On The Security Of Some Variants Of The Rsa Signature Scheme

M Michels,M Stadler,Hm Sun

DOI: https://doi.org/10.1007/BFb0055857

1998-01-01

Abstract:We describe adaptive attacks on several variants of the RSA signature scheme by de Jonge and Chaum. Moreover, we show how to break Boyd's scheme with an adaptive, a directed and a known signature attack. The feasibility of the adaptive attack on Boyd's scheme is illustrated by a concrete example.

What problem does this paper attempt to address?

Building A New Secure Variant Of Rainbow Signature Scheme

Yang Tan,Shaohua Tang,Jie Chen,Yong Yu,Xiangxue Li

DOI: https://doi.org/10.1049/iet-ifs.2015.0016

2016-01-01

IET Information Security

Abstract:Rainbow is an effective multivariate digital signature scheme proposed by Ding and Schmidt. However, a lot of attacks against it have been proposed. To resist all these attacks, designer should be very careful with its choice of parameters. In this study, the authors will propose a new approach to build a secure variant of Rainbow. According to our security analysis, it could resist all the existing attacks against Rainbow and save some memory in the meantime.
Multiple-Time Signature Schemes Against Adaptive Chosen Message Attacks

J Pieprzyk,HX Wang,CP Xing

DOI: https://doi.org/10.1007/978-3-540-24654-1_7

2004-01-01

Abstract:Multiple-time signatures are digital signature schemes where the signer is able to sign a predetermined number of messages. They are interesting cryptographic primitives because they allow to solve many important cryptographic problems, and at the same time offer substantial efficiency advantage over ordinary digital signature schemes like RSA. Multiple-time signature schemes have found numerous applications, in ordinary, on-line/off-line, forward-secure signatures, and multicast/stream authentication. We propose a multiple-time signature scheme with very efficient signing and verifying. Our construction is based on a combination of one-way functions and cover-free families, and it is secure against the adaptive chosen-message attack.
Advanced Security Analysis of a Signature Scheme with Message Recovery.

Lei Niu,Changqing Zhang,Qi Xia,Yong Yu

DOI: https://doi.org/10.1504/ijics.2015.069212

2015-01-01

Abstract:Chang et al. proposed a new digital signature scheme with message recovery. However, several forgery attacks demonstrated that Chang et al.'s construction without using one-way hash functions and message redundancy is insecure. Nevertheless, it is unclear to see how to achieve the attacks. In this paper, more general forgery attacks are described to show clearly how to obtain these attacks. It is interesting that our general forgery covers all the known attacks.
New Provably Secure Signature Scheme

Jie Wang,Wenbin Li

2003-01-01

Abstract:A new mathematical problem-Decisional Relevant-RSA problem was introduced to construct a new signature scheme.It is simple and secure against adaptive chosen-message attacks.In addition its security proof is in the standard model.
Further Cryptanalysis of a Signature Scheme with Message Recovery

Lei Niu,Yong Yu,Jianbing Ni,Ying Sun

DOI: https://doi.org/10.1109/incos.2012.41

2012-01-01

Abstract:Chang et al. proposed a new digital signature scheme with message recovery. They claimed that their scheme was accomplished without using one-way hash functions and message redundancy. However, several forgery attacks demonstrated that Chang et al.'s signature scheme with message recovery is not secure. However, the idea of how to get the attacks is unclear. In this paper, we present more general forgery attacks to show clearly how to obtain the attacks. Interestingly, our general forgery covers all the known attacks.
On the Security of an Efficient Attribute-Based Signature.

Yan Zhang,Dengguo Feng,Zhengfeng Zhang,Liwu Zhang

DOI: https://doi.org/10.1007/978-3-642-38631-2_28

2013-01-01

Abstract:In CT-RSA 2011, Maji et.al proposed an attribute-based signature (ABS) scheme, which is the most efficient ABS scheme that supports general predicates until now. They claimed that their ABS scheme is unforgeable under generic group model. Unfortunately, we found a forgery attack on this ABS scheme. In this paper, we firstly give a forgery example, then analyze the reason cause this attack and gives the conditions this attack worked. We found this attack is fatal to Maji et.al's ABS scheme. © 2013 Springer-Verlag.
An Efficient and Provably Secure Pairing-Free Certificateless Signature Scheme Based on Variant of RSA.

