1 Introduction

The global increase in car ownership has led to a higher risk of traffic safety issues, such as accidents and congestion. Vehicular Ad-hoc Networks (VANETs) utilize advanced information technology to establish an extensive network connection among entities, facilitating real-time monitoring of vehicle flow and driving conditions [1]. This innovative approach aims to mitigate or even prevent traffic accidents, enhance traffic efficiency, and optimize the overall driving environment. The core components of VANETs typically consist of three entities: a Trusted Authority (TA), vehicles equipped with On-Board Units (OBUs), and Roadside Units (RSUs). VANETs enable vehicles to broadcast messages every 100 to 300 milliseconds via the Dedicated Short-Range Communication (DSRC) protocol [2]. These frequent broadcasts enable vehicles to make well-informed decisions based on the received information. For example, they can choose faster and safer travel routes based on real-time transmission data to relieve traffic congestion, minimize or avoid traffic accidents, and enhance road utilization, traffic efficiency. Moreover, VANETs provide a variety of value-added services like navigation, media, and social media, thereby remarkably enhancing people’s driving experience [3, 4].

However, the open and broadcast nature of VANETs’ communication facilitates real-time information exchange but also makes it vulnerable to various security threats like message forgery and tampering [5]. In VANETs, vehicle users depend on public communication channels which are usually insecure. Consequently, this vulnerability enables adversaries to intercept and manipulate information, possibly resulting in the exposure of vehicle users’ identity details. These security breaches might also allow the tracking of vehicle users’ travel patterns, thus endangering the safety of individuals and their property. Furthermore, there is the risk of malicious vehicles deliberately spreading false information to disrupt traffic flow for their gain. For instance, a vehicle may broadcast false reports of congestion ahead, causing other vehicles to avoid specific routes during route planning and giving the malicious vehicle an unfair edge. In such cases, it is essential for trustworthy entities to quickly verify the identities of the malicious entities in the network. Therefore, strong conditional privacy protection and message authentication mechanisms are required in VANETs. Moreover, considering the limited communication bandwidth in VANETs, these authentication processes need to be designed to reduce communication overhead as much as possible.

The certificateless public key cryptosystem [6], which was first introduced by Al Riyami et al. at ASIACRYPT 2003, is a high-performance and versatile cryptographic framework and has become one of the most advanced public key systems available since then. It doesn’t need certificates and still keeps robust security. In the field of digital signatures, the concept of aggregate signatures, which was initially presented by Boneh et al. [7] at EUROCRYPT 2003, has proved to be particularly innovative. This approach enables multiple signatures to be consolidated into a single (aggregated signature), thus simplifying the verification process. The verifier only needs to confirm the validity of this aggregated signature to verify the authenticity of all individual signatures. Therefore, aggregate signatures have broad application value in network communication environments that have low computational load, low bandwidth, low capacity, and require mutual verification of signature validity. It is essential to explore a certificateless aggregate signature scheme which combines the advantages of both certificateless cryptography and aggregate signatures, because such a scheme provides the dual benefits of conditional anonymity and enhanced security. And it is well-suited for applications that require efficient network communication and mutual verification of signature integrity, like healthcare wireless medical sensor networks (HWMSNs) and VANETs. In recent years, scholars have been highly interested in enhancing the security and privacy of networks, including devising certificateless aggregate signature schemes for HWMSNs and VANETs. For example, Zhou et al. [8] proposed an improved pair-free certificateless aggregate signature scheme for HWMSNs which was based on the work of Zhan et al. [9]. Altaf et al. [10] proposed a privacy-preserving local hybrid authentication scheme that is suitable for large vehicle networks. Almazroi et al. [11] proposed an efficient certificateless authentication scheme for fog computing in 5G-assisted vehicle systems. Xu et al. [12] proposed a certificateless aggregate signature scheme aimed at ensuring secure routing. Wang et al. [13] utilized full aggregation technology to reduce computing and bandwidth resources, proposed a certificateless aggregate signature scheme for implementing conditional privacy protection in VANETs and proved the security of the scheme under the standard model. Liang et al. [14] analyzed and improved an efficient certificateless aggregate signature scheme that has conditional privacy protection properties and is applied to VANETs. Yu et al. [15] proposed the first scheme for aggregation on a vehicle-mounted unit. This scheme performed a certificateless aggregate signature on the vehicle-mounted unit to avoid channel conflicts. Moreover, they utilized elliptic curve point multiplication operations to reduce computational costs. Rajkumar et al. [16] put forward an improved scheme that ensures robust privacy protection and security. They utilized aggregation and elliptic curve point addition to enhance efficiency without affecting verification speed or adding extra costs for roadside units.

