Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Security Analysis of Two RSA-Based Fair Document Exchange Protocols

Zuhua Shao

Published Jan 1, 2009• 0 citations
Publisher

Abstract

In 2005, A. Nenadic N. Zhang and Q. Shi proposed a new cryptographic primitive, called Verifiable and Recoverable Encryption of Signature VRES. Based on RSA-based VRES, they presented two variant protocols RSA-CEMD1 and RSA-CEMD2 for certified e-mail delivery with RSA receipts. They claimed that the protocols provided strong fairness to ensure that the recipient receives the e-mail if and only if the sender receives the receipt. Later, N. Zhang, Q. Shi, M. Merabti, and R. Askwith presented a practical and efficient fair document exchange protocol based on a verifiable and recoverable encryption of keys that is somewhat similar to the VRES. In this paper, we find that the VRES scheme is universal forgeable. Anyone can generate the false VRES for any message without the knowledge of any private key of the sender, the recipient and the TTP. It follows that the two variant protocols RSA-CEMD1, RSA-CEMD2 are all insecure. Meanwhile, we show that the document exchange protocol is not fair since the verifiable and recoverable encryption of keys is not recoverable.

DOI
10.1109/wcse.2009.621

Related papers

Certified E-Mail Delivery with DSA Receipts

Aleksandra Nenadić, Ning Zhang, Qi Shi +1 more

In this paper we present two variant protocols DSA-CEMD1 and DSA-CEMD2 for certified e-mail delivery with DSA receipts. The protocols are based on a cryptographic primitive called Verifiable and Recoverable Encryption of a Signature (VRES) and are capable of achieving non-repudiation and strong fairness security properties. The novel design of the VRES primitive allows efficiency improvements in comparison with the related certified e-mail delivery protocols based on similar primitives. The protocols employ the services of an off-line and invisible trusted third party (TTP) only in case of dispute. In DSA-CEMD1 the content of the e-mail message is not revealed to the TTP during possible recovery and this is achieved at the cost of some additional cryptographic operations. In DSA-CEMD2 the confidentiality of the message is not protected from the TTP, but the protocol is slightly more efficient.

IEEE International Parallel and Distributed Processing Symposium (IPDPS)•Apr 19, 2005•4 citations

Unfairness of a protocol for certified delivery.

Juan Tapiador, Almudena Alcaide

Recently, Nenadić et al. (2004) proposed the RSA-CEGD protocol for certified delivery of e-goods. This is a relatively complex scheme based on verifiable and recoverable encrypted signatures (VRES) to guarantee properties such as strong fairness and non-repudiation, among others. In this paper, we demonstrate how this protocol cannot achieve fairness by presenting a severe attack and also pointing out some other weaknesses. Keywords: Cryptographic protocols; Fair exchange; Non-repudiation; 1

•Jan 1, 2005•0 citations

New Optimistic Fair Exchange Protocol Based on VE-RSA Signature

Lize Gu, Yanbin Sun

Recently, Zhou et al. proposed a verifiably encrypted RSA (VE-RSA) signature scheme, which was used to convince that an encrypted message is a certain party's signature on a message while without revealing the signature. In this paper, we propose a new optimistic fair exchange protocol based on the verifiably encrypted RSA signature scheme. In our scheme, both parties can contact the TTP and settle the argument before the deadline. Moreover, our new scheme achieves fairness and timeliness.

International Workshop on Education Technology and Computer Science•Jan 1, 2010•1 citation

Signature-based approach to fair document exchange

Qi Shi, N. Zhang, M. Merabti

The authors aim to present a protocol for fair document exchange between two parties, that incorporates a signature scheme based method for the recovery of a document decryption key. The principal idea for such key recovery is based on a verifiable and recoverable encryption of a key. This means that any party can verify the correctness of the key encrypted without actually viewing the key, and the party can be assured that a designated party can decrypt the encrypted key to recover the original key. A DSA (digital signature algorithm) is applied as an example to demonstrate how to implement such key encryption based on an off-line semi-trusted third party. The third party is off-line as they do not participate in an exchange in normal situations, and semi-trusted in the sense that they may misbehave but do not conspire with any party involved in the exchange. The main contribution of the paper is that it presents a fair document exchange protocol which is more efficient, simpler and easier to implement in comparison with related work.

