Security Remarks on a Convertible Nominative Signature Scheme

A nominative signature scheme allows a nominator (i.e. the signer) and a nominee (i.e. a designated verifier) to jointly generate and publish a signature so that only the nominee can check the validity of a nominative signature and further convince a third party to accept this fact. Recently, Huang and Wang proposed a new nominative signature scheme at ACISP 2004, and claimed that their scheme is secure under some standard computational assumptions. In this paper, we show that their scheme is not a secure nominative signature, since it fails to meet the crucial security requirement of verification untransferability. Specifically, we present an adaptively chosen-message attack against their scheme such that the nominator can determine the validity of a new message-signature pair with some indirect help from the nominee. Moreover, we point out that this attack enables the nominator to demonstrate the validity of nominative signatures to a third party. Therefore, the Huang-Wang scheme ...

• Type: Conference
• Year: 2007
• Where: SEC
• Authors: Guilin Wang, Feng Bao
• Keywords: Nominative Signature Scheme, Nominative Signatures, SEC 2007, Secure Nominative Signature, Security Privacy