A Secure Strong Proxy Signature Scheme with Proxy Signer Privacy Protection

Transcription

1 A Secure Stron roxy Sinature Scheme ith roxy Siner rivacy rotection Youn-Ho Lee, Seon-in Hon and Hyunoo Yoon Diviion of Comuter Science, Deartment of Electric Enineerin and Comuter Science Korea Advanced Intitute of Science and echnoloy, aejon, Korea ABSAC A roxy inature cheme enable an entity to deleate it inin riht to another entity. Since the roxy inature concet a rooed by ambo et al., many variant cheme have been aeared. In thi aer, e rooe a ne roxy inature cheme ith a roxy iner' rivacy rotection. In roxy iner' rivacy cenario, the identity of the roxy iner cannot be revealed in a roxy inature unle the alia authority reveal it. he verifier only kno that the roxy iner i certified by the alia authority. he anonymity of the roxy iner ive an additional alication uch a electronic votin, electronic cah. In 2002, Shum et al. firtly rooed a cheme. But thi cheme a broken becaue it i baed on the LKK roxy inature cheme hich i knon to be inecure. We modify the trile Schnorr cheme and aly the modified reult to our cheme. Keyord: roxy Sinature, Diital Sinature, Security, rivacy rotection 1. Introduction he concet of roxy inature, introduced by ambo, Uuda and Okamoto in 1996, rovide a method for an oriinal iner to deleate inin caabilitie to a roxy iner [1]. By the caability of deleatin inin riht, the roxy inature cheme can be alied to many ractical alication, uch a rid comutin [2], mobile aent alication [3-4], ditributed ytem [5-6], lobal ditributed netork [7], mobile communication [8]. ambo et al. claified the roxy inature cheme accordin to the tye of deleation a full deleation, deleation by certificate, and artial deleation [1]. In 1997, Kim et al. rooed a ne tye of roxy inature hich i called "artial deleation ith arrant" and ueted a ne roxy inature cheme in thi tye [9]. he artial deleation ith arrant tye ha antae comarin to both artial deleation tye and deleation by certificate becaue it need le comutational cot for the roxy inature verification than deleation-by-certificate cheme. oreover, it ha an ability of limitin the inin caability that artial deleation tye doe not have. After the firt rooal of the artial deleation ith arrant tye, many extenion of the baic cheme are rooed [8,11-12,14-15]. One of thee extenion i the roxy inature cheme ith roxy iner' rivacy rotection [11]. In 2002, Shum et al. firtly rooed a roxy inature cheme ith roxy iner' rivacy rotection uin the Lee et al.' baic roxy inature cheme [4,11]. Unfortunately, Shum et al.' cheme i analyzed and hon that ithout roxy iner' areement, the oriinal iner can enerate the roxy inature a if the roxy iner enerate it [16]. o the bet of our knolede, there exit no ecure roxy inature cheme ith reervin the rivacy of the roxy iner. Our contribution i the rooal of a ne roxy inature cheme ith roxy iner rivacy rotection. We modify the trile Schnorr roxy inature cheme and aly it to the roxy iner' rivacy rotection cenario. In mot cae, the roxy inature cheme uin the Schnorr inature at deleation hae i hon to be inecure becaue the random commitment hich i ued for a art of the Schnorr inature a deleation information can be abued by maliciou oriinal iner [13,16-17]. So, e concentrate on removin the effect of the random commitment at deleation hae. he oranization of our aer i a follo. In ection 2, e reent the reliminarie. In ection 3, e decribe the trile Schnorr roxy inature cheme. In ection 4, e reent our ne roxy inature cheme ith roxy iner' rivacy rotection. In ection 5, e conider the ecurity aect of the rooed cheme. Finally, e ive a concluion in ection reliminary

