A cognitive wireless mesh (CogMesh) network can provide network access for users (mesh clients) while holding the open spectrum-sharing feature. It combines the advantages of both cognitive radio networks and wireless mesh networks: high utilization of the scarce radio spectrum, ease of deployment, maintenance, and low cost. However, the unstable radio environment incurs more handoffs in CogMesh than other wireless networks. Therefore, seamless handoff and a lightweight re-authentication process are required to achieve a high quality of real-time applications and low network load caused by re-authentication. In this paper, we introduce a local joint fast handoff scheme based on proxy signature, which is suitable for CogMesh scenarios. After the mutual authentication between a mesh client and a mesh router, a session tunnel key is derived and shared between them to protect their sessions. Because the proxy signature is used, the IEEE 802.1x authentication architecture remains the same, and there is no need for the authentication server to be involved in the handoff procedure, the re-authentication delay has been reduced, and the load of CogMesh and the authentication server are lower. Copyright © 2013 John Wiley & Sons, Ltd.