Cryptanalysis of the SNOVA Signature Scheme.

Peigen Li,Jintai Ding

DOI: https://doi.org/10.1007/978-3-031-62746-0_4

2024-01-01

Abstract:SNOVA is a variant of a UOV-type signature scheme over a noncommutative ring. In this article, we demonstrate that certain parameters provided by authors in SNOVA fail to meet the NIST security level, and the complexities are lower than those claimed by SNOVA.

What problem does this paper attempt to address?

Cryptanalysis Of A Certificateless Signature Scheme Without Pairings

Miaomiao Tian,Liusheng Huang

DOI: https://doi.org/10.1002/dac.2310

2013-01-01

International Journal of Communication Systems

Abstract:Certificateless cryptography is an attractive paradigm for public key cryptography as it does not require certificates in traditional public key cryptography and, at the same time, solves the inherent key escrow problem in identity-based cryptography. Recently, an efficient certificateless signature scheme without using pairings was proposed by He, Chen and Zhang. They claimed that it is provably secure under the discrete logarithm assumption in the random oracle model. However, in this paper, we show that their scheme is insecure against a type II adversary who can access to the master secret key of the system. Copyright (c) 2012 John Wiley & Sons, Ltd.
Cryptanalysis of the Lifted Unbalanced Oil Vinegar Signature Scheme

Jíntai Ding,Joshua D. Deaton,Kurt Schmidt,Vishakha ...,Zheng Zhang

DOI: https://doi.org/10.1007/978-3-030-56877-1_10

2020-01-01

Abstract:In 2017, Ward Beullens et al. submitted Lifted Unbalanced Oil and Vinegar (LUOV) [4], a signature scheme based on the famous multivariate public key cryptosystem (MPKC) called Unbalanced Oil and Vinegar (UOV), to NIST for the competition for post-quantum public key scheme standardization. The defining feature of LUOV is that, though the public key $$\mathscr {P}$$ works in the extension field of degree r of $$\mathbb {F}_2$$ , the coefficients of $$\mathscr {P}$$ come from $$\mathbb {F}_2$$ . This is done to significantly reduce the size of $$\mathscr {P}$$ . The LUOV scheme is now in the second round of the NIST PQC standardization process. In this paper we introduce a new attack on LUOV. It exploits the “lifted” structure of LUOV to reduce direct attacks on it to those over a subfield. We show that this reduces the complexity below the targeted security for the NIST post-quantum standardization competition.
Practical and Theoretical Cryptanalysis of VOX

Hao Guo,Yi Jin,Yuansheng Pan,Xiaoou He,Boru Gong,Jintai Ding

DOI: https://doi.org/10.1007/978-3-031-62746-0_9

2024-01-01

Abstract:VOX is a UOV-like hash-and-sign signature scheme from the Multivariate Quadratic (MQ) family, which has been submitted to NIST Post-Quantum Cryptography Project, in response to NIST's Call for Additional Digital Signature Schemes for the PQC Standardization Process. In 2023, the submitters of VOX updated the sets of recommended parameters of VOX, due to the rectangular MinRank attack proposed by Furue and Ikematsu. In this work we demonstrate the insecurity of the updated VOX from both the practical and the theoretical aspects. First, we conduct a practical MinRank attack against VOX, which uses multiple matrices from matrix deformation of public key to form a large rectangular matrix and evaluate the rank of this new matrix. By using Kipnis-Shamir method and Grobner basis calculation only instead of support-minors method, our experiment shows it could recover, within two seconds, the secret key of almost every updated recommended instance of VOX. Moreover, we propose a theoretical analysis on VOX by expressing public/secret key as matrices over a smaller field to find a low-rank matrix, resulting in a more precise estimation on the concrete hardness of VOX; for instance, the newly recommended VOX instance claimed to achieve NIST security level 3 turns out to be 69-bit-hard, as our analysis shows.
Cryptanalysis of Strong Designated Verifier Signature Scheme with Non-delegatability and Non-transferability

Mingwu Zhang,Tsuyoshi Takagi,Bo Yang,Fagen Li

DOI: https://doi.org/10.1587/transfun.e95.a.259

2012-01-01

Abstract:Strong designated verifier signature scheme (SDVS) allows a verifier to privately check the validity of a signature. Recently, Huang et al. first constructed an identity-based SDVS scheme (HYWS) in a stronger security model with non-interactive proof of knowledge, which holds the security properties of unforgeability, non-transferability, non-delegatability, and privacy of signer's identity. In this paper, we show that their scheme does not provide the claimed properties. Our analysis indicates that HYWS scheme neither resist on the designated verifier signature forgery nor provide simulation indistinguishability, which violates the security properties of unforgeability, non-delegatability and non-transferability.
Security analysis of verifiably encrypted signature scheme

