Improvement of a proxy multi-signature scheme without random oracles

Improvement of a proxy multi-signature scheme without random oracles qYing Sun a,*,Chunxiang Xu a ,Yong Yu a ,Bo Yang ba School of Computer Science and Engineering,University of Electronic Science and Technology of China,Chengdu 610054,China bCollege of Information,South China Agricultural University,Guangzhou 510642,Chinaa r t i c l e i n f o Article history:Available online 10February 2010Keywords:Digital signature Proxy signature Bilinear pairing Security proofa b s t r a c tA proxy multi-signature scheme permits two or more original singers to delegate their signing powers to the same proxy signer.Recently,Liu et al.proposed the first proxy multi-signature that be proven secure in the standard model [Liu et al.(2008)[20]],which can be viewed as a two-level hierarchical signature due to Waters.However,because of the direct employment of Waters’signature,their scheme needs a relatively large number of public parameters and is not tightly reduced to the security assumption.In this paper,inspired by Boneh,Boyen’s technique and Waters’technique,we propose a new proxy multi-sig-nature scheme without random oracles,whose unforgeability can be tightly reduced to the CDH assump-tion in bilinear groups.The new scheme can be regarded as an improvement to overcome the weaknesses of Liu et al.’s pared with Liu et al.’s scheme,the improvement has three merits,tighter secu-rity reduction,shorter system parameters and higher efficiency.Ó2010Elsevier B.V.All rights reserved.1.IntroductionIn the last two decades,the science of cryptography has focused on the construction of provably secure digital signature schemes.A security proof of a digital signature scheme generally proceeds by a reduction showing how an adversary who can break the digital signature scheme in polynomial time can be used to solve some hard mathematical problems,such as discrete logarithm problem,RSA problem,and Computational Diffie–Hellman (CDH)problem.The ‘‘quality”of the reduction is given by the success probability of the adversary to break the underlying intractable problem.A reduction in which the difficulty of forging and the difficulty of solving the underlying hard problem are close is called tight ;otherwise,it is called loose .Naturally,‘‘close”,‘‘tight”and ‘‘loose”are imprecise terms and make more sense when used in comparison.Today,how to construct a digital signature scheme that can be tightly reduced to a weak security assumption is a hot topic in cryptography [1–4].In 1996,Mambo et al.[5]introduced the concept of a proxy sig-nature for signature delegation,which allows an original signer to delegate his signing capability to a proxy signer and then the proxy signer can create valid signatures on behalf of the original signer.Proxy signatures have been shown to be useful in a number of applications,including distributed shared object systems,gridcomputing and mobile agent environment.Moreover,proxy signa-tures have many variations,such as proxy blind signature [6,7],threshold proxy signature [9,8],multi-proxy signature [10–12],proxy ring signature [7,13],designated verifier proxy signature [14]and so on.Among of them,the concept of proxy multi-signa-ture was first introduced by Yi et al.[15].In this kind of primitive,a proxy signer can generate a signature for a message on behalf of two or more original signers.It can be used to solve the problem of signing a document for a corporation.For instance,a company releases a document that may involve the financial department,engineering department and program office,etc.The document must be signed jointly by these entities,or signed by a proxy signer authorized by these entities [15].Followed by Yi et al.’s work,sev-eral proxy multi-signature schemes have been proposed [16–21].To offer strong security guarantee,provable security is