The concept of an online/offline signature was first proposed in 1990 by Evan et al. [1]. The main idea is to divide the signature generation algorithm into two phases (i.e., online and offline phase). The signing algorithm performs the offline step to manage most of the heavy computations and stores without knowing the signed message. Once the signed message arrives, the signature algorithm runs the online step very fast and only light computations are required. Online offline signatures are more useful on some storage limited devices such as smart cards, wireless sensors, and RFID tags, as the offline step can be done with a background computation during the device manufacturing process or whenever the device power is connected. There are numerous offline/online signature schemes [2–5], designed for different applications.

In 2008, Yu and Tate [3], presents three effective online/offline signature approaches. The authors claim that the given is formally secure in the standard model under the assumptions of RSA. Unfortunately, the given scheme is affected by high-cost consumptions i.e., computation time and communication overhead. Besides, Ma et al. [4], found that the first scheme of Yu and Tate [3], is not secure.

In 2010, Wu et al. [5], suggest an identity-based online/offline signature scheme under ROM using the hardness of bilinear pairing. Unfortunately, the given scheme is affected by high-cost consumptions due to the use of heavy pairing operation which makes it inefficient.

In 2020, Addobea et al. [6], suggest a certificateless online/offline signature scheme for mobile health devices under ROM using the hardness of bilinear pairing. Nonetheless, the given scheme also suffers from high-cost consumptions due to the use of heavy pairing operation that shows the inefficiency of the designed scheme for the resource-constrained devices of mobile health.

Let ⍬, ℇ { 1,2,3,…n−1} and R=⍬.D , then finding ⍬ and R is known as HDLP.

Here we present the constructions of the Khan et al. [7] scheme. Additionally, the notations used in the constructions are listed in Tab. 1.

Setup:

Given the security parameter η , the KGC select,

Set Secret value:

The participating entities with identity idi picks li ∈ {1,2,3,……n−1} as a secret value and computes Vi = li . D as a public key.

Set Partial private key:

For an entity with identities idi the KGC picks ϑi ∈ {1,2,3,……n−1} , computes μi=ϑi.D , calculates Wi=ϑi+QHx(idi,Vi,μi ), and send Γi=(Wi,μi) to the entities with idi using a secure channel.

Set Private key:

The entities, with identity idi sets Ni=(Γi,li) of its private key.

Set Public key:

The entities, with identity idi sets Zi=(Vi,μi) of its public key.

Signature Generation:

The computations of the sender are divided into two steps;

Offline Step:

Executed on the server equipped with high resources.

It picks d ∈ {1,2,3,……n−1} and computes t=d.Vs

Online phase:

Compute S=ls.d−(ls.X+P.Ws)

Verification:

Upon reception ϕ , the receiver can verify S as follows

Compute P=Hy(ids,μs,m,t) and X=Hz(ids,Vs,m,t)

An Adv can forge the valid signature on a message ( m ) by replacing a public key ( K ).

Subsequently after obtaining the ( ids,μs ), the Adv randomly choose WAdv , lAdv ∈ {1,2,3,……n−1} , computes VAdv=lAdvD , Hx(ids,μs,VAdv)K′=WAdvD−μs ) ,Hx−1 and replace the master public key ( K ) with K′ and idsVs with VAdv so that WAdvD=μs+Hx(ids,μs,VAdv)K′ holds.

Finally, Adv computes SAdv=lAdvdAdv−(XAdvlAdv+PAdvWAdv) and generate the signature ( SAdv,tAdv ) on the given message m.

Because tAdv=dAdvVAdv=dAdvlAdv PAdv=Hy(ids,μs,m,tAdv) and XAdv=Hz(ids,m,VAdv,tAdv)

Thus, SAdvD=tAdv−XAdvVAdv−PAdv(μs+Hx(ids,VAdv,μs)K′) .

Therefore, we argue that the produced signature can pass through the verification successfully and the A can generate a signature.

While designing a signature protocol as designed by Khan et al. [7], the public key K needs to be hashed to eliminate the prospect of this type of forgery. The correction with formal proof is given below.

While executing partial private key extraction in Khan et al. [7], if the K is hashed in Hx , the private part Wi is computed as Wi=ϑi+QHx(idi,Vi,μi,K ), so a user can authenticate their tuple of the partial private key ( Wi,μi) , if Adv tries to forge the signature as described in Khan et al. scheme, it then randomly pick WAdv , lAdv ∈ {1,2,3,…n−1} , computes lAdvD,Hx(idi,μi,Vi,K),K′=(WAdvD−μs),Hx−1 and replace the master public key K with K′ and idsVs with VAdv .

In this section, we evaluate the performance of our cryptanalysis in comparison with Khan et al. [7]. For our comparative analysis, we adopt the running time of costly mathematical operations from [8] and [9]. Here, we only consider the operations that are used in the particular scheme of Khan et al. [6]. According to [8] and [9], the cost of a single pairing-based point multiplication ( PBML ) is 4.31 milliseconds, the cost of bilinear pairing ( BPairing ) is 14.90 milliseconds, the cost of exponentiation ( EPO ) is 1.25 milliseconds and the cost of a single HCDM is approximately 0.48 milliseconds [8,9]. The total computation cost of signing in the Khan et al. [7] scheme is 4 HCDM and the total computation cost of verification is 3 HCDM.

Note: Here we consider the same schemes with which Khan et al. [7] perform the comparative analysis in terms of computation time and communication overhead. Tab. 2, shows cost analysis of the selected schemes.

Recently, Khan et al. presented a new certificateless online/offline signature scheme for the Internet of Health Things (IoHT) to fulfill the authenticity requirement for the resource-constrained environment of (IoHT) devices. The authors claim that the newly proposed scheme is secure against Type-I adversary under the Random Oracle Model (ROM). Unfortunately, their scheme is insecure against adaptive chosen message attacks. It is demonstrated that an adversary can forge a valid signature on a message by replacing the public key. Furthermore, we performed a comparative analysis of the selective parameters including computation time, communication overhead, security, and formal proof by employing Evaluation based on Distance from Average Solution (EDAS). The analysis shows that the designed scheme of Khan et al. doesn’t have any sort of advantage over the previous schemes. Though, the authors utilized a lightweight hyperelliptic curve cryptosystem with a smaller key size of 80-bits. Finally, we give some suggestions on the construction of a concrete security scheme under ROM. Soon, we intend to improve the security of Khan et al. under the standard model.