XIA Qi,XU Chun-xiang

2009-01-01

Abstract:The security of Yang et al. verifiably encrypted signature schemes is analyzed.Although the scheme is proved security in the standard model,it is vulnerable to key substitution attack in a multi-user setting,where an adversary can generate new keys satisfying legitimate verifiably encrypted signatures created by the legitimate users.A concrete instance of fair exchange of digital signature protocol is given to show that this kind attack can breach the fairness when they are used in fair exchange in a multi-user setting.
A Complete Cryptanalysis of the Post-Quantum Multivariate Signature Scheme Himq-3

Jíntai Ding,Zheng Zhang,Joshua D. Deaton,Lih-Chung Wang

DOI: https://doi.org/10.1007/978-3-030-61078-4_24

2020-01-01

Abstract:In 2017 Kyung-Ah Shim et al. proposed a multivariate signature scheme called Himq-3 which is a submission to National Institute of Standards and Technology (NIST) standardization process of post-quantum cryptosystems. The Himq-3 signature scheme can be classified into the oil vinegar signature scheme family. Similar to the rainbow signature scheme, the Himq-3 signature scheme uses a multilayer structure to shorten the signature size. Moreover the signing process is very fast due to a special system called L-inveritble cycle system that is used to invert the central map. In this paper, we provide a complete cryptanalysis to the Himq-3 signature scheme. We describe a new attack method called the singularity attack. This attack is based on the observation that the variables in the L-invertible cycle system are not allowed to be zero in a valid signature. For the completeness, we show step by step how variables and layers can be separated so that signature forgery can be performed. We claim that the complexity of our attack is much lower than the proposed security level.
Key substitution attacks on some verifiably encrypted signature schemes

Qi Xia,Chunxiang Xu,Yong Yu

DOI: https://doi.org/10.3772/j.issn.1006-6748.2011.02.013

2011-01-01

Abstract:As a special kind of digital signature, verifiably encrypted signatures are used as a building block to construct optimistic fair exchange. Many verifiably encrypted signature schemes have been proposed so far and most of them were proven secure under certain complexity assumptions. In this paper, however, we find that although some schemes are secure in a single-user setting, they are not secure in a multi-user setting any more. We show that Zhang, et al.'s scheme, Gorantla, et al.'s scheme and Ming, et al.'s scheme are vulnerable to key substitution attacks, where an adversary can generate new keys satisfying legitimate verifiably encrypted signatures created by the legitimate users. We also show that this kind of attacks can breach the fairness when they are used in fair exchange in a multi-user setting. © by HIGH TECHNOLOGY LETTERS PRESS.
The Singularity Attack to the Multivariate Signature Scheme Himq-3.

Jintai Ding,Zheng Zhang,Joshua Deaton

DOI: https://doi.org/10.3934/amc.2020043

2019-01-01

Advances in Mathematics of Communications

Abstract:We present a cryptanalysis of a signature scheme HIMQ-3 due to Kyung-Ah Shim et al [10], which is a submission to National Institute of Standards and Technology (NIST) standardization process of post-quantum cryptosystems in 2017. We will show that inherent to the signing process is a leakage of information of the private key. Using this information one can forge a signature.
Further Cryptanalysis of a Signature Scheme with Message Recovery

Lei Niu,Yong Yu,Jianbing Ni,Ying Sun

DOI: https://doi.org/10.1109/incos.2012.41

2012-01-01

Abstract:Chang et al. proposed a new digital signature scheme with message recovery. They claimed that their scheme was accomplished without using one-way hash functions and message redundancy. However, several forgery attacks demonstrated that Chang et al.'s signature scheme with message recovery is not secure. However, the idea of how to get the attacks is unclear. In this paper, we present more general forgery attacks to show clearly how to obtain the attacks. Interestingly, our general forgery covers all the known attacks.
Advanced Security Analysis of a Signature Scheme with Message Recovery.

Lei Niu,Changqing Zhang,Qi Xia,Yong Yu

DOI: https://doi.org/10.1504/ijics.2015.069212

2015-01-01

Abstract:Chang et al. proposed a new digital signature scheme with message recovery. However, several forgery attacks demonstrated that Chang et al.'s construction without using one-way hash functions and message redundancy is insecure. Nevertheless, it is unclear to see how to achieve the attacks. In this paper, more general forgery attacks are described to show clearly how to obtain these attacks. It is interesting that our general forgery covers all the known attacks.
Cryptanalysis of an Identity Based Signcryption without Random Oracles

Hu Xiong,Zhiguang Qin,Fagen Li

DOI: https://doi.org/10.3233/FI-2011-395

2011-01-01

Abstract:Signcryption is a cryptographic primitive that performs digital signature and public key encryption simultaneously, at lower computational costs and communication overhead than signing and encrypting separately. Recently, Yu et al. proposed an identity based signcryption scheme with a claimed proof of security. We show that their scheme is not secure even against a chosen-plaintext attack. (This work is supported by National Natural Science Foundation of China under Grant No. 61003230 and China Postdoctoral Science Foundation under Grant No. 20100480130.)
Cryptanalysis of Two Identity Based Signcryption Schemes

