1. Certificateless signature revisited X. Huang, Yi Mu, W. Susilo, D.S. Wong, W. Wu ACISP’07 Presenter: Yu-Chi Chen

2. Outline. Introduction Huang et al.’s scheme Conclusion 2

3. Introduction. Traditional PKC ID-based PKC: 1984 Certificateless PKC: 2003 3

4. ID-PKC Private Key Generation master-key = s mpk=sP Require priv-key Return priv-key= sH(ID 1 ) User (signer) ID 1 Sign: σ=sH(ID 1 )+H(M,…) Secure channel User (verifier) Use ID 1 and PKG’s mpk=sP to check e(σ,P) =? e(mpk, H(ID 1 ))e(H(M,…),P) 4

5. CL-PKC Key Generation Center master-key = s mpk=sP Require part-priv-key Return part-priv-key= sH(ID 1 ) User (signer) ID 1 Sign: σ=sH(ID 1 )+rH(M,…) Secure channel User (verifier) Use ID 1 and PKG’s mpk=sP to check e(σ,P) =? e(mpk, H(ID 1 ))e(H(M,…),pk) Decide his secret value r And public key pk=rP bulletin board IDpk 5

6. Outline. Introduction Huang et al.’s scheme Conclusion 6

7. Huang et al.’s scheme In this paper, Huang et al. proposed a short certificateless signature scheme – Short: 160 bit (elliptic curve) – Conventional security model 7

8. Conventional security model Game I (An adversary can replace any user’s public key, but it cannot access master-key) – Setup. – Attack: public-key queries, partial-private-key queries, sign queries, public-key-replacement. – Forgery. A wins the game iff it can forge a valid signature which has never been queried.

9. Short CLS Setup. (omitted.) Secret-Value: The user sets a value Partial-private-key: KGC sets the partial- private-key to the user

10. Short CLS Public-key: the user sets his public key Private-key: the user sets his private key Sign: Ver:

11. Outline. Introduction Huang et al.’s scheme Conclusion 11

12. Conclusion Hu et al.’s CLS scheme is short, but Du and Wen’s scheme is more efficient. Shim in 2009 present a cryptanalysis for short CLS schemes. (next page.) 12