Although several certificateless aggregate signature schemes suitable for VANETs already exist, some of them have not been subject to rigorous security analysis and might be vulnerable to attacks like public key replacement and KGC(Key Generation Center) attacks. For example, Jiu et al. [17] pointed out that the scheme proposed by Thumbur et al. [18] is prone to signature forgery attacks and then proposed a new certificateless aggregate signature scheme without pairing based on [18]. Similarly, Zhou et al. [19] pointed out that neither the scheme of Thumbur et al. [18] nor that of Chen et al. [20] can resist public key replacement attacks, and proposed an improved certificateless aggregate signature scheme which is more suitable for resource-constrained VANETs environments. Shim et al. [21] also indicated that the scheme of Chen Y [20] is vulnerable to forgery attacks and Type I attacks. Ali et al. [22] presented a certificateless aggregate signature scheme with provable security, providing conditional privacy authentication within a random oracle model framework. However, Zhou et al. [23] emphasized that the scheme of Ali et al. is vulnerable to malicious vehicle attacks or malicious KGC attacks. Xiong et al. [24] proposed a certificateless aggregate signature scheme based on elliptic curve cryptography which can resist collusion attacks. However, Xu et al. [25] pointed out that this scheme can be forged by Type I adversaries. Wu et al. [26] pointed out that the pair-free certificateless aggregate signature scheme with conditional privacy protection proposed by Gong et al. [27] for VANETs fails to achieve the required unlinkability and is vulnerable to public key replacement forgery attacks by Type I adversaries. In 2022, Cahyadi et al. [28] developed a certificateless aggregate signature scheme with security and privacy protection for VANETs. Unfortunately, through analysis, we found that this signature scheme is also insecure. This paper will analyze and indicate that the signature scheme is vulnerable to at least two types of attacks, and offer a detailed analysis of the specific reasons for the existence of these attack methods. Additionally, corresponding improvement measures to defend against these attacks are proposed, and the enhanced security of the improved signature scheme is demonstrated.

The layout of this article is organized as follows. The related work is discussed in Section 2. Essential preliminary knowledge is presented in Section 3. A comprehensive review of the certificateless aggregate signature scheme proposed by Cahyadi et al. is shown in Section 4. Subsequently, Section 5 explores the vulnerabilities of Cahyadi et al.’s scheme, illustrating two distinct attack methodologies. In Section 6, we first analyze the underlying causes of these attacks. Then, we introduce an improved certificateless aggregate signature scheme which is designed to address the aforementioned vulnerabilities. This new scheme is accompanied by rigorous security proof, demonstrating its robustness. Section 7 focuses on an analysis of computational and communication costs, assessing the efficiency of our proposed scheme. Finally, Section 8 presents the conclusion and future work.

2 Related work

In the open wireless communication environment of VANETs, several crucial security challenges emerge, mainly concerning the dynamic authentication of vehicles, the efficiency and effectiveness of authentication procedures, and the location privacy issues of vehicles. Ensuring the security and protecting the privacy of users have become crucial issues in the research field of VANETs [29, 30].

