# Design and Implementation of a Mobile Voting System Using a Novel Oblivious and Proxy Signature

Authors: Shin-Yan Chiou; Tsung-Ju Wang; Jiun-Ming Chen
Journal: Security and Communication Networks
 (2017)

---

## Abstract

Electronic voting systems can make the voting process much more convenient. However, in such systems, if a server signs blank votes before users vote, it may cause undue multivoting. Furthermore, if users vote before the signing of the server, voting information will be leaked to the server and may be compromised. Blind signatures could be used to prevent leaking voting information from the server; however, malicious users could produce noncandidate signatures for illegal usage at that time or in the future. To overcome these problems, this paper proposes a novel oblivious signature scheme with a proxy signature function to satisfy security requirements such as information protection, personal privacy, and message verification and to ensure that no one can cheat other users (including the server). We propose an electronic voting system based on the proposed oblivious and proxy signature scheme and implement this scheme in a smartphone application to allow users to vote securely and conveniently. Security analyses and performance comparisons are provided to show the capability and efficiency of the proposed scheme.


---

## Body

## 1. Introduction

In recent years, network transactions for applications such as Internet auctions and banking have increased greatly. Network and mobile security technologies [1–6] play important roles in protecting users’ privacy. In this regard, digital signatures have attracted considerable attention. By using public-key cryptography, a signer can sign a message using his or her private key, which is owned only by the signer, to create a digital signature for the message. Then, any verifier can validate the correctness of this signature by using the signer’s public key.However, it is necessary to protect the privacy of signature receivers in some situations, such as the contents of signed message in a digital cash system or the choices from candidates in an e-voting situation. In 1983, Chaum [7] introduced a blind signature scheme to offer blindness which protects the signee’s privacy. In 2013, Nayak et al. [8] proposed a blind signature scheme based on an elliptic curve discrete logarithm problem. In 2005, Rabin [9] introduced the concept of oblivious transfer. In 1994, Chen [10] proposed the concept of oblivious signatures and considered two types of oblivious signature schemes. In 2008, Tso et al. [11] provided formal definitions and security requirements for an oblivious signature scheme. In 2012, Chou [12] proposed a more efficient and secure k-out-of-n oblivious transfer scheme.In 1996, Mambo et al. [13] proposed the concept of proxy signature. Various proxy signature schemes have been proposed [14, 15]. In 2000, Lin and Jan [16] proposed the first proxy blind signature scheme that combines the functionalities of both proxy signatures and blind signatures. In 2002, Tan et al. [17] proposed a proxy blind signature scheme; however, in 2003, Lal and Awasthi [18] showed this scheme to be insecure and further proposed a new scheme that is secure and more efficient than Tan et al.’s scheme. In 2013, Yang and Liang [19] proposed a new proxy blind signature scheme that allows revocation.For electronic voting systems, in 2001, Ray and Narasimhamurthi [20] introduced an online anonymous electronic voting protocol that allows a voter to cast his or her ballot anonymously by exchanging untraceable authentic messages. In 2013, Pan et al. [21] proposed an electronic voting scheme that is based on the ring signature and is resistant to a clash attack. Several schemes with delegated voting functionality have been proposed. In 2013, Zwattendorfer et al. [22] proposed a proxy voting scheme that allows a voter to delegate his or her voting power to a proxy who actually casts the ballots for all represented voters. Norway has used an Internet-based voting protocol for some years, and the vote privacy and correctness of this scheme have been demonstrated [23]. In 2016, Kulyk et al. [24] proposed a new coercion-resistant proxy voting scheme by extending the coercion-resistant JCJ/Civitas theme, aiming to prevent direct voter coercion, delegation coercion, and proxy coercion. They also proposed a new proxy voting scheme [25] to extend the Helios voting system [26] with delegated voting functionality. In 2017, Cohensius et al. [27] considered a social choice problem and demonstrated that the mechanism using proxy voting better approximates the optimal outcome.


### 1.1. Motivation

Compared with a blind signature scheme, a oblivious signature scheme used in e-voting provides one more property: ambiguity in selected messages. A signer cannot find out which message a voter has selected while signing the messages, but the signer can be certain that the message the voter chooses is one of the predetermined messages; otherwise, the signature would not be accepted by a verifier. Therefore, in oblivious signature systems, which differ from blind signature schemes, the limited signed contents can prevent potential malicious users from obtaining valid signatures of some candidates for unauthorized purposes.In addition, because each unit of a group (such as each state of a country, each county of a state, each campus of a school, or each approved bank of a group) may use different methods to authorize their members (using different keys), polling booths with proxy ability are required. Additional benefits include reducing the load at voting centers and avoiding network jams. Moreover, the mobility of the voting functionality allows people to vote from anywhere using their mobile devices, thereby making the electronic voting system more convenient.The goal in this research is a design of novel schemes which combine oblivious and proxy signatures and extend the designed schemes to an electronic voting system which provides the following properties: mobility, instant voting, proxy signer, completeness, unforgeability, unlinkability, undeniability, accuracy, distinguishability, ambiguity, nonduplication, eligibility, verifiability, fairness, and privacy, where fairness means that no one can know the current total number of votes received by every candidate before the end of the voting period.


### 1.2. Our Contribution

In this paper, based on the Schnorr signature [28], we propose two novel 1-out-of-n blind (oblivious) and proxy signature schemes that combine the advantages of oblivious signatures and proxy signatures and satisfy the security properties of these two signature schemes. One of the proposed proxy oblivious schemes is of the proxy-unprotected type and the other is of the proxy-protected type. Based on our schemes, we also propose an anonymous electronic voting system with proxy signer. By using the concept proposed in [29], we conduct security analyses and performance comparisons. The results showed that our scheme has good performance and is efficient. Finally, we implement the voting system on Android mobile phones to prove that our scheme is workable. This paper extends the research [30], which presents the concept of 1-out-of-n oblivious and proxy signature schemes of proxy-unprotected type without the voting system application, security analyses and formal proofs, and mobile phone implementation.


## 1.1. Motivation

Compared with a blind signature scheme, a oblivious signature scheme used in e-voting provides one more property: ambiguity in selected messages. A signer cannot find out which message a voter has selected while signing the messages, but the signer can be certain that the message the voter chooses is one of the predetermined messages; otherwise, the signature would not be accepted by a verifier. Therefore, in oblivious signature systems, which differ from blind signature schemes, the limited signed contents can prevent potential malicious users from obtaining valid signatures of some candidates for unauthorized purposes.In addition, because each unit of a group (such as each state of a country, each county of a state, each campus of a school, or each approved bank of a group) may use different methods to authorize their members (using different keys), polling booths with proxy ability are required. Additional benefits include reducing the load at voting centers and avoiding network jams. Moreover, the mobility of the voting functionality allows people to vote from anywhere using their mobile devices, thereby making the electronic voting system more convenient.The goal in this research is a design of novel schemes which combine oblivious and proxy signatures and extend the designed schemes to an electronic voting system which provides the following properties: mobility, instant voting, proxy signer, completeness, unforgeability, unlinkability, undeniability, accuracy, distinguishability, ambiguity, nonduplication, eligibility, verifiability, fairness, and privacy, where fairness means that no one can know the current total number of votes received by every candidate before the end of the voting period.


## 1.2. Our Contribution

In this paper, based on the Schnorr signature [28], we propose two novel 1-out-of-n blind (oblivious) and proxy signature schemes that combine the advantages of oblivious signatures and proxy signatures and satisfy the security properties of these two signature schemes. One of the proposed proxy oblivious schemes is of the proxy-unprotected type and the other is of the proxy-protected type. Based on our schemes, we also propose an anonymous electronic voting system with proxy signer. By using the concept proposed in [29], we conduct security analyses and performance comparisons. The results showed that our scheme has good performance and is efficient. Finally, we implement the voting system on Android mobile phones to prove that our scheme is workable. This paper extends the research [30], which presents the concept of 1-out-of-n oblivious and proxy signature schemes of proxy-unprotected type without the voting system application, security analyses and formal proofs, and mobile phone implementation.


## 2. Related Works

In this section, we present two representative protocols that are relevant to our scheme: oblivious signature and proxy signature.


