On the security of a convertible group signature scheme

In this paper, we present two attacks on a group signature scheme proposed by Kim, Park and Won. We show how adversaries can forge secret keys linked to a set of groups that enable them to sign messages on behalf of those groups. The success of the attacks depends on the number of acceptable identities or more precisely, on what constitutes an acceptable identity. We also show how to modify the scheme to make the attacks ineffective, independently of the way identities are defined. (C) 2000 Published by Elsevier Science B.V. All rights reserved.