2 In thi ection, e ive the baic cenario and ecurity reuirement of the roxy inature cheme ith roxy iner rivacy rotection. At next, e reent the notation hich are ued in the aer. We rovide ome aumtion for our cheme at lat of the ection. Baic Scenario In the roxy inature cheme ith roxy iner rivacy rotection, there are five te [11,16]. hee are Iuin Alia, Deleation, roxy Sinature Generation, roxy Sinature Verification, and evokin rivacy. he detailed exlanation of each te i a follo. Iuin alia: In thi te, the alia authority end an alia and an anonymou rivate key to the roxy iner. he alia value rereent an anonymou identity of the roxy iner and i ued for eneratin the anonymou ublic key of the roxy iner. he alia value alo can be ued for findin the real identity of the roxy iner at rivacy revocation hae. Deleation: hi te rereent ho the oriinal iner deleate the inin riht to roxy iner. It i aumed that the anonymou identity of the roxy iner i knon ublicly. In thi te, the oriinal iner enerate roxy information that include a decrition of inin riht deleated. he roxy iner can verify that the roxy information i enerated by the oriinal iner. roxy inature eneration: he roxy iner enerate a roxy inin key uin the roxy information and the anonymou rivate key of the roxy iner. After that, the roxy iner erform the roxy inature eneration rocedure for a meae to be ined uin the roxy inin key. roxy inature verification: he verifier ho receive the roxy inature erform the roxy inature verification. hi te conit of roxy ublic key eneration and roxy inature verification. he roxy ublic key can enerated ith the ublic key of the oriinal iner and the alia authority, and the art of the roxy inature. he roxy inature verification rocedure i the ame a the tandard diital inature verification. In thi rocedure, the roxy ublic key i ued a the ublic key for the tandard diital inature verification. evokin rivacy: If needed, the real identity of roxy iner can be revealed by endin the alia of the roxy iner to the alia authority. Security euirement he ecurity reuirement of the roxy inature cheme ith rivacy rotection are a follo [11]. Comared ith the ecurity reuirement of the oriinal roxy inature cheme [1,4], roxy rivacy and rivacy revocation are added and Stron identifiability i omitted [11]. Verifiability: A verifier can be convinced of the oriinal iner' areement by the roxy inature. Stron unforeability: Only the deinated roxy iner can enerate a valid roxy inature. Stron non-reudiation: A roxy iner cannot reudiate the valid roxy inature hich the roxy iner enerate. roxy rivacy: he identity of the roxy iner cannot be revealed from the roxy inature ithout the alia authority' hel. rivacy revocation: he cheme hould rovide a ay to reveal the roxy iner' identity, hich i reuired in ome excetional cae. Notation he notation ued for our aer are decribed belo.,,, V : oriinal iner, roxy iner, alia authority and verifier reectively. { 0,1} : et of all binary trin of finite lenth. : concatenation oeration., : rime number uch that 2 1. : enerator of order in Z. h, : a ecure hah function uch that h. We aume that all number can be :{0,1} {0,1} Z tranformed to binary trin. x A Z : rivate key of A. y A A x mod : ublic key of A. Z, r Z :, r i a Schnorr diital inature enerated by. Later ill be ued for anonymou roxy inin key by. m {0,1} : arrant hich decribe the inin riht deleated to the roxy iner. m, Z, r Z : deleation information hich i enerated by the oriinal iner. h {0,1} : anonymou alia of a roxy iner. Sin m, x : dicrete loarithm roblem baed inin alorithm. m {0,1} i a meae to be ined and x F i the rivate key ued for inin. We aume that the inature i unforeable and non-reudiable. Verify, m, y : dicrete loarithm baed inature verification alorithm hich i matched to Sin m, x. If Verify, m, y return 1, then i the diital inature by the reult of Sin m, x, m {0,1} i the meae hich i ued for eneratin, and y Z i the ublic key hich

3 i matched to the rivate key x for eneratin. Otherie, it return 0. Baic Aumtion In the ret of our aer, e aume that the rime number, and enerator are knon ublicly. he ublic key i knon ublicly and anyone can kno ho the oner of the iven ublic key i. For removin the roue key attack, e alo aume that the oner of the ublic key ha roved the oeion of the matchin rivate key at the ublic key reitration te. 3. rile Schnorr roxy inature cheme In thi ection, e reent the trile Schnorr cheme \cite{[10]}. he decrition of the oeration i a follo. A. Deleation: Folloin rocedure i done for deleatin the inin riht of to 1 enerate a deleation arrant m. 2 enerate a random number k Z. k 3 comute r mod, e h 0 m y y, r and 4 end e x k mod. m, y,, r to. 5 verifie