### 2.1. Oblivious Signature

In 1983, Chaum [7] introduced a blind signature scheme. Compared with a normal signature, a blind signature offers an additional property, blindness, that provides it with the ability to protect the signee’s privacy. In a blind signature scheme, a signee could get a message’s digital signature signed by a signer without revealing any information about the message. This is vital in some applications such as electronic payment systems and secure voting systems [31–35], because the requester’s messages may be sensitive. Nayak et al. [8] also proposed a blind signature scheme based on an elliptic curve discrete logarithm problem.In 2005, Rabin [9] introduced the concept of oblivious transfer. In this protocol, a sender sends some subsets of some messages but does not know what the receiver has received. Thus, the receiver can get the particular message he or she wants without revealing any information about the message to the sender. In 2012, Chou [12] proposed a more efficient and secure k-out-of-n oblivious transfer scheme.In 1994, Chen [10] proposed the concept of oblivious signatures. He considered two types of oblivious signature schemes. The first one comprises n keys and one message; the receiver can get a message signed with one of n keys that are chosen by him or her while the signers cannot know which key has been used for the signature by the receiver. The second one comprises n messages and one key; a signee can choose one predetermined message to get signed while not revealing any information about the selected message to the signer. In contrast to blind signatures, oblivious signatures can guarantee that the signed message is actually one of the predetermined messages; therefore, if the receiver were to submit some additional messages, the signature would not be accepted by the scheme.In 2008, Tso et al. [11] noted that Chen’s proposal does not crisply formalize the notion and security properties of the scheme. Consequently, they provided formal definitions and security requirements for an oblivious signature scheme, including completeness, unforgeability, and ambiguity, and proposed a 1-out-of-n oblivious signature agreement based on Schnorr’s blind signature [28]. They also improved the scheme’s performance. The preceding properties render oblivious signatures very suitable for electronic voting applications.In their scheme [11], it first creates a normalized definition for the oblivious signature agreement and proposes the following properties to ensure security:(1)
Completeness: as long as the recipient and the signer can implement the agreement honestly, once the agreement is completed the recipient can obtain the signed message.(2)
Unforgeability: despite the algorithm being publicly published, attackers still have difficulty creating a forged signature within an acceptable time frame.(3)
Ambiguity in selected messages: the signer is unable to determine the recipient’s selection.This system provides for three roles, namely, the signer, the recipient, and the verifier. The operation proceeds through three phases, namely, initiation, signing, and verification. Figure1 shows their scheme and the steps in this scheme are as follows.Figure 1
Oblivious signature scheme.(1) System Initiation Phase. In this phase, the signer generates public parameters and a pair of asymmetric keys for use in the following process.The signer first establishes security parameter1k to input into the system to establish the algorithm G, which can be used to obtain the public parameters for the agreement.(A)
p, q are two large prime numbers, and q∣(p-1).(B)
g,h∈RZp∗ are two parameters with order q.(C)
H() is a hash function.The signer also selects a random numberx∈RZq∗ as a private key to calculate the public key y=gxmodp.(2) Signing Phase. This phase explains how the recipient obtains the signature value from the signer’s signature (see Figure 1).Step 1.
Assume the recipient wants to obtain the signature value for messageml∈{m1,m2,…,mn}. First, the recipient selects r∈RZq∗, then calculates c=grhlmodp, and then transmits c and {m1,m2,…,mn} to the signer.Step 2.
After the signer receives these, he selects random numberski∈RZq∗,i=1,2,…,n, using ki to calculate Ki=gkimodp followed by e^i=H(mi,Kic/(gh)imodp) and uses private key x to obtain s^i=ki-xe^imodq for the signed message. Finally, (e^i,s^i),i=1,2,…,n, is transmitted to the recipient.Step 3.
Once the recipient has received(e^i,s^i), he/she then calculates δi=g(r-i)h(l-i)modp, i=1,2,…,n, and verifies (e^i,s^i) to determine whether it satisfies e^i=?H(mi,gs^iye^iδimodp), where only the lth message initially selected by the recipient will be successfully verified.Step 4.
The successful verification(e^l,s^l) is then used to calculate e=e^l and s=r-l+s^lmodq. Finally, we obtain the ml’s signature value σ(ml)=(e,s).(3) Verification Phase. This phase explains how the verifier verifies the correctness of the signature obtained by the recipient (see Figure 3).Step 1.
The recipient sends the obtained signature valueσ(ml) and the selection ml to the verifier.Step 2.
After the verifier obtains(ml,σ(ml)), he/she determines whether (ml,σ(ml)) satisfies e=?H(ml,gsyemodp). If it does, this represents that the signature obtained by the recipient is genuine.Note that, in Step2 of signing phase, the signer cannot learn which message is selected by the recipient; this is called the ambiguity of the protocol. Moreover, in Step 2 of verification phase, unless the selected message ml is one of the elements of mi, the signature will not be accepted by a verifier. This protocol ensures that a signee’s message is one of the predetermined messages, which is one of the features of an oblivious signature scheme.


### 2.2. Proxy Signature

Although the aforementioned signature schemes seem practical, they are unsuitable for applications in which the signers are not always available. To overcome this problem, in 1996, Mambo et al. [13] proposed the concept of proxy signature. Various proxy signature schemes have been proposed [14, 15]. Such schemes consist of three entities: an original signer, a proxy signer, and a signee. The original signer can delegate his or her signing power to one or more proxy signers to enable them to sign messages submitted on his or her behalf. Mambo et al. discussed two types of proxy signature schemes: proxy unprotected and proxy protected.Proxy-unprotected proxy signatures include two cases: full delegation and partial delegation. In full delegation, the original signer gives his or her private key to the proxy signer to sign messages; therefore, the original signer takes full responsibility for the signatures produced by the proxy signer. In partial delegation, the original signer creates a proxy signature key using his or her private key and securely forwards it to the proxy signer; then, the proxy signer uses this proxy signature key to sign messages on the original signer’s behalf.Proxy-protected proxy signature schemes allow the original signer to use his or her private key to create a proxy signature key and securely forward it to the proxy signer. The proxy signer computes a new proxy signature signing key—which contains both the original signer’s original proxy signature signing key and the private key of the proxy signer—and then signs messages using the new proxy signature key. Therefore, the original signer and proxy signer share the responsibility for the valid proxy signatures generated by the proxy signer. Both of these schemes afford security properties such as verifiability, unforgeability, and undeniability.For example, the president of a company could ask his or her reliable secretary (using the proxy-unprotected signature scheme) or employee (using the proxy-protected signature scheme) to sign some important documents on his or her behalf. Then, if some illegal situation arises in relation to the proxy signature, the employee’s privacy can be uncovered while the secretary’s privacy cannot.Moreover, delegation can be categorized as full delegation, partial delegation, and delegation by warrant, as follows:(1)
Full delegation: the proxy signer obtains a copy of the original signer’s signature key to produce a proxy signature value identical to the signature of the original signer.(2)
Partial delegation: the proxy signer’s signature key is obtained through a calculation based on the original signer’s private key. However, the proxy signature key cannot be used to obtain information related to the original signer’s private key. Partial delegation can be categorized as one of two types: proxy-unprotected or proxy-protected. In the former, the original signer and proxy signer can both provide valid proxy signatures. In the latter, only the proxy signer can provide a valid proxy signature.(3)
Delegation by warrant: a warrant based on the original signer’s signature is used to validate the proxy signer’s signing authority. The proxy signer’s authorization message and proxy signature content is included in the proxy signature and the verifier is used to determine the legitimacy of the authorization.The original signer first delegates his/her signing rights to one or more proxy signers, so that the proxy signers can sign a message in the name of the original signer. Each type of the scheme, proxy unprotected or proxy protected, has to satisfy three security requirements.(1)
Verifiability: the proxy signature created by the proxy signer can convince anyone of the permission from the original signer.(2)
Unforgeability: only the authorized proxy signers can sign a valid signature; this cannot be done even by the original signer.(3)
Undeniability: neither the proxy signer nor the original signer can deny the signature they created after the signature creation.The earliest proxy signature scheme (Figure2) (proposed by Mambo et al. [13]) is a proxy signature of the proxy-unprotected type for the ElGamal scheme [36]. The steps in this scheme are as follows.Figure 2
Proxy signature scheme.Figure 3
Proxy phase (proxy-unprotected type).(1) Key Generation Phase. In this phase, the system generates two primes and a pair of keys, public and private keys, for use in the following process.Step 1.
Choose two large prime numbersp,q such that q∣(p-1).Step 2.
Select random numbersg∈Zp∗ such that Ordpg=q.Step 3.
Each of the original signer and the proxy signer choose a random numberx∈RZq∗ as their private keys.Step 4.
Each of the original signer and the proxy signer computey=gxmodp as their public keys.(2) Proxy PhaseStep 1.
The original signer chooses a random numberk∈RZp-1∗.Step 2.
The original signer computesK=gkmodp.Step 3.
The original signer calculatesσ=x+kKmod(p-1) and sends σ to the proxy signer via a secure channel.Step 4.
After receivingσ, the proxy signer checks whether gσ=?yKKmodp is correct. If it is, the proxy signer accepts delegation.(3) Signing Phase. After receiving a message m from a requestor, the proxy signer processes the follow steps.Step 1.
Choose a random numberr∈RZp-1∗.Step 2.
ComputeR=grmodp.Step 3.
Evaluates=r-1(m-Rσ)mod(p-1) and send signature (R,s,K) to the requestor.(4) Verification Phase. After receiving a message (m, (R,s,K)) from the requestor, a verifier checks the validation of the signature via the following verification equation: gm=?(yKK)RRsmodp.Note that(yKK)RRs=(gxgkK)Rgrs=gR(x+kK)gr[r-1(m-Rσ)]=gR(x+kK)+(m-Rσ)=gR(x+kK)+m-R(x+kK)=gmmodp.