IEE Proceedings - Communications•Jan 1, 2003•12 citations

A Fair Exchange Protocol Based on RSA Signature Scheme

Yong Zheng Zhou

Fairness is the basic requirement of E-Commerce protocols. RSA is one of the most widely used cryptosystems. A fair-exchange protocol allows two parties to exchange items in a fair way so that either each party gets the other's item, or neither party does. In this paper construction and architecture of the existing fair exchange protocols are analyzed. Both practicality and efficiency problems of these protocols are also presented. Based on this analysis, an optimistic fair exchange protocol totally based on RSA signature scheme is proposed. The novel scheme employs verifiably encrypted RSA signatures in the extended integer ring that is elaborately constructed. The security and efficiency of the newly devised scheme are also proved and examined. It is showed that the proposed scheme is secure and efficient.

•Jan 1, 2004•2 citations

Fair Certified Email Protocol

Abdullah Mohammed Alaraj

In this paper, a new fair certified email protocol is proposed. The proposed protocol uses offline trusted third party (TTP) that will only be involved if a party misbehaves, otherwise the TTP is inactive. The protocol is based on the verifiable and recoverable encryption of keys. In this regard, the recipient of an email will be able to verify if the encrypted key used to encrypt the email is correct. The protocol comprises of only three messages in the exchange sub-protocol and three messages in the recovery sub-protocol. The proposed protocol is more efficient compared with related protocols.

INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY•Jul 25, 2013•3 citations
In 2005, A. Nenadic N. Zhang and Q. Shi proposed a new cryptographic primitive, called Verifiable and Recoverable Encryption of Signature VRES. Based on RSA-based VRES, they presented two variant protocols RSA-CEMD1 and RSA-CEMD2 for certified e-mail delivery with RSA receipts. They claimed that the protocols provided strong fairness to ensure that the recipient receives the e-mail if and only if the sender receives the receipt. Later, N. Zhang, Q. Shi, M. Merabti, and R. Askwith presented a practical and efficient fair document exchange protocol based on a verifiable and recoverable encryption of keys that is somewhat similar to the VRES. In this paper, we find that the VRES scheme is universal forgeable. Anyone can generate the false VRES for any message without the knowledge of any private key of the sender, the recipient and the TTP. It follows that the two variant protocols RSA-CEMD1, RSA-CEMD2 are all insecure. Meanwhile, we show that the document exchange protocol is not fair since the verifiable and recoverable encryption of keys is not recoverable.
In this paper we present two variant protocols DSA-CEMD1 and DSA-CEMD2 for certified e-mail delivery with DSA receipts. The protocols are based on a cryptographic primitive called Verifiable and Recoverable Encryption of a Signature (VRES) and are capable of achieving non-repudiation and strong fairness security properties. The novel design of the VRES primitive allows efficiency improvements in comparison with the related certified e-mail delivery protocols based on similar primitives. The protocols employ the services of an off-line and invisible trusted third party (TTP) only in case of dispute. In DSA-CEMD1 the content of the e-mail message is not revealed to the TTP during possible recovery and this is achieved at the cost of some additional cryptographic operations. In DSA-CEMD2 the confidentiality of the message is not protected from the TTP, but the protocol is slightly more efficient.
The authors aim to present a protocol for fair document exchange between two parties, that incorporates a signature scheme based method for the recovery of a document decryption key. The principal idea for such key recovery is based on a verifiable and recoverable encryption of a key. This means that any party can verify the correctness of the key encrypted without actually viewing the key, and the party can be assured that a designated party can decrypt the encrypted key to recover the original key. A DSA (digital signature algorithm) is applied as an example to demonstrate how to implement such key encryption based on an off-line semi-trusted third party. The third party is off-line as they do not participate in an exchange in normal situations, and semi-trusted in the sense that they may misbehave but do not conspire with any party involved in the exchange. The main contribution of the paper is that it presents a fair document exchange protocol which is more efficient, simpler and easier to implement in comparison with related work.
Fairness is the basic requirement of E-Commerce protocols. RSA is one of the most widely used cryptosystems. A fair-exchange protocol allows two parties to exchange items in a fair way so that either each party gets the other's item, or neither party does. In this paper construction and architecture of the existing fair exchange protocols are analyzed. Both practicality and efficiency problems of these protocols are also presented. Based on this analysis, an optimistic fair exchange protocol totally based on RSA signature scheme is proposed. The novel scheme employs verifiably encrypted RSA signatures in the extended integer ring that is elaborately constructed. The security and efficiency of the newly devised scheme are also proved and examined. It is showed that the proposed scheme is secure and efficient.
In this paper, a new fair certified email protocol is proposed. The proposed protocol uses offline trusted third party (TTP) that will only be involved if a party misbehaves, otherwise the TTP is inactive. The protocol is based on the verifiable and recoverable encryption of keys. In this regard, the recipient of an email will be able to verify if the encrypted key used to encrypt the email is correct. The protocol comprises of only three messages in the exchange sub-protocol and three messages in the recovery sub-protocol. The proposed protocol is more efficient compared with related protocols.