A Secure Anonymous Proxy Multi-signature Scheme

Vishal Saraswat and Rajeev Anand Sahu

C.R.Rao Advanced Institute of Mathematics Statistics and Computer Science

Hyderabad, India

Keywords:

Identity-based Cryptography, Bilinear Map, CDHP, Provable Security, Digital Signature, Signing Rights

Delegation, Proxy Multi-signature, Anonymity, Accountability.

Abstract:

A proxy signature scheme enables a signer to delegate its signing rights to any other user, called the proxy

signer, to produce a signature on its behalf. In a proxy multi-signature scheme, the proxy signer can produce

one single signature on behalf of multiple original signers. We propose an efﬁcient and provably secure

threshold-anonymous identity-based proxy multi-signature (IBPMS) scheme which provides anonymity to the

proxy signer while also providing a threshold mechanism to the original signers to expose the identity of the

proxy signer in case of misuse. The proposed scheme is proved secure against adaptive chosen-message and

adaptive chosen-ID attacks under the computational Difﬁe-Hellman assumption. We compare our scheme with

the recently proposed anonymous proxy multi-signature scheme and other ID-based proxy multi-signature

schemes, and show that our scheme requires signiﬁcantly less operation time in the practical implementation

and thus it is more efﬁcient in computation than the existing schemes.

1 INTRODUCTION

Digital signature is a cryptographic primitive to guar-

antee data integrity, entity authentication and signer’s

non-repudiation. A proxy signature scheme enables

a signer, O, also called the designator or delegator,

to delegate its signing rights (without transferring the

private key) to another user P , called the proxy signer,

to produce, on the delegator’s behalf, signatures that

can be veriﬁed by a veriﬁer V under the delegator O’s

public key. For example, the director of a company

may authorize the deputy director to sign certain mes-

sages on his behalf during a certain period of his ab-

sence.

Proxy multi-signature is a proxy signature prim-

itive which enables a group of original signers

,...,O

to transfer their signing rights to a proxy

signer P who can produce one single signature which

convinces the veriﬁer V of the concurrence of all the

original signers. Threshold anonymous proxy multi-

signature provides anonymity to the proxy signer

while also providing a (t,n)-threshold mechanism to

the original signers to expose the identity of the proxy

signer in case of misuse. The proxy identiﬁcation al-

gorithm in the standard proxy signature protocol is

replaced by a proxy exposure protocol where any t (or

more) out of n original signers can come together to

expose the identity of the proxy signer. Note that the

threshold anonymous proxy multi-signature is differ-

ent from threshold proxy signatures in the sense that

while in threshold proxy signatures, any t (or more)

out of n proxy signers must come together to pro-

duce a valid signature, in threshold anonymous proxy

multi-signature any t (or more) out of n original sign-

ers must come together to revoke the anonymity of the

proxy signer.

Consider the following example in a secure multi-

party computation setting, multiple parties O

,...,O

start a process P after authenticating themselves.

Once the process P is started, the parties do not need

to stay connected while the process P may remain ac-

tive and need access to additional resources that re-

quire further authentication. The parties thus delegate

their rights to the process P and the resources allow

access to P as long as the resources can verify that

P was indeed authorised by the original parties. The

resources do not need to know the ‘identity’ of the

process at all and P may remain anonymous to them.

In fact, most of the times the resources do not even

need to know whether it is actually the set of origi-

nal parties who were authenticated or their proxy P .

But in case of a malicious process, the original parties

should be able to expose the process and restrict any

further activities by it on their behalf.

Saraswat V. and Sahu R..

A Secure Anonymous Proxy Multi-signature Scheme.

DOI: 10.5220/0005021200550066

In Proceedings of the 11th International Conference on Security and Cryptography (SECRYPT-2014), pages 55-66

ISBN: 978-989-758-045-1

 2014 SCITEPRESS (Science and Technology Publications, Lda.)

1.1 Related Work

The notion of proxy signature has been around since

1989 (Gasser et al., 1989) but it took almost seven

years for the ﬁrst construction (Mambo et al., 1996)

of a proxy signature scheme to be proposed. Since

then many variants of the proxy signature have been

proposed and many extensions of the basic proxy sig-

nature primitive have been studied. The formal se-

curity model of proxy signatures was ﬁrst formalized

in (Boldyreva et al., 2003) and further strengthened

and extended to the identity-based setting in (Schuldt

et al., 2008). A formal security model for anonymous

proxy signatures was introduced relatively recently

in (Fuchsbauer and Pointcheval, 2008) by unifying

the notions of proxy signatures and group signatures.

The notion of proxy-anonymous proxy signatures

was introduced in (Shum and Wei, 2002). Their

scheme was based on the proxy signature scheme

of (Lee et al., 2001) which was shown insecure

in (Sun and Hsieh, 2003). The anonymization tech-

nique itself was shown to cause insecurity – (Lee and

Lee, 2005) showed that the original signer can gener-

ate valid proxy signatures, thus violating the property

of the strong unforgeability.

Many proxy signature schemes have since been

proposed with the aim of providing anonymity of

the proxy signers — (Yu et al., 2009; Toluee et al.,

2012) provide proxy-anonymity by having a large

“ring” of proxy-signers; (Wu et al., 2008; Fuchs-

bauer and Pointcheval, 2008) require a large “group”

of proxy signers with one or more group managers

to revoke the anonymity of a malicious proxy-signer;

and (Lee et al., 2005; Du and Wang, 2013) require

a trusted third-party or trusted authority or trusted

dealer to provide the required functionality. In the

ring-based and group-based settings, the proxy signa-

ture schemes require that the number of proxy sign-

ers authorized by the original signer is large enough

to provide sufﬁcient anonymity to the proxy signer.

The cost (time, space, etc.) of providing anonymity

is rather large and the anonymity is not even absolute

but only 1-out-of-n where n is the size of group or

ring. The trusted third-party setting has its fair share

of well-known issues including the requirement of an

absolutely trustworthy authority/ dealer who is always

available.

