对一种高效无证书强代理签名方案进行了分析,指出该方案对于公钥替换攻击是不安全的.证明了敌手不仅可以通过替换原始签名者的公钥伪造代理授权,而且可以通过同时替换原始签名者和代理签名者的公钥伪造任意消息的代理签名.针对这2种公钥替换攻击提出了改进方案,使得改进后的方案克服了原方案的安全缺陷,满足了无证书强代理签名方案的安全性要求.
It is analyzed that efficient certificateless strong proxy signature scheme is proven insecure against the public key replacement attack. The adversary can not only forge valid proxy delegation by substituting the public keys of the original signer, but it can also forge the proxy signatures of the proxy signer by substituting the public keys of the original signer and the proxy signer. An improved scheme is presented to resist against these attacks.