I came across [1] and I'm very puzzled by this paper.

They use a building block which they call "identity-based dynamic threshold (IBDT) signature", citing paper [2].

First of all [2] does use this IBDT term. But even the algorithms list described in [1] do not match the one in [2]. My major concern is this Comb algorithm in [1] which does not appear at all in [2] and that apparently combines signatures with different identities to create a signature that contains all the identities required by the policy $S$.

Combining signatures to get a more powerful signature seems to be the opposite of the security properties of an Attribute-Based scheme, which is what [2] is about, so I was wondering if they just did not cite the proper reference. However at the same time the rest of the algorithms listed in [1] for IBDT is very similar to the one in [2].

Is there a way they are referring to another scheme ? I found paper [3] that seems to do what [1] describes, namely combining 'partial' signatures, but there does not seem to be a dynamic threshold.


[1] http://web.ua.es/va/recsi2014/documentos/papers/privacy-preserving-group-discounts.pdf "'Privacy-Preserving Group Discounts' by Josep Domingo-Ferrer and Alberto Blanco-Justicia"

[2] J. Herranz, F. Laguillaumie, B. Libert and C. Ràfols, “Short attribute-based signatures for threshold predicates,” Topics in Cryptology–CT-RSA 2012, pp. 51–67, Springer, 2012.

[3] Sherman S.M. Chow and Lucas C.K. Hui and S.M. Yiu, "Identity Based Threshold Ring Signature", https://eprint.iacr.org/2004/179

appendix: other concerns with this paper

The rest of [1] is also very surprising: While the writing style of the abstract suggests an author who is accustomed to writing papers in cryptography, the protocol description is extremely informal and weird (and the protocol seems so weak !) and the "Security analysis" only states that "the scheme is secure by design".

My guess would be that [1] is a bare joke but it has been published in a (very modest, it seems) conference "RECSI XIII", it is in Springer's LNCS and the first author seems to be a senior researcher who according to its personal web page received prizes, awards and so on. Apparently the paper also led to a patent and a smartphone application. Because of all this "impact" (?) I do not dare calling this paper a joke before really trying to understand what this paper really is.

  • 1
    $\begingroup$ It seems that there are two versions of [2]. The one from the CT-RSA conference, and the full version. Have you checked this? $\endgroup$ – cygnusv May 6 '15 at 8:17
  • $\begingroup$ No I did not, thank you. However I quickly just skimmed through it and all the remarks still apply. $\endgroup$ – Cédric Van Rompay May 6 '15 at 8:33
  • $\begingroup$ Just in case...have you also checked Section 5 of the full paper that discusses extensions to the schemes? $\endgroup$ – cygnusv May 6 '15 at 8:41
  • $\begingroup$ 5.1 is about "weighted threshold predicate", I don't think it fits the use in [1]. 5.2 is threshold signature from the second algorithm, so it is a good candidate, but still I don't see combinations of signature. Only a signature need $t$ out of $n$ attribute to verify, it seems. As to "hierarchical threshold predicate" and "Compartmented Access Structures", I don't think they fit also but I'm not sure I have a full comprehension of them yet, I should read the paper more thoroughly $\endgroup$ – Cédric Van Rompay May 6 '15 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.