On the Security of Two Threshold Signature Schemes with Traceable Signers

A (t, n) threshold signature scheme allows t or more group members to generate signatures on behalf of a group with n members, while any t−1 or less members cannot do the same thing. In 2001, based on a variant of ElGamal digital signature scheme, Li et al. proposed two (t, n) threshold signature schemes with traceable signers. One of their schemes needs the assistance of a mutually trusted center, while the other does not. In this paper, we present a security analysis on their schemes. We first point out that in fact signers in their schemes are untraceable, since anybody can convert a valid threshold signature into a new one such that another subset of group members will be wrongly considered as the signers of the new threshold signature for the same message. Furthermore, we demonstrate an attack to show that their second threshold signature scheme is insecure. In our attack, (n − t + 1) colluding members can control the group secret key. Therefore, they can generate valid threshold signature for any message without the help of other members. Furthermore, honest members cannot detect this security flaw in the system, since any t members can generate threshold signatures according to the prescribed protocols.