Design Principles of Secure Certificateless Signature and Aggregate Signature Schemes for IoT Environments

Abstract

Certificateless cryptography resolves the certificate management problem of public-key cryptography and the key-escrow problem of identity-based cryptography. An aggregate signature scheme which allows to aggregate k distinct signatures on k distinct messages of k distinct signers into a single signature reduces communication overhead and computational cost. Due to the suitability of certificateless signature (CLS) and certificateless aggregate signature (CLAS) schemes for IoT environments, similar CLS and CLAS schemes have been proposed for a long time and, despite their security proofs, they have been attacked and modified to prevent the attacks. Even now, similar design methods and similar attacks on the schemes are being repeated. In order to prevent the similar attacks on the schemes, it is necessary to analyze their causes and vulnerabilities. In this paper, we first show that recently proposed five CLS and CLAS schemes are insecure against universal forgery attacks, type I attacks, type II attacks or maliciousbut-passive-KGC attacks. We discuss their security flaws, causes and countermeasures. We then present design principles to prevent various algebraic attacks including our attacks. The design principles will help in the construction of secure CLS and CLAS schemes against the previous attacks and potential attacks.INDEX TERMS Aggregate signature, Certificateless signature, malicious-but-passive-KGC attack, type I attack, type II attack, universal forgery attack.

Improving Throughput of Mobile Sensors via Certificateless Signature Supporting Batch Verification

“…There are also some schemes that have been proven to be insecure. For example, Shim [16] analyzed five recent articles and found that they can all be forged by adversaries. Therefore, how to construct secure certificateless signatures still requires a very rigorous approach.…”

Hidden Treasures of Kediri’s Medicinal Plants: A Collaborative Effort to Map and Validate Authentic Information Using Innovative QR Code Security and Cryptography

“…In this study, we will test the application of cryptographic-based QR Codes on data information on medicinal plants and rare plants displayed on rare plant database-based websites [19]. The implementation of QR Code implementation with cryptographic security will be tested.…”