The concept of multisignature, in which multiple signers can cooperate to sign the same message and any verifier can verify the validity of the multi-signature, was first introduced by Itakura and Nakamura. Several mu...The concept of multisignature, in which multiple signers can cooperate to sign the same message and any verifier can verify the validity of the multi-signature, was first introduced by Itakura and Nakamura. Several multisignature schemes have been proposed since. Chen et al. proposed a new digital multi-signature scheme based on the elliptic curve cryptosystem recently. In this paper, we show that their scheme is insecure, for it is vulnerable to the so-called active attacks, such as the substitution of a ＂false＂ public key to a ＂true＂ one in a key directory or during transmission. And then the attacker can sign a legal signature which other users have signed and forge a signature himself which can be accepted by the verifier.展开更多
The classical RSA is vulnerable to low private exponent attacks （LPEA） and has homomorphism. KMOV based on elliptic curve En（a,b） over Zn can resist LPEA but still has homomorphism. QV over En（a,b） not only can ...The classical RSA is vulnerable to low private exponent attacks （LPEA） and has homomorphism. KMOV based on elliptic curve En（a,b） over Zn can resist LPEA but still has homomorphism. QV over En（a,b） not only can resist LPEA but also has no homomorphism. However, QV over En（a,b） requires the existence of points whose order is Mn= 1cm{#Ep（a,b）, #Eq（a,b）}. This requirement is impractical for all general elliptic curves. Besides, the computation over En（a,b） is quite complicated. In this paper, we further study conic curve Cn（a,b） over Zn and its corresponding properties, and advance several key theorems and corollaries for designing digital signature schemes, and point out that Cn（a,b） always has some points whose order is Mn： 1cm{#Ep（a,b）,#Eq（a,b））. Thereby we present an improved QV signature over Cn（a,b）, which inherits the property of non-homomorphism and can resist the Wiener attack. Furthermore, under the same security requirements, the improved QV scheme is easier than that over En（a,b）, with respect plaintext embedding, inverse elements computation, points computation and points＇ order calculation. Especially, it is applicable to general conic curves, which is of great significance to the application of QV schemes.展开更多
基金This work is supported by the National Natural Science Foundation of China under Grant No. 90304014 and the National Grand Fundamental Research 973 Program of China under Grant No. 2003CB314805.
文摘The concept of multisignature, in which multiple signers can cooperate to sign the same message and any verifier can verify the validity of the multi-signature, was first introduced by Itakura and Nakamura. Several multisignature schemes have been proposed since. Chen et al. proposed a new digital multi-signature scheme based on the elliptic curve cryptosystem recently. In this paper, we show that their scheme is insecure, for it is vulnerable to the so-called active attacks, such as the substitution of a ＂false＂ public key to a ＂true＂ one in a key directory or during transmission. And then the attacker can sign a legal signature which other users have signed and forge a signature himself which can be accepted by the verifier.
基金Supported by the National Natural Science Foundation of China (Grant No. 10128103)
文摘The classical RSA is vulnerable to low private exponent attacks （LPEA） and has homomorphism. KMOV based on elliptic curve En（a,b） over Zn can resist LPEA but still has homomorphism. QV over En（a,b） not only can resist LPEA but also has no homomorphism. However, QV over En（a,b） requires the existence of points whose order is Mn= 1cm{#Ep（a,b）, #Eq（a,b）}. This requirement is impractical for all general elliptic curves. Besides, the computation over En（a,b） is quite complicated. In this paper, we further study conic curve Cn（a,b） over Zn and its corresponding properties, and advance several key theorems and corollaries for designing digital signature schemes, and point out that Cn（a,b） always has some points whose order is Mn： 1cm{#Ep（a,b）,#Eq（a,b））. Thereby we present an improved QV signature over Cn（a,b）, which inherits the property of non-homomorphism and can resist the Wiener attack. Furthermore, under the same security requirements, the improved QV scheme is easier than that over En（a,b）, with respect plaintext embedding, inverse elements computation, points computation and points＇ order calculation. Especially, it is applicable to general conic curves, which is of great significance to the application of QV schemes.