The recently proposed scheme of (Du and Wang,

2013) is most notable in its attempt but it comes with

several ﬂaws. First and foremost, their implementa-

tion of the anonymization technique is not correct and

because of that the signature veriﬁcation cannot be

done. In particular their proxy key generation is not

consistent — they are adding a group element with

scalar elements (integers). Thus their scheme is not

consistent and is in fact incorrect. Second, it is not

even a proxy multi-signature scheme but is just a con-

catenation of n proxy signature schemes, where n is

the number of original signers, since each original

signer in the scheme issues a warrant with a differ-

ent pseudonym: Q

pseu

= R

+ R

+ Q

. Third, each

original signer O

can reveal the identity of the proxy

signer P and even try to (partially) “demonstrate” by

using the signature of the proxy. Fourth, during the

proxy multi-signature veriﬁcation PMSVeri, it is re-

quired that the veriﬁer “checks whether or not the

proxy signer P is authorized by the n original sign-

ers O

,...,O

in the warrant w”. Nevertheless, if the

veriﬁer can already check the authority of the proxy

signer P then P never remains anonymous! Fifth,

the dealer D of the secret sharing scheme used by the

original signers also knows the identity of P and can

also compute R

from the R

(which he computes

himself) and publicly available values Q

and Q

pseu

Finally, the scheme of (Du and Wang, 2013) is based

on the proxy multi-signature scheme of (Cao and Cao,

2009) which can be shown to be insecure (Xiong

et al., 2011) when n = 1.

1.2 Our Contribution

To the best of our knowledge, almost all available

proxy-anonymous signature schemes are either too

costly or inefﬁcient to be practical or have not been

proved secure. We propose an efﬁcient and provably

secure threshold-anonymous ID-based proxy multi-

signature scheme which provides anonymity to the

proxy signer while also providing a threshold mech-

anism to the original signers to expose the identity

of the proxy signer in case of misuse. The proposed

scheme is proved secure against adaptive chosen-

message and adaptive chosen-ID attacks under the

computational Difﬁe-Hellman (CDH) assumption.

In this paper, we build our scheme on the tech-

nique of pseudonym and secret sharing as suggested

by (Du and Wang, 2013) to provide the required func-

tionality – the identity of the proxy signer is hidden

but in case of misuse of the delegated rights, t or more

of the n original signers can come together to reveal

the proxy signer’s identity.

In our scheme we modify the structure of the war-

rant slightly. As in usual proxy signature schemes,

the warrant in our scheme includes the nature of mes-

sage to be delegated, period of delegation, identity in-

formation of original signers, etc. But unlike usual

proxy signature schemes, it does not include the iden-

tity information of the proxy signer. Instead, the war-

rant includes the proxy signer’s pseudonym, which

SECRYPT2014-InternationalConferenceonSecurityandCryptography

is a proxy signature veriﬁcation key that cannot be

linked to the identity of the proxy signer easily — t

or more original signers must come together to reveal

the proxy signer’s identity.

Compared with the scheme of (Du and Wang,

2013), our scheme allows the proxy signer to act as

the dealer of the secret sharing scheme and uses a

veriﬁable secret sharing scheme (Pedersen, 1991) to

restrict the proxy from acting as a malicious dealer.

Our scheme requires only 2n broadcasts compared to

3n + 1 of Du’s scheme to construct the pseudonym

of the proxy and thus our scheme requires 33% less

broadcasts to provide anonymity. Also we use a

much more efﬁcient and provably secure proxy multi-

signature scheme of (Sahu and Padhye, 2012) as our

basic scheme so that the overall proxy signature has

less operation time and thus more efﬁcient (14%-23%

more) than the existing best schemes in computation.

1.3 Outline of the Paper

The rest of this paper is organized as follows. In

Section 2, we introduce some related mathematical

deﬁnitions, problems and assumptions. In Section 3,

we present the formal deﬁnition of an anonymous

ID-based proxy multi-signature scheme and a secu-

rity model for it. Our proposed anonymous ID-based

proxy multi-signature scheme is presented in Sec-

tion 4. In Section 5 we analyze the security of our

scheme. Finally, Section 6 includes the efﬁciency

comparison.

2 PRELIMINARIES

In this section, we introduce some relevant deﬁni-

tions, mathematical problems and assumptions and

brieﬂy discuss the veriﬁable secret sharing scheme.

2.1 Bilinear Map

Let G

be an additive cyclic group with generator P

and G

be a multiplicative cyclic group with generator

g. Let the both groups are of the same prime order q.

Then a map e : G

×G

→ G

satisfying the following

properties, is called a cryptographic bilinear map:

1. Bilinearity: For all a, b ∈ Z

∗

, e(aP,bP) =

e(P,P)

, or equivalently, for all Q,R,S ∈ G

e(Q + R,S) = e(Q,S)e(R,S) and e(Q, R + S) =

e(Q,R)e(Q,S).

2. Non-Degeneracy: There exists Q,R ∈ G

such

that e(Q,R) 6= 1. Note that since G

and G

are

groups of prime order, this condition is equivalent

to the condition e(P,P) 6= 1, which again is equiv-

alent to the condition that e(P, P) is a generator of

3. Computability: There exists an efﬁcient algorithm

to compute e(Q,R) ∈ G

, for any Q,R ∈ G

2.2 Discrete log (DL) Assumption

Let G

be a cyclic group with generator P.

Deﬁnition 1. Given a random element Q ∈ G

, the

discrete log problem (DLP) in G

is to compute an

integer n ∈ Z

∗

such that Q = nP.

Deﬁnition 2. The DL assumption on G

states that

the probability of any polynomial-time algorithm to

solve the DL problem in G

is negligible.

2.3 Computational Difﬁe-Hellman

(CDH) Assumption

Let G

be a cyclic group with generator P.

Deﬁnition 3. Let a, b ∈ Z

∗

be randomly chosen and

kept secret. Given P,aP, bP ∈ G

, the computational

Difﬁe-Hellman problem (CDHP) is to compute abP ∈

Deﬁnition 4. The (t,ε)-CDH assumption holds in

if there is no algorithm which takes at most t run-

ning time and can solve CDHP with at least a non-

negligible advantage ε.

2.4 Veriﬁable Secret Sharing

The notion of secret sharing was introduced indepen-

dently by (Shamir, 1979) and (Blakley, 1979) to en-

able a secret to be shared among a group of users so

that the secret can be reconstructed only when a suf-

ﬁcient number of them come together. For integers

n and t such that 1 < t ≤ n, an (t,n)-secret sharing

scheme consists of two phases:

1. in the splitting phase, a dealer shares a secret σ

among n users;

2. in the combining phase, only t or more users in

the group can reconstruct the secret σ.

