This document summarizes and critiques the MABS-DSA protocol proposed by Zhou et al. for multicast authentication using batch verification. While MABS-DSA was intended to increase efficiency and security over other implementations, the author finds through reexamination of the arithmetic that the algorithm is actually incorrect and batch signature verification would fail almost always, even when individual packets were properly signed by an honest sender. The key issue is a flaw in protocol correctness rather than the intended security improvements.

1. Comments on “MABS: Multicast Authentication Based on Batch Signature”
Recently, Zhou et al. proposed a multicast authentication protocol named MABS employing an
efficient cryptographic primitive called batch verification to authenticate arbitrary number of
data packets simultaneously, and three implementations were presented: MABS-RSA, MABS-
BLS, and MABS-DSA. In this letter, we are concerned with the last implementation, which is
claimed to be much more efficient than the others. Our particular interest also lies in that MABS-
DSA was designed to thwart a known attack against its underlying batch DSA primitive and is
claimed to be with increased security. After a careful revisit of the involved arithmetic, however,
we find that the real issue lies in protocol correctness rather than security; the algorithm of
MABS-DSA actually does not hold as one would expect. More specifically, even if each of the
data packets has been signed by an honest sender and securely delivered to the receiver,
verification of the batch of signatures will still fail almost always.
Ambit lick Solutions
Mail Id: Ambitlick@gmail.com , Ambitlicksolutions@gmail.Com