## 2.1. Oblivious Signature

In 1983, Chaum [7] introduced a blind signature scheme. Compared with a normal signature, a blind signature offers an additional property, blindness, that provides it with the ability to protect the signee’s privacy. In a blind signature scheme, a signee could get a message’s digital signature signed by a signer without revealing any information about the message. This is vital in some applications such as electronic payment systems and secure voting systems [31–35], because the requester’s messages may be sensitive. Nayak et al. [8] also proposed a blind signature scheme based on an elliptic curve discrete logarithm problem.In 2005, Rabin [9] introduced the concept of oblivious transfer. In this protocol, a sender sends some subsets of some messages but does not know what the receiver has received. Thus, the receiver can get the particular message he or she wants without revealing any information about the message to the sender. In 2012, Chou [12] proposed a more efficient and secure k-out-of-n oblivious transfer scheme.In 1994, Chen [10] proposed the concept of oblivious signatures. He considered two types of oblivious signature schemes. The first one comprises n keys and one message; the receiver can get a message signed with one of n keys that are chosen by him or her while the signers cannot know which key has been used for the signature by the receiver. The second one comprises n messages and one key; a signee can choose one predetermined message to get signed while not revealing any information about the selected message to the signer. In contrast to blind signatures, oblivious signatures can guarantee that the signed message is actually one of the predetermined messages; therefore, if the receiver were to submit some additional messages, the signature would not be accepted by the scheme.In 2008, Tso et al. [11] noted that Chen’s proposal does not crisply formalize the notion and security properties of the scheme. Consequently, they provided formal definitions and security requirements for an oblivious signature scheme, including completeness, unforgeability, and ambiguity, and proposed a 1-out-of-n oblivious signature agreement based on Schnorr’s blind signature [28]. They also improved the scheme’s performance. The preceding properties render oblivious signatures very suitable for electronic voting applications.In their scheme [11], it first creates a normalized definition for the oblivious signature agreement and proposes the following properties to ensure security:(1)
Completeness: as long as the recipient and the signer can implement the agreement honestly, once the agreement is completed the recipient can obtain the signed message.(2)
Unforgeability: despite the algorithm being publicly published, attackers still have difficulty creating a forged signature within an acceptable time frame.(3)
Ambiguity in selected messages: the signer is unable to determine the recipient’s selection.This system provides for three roles, namely, the signer, the recipient, and the verifier. The operation proceeds through three phases, namely, initiation, signing, and verification. Figure1 shows their scheme and the steps in this scheme are as follows.Figure 1
Oblivious signature scheme.(1) System Initiation Phase. In this phase, the signer generates public parameters and a pair of asymmetric keys for use in the following process.The signer first establishes security parameter1k to input into the system to establish the algorithm G, which can be used to obtain the public parameters for the agreement.(A)
p, q are two large prime numbers, and q∣(p-1).(B)
g,h∈RZp∗ are two parameters with order q.(C)
H() is a hash function.The signer also selects a random numberx∈RZq∗ as a private key to calculate the public key y=gxmodp.(2) Signing Phase. This phase explains how the recipient obtains the signature value from the signer’s signature (see Figure 1).Step 1.
Assume the recipient wants to obtain the signature value for messageml∈{m1,m2,…,mn}. First, the recipient selects r∈RZq∗, then calculates c=grhlmodp, and then transmits c and {m1,m2,…,mn} to the signer.Step 2.
After the signer receives these, he selects random numberski∈RZq∗,i=1,2,…,n, using ki to calculate Ki=gkimodp followed by e^i=H(mi,Kic/(gh)imodp) and uses private key x to obtain s^i=ki-xe^imodq for the signed message. Finally, (e^i,s^i),i=1,2,…,n, is transmitted to the recipient.Step 3.
Once the recipient has received(e^i,s^i), he/she then calculates δi=g(r-i)h(l-i)modp, i=1,2,…,n, and verifies (e^i,s^i) to determine whether it satisfies e^i=?H(mi,gs^iye^iδimodp), where only the lth message initially selected by the recipient will be successfully verified.Step 4.
The successful verification(e^l,s^l) is then used to calculate e=e^l and s=r-l+s^lmodq. Finally, we obtain the ml’s signature value σ(ml)=(e,s).(3) Verification Phase. This phase explains how the verifier verifies the correctness of the signature obtained by the recipient (see Figure 3).Step 1.
The recipient sends the obtained signature valueσ(ml) and the selection ml to the verifier.Step 2.
After the verifier obtains(ml,σ(ml)), he/she determines whether (ml,σ(ml)) satisfies e=?H(ml,gsyemodp). If it does, this represents that the signature obtained by the recipient is genuine.Note that, in Step2 of signing phase, the signer cannot learn which message is selected by the recipient; this is called the ambiguity of the protocol. Moreover, in Step 2 of verification phase, unless the selected message ml is one of the elements of mi, the signature will not be accepted by a verifier. This protocol ensures that a signee’s message is one of the predetermined messages, which is one of the features of an oblivious signature scheme.


## 2.2. Proxy Signature

Although the aforementioned signature schemes seem practical, they are unsuitable for applications in which the signers are not always available. To overcome this problem, in 1996, Mambo et al. [13] proposed the concept of proxy signature. Various proxy signature schemes have been proposed [14, 15]. Such schemes consist of three entities: an original signer, a proxy signer, and a signee. The original signer can delegate his or her signing power to one or more proxy signers to enable them to sign messages submitted on his or her behalf. Mambo et al. discussed two types of proxy signature schemes: proxy unprotected and proxy protected.Proxy-unprotected proxy signatures include two cases: full delegation and partial delegation. In full delegation, the original signer gives his or her private key to the proxy signer to sign messages; therefore, the original signer takes full responsibility for the signatures produced by the proxy signer. In partial delegation, the original signer creates a proxy signature key using his or her private key and securely forwards it to the proxy signer; then, the proxy signer uses this proxy signature key to sign messages on the original signer’s behalf.Proxy-protected proxy signature schemes allow the original signer to use his or her private key to create a proxy signature key and securely forward it to the proxy signer. The proxy signer computes a new proxy signature signing key—which contains both the original signer’s original proxy signature signing key and the private key of the proxy signer—and then signs messages using the new proxy signature key. Therefore, the original signer and proxy signer share the responsibility for the valid proxy signatures generated by the proxy signer. Both of these schemes afford security properties such as verifiability, unforgeability, and undeniability.For example, the president of a company could ask his or her reliable secretary (using the proxy-unprotected signature scheme) or employee (using the proxy-protected signature scheme) to sign some important documents on his or her behalf. Then, if some illegal situation arises in relation to the proxy signature, the employee’s privacy can be uncovered while the secretary’s privacy cannot.Moreover, delegation can be categorized as full delegation, partial delegation, and delegation by warrant, as follows:(1)
Full delegation: the proxy signer obtains a copy of the original signer’s signature key to produce a proxy signature value identical to the signature of the original signer.(2)
Partial delegation: the proxy signer’s signature key is obtained through a calculation based on the original signer’s private key. However, the proxy signature key cannot be used to obtain information related to the original signer’s private key. Partial delegation can be categorized as one of two types: proxy-unprotected or proxy-protected. In the former, the original signer and proxy signer can both provide valid proxy signatures. In the latter, only the proxy signer can provide a valid proxy signature.(3)
Delegation by warrant: a warrant based on the original signer’s signature is used to validate the proxy signer’s signing authority. The proxy signer’s authorization message and proxy signature content is included in the proxy signature and the verifier is used to determine the legitimacy of the authorization.The original signer first delegates his/her signing rights to one or more proxy signers, so that the proxy signers can sign a message in the name of the original signer. Each type of the scheme, proxy unprotected or proxy protected, has to satisfy three security requirements.(1)
Verifiability: the proxy signature created by the proxy signer can convince anyone of the permission from the original signer.(2)
Unforgeability: only the authorized proxy signers can sign a valid signature; this cannot be done even by the original signer.(3)
Undeniability: neither the proxy signer nor the original signer can deny the signature they created after the signature creation.The earliest proxy signature scheme (Figure2) (proposed by Mambo et al. [13]) is a proxy signature of the proxy-unprotected type for the ElGamal scheme [36]. The steps in this scheme are as follows.Figure 2
Proxy signature scheme.Figure 3
Proxy phase (proxy-unprotected type).(1) Key Generation Phase. In this phase, the system generates two primes and a pair of keys, public and private keys, for use in the following process.Step 1.
Choose two large prime numbersp,q such that q∣(p-1).Step 2.
Select random numbersg∈Zp∗ such that Ordpg=q.Step 3.
Each of the original signer and the proxy signer choose a random numberx∈RZq∗ as their private keys.Step 4.
Each of the original signer and the proxy signer computey=gxmodp as their public keys.(2) Proxy PhaseStep 1.
The original signer chooses a random numberk∈RZp-1∗.Step 2.
The original signer computesK=gkmodp.Step 3.
The original signer calculatesσ=x+kKmod(p-1) and sends σ to the proxy signer via a secure channel.Step 4.
After receivingσ, the proxy signer checks whether gσ=?yKKmodp is correct. If it is, the proxy signer accepts delegation.(3) Signing Phase. After receiving a message m from a requestor, the proxy signer processes the follow steps.Step 1.
Choose a random numberr∈RZp-1∗.Step 2.
ComputeR=grmodp.Step 3.
Evaluates=r-1(m-Rσ)mod(p-1) and send signature (R,s,K) to the requestor.(4) Verification Phase. After receiving a message (m, (R,s,K)) from the requestor, a verifier checks the validation of the signature via the following verification equation: gm=?(yKK)RRsmodp.Note that(yKK)RRs=(gxgkK)Rgrs=gR(x+kK)gr[r-1(m-Rσ)]=gR(x+kK)+(m-Rσ)=gR(x+kK)+m-R(x+kK)=gmmodp.