Veriﬁable secret sharing (VSS), introduced in (Chor

et al., 1985), enables each user to verify the correct-

ness of their shares to prevent malicious attack per-

formed by the dealers. For the purpose of this pa-

per, we use Pedersen’s non-interactive and informa-

tion theoretic secure VSS (Pedersen, 1991). This

scheme protects the secret to be distributed uncondi-

tionally for any value of t, (1 < t ≤ n), and the cor-

rectness of the shares depends on the assumption that

the dealer cannot ﬁnd discrete logarithms before the

distribution has been completed.

ASecureAnonymousProxyMulti-signatureScheme

3 ANONYMOUS ID-BASED

PROXY MULTI-SIGNATURE

SCHEME AND ITS SECURITY

MODEL

Here we give a formal deﬁnition of an anonymous

ID-based proxy multi-signature scheme and a formal

security model for it as presented in (Cao and Cao,

2009; Sahu and Padhye, 2012) built upon the work

of (Boldyreva et al., 2003) and (Schuldt et al., 2008).

3.1 Anonymous ID-based Proxy

Multi-Signature Scheme

In a (t,n)-threshold anonymous ID-based proxy

multi-signature scheme, group of n original signers

are authorized to transfer their signing rights to a sin-

gle proxy signer to sign any document anonymously

on their behalf but in case of misuse of the delegated

rights by the proxy signer, t or more of the original

signers can come together to reveal and demonstrate

the identity of the proxy signer. Public and private

keys of original and proxy signers are generated by a

Private Key Generator (PKG), using their correspond-

ing identities. Let the n original signers O

have the

identities ID

, i = 1,.. .,n, and the proxy signer P

has the identity ID

. A (t, n)-threshold anonymous

ID-based proxy multi-signature scheme can be de-

ﬁned consisting the following:

Setup: For a security parameter k, the PKG runs

this algorithm and generates the public parameters

params and a master secret of the system. Further,

the PKG publishes params and keeps the master se-

cret conﬁdential.

Extract: This is a private key generation algorithm.

For a given identity ID, public parameters params

and master secret, PKG runs this algorithm to gen-

erate private key S

of the user with identity ID, and

provides this private key through a secure channel to

the user corresponding to the identity ID.

Proxy multi-generation: This is an interactive pro-

tocol among the original signers and the proxy signer.

In this phase, the group of original signers interact

with the proxy signer to agree on a pseudonym to

anonymize the identity of the proxy signer and a war-

rant w which includes the nature of message to be del-

egated, period of delegation, identity information of

original signers, the pseudonym for the proxy signer

etc. Finally the original signers delegate their sign-

ing rights to the proxy signer and the proxy signer

produces the (secret) proxy signing key. This algo-

rithm takes as input, the identities ID

,ID

and pri-

vate keys S

of all the users and outputs the

pseudonym Q

, the warrant w, the shares ρ

of the

original signers, the delegation V

, i = 1,. .., n, and

the proxy signing key S

Proxy multi-signature: This is a randomized algo-

rithm, the proxy signer runs this algorithm to gener-

ate a proxy multi-signature on an intended message

m. This algorithm takes proxy signing key of the

proxy signer, the warrant w, message m and outputs

the proxy multi-signature σ

Proxy multi-veriﬁcation: This is a deterministic

algorithm run by the veriﬁer on receiving a proxy

multi-signature σ

on any message m. This algorithm

takes as inputs the proxy multi-signature σ

, the mes-

sage m, the warrant w, the identities ID

of all the

original signers, Q

and outputs 1 if the signature

is a valid proxy multi-signature on behalf of the

group of original signers on m, and outputs 0 other-

wise. We emphasize that the actual identity ID

the proxy signer is not required but the pseudonym

, as in the warrant, is required for the veriﬁca-

tion.

Reveal & Demonstrate: To reveal and demonstrate

the proxy signer’s identity, t or more original signers

combine their shares ρ

to recover the shared secret

and proceed to reveal the proxy signer’s identity

from the pseudonym.

3.2 Security Model for Anonymous

ID-based Proxy Multi-Signature

Schemes

3.2.1 Unforgeability

In this model we consider a case where an adver-

sary A tries to forge the proxy multi-signature work-

ing against a single user, once against an original

signer say O

and once against the proxy signer P .

We consider that ID

(i = 1,...,n) denotes iden-

tities of the original signers and ID

denotes iden-

tity of the proxy signer. The adversary A is allowed

to access polynomial number of hash queries, ex-

traction queries, proxy multi-generation queries and

proxy multi-signature queries. The goal of the adver-

sary A is to produce one of the following forgeries:

SECRYPT2014-InternationalConferenceonSecurityandCryptography

1. A proxy multi-signature for a message m by user

1 on behalf of the original signers, such that either

the original signers never designated user 1, or the

message m was not submitted in the proxy multi-

signature queries.

2. A proxy multi-signature for a message m by some

user i (i 6= 1) on behalf of the original signers, such

that user i was never designated by the original

signers, and user 1 is one of the original signers.

An ID-based proxy multi-signature scheme is said

to be existential unforgeable against adaptive chosen-

message and adaptive chosen-ID attack if there is

no probabilistic polynomial time adversary A with a

non-negligible advantage against the challenger C in

the following game:

1. Setup: Challenger C runs the Setup algorithm and

provides the public parameters params to the ad-

versary A.

2. Extract query: When the adversary A asks private

key of any user with identity ID

, the challenger

runs the Extract algorithm and responds the pri-

vate keys to the adversary.

3. Proxy multi-generation query: When the adver-

sary A requests to interact with the user 1 for

the proxy signing key by proxy multi-generation

query on the warrant w

and identities ID

of its

choice where the user 1 may be either one of the

original signers or the proxy signer, the challenger

C runs the proxy multi-generation algorithm to re-

spond the proxy signing key to the adversary and

maintains corresponding lists.

4. Proxy multi-signature query: Proceeding adap-

tively when the adversary A requests for a proxy

multi-signature on message m

and warrant w

its choice, C responds by running the proxy multi-

signature algorithm and maintains a query list say

pms

for it.