very essential for proxy multi-signature schemes.However,the early schemes did not provide formal security proofs,and therefore,most of them do not fully meet the desired security requirement and many schemes were found security flaws [16–19,21].In 2006,Wang and Cao proposed a new proxy multi-signature scheme [21]and pro-vided security proof in the random oracle model proposed by Bellare and Rogaway [22].This model replaces hash functions by truly ran-dom functions.Although the model is efficient and useful,it has re-ceived many criticisms that the proofs in the random oracle model are not perfect.Canetti et al.[23]showed that security in the random oracle model does not imply the security in the real world.Fortu-nately,by employing Waters’signature scheme [24],Liu et al.[20]proposed such a new scheme that can be proven secure without using the random oracle model in 2008.However,there are two drawbacks of this scheme.Firstly,it needs a relatively large number0140-3664/$-see front matter Ó2010Elsevier B.V.All rights reserved.doi:10.1016/com.2010.02.002qThis work was supported by the National 863High-Tech Program of China (No.2009AA01Z415),National Natural Science Foundation of China under Grants 60773175,60803133,60873233,the National Research Foundation for the Doctoral Program of Higher Education of China under Grant No.200806140010and the open fund of Youth Science and Technology Foundation of UESTC.*Corresponding author.E-mail address:yingsun@ (Y.Sun).of public parameters and secondly,its security reduction is loose. Therefore,tofind a new proxy multi-signature scheme secure in the standard model with a tighter security reduction and shorter public parameters is an interesting research problem.1.1.Our contributionIn this paper,we would like to propose a new construction of proxy multi-signature scheme,whose security relies on the hard-ness of the CDH problem in the standard model.In fact,the new scheme can be viewed as an improved version of Liu et al.’s scheme [20].We divide the potential adversaries into three kinds according to their attack power,and in Huang et al.’s security model[27,28], prove that the improved scheme is unforgeable against all kinds of adversaries in the standard pared with Liu et al.’s scheme[20],the new scheme has three advantages.Firstly,it achieves a tighter security reduction than Liu et al.’s scheme.Sec-ondly,the size of public parameters is only about one half of that of Liu et al.’s scheme,andfinally,the new scheme is more efficient in computation.1.2.RoadmapThe remainder of this paper is organized as follows.Some pre-liminary works are given in Section2.The formal models of proxy multi-signature scheme is described in Section3.Our proxy multi-signature scheme and the comparison between our scheme and Liu et al.’s scheme is presented in Section4.We give a formal security proofs in the standard model in Section5.Finally,conclusions are given in Section6.2.PreliminariesIn this section,we will review some fundamental backgrounds used in this paper,including bilinear pairings,complexity assump-tions and Waters signature.2.1.Bilinear pairingsLet G and G T be two cyclic multiplicative groups of prime order p and g be a generator of G.The map e:GÂG!G T is said to be an admissible bilinear pairing if the following conditions hold true[29].(1)e is bilinear,i.e.eðg a;g bÞ¼eðg;gÞab for all a;b2Z p.(2)e is non-degenerate,i.e.eðg;gÞ–1GT.