## 3. System Goal and Security Requirements

In this section, we define the attacker model, propose two new signature schemes, and present one electronic voting system based on the proposed signature schemes.


### 3.1. Attacker Model for Signature Scheme

The proposed signature schemes consist of four entities: an original signerA, a proxy signer B, a receiver R, and a verifier V. In our scheme, we assume the channels between A and B are secure. Any identity (i.e., R or V) communicates with B via an insecure public channel, offering adversaries opportunities to intercept. In the following, we present the assumptions of the attacker model [37, 38].(1)
An adversary may eavesdrop on all communications between protocol actors over the public channel.(2)
An attacker can modify, delete, resend, and reroute the eavesdropped message.(3)
An attacker cannot intercept a message over a secure channel.(4)
An attacker cannot be a legitimate original signer or proxy signer.(5)
The attacker knows the protocol description, which means the protocol is public.


### 3.2. Signature Scheme

We define the security properties of a proxy oblivious signature scheme as follows.Definition 1 (security requirements of our signature scheme).
Our signature scheme is secure if it achieves (1) completeness, (2) unforgeability, (3) unlinkability, (4) undeniability, (5) verifiability, (6) distinguishability, and (7) ambiguity.The security requirements of our proposed scheme are listed as follows:(1)
Completeness: if all entities follow the protocol honestly, then, at the end of the protocol,R will obtain the valid signature σ of the selected message.(2)
Unforgeability: in a proxy-unprotected type scheme,B can sign messages on behalf of A without taking responsibility for the signature. V can merely know that the signature is signed by some proxy delegated by A, and no one except B (or A) can produce a valid signature. In a proxy-protected type scheme, A and B share the responsibility for the signature, and only B can create a valid signature for R. Consequently, the proxy signing key is practically unbreakable, making it almost impossible for an attacker to create a valid signature.(3)
Unlinkability:B can identify neither the message nor the proxy signature he or she generates associated with the scheme after the signature is revealed when necessary.(4)
Undeniability: neitherA nor B can deny the signature they have created after signature generation.(5)
Verifiability: the signature thatR receives should be able to convince V of the agreement from A and B.(6)
Distinguishability: the proxy signature is distinguishable from a normal one.(7)
Ambiguity:B cannot find out which message R has selected while signing the messages, but B can be certain that the message he or she signs is one of the predetermined messages; otherwise, the signature would not be accepted by a verifier.


### 3.3. Attacker Model for Voting Scheme

The proposed electronic voting system consists of five entities: a creatorA, a proxy creator B, a voter R, a voting center V, and a bulletin board BB. In our scheme, we assume the channels between A and B are secure. Any identity (i.e., R, V, or BB) communicates with B via an insecure public channel, offering adversaries opportunities to intercept. In the following, we present the assumptions of the attacker model [37, 38].(1)
An adversary may eavesdrop on all communications between protocol actors over the public channel.(2)
An attacker can modify, delete, resend, and reroute the eavesdropped message.(3)
An attacker cannot intercept a message over a secure channel.(4)
An attacker cannot be a legitimate creator or proxy creator.(5)
The attacker knows the protocol description, which means the protocol is public.


### 3.4. Voting System

The proposed electronic voting system consists of five entities,A, B, R, V, and BB, which, in a practical situation, would correspond to a central government, a local government, a voter, a voting center computer, and a bulletin website, respectively. Anane et al. [39] present the core properties of the voting system and indicated that a viable e-voting system should possess (1) accuracy, (2) privacy (untraceability), (3) individual and universal verifiability, (4) eligibility, and (5) fairness. Based on [39], we define the system requirements of the proposed electronic voting system as follows.Definition 2 (system requirements of our electronic voting system).
Our electronic voting system is secure if it achieves (1) proxy completeness, (2) eligibility, (3) nonduplication, (4) fairness, (5) accuracy, (6) verifiability, and (7) privacy.This system requirements of our electronic voting system are listed as follows:(1)
Proxy completeness: the proxy creator should not deny the fact that he or she has accepted the delegation from the creator.(2)
Eligibility: only voters who have the right to vote can participate in the voting event.(3)
Nonduplication: every legal voter is allowed to cast only one ballot.(4)
Fairness: before the end of the voting period, no one can know the current total number of votes received by every candidate.(5)
Accuracy: the validity of all ballots can be verified by using the proper public key.(6)
Verifiability: every voter should be able to confirm his or her voting condition and verify all other voters’ ballots.(7)
Privacy: no one except for the voter can find out which candidate has been chosen, even at the end of voting.


## 3.1. Attacker Model for Signature Scheme

The proposed signature schemes consist of four entities: an original signerA, a proxy signer B, a receiver R, and a verifier V. In our scheme, we assume the channels between A and B are secure. Any identity (i.e., R or V) communicates with B via an insecure public channel, offering adversaries opportunities to intercept. In the following, we present the assumptions of the attacker model [37, 38].(1)
An adversary may eavesdrop on all communications between protocol actors over the public channel.(2)
An attacker can modify, delete, resend, and reroute the eavesdropped message.(3)
An attacker cannot intercept a message over a secure channel.(4)
An attacker cannot be a legitimate original signer or proxy signer.(5)
The attacker knows the protocol description, which means the protocol is public.


## 3.2. Signature Scheme

We define the security properties of a proxy oblivious signature scheme as follows.Definition 1 (security requirements of our signature scheme).
Our signature scheme is secure if it achieves (1) completeness, (2) unforgeability, (3) unlinkability, (4) undeniability, (5) verifiability, (6) distinguishability, and (7) ambiguity.The security requirements of our proposed scheme are listed as follows:(1)
Completeness: if all entities follow the protocol honestly, then, at the end of the protocol,R will obtain the valid signature σ of the selected message.(2)
Unforgeability: in a proxy-unprotected type scheme,B can sign messages on behalf of A without taking responsibility for the signature. V can merely know that the signature is signed by some proxy delegated by A, and no one except B (or A) can produce a valid signature. In a proxy-protected type scheme, A and B share the responsibility for the signature, and only B can create a valid signature for R. Consequently, the proxy signing key is practically unbreakable, making it almost impossible for an attacker to create a valid signature.(3)
Unlinkability:B can identify neither the message nor the proxy signature he or she generates associated with the scheme after the signature is revealed when necessary.(4)
Undeniability: neitherA nor B can deny the signature they have created after signature generation.(5)
Verifiability: the signature thatR receives should be able to convince V of the agreement from A and B.(6)
Distinguishability: the proxy signature is distinguishable from a normal one.(7)
Ambiguity:B cannot find out which message R has selected while signing the messages, but B can be certain that the message he or she signs is one of the predetermined messages; otherwise, the signature would not be accepted by a verifier.


## 3.3. Attacker Model for Voting Scheme

The proposed electronic voting system consists of five entities: a creatorA, a proxy creator B, a voter R, a voting center V, and a bulletin board BB. In our scheme, we assume the channels between A and B are secure. Any identity (i.e., R, V, or BB) communicates with B via an insecure public channel, offering adversaries opportunities to intercept. In the following, we present the assumptions of the attacker model [37, 38].(1)
An adversary may eavesdrop on all communications between protocol actors over the public channel.(2)
An attacker can modify, delete, resend, and reroute the eavesdropped message.(3)
An attacker cannot intercept a message over a secure channel.(4)
An attacker cannot be a legitimate creator or proxy creator.(5)
The attacker knows the protocol description, which means the protocol is public.


## 3.4. Voting System

The proposed electronic voting system consists of five entities,A, B, R, V, and BB, which, in a practical situation, would correspond to a central government, a local government, a voter, a voting center computer, and a bulletin website, respectively. Anane et al. [39] present the core properties of the voting system and indicated that a viable e-voting system should possess (1) accuracy, (2) privacy (untraceability), (3) individual and universal verifiability, (4) eligibility, and (5) fairness. Based on [39], we define the system requirements of the proposed electronic voting system as follows.Definition 2 (system requirements of our electronic voting system).
Our electronic voting system is secure if it achieves (1) proxy completeness, (2) eligibility, (3) nonduplication, (4) fairness, (5) accuracy, (6) verifiability, and (7) privacy.This system requirements of our electronic voting system are listed as follows:(1)
Proxy completeness: the proxy creator should not deny the fact that he or she has accepted the delegation from the creator.(2)
Eligibility: only voters who have the right to vote can participate in the voting event.(3)
Nonduplication: every legal voter is allowed to cast only one ballot.(4)
Fairness: before the end of the voting period, no one can know the current total number of votes received by every candidate.(5)
Accuracy: the validity of all ballots can be verified by using the proper public key.(6)
Verifiability: every voter should be able to confirm his or her voting condition and verify all other voters’ ballots.(7)
Privacy: no one except for the voter can find out which candidate has been chosen, even at the end of voting.