5. Output: After the series of queries, A outputs a

new proxy multi-signature (U

,σ

,U, w) on mes-

sage m under a warrant w for identities ID

and

. Where A has never requested private keys

for ID

and ID

in extraction queries. A has

never requested a Proxy multi-generation query

including warrant w and identities ID

. A has

never requested a proxy multi-signature query on

message m with warrant w and identity ID

The adversary A wins the above game if the

new ID-based proxy multi-signature (U

,σ

,U, w)

on message m is valid.

Deﬁnition 5. An ID-based proxy multi-signature

forger A (t,q

pmg

pms

,n+1,ε)-breaks the n +

1 users ID-based proxy multi-signature scheme by the

adaptive chosen-message and adaptive chosen-ID at-

tack, if A runs in at most t time; makes at most q

hash queries; at most q

extraction queries; at most

pmg

proxy multi-generation queries; at most q

pms

proxy multi-signature queries; and the success proba-

bility of A is at least ε.

Deﬁnition 6. An ID-based proxy multi-signature

scheme is (t,q

pmg

pms

,n + 1,ε)-

secure against adaptive chosen-message and

adaptive chosen-ID attacks, if no adversary

(t,q

pmg

pms

,n + 1, ε)-breaks it.

3.2.2 Anonymity and Accountability

Deﬁnition 7 (Anonymity). By anonymity we mean

that no one except the original signers should be able

to determine the identity of the proxy signer from the

proxy signatures or the warrant.

Deﬁnition 8 (Threshold Anonymity). By (t,n)-

threshold anonymity we mean that even the original

signers O

who know the identity of the proxy signer

P should not be able to prove that P is the signer of a

certain proxy multi-signature unless at least t of the n

original signers participate in the proof.

Deﬁnition 9 (Accountability). Accountability en-

sures that the proxy signer P does not abuse its

anonymity. Any t (or more) out of n original sign-

ers can come together to prove that P is the signer of

any veriﬁable designated proxy multi-signature.

Remark: Note that each of the original signers al-

ways know the identity of the proxy signer P since

they delegate their rights to P . Our deﬁnitions re-

quire that any group of less than t original signers is

not able to prove to a third party that P is indeed the

proxy signer.

4 PROPOSED SCHEME

In this section, we present our efﬁcient and provably

secure threshold-anonymous identity-based proxy

multi-signature (IBPMS) scheme which provides

anonymity to the proxy signer while also providing a

threshold mechanism to the original signers to expose

the identity of the proxy signer in case of misuse. Our

scheme consists of the following phases: setup, ex-

tract, proxy multi-generation, proxy multi-signature,

proxy multi-veriﬁcation, reveal & demonstration.

The scheme uses the following signature scheme

which was proved to be secure in (Sahu and Padhye,

2012) (with Setup and Extract as deﬁned below in the

deﬁnition of the threshold anonymous proxy multi-

signature):

ASecureAnonymousProxyMulti-signatureScheme

Signature: To sign a message m ∈ {0,1}

∗

• randomly selects r ∈ Z

∗

• computes U = rP ∈ G

• h = H

(mkU) and

• V = hS

+ rPub.

The signature on message m is σ = hU,V i.

Veriﬁcation: To verify a signature σ = hU,V i on

message m for an identity ID, the veriﬁer ﬁrst com-

putes

• Q

= H

(ID), and

• h = H

(mkU).

Then accepts the signature if

e(P,V ) = e(Pub, hQ

+U),

and rejects otherwise.

4.1 Our Anonymous IBPMS Scheme

Setup: For a given security parameter 1

, let G

an additive cyclic group of prime order q with gener-

ator P and G

be a multiplicative cyclic group of the

same prime order q. Let e : G

×G

→ G

be a crypto-

graphic bilinear map as deﬁned above. Let H

and H

are two hash functions deﬁned for security purpose as

: {0,1}

∗

→ G

and H

: {0,1}

∗

→ Z

∗

. The PKG

randomly selects s ∈ Z

∗

and sets Pub = sP as public

value. Finally, the PKG publishes system’s public pa-

rameter params = hk,e,q,G

,P,Pubi and

keeps the master secret s conﬁdential to itself only.

Extract: Given a user’s identity ID, the PKG com-

putes its

• public key as: Q

= H

(ID) and

• private key as: S

= sQ

respectively.

Proxy multi-generation: To delegate the signing

capability to the proxy signer P , the n original sign-

ers do the following jobs to make a signed warrant w.

The warrant includes the nature of message to be del-

egated, period of delegation, identity information of

original signers, the pseudonym for the proxy signer

etc. In successfully completion of the protocol, proxy

signer gets a proxy signing key S

Delegation generation: (a) Pseudonym generation:

Each original signer with identity ID

selects

a random number ρ

∈ Z

∗

and sends it to the

proxy signer P in a secure channel. P computes

= ρ

+ρ

+··· + ρ

∈ Z

∗

and uses a (t,n)-

threshold veriﬁable secret sharing scheme (Ped-

ersen, 1991) to split ρ

into n shares ρ

, i =

1,2,...,n. P then sets R

= ρ

P and sends

,ρ

to the corresponding original signer O

for i = 1,2, ... ,n through a secure channel. P

also selects a random number ρ

∈ Z

∗

, computes

= ρ

P and its standard signature s

. Finally

P sends R

to all the n original signers O

for i = 1,2,. .., n through a secure channel. Each

original signer computes Q

= Q

as the proxy signer’s pseudonym, which will be

included in the warrant and will be used as the

signature veriﬁcation key.

Remark: Note that all the n original signers can

come together with the ρ

that they sent to P and

compute ρ

= ρ

+ρ

+·· ·+ρ

to expose the

identity of the proxy signer in case of misuse. We

are using a threshold secret sharing scheme to pro-

vide a threshold mechanism to the original signers

so that only t ≤ n of the original signers are suf-

ﬁcient to participate to expose the identity of the

proxy signer. Also note that we use a veriﬁable

secret sharing scheme so that a malicious proxy

signer cannot mislead the original signers with an

incorrect ρ

to avoid being held responsible for its

proxy-signatures. The original signers can verify

their shares as soon as they receive it and are as-

sured that the ρ

they receive will correctly con-

struct to ρ

corresponding to the R

which they

receive. Also, P ’s signature is required for non-

repudiation.

