对一种匿名代理签名方案的安全性分析

最近，谷等人提出了一种具有无需可信第三方的匿名代理签名方案, 即在代理签名中
可以隐藏代理签名者的身份, 并且验证者无法从代理签名中识别代理者身份, 在出现争议
时, 验证者可以通过原始签名者揭示代理签名者的身份. 然而, 根据安全性分析, 可知在谷
等人提出的方案中原始签名者可以伪造所有代理签名人的代理签名密钥, 并在委任书中任
意伪造代理人的身份, 从而原始签名人可以伪造代理签名, 而代理签名人也因此会否认自
己的代理签名. 因此, 谷等人给出匿名代理签名方案并不安全. 最后，指出无需可信第三方
匿名代理签名方案不能实现的内在原因.
关键词：签名，数字签名，代理签名， 匿名性
Abstract. Recently, an anonymous proxy signature scheme without third trusted party was
proposed by Gu et al, where the proxy signer’s identity is anonymous in the proxy signature, and the signature verifier cannot derive the proxy signer’s identity from the proxy signature. In the case of a later dispute, the verifier can reveal the real identity of the proxy signer from the proxy signature. However, according to our security analysis to this scheme, it is found that the original signer can forge all the proxy signers’ proxy secret keys, and the original signer can forge the identities of the proxy signers too. So, the original signer can forge the proxy signatures of any of the proxy signers, and the proxy signers will deny the signatures signed by themselves. Therefore, the anonymous proxy signature scheme proposed by Gu et at. is not secure. At last, the reasons for the failure of such scheme is present.
Keyword. signature, digital signature, proxy signature, anonymity