## 4. Proposed Signature Scheme

Two types of proxy oblivious signature schemes are proposed: proxy-unprotected type and proxy-protected type. Each scheme includes four phases: (1) system setup phase, (2) proxy phase (Figure3), (3) signing phase (Figure 4), and (4) verification phase (Figure 5). Notation illustrates the notations used in the protocol.Figure 4
Signing phase.Figure 5
Verification phase.


### 4.1. Proxy-Unprotected Type

For a proxy-unprotected type scheme, our protocol is as follows.(1) System Setup PhaseStep 1.
Two large primesp,q∋q∣(p-1) are chosen.Step 2.
Two generatorsg,h∈Zp∗, where Ordpg=q and Ordph=q, are chosen.Step 3.
The original signerA chooses xA∈Zq∗ and computes yA=gxAmodp.Step 4.
The proxy signerB chooses xB∈Zq∗ and computes yB=gxBmodp.(2) Proxy PhaseStep 1 (commission generation).
A randomly chooses k∈RZq∗ and computes r=gkmodp, sp=xAr+kmodq, and yp=gspmodp.Step 2 (proxy delivery).
A securely forwards the pair (r,sp) to the proxy signer B and publishes yp.Step 3 (proxy verification).
B checks whether gsp=ryArmodp holds. If it does, B accepts the proxy and uses sp as his or her secret proxy signature key.(3) Signing PhaseStep 1.
R decides n messages {m1,m2,…,mn} and then selects a message mb∈{m1,m2,…,mn}, randomly chooses v∈RZq∗, computes c=gvh-bmodp, and finally sends the determined messages and c to B.Step 2.
Fori=1,2,…,n, B chooses n random numbers ki∈RZq∗, computes Ki=gkimodp, δi=c(gh)imodp, ei^=H(mi,Kiδimodp), and si^=ki-spei^modq, and sends (ei^,si^) to R, where 1≤i≤n.Step 3.
Fori=1,2,…,n, R computes δi=c(gh)imodp and accepts the oblivious signature if and only if ei^=H(mi,gsi^ypei^δimodp).Step 4.
To convert the oblivious signature into a generic signature,R lets e=eb^ and computes s=sb^+v+bmodq. The signature for mb is σ=(e,s).(4) Verification Phase. As shown in Figure 5, the verifier V accepts the signature σ as a valid signature if and only if e=H(mb,gsypemodp).


### 4.2. Proxy-Protected Type

For a proxy-protected type scheme, the signing phase and verification phase are the same as those in the case of a proxy-unprotected type scheme except for one more computationyp=yp′yBmodp (as shown in Figure 6). The proxy phase is modified as described subsequently.Figure 6
Proxy phase (proxy-protected type).(1) Proxy PhaseStep 1 (commission generation).
A randomly chooses k∈RZq∗ and computes r=gkmodp, sA=xAr+kmodq, and yp′=gsAmodp.Step 2 (proxy delivery).
A securely forwards the pair (r,sA) to the proxy signer B and publishes yp′.Step 3 (proxy verification).
B checks whether gsA=ryArmodp holds. If it does, B accepts the proxy and computes sp=sA+xBmodq as his or her secret proxy signature key.


## 4.1. Proxy-Unprotected Type

For a proxy-unprotected type scheme, our protocol is as follows.(1) System Setup PhaseStep 1.
Two large primesp,q∋q∣(p-1) are chosen.Step 2.
Two generatorsg,h∈Zp∗, where Ordpg=q and Ordph=q, are chosen.Step 3.
The original signerA chooses xA∈Zq∗ and computes yA=gxAmodp.Step 4.
The proxy signerB chooses xB∈Zq∗ and computes yB=gxBmodp.(2) Proxy PhaseStep 1 (commission generation).
A randomly chooses k∈RZq∗ and computes r=gkmodp, sp=xAr+kmodq, and yp=gspmodp.Step 2 (proxy delivery).
A securely forwards the pair (r,sp) to the proxy signer B and publishes yp.Step 3 (proxy verification).
B checks whether gsp=ryArmodp holds. If it does, B accepts the proxy and uses sp as his or her secret proxy signature key.(3) Signing PhaseStep 1.
R decides n messages {m1,m2,…,mn} and then selects a message mb∈{m1,m2,…,mn}, randomly chooses v∈RZq∗, computes c=gvh-bmodp, and finally sends the determined messages and c to B.Step 2.
Fori=1,2,…,n, B chooses n random numbers ki∈RZq∗, computes Ki=gkimodp, δi=c(gh)imodp, ei^=H(mi,Kiδimodp), and si^=ki-spei^modq, and sends (ei^,si^) to R, where 1≤i≤n.Step 3.
Fori=1,2,…,n, R computes δi=c(gh)imodp and accepts the oblivious signature if and only if ei^=H(mi,gsi^ypei^δimodp).Step 4.
To convert the oblivious signature into a generic signature,R lets e=eb^ and computes s=sb^+v+bmodq. The signature for mb is σ=(e,s).(4) Verification Phase. As shown in Figure 5, the verifier V accepts the signature σ as a valid signature if and only if e=H(mb,gsypemodp).


## 4.2. Proxy-Protected Type

For a proxy-protected type scheme, the signing phase and verification phase are the same as those in the case of a proxy-unprotected type scheme except for one more computationyp=yp′yBmodp (as shown in Figure 6). The proxy phase is modified as described subsequently.Figure 6
Proxy phase (proxy-protected type).(1) Proxy PhaseStep 1 (commission generation).
A randomly chooses k∈RZq∗ and computes r=gkmodp, sA=xAr+kmodq, and yp′=gsAmodp.Step 2 (proxy delivery).
A securely forwards the pair (r,sA) to the proxy signer B and publishes yp′.Step 3 (proxy verification).
B checks whether gsA=ryArmodp holds. If it does, B accepts the proxy and computes sp=sA+xBmodq as his or her secret proxy signature key.


## 5. Proposed Voting System

### 5.1. System Overview

Based on the proposed signature scheme, our electronic voting system allows a creator (central government) to delegate one or more proxy creators (local government), and a voter can get a legal ballot from a proxy creator and send his or her vote to a verifier (center voting computer).This system includes six phases: (1) system setup phase, (2) proxy phase (Figure8), (3) register phase (Figure 9), (4) circling phase (Figure 10), (5) voting phase (Figure 11), and (6) counting phase (Figure 12), as shown in Figure 7.Figure 7
System diagram.Figure 8
Proxy phase.Figure 9
Register phase.Figure 10
Circling phase.Figure 11
Voting phase.Figure 12
Counting phase.Step 1.
The system first generates the required parameters.Step  2a. The creator delegates his or her authority to a proxy creator.Step  2b. The creator publishes the public key of the proxy creator to the bulletin.Step  3a. The proxy creator examines whether the registrant is a legal voter; if so, he or she distributes a certificate to the voter.Step  3b. The proxy creator publishes the certificate to the bulletin.Step  3c. The voter checks whether he or she has registered successfully via the bulletin.Step 4.
The voter chooses a candidate and receives the signature on it from the proxy creator.Step  5a. The voter casts his or her ballot and sends it to the voting center.Step  5b. The voting center publishes a message about the ballot from the voter to the bulletin.Step  5c. Every voter can confirm whether his or her ballot has been received by the voting center; if not, he or she can resend the ballot.Step  6a. At the end of the voting period, the proxy creator forwards the decrypting key to the voting canter, and the voting center starts to verify and count the ballots.Step  6b. The voting center publishes the voting result to the bulletin, where everyone can verify and count all ballots.