(3)e is efficiently computable.plexity assumptionDefinition1(Computational Diffie–Hellman(CDH)Problem in G).Given g;g a;g b2G for some unknown a;b2Z p,compute g ab2G.The success probability of a polynomial algorithm A in solving the CDH problem in G is denoted asSucc CDHA ¼Pr A g;g a;g bÀÁ¼g ab:a;b2R Z p ÂÃDefinition2(Computational Diffie–Hellman(CDH)Assumption inG).Given g;g a;g b2G for some unknown a;b2Z p;Succ CDHA isnegligible.2.3.Waters signatureIn Eurocrypt2005,Waters[24]presented an efficient identity based encryption scheme secure in the standard model and he also showed how to derive a signature scheme from his encryptionscheme.Let us review Waters signature schemefirstly.Let G be a group of prime order p.e:GÂG!G T is a bilinear pairing and g is the corresponding generator.Setup.A secret a2Z p is chosen at pute g1¼g a and choose g2randomly in G.Additionally,choose a random value u02G and a random vector U¼ðu1;u2;ÁÁÁ;u nÞ,whose elements are chosen at random from G.The public key isg;g1;g2;u0;UðÞand the secret key is g a2.Signing.Let M be an n-bit message to be signed and M i denote the i th bit of M,and M#f1;ÁÁÁ;n g be the set of all i for which M i¼1.A signature is generated as follows.First,a random r2Z p is chosen and then a signature is constructed asr M¼g a2u0Yi2Mu i!r;g r!:Verification.r¼ðr1;r2Þis a valid signature on a message M if eðg;r1Þ¼eðg1;g2Þe r2;u0Yi2Mu i!:Waters[24]showed that his signature scheme is existentially unforgeable,however,the reduction is not tight with long public key size.Moreover,just as Tan[25]claimed,Waters signature is malleable.It means that an adversary is able to produce a different valid signature on the same message without knowing the private key.In Waters signature,given a signature r¼ðr1;r2Þon a mes-sage M,anyone can construct another signature on the same mes-sage as follows.First.choose a random r02ZÃpand computer1¼r1u0Qi2Mu iÀÁr0;r2¼r2g r0.It can be checked that r1;r2ðÞis a valid signature on M.The malleability of Waters signature im-plies that it is not strongly unforgeable[26].Liu et al.’s proxy mul-ti-signature[20]is a2-level hierarchical Waters signature, therefore,it is also malleable and is not strongly unforgeable.3.Definitions and attack modelIn this section,we will give the outline of a proxy multi-signa-ture scheme and its security model.3.1.Outline of proxy multi-signature schemesThere exists three parties in a proxy multi-signature scheme,a set of original signers L¼f U1;U2;ÁÁÁ;U l g,a proxy signer U p desig-nated by all original signers and a verifier.A proxy multi-signature scheme consists of the following algorithms.Setup:Given a security parameter k,this algorithm outputs the system parameters.KeyGen:It takes as input the security parameter k and outputsthe secret–public key pairðsk i;pkiÞfor each party.DelegationGen:Given the system’s parameters,the original sign-er’s private key and a warrant W to be signed,this algorithm outputs the delegation r W.In a warrant-based proxy multi-sig-nature,the delegation is the original signers’standard signature on the warrant which contains the original signers’identities, the proxy signer’s identity,a period of validity,the restrictions on the class of messages for which the warrant is valid and so on.DelegationVerify:This is a deterministic verification algorithm to verify the delegation signing by all the original signers on the warrant W.It takes as input the delegation of the original signer258Y.Sun et al./Computer Communications34(2011)257–263on the warrant W and the public key of the original signer,this algorithm outputs>if the delegation is valid,otherwise returns \if the delegation is invalid.ProxyMulSign:This algorithm takes as input the system parame-ters,the warrant W and all delegations r W,the secret key of the proxy signer and a message M to be signed,and generates a proxy multi-signature r on M.ProxyMulVerify:A deterministic algorithm that inputs a message M,a warrant W,a proxy multi-signature r,the public key of all the original signers and the proxy signer,returns>if the signa-ture is valid,and returns\indicating the signature is invalid.3.2.Security notionsIn2001,Lee et al.[30]defined some properties that a proxy sig-nature should provide,but their precise meaning is unclear.Wang and Cao[21]as well as Cao and Cao[16]presented the formal security model for proxy multi-signature schemes in2006,which are adapted versions of the model of proxy signature due to Bold-yreva et al.