Cryptanalysis of Threshold Proxy Signature Scheme Based on Factoring

All of the existing threshold signature schemes cannot withstand conspiracy attacks. Its reason is that the secret of any subgroup shares is the group secret key, and any t or more group members can cooperate to reveal the group secret key with high probability. Therefore, any subgroup can forge the valid signature stand in other subgroups; the design of an efficient scheme is remained open. Lu et al. tried to propose the first robust (k, n)+1 threshold proxy signature scheme based on factoring. However, we find that Lu et al.psilas scheme is not secure against known-plaintext attack and coalition attack. Some k or more malicious proxy signers can conspire together against the original signer. Moreover, the trusted dealer can alone compute valid signatures for new messages on behalf of the original signer afterwards without the cooperation of other proxy signers. Therefore, their scheme is insecure.