To ensure the integrity and reliability of messages received in VANETs and prevent malicious actors from tampering with communications or impersonating legitimate users, researchers have adopted reputation management systems. These systems allow vehicles to evaluate the trustworthiness of their peers and the received messages, thus reducing the risks related to deceptive messages spread by malicious entities [31–33]. To assess the reliability of sensor vehicles, some schemes like those in literature [34–36] have carried out real-time updates of reputation values. Reputation update is a crucial part of reputation management. It is typically performed regularly by Trusted Authority (TA) after gathering, decrypting, and verifying a large amount of reputation feedback. This leads to high computational and communication costs for the TA and may even cause the TA to become a bottleneck in the reputation management system [33, 37]. Moreover, digital signature technology is also a significant technology for guaranteeing the security of VANETs. It ensures that communication messages between entities are signed for security. In the communication process, the sender encrypts the information using a private key, and the receiver verifies the signature first to confirm the reliability of the message source. Furthermore, to improve the efficiency of verification processes and reduce communication overhead, VANETs security protocols frequently utilize aggregate signature technology and certificateless signature technology. These methods are preferred due to their advantages in optimizing signature efficiency and decreasing the overall system overhead. Then, certificateless aggregate signature schemes have been continuously proposed for VANETs [12–28] (A brief introduction to these algorithms can be found in Section 1.).

On the other hand, privacy protection is also a crucial aspect of research in VANETs. Without privacy protection for reputation feedback, sensitive information about vehicle privacy may be leaked. When a dispute over messages occurs, it is expected that only trusted institutions can track and extract the true identity of the message sender, thus achieving conditional privacy protection for user identity. To address such issues, Liu et al. [34] proposed a scheme that can simultaneously offer accurate trust management and robust conditional privacy protection by using the well-known Private Set Intersection (PSI) technique based on Bloom Filter (BF). Cheng et al. [31] designed a lightweight privacy-preserving sensing task-matching algorithm. This algorithm is implemented by devising algorithms to verify the validity of reputation values, selecting reliable sensing vehicles, and an efficient reputation management mechanism that can update the reputation values of sensing vehicles efficiently and accurately. So, this algorithm can protect location privacy, identity privacy, sensing data privacy, and reputation value privacy while decreasing the computational and communication overhead of sensing vehicles. Liu et al. [38] proposed a cloud-assisted vehicle network privacy protection reputation update (PPRU) scheme based on elliptic curve cryptography (ECC) and the Parlier algorithm. In this scheme, reputation feedback is provided by honest but curious cloud service providers (CSPs). Moreover, the pseudonym mechanism is also a means of protecting user privacy. Zhou et al. [39] proposed a certificateless aggregate signature scheme, which uses full aggregation technology to reduce computation and bandwidth resources and implements conditional privacy protection through a pseudonymization mechanism to ensure the communication security and privacy protection of VANETs. References [13–15, 20, 22, 26, 27] also combine the pseudonym mechanism with the certificateless aggregate signature to ensure the conditional privacy of VANETs. Furthermore, the utilization of algorithms incorporating privacy principles represents a means of safeguarding user privacy. Shahrouz et al. [40] proposed an anonymous authentication scheme based on zero-knowledge proof to achieve conditional privacy protection of VANETs. Mundhe et al. [41] proposed a conditional privacy protection authentication scheme based on lightweight ring signatures and pseudonyms for VANETs. Zhang [42] proposed a privacy protection announcement scheme based on message link group signatures for VANETs. This scheme has information-binding and efficient revocation functions and exhibits strong credibility.

In the domain of communication security and privacy preservation in VANETs, a promising research approach is to integrate reputation management, pseudonymization mechanisms, and advanced digital signatures technologies like certificateless aggregate signatures, ring signatures, and group signatures. This approach not only improves network security but also reduces communication and storage costs. Moreover, it incorporates a fault-tolerant mechanism that ensures operational continuity even when a trusted authority is absent or there is a partial infrastructure disruption, thereby offering a practical solution for building a reliable and trustworthy vehicle network.