[31]in2003.However,their model is complicated and just as Schuldt et al.pointed out[32],warrants are not explicitly modeled in Boldyreva et al.’s model and their scheme suffers from proxy key exposure attack.In[28],Huang et al.proposed a new model of proxy signature,which is a better one since the classifica-tion of adversaries makes the security model clearer.We will use this model to prove the security of our scheme.There are three types adversaries in the system.Type1This type adversary A1only has the public key of the ori-ginal signers and the proxy signer.Type2This type adversary A2has the public key of the original signers and the proxy signer,he additionally has thesecret key of the proxy signer and lÀ1original signers.In the following,without loss of generality,we assumethat A2has the private key of all the original signersexcept the original signer U1.Type3This type adversary A3has the public key of all the origi-nal signers and the proxy signer,he additionally has thesecret key of all the original signers.We canfind that if a proxy multi-signature scheme is unforge-able against Type2and Type3adversary,it is also unforgeable against Type1adversary.3.3.Attack model3.3.1.Existential unforgeability against adaptive A2adversaryFollowing the work of[27],we provide a formal definition of existential unforgeability of a proxy multi-signature scheme against Type2adversary.The existential unforgeability of a proxy multi-signature scheme against Type2adversary requires that even the adversary A2obtains the keys of proxy signer and lÀ1 original signers except the only one original signer,to generalize, named U1,it is difficult for the adversary A2to forge a valid signa-ture on message M under a warrant W without getting the delega-tion of the warrant W.It is defined using the following game between an adversary A2and a challenger C.Setup:The challenger C runs the Setup algorithm to obtain sys-tem’s parameters,runs KeyGen algorithm to obtain the secret–public key pairsðsk i;pkiÞð16i6lÞ;ðsk p;pk pÞof all the original signers and the proxy signer,respectively.C then sends ðsk p;pk pÞ;ðpk1;ÁÁÁ;pk lÞandðsk2;ÁÁÁ;sk lÞto A2.Delegation queries:Proceeding adaptively,A2can request the delegation on a warrant W.The challenger C runs the Delegation-Gen algorithm to obtain r W and returns it to A2. ProxyMulSign queries:Proceeding adaptively,A2can request a proxy multi-signature on a message M under a warrant W.Inresponse,C runs DelegationGen algorithm to generate delega-tions of all the original signers on the warrant W.Then C runs the ProxyMulSign algorithm to obtain a proxy multi-signature r and returns it to the adversary A2.Output:Finally,A2outputs a proxy multi-signature rÃon the message MÃunder the warrant WÃsuch that(1)WÃhas not been requested as one of the Delegationqueries.(2)ðM;WÃÞhas not been requested as one of the ProxyMulSignqueries.(3)rÃis a valid proxy multi-signature on the message MÃunder the warrant WÃ.The success probability of an adversary A2wins the above game is defined as Succ A2.We say that a Type2adversary A2canðt;qw;qp; Þbreak a proxy multi-signature scheme if A2makesat most qwdelegation queries,qpProxyMulSign queries in time at most t and Succ A2is at least .3.3.2.Existential unforgeability against adaptive A3adversaryThe existential unforgeability of a proxy multi-signature scheme under a Type3adversary requires that it is difficult for the original signers to collaborate to generate a valid proxy mul-ti-signature on a message MÃthat has not been signed by the proxy signer.It is defined using the following game between the chal-lenger C and a Type3adversary A3.Setup:The challenger C runs the Setup algorithm to obtain sys-tem’s parameters,runs KeyGen algorithm to obtain the secret–public