Cryptanalysis and improvement of blind signcryption scheme based on elliptic curve

Electronics LettersVolume 55, Issue 8 p. 457-459 Information and communicationsFree Access Cryptanalysis and improvement of blind signcryption scheme based on elliptic curve Malik Zia Ullah Bashir, Corresponding Author Malik Zia Ullah Bashir ziamalik199@gmail.com Department of Mathematics, Capital University of Science and Technology, Islamabad, PakistanSearch for more papers by this authorR. Ali, R. Ali Department of Mathematics, Capital University of Science and Technology, Islamabad, PakistanSearch for more papers by this author Malik Zia Ullah Bashir, Corresponding Author Malik Zia Ullah Bashir ziamalik199@gmail.com Department of Mathematics, Capital University of Science and Technology, Islamabad, PakistanSearch for more papers by this authorR. Ali, R. Ali Department of Mathematics, Capital University of Science and Technology, Islamabad, PakistanSearch for more papers by this author First published: 01 April 2019 https://doi.org/10.1049/el.2019.0032Citations: 8 [Correction added on 25 October 2021: After the first online publication, the first author name has been corrected from M. Zia to Milak Zia Ullah Bashir] AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Blind signcryption schemes are the extension of signcryption schemes. They are used to protect the privacy and identity of the sender from other users, especially in electronic voting and electronic cash payment systems. A number of blind signcryption schemes are introduced over the years and some of them are proved to be insecure. In this Letter, the authors analysed a recently proposed blind signcryption scheme based on elliptic curves and proved it is insecure. Their analysis showed that the proposed scheme is unable to provide the claimed security attributes of message integrity, authentication, unforgeability, and signer non-repudiation. After successful cryptanalysis, they introduced a modified version of this scheme to overcome the security flaws and weakness. Introduction Cryptology is a scientific way of generating and solving secret codes. It deals with the comprehensive study of cryptography and cryptanalysis. Cryptography is the knowledge of secret communication in the presence of an unauthorised third party. Modern cryptography deals with the security attributes of confidentiality, authentication, integrity, non-repudiation, unforgeability, and forward secrecy of message confidentiality and public verification. Without using any secret key, a cryptanalyst tries to find the contents of the original message by finding the weaknesses in the cryptosystem. The possible attacks on a cryptosystem are chosen plaintext attack, known plaintext attack, ciphertext only attack, man in middle attack, differential cryptanalysis, and linear cryptanalysis. There are two main types of cryptography known as private key cryptography and public key cryptography. Public key cryptography [1] was introduced by Whitefield Diffie and Martin Hellman in 1976. Since then many public key systems are introduced such as Rivest–Shamir–Adleman (RSA) [2], El-gamal [3] and elliptic curve cryptography (ECC) [4]. In 1985, Neal Koblitz and Victor Miller independently proposed the elliptic curve cryptography [4]. The main advantages of ECC are that it uses small parameters as compared to RSA. The elliptic curve over the finite field is (1)with a point O at infinity, where a and b are integers under modulo p with the condition that . Longa and Miri [5] proposed a new flexible technique for accelerating the computation of elliptic curve points over a finite field. This flexible technique provides more benefits for parallel schemes such as 160-bit non-adjacent form (NAF) scalar multiplication with parallel single-instruction multiple-data (SIMD) operations reducing the computational cost by 63–70%. In 1997, Zheng [6] proposed a cryptographic scheme called ‘signcryption’, which combines the two basic cryptographic requirements of authentication and encryption in a single logical step. In cryptography, digital signature provides non-repudiation, authentication, unforgeability, and data integrity. It plays a very important role in key distributions, electronic commerce, and authentications. Zheng and Imai [7] proposed the first signcryption scheme based upon elliptic curves, as compared to RSA and digital signature algorithm (DSA) and hence it reduces the computational and communication cost. Cheng and Wen [8] modified a signcryption scheme of Liu et al. [9]. Their analysis shows that the proposed scheme of Liu et