Resumen
A transitive signature scheme enables anyone to obtain the signature on edge (??,??)
(
i
,
k
)
by combining the signatures on edges (??,??)
(
i
,
j
)
and (??,??)
(
j
,
k
)
, but it suffers from signature theft and signature abuse. The existing work has solved these problems using a universal designated verifier transitive signature (UDVTS). However, the UDVTS scheme only enables the designated verifier to authenticate signatures, which provides a simple way for the signer to deny having signed some messages. The fact that the UDVTS is not publicly verifiable prevents the verifier from seeking help arbitrating the source of signatures. Based on this problem, this paper proposes a traceable universal designated verifier transitive signature (TUDVTS) and its security model. We introduce a tracer into the system who will trace the signature back to its true source after the verifier has submitted an application for arbitration. To show the feasibility of our primitive, we construct a concrete scheme from a bilinear group pair (??,????)
(
G
,
G
T
)
of prime order and prove that the scheme satisfies unforgeability, privacy, and traceability.