(b) Delegation generation: For i = 1, ... ,n, each

• selects r

∈ Z

∗

• computes U

= r

P and

• broadcasts U

to the other n−1 original signers.

For i = 1, ... ,n, each O

computes

• U =

∑

i=1

• h = H

(wkU), and

• V

= hS

+ r

Pub

and sends (w,U

) to the proxy signer P , with

as a delegation value.

Delegation veriﬁcation: For i = 1, ... ,n, P veriﬁes

the delegation by U =

∑

i=1

and h = H

(wkU)

and checking

e(P,V

) = e(Pub,hQ

If the above equality does not hold for some i =

1,...,n, P requests a valid delegation (w,U

)

or terminates the protocol.

SECRYPT2014-InternationalConferenceonSecurityandCryptography

Proxy signing key generation: Having accepted del-

egations (w,U

), i = 1,. .., n, P computes

= S

+ ρ

Pub + ρ

Pub

and sets the proxy signing key S

= V

+ hS

where V

∑

i=1

and h = H

(wkU).

Remark: Note that

= S

+ ρ

Pub + ρ

Pub

= sQ

+ ρ

sP + ρ

= s(Q

+ ρ

P + ρ

= s(Q

+ R

)

= sQ

So, (Q

) is a valid public-key / private-key

pair.

Proxy multi-signature: To sign a message m

anonymously on behalf of the group of n original

signers, the proxy signer P computes the following:

• Randomly picks r

∈ Z

∗

, and

• computes

- U

= r

- h

= H

(mkU

) and

- V

= h

+ r

Pub.

The anonymous proxy multi-signature on message m,

by P on behalf of the n original signers is σ

(w,U

,U).

Proxy multi-veriﬁcation: To verify an anonymous

proxy multi-signature σ

= (w,U

,U) for mes-

sage m under a warrant w, the veriﬁer proceeds as fol-

lows:

• Checks whether or not the message m conforms to

the warrant w. If not, stop. Continue otherwise.

• Checks whether or not the pseudonym Q

is au-

thorized by the group of n original signers in the

warrant w. If not, stop. Continue otherwise.

• Computes h

= H

(mkU

), h = H

(wkU) and ac-

cepts the proxy signature if and only if the follow-

ing equality holds:

e(P,V

) = e(Pub,h

(h(

∑

i=1

)+U)+U

Remark: Note that the identity of the proxy signer

P or its public key Q

is not required for the veriﬁ-

cation.

Reveal & Demonstrate: To reveal the identity of

the proxy signer, any original signer O

can reveal R

and R

and show that

= Q

+ R

That R

was indeed sent by P is proved using the

signature s

. To prove that R

is not just a solution

to the equation Q

= Q

+ R

, t or more

original signers combine their shares to recover the

secret ρ

and show that R

= ρ

5 SECURITY ANALYSIS

In this section, we analyze the correctness, secu-

rity, threshold-anonymity and accountability of our

scheme. First we prove the correctness of the scheme,

then we prove that the underlying IBPMS scheme

is existential unforgeable against adaptive chosen-

message and adaptive chosen-ID attacks and ﬁnally

we analyze the threshold-anonymity and accountabil-

ity of the proposed anonymous proxy multi-signature

scheme.

5.1 Correctness

Theorem 10. The presented threshold anonymous

proxy multi-signature scheme is correct.

Proof. This follows since

e(P,V

) = e(P,h

+ r

Pub)

= e(P,h

+ hS

) + r

Pub)

= e(P,h

(

∑

i=1

(hS

+ r

Pub) + hS

)

+ r

Pub)

= e(Pub,h

(

∑

i=1

(hQ

+ r

P) + hQ

)

+ r

= e(Pub,h

(

∑

i=1

∑

i=1

P + hQ

)

= e(Pub,h

(h(

∑

i=1

+ Q

) +U )

5.2 Security Proof of the IBPMS

Scheme

We now prove that the underlying IBPMS scheme

is existential unforgeable against adaptive chosen-

ASecureAnonymousProxyMulti-signatureScheme

message and adaptive chosen-ID attacks.

We facilitate the adversary to adaptively select the

identity on which it wants to forge the signature. Fur-

ther the adversary can obtain the private keys associ-

ated to the identities. The adversary also can access

the proxy multi-generation oracles on warrants w

its choice, and proxy multi-signature oracles on the

warrant, messages pair (w

) of its choice, as many

times it wants.

Theorem 11. We consider the random oracle for re-

ply to hash queries. If there exists an adversary

A(t,q

pmg

pms

,ε)

which breaks the proposed ID-based proxy multi-

signature scheme, then there exists an adversary

B(t

pmg

pms

,ε

)

which solves CDHP in time at most

≥ t + (q

+ q

+ 2q

pmg

+ 4q

pms

+ 1)C

with success probability at least

≥

ε(1 − 1/q)

M(q

+ q

pmg

+ q

pms

+ n + 1)

where C

denotes the number of scalar multiplica-

tions in group G

Proof. First of all the challenger runs the setup al-

gorithm and provides the

params = hq, G

,e,P, sP, bPi

to B. Here, A is a forger algorithm whose goal is to

break the underlying ID-based proxy multi-signature

scheme. The adversary B simulates the challenger

and interacts with A. The goal of B is to solve CDHP

by computing sbP ∈ G

Key Generation: For security parameter 1

, B gen-

erates the system’s public parameter

params = hq, G

,e,P, Pub,H

and provides Pub = sP to A.

-queries: To respond to the H

hash function

queries, B maintains a list L

= {hID,h,a,ci}.

When A queries the H

hash function on some iden-

tity ID

∈ {0,1}

∗

, B responds as follows:

1. If the query ID

already appears in the list L

in some tuple hID

i then algorithm B re-

sponds to A with H

(ID

) = h

2. Otherwise B picks a random integer a

∈ Z

∗

and

generates a random coin c

∈ {0,1} with probabil-

ity Pr[c

= 0] = λ, for some λ ∈ [0,1].

