A Delegation Attack Method on Attribute-Based Signatures and Probable Solutions

Attribute-based signature (ABS) assures the verifier that the message is endorsed by a signer whose attributes satisfy the claimed attribute policy (predicate); thus, it can provide identity authentication with privacy preservation in scenarios like anonymous communication and access control. However, we have found that the inherent delegatibility of attribute-based cryptography, which enables the utilization of relationship between policies, could make most of the existing ABS constructions not satisfy the unforgeability requirement under the common security model. In this paper, we dig into the delegatibility property of ABS for the first time and propose the potential delegation attack to break the unforgeability of the existing ABS constructions under the common security model. We also give two attack instances on a typical ABS construction to demonstrate the feasibility of the proposed delegation attack. Finally, we present two solutions to improve the above issue and give a further discussion about the delegatibility property of ABS.