al. is not secure and unable to provide unforgeability against the chosen ciphertext attack. In 1983, Chaum [10] extended the concept of digital signature and introduced a new scheme called ‘blind signatures for untraceable payments’ based on the RSA algorithm. According to Chaum's blind signature scheme, there are three participants namely the sender (requester), the signer, and the receiver. The sender blinds the message and sends it to the signer for signature. The signer signs the message without reading the contents of the original message and sends it to the sender. Then sender unblinds the message and transmits the signed encrypted message to the receiver. A blind signcryption scheme satisfies two additional properties of blindness and untraceability. Blind signcryption is mostly used in an electronic voting system and electronic payment system. Pointcheval and Stern [11] introduced a new blind signature scheme based upon the integer factorisation problem. The proposed scheme is secure but is not efficient for small devices. Dhanashree and Agrawal [12] use an elliptic curve to generate a blind signature for the electronic voting system. The proposed scheme involves a hash function for blinding a message. Awasthi and Lal [13] introduced a new blind signcryption scheme, which offers anonymity, confidentiality, untraceability, and unlinkability. This scheme does not provide the public verification property. Chakraborty and Mehta [14] proposed a blind signature scheme based on an elliptic curve with double blinding. In his scheme, a signer is the original receiver of a message. Guilin [15] proposed a new blind proxy signcryption scheme for a powerful server to overcome the computational burden as compared to the low power device. Zia and Ali [16] analysed a recently proposed signcryption scheme of Iqbal et al. [17]. Their analysis shows that the proposed scheme is not secure and cannot be able to provide the security attributes of integrity, authentication, unforgeability, and non-repudiation. They introduced a modified and improved version of this scheme to overcome the security flaws and weakness. Recently, some new blind signcryption schemes, implementation, and applications are proposed [18-20]. Recently, Riaz Ullah et al. [21] proposed a blind signcryption scheme based on elliptic curves. The claimed security attributes of their proposed scheme are confidentiality, sender anonymity, message integrity, authentication, unforgeability, signer non-repudiation, forward secrecy, blindness, and message untraceability. In this Letter, our analysis shows that the scheme proposed in [21] has many security flaws and unable to provide the claimed security attributes. The rest of the Letter is organised as follows: Section 2 provides the security attributes of blind signcryption scheme, Section 3 describes the blind signcryption scheme of Riaz Ullah et al. [21], Section 4 gives cryptanalysis of their scheme [21] and Section 5 gives the conclusion. Blind signcryption scheme In this section, we describe the blind signcryption scheme of Riaz Ullah et al. [21]. The proposed signcryption scheme uses elliptic curve cryptography whose hardness is based upon the elliptic curve discrete logarithm problem. The scheme has three participants a sender (Alice), a receiver (Bob) and a signer. It consists of four steps: (a) pre-request, (b) key generation, (c) blind signcryption, and (d) unsigncryption. The signer is the party that signs the received message without reading the content of the original message. Alice is the sender who wants to communicate with Bob. The proposed scheme is described in the following four phases. Pre-requisites (global parameters) In this step, the system generates and publishes the domain parameters of the elliptic curve. Variables Description q prime number with E elliptic curve over finite field n prime number with h one-way hash function G base point of elliptic curve with order n and symmetric encryption and decryption algorithm with private key k Key generation Signer • Chooses an integer randomly as his secret key such that • Calculates his public key as elliptic curve point Alice • Chooses an integer randomly as her secret key such that • Calculates her public key as elliptic curve point Bob • Chooses an integer randomly as his secret key such that . • Calculates his public key as elliptic curve point Blind signcryption Suppose Alice (sender) wants to transmit a message m to Bob over a public network. First Alice blinds the message m and sends it to signer for signing a message. After receiving the signed message from