3. If c

= 0, B computes h

= a

(bP) and if c

= 1, B

computes h

= a

4. Algorithm B adds the tuple hID

i to the

list L

and responds to A with h

-queries: To respond to the H

hash function

queries, B maintains a list L

= {hw,U, f i}. When

A requests the H

query on (w

) for some warrant

, B responds as follows:

1. If the query (w

) already appears on the list

in some tuple hw

, f i then algorithm B re-

sponds to A with H

) = f .

2. Otherwise B picks a random integer f ∈ Z

∗

and

adds the tuple hw

, f i to the list L

and re-

sponds to A with H

) as H

) = f .

Extraction queries: If A requests a private key on

identity ID

, B responds as follows:

1. B runs the above algorithm for responding to H

queries on ID

and obtains the corresponding tu-

ple hID

i on the list L

2. If c

= 0, then B outputs ‘failure’ and terminates.

3. If c

= 1, then B responds to A with S

Pub ∈ G

Remark: Note that H

(ID

) = h

= a

P so that

e(S

,P) = e(a

Pub,P)

= e(a

P, Pub)

= e(H

(ID

),Pub)

= e(Q

,Pub).

Thus, S is a valid private key corresponding to the

identity ID

and the probability of success is (1 − λ),

because we have considered the case for c

= 1.

Proxy multi-generation queries: When the adver-

sary A requests to interact with either the proxy signer

or anyone from the original signers, then challenger B

responds as follows:

1. Suppose, A requests to interact with the user ID

who is playing the role of one of the original

signers. For this, A creates a warrant w

and re-

quests ID

to sign the warrant. B queries w

its signing oracle and upon receiving a response

i, sends hw

i to A and adds the

warrant w to the delegation generation list say

del

2. Suppose, A requests to interact with user ID

where ID

is playing the role of the proxy signer.

For this, A creates a warrant w

and computes the

SECRYPT2014-InternationalConferenceonSecurityandCryptography

signatures V

= H

+ x

Pub. Where

∑

i=1

P for randomly selected x

∈ Z

∗

and

is private key of the original signer O

which

can be collected by A in the extraction query.

Then A sends (w

) (for i = 1,. .., n) to B .

B provides the corresponding proxy signing key

to A and adds the tuple hw

i to the proxy

multi-generation list say L

pmg

In either of the above cases,

1. B runs the above algorithm for responding to H

queries on w

obtaining the corresponding tuple

, f i, on L

list.

2. For H

query, if c = 0, then B reports ‘failure’ and

terminates. If c = 1, then, H

(ID

) = a

Then for V

= f a

Pub + x

Pub, one can check

that:

e(Pub, f Q

)

= e(Pub, f H

(ID

) +U

)

= e(Pub, f a

P + x

= e(P, f a

Pub + x

Pub)

= e(P,V

Hence the above provided proxy signing key is valid.

The success probability is (1 − λ), because we have

considered the case for c = 1.

Proxy multi-signature queries: Proceeding adap-

tively when adversary A requests for a proxy multi-

signature on message m

of its choice (with satisfying

the warrant w

), by the proxy signer P on behalf of

the n original signers O

, (i = 1,2, ..,n). B does the

following:

1. runs the above algorithm to respond H

-queries on

, obtaining the tuple hw

, f i on L

list.

2. If c = 0 then reports ‘failure’ and terminates. If

c = 1, then by the corresponding H

-query h = aP.

Now B randomly selects r

∈ Z

∗

and computes

= r

P and U

= r

P then having H

) =

f from H

query, for the tuple hw

, f i and

) = f

from H

query, for the tuple

, f

i, B again computes Q

= f (

∑

i=1

) +U

. Finally B computes V

= [ f

{ f (a

··· + a

+ a

) + r

} + r

]Pub for the signature on

message m

. One can check that:

e(Pub, f

{ f (

∑

i=1

+ Q

) +U

} +U

)

= e(Pub, f

{ f (H

(ID

) + ·· · + H

(ID

)

+ H

(ID

)) +U

} +U

)

= e(Pub, f

{ f (a

P + ·· · + a

P + a

P) + r

+ r

P) (for the case when c = 1)

= e(Pub, f

{ f (a

+ ··· + a

+ a

) + r

+ r

= e(P, f

{ f (a

+ ··· + a

+ a

) + r

}Pub

+ r

Pub)

= e(P,[ f

{ f (a

+ ··· + a

+ a

) + r

}

+ r

]Pub)

= e(P,V

Hence, the produced proxy multi-signature

) on message m

is valid, which

satisﬁes

e(P,V

) = e(Pub,h

(h(

∑

i=1

)+U

The success probability is (1 − λ), because we have

considered the case for c = 1.

Hence, the probability that B does not abort dur-

ing the simulation is

(1 − λ)

pmg

pms

Output: If B never reports ‘failure’ in the above

game, A outputs a valid ID-based proxy multi-

signature (w,U

,U) on message m which satisﬁes

e(P,V

) = e(Pub,h

(h(

∑

i=1

)+U)+U

If A does not query any hash function, that is, if re-

sponses to all the hash function queries are picked

randomly then the probability that veriﬁcation equal-

ity holds is less than 1/q. Hence, A outputs a new

valid ID-based proxy multi-signature (w,U

,U)

on message m with the probability

(1 − λ)

pmg

pms

(1 − 1/q).

Now we compute the success probability of B for

the solution of CDHP using the above forgeries (by

A). We consider both the possible cases, viz. , suc-

cess probability in case when A plays against an orig-

inal signer and when A plays against the proxy signer.

