强不可伪造的多用双向代理重签名方案

Multi-use Bidirectional Proxy Re-signature Scheme with Strong Unforgeability

代理重签名具有转换签名的功能,可广泛应用于云存储、身份认证、版权管理等领域.标准模型下的代理重签名方案多数是存在性不可伪造的,无法阻止攻击者对已经签名过的消息重新伪造一个合法的签名.为了克服已有代理重签名方案的安全性依赖强、重签名长度长和计算代价大等缺陷,利用目标抗碰撞杂凑函数提出了一种新的多用双向代理重签名方案.在计算性Diffie-Hellman困难问题的假设下,证明新方案在适应性选择消息攻击下是强不可伪造的.与已有强不可伪造的双向代理重签名方案相比,新方案的系统参数、签名和重签名的长度短,重签名的计算量小,且满足更多的安全属性.

In a proxy re-signature scheme,a semi-trusted proxy is allowed to convert a delegatee＇s signature into a delegatee＇s signature on the same message by using a re-signature key. But the proxy cannot generate arbitrary signatures for either the delegatee or the delegator. Hence, proxy re-signature is very useful and can be applied in many applications, such as cloud storage, cross-domain identity authentication, simplifying certificate management,managing group signatures, providing a proof for a path that has been taken, con- structing a checking system and a digital rights management interoperable system. Cryptosystems previously proved secure in the ran- dom oracle model are actually provably insecure when the random oracle is instantiated by any real-world hashing function. Therefore, provably secure proxy re-signature scheme in the standard model is more attractive. However, most proxy re-signature schemes in the standard model are existentially unforgeable, which cannot prevent adversaries from forging valid signatures on messages that have pre- viously been signed/re-signed. In order to overcome the shortcomings of the existing proxy re-signature schemes such as strong hard- ness assumption,long re-signatures length and high computation cost, a multi-use bidirectional proxy re-signature scheme is proposed by using target collision-resistant hash function. Under the computational Diffie-HeUman assumption, the proposed proxy re-signature scheme is proven to be strongly unforgeable under adaptive chosen message attacks. Compared with existing proxy re-signature schemes with strong unforgeability, the proposed scheme has short system parameters, short re-signature,low re-signing computation cost and more security properties.