1 一個新的代理簽章法 A New Proxy Signature Scheme 作 者 : 洪國寶, 許琪慧, 郭淑娟與邱文怡 報 告者 : 郭淑娟

2 Outline Definition Our proxy signature scheme Security analysis Conclusions

3 Definition Proxy Signature [Mambo et al. 1996] A designed proxy signer signed message on behalf of the original signer.  Original Signer A  Proxy Signer B Delegation Proxy Signer B Message

4 Our scheme--system parameters Two public large primes p and q that q|p-1. One public generator g  Z * p with order q. A public one way hash function h. Each user i has a secret key x i  Z * q and corresponding public key y i =g x i mod p. Message m Public delegation warrant w.

5 Delegation warrant w Proxy period. The name of proxy and original signers. The responsibility of proxy signer. The key of certification including y A and y B.

6 Our scheme — participants A: Original signer B: Proxy signer V: Verifier

7 Our scheme—three phases Delegation phase Signature phase Verification phase

8 Our scheme diagram Proxy certification + Proxy signature Origin signer  Delegation phase Signature phase Proxy signer  Verification phase Verifiers 

9 Delegation phase Step 1: Original signer A chooses a secret random number k  Z * q, computes r =g k mod p. Step 2: A computes e =h(r, w). Step 3: A computes s = k- x A  e mod q. Step 4: A sends (e, s, w) to proxy signer B.

10 Signature phase Step 1: Proxy signer B computes r’=g s  y A e mod p Step 2: B checks h(r’, w)=e  e, s, w is valid. Step 3: B chooses a secret random number t  Z * q, computes  = g t mod p. Step 4: B signs m by U= h( , m). Step 5: B computes V= t-x B  U-s mod q. Step 6: B sends ((e, s, w), (U,V,m)) to verifier V.

11 Verification phase Step 1: Verifier V checks authentication for m. Step 2: Getting y A and y B from w, V computes r’= g s  y A e mod p and  ’= g v+s  y B U mod p. Step 3: If h(r’, w)=e  B is an authenticated proxy signer. Step 4: If U=h(  ’, m)  (U, V, m) is valid.

12 Security analysis Attack1: Get the secret key x A of original signer A. Attack2: Get the secret key x B of proxy signer B. Attack3: Find the k choosing by A. Attack4: Find the t choosing by B.

13 Security analysis Attack 5: Forge a valid proxy certification （ e , s ,w  ). Attack 6: Forge a valid proxy signature （ U , V , m  ).

14 Conclusions Original signer couldn’t forge proxy signer to generate proxy signature. Only proxy signer can generate valid proxy signature. Proxy signers could be identified efficiently. The scheme is based on schnorr scheme. Without secure channel.

15 Ending

16 Computation analysis ComputationHwang-ShiOur scheme Multiplication Computation 63 Exponential Computation 34