Design Principles of Secure Certificateless Signature and Aggregate Signature Schemes for IoT Environments

Abstract

Certificateless cryptography resolves the certificate management problem of public-key cryptography and the key-escrow problem of identity-based cryptography. An aggregate signature scheme which allows to aggregate <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> distinct signatures on <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> distinct messages of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> distinct signers into a single signature reduces communication overhead and computational cost. Due to the suitability of certificateless signature (CLS) and certificateless aggregate signature (CLAS) schemes for IoT environments, similar CLS and CLAS schemes have been proposed for a long time and, despite their security proofs, they have been attacked and modified to prevent the attacks. Even now, similar design methods and similar attacks on the schemes are being repeated. In order to prevent the similar attacks on the schemes, it is necessary to analyze their causes and vulnerabilities. In this paper, we first show that recently proposed five CLS and CLAS schemes are insecure against universal forgery attacks, type I attacks, type II attacks or malicious-but-passive-KGC attacks. We discuss their security flaws, causes and countermeasures. We then present design principles to prevent various algebraic attacks including our attacks. The design principles will help in the construction of secure CLS and CLAS schemes against the previous attacks and potential attacks.