Abstract:Certificateless cryptography involves a Key Generation Center (KGC) which issues a partial key to a user and the user also independently generates an additional public/secret key pair in such a way that the KGC who knows only the partial key but not the additional secret key is not able to do any cryptographic operation on behalf of the user; and a third party who replaces the public/secret key pair but does not know the partial key cannot do any cryptographic operation as the user either. We call this attack launched by the third party as the key replacement attack. In ACISP 2004, Yum and Lee proposed a generic construction of digital signature schemes under the framework of certificateless cryptography. In this paper, we show that their generic construction is insecure against key replacement attack. In particular, we give some concrete examples to show that the security requirements of some building blocks they specified are insufficient to support some of their security claims. We then propose a modification of their scheme and show its security in a new and simplified security model. We show that our simplified definition and adversarial model not only capture all the distinct features of certificateless signature but are also more versatile when compared with all the comparable ones. We believe that the model itself is of independent interest.A conventional certificateless signature scheme only achieves Girault's Level 2 security. For achieving Level 3 security, that a conventional signature scheme in Public Key Infrastructure does, we propose an extension to our definition of certificateless signature scheme and introduce an additional security model for this extension. We show that our generic construction satisfies Level 3 security after some appropriate and simple modification.

Insecurity of a Pairing-Free Certificateless Ring Signcryption Scheme

Cryptoanalysis of ID-based Proxy Re-Signature Scheme with Pairing-Free

Cryptanalysis of a Certificateless Signcryption Scheme for Wireless Sensor Networks in Ubiquitous Healthcare Systems

Improvement of Provably Secure Self-Certified Proxy Convertible Authenticated Encryption Scheme

A Provably Secure Ring Signature Scheme in Certificateless Cryptography

ON THE SECURITY OF A PAIRING-BASED SIGNCRYPTION SCHEME USING SELF-CERTIFIED PUBLIC KEYS

An Efficient Certificateless Signature Scheme With Provably Security and Its Applications

On the Security of Two Identity-Based Signature Schemes Based on Pairings

Security Flaw of an ECC-based Signcryption Scheme with Anonymity.

Lightweight Certificateless Signcryption Scheme Using Type-3 Pairing on Elliptic Curve

On The Security Of A Novel Construction Of Certificateless Aggregate Signature Scheme For Healthcare Wireless Medical Sensor Networks

A Novel Revocable Lightweight Authentication Scheme for Resource-Constrained Devices in Cyber–Physical Power Systems

An Efficient Identity-Based Ring Signcryption Scheme without Random Oracles

Certificateless Signature: a New Security Model and an Improved Generic Construction

ID-Based Ring Signature against Continual Side Channel Attack

Securing IoT-Based RFID Systems: A Robust Authentication Protocol Using Symmetric Cryptography

Bilinear Pairing-Based Hybrid Signcryption for Secure Heterogeneous Vehicular Communications

Complex Conjugated certificateless-based signcryption with differential integrated factor for secured message communication in mobile network

An Efficient Certificateless Anonymous Signcryption Scheme for WBAN

Certificateless Public Key Encryption Scheme with Hybrid Problems and Its Application to Internet of Things

Cryptanalysis of “Certificateless remote data integrity checking using lattices in cloud storage”