key pairsðsk i;pkiÞð16i6lÞ;ðsk p;pk pÞof all the original signers and the proxy signer,respectively.C then sends ðpk p;pk1;ÁÁÁ;pk l;sk1;ÁÁÁ;sk lÞto A3.ProxyMulSign queries:Proceeding adaptively,A3can request a proxy multi-signature on a message M under a warrant W.In response,C runs DelegationGen algorithm to generate delega-tions of all the original signers on the warrant W.Then C runs the ProxyMulSign algorithm to obtain a proxy multi-signature r and returns it to the adversary A3.Output:Finally,A3outputs a proxy multi-signature rÃwith the warrant WÃand the message MÃsuch that(1)ðM;WÃÞhas not been requested as one of the ProxyMulSignqueries.(2)rÃis a valid proxy multi-signature on the message MÃunder the warrant WÃ.The success probability of an adversary A3wins the above game is defined as Succ A3.We say that a Type3adversary A3canðt;qp; Þbreak a proxy multi-signature scheme if A3makes at most qpProxy-MulSign queries in time at most t and Succ A3is at least .4.Our schemeIn this section,we willfirstly describe our proxy multi-signa-ture scheme derived from Waters’scheme[24]and the BB04scheme[33],and then,we will give a comparison between ourscheme and Liu et al.’s scheme[20].4.1.Our proxy multi-signature schemeAs assumed earlier,there are three participants in the system,namely l original signers U1;ÁÁÁ;U l,a proxy signer U p and a verifier.Our scheme consists of the following algorithms.Y.Sun et al./Computer Communications34(2011)257–263259Setup:The system parameters are as follows.Let ðG ;G T Þbe bilinear groups where j G j ¼j G T j ¼p for some prime p ;g is a generator of G .e denotes an admissible pairing G ÂG !G T .Pick u 0;m 0;m 1;v 2G and vector ~u ¼ðu i Þof length n ,whose entries are random elements from G and a collision resistant hash function H :f 0;1g ÃÂG ÂG !Z p .The public parameters are G ;G T ;H ;p ;g ;e ;m 0;m 1;u 0;v ;~u ðÞ.KeyGen:Each original signer U i ð16i 6l Þpicks a random pair sk i ¼ðx i ;y i Þ2Z Ãp as his private key and computes the corre-sponding public key pk i ¼pk ix ;pk iy ÀÁ¼g x i ;g y i ðÞ.Similarly,theproxy signer U p picks randomly his private key ðx p ;y p Þ2Z Ãp,and then he computes his public key pk p ¼pk px ;pk py ÀÁ¼g x p ;g y p ðÞ.DelegationGen:Let W be an n -bit warrant to be signed by each original signer and w i denotes the i th bit of W .To con-struct a more flexible scheme which allows warrants of arbi-trary length,a collision resistant hash function H 0:f 0;1g Ã!f 0;1g n can be employed.The identities of the original signers and the proxy signer,the class of messages delegated,the per-iod of validity,and other delegation information are concluded in the warrant.Each original signer U i ð16i 6l Þpicks a ran-dom r i 2Z p and computes his delegation r W i ¼r W i 1;r W i 2ÀÁand sends it to the proxy signer U p ,where r W i 1¼g x i y i u 0Q n i ¼1u w i iÀÁr i;r W i 2¼g r i .DelegationVerify:After receiving all delegations,the proxy signer U p firstly checks the validity of all delegations on the war-rant W .For 16i 6l ;U p accepts r W i if the following equation holds:e ðr W i 1;g Þ¼e ðpk ix ;pk iy Þe u 0Y n i ¼1u wi i ;r W i 2!Otherwise,the proxy signer rejects it and requests from U i a new delegation.ProxyMulSign:If the proxy signer U p confirms the validity of all ðW ;r W i Þ,he computes the proxy key as follows.(1)U p picks a random r p 2Z p and computes k p ¼g r p .(2)U p computers r W ¼ðr w 1;r w 2Þ,wherer W 1¼Y l i ¼1r W i 1;r W 2¼Y l i ¼1r W i 2:(3)U p computes h ¼H M k W ;r W 2;k p ÀÁ.