3 Preliminary

4 Restatement of Cahyadi et al.’s certificateless aggregate signature scheme

Cahyadi et al.’s certificateless aggregate signature scheme consists of nine algorithms as follows [28]:

Setup: KGC inputs safety parameter l∈N, selects large prime numbers q, constructs an additive group G₁ and a multiplication group G₂, where G₁ and G₂ have the same order q. Then KGC selects a generator P from G₁, and selects a bilinear pairwise mapping . The system master and the private key are selected randomly as , and the system public key is calculated as P_pub = αP. KGC selects six secure one-way hash functions .

Meanwhile, TRA (Trace Authority) selects a secret value , then calculates public key T_pub = βP. Every RSU in the vehicle self-organizing network needs to randomly select a number as their private key, then calculates the corresponding public key , and sends to KGC. Common system parameters will be sent to each vehicle in the network by KGC after KGC received , and params will also be preloaded on TPD(Tamper-Proof Device).

Registration: Each vehicle equipped with OBU devices needs to register with the TRA. Thus, the TRA is capable of tracking the false identities of vehicles and precisely identifying which vehicle used a false identity in disputable situations. The registration process comprises three steps:

Firstly, TRA selects a hash function .

Then, TRA selects a random number and the vehicle’s identity ID_i, associating it with the new actual identity which will be used in all further communication in the future. will be transmitted to the vehicle through a secure communication channel by TRA. After receiving this information, the vehicle selects nonce which is a random number, and subsequently computes the password .

Finally, is sent to TRA via a secure communication channel, TRA stores , and vehicle registration is completed.

Partial-Private-Key-Gen: KGC uses the vehicle’s identity and system master private key α to generate its partial private key . Secure communication channels are used by KGC to send to the vehicle. The vehicle can verify and by Eq (1) to determine whether they are created by legal TRA and KGC.

(1)

Vehicle-Key-Gen: To obtain a pseudo-identity from the TRA, a vehicle must first follow the steps below to generate its own public and private keys.

1. ①The vehicle randomly selects a value as its private key , that is .
2. ②The vehicle calculates its public key by using the common parameter P.
3. ③The vehicle calculates a one-time password used for mutual authentication with TRA based on the current timestamp T_i, and , and this OTP can only be used once. Afterward, the vehicle encrypts the message by using the public key cryptography system and T_pub, and sends the encrypted message to TRA, where m represents that the vehicle’s OBU device stores m pseudo identities.
4. ④Using its private key β, the TRA decrypts the received message and checks if T_i falls in a valid time period. If so, TRA calculates and . If OTP^∘ = OTP, TRA can verify the vehicle’s identity.

Pseudonym-Gen: TRA will produce a pseudo-identity PID_i for the vehicle upon successful mutual authentication between the TRA and the vehicle.

1. ①TRA creates a pseudo-identity by calculating .
2. ②TRA calculates D_i = h₄(PID_i) and K_i = C_iD_i.

The vehicle has to preload several pseudo-identities and ensure that none of them are reused. Whenever a message is sent to another vehicle, a different pseudo-identity is used. When vehicles are in areas where many vehicles congregate, like intersections or parking lots, this approach will make it hard for legitimate vehicles to be tracked by malicious attackers. The TRA decides the number of pseudo-identities to generate based on the current number of pseudo-identities stored in the OBU device. Each application process leads to the generation of multiple pseudo-identities .

1. ③TRA calculates , and encrypts messages M₁ (Eq 2) by using .

(2)

RSU sends M₁ to the vehicle. Then the vehicle will use to decrypt the message (Eq 3) after receiving the M₁, and verify if is in a valid time interval. If so, the vehicle calculates and verifies if j^∘ = j holds.