Qi Xia,Chunxiang Xu

DOI: https://doi.org/10.1109/dasc.2009.144

2009-01-01

Abstract:Recently, Yu et al. proposed two identity based signcryption schemes, one is an identity based signcryption scheme for multiple receivers and the other is an identity based signcryption scheme without random oracles. They showed their former scheme is secure against adaptive chosen ciphertext attacks and unforgeable in the random oracle model, and the latter scheme is secure against adaptive chosen ciphertext attacks and unforgeable in the standard model. In this paper, however, we show that their first scheme is vulnerable to universal forgery attack and their second scheme is not secure against adaptive chosen ciphertext attack.
Practical certificateless short signature scheme

Miaomiao Tian,Liusheng Huang,Wei Yang

DOI: https://doi.org/10.1504/IJESDF.2014.064409

2014-01-01

International Journal of Electronic Security and Digital Forensics

Abstract:Certificateless cryptography is an attractive paradigm for public key cryptography since it does not require certificates in traditional public key cryptography and also solves the inherent key escrow problem in identity-based cryptography. Currently, certificateless short signature is receiving significant attention from the public key cryptography research community as it is particularly useful in low-bandwidth communication environments. However, most of the certificateless short signature schemes only support low-level security. Recently, Choi et al. presented a certificateless short signature scheme and claimed that it is provably secure against super adversaries in the random oracle model. Unfortunately, in this paper, we show that their scheme is insecure even against a strong adversary. We then propose a new certificateless short signature scheme and prove that it is secure against strong adversaries. Compared with other certificateless short signature schemes, our scheme is more computationally efficient.
Cryptanalysis of the New TTS Scheme in CHES 2004

Jintai Ding,Dieter Schmidt,Zhijun Yin

DOI: https://doi.org/10.1007/s10207-006-0003-9

2006-01-01

International Journal of Information Security

Abstract:We combine the method of searching for an invariant subspace of the unbalanced Oil and Vinegar signature scheme and the Minrank method to defeat the new TTS signature scheme, which was suggested for low-cost smart card applications at CHES 2004. We show that the attack complexity is less than 250.
Security Flaw of an ECC-based Signcryption Scheme with Anonymity.

Hu Xiong,Jian-bin Hu,Zhong Chen

DOI: https://doi.org/10.6633/ijns.201307.15(4).12

2013-01-01

Abstract:Signcryption is a cryptographic primitive that performs digital signature and public key encryption simultaneously, at lower computational costs and communication overhead than signing and encrypting separately. Recently, Chung et al. proposed an anonymous ECC-based signcryption scheme. We show that their scheme is not secure even against a chosen-plaintext attack.
Schnorr Ring Signature Scheme with Designated Verifiability

Xin Lv,Feng Xu,Ping Ping,Xuan Liu,Huaizhi Su

DOI: https://doi.org/10.1109/DCABES.2015.48

2015-01-01

Abstract:Ring signatures enable a user to sign a message so that a ring of possible signers is identified, without revealing exactly which member of that ring actually generated the signature. In some situations, however, an actual signer may possibly want to expose himself, for instance, if doing so, he will acquire an enormous benefit. In this paper, a signature scheme with designated verifiability based on Schnorr ring signature is proposed. The scheme provides a confirmation procedure, in which the real signer is able to convince a designated party that he is the one who generates the signature. The confirming procedure involves an interactive Zero-Knowledge proof protocol, which is non-transferable, and it only can be triggered by the signer. Based on the intractability of Discrete Logarithm Problem (DLP), the scheme is existentially unforgeable under adaptive-chosen message attack in the random oracle model.
VDOO: A Short, Fast, Post-Quantum Multivariate Digital Signature Scheme

Anindya Ganguly,Angshuman Karmakar,Nitin Saxena

2023-12-15

Abstract:Hard lattice problems are predominant in constructing post-quantum cryptosystems. However, we need to continue developing post-quantum cryptosystems based on other quantum hard problems to prevent a complete collapse of post-quantum cryptography due to a sudden breakthrough in solving hard lattice problems. Solving large multivariate quadratic systems is one such quantum hard problem. Unbalanced Oil-Vinegar is a signature scheme based on the hardness of solving multivariate equations. In this work, we present a post-quantum digital signature algorithm VDOO (Vinegar-Diagonal-Oil-Oil) based on solving multivariate equations. We introduce a new layer called the diagonal layer over the oil-vinegar-based signature scheme Rainbow. This layer helps to improve the security of our scheme without increasing the parameters considerably. Due to this modification, the complexity of the main computational bottleneck of multivariate quadratic systems i.e. the Gaussian elimination reduces significantly. Thus making our scheme one of the fastest multivariate quadratic signature schemes. Further, we show that our carefully chosen parameters can resist all existing state-of-the-art attacks. The signature sizes of our scheme for the National Institute of Standards and Technology's security level of I, III, and V are 96, 226, and 316 bytes, respectively. This is the smallest signature size among all known post-quantum signature schemes of similar security.