the validity of the deleation by checkin the euality of mod y h0 m y y, r r mod B. roxy inature eneration: erform the folloin rocedure for eneratin a roxy inature for a meae m {0,1} 1 Generate roxy inin key x h 0 m y y, r x mod h0 m y y, r x x k mod 2 Generate random number r k mod k Z and Comute 3 Comute h 1 m m y y r, r x k mod 4 Outut i m, m, r,, r, y, y C. roxy inature verification: If a roxy inature m, m, r,, r, y, y i ent by, V erform the folloin rocedure for verifyin the roxy inature 1 Generate roxy ublic key y y y h0 m y y, r r mod 2 Check the euality of the folloin euation: h1 m m y y r, r mod y r mod. if ae, the inature i valid. 4. rooed Scheme In thi ection, e reent a ne roxy inature cheme ith roxy iner rivacy rotection. Our cheme can be vieed a an enhancement of the trile Schnorr roxy inature cheme. ore ecifically, e inerted Iuin alia tae before Deleation tae of the trile Schnorr roxy cheme and aroriately modified the other tae. Note that the ecurity of trile Schnorr cheme can be reducible to that of the Schnorr diital inature cheme becaue the roxy ublic key i enerated to the form of y h m, r r in Ste 3-C-1 hich i ued to the Schnorr inature verification; many roxy inature cheme hich do not ue thi form for roxy ublic key have been found to be inecure [13,16-17]. Becaue the roxy ublic key in our cheme ha the form of { y r, hich i the form that the Schnorr h m 1, r1 } h m2, r2 r1 2 diital inature i ued tice. hi enable u to rove ecurity of our cheme.t. ecurity of our cheme i reducible to that of Schnorr diital inature hich ill be hon in Section 5. he detailed decrition of our rooed rotocol i decribed belo. We aume that the oriinal iner kno the alia of the roxy iner. A. Iuin Alia: et hi/her anonymou identity and anonymou rivate key from by the folloin rocedure. 1 end hi identity ID {0,1} to 2 enerate k Z and comute ' anonymou

4 identity h h k, ID. 3 enerate a random number k Z, r k mod, and h h, r x k mod. 4 end h, r, to ith a ecure manner. 5 verifie the validity of received value by checkin the folloin euation: h h, r mod y r mod E. 1 6 tore h, ID, k for later uae at the rivacy revocation hae. B. Deleation: deleate hi/her inin riht to by the folloin rocedure. hi te i different from the reviou aroach becaue e do not ue the Schnorr diital inature for deleation but modify it. emind that e aume that oriinal iner kno the roxy iner' alia 1 enerate m and random number h, r. k Z. 2 comute r k mod and { h h, r x } h m, r k mod. 3 end m, r, to. 4 check the validity of received value by verifyin the folloin euation: mod y { h h, r h m, r } r mod...e. 2 C. roxy inature eneration: After makin the roxy inin key, enerate a roxy inature for a iven meae $m$. he detailed rocedure i decribed belo. 1 enerate the roxy inin key x by the folloin: x h m, r mod h m, r { h h, r x k } k E. 3 2 enerate Sin m, x. 3 Outut i m,, r, m, y, h, r D. roxy inature verification: Given roxy inature m,, r, m, y, h, r, V erform the folloin rocedure for checkin it validity. 1 V enerate roxy ublic key by the folloin: h h, r h m, r y { y y r } r mod...e. 4 2 V erform Verify m,, y. If it return 1, the received roxy inature i valid. Otherie, it i invalid. E. evokin rivacy: If needed, anyone ho ha the anonymou alia of a roxy iner can kno hi/her real identity by the interaction ith the alia authority. he rocedure i a follo. In thi rocedure, e aume that V ant to kno the real identity of the roxy iner. 1 V end an anonymou identity h to. 2 find the matchin ID, k air uin h a key information. 3 end ID to V. 5. Security Conideration In thi ection, e conider the ecurity of our cheme. We ho that our cheme reerve the ecurity reuirement decribed in Section 2. In each ecurity reuirement, e dicu it a follo. Verifiability: For atifyin thi reuirement, the oriinal iner' areement hould be verified imlicitly in roxy inature verification te. In deleation te, the roxy iner verifie that the deleation information i enerated by the oriinal iner. Hoever, in roxy inature verification te, verifier doe not erform to verify the deleation information but only to verify the roxy inature. In fact, the roxy inature verification te only ho that the roxy