(3)

After successful verification, the vehicle and the TRA will conduct mutual authentication. Subsequently, the vehicle will store the pseudo-identities together with K_i. Since OBU devices must store sufficient pseudo-identities, vehicles need to reapply to the TRA at appropriate times to prevent a lack of pseudo-identities.

Sign: ①The vehicle selects a random number , and calculates U_i = u_iP∈G₁.

1. ②OBU calculates h_i (Eq 4) and S_i (Eq 5) to form a certificateless signature σ_i = (U_i,S_i) for the message M_i.

(4)

(5)

③Vehicle broadcast final message , where t_i is the timestamp.

Verify: This step is executed by RSU. When the RSU detects a message sent by the vehicle, it first verifies t_i. If the message is not signed within an acceptable time frame, t_i will not be accepted and the message will be abandoned. Conversely, RSU calculates and D_i = h₄(PID_i). Finally, RSU verifies Eq (6). If the verification is successful, the certificateless signature is accepted. Conversely, if the verification fails, it implies potential message tampering and the signature will not be accepted.

(6)

Aggregate: When RSU receives n message signature pairs from the vehicle with pseudo-identities (PID₁,⋯,PID_n). It calculates the formula and returns σ = (U₁,⋯,U_n,S) as an aggregate signature.

Finally, RSU sends to AS.

Aggregate-verify: When AS receives σ = (U₁,⋯,U_n,S) from RSU, it calculates and . Finally, the AS verifies if the Eq (7) holds. If so, the aggregate signature is valid and is accepted. Otherwise, it is invalid and is rejected.

(7)

5 Two attack methods for Cahyadi et al.’s certificateless aggregate signature schemes

The subsequent analysis reveals that the certificateless aggregate signature scheme presented in [28] is vulnerable to at least two distinct malicious attacks, as detailed below:

1. Attack Method 1: KGC Malicious Attack
   KGC starts with the signature algorithm Sign to attack. Firstly, it is noticed that in the signature algorithm Sign, the calculated formula is equivalently deformed as follows:
   The equation shows that KGC is capable of generating an authentic signature for any arbitrary message intended for any vehicle ID_i, by using the system’s master private key α, even without access to the private key x_i of the specific vehicle. The specific attack method is described below:
   1. ① Choose any message to be signed.
   2. ② The vehicle selects a random number , and calculates .
   3. ③ OBU calculates (Eq 8) and (Eq 9) to form a certificateless signature for the message .
   (8) (9)
   The forgery method described above cannot be distinguished from a genuine signature generated by the legitimate signer with their private key in Cahyadi et al.’s signature protocol. Moreover, it meets the verification formula of the aggregate signature algorithm. Notably, when examining the verification formula for individual signatures, it can be seen that the forgery satisfies the verification Eq (6). That is because
   Therefore, KGC successfully forged a signature on any selected message .
2. Attack Method 2: Public Key Replacement Attack
   The aggregate signature scheme proposed in reference [28] is based on a certificateless public key cryptography system. Thus, it is essential to consider replacement public key attacks. An attacker can successfully forge signatures on any selected message M′ by commencing with the verification algorithm, as described below:
   1. ① Chooses any message to be signed.
   2. ② Selects , and replaces the vehicle public key with .
   3. ③ The vehicle selects a random number , let .
   4. ④OBU calculates (Eq 10) and (Eq 11) to form a certificateless signature for the message .

(10)

(11)

1. ⑤ Outputs the signature of the message .

The forgery method described above cannot be distinguished from a signature that would have been produced by the signer using the vehicle’s private key in Cahyadi et al.’s signature scheme. Moreover, it completely conforms to the verification Eq (6), which makes it hard to tell from an authentic signature. The reason is that

Therefore, the attacker successfully forged a signature on any selected message .