Cryptography and Security
Cryptanalysis of a Certificateless Aggregate Signature Scheme with Efficient Verification

Han Shen,Jianhua Chen,Jian Shen,Debiao He

DOI: https://doi.org/10.1002/sec.1480

IF: 1.968

2016-01-01

Security and Communication Networks

Abstract:Recently, Chen et al. proposed a certificateless aggregate signature scheme with efficient verification. They claimed that their scheme could resist attacks of Type I adversary and Type II adversary. Unfortunately, we present a universal attack to demonstrate that their scheme cannot provide unforgeability. The adversary in the proposed attack can forge a legal signature on any message without any users' secret information. Copyright © 2016 John Wiley & Sons, Ltd.
HS-Sign: A Security Enhanced UOV Signature Scheme Based on Hyper-Sphere.

Jiahui Chen,Shaohua Tang,Xinglin Zhang

DOI: https://doi.org/10.3837/tiis.2017.06.020

2017-01-01

KSII Transactions on Internet and Information Systems

Abstract:For "generic" multivariate public key cryptography (MPKC) systems, experts believe that the Unbalanced Oil-Vinegar (UOV) scheme is a feasible signature scheme with good efficiency and acceptable security. In this paper, we address two problems that are to find inversion solution of quadratic multivariate equations and find another structure with some random Oil-Oil terms for UOV, then propose a novel signature scheme based on hyper-sphere (HS-Sign for short) which directly answers these two problems. HS-Sign is characterized by its adding Oil-Oil terms and more advantages compared to UOV. On the one side, HS-Sign is based on a new inversion algorithm from hyper-sphere over finite field, and is shown to be a more secure UOV-like scheme. More precisely, according to the security analysis, HS-Sign achieves higher security level, so that it has larger security parameters choice ranges. On the other side, HS-Sign is beneficial from both the key side and computing complexity under the same security level compared to many baseline schemes. To further support our view, we have implemented 5 different attack experiments for the security analysis and we make comparison of our new scheme and the baseline schemes with simulation programs so as to show the efficiencies. The results show that HS-Sign has exponential attack complexity and HS-Sign is competitive with other signature schemes in terms of the length of the message, length of the signature, size of the public key, size of the secret key, signing time and verification time.
Security analysis of some threshold signature schemes and multi-signature schemes

Tianjie Cao,Dongdai Lin

DOI: https://doi.org/10.1007/11599548_20

2005-01-01

Abstract:Digital signature scheme allows a user to sign a message in such a way that anyone can verify the signature, but no one can forge the signature on any other message. In this paper, we show that Xie and Yu’s threshold signature scheme, Huang and Chang’s threshold proxy signature scheme, Qian, Cao and Xue’s pairing-based threshold proxy signature scheme, Xue and Cao’s multi-proxy signature scheme and Zhou et al.’s proxy multi-signature scheme are all insecure against the forgery attacks.

Cryptanalysis of the SNOVA Signature Scheme.

Cryptanalysis Of A Certificateless Signature Scheme Without Pairings

Cryptanalysis of the Lifted Unbalanced Oil Vinegar Signature Scheme

Practical and Theoretical Cryptanalysis of VOX

Cryptanalysis of Strong Designated Verifier Signature Scheme with Non-delegatability and Non-transferability

Security analysis of verifiably encrypted signature scheme

A Complete Cryptanalysis of the Post-Quantum Multivariate Signature Scheme Himq-3

Key substitution attacks on some verifiably encrypted signature schemes

The Singularity Attack to the Multivariate Signature Scheme Himq-3.

Further Cryptanalysis of a Signature Scheme with Message Recovery

Advanced Security Analysis of a Signature Scheme with Message Recovery.

Cryptanalysis of an Identity Based Signcryption without Random Oracles

Cryptanalysis of Two Identity Based Signcryption Schemes

Practical certificateless short signature scheme

Cryptanalysis of the New TTS Scheme in CHES 2004

Security Flaw of an ECC-based Signcryption Scheme with Anonymity.

Schnorr Ring Signature Scheme with Designated Verifiability

VDOO: A Short, Fast, Post-Quantum Multivariate Digital Signature Scheme

Cryptanalysis of a Certificateless Aggregate Signature Scheme with Efficient Verification

HS-Sign: A Security Enhanced UOV Signature Scheme Based on Hyper-Sphere.

Security analysis of some threshold signature schemes and multi-signature schemes