(4)After checking the value c 2f 0;1g of the rightmost bit of xcoordinate of r W 2and determining m c denoting m 0or m 1according to c ¼0or c ¼1;U p outputs the proxy multi-sig-nature r ¼ðr 1;r 2;r 3Þwherer 1¼r W 1g x p y p ðm c v h Þr p ;r 2¼r W 2;r 3¼k pProxyMulVerify:To check whether r ¼ðr 1;r 2;r 3Þis a valid proxy multi-signature on the message M under the warrant W ¼ðw 1;ÁÁÁ;w n Þ,a verifier examines the rightmost bit of x coordinate of r 22G is 0or 1to determine the valuec 2f 0;1g ,computes h ¼H M k W ;r W 2;r W 3ÀÁ,and accepts the proxy multi-signature if and only if the following equation holds:e ðr 1;g Þ¼Y l i ¼1e ðpk ix ;pk iy Þe u 0Y n i ¼1u wi i ;r 2!e pk px ;pk py ÀÁe m c v h ;r 3ÀÁ 4.2.CorrectnessBy bilinearity of the pairing e ,the correctness of the scheme is easy to verify.If the rightmost bit value c of the x coordinate of r 2was determined and h ¼H M k W ;r 2;r 3ðÞwas generated.e r 1;g ðÞ¼e g x p y pY l i ¼1g x i y i u 0Y n i ¼1u wii !r im c v h ÀÁr p;g!¼Y l i ¼1e g x i ;g y i ðÞe u 0Y n i ¼1u wi i ;g Pl i ¼1r i 0B@1C A e g x p ;g y p ðÞe m c v h ;g r pÀÁ¼Y l i ¼1e pk ix ;pk iy ÀÁe u 0Y n i ¼1u wi i ;g Pl i ¼1r i 0B @1C A e pk px ;pk py ÀÁe m c v h ;g r p ÀÁ¼Y l i ¼1e pk ix ;pk iy ÀÁe u 0Y n i ¼1u w i i ;r 2 !e pk px ;pk py ÀÁe m c v h ;r 3ÀÁparisonWe compare the security and efficiency of our scheme to thoseof Liu et al.’s scheme in [20].We denote Mul,Exp and ^e ,the mul-tiplication in G ,the exponentiation in G and the pairing computa-tion,respectively.We summarize the comparison of the two schemes in Table 1.Both our scheme and Liu et al.’s scheme [20]share the same compu-tation in KeyGen,DelegationGen and DelegationVerify phase,so we omit these comparisons.The Size column is the proxy multi-signa-ture size of group elements in G .The Params column gives the num-ber of group elements in G to be included in public parameters.SM specifies whether the security proof is in the standard model and TN shows the tightness of the reduction,i.e.the success probability of the adversary to break the underlying intractable problem,CDH problem.l denotes the number of original signers.n ,which can usu-ally be the output length of a secure hash function,denotes the length of the warrant W as a bit string.2n þ2group elements are re-quired as public parameters in Liu et al.’s [20]scheme while only n þ4group elements are needed in our scheme.From this point of view,the property of smaller size public parameters makes our scheme more suitable for low storage requirement of applications.Although the two schemes have the same signature size,our scheme has higher efficiency since the computational cost are reduced by 1Exp +(n +3)Mul in ProxyMultiSign algorithm and about 1^e þn =2Mul À1Exp in ProxyMultiVerify phase.Moreover,our scheme has a tighter security reduction than the scheme in [20].5.Security proofIn this section,we will prove that the new scheme is unforge-able against Type 2and Type 3adversaries in the standard model.Finally,we show that our scheme satisfies all the requirements of a strong and proxy-protected proxy signature [30].5.1.Unforgeability against Type 2adversaryTheorem 1.If there exists a Type 2adversary A 2who can ðt ;q w ;q ps ; Þbreaks our proxy multi-signature scheme,then there exists another algorithm B who can use A 2to solve an instance of the CDH problem in G with probabilitySucc CDH BP e16ðn þ1Þq w260Y.Sun et al./Computer Communications 34(2011)257–263in time t 06t þð4q w þ8q ps þ2n þ2l þ9Þt Exp þn 2þ2ÀÁq w þn 2þ4ÀÁq ps þÀn þ6Þt Mul where t Exp and t Mul denotes the time for an exponentiation and a multiplication in G ,respectively.Proof.Assume that B receives a random CDH problem instance g ;g a ;g b ðÞ2G ,his goal is to compute out g a b .B will run A 2as a subroutine and act as A 2’s challenger.B will response A 2’s queries in the following way.Note that this type of adversary A 2has the public key of all the original signers and the proxy singer,he also has the secret key of the proxy signer and all the original signers except the original signer U 1.Setup:B sets integers ‘¼4q w and chooses k uniformly at random between 0and n .Then it chooses a value x 0and a random n -vector,~x ¼ðx i Þwhere x 0;x i 2R Z ‘.Additionally,B chooses a value y 0and a random n -vector ~y ¼ðy i Þwhere y 0;y i 2R Z p ,anda ;b ;c ;d 2Z Ãp .These values are kept internal to B .Let W ¼ðw 1;w 2;ÁÁÁ;w n Þ,be a warrant,and p )ðn þ1Þ‘for any p ;n ;‘.Finally,B chooses a collision resistant hash function H :f 0;1g ÃÂG ÂG !Z p .For ease of analysis,we define three functions F ðW Þ;J ðW Þ;K ðW Þjust as in [24,28].