通过对一类已有的高效无证书强代理签名方案进行分析,给出了该方案所存在的一种替换公钥攻击,指出了该方案存在的安全问题,表明了攻击者可以通过替换原始签名者的公钥伪造代理授权,进而伪造代理签名.针对该攻击提出了一种改进方案,使其克服了原方案所存在的问题,具有更高的安全性.
A proposal of efficient certificateless signature scheme is presented to insecure against public key replacement attack. It is shown that an adversary who replaces the public key of the original signer can forge valid proxy delegations for the corresponding proxy signer without knowledge of the signer's pri- vate key, and can even forge valid proxy signatures. To thwart this attack, an improved scheme is further proposed, which is not only more securer but also avoids the problems of the original scheme.