Comments on “A Cross-Layer Approach to Privacy-Preserving Authentication in WAVE-Enabled VANETs” by Biswas and Mišić

A WAVE-based cross-layer anonymous authentication scheme based on a variant of ECDSA (Biswas and Mišić “A Cross-layer approach to privacy-preserving authentication in WAVE-enabled VANETs,” IEEE Trans. Veh. Technol., vol. 62, no. 5, pp. 2182–2192, Jun. 2013.) was published for authenticity of vehicular safety application messages. Our result shows that, contrary to what is claimed, the scheme is entirely broken due to the insecurity of their underlying signature scheme: Their modification of ECDSA is insecure against secret key recovery attacks where anyone can recover OBUs’ or mobile nodes’ private keys from transmitted signed messages just eavesdropping.