### 5.2. System Process

We assume that the system database already contains an identification list of legal voters and that the bulletin is read-only to all entities except for the authorities.(1) System Setup PhaseStep 1.
Two large primesp,q∋q∣(p-1) are chosen.Step 2.
Two generatorsg,h∈Zp∗, where Ordpg=q and Ordph=q, are chosen.Step 3.
The creatorA chooses xA∈Zq∗ and computes yA=gxAmodp.Step 4.
The proxy creatorB chooses xB∈Zq∗ and computes yB=gxBmodp.Step 5.
B chooses two large primes pB,qB.Step 6.
B computes NB=pB×qB.Step 7.
B computes ϕ(NB)=(pB-1)(qB-1).Step 8.
B chooses eB∋GCD(eB,ϕ(NB))=1.Step 9.
B computes dB=eB-1modϕ(NB).(2) Proxy PhaseStep 1.
A randomly chooses k∈RZq∗ and computes rA=gkmodp, sA=xArA+kmodq, and yp′=gsAmodp.Step 2.
A encrypts the pair (rA,sA) using (eB,NB), forwards it to B, and publishes yp′.Step 3.
B decrypts (rA,sA) using (dB,NB) and checks whether gsA=rAyArAmodp holds. If it does, B accepts the proxy and computes sp=sA+xBmodq as his or her secret proxy signature key.Step 4.
B generates a signature sA,B=H(gsAmodp)dBmodNB and forwards it to A.Step 5.
A checks whether sA,BeB=H(yp′)modNB holds. If it does, he or she publishes yp′,yB to the bulletin.(3) Register PhaseStep 1.
A voterR picks a pseudoname pn and a password pw, computes HR=H(pw), encrypts (id,pn,H(pw)) using (eB,NB), and sends it to a proxy creator.Step 2.
B decrypts (id,pn,HR) using (dB,NB) and checks whether R is a legal voter. If so, B stores (pn,HR) in the system database, sets flag(pn)=0, calculates keyR=H(HR,eB) and sB=H(pn,eB)dBmodNB, returns Cert(R) to R, and publishes Cert(R) to the bulletin, where Cert(R)=(pn,eB,sB).Step 3.
R verifies whether sBeB=H(pn,eB)modNB is correct. If so, he or she has the right to vote.(4) Circling PhaseStep 1.
B sends a random number r∈RZq∗ to R after receiving a login request from R.Step 2.
R computes HR′=H(H(pw),r), picks a random number v∈RZq∗, calculates c=gvh-bmodp(mb∈{m1,m2,…,mn}), and forwards (pn,HR′,c) to B.Step 3.
B examines whether HR′=H(HR,r) is correct. If so, B checks whether flag(pn)=0. If it holds, B chooses ki∈RZq∗, calculates Ki=gkimodp, δi=c(gh)imodp, ei^=H(mi,pn,Kiδimodp), and si^=ki-spei^modq,∀i=1,2,…,n, returns (ei^,si^),1≤i≤n, to R, and sets flag(pn)=1.Step 4.
R computes yp=yp′yBmodp, and, for every i=1,2,…,n, he or she calculates δi=c(gh)imodp and checks whether ei^=H(mi,pn,gsi^ypei^δimodp) is correct. If so, R computes s=sb^+v+bmodq and e=eb^. The final signature is σ(mb)=(e,s).(5) Voting PhaseStep 1.
R calculates H(H(pw),eB) and uses it as a symmetric key to encrypt (mb,σ(mb)), produces a cipher CR, and sends (Cert(R),CR) to the voting center.Step 2.
V first examines whether sBeB=H(pn,eB)modNB holds. If so, V publishes (Cert(R),CR) to the bulletin.Step 3.
Every voter can check whether his or her ballot is received by the voting center via the bulletin. If it is not, the voter resends(Cert(R),CR).(6) Counting PhaseStep 1.
B forwards keyR=H(HR,eB) to the voting center.Step 2.
V decrypts CR using the symmetric key keyR, publishes (Cert(R),CR,mb,keyR) to the bulletin and calculates yp=yp′yBmodp, and verifies whether e=H(mb,pn,gsypemodp) is correct. If so, the signature is valid and the ballot is counted.Step 3.
V publishes the voting result. Everyone can verify and count the ballots via the bulletin.


## 5.1. System Overview

Based on the proposed signature scheme, our electronic voting system allows a creator (central government) to delegate one or more proxy creators (local government), and a voter can get a legal ballot from a proxy creator and send his or her vote to a verifier (center voting computer).This system includes six phases: (1) system setup phase, (2) proxy phase (Figure8), (3) register phase (Figure 9), (4) circling phase (Figure 10), (5) voting phase (Figure 11), and (6) counting phase (Figure 12), as shown in Figure 7.Figure 7
System diagram.Figure 8
Proxy phase.Figure 9
Register phase.Figure 10
Circling phase.Figure 11
Voting phase.Figure 12
Counting phase.Step 1.
The system first generates the required parameters.Step  2a. The creator delegates his or her authority to a proxy creator.Step  2b. The creator publishes the public key of the proxy creator to the bulletin.Step  3a. The proxy creator examines whether the registrant is a legal voter; if so, he or she distributes a certificate to the voter.Step  3b. The proxy creator publishes the certificate to the bulletin.Step  3c. The voter checks whether he or she has registered successfully via the bulletin.Step 4.
The voter chooses a candidate and receives the signature on it from the proxy creator.Step  5a. The voter casts his or her ballot and sends it to the voting center.Step  5b. The voting center publishes a message about the ballot from the voter to the bulletin.Step  5c. Every voter can confirm whether his or her ballot has been received by the voting center; if not, he or she can resend the ballot.Step  6a. At the end of the voting period, the proxy creator forwards the decrypting key to the voting canter, and the voting center starts to verify and count the ballots.Step  6b. The voting center publishes the voting result to the bulletin, where everyone can verify and count all ballots.


## 5.2. System Process

We assume that the system database already contains an identification list of legal voters and that the bulletin is read-only to all entities except for the authorities.(1) System Setup PhaseStep 1.
Two large primesp,q∋q∣(p-1) are chosen.Step 2.
Two generatorsg,h∈Zp∗, where Ordpg=q and Ordph=q, are chosen.Step 3.
The creatorA chooses xA∈Zq∗ and computes yA=gxAmodp.Step 4.
The proxy creatorB chooses xB∈Zq∗ and computes yB=gxBmodp.Step 5.
B chooses two large primes pB,qB.Step 6.
B computes NB=pB×qB.Step 7.
B computes ϕ(NB)=(pB-1)(qB-1).Step 8.
B chooses eB∋GCD(eB,ϕ(NB))=1.Step 9.
B computes dB=eB-1modϕ(NB).(2) Proxy PhaseStep 1.
A randomly chooses k∈RZq∗ and computes rA=gkmodp, sA=xArA+kmodq, and yp′=gsAmodp.Step 2.
A encrypts the pair (rA,sA) using (eB,NB), forwards it to B, and publishes yp′.Step 3.
B decrypts (rA,sA) using (dB,NB) and checks whether gsA=rAyArAmodp holds. If it does, B accepts the proxy and computes sp=sA+xBmodq as his or her secret proxy signature key.Step 4.
B generates a signature sA,B=H(gsAmodp)dBmodNB and forwards it to A.Step 5.
A checks whether sA,BeB=H(yp′)modNB holds. If it does, he or she publishes yp′,yB to the bulletin.(3) Register PhaseStep 1.
A voterR picks a pseudoname pn and a password pw, computes HR=H(pw), encrypts (id,pn,H(pw)) using (eB,NB), and sends it to a proxy creator.Step 2.
B decrypts (id,pn,HR) using (dB,NB) and checks whether R is a legal voter. If so, B stores (pn,HR) in the system database, sets flag(pn)=0, calculates keyR=H(HR,eB) and sB=H(pn,eB)dBmodNB, returns Cert(R) to R, and publishes Cert(R) to the bulletin, where Cert(R)=(pn,eB,sB).Step 3.
R verifies whether sBeB=H(pn,eB)modNB is correct. If so, he or she has the right to vote.(4) Circling PhaseStep 1.
B sends a random number r∈RZq∗ to R after receiving a login request from R.Step 2.
R computes HR′=H(H(pw),r), picks a random number v∈RZq∗, calculates c=gvh-bmodp(mb∈{m1,m2,…,mn}), and forwards (pn,HR′,c) to B.Step 3.
B examines whether HR′=H(HR,r) is correct. If so, B checks whether flag(pn)=0. If it holds, B chooses ki∈RZq∗, calculates Ki=gkimodp, δi=c(gh)imodp, ei^=H(mi,pn,Kiδimodp), and si^=ki-spei^modq,∀i=1,2,…,n, returns (ei^,si^),1≤i≤n, to R, and sets flag(pn)=1.Step 4.
R computes yp=yp′yBmodp, and, for every i=1,2,…,n, he or she calculates δi=c(gh)imodp and checks whether ei^=H(mi,pn,gsi^ypei^δimodp) is correct. If so, R computes s=sb^+v+bmodq and e=eb^. The final signature is σ(mb)=(e,s).(5) Voting PhaseStep 1.
R calculates H(H(pw),eB) and uses it as a symmetric key to encrypt (mb,σ(mb)), produces a cipher CR, and sends (Cert(R),CR) to the voting center.Step 2.
V first examines whether sBeB=H(pn,eB)modNB holds. If so, V publishes (Cert(R),CR) to the bulletin.Step 3.
Every voter can check whether his or her ballot is received by the voting center via the bulletin. If it is not, the voter resends(Cert(R),CR).(6) Counting PhaseStep 1.
B forwards keyR=H(HR,eB) to the voting center.Step 2.
V decrypts CR using the symmetric key keyR, publishes (Cert(R),CR,mb,keyR) to the bulletin and calculates yp=yp′yBmodp, and verifies whether e=H(mb,pn,gsypemodp) is correct. If so, the signature is valid and the ballot is counted.Step 3.
V publishes the voting result. Everyone can verify and count the ballots via the bulletin.


## 6. Security Analysis

In this section, we analyze our protocol according to the security requirements defined in Section3.