Liangliang Wang,Mi Wen,Kefei Chen,Zhongqin Bi,Yu Long

DOI: https://doi.org/10.1007/978-3-319-69471-9_19

2017-01-01

Abstract:Through the application of certificateless signature, certificate management in traditional signatures can be simplified. Furthermore, the key escrow problem in identity-based signatures can be solved as well. As history has shown, there has not been a general pairing-free certificateless signature scheme which is mainly designed with modular exponentiation and modular multiplication that can possess resistance to Type I and Type II adversaries so far. Therefore, a new hard mathematic problem is firstly defined in this paper, which is called variant of RSA problem. In the next step, a new general pairing-free certificateless signature scheme is proposed based on the newly defined variant of RSA problem and the well known discrete logarithm problem. Fortunately, the proposed scheme is also the first RSA-based certificateless signature scheme that can possess resistance to Type I and Type II adversaries. In addition, a formal security proof is provided to demonstrate that, under adaptively chosen message attacks, the proposed scheme is provably secure against Type I and Type II adversaries in the random oracle model. When compared with other known pairing-free certificateless signature schemes of the same type, the computation cost of our scheme is slightly higher, however, a higher security level can be achieved.
Breaking the Symmetry: a Way to Resist the New Differential Attack.

Jintai Ding,Bo-Yin Yang,Chen-Mou Cheng,Chia-Hsin Owen Chen,Vivien Dubois

2007-01-01

Abstract:sflash had recently been broken by Dubois, Stern, Shamir, etc., using a differential attack on the public key. The C∗− signature schemes are hence no longer practical. In this paper, we will study the new attack from the point view of symmetry, then (1) present a simple concept (projection) to modify several multivariate schemes to resist the new attacks; (2) demonstrate with practical examples that this simple method could work well; and (3) show that the same discussion of attack-and-defence applies to other big-field multivariates. The speed of encryption schemes is not affected, and we can still have a big-field multivariate signatures resisting the new differential attacks with speeds comparable to sflash.
Attacking the Diebold Signature Variant -- RSA Signatures with Unverified High-order Padding

Ryan W. Gardner,Tadayoshi Kohno,Alec Yasinsac

2024-03-14

Abstract:We examine a natural but improper implementation of RSA signature verification deployed on the widely used Diebold Touch Screen and Optical Scan voting machines. In the implemented scheme, the verifier fails to examine a large number of the high-order bits of signature padding and the public exponent is three. We present an very mathematically simple attack that enables an adversary to forge signatures on arbitrary messages in a negligible amount of time.

Cryptography and Security
Tightly-Secure Signatures From The Decisional Composite Residuosity Assumption

Xiao Zhang,Shengli Liu,Dawu Gu

DOI: https://doi.org/10.1007/978-3-319-60055-0_24

2017-01-01

Abstract:In this paper, we construct the first tightly secure signature scheme against adaptive chosen message attacks (CMA) from the Decisional Composite Residuosity (DCR) Assumption. Moreover, the verification key in our scheme is of constant size. Based on the DCR assumption, we design a one-time secure signature scheme first, then we employ a flat tree structure to obtain a signature scheme that is secure against non-adaptive chosen message attacks (NCMA). By combining the one-time scheme and NCMA-secure scheme, we obtain the final CMA-secure signature scheme with a tight security reduction to the DCR assumption.
A Strong RSA Signature Scheme and Its Application