iner ha the roxy inin key hich i matched the roxy ublic key hich the verifier enerate. herefore, it hould be roven that the oeion of the roxy inin key mean the roxy iner ha valid deleation information and a valid anonymou rivate key. Stron unforeability: For reervin thi reuirement, anyone excet the leitimate roxy iner cannot fore the roxy inature. Our cheme ue the Schnorr inature in many cae: deleation information, roxy inin key eneration, and roxy inature eneration/verification. It i idely believed that the Schnorr diital inature cheme i immune to exitential forery aaint the choen meae attack aumin that the dicrete loarithm roblem i hard [18]. herefore, our cheme reerve the Stron unforeability roerty. Stron non-reudiation: hi reuirement mean that only the

5 roxy iner ho on a vaild deleation information and a valid anonymou rivate key can enerate a valid roxy inature. In our cenario, e already aumed that the roxy inin alorithm ha non-reudiation roerty. So, e do not need to rove that the roxy inature itelf ha non-reudiation roerty. Hoever, if the roxy inin key can be enerated by illeitimate method, the roxy iner can deny eneratin a roxy inature. hu, for reervin tron non-reudiation, e only rove that the roxy iner ha the valid roxy inin key hich i matched to the enerated roxy ublic key by verifier. roxy rivacy: In our cheme, the roxy iner can be identified only by the anonymou alia. If an erary ant to kno the real identity of a roxy iner, they hould comromie the alia authority becaue of the folloin reaon: the anonymou alia i the reult of the alia authority runnin hah function hich ha the inut value that are the real identity of the roxy iner and the random number enerated by the alia authority. If the erary kno only the anonymou alia, it can be claimed to that of any roxy iner by maniulatin the random value enerated by the alia authority. So, if the random value i not knon, the anonymou alia doe not leak any information about the real identity. herefore, if the anonymou alia i not comromied, the roxy rivacy can be reerved. rivacy revocation: Our cheme ha an efficient method for revealin the real identity of the roxy iner. So, the roerty can be reerved. By the above dicuion, it can be ummarized that our cheme hould atify that a valid roxy inin key can be made ithout either a valid anonymou rivate key or valid deleation information from an oriinal iner for reervin all ecurity reuirement. We define the forery of the roxy inin key that there can be a method for eneratin a valid roxy inin key ithout either valid anonymou rivate key or valid deleation information from an oriinal iner. We rove the folloin theorem to ho that the roxy inin key can be unforeable in our cheme. heorem 1. A roxy inin key cannot be foreable unle the Schonorr diital inature cheme i foreable. roof. oracle. For rovin the theorem, e define the folloin O x : acce oracle of ' rivate key; the inut del value of thi oracle i m, h, r and it outut deleation information, r. O x : acce oracle of ' rivate key; thi oracle arv et h a inut and outut an, r. In fact, h i enerated by alia authority. But, from the verifier' vie, it i a random value becaue anyone cannot verify the correctne of h excet the alia authority. hu, it can be an effective attack if the erary can et a vaild inature of the alia authority for a random h ithout accein O x. herefore, e et h a an inut arv value of the oracle. Adverarie can be defined a follo. We ho that C can enerate a forery of a Schnorr diital inature if D ucceed to fore a roxy inin key. C : C intend to fore the Schnorr diital inature for hich a rivate key x rv Z i ued. C enerate x Z randomly and et x x x. rv x rv x C et y x mod, and y mod ublic key then end them to D. After D ucceed to enerate a forery, C et the forery and trie to fore the Schnorr inature uin the forery. D : D intend to fore the roxy inin key. D m, randomly and accee the oracle enerate a O x and O x that et m, h a inut del h arv value. Uin the reult of the oracle, D enerate a valid roxy inin key x h m, r mod. he ucceful forery of D mean that ithout accein the oracle uin m, h a an inut, D enerate k Z, h, r, m, r hich reerve the If folloin euation. k h h, r h m, r { y y r } r mod.. E. 5 D find a forery k, h, r, m, r end the forery to, then D C. In thi cae, C can et a