signer, Alice unblinds the blind signature and sends a signcrypted text to Bob (receiver). Following steps are required to generate the blind signcrypted text. Signer • Choose a random number a from . • Calculate . • Send Z to Alice. Alice • Choose random numbers from as blinding factors. • Calculate • Calculate • Calculate the ciphertext by using symmetric encryption with secret key . • Calculate • Calculate • Send to signer. Signer • Calculate • Send to Alice. Alice • Calculate • Send (c, t, s, X) to Bob. Unsigncryption • Bob received (c, t, s, X) from the Alice. • Calculate . • Calculate • Obtain plaintext by using symmetric encryption with secret key • Calculate • If then accept m as a valid message otherwise reject. Cryptanalysis In this section, we analysed that the scheme proposed by Riaz Ullah et al. [21] is not secure. The claimed security attributes of message integrity, authentication, unforgeability, and signer non-repudiation are compromised. Suppose Mallory (attacker) wants to send a message of his choice to Bob. Mallory intercepts the network communication between Alice and Bob and generates a signcrypted text from message . Bob received the signcrypted text from Mallory and accepts the received message as a valid original message. Mallory performs the following steps to generate and send a message . Signcryption • Mallory choose a random number from . • Compute . • Choose random numbers from . • Calculate • Calculate • Calculate ciphertext by using symmetric encryption with secret key • Calculate • Calculate • Calculate • Calculate • Send to Bob. Unsigncryption • Bob received the signcrypted text • Calculate . • Calculate • Calculate by using symmetric encryption with secret key . • Calculate • Accept as a valid message because . The unsigncryption algorithm authenticates the received message and now Bob believes that the received message is valid and sending by authentic person Alice. In this way, Mallory successfully transmits the message of his choice to Bob. Proof of cryptanalysis The unsigncryption algorithm verifies the authenticity of the received signcrypted text correctly. The same secret key is generated by Mallory and Bob to get the valid authentic signature Modification and improvement of scheme proposed in [21] Our analysis shows that the proposed scheme of Riaz Ullah et al. [21] is not secure and unable to provide the claimed security attributes of message integrity, authentication, unforgeability, and signer non-repudiation. We observe that the process of signature generation and verification of the proposed scheme is not up to mark according to the desired security requirements. We modify the signature generation process of the proposed scheme so that signcrypted text generated by an authentic sender is verified by a unsigncryption algorithm. We use the private key of the signer for generation of signature so that only authentic sender can generate the signature. Our modified scheme provides the security attributes of confidentiality, authentication, sender anonymity, message integrity, unforgeability, signer non-repudiation, forward secrecy, blindness, and message untraceability. Signer • Choose a random number a from . • Calculate . • Send Z to Alice. Alice • Choose random numbers from as blinding factors. • Calculate • Calculate • Calculate • Send to signer. Signer • Calculate • Calculate • Send to Alice. Alice • Calculate • Calculate • Calculate • Calculate ciphertext by using symmetric encryption with secret key • Calculate • Send (c, t, s, X) to Bob. Unsigncryption • Bob received (c, t, s, X) from the Alice. • Calculate . • Calculate • Calculate plaintext by using symmetric encryption with secret key • Calculate • Calculate • If then accept m as a valid message otherwise reject. Conclusion We analysed a recently proposed blind signcryption scheme of Riaz Ullah et al. [21] that uses an elliptic curve over a finite field. They claimed that their scheme is secure and has less computational cost as compared to other existing blind signcryption schemes. The claimed security attributes of the proposed scheme are confidentiality, authentication, sender anonymity, message integrity, unforgeability, signer non-repudiation, forward secrecy, blindness, and message untraceability. In this Letter, we analysed and proved that the proposed scheme of Riaz Ullah et al. [21] is not secure and has many security flaws. After our successful cryptanalysis of this scheme, the claimed security attributes of message integrity, authentication, unforgeability, and signer non-repudiation are compromised. We modify and improve