### 6.1. Signature Scheme

(1) The Proposed Scheme Is Complete. Because the completeness of the signature σ=(e,s) depends on the Schnorr signature [28], we only show the completeness of the oblivious signature generated in the signing phase. For any (ei^,si^),i=1,2,…,n, we have H(mi,gsi^ypei^δimodp)=H(mi,gki-spei^gspe^iδimodp)=H(mi,gkiδimodp)=H(mi,Kiδimodp)=ei^. Therefore, the completeness of the proxy signature σ=(e,s) is proved.(2) Proxy Oblivious Signatures Are Unforgeable. Unforgeability can be proved via Definitions 3 and 5 and Theorems 4 and 6.Definition 3 (DLP).
Letp1 be a large prime, g1 be a primitive root modulo p, and y=g1xmodp1, where x,y∈Zp1∗. If x can be evaluated from given y, p1, and g1, then we say discrete logarithm problem (DLP) can be solved (the probability of solving this problem is denoted as Pr(x∣y,p1,g1)=ε1).Theorem 4 (unforgeability).
In our protocol, if a recipient can forge the signer’s signature; then DLP can be solved.Proof.
In our scheme, assume an adversary tries to evaluatesA by eavesdropping yp′. Let RO1 be a random oracle: input yp′, p, and g to output sA (i.e., RO1(yp′,p,g)⇒sA). In Definition 3, let yp′←x, p←p1, and g←g1 be input parameters of RO1 and obtain output sA. Let y←sA; then y is evaluated. Therefore, Pr(sA∣yp′,p,g)≤Pr(y∣x,p1,g1)=ε1, which means thediscrete logarithm problem can be solved if RO1 exists.Definition 5 (DLP under known plaintext attack).
Letp1 be a large prime, g1 be a primitive root modulo p1, and yi=gximodp1, where xi,yi∈Zp1∗. If xn+1 can be evaluated from given p1, g1, (xi,yi), and yn+1, i=1,2,…,n, then we say DLP under known plaintext attack can be solved (the probability of solving this problem is denoted as Pr(xn+1∣(xi,yi),yn+1,p1,g1)=ε2).Theorem 6 (unforgeability under replay attack).
In our protocol, if a recipient can forge the signer’s signature from givenn pairs (yP′(i),sA(i)), i=1,2,…,n, then DLP under known plaintext attack can be solved.Proof.
In our scheme, assume an adversary tries to evaluatesA(i+1) from eavesdropped (yP′(i),sA(i)) and yP′(n+1),i=1,2,…,n. Let RO2 be a random oracle: input (yP′(i),sA(i)), yP′(n+1),p,g to output sA(i+1) (i.e., RO2((yP′(i),sA(i)),yP′(n+1),p,g)⇒sA(i+1)). In Definition 5, let (yP′(i),sA(i))←(xi,yi),yP′(n+1)←yn+1,p←p1, and g←g1 be input parameters of RO2 and obtain output sA(i+1). Let xn+1←sA(i+1); then xn+1 is evaluated. Therefore, Pr(sA(i+1)∣(yP′(i),sA(i)),yP′(n+1),p,g)≤Pr(xn+1∣(xi,yi),yn+1,p1,g1)=ε2, which means theDLP under known plaintext attack can be solved if RO2 exists.(3) Proxy Oblivious Signatures Are Unlinkable. In the signing phase, because B receives the disguised selection c of the message mb, he or she cannot find out the selection of R. Moreover, because the blinding factor v is required during the conversion of the oblivious signature sb^, where v is known only by R, B cannot make a linkage between the signature and R’s selection. Thus, we can conclude that B can discover neither the message nor the proxy signature associated with the protocol after the signature is verified.(4) Proxy Oblivious Signatures Are Undeniable. Owing to the unforgeability of the proxy oblivious signature, B cannot repudiate any proxy signature produced by him or her.(5) Proxy Oblivious Signatures Are Verifiable. In the verification phase, V checks whether the equation e=H(mb,gsypemodp) holds, because gsype = gsb^+v+bypeb^ = gkb-speb^+v+bgspeb^=gkb+v+b = gkbgvh-bgbhb = gkbc(gh)b = Kbδbmodp, and, thus, H(mb,gsypemodp) = H(mb,Kbδbmodp) = eb^ = e. Therefore, the signature can be verified by all verifiers.(6) Generated Signatures Are Distinguishable. Evidently, by using different congruences to check the validity of the original signatures and the proxy signatures, everyone can easily distinguish the proxy signature from a normal signature.(7) The Proposed Scheme Provides Ambiguity of the Message Selected by
R
; That Is, It Provides Perfect Security for
R. If an attacker A1 takes the place of B, A1 needs to obtainb, where c=gvh-bmodp, v∈RZq∗, because we know that, for every b of any c, there exists vi such that c=gvh-b=gvih-imodp,fori=1,2,…,n. Finally, we conclude that the probability of A1 getting the correct b is 1/n, which achieves theoretical security.


### 6.2. Voting System

(1) Delegation from Creator Is Complete. In the proxy phase, B signs the proxy public key yp′ using his or her private key xB and passes the signature sA,B to A. Therefore, B cannot deny the fact that he or she has accepted the delegation from A.(2) Eligibility. In the register phase, B checks whether R is a legal voter by his or her id. Therefore, only legal voters can get the certificate CERT(R) from B and participate in the voting event.(3) Nonduplication. In the circling phase, B checks whether flagpn=0. If it holds, it means that pn has not voted yet; otherwise, the process will be terminated. Consequently, every legal voter can cast at most one ballot.(4) Fairness. In the voting phase, R encrypts his or her ballot using the symmetric key H(H(pw),eB) and sends it to the voting center. Therefore, no one can learn the current voting situation before the voting period is over.(5) Accuracy. The validity of all ballots can be verified using the examining equation e=H(mb,pn,gsypemodp).(6) Verifiability. In the voting phase, every voter can check his or her own ballot via the bulletin, and the ballot cannot be modified by anyone. Furthermore, in the counting phase, every voter can verify and count all other voters’ ballots on the bulletin.(7) Privacy. In the circling phase, owing to the ambiguity of the proxy oblivious signature, no one can learn a voter’s selection from c=gvh-bmodp. In the voting phase, R encrypts his or her ballot using the key H(H(pw),eB) before casting it to V, and, therefore, no one can obtain his or her plain ballot. Finally, in the counting phase, because every selected candidate on the bulletin corresponds to a pseudoname pn, no one can discover which person has made the selection.


## 6.1. Signature Scheme

(1) The Proposed Scheme Is Complete. Because the completeness of the signature σ=(e,s) depends on the Schnorr signature [28], we only show the completeness of the oblivious signature generated in the signing phase. For any (ei^,si^),i=1,2,…,n, we have H(mi,gsi^ypei^δimodp)=H(mi,gki-spei^gspe^iδimodp)=H(mi,gkiδimodp)=H(mi,Kiδimodp)=ei^. Therefore, the completeness of the proxy signature σ=(e,s) is proved.(2) Proxy Oblivious Signatures Are Unforgeable. Unforgeability can be proved via Definitions 3 and 5 and Theorems 4 and 6.Definition 3 (DLP).
Letp1 be a large prime, g1 be a primitive root modulo p, and y=g1xmodp1, where x,y∈Zp1∗. If x can be evaluated from given y, p1, and g1, then we say discrete logarithm problem (DLP) can be solved (the probability of solving this problem is denoted as Pr(x∣y,p1,g1)=ε1).Theorem 4 (unforgeability).
In our protocol, if a recipient can forge the signer’s signature; then DLP can be solved.Proof.
In our scheme, assume an adversary tries to evaluatesA by eavesdropping yp′. Let RO1 be a random oracle: input yp′, p, and g to output sA (i.e., RO1(yp′,p,g)⇒sA). In Definition 3, let yp′←x, p←p1, and g←g1 be input parameters of RO1 and obtain output sA. Let y←sA; then y is evaluated. Therefore, Pr(sA∣yp′,p,g)≤Pr(y∣x,p1,g1)=ε1, which means thediscrete logarithm problem can be solved if RO1 exists.Definition 5 (DLP under known plaintext attack).
Letp1 be a large prime, g1 be a primitive root modulo p1, and yi=gximodp1, where xi,yi∈Zp1∗. If xn+1 can be evaluated from given p1, g1, (xi,yi), and yn+1, i=1,2,…,n, then we say DLP under known plaintext attack can be solved (the probability of solving this problem is denoted as Pr(xn+1∣(xi,yi),yn+1,p1,g1)=ε2).Theorem 6 (unforgeability under replay attack).
In our protocol, if a recipient can forge the signer’s signature from givenn pairs (yP′(i),sA(i)), i=1,2,…,n, then DLP under known plaintext attack can be solved.Proof.
In our scheme, assume an adversary tries to evaluatesA(i+1) from eavesdropped (yP′(i),sA(i)) and yP′(n+1),i=1,2,…,n. Let RO2 be a random oracle: input (yP′(i),sA(i)), yP′(n+1),p,g to output sA(i+1) (i.e., RO2((yP′(i),sA(i)),yP′(n+1),p,g)⇒sA(i+1)). In Definition 5, let (yP′(i),sA(i))←(xi,yi),yP′(n+1)←yn+1,p←p1, and g←g1 be input parameters of RO2 and obtain output sA(i+1). Let xn+1←sA(i+1); then xn+1 is evaluated. Therefore, Pr(sA(i+1)∣(yP′(i),sA(i)),yP′(n+1),p,g)≤Pr(xn+1∣(xi,yi),yn+1,p1,g1)=ε2, which means theDLP under known plaintext attack can be solved if RO2 exists.(3) Proxy Oblivious Signatures Are Unlinkable. In the signing phase, because B receives the disguised selection c of the message mb, he or she cannot find out the selection of R. Moreover, because the blinding factor v is required during the conversion of the oblivious signature sb^, where v is known only by R, B cannot make a linkage between the signature and R’s selection. Thus, we can conclude that B can discover neither the message nor the proxy signature associated with the protocol after the signature is verified.(4) Proxy Oblivious Signatures Are Undeniable. Owing to the unforgeability of the proxy oblivious signature, B cannot repudiate any proxy signature produced by him or her.(5) Proxy Oblivious Signatures Are Verifiable. In the verification phase, V checks whether the equation e=H(mb,gsypemodp) holds, because gsype = gsb^+v+bypeb^ = gkb-speb^+v+bgspeb^=gkb+v+b = gkbgvh-bgbhb = gkbc(gh)b = Kbδbmodp, and, thus, H(mb,gsypemodp) = H(mb,Kbδbmodp) = eb^ = e. Therefore, the signature can be verified by all verifiers.(6) Generated Signatures Are Distinguishable. Evidently, by using different congruences to check the validity of the original signatures and the proxy signatures, everyone can easily distinguish the proxy signature from a normal signature.(7) The Proposed Scheme Provides Ambiguity of the Message Selected by
R
; That Is, It Provides Perfect Security for
R. If an attacker A1 takes the place of B, A1 needs to obtainb, where c=gvh-bmodp, v∈RZq∗, because we know that, for every b of any c, there exists vi such that c=gvh-b=gvih-imodp,fori=1,2,…,n. Finally, we conclude that the probability of A1 getting the correct b is 1/n, which achieves theoretical security.