6 Improvement methods and analysis to overcome the above attacks

6.1 Improvement methods to overcome the above attacks

Firstly, we will discuss how to overcome attack method 1(KGC Malicious Attack). Note that the reason why attack method 1 was successful is due to the computation S_i, which involved in Eq (5). The way to overcome this attack is to change the generation method of S_i, that is the vehicle’s secret value and private key need to be used separately. The fundamental reason why attack method 2 (Public Key Replacement Attack) can succeed is that PID_i⋅D_i can be eliminated by a new public key .

In addition, it was found that there was a conceptual error in the proof of their Theorem 1(See reference [28] for details) of Cahyadi et al.’s scheme, as follows:

This is obviously not right. Therefore, we propose an improved signature scheme as follows:

Setup: KGC and TRA execute this algorithm to generate relevant parameters. The generation method of each parameter is the same as Cahyadi et al.’s signature scheme. KGC sends common system parameters to each vehicle in the network, and secretly stores system master private key α.

Registration: TRA completes registration of vehicle equipped with OBU. This algorithm is equivalent to Cahyadi et al.’s signature scheme.

Partial-Private-Key-Gen: KGC executes this algorithm to create the vehicle’s partial private keys . This algorithm is the same as Cahyadi et al.’s signature scheme.

Vehicle-Key-Gen: The vehicle’s unique public and private keys will be created through this algorithm by the vehicle itself. This algorithm is identical to Cahyadi et al.’s signature scheme in terms of its functionality and output.

Pseudonym-Gen: TRA and the vehicle execute this algorithm to generate the vehicle’s pseudo-identity PID_i. This algorithm is the same as Cahyadi et al.’s signature scheme.

Sign: While the fundamental principles of this algorithm remain similar to Cahyadi et al.’s signature scheme, a key difference lies in the modified method for generating S_i. Vehicle ID_i generates a signature for message M_i in the following two steps:

1. ①The vehicle selects a random number , and calculates U_i = u_iP∈G₁.
2. ②OBU calculates h_i (Eq 12) and S_i (Eq 13) to form a certificateless signature σ_i = (U_i,S_i) for the message M_i, where t_i represents the timestamp.

(12)(13)

1. ③Vehicle broadcasts the final message .

Verify: This algorithm is executed by RSU, and it is basically the same as Cahyadi et al.’s signature scheme, but modify the validation formula to Eq (14).

(14)

Aggregate: This is an algorithm for generating an aggregate signature σ = (U₁,⋯,U_n,S) which is executed by RSU, and it is the same as Cahyadi et al.’s scheme.

Aggregate-verify: The AS utilizes the algorithm to authenticate the legitimacy of the signature. This algorithm is fundamentally identical to Cahyadi et al.’s signature scheme, necessitating only minor modifications to the verification formula to adapt it to the new context. AS verifies if the Eq (15) holds. If it holds, the aggregate signature is considered valid and accepted. Otherwise, it is invalid and rejected.

(15)

7 Analysis of computing and communication costs

This article uses third-party data to analyze the computational efficiency of some schemes. Altaf et al. [10] conducted experiments on a simulation machine using MIRACL database data to obtain the basic cryptographic operation time (Linux Mint operating system with Core-i7@3.40 GHz processor and 16 GB RAM driver). Under CDHP, the computational overhead of one-way hash function operations is very low. Therefore, the main operations considered in this article are: Bilinear-Pairing(T_bp=3.24 ms), Map-to-Point in G₁(T_H=0.58 ms), Scalar Multiplication in G₁(T_m=0.24 ms), Point Addition in G₁(T_a=0.005 ms). Using the above data, the analysis and comparison of the computational cost results between this article and several similar schemes [12–14, 28] are presented in Table 1, where n represents the number of users with aggregated signatures. The security of these schemes is also shown in Table 1. The computational cost considering different numbers of messages is illustrated in Fig 1.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. The computational cost of aggregate verification for different n.

https://doi.org/10.1371/journal.pone.0317047.g001

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Comparison of the computational cost and the security.