this scheme to achieve the security requirements of confidentiality, sender anonymity, authentication, message integrity, unforgeability, signer non-repudiation, forward secrecy, blindness, and message untraceability. References 1Diffie, W., Hellman, M.E.: ‘New directions in cryptography’, Trans. Inf. Theory, 1976, 22, (6), pp. 644– 654 (https://doi/org/10.1109/TIT.1976.1055638) CrossrefWeb of Science®Google Scholar 2Rivest, R.L., Shamir, A., Adleman, L.: ‘A method for obtaining digital signatures and public-key cryptosystems’, Commun. ACM, 1978, 21, (2), pp. 120– 126 (https://doi/org/10.1145/359340.359342) CrossrefWeb of Science®Google Scholar 3ElGamal, T.: ‘A public-key cryptosystem and a signature scheme based on discrete logarithms’, Trans. Inf. Theory, 1985, 31, (4), pp. 469– 472 (https://doi/org/10.1109/TIT.1985.1057074) CrossrefWeb of Science®Google Scholar 4Koblitz, N.: ‘Elliptic curve cryptosystems’, Math. Comput., 1987, 177, pp. 203– 209 (https://doi/org/10.1090/S0025-5718-1987-0866109-5) CrossrefGoogle Scholar 5Longa, P., Miri, A.: ‘Fast and flexible elliptic curve point arithmetic over prime fields’, Trans. Comput., 2008, 57, (3), pp. 289– 302 (https://doi/org/10.1109/TC.2007.70815) CrossrefWeb of Science®Google Scholar 6Zheng, Y.: ‘ Digital signcryption or how to achieve cost (signature and encryption) cost (signature)+cost (encryption)’, 17th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 2017, pp. 165– 179Google Scholar 7Zheng, Y., Imai, H.: ‘How to construct efficient signcryption schemes on elliptic curves’, Inf. Process. Lett., 1998, 68, pp. 227– 233 (https://doi/org/10.1016/S0020-0190(98)00167-7) CrossrefWeb of Science®Google Scholar 8Cheng, L., Wen, Q.: ‘An improved certificate less signcryption in the standard model’, Int. J. Netw. Secur., 2015, 17, (3), pp. 229– 237Google Scholar 9Liu, Z., Hu, Y., Zhang, X. et. al.,: ‘Certificate less signcryption scheme in the standard model’, Inf. Sci., 2010, 180, (3), pp. 452– 464 (https://doi/org/10.1016/j.ins.2009.10.011) CrossrefWeb of Science®Google Scholar 10Chaum, D.: ‘ Blind signatures for untraceable payments’, in D. Chaum, R.L. Rivest, A.T. Sherman (Eds.): ‘ Advances in Cryptology: Proceedings of Crypto 82’ ( Springer, Boston, MA, USA, 1983), pp. 199– 203CrossrefGoogle Scholar 11Pointcheval, D., Stern, J.: ‘ New blind signatures equivalent to factorization’. 4th ACM Conf. on Computer and Communications Security, Zurich, Switzerland, April 1997, pp. 92– 99Google Scholar 12Dhanashree, M., Agrawal, M.P.J.: ‘Implementation of blind digital signature using ECC’, Int. J. Comput. Sci. Netw., 2012, 2, (9), pp. 316– 319Google Scholar 13Awasthi, A.K., Lal, S.: ‘An efficient scheme for sensitive message transmission using blind signcryption’, 2005, arXiv preprint cs/0504095 Google Scholar 14Chakraborty, K., Mehta, J.: ‘A stamped blind signature scheme based on elliptic curve discrete logarithm problem’, Int. J. Netw. Secur., 2012, 14, (6), pp. 316– 319Google Scholar 15Yu, H.-F., Tian, L.-Q., Wang, Z.-C.: ‘ Self-certified proxy blind signcryption scheme from pairings’. Proc. 2011 IEEE Int. Conf. on Network Computing and Information Security, Guilin, China, May 2011, pp. 316– 320Google Scholar 16Zia, M., Ali, R.: ‘Cryptanalysis and improvement of an elliptic curve based signcryption scheme for firewalls’, PLoS ONE, 2018, 13, pp. 1– 11, e0208857. (https://doi/org/10.1371/journal.pone.0208857) CrossrefWeb of Science®Google Scholar 17Iqbal, W., Afzal, M., Ahmad, F.: ‘ An efficient elliptic curve based signcryption scheme for firewalls’. 2nd National Conf. on Information Assurance (NCIA), Rawalpindi, Pakistan, December 2013, pp. 67– 72Google Scholar 18James, S, Gayathri, N.B., Reddy, P.V.: ‘Pairing free identity-based blind signature scheme with message recovery’, Cryptography, 2018, 2, (4), p. 29 (https://doi/org/10.3390/cryptography2040029) CrossrefGoogle Scholar 19Su, P.C., Tsai, C.H.: ‘New proxy blind signcryption scheme for secure multiple digital messages transmission based on elliptic curve cryptography’, KSII Transactions on Internet and Information Systems, 2017, 11, (11), pp. 5537– 5555Web of Science®Google Scholar 20Tsai, C.H., Su, P.C.: ‘An ECC-based blind signcryption scheme for multiple digital documents’, Secur. Commun. Netw., 2017, 2017, pp. 1– 14Google Scholar 21Ullah, R., Nizamuddin, A.I., Amin, N.: ‘ Blind signcryption scheme based on elliptic curve’. IEEE Conf. on Information Assurance and Cyber Seccurity (CIACS), Rawalpindi, Pakistan, June 2014, pp. 51– 54Google Scholar Citing Literature Volume55, Issue8April 2019Pages 457-459 ReferencesRelatedInformation