Constantin POPESCU
Department of Mathematics and Computer Science, University of Oradea
Oradea 410087, Romania

Abstract: A proxy signature scheme is a variation of the ordinary digital signature schemes which enables a proxy signer to generate signatures on behalf of an original signer. In this paper, we present a secure proxy signature scheme. Our proxy signature scheme is based on the difficulty of solving the discrete logarithm problem. We prove that our proxy signature scheme meets all the security requirements for a proxy signature scheme.

Keywords: Cryptography, proxy signature, proxy signer, delegation, discrete logarithm problem, warrant.

>>Full text
CITE THIS PAPER AS:
Constantin POPESCU, A Secure Proxy Signature Scheme with Delegation by Warrant, Studies in Informatics and Control, ISSN 1220-1766, vol. 20 (4), pp. 373-380, 2011. https://doi.org/10.24846/v20i4y201105

1. Introduction

The concept of the proxy signature scheme was first introduced by Mambo et al. [9] in 1996. Their proxy signature scheme allows the original signer to delegate his/her signing right to the proxy signer to sign a message on behalf of the original signer. Afterwards, a verifier, which knows the public keys of the original signer and the proxy signer, can verify the validity of the proxy signature issued by the proxy signer.

The proxy signature scheme is classified in two criteria [9]: the delegation technique and generating the proxy signature. There are three types in the first criterion: full delegation, partial delegation and delegation by warrant. In a full delegation proxy signature scheme, a proxy signer uses the same private key as the original signer and generates a proxy signature as the original signer does. The disadvantage of the full delegation comes from the difficulty of distinguishing between the original signer and the proxy signer. In the partial delegation proxy signature scheme, an original signer derives a proxy key from his private key and sends it to a proxy signer in a secure channel. In a proxy signature scheme with delegation by warrant, the original signer gives a proxy signer a special message, namely, warrant. A warrant certifies that the proxy signer is legal and consists of signers’ identity, delegation period and the types of the message on which the proxy signer can sign.

Also, there are two types in the second criterion: protected and unprotected proxy signature schemes. In an unprotected proxy signature scheme, the proxy signature is generated by the both the proxy signer and the original signer. In this case, the verifier cannot distinguish the identity of the signer. In a protected proxy signature scheme, the proxy signature is generated with the proxy signature key of the original signer and also with the private key of the proxy signer. Afterwards, a verifier validates the proxy signature with the public keys of both the original signer and the proxy signer.

Proxy signature schemes are useful in many applications such as electronic payment systems [3], [15], [17], [18] and wireless networks [7], [26].

A lot of proxy signature schemes and some ID-based proxy signature schemes with special features were proposed, such as identity-based multi-proxy signature [1], [2], identity-based strong designated verifier proxy signature [28], [30].

Okamoto et al. [14] proposed a proxy unprotected signature scheme based on the RSA assumption. Also, in 2001, Lee et al. [7] proposed a proxy protected signature scheme based on the RSA assumption. Unfortunately, Wang et al. [27] point out that Lee et al.’s [7] proxy signature scheme is insecure. The first proxy signature scheme based on the factoring integer problem is proposed by Shao [22], in 2003. Recently, Zhou et al. [31] proposed two efficient proxy protected signature schemes. Their first scheme is based on RSA [20] assumption and the second scheme is based on the integer factorization problem. Zhou et al. [31] claim that their schemes are more efficient than other schemes. However, Park et al. [16] point out their schemes are insecure. Moreover, Liu et al. [8] point out that Zhou et al.’s [31] schemes are vulnerable to the undelegated proxy signature attack: any attacker without the delegation of the original signer can generate a valid proxy signature. Xue et al. [29] proposed two proxy signature schemes based on the difficulty of factorings of large integers without formal security proofs. Recently, Shao [24] proposed proxy protected signature scheme based on RSA. Also, most proxy signature schemes are based on the difficulty of discrete logarithm problem [4] or elliptic curve discrete logarithm problem [6], [11], [19], [25].

Mambo et al. [9], [10] proposed three proxy signature schemes based on ElGamal’s signature scheme [5], Schnorr’s signature scheme [21], and Okamoto’s signature scheme [13].

In 1996, Mambo, Usuda and Okamoto, first defined the basic security properties of a proxy signature scheme as follows [9], [10]:

Verifiability: From a proxy signature, a verifier can be convinced of the original signer’s agreement on the signed message.

Strong unforgeability: A proxy signer can create a valid proxy signature on behalf of the original signer. However, the original signer and any third party cannot generate a valid proxy signature with the name of proxy signers.

Strong identifiability: From a proxy signature, anyone can determine the identity of the corresponding proxy signer.

Strong undeniability: Once a proxy signer generates a valid proxy signature on behalf of the original signer, the proxy signer cannot deny his signature generation against anyone.

Prevention of misuse: It should be confident that the proxy key pair cannot be used for other purposes. In the case of misuse, the responsibility of proxy signers should be determined explicitly.