6 Schnorr inature forery by the folloin rocedure. h h, r 1. If the ublic key i thouht a y y r, k, m, r i an exitential forery of Schnorr inature. Uin folkin lemma [18], C can find an another fored inature k ', mˆ, rˆ. 2. Set the reult of hah value a c h m, r, 1 c ˆ, ˆ 2 h m r and et the fored ublic key a h h, r y' y y r mod. With c,, 1 c2 y', C can et the folloin euation. k c 1 mod y' r mod. E. 6 k ' c2 mod y' r mod. E By the euation 6 and 7, C et '/ 1 2 y' k k c c mod. Uin thi reult, C et the folloin reult. h h, r x x k k k' / c 1 c2 mod.... E. 7 k r mod, k i unknon to C 4. Let k k' / c c mod. Since x x ' 1 2 x mod, ', r, h i a forery of the Schnorr diital inature. herefore, Schnorr diital inature. he above rocedure ho that if rv C uccefully fore a D exit, there exit a method to fore the Schnorr inature. U till no, there i no efficient alorithm to break the Schnorr diital inature cheme. herefore, a roxy inin key in our cheme cannot be fored unle the Schnorr diital inature cheme i foreable. 6. Concluion In thi aer, e rooed a ne ecure tron roxy inature cheme ith roxy iner rivacy rotection. o the bet of our knolede, our cheme i the uniue one that uort thi functionality. We analyzed ecurity of our cheme under the roxy inature forery cae and the roxy inin key forery cae. In both cae, e roved that our cheme i unforeable if the Schnorr diital cheme remain unforeable. 7. Acknoledement hi ork a uorted by the KOSEF throuh the AIrc and the IC, Korea, under the IC uort roram uervied by the IIA 8. eference [1].ambo, K.Uuda, and E.Okamoto, roxy inature: deleation of the oer to in meae, IEICE ran. Fundam, vol. E79-A, No. 9, , [2] I. Foter, C. Keelman, G. udik, and S. uecke, A ecurity architecture for comutational rid, roc. 5th AC Conference on Comuter and Communication Security, , [3] H. Kim, J. Baek, B. Lee, K. Kim, Secret comutation ith ecret for mobile aent uin one-time roxy inature, roc. he 2001 Symoium on Crytorahy and Information Security, he Oio, Jaan, [4] B. Lee, H. Kim, K. Kim, Stron roxy inature and it alication, roc. he 2001 Symoium on Crytorahy and Information Security, he Oio, Jaan, [5] B. Neuman, roxy baed authorization and accountin for ditributed ytem, roc. 13th International Conference on Ditributed Comutin Sytem, , [6] V. Varadharajan,. Allen, S. Black, An analyi of the roxy roblem in ditributed ytem, roc IEEE Comuter Society Symoium on eearch in Security and rivacy, , [7] A. Bakker,. Steen, A. anenbaum, A la-abidin eer-to-eer netork for free-oftare ditribution, roc. IEEE International Symoium on Netork Comutin and Alication, Cambride, , Oct [8] H. ark, L. Lee, A diital nominative roxy inature cheme for mobile communication, roc. ICICS 2001, LNCS vol. 2229, , Sriner-Verla, [9] S. Kim, S. ark, D. Won, roxy inature, reviited, roc. ICICS'97, LNCS vol. 1334, , Sriner-Verla, [10] A. Boldyreva, A. alacio, B. Warinchi, Secure roxy Sinature Scheme for Deleation of Sinin iht, IAC erint Archive, available at htt://erint.iacr.or/2003/096/, [11] K. Shum, V. Wei, A tron roxy inature cheme ith roxy iner rivacy rotection, roc. 11th IEEE International Workho on Enablin echnoloie: Infratructure for Collaborative Enterrie, [12] H. Sun, On the dein of time-tamed roxy inature ith traceable receiver, roc. Comuter and Diital echniue. IEE re, [13] J. Lee, J. Cheon, and S. Kim, An analyi of roxy inature: i a ecure channel neceary, roc. C-SA 2003, LNCS vol. 2612, , Sriner-Verla, [14] H. Sun, N. Lee, and. Han, hrehold roxy inature, roc. Comuter and Diital echniue, vol. 146, , IEE re, [15] H. Sun, An efficient nonreudiable threhold roxy inature cheme ith knon iner, Com. Commun., vol. 22, No. 8, , [16] N. Lee and. Lee, he ecurity of a tron roxy inature cheme ith roxy iner rivacy rotection, Alied ath. and Com., Vol. 161, No. 3, , [17] G. Wan, F. Bao, J. Zhou, and. Den, Security analyi of ome roxy inature, roc. ICISC 2003, LNCS vol. 2971, , Sriner-Verla, [18] D. ointcheval and J. Stern, Security arument for diital inature and blind inature, J. Crytoloy, Vol. 13, No. 3, , 2000.