关于一个前向安全电子货币系统的两点注记

Two Remarks on a Forward-Secure E-cash System

指出了文献[1]提出的一个前向安全电子货币系统有两点疏漏:(1)在系统公共参数生成阶段,公共模数n的素因子p1,p2没有公布,使得用户和银行在提取阶段无法作出有效签名;(2)商家M必须从安全途径直接获得支付过程中所需的(h,h1,h2,h3),而不是从某个用户U提供的签名中获得这些数据,否则攻击者可以在支付阶段伪造签名,从而,用户提供的签名(z,a,b,r,j,h,h1,h2,h3)中有4个是冗余数据.

The paper shows that there are two errors in the E-cash system in Ref. [ 1 ]. （ 1 ） In the setup phase, the factors P1 , P2 of modulus n are not published. This makes the user and the bank unable to make valid signatures in the withdrawal phase. （2）The shop M must directly obtain those data （h, h1, h2, h3 ） used in payment phase in a secure way, instead of receiving them from a signature offered by a user U. Otherwise, the adversary can forge signatures in the payment phase. Therefore, there are four redundant data among the signature （ z, a, b, r ,j, h, h1, h2, h3 ） offered by a user.