Huafeng Wu,Haiguang Chen,Qiang Zhou,Chuanshan Gao

DOI: https://doi.org/10.1109/snpd.2007.33

2007-01-01

Abstract:We present an efficient improvement of the strong RSA signature scheme [1], which is very similar to Fischlin sig nature [2]. Both two signatures are based on strong RSA assumption. In the original scheme, the signer has to choose a prime with prescribed length in signing phase. Except that, three generators of QRn should be chosen in the set-up phase. Our scheme removes or relaxes these restrictions. It only needs to choose two generators of QRn and an odd. Our scheme saves about 1/2 computational cost of the original scheme. Moreover, we propose a blind signature scheme and a partially blind signature scheme based on the basic scheme. To the best of our knowledge, it's the first time to propose such a blind signature scheme and a partially blind signature scheme based on strong RSA assumption.
THRESHOLD FAIL-STOP SIGNATURE SCHEMES BASED ON RSA

Jiang Lei,Liu Shengli,Chen Kefei

DOI: https://doi.org/10.3969/j.issn.1000-386X.2009.01.001

2009-01-01

Abstract:The security of fail-stop signature schemes does not rely on assumption of computational power of forger.Fail-stop signature schemes provide security even if a forger possesses unlimited computation power by enabling the sender to provide a proof on forgery if it occurs.Currently the study of fail-stop signature based on RSA has been mature.We construct a new threshold fail-stop signature scheme based on it and provide security analysis of the scheme.Our scheme is based on a provably secure RSA fail-stop signature scheme with the advantage of cheater detection(verification of partial signatures) and efficient proof of forgery.
Improvement of Adaptive Threshold RSA

Feiyu Lei,Wen Chen,Kefei Chen

DOI: https://doi.org/10.1007/1-84628-352-3_16

2006-01-01

Abstract:We put forward a solution to secure threshold RSA cryptosystems in the adaptive adversary model. Most protocols in the current literature for threshold cryptosystems were secure only against static adversary, especially for threshold RSA which is harder to be distributed than discrete logarithm schemes due to the unknown order of RSA exponents. In this paper, we point out that Canetti's solution to RSA is not secure. Then we propose a simple efficient adaptive secure RSA signature. And the proofs of adaptive secure simulation is given.
Insecurity of Chait et al.'s RSA-Based Aggregate Signature Scheme

Chanhyeok Park,Sangrae Cho,Young-Seob Cho,Soohyung Kim,Hyung Tae Lee

DOI: https://doi.org/10.1109/access.2024.3358849

IF: 3.9

2024-02-07

IEEE Access

Abstract:Recently, Chait et al. proposed a new aggregate signature scheme under the RSA setting (IEEE Access, 2023). In this paper, we show that Chait et al.'s aggregate signature scheme is insecure when two signers collude with their own secret keys, by presenting an attack algorithm that forges aggregate signatures of aggregator or individual signatures of all other (non-colluding) users. More concretely, our attack algorithm consists of three sub-algorithms: The first sub-algorithm computes a multiple of from secret keys of two users where is the RSA modulus that is included in the public parameter of the system and is the Euler totient function. The second sub-algorithm recovers an equivalent secret key of a target user that is congruent to his/her original secret key modulo from his/her public key and the multiple of which is the output of the first sub-algorithm. Finally, with the equivalent secret key obtained by the second sub-algorithm, the last sub-algorithm generates valid aggregate/individual signatures of the target user. Our attack algorithm always succeeds in forging aggregate/individual signatures. Furthermore, it is lightweight in the sense that it requires several integer operations, gcd computations, and an execution of aggregate/individual signing algorithm only. For example, when the pubic parameter and secret keys of all users, except the target user, are provided, our experimental results demonstrate that the proposed attack algorithm takes less than 1 second only in total to forge an aggregate signature of 29 individual signatures including that of the target user, where is 3,072 bits for 128-bit security.

computer science, information systems,telecommunications,engineering, electrical & electronic
On the (In)security of optimized Stern-like signature schemes