ASecureAnonymousProxyMulti-signatureScheme

Case 1. Suppose, A simulates B and requests to in-

teract with any user say ID

, where the user ID

playing the role of one original signer. For ID

, A

did not request the private key in Extraction queries,

A did not request a Proxy multi-generation query

including hw,ID

i and A did not request a Proxy

multi-signature query including hID

,w, mi. If c = 1,

then H

(ID

) = a

P for i = 2,.. .,n, and H

(ID

) =

P from the H

-query. Further B computes V

∗

− ([ f

{ f (a

+ ··· + a

+ a

) + r

} + r

]Pub),

then proceeds to solve CDHP using the equality:

e(P,V

) = e(Pub,h

(h(

∑

i=1

+ Q

) +U

)

= e(Pub, f

{ f (H

(ID

) + ·· · + H

(ID

)

+ H

(ID

)) +U

} +U

)

= e(Pub, f

{ f (a

+ ··· + a

+ a

) + r

+ r

P)e(Pub, f

{ f H

(ID

)})

= e(P,[ f

{ f (a

+ ··· + a

+ a

) + r

}

+ r

]Pub)e(Pub, f

{ f H

(ID

)})

or, by above we can write

e(P,V

∗

) = e(Pub, f

{ f H

(ID

)})

= e(Pub, f

f a

(bP))

= e(P, f

f a

(bsP))

= e(P,k(bsP))

where k = f

f a

∈ Z

∗

Comparing the components on both sides, B gets

∗

= k(bsP)

which implies that k

−1

∗

= bsP. Thus B can solve

an instance of CDHP.

The probability of success is λ(1 − λ)

Case 2. When A simulates B and requests to in-

teract with a user ID

, where user ID

is the proxy

signer. For ID

, A did not request the private key,

A did not request a proxy multi-generation query in-

cluding hw,ID

i and A did not request a proxy multi-

signature query including hID

,w, mi. As the above

case, we can show that B can derive sbP with the

same success probability λ(1 − λ)

Hence the overall success probability that B

solves the CDHP in the above attack game is:

= λ(1 − λ)

pmg

pms

(1 − 1/q)ε.

Now the maximum possible value of the above prob-

ability occurs for

λ =

+ q

pmg

+ q

pms

+ n + 1

Hence the optimal success probability is

ε(1 − 1/q)

M(q

+ q

pmg

+ q

pms

+ n + 1)

where

is the maximum value of

(1 − λ)

pmg

pms

for

λ =

+ q

pmg

+ q

pms

+ n + 1

Therefore

ε ≤

M(q

+ q

pmg

+ q

pms

+ n + 1)

1 − 1/q

Now taking care of running time, one can observe

that the running time of algorithm B is same as A’s

running time plus the time taken to respond to the

hash, extraction, proxy multi-generation and proxy

multi-signature queries, that is,

+ q

pmg

+ q

pms

Hence, the maximum running time is given by

t + (q

+ q

+ 2q

pmg

+ 4q

pms

+ 1)C

as each H

Hash query requires one scalar multiplica-

tion in G

, Extraction query also requires one scalar

multiplication in G

, proxy multi-generation query re-

quires two scalar multiplications in G

, proxy multi-

signature query requires four scalar multiplications

in G

and to output CDH solution from A’s forgery,

B requires at most one scalar multiplication in G

Hence

≥ t + (q

+ q

+ 2q

pmg

+ 4q

pms

+ 1)C

5.3 Anonymity

Theorem 12. The presented threshold anonymous

proxy multi-signature scheme is anonymous.

Proof. Since ρ

∈ Z

∗

are random, so is ρ

and

hence so is R

= ρ

P. Also, since ρ

∈ Z

∗

is random,

so is R

= ρ

P. Since ρ

, ρ

, R

and R

were com-

municated through a secure channel, these are hidden

from any adversary. So, no adversary would be able

to ascertain the identity of the proxy signer from the

computation Q

= Q

+ R

In fact, note that even a collusion of t

original

signers (t

< t) cannot recover ρ

and cannot really

prove that P is indeed the proxy signer. The last state-

ment follows from the security of the threshold veri-

ﬁable secret sharing (Pedersen, 1991) and to get the

value ρ

from R

, the adversary has to solve discrete

log problem, which is assumed to be hard.

SECRYPT2014-InternationalConferenceonSecurityandCryptography

5.4 Accountability

Theorem 13. The presented threshold anonymous

proxy multi-signature scheme is accountable.

Proof. To reveal the identity of the proxy signer, any

original signer O

can reveal R

and R

and show that

= Q

+ R

. (1)

That R

was indeed sent by P is proved using the

signature s

To prove that R

is not just a solution to the equa-

tion (1), t or more original signers combine their

shares to recover the secret ρ

and show that R

P. Since R

was randomly chosen by P , given

and Q

, R

is also random, and hence dis-

honest original signers can produce correct ρ

only if

they can solve the discrete log problem in G

6 EFFICIENCY COMPARISON

Here, we compare the efﬁciency of our scheme with

the IBPMS schemes of (Cao and Cao, 2009), (Du and

Wang, 2013) and (Shao, 2009), and show that our

scheme is more efﬁcient in the sense of computation

and operation time than these schemes. For the com-

putation of operation time, we refer to (Debiao et al.,

2011) where the operation time for various crypto-

graphic operations have been obtained using MIR-

ACL (MIRACL), a standard cryptographic library,

and the hardware platform is a PIV 3 GHZ proces-

sor with 512 M bytes memory and the Windows XP

operating system. For the pairing-based scheme, to

achieve the 1024-bit RSA level security, Tate pairing

deﬁned over the supersingular elliptic curve E = F

= x

+x with embedding degree 2 was used, where

q is a 160-bit Solinas prime q = 2

159

+ 2

+ 1 and p

a 512-bit prime satisfying p + 1 = 12qr. We note that

the OT for one pairing computation is 20.04ms, for

one scalar multiplication it is 6.38ms, for one map-to-

point hash function it is 3.04ms and for one general

hash function it is < 0.001ms. To evaluate the total

operation time in the efﬁciency comparison tables, we

use the simple method from (Cao et al., 2010; Debiao

et al., 2011). In each of the three phases: proxy multi-

generation, proxy multi-signature and proxy multi-

veriﬁcation, we compare the total number of bilin-

ear pairings (P), scalar multiplications (SM), map-to-

point hash functions (H) and the consequent opera-

tion time (OT) while omitting the operation time due

to a general hash function which is negligible com-

pared to the other three operations. Further, across

all the compared schemes, in the computation table

for proxy multi-generation, we take into consideration

the computations of only one of the n original signers

following the methodology of (Cao et al., 2010; De-

biao et al., 2011).

For example, the proxy multi-generation phase of

our scheme takes 2 pairing operations, 7 scalar mul-

tiplications and 1 map-to-point hash function. Hence

the total operation time for this phase can be calcu-

lated as: 2 × 20.04 + 7 × 6.38 + 1 × 3.04 = 87.78ms.