## 6.2. Voting System

(1) Delegation from Creator Is Complete. In the proxy phase, B signs the proxy public key yp′ using his or her private key xB and passes the signature sA,B to A. Therefore, B cannot deny the fact that he or she has accepted the delegation from A.(2) Eligibility. In the register phase, B checks whether R is a legal voter by his or her id. Therefore, only legal voters can get the certificate CERT(R) from B and participate in the voting event.(3) Nonduplication. In the circling phase, B checks whether flagpn=0. If it holds, it means that pn has not voted yet; otherwise, the process will be terminated. Consequently, every legal voter can cast at most one ballot.(4) Fairness. In the voting phase, R encrypts his or her ballot using the symmetric key H(H(pw),eB) and sends it to the voting center. Therefore, no one can learn the current voting situation before the voting period is over.(5) Accuracy. The validity of all ballots can be verified using the examining equation e=H(mb,pn,gsypemodp).(6) Verifiability. In the voting phase, every voter can check his or her own ballot via the bulletin, and the ballot cannot be modified by anyone. Furthermore, in the counting phase, every voter can verify and count all other voters’ ballots on the bulletin.(7) Privacy. In the circling phase, owing to the ambiguity of the proxy oblivious signature, no one can learn a voter’s selection from c=gvh-bmodp. In the voting phase, R encrypts his or her ballot using the key H(H(pw),eB) before casting it to V, and, therefore, no one can obtain his or her plain ballot. Finally, in the counting phase, because every selected candidate on the bulletin corresponds to a pseudoname pn, no one can discover which person has made the selection.


## 7. Comparison

This section presents a comparison of our scheme against other related schemes, including blind signature [8], proxy signature [13], oblivious signature [10, 11], and proxy blind signature [19]. Tables 1, 2, and 3 present the computation cost, communication cost, and ability comparison, respectively. Because modular exponentiation is the most significant computational operation, we denote its time cost as “Tex” and ignore the other operations in the schemes.Table 1
Computation cost comparison.
Scheme
Original signer
(Proxy) signer
Receiver
Verifier
Yang and Liang [19]
T
e
x
4
T
e
x
2
T
e
x
3
T
e
x
Chen [10]
-
3
n
T
e
x
(
2
n
+
10
)
T
e
x
8
T
e
x
Tso et al. [11]
-
2
n
T
e
x
(
2
n
+
2
)
T
e
x
2
T
e
x
Proposed
2
T
e
x
(
n
+
2
)
T
e
x
∗
(
2
n
+
2
)
T
e
x
2
T
e
xTable 2
Communication cost comparison.
Scheme
A
→
B
B
→
R
R
→
B
R
→
V
Yang and Liang [19]
lq+lH
l
p
+
l
q
+
l
H
l
q
l
q
+
2
l
H
Chen [10]
-
3
n
l
p
+
n
l
q
l
q
7
l
p
+
l
q
+
l
H
Tso et al. [11]
-
n
(
l
q
+
l
H
)
l
p
l
q
+
l
H
Proposed
l
p
+
l
q
n
(
l
q
+
l
H
)
l
p
l
q
+
l
HTable 3
Ability comparison.
Scheme
Blindness
Ambiguity
Proxy ability
Nayak et al. [8]
✓
Mambo et al. [13]
✓
Yang and Liang [19]
✓
✓
Chen [10]
✓
✓
Tso et al. [11]
✓
✓
Proposed
✓
✓
✓Compared with other related schemes, our scheme provides the most abilities with a low increment in computation cost. Furthermore, the communication cost is no higher than that of other oblivious signature schemes.In the proxy phase,B processes 2Tex to examine whether gsA=ryArmodp holds (see asterisk in Table 1). In the signing phase, B processes nTex to calculate Ki=gkimodp for i=1,2,…,n. For δi=c(gh)imodp, B may compute δi by letting δ0=c and generate δi=δi-1(gh)modp for i=1,2,…,n. Consequently, the computation cost is n modular multiplication rather than nTex.


## 8. Implementation

This section demonstrates an application of an anonymous mobile electronic voting with proxy signer implemented on smartphones. Figure13 shows a flowchart of this system. In this system, it is assumed that any signer who is asked for his or her public key responds with his or her real public key immediately and that the requester would receive this public key at once. Tables 4, 5, and 6 present the average computation times of each role in each phase, the average communication times of each communication direction in each phase, and the average computation and communication times in each phase, respectively, where PP, RP, CiP, VP, and CoP stand for proxy phase, register phase, circling phase, voting phase, and counting phase. The steps in this system are as follows.Table 4
Computation time (milliseconds).
Phase
PP
RP
CiP
VP
CoP
Role
A
B
R
B
R
B
R
V
V
Time
42.4
31.5
22.85
19.55
31.2
31
19.8
10.35
20.25Table 5
Communication time (milliseconds).
Phase
PP
RP
CiP
VP
CoP
Direction
A
→
B
B
→
A
R
→
B
B
→
R
B
→
R
R
→
B
B
→
R
R
→
V
B
→
V
Time
61.05
81.65
32.1
42.8
44.45
38.75
47.2
44.7
39.6Table 6
Implementation time (milliseconds).
Phase
PP
RP
CiP
VP
CoP
Total
Computation time
73.9
42.4
62.2
30.15
20.25
228.9
Communication time
142.7
74.9
130.4
44.7
39.6
432.3Figure 13
Flowchart of voting application.Step 1.
On the main page (Figure14(a)), users are allowed to select a role and enter a pseudoname (Figure 14(b)). An original signer first runs the procedure and waits for proxy signers (Figure 14(c)).Figure 14
Data transfer.
(a)
Main page
(b)
Enter a pseudoname
(c)
Wait for proxy signers
(d)
Request delegation
(e)
Delegation
(f)
Set voting issue
(g)
Wait for verifiers
(h)
Wait for voting event
(i)
Send the voting event
(j)
Hold the voting event
(k)
Choose a voting event
(l)
Vote for a candidate
(m)
Send the signature
(n)
Collect votes
(o)
Display resultStep 2.
A proxy signer runs Step1 and selects a detected original signer to request delegation (Figure 14(d)).Step 3.
The original signer selects the proxy signer on the request list to process the delegation (Figure14(e)).Step 4.
After verifying the correctness of the delegation, the proxy signer sets the voting issue (Figure14(f)) and starts waiting for verifiers (Figure 14(g)).Step 5.
A verifier runs Step1 and waits for a proxy signer to send him a voting event (Figure 14(h)).Step 6.
The proxy signer selects a verifier to send the voting event (Figure14(i)) and starts holding the event (Figure 14(j)).Step 7.
A receiver selects “Voter” on the main page and chooses a detected voting event (Figure14(k)).Step 8.
The receiver votes for a candidate and presses the “Vote” button (Figure14(l)) to send his or her vote to the proxy signer. Then, he or she receives a proxy oblivious signature and sends the extracted signature to the verifier by pressing the “Send” button (Figure 14(m)).Step 9.
The verifier keeps collecting votes (Figure14(n)) until the proxy signer ends the voting event by pressing the “End Event” button shown in Figure 14(j).Step 10.
After the end of the voting event, the verifier starts verifying the collected votes and displays the voting result (Figure14(o)).


## 9. Conclusion

We first construct 1-out-of-n proxy oblivious signature schemes of proxy-unprotected and proxy-protected types and discuss their security requirements. The proposed schemes combine the advantages of a proxy signature and an oblivious signature and satisfy the security properties of both signatures, including completeness, unforgeability, unlinkability, undeniability, verifiability, distinguishability, and ambiguity. Compared with related schemes, our schemes provide extra proxy ability and perform well in terms of both complexity and usability. Finally, an anonymous proxy electronic voting application is implemented on smartphones based on the proposed scheme.



---

*Source: 3075210-2017-12-24.xml*