André Chailloux,Simona Etinski

DOI: https://doi.org/10.1007/S10623-023-01329-Y

2024-08-28

Abstract:Stern's signature scheme is a historically important code-based signature scheme. A crucial optimization of this scheme is to generate pseudo-random vectors and a permutation instead of random ones, and most proposals that are based on Stern's signature use this optimization. However, its security has not been properly analyzed, especially when we use deterministic commitments. In this article, we study the security of this optimization. We first show that for some parameters, there is an attack that exploits this optimization and breaks the scheme in time $O(2^{\frac{\lambda}{2}})$ while the claimed security is $\lambda$ bits. This impacts in particular the recent Quasy-cyclic Stern signature scheme [BGMS22]. Our second result shows that there is an efficient fix to this attack. By adding a string $salt \in \{0,1\}^{2\lambda}$ to the scheme, and changing slightly how the pseudo-random strings are generated, we prove not only that our attack doesn't work but that for any attack, the scheme preserves $\lambda$ bits of security, and this fix increases the total signature size by only $2\lambda$ bits. We apply this construction to other optimizations on Stern's signature scheme, such as the use of Lee's metric or the use of hash trees, and we show how these optimizations improve the signature length of Stern's signature scheme.

Cryptography and Security
Further Cryptanalysis of a Type of RSA Variants

Gongyu Shi,Geng Wang,Dawu Gu

DOI: https://doi.org/10.1007/978-3-031-22390-7_9

2022-01-01

Abstract:To enhance the security or the efficiency of the standard RSA cryptosystem, some variants have been proposed based on elliptic curves, Gaussian integers or Lucas sequences. A typical type of these variants which we called Type-A variants have the specified modified Euler's totient function psi(N) = (p(2) - 1)(q(2) - 1). But in 2018, based on cubic Pell equation, Murru and Saettone presented a new RSA-like cryptosystem, and it is another type of RSA variants which we called Type-B variants, since their scheme has psi(N) = (p(2) + p+ 1)(q(2) + q+ 1). For RSA-like cryptosystems, four key-related attacks have been widely analyzed, i.e., the small private key attack, the multiple private keys attack, the partial key exposure attack and the small prime difference attack. These attacks are well-studied on both standard RSA and Type-A variants. Recently, the small private key attack on Type-B variants has also been analyzed. In this paper, we make further cryptanalysis of Type-B variants, that is, we propose the first theoretical results of multiple private keys attack, partial key exposure attack as well as small prime difference attack on Type-B variants, and the validity of our attacks are verified by experiments. Our results show that for all three attacks, Type-B variants are less secure than standard RSA.
On the Security of Two Identity-Based Signature Schemes Based on Pairings

Zhen Qin,Chen Yuan,Yilei Wang,Hu Xiong

DOI: https://doi.org/10.1016/j.ipl.2016.02.003

IF: 0.851

2016-01-01

Information Processing Letters

Abstract:ID-based signature enables users to verify signatures using only public identifier. Very recently, Rossi and Schmid (2015) [9] proposed two identity-based signature schemes along with the application to group communications. Unfortunately, by proposing concrete attack, we demonstrate that the former scheme is insecure against forgery attack, while the latter scheme has been totally broken in the sense that the signing key can be recovered from the valid signature easily.
RSA with balanced short exponents and its application to entity authentication

Hung-Min Sun,Cheng-Ta Yang

DOI: https://doi.org/10.1007/978-3-540-30580-4_14

2005-01-01

Abstract:In typical RSA, it is impossible to create a key pair (e,d) such that both are simultaneously much shorter than φ (N). This is because if d is selected first, then e will be of the same order of magnitude as φ (N), and vice versa. At Asiacrypt'99, Sun et al. designed three variants of RSA using prime factors p and q of unbalanced size. The first RSA variant is an attempt to make the private exponent d short below N0.25 and N0.292 which are the lower bounds of d for a secure RSA as argued first by Wiener and then by Boneh and Durfee. The second RSA variant is constructed in such a way that both d and e have the same bit-length $\frac{1}{2}\log _{2}N+56$. The third RSA variant is constructed by such a method that allows a trade-off between the lengths of d and e. Unfortunately, at Asiacrypt'2000, Durfee and Nguyen broke the illustrated instances of the first RSA variant and the third RSA variant by solving small roots to trivariate modular polynomial equations. Moreover, they showed that the instances generated by these three RSA variants with unbalanced p and q in fact become more insecure than those instances, having the same sizes of exponents as the former, in RSA with balanced p and q. In this paper, we focus on designing a new RSA variant with balanced d and e, and balanced p and q in order to make such an RSA variant more secure. Moreover, we also extend this variant to another RSA variant in which allows a trade-off between the lengths of d and e. Based on our RSA variants, an application to entity authentication for defending the stolen-secret attack is presented.
RKA Security of Identity-Based Homomorphic Signature Scheme

