an attack on the proactive rsa signature scheme in the ursa ad.pdfVIP

An Attack on the Proactive RSA Signature Scheme in the URSA Ad Hoc Network Access Control Protocol Stanisław Jarecki, Nitesh Saxena, and Jeong Hyun Yi School of Information and Computer Science UC Irvine, CA 92697, USA {stasio, nitesh, jhyi}@ ABSTRACT 1. INTRODUCTION: BACKGROUND AND Recently, Luo, et al. in a series of papers [17, 14, 13, 18, 15] MOTIVATION proposed a set of protocols for providing ubiquitous and ro- bust access control [URSA] in mobile ad hoc networks with- Threshold and Proactive Signature Schemes. A (t, n) out relying on a centralized authority. The URSA protocol threshold signature scheme [6] enables any subgroup of t + 1 relies on the new proactive RSA signature scheme, which members in a group consisting of n t members, to col- allows members in an ad hoc group to make access control laboratively sign a message on behalf of that group. This is decisions in a distributed manner. The proposed proactive achieved by secret-sharing the signature key, e.g. the RSA RSA signature scheme is assumed secure as long as no more secret key, among the group members, and allowing them than an allowed threshold of participating members is si- to compute a signature on some message via a distributed multaneously corrupted at any point in the lifetime of the protocol in which the members use the shares of the sig- scheme. nature key instead of the key itself. The scheme is said