两种签密方案的安全分析

通过对一种基于身份的签密方案和一种多接收者的签密方案进行分析，展示出这2种方案是不安全的，尽管这2种方案在文献中被证明在随机预言模型下是安全的，但是它们存在着伪造攻击，在基于身份的签密方案中，一个不诚实的接收者可以伪造任意消息m的签密文，并且一个敌手在挑战阶段可以区分一个挑战密文；在多接收者签密方案中，任意一个接收者能够代表其他接收者伪造一个消息m的签密文，为了克服这2种方案的缺陷，分别通过对s进行约束和改变原方案的哈希值的输入来阻止上面的攻击。

Security analysis of two signcryption schemes

The security of an ID-based signcryption scheme and a multi-recipient signcryption scheme are analyzed. It is shown that these two signcryption schemes are insecure although they were proven to be secure under the random oracle model in existing references. In the ID-based signcryption scheme, any dishonest receiver can forge a signcryption on arbitrary message m, and the adversary can distinguish the challenged ciphertext in the challenge phase. In the multi-recipient signcryption scheme, any receiver can forge a signcryption of message m on behalf of the other receivers. To overcome the flaws of these two schemes, it is suggested to restrict S of signcryption in the first scheme and modify the inputs of hash function in the second scheme to resist the above attacks.