Similarly, we have computed the total OT in other

phases for all the schemes.

Table 1: Efﬁciency Comparison

Proxy multi-generation:

Scheme P H SM OT (ms)

(Cao and Cao, 2009) 3 3 3 88.38

(Du and Wang, 2013) 3 4 4

∗

97.80

(Shao, 2009) 3 3 2 82.00

Our scheme 2 1 7

∗

87.78

Proxy multi-signature:

Scheme P H SM OT (ms)

(Cao and Cao, 2009) 0 1 2 15.80

(Du and Wang, 2013) 0 1 2 15.80

(Shao, 2009) 0 1 2 15.80

Our scheme 0 0 3 19.14

Proxy multi-veriﬁcation:

Scheme P H SM OT (ms)

(Cao and Cao, 2009) 4 3 1 95.66

(Du and Wang, 2013) 4 3 1 95.66

(Shao, 2009) 4 3 0 89.28

Our scheme 2 1 2 55.88

Overall Time:

Scheme P H SM OT (ms)

(Cao and Cao, 2009) 7 7 6 199.84

(Du and Wang, 2013) 7 8 7 209.26

(Shao, 2009) 7 7 4 187.08

Our scheme 4 2 11 162.80

* The scalar multiplications due to pseudonym gen-

eration are not considered.

From the efﬁciency comparison table (1), it is

clear that our scheme is computationally more ef-

ﬁcient and having less operation time than the

schemes (Cao and Cao, 2009; Du and Wang, 2013;

Shao, 2009).

REFERENCES

Blakley, G. R. (1979). Safeguarding cryptographic keys. In

National Computer Conference, pages 313–317.

ASecureAnonymousProxyMulti-signatureScheme

Boldyreva, A., Palacio, A., and Warinschi, B. (2003).

Secure proxy signature schemes for delegation of

signing rights. IACR Cryptology ePrint Archive,

2003:096.

Cao, F. and Cao, Z. (2009). A secure identity-based

proxy multi-signature scheme. Information Sciences,

179(3):292–302.

Cao, X., Kou, W., and Du, X. (2010). A pairing-free

identity-based authenticated key agreement protocol

with minimal message exchanges. Information Sci-

ences, 180(15):2895–2903.

Chor, B., Goldwasser, S., Micali, S., and Awerbuch, B.

(1985). Veriﬁable secret sharing and achieving simul-

taneity in the presence of faults (extended abstract). In

FOCS, pages 383–395.

Debiao, H., Jianhua, C., and Jin, H. (2011). An id-based

proxy signature schemes without bilinear pairings.

Ann. Telecommun., 66(11-12):657–662.

Du, H. and Wang, J. (2013). An anonymous but accountable

proxy multi-signature scheme. Journal of Software,

8(8):1867–1874.

Fuchsbauer, G. and Pointcheval, D. (2008). Anonymous

proxy signatures. In Security and Cryptography for

Networks, pages 201–217.

Gasser, M., Goldstein, A., Kaufman, C., and Lampson, B.

(1989). The digital distributed system security archi-

tecture. In NCSC’89, pages 305–319.

Lee, B., Kim, H., and Kim, K. (2001). Strong proxy signa-

ture and its applications. In Proc of SCIS, volume 1,

pages 603–608.

Lee, N.-Y. and Lee, M.-F. (2005). The security of a strong

proxy signature scheme with proxy signer privacy

protection. Applied mathematics and computation,

161(3):807–812.

Lee, Y.-H., Hong, S.-M., and Yoon, H. (2005). A se-

cure strong proxy signature scheme with proxy signer

privacy protection. In CCCT’05. (International Con-

ference on Computing, Communications and Control

Technologies).

Mambo, M., Usuda, K., and Okamoto, E. (1996). Proxy

signatures: Delegation of the power to sign messages.

IEICE transactions on fundamentals of electronics,

communications and computer sciences, 79(9):1338–

1354.

MIRACL. Multiprecision integer and ra-

tional arithmetic cryptographic library.

http://certivox.org/display/EXT/MIRACL.

Pedersen, T. P. (1991). Non-interactive and information-

theoretic secure veriﬁable secret sharing. In Advances

in Cryptology – CRYPTO’91, pages 129–140.

Sahu, R. A. and Padhye, S. (2012). Efﬁcient id-based

proxy multi-signature scheme secure in random ora-

cle. Frontiers of Computer Science, 6(4):421–428.

Schuldt, J. C. N., Matsuura, K., and Paterson, K. G. (2008).

Proxy signatures secure against proxy key exposure.

In Public Key Cryptography, volume 4939 of LNCS,

pages 141–161.

Shamir, A. (1979). How to share a secret. Communications

of the ACM, 22(11):612–613.

Shao, Z. (2009). Improvement of identity-based proxy

multi-signature scheme. Journal of Systems and Soft-

ware, 82(5):794–800.

Shum, K. and Wei, V. K. (2002). A strong proxy signa-

ture scheme with proxy signer privacy protection. In

Enabling Technologies: Infrastructure for Collabora-

tive Enterprises, 2002. WET ICE 2002. Proceedings.

Eleventh IEEE International Workshops on, pages 55–

56. IEEE.

Sun, H.-M. and Hsieh, B.-T. (2003). On the security of

some proxy signature schemes. IACR Cryptology

ePrint Archive, 2003:068.

Toluee, R., Asaar, M. R., and Salmasizadeh, M. (2012). An

anonymous proxy signature scheme without random

oracles. IACR Cryptology ePrint Archive, 2012:313.

Wu, K.-L., Zou, J., Wei, X.-H., and Liu, F.-Y. (2008). Proxy

group signature: A new anonymous proxy signature

scheme. In Machine Learning and Cybernetics, 2008

International Conference on, volume 3, pages 1369–

1373.

Xiong, H., Hu, J., Chen, Z., and Li, F. (2011). On

the security of an identity based multi-proxy signa-

ture scheme. Computers & Electrical Engineering,

37(2):129–135.

Yu, Y., Xu, C., Huang, X., and Mu, Y. (2009). An efﬁcient

anonymous proxy signature scheme with provable se-

curity. Computer Standards & Interfaces, 31(2):348–

353.

SECRYPT2014-InternationalConferenceonSecurityandCryptography