(1)F ðW Þ¼ðp À‘k Þþx 0þPn i ¼1w i x i ,(2)J ðW Þ¼y 0þP ni ¼1w i y i ,(3)K ðW Þ¼0;if x 0þP n i ¼1w i x i 0ðmod ‘Þ;1;otherwise :&Then B sets the public keys of the participants and common parameters as follows.(1)B assigns the public key of the original signer U 1aspk 1x ¼g a ;pk 1y ¼g b ;where g a ;g bare the input of the CDH problem.(2)B chooses randomly l À1pairs ðx i ;y i Þ2Z Ãp and for 26i 6l ,sets the i th original signer’s private key and public key assk ix ¼x i ;sk iy ¼y i ;pk ix ¼g x i;pk iy ¼g y i:(3)B chooses randomly a pair ðx p ;y p Þ2Z Ãp and sets the proxysigner’s private key and public key assk px ¼x p ;sk py ¼y p ;pk px ¼g x p ;pk py ¼g y p :(4)B assigns u 0¼pk p Àk ‘þx 01y g y 0;u i ¼pk xi 1y g y i ;~u ¼ðu 1;u 2;ÁÁÁ;u n Þ.(5)B sets m 0¼g a ;m 1¼pk d 1y g b ;v ¼g c.Note that,at this time,u 0Y n i ¼1u w i i ¼pk F ðW Þ1y g J ðW Þ:B returns ðG ;G T ;e ;p ;g ;u 0;~u ;v ;m 0;m 1;H Þ,ðpk px ;pk py ;ÁÁÁ;pk lx ;pk ly Þand ðsk px ;sk py ;sk 2x ;sk 2y ;ÁÁÁ;sk lx ;sk ly Þto A 2.Delegation queries:Suppose A 2issues a delegation query for an n -bit warrant W on the original signer U 1.(1)If K ðW Þ¼0;B terminates the simulation and reports failure.(2)If K ðW Þ–0,which implies F ðW Þ–0ðmod p Þ[24],B can con-struct a delegation of this warrant by choosing a random r 12Z p and computing:r W 1¼ðr W 11;r W 12Þ¼pk ÀJ ðW ÞF ðW Þ1xu 0Y n i ¼1u wii !r 1;pk À1F ðW Þ1x g r 1!:Correctnessr W 11¼pk ÀJ ðW ÞF ðW Þ1xu 0Y n i ¼1u w ii!r 1¼pk ÀJ ðW ÞF ðW Þ1xpk F ðW Þ1y g J ðW Þr 1¼pk a 1y pk F ðW Þ1y g J ðW Þ Àa F ðW Þpk F ðW Þ1y g J ðW Þr 1¼pk a 1y pk F ðW Þ1y g J ðW Þ r 1Àa F ðW Þ¼pk a 1y pk F ðW Þ1y g J ðW Þ^r 1¼pk a1y u 0Y i ¼1u w i i !^r 1¼g a b u 0Y i ¼1u w ii !^r1r W 12¼pk À1F ðW Þ1x g r 1¼g ÀaF ðW Þg r 1¼g r 1ÀaF ðW Þ¼g ^r 1:Since the adversary A 2has the secret key of other original signers U i ð26i 6l Þ,he dose not need to request r W i since he can generate a delegation on any warrant using the secret key.ProxyMulSign queries:Suppose A 2issues a proxy multi-signature query for a message M under a warrant W ¼ðw 1;w 2;ÁÁÁ;w n Þ,B randomly chooses l values r 1;ÁÁÁ;r l 2Z p ,and computes g P li ¼1r i 2G .(1)If the rightmost bit of the x -coordinate of g P li ¼1r i is 1,Bchooses a random s 2Z p ,and computesh ¼H M k W ;g P li ¼1r i ;pk À1d 1x g s .Since A 2knows the secretekey of the proxy signer,he can calculate the proxy multi-sig-nature r ¼ðr 1;r 2;r 3Þwherer 1¼pk Àðb þch Þ1xg Pl i ¼2sk ix sk iyu 0Y n i ¼1u w ii!P li ¼1r igsk px sk pym 1vh ÀÁs;r 2¼g Pl i ¼1r i;r 3¼pk À1d1x g s ;Finally,B sends r ¼ðr 1;r 2;r 3Þto A 2.Correctnessr 1¼pk Àðb þch Þd1xÁðu 0Q n i ¼1u w i i ÞP l i ¼1r i Ág P l i ¼2sk ix sk iy Ág sk px sk py Áðm 1v h Þs¼pk a1y Áðpk Àa 1yÁpk Àðb þch Þ1xÞÁðu0Q n i ¼1u wi i ÞPl i ¼1r iÁg Pl i ¼2x i y iÁg x p y p Áðm 1v h Þs¼pk a1y Áðpk d1y Ág ðb þch ÞÞÀa dÁðu0Q n i ¼1u wi i ÞPl i ¼1r iÁg Pl i ¼2x i y iÁg x p y p Áðm 1v h Þs¼pk a1y Áðpk d1y Ág b Áðg c Þh ÞÀa dÁðu 0Q n i ¼1u wi i ÞPl i ¼1r iÁg Pl i ¼2x i y iÁg x p y p Áðm 1v h Þs¼pk a1y Áðm 1v h ÞÀaÁðu 0Q n i ¼1u wi i ÞPl i ¼1r iÁg Pl i ¼2x i y iÁg x p y p Áðm 1v h Þs¼pk a1y Áðu 0Q n i ¼1u wi i ÞPl i ¼1r iÁg Pl i ¼2x i y iÁg x p y p Áðm 1v h Þs Àa¼gx p y pÁQ l i ¼1g x i y i ðu 0Q n i ¼1u wi i Þri Áðm 1v h Þ^s;Table 1Efficiency comparisons of the two schemes.SchemeSize ProxyMulSignProxyMulVerify Params SM TNLiu et al.’s scheme 3j G j 5Exp þðn þ2l þ6ÞMul ðl þ4Þ^e þðn þ2ÞMulð2n þ2Þj G j Yes16q p ðq w þq p Þðn þ1Þ2Our scheme3j G j4Exp þð2l þ3ÞMulðl þ3Þ^e þ1Exp þðn =2þ2ÞMulðn þ4Þj G jYes16ðn þ1Þq wY.Sun et al./Computer Communications 34(2011)257–263261。