Jinyong Chang,Hui Ma,Anling Zhang,Maozhi Xu,Rui Xue

DOI: https://doi.org/10.1109/access.2019.2908244

IF: 3.9

2019-01-01

IEEE Access

Abstract:Recently, Lin et al. proposed a new primitive identity-based (IB) homomorphic signature scheme and presented an ingenious implement by using any IB-signature scheme as a building block. In this paper, we consider a new type of attack on their scheme: Related-key attack (RKA) is introduced by Bellare and Kohno in 2003 and widely considered for kinds of cryptographic primitives. Specifically, for the first time, we define the RKA security of IB-homomorphic signature scheme. By modifying the signing secret key as its linear form, we prove that Lin et al.’s IB-homomorphic signature scheme is not RKA secure. But a slight modification of it yields an RKA secure one under the original assumptions. We also present security proof in detail. However, we remark that the reason why RKA on Lin et al.’s scheme can be successful lies in that RKA is outside of its security model. Finally, the numerical analysis and experimental results demonstrate that our modified scheme does not distinctly decrease the computational efficiency of Lin et al.’s scheme.

computer science, information systems,telecommunications,engineering, electrical & electronic
Key substitution attacks on some verifiably encrypted signature schemes

Qi Xia,Chunxiang Xu,Yong Yu

DOI: https://doi.org/10.3772/j.issn.1006-6748.2011.02.013

2011-01-01

Abstract:As a special kind of digital signature, verifiably encrypted signatures are used as a building block to construct optimistic fair exchange. Many verifiably encrypted signature schemes have been proposed so far and most of them were proven secure under certain complexity assumptions. In this paper, however, we find that although some schemes are secure in a single-user setting, they are not secure in a multi-user setting any more. We show that Zhang, et al.'s scheme, Gorantla, et al.'s scheme and Ming, et al.'s scheme are vulnerable to key substitution attacks, where an adversary can generate new keys satisfying legitimate verifiably encrypted signatures created by the legitimate users. We also show that this kind of attacks can breach the fairness when they are used in fair exchange in a multi-user setting. © by HIGH TECHNOLOGY LETTERS PRESS.

On The Security Of Some Variants Of The Rsa Signature Scheme

Building A New Secure Variant Of Rainbow Signature Scheme

Multiple-Time Signature Schemes Against Adaptive Chosen Message Attacks

Advanced Security Analysis of a Signature Scheme with Message Recovery.

New Provably Secure Signature Scheme

Further Cryptanalysis of a Signature Scheme with Message Recovery

On the Security of an Efficient Attribute-Based Signature.

An Efficient and Provably Secure Pairing-Free Certificateless Signature Scheme Based on Variant of RSA.

Breaking the Symmetry: a Way to Resist the New Differential Attack.

Attacking the Diebold Signature Variant -- RSA Signatures with Unverified High-order Padding

Tightly-Secure Signatures From The Decisional Composite Residuosity Assumption

A Strong RSA Signature Scheme and Its Application

THRESHOLD FAIL-STOP SIGNATURE SCHEMES BASED ON RSA

Improvement of Adaptive Threshold RSA

Insecurity of Chait et al.'s RSA-Based Aggregate Signature Scheme

On the (In)security of optimized Stern-like signature schemes

Further Cryptanalysis of a Type of RSA Variants

On the Security of Two Identity-Based Signature Schemes Based on Pairings

RSA with balanced short exponents and its application to entity authentication

RKA Security of Identity-Based Homomorphic Signature Scheme

Key substitution attacks on some verifiably encrypted signature schemes