Cryptanalysis of a Lightweight Certificateless Signature Scheme for IIOT Environments

As an extremely significant cryptographic primitive, certificateless signature (CLS) schemes can provide message authentication with no use of traditional digital certificates. High efficiency and provable security without random oracle are challensges in designing a CLS scheme. Recently, Karati et al. proposed an efficient pairing-based CLS scheme with no use of map-to-point hash function and random oracle model to provide data authenticity in Industrial Internet of Things (IIoT) systems. The security proof was given under several hardness assumptions. However, we notice that both public key replacement attack and known message attack are existing in Karati et al.’s scheme. Any adversary without knowledge of signer’s private key is capable of forging valid signatures. This leads to several serious consequences. For example, anybody can sign IIoT data on behalf of IIoT data owner without being detected.

[1]  Duncan S. Wong,et al.  Certificateless Public-Key Signature: Security Model and Efficient Construction , 2006, ACNS.

[2]  Yi Mu,et al.  Certificateless Signature Revisited , 2007, ACISP.

[3]  Kefei Chen,et al.  Two Certificateless Aggregate Signatures From Bilinear Maps , 2007, Eighth ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing (SNPD 2007).

[4]  Tzong-Chen Wu,et al.  Robust Certificateless Signature Scheme without Bilinear Pairings , 2013, 2013 International Conference on IT Convergence and Security (ICITCS).

[5]  Zhang Zhang,et al.  Efficient and provably secure certificateless signcryption from bilinear maps , 2010, 2010 IEEE International Conference on Wireless Communications, Networking and Information Security.

[6]  Fagen Li,et al.  An Improved Certificateless Signature Scheme Secure in the Standard Model , 2008, Fundam. Informaticae.

[7]  Chunhua Su,et al.  A Novel Certificateless Signature Scheme for Smart Objects in the Internet-of-Things , 2017, Sensors.

[8]  Kenneth G. Paterson,et al.  Certificateless Public Key Cryptography , 2003 .

[9]  Qiaoyan Wen,et al.  Efficient and provably-secure certificateless short signature scheme from bilinear pairings , 2009, Comput. Stand. Interfaces.

[10]  Yi Mu,et al.  Certificateless threshold signature scheme from bilinear maps , 2010, Inf. Sci..

[11]  Liusheng Huang,et al.  Cryptanalysis of a certificateless signature scheme without pairings , 2013, Int. J. Commun. Syst..

[12]  Vipul Goyal,et al.  Reducing Trust in the PKG in Identity Based Cryptosystems , 2007, CRYPTO.

[13]  Qiong Huang,et al.  Generic Certificateless Encryption in the Standard Model , 2007, IWSEC.

[14]  Sen-Shan Huang,et al.  Secure Certificateless Signature with Revocation in the Standard Model , 2014 .

[15]  Rui Zhang,et al.  An efficient and provably‐secure certificateless signature scheme without bilinear pairings , 2012, Int. J. Commun. Syst..

[16]  Jianhua Chen,et al.  An efficient certificateless proxy signature scheme without pairing , 2013, Math. Comput. Model..

[17]  Hongzhen Du,et al.  Efficient Certificateless Signcryption from Bilinear Pairings , 2016 .

[18]  Kuo-Yu Tsai,et al.  An efficient certificateless signature scheme without bilinear pairings , 2014, Multimedia Tools and Applications.

[19]  Yi Mu,et al.  Improved certificateless signature scheme provably secure in the standard model , 2012, IET Inf. Secur..

[20]  Mihir Bellare,et al.  Random oracles are practical: a paradigm for designing efficient protocols , 1993, CCS '93.

[21]  Kenneth G. Paterson,et al.  An Attack on a Certificateless Signature Scheme , 2006, IACR Cryptol. ePrint Arch..

[22]  Chenhui Wang,et al.  Certificateless signature scheme with security enhanced in the standard model , 2014, Inf. Process. Lett..

[23]  Yi Liu,et al.  Efficient and secure certificateless signature scheme in the standard model , 2017, Int. J. Commun. Syst..

[24]  Joseph K. Liu,et al.  Self-Generated-Certificate Public Key Cryptography and certificateless signature/encryption scheme in the standard model: extended abstract , 2007, ASIACCS '07.

[25]  Wei Wu,et al.  A Provably Secure Ring Signature Scheme in Certificateless Cryptography , 2007, ProvSec.

[26]  Lei Zhang,et al.  A new certificateless aggregate signature scheme , 2009, Comput. Commun..

[27]  Fagen Li,et al.  Certificateless threshold signature secure in the standard model , 2013, Inf. Sci..

[28]  Zhenfu Cao,et al.  Simulatability and security of certificateless threshold signatures , 2007, Inf. Sci..

[29]  Kefei Chen,et al.  An efficient pairing-free certificateless signature scheme for resource-limited systems , 2015, Science China Information Sciences.

[30]  G. P. Biswas,et al.  Efficient and provably secure random oracle-free adaptive identity-based encryption with short-signature scheme , 2016, Secur. Commun. Networks.

[31]  Xian Wang,et al.  An efficient certificateless aggregate signature with conditional privacy-preserving for vehicular sensor networks , 2015, Inf. Sci..

[32]  Ying-Hao Hung,et al.  Certificateless Signature with Strong Unforgeability in the Standard Model , 2015, Informatica.

[33]  Kefei Chen,et al.  An Adaptive Stable Link Selection Algorithm for Mobile Ad Hoc Networks , 2007 .

[34]  Ran Canetti,et al.  The random oracle methodology, revisited , 2000, JACM.

[35]  Kefei Chen,et al.  A Modified Efficient Certificateless Signature Scheme without Bilinear Pairings , 2015, 2015 International Conference on Intelligent Networking and Collaborative Systems.

[36]  Xiaotie Deng,et al.  Key Replacement Attack Against a Generic Construction of Certificateless Signature , 2006, ACISP.

[37]  Lei Zhang,et al.  Efficient many-to-one authentication with certificateless aggregate signatures , 2010, Comput. Networks.

[38]  Yi Mu,et al.  Certificateless Threshold Ring Signature , 2009, Inf. Sci..

[39]  Dengguo Feng,et al.  Key Replacement Attack on a Certificateless Signature Scheme , 2006, IACR Cryptol. ePrint Arch..

[40]  Dong Hoon Lee,et al.  A new provably secure certificateless short signature scheme , 2011, Comput. Math. Appl..

[41]  Ashutosh Saxena,et al.  An Efficient Certificateless Signature Scheme , 2005, CIS.

[42]  Pil Joong Lee,et al.  Generic Construction of Certificateless Signature , 2004, ACISP.

[43]  Zhong Chen,et al.  An efficient provably secure certificateless aggregate signature applicable to mobile computation , 2012 .

[44]  Yupu Hu,et al.  Certificateless signcryption scheme in the standard model , 2010, Inf. Sci..

[45]  SK Hafizul Islam,et al.  Provably Secure and Lightweight Certificateless Signature Scheme for IIoT Environments , 2018, IEEE Transactions on Industrial Informatics.

[46]  Zhixiong Chen,et al.  A New Efficient Certificateless Signcryption Scheme , 2008, 2008 International Symposium on Information Science and Engineering.

[47]  Jia-Lun Tsai,et al.  Weaknesses and improvements of an efficient certificateless signature scheme without using bilinear pairings , 2014, Int. J. Commun. Syst..

[48]  Manuel Barbosa,et al.  Certificateless signcryption , 2008, ASIACCS '08.