) = (R⁰,S⁰)] = 1/(q1), since the signature (R,S) is computed based on the integerr, which is chosen randomly from the set Z_q. Similarly, we can write Pr½ðR;b SÞ ¼ ðRb ⁰;S⁰Þ ¼1=ðq1Þ. Therefore, the simu- lated signature and the original signature have the identical dis- tribution, and thus, they are indistinguishable from each other.

Hence, the proposed CL-SDVS scheme satisfies thenon-deleg- atability property through the CL-SDVS-Simulation algorithm. h

For a further security discussion, three trust levels, defined byGirault (1992)to reduce the degree of trust that users need to have in the PKG, can easily be achieved in our proposed CL-SDVS scheme. The Theorems 2 and 3 discussed earlier confirm that the proposed scheme achieves Girault’s first two trust levels 1 and 2. The discussions about the Girult’s trust le- vel 3 made by Al-Riyami and Paterson (2003) and Gorantla and Saxena (2005) indicate that the adversary AIII(i.e., untrusted PKG) can still impersonate a userIDiwithout know- ing the corresponding secret keyx_i, i.e., the PKG can forge a valid signature by replacing the original public key Pi=xiP with a fake public key P⁰⁰_i ¼x⁰⁰_iP of its own choice. Because the PKG can calculate the partial private key D_i=sQ_iand generate another valid key pair ðDi;P⁰⁰_iÞ for the user IDi, so the PKG can impersonate the valid userID_iwithout being de- tected, and it happened because the user withIDican also gen- erate another valid key pair ðDi;P⁰_iÞ corresponding to the partial private keyDias the partial private keyDiand the pub- lic keyPiare generated independently. Note that this type of attack may occur only by the adversary who has access to the PKG’s master private keys, i.e., Type III adversary AIII

in our scheme as defined earlier.