On the Unforgeability of “Privacy-Preserving Aggregation-Authentication Scheme for Safety Warning System in Fog-Cloud Based VANET”

Yang et al. proposed a privacy-preserving aggregation authentication scheme (PPAAS) for fog-cloud-based vehicular ad hoc network based on an anonymous certificateless aggregation signcryption. In their scheme, the vehicles’ public keys and pseudonyms are contained in the ciphertexts to provide sender anonymity. The receiver uses them after they are retrieved from the ciphertexts. However, this method contradicts the authentication. A pseudonym is essentially an encryption of the real identity. The receiver who does not know the encryption key cannot check the validity of the public keys with the pseudonyms. Thus, the attacker can contain public keys and pseudonyms selected by himself in the forged aggregated ciphertext. The receiver has to use them directly. Hence, the PPAAS can be broken in real life.