https://doi.org/10.1371/journal.pone.0317047.t001

From Table 1, it can be observed that our signature scheme demands only marginally more computational overhead compared to Wang et al.’s scheme [13] during the single signature generation stage, and Wang et al.’s scheme is insecure and will be vulnerable to KGC attacks. As shown in Table 1 and Fig 1, our scheme presents a computational cost comparable to that of Cahyadi et al.’s scheme [28], which surpasses other schemes in the signature verification stage. In the aggregation verification stage, it is notable that our scheme shows a slightly higher computational cost than Wang et al.’s scheme [13] when the total message count is 300 or less. However, as the message volume rises, the computational efficiency of our scheme becomes more prominent, displaying an advantage over the existing methods.

In terms of communication overhead, this article uses the relevant parameters used in reference [28]. The length of the cyclic addition group G₁ is 128 bytes. The length of the multiplication group G₂ is 40 bytes. The length of the timestamp is 4 bytes. The output length of a universal one-way hash function is the same as the length of the number in , both being 20 bytes. The length of traffic related messages in VANETS is 67 bytes. The communication overhead results of this article and several similar schemes [12–14, 28] are analyzed and compared is shown in Table 2.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Comparison of the communication overhead for n messages.

https://doi.org/10.1371/journal.pone.0317047.t002

By inspecting Fig 2 and Table 2, it is revealed that our scheme has the same communication overhead as Cahyadi et al.’s scheme and surpasses the other three schemes in communication efficiency.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. The communication overhead for a single message.

https://doi.org/10.1371/journal.pone.0317047.g002

Furthermore, we take into account the calculational efficiency aspect of certificateless aggregate signature schemes. According to the definition given by Zhao et al. [43], let K denote the total computational cost of signature and verification for n messages, and L denote the computational cost of signature verification after aggregation. Then, the calculational efficiency is defined as β=(K-L)/K. The calculational efficiency β of each scheme is presented in Table 3, and the comparison results are illustrated in Fig 3. From Fig 3, it can be observed that our scheme exhibits the highest calculational efficiency.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Comparison of calculational efficiency β of different schemes.

https://doi.org/10.1371/journal.pone.0317047.g003

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Comparison of the calculational efficiency β of different schemes for n messages.

https://doi.org/10.1371/journal.pone.0317047.t003

The aforementioned observations and analyses highlight the subtle yet crucial advantages of our algorithm regarding computational and communication overheads as well as calculational efficiency. With respect to security, our in-depth analysis has detected vulnerabilities in Cahyadi et al.’s scheme, which is prone to both public key replacement attacks and KGC attacks. Likewise, Wang et al.’s scheme is also susceptible to KGC attacks. Consequently, the improvement scheme proposed in our article outperforms the other four schemes [12–14, 28] used for comparison.

8 Conclusion

This article conducts a rigorous security analysis of the certificateless aggregate signature scheme for VANETs proposed by Cahyadi et al. [28]. The study reveals that Cahyadi et al.’s scheme cannot withstand two crucial security vulnerabilities: malicious KGC attack and public key replacement attack. The specific reasons for the existence of these attack methods are presented in this paper. Subsequently, this article presents an enhanced scheme aimed at strengthening against these attacks, accompanied by proof of its enhanced security. Through a comparative analysis of the computational cost, communication overhead, calculational efficiency and security of the proposed scheme with several similar schemes, the results demonstrate that our scheme exhibits superior performance in both computational and communication efficiency, along with enhanced security. The security analysis and attack methodologies described here are effective not only for the signature schemes mentioned in [28] but also possess reference value for the analysis and design of other similar signature schemes. This is especially the case for those based on bilinear pairings, as well as certificateless and certificate-based signature schemes. In future work, we will further refine and design certificateless aggregate signature schemes. This will involve considering more potential attacks, integrating reputation management mechanisms and privacy-based signature schemes, and evaluating their performance in diverse simulated and real vehicle networks.