On the security of joint signature and encryption revisited

Mridul Nandi; Tapas Pandit

doi:10.1515/jmc-2015-0060

Open Access Published by De Gruyter November 10, 2016

On the security of joint signature and encryption revisited

Mridul Nandi and Tapas Pandit

From the journal Journal of Mathematical Cryptology

https://doi.org/10.1515/jmc-2015-0060

Abstract

In 2002, An et al. [1] proposed three generic conversions of signcryption, ℰ⁢t⁢𝒮, 𝒮⁢t⁢ℰ and 𝒞⁢t⁢ℰ&𝒮 from the primitive encryption scheme and signature scheme. But, the security proof of confidentiality in the 𝒞⁢t⁢ℰ&𝒮 paradigm was ambiguous. In this paper, we revisit these paradigms again and provide a more transparent proof for the aforementioned paradigm. None of these paradigms preserves both stronger securities: strong unforgeability and IND-CCA security. We extend the above paradigms to new signcryption paradigms, ℰ⁢t⁢𝒮⁢t⁢𝒮, 𝒮⁢t⁢ℰ⁢t⁢𝒮 and 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮, by applying one-time signature (OTS) cautiously at the outside layer. In these new paradigms, the stronger security of the primitive encryption and signature schemes are maintained. We also obtain a new paradigm, “Encrypt and Sign then Sign (ℰ&𝒮⁢t⁢𝒮)”, which is surprisingly better than the 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 paradigm in all aspects except that ℰ&𝒮⁢t⁢𝒮 does not guarantee the non-repudiation. Moreover, the IND-CCA security and strong unforgeability of the proposed signcryptions are achieved from the IND-gCCA secure encryption scheme and weak unforgeable signature scheme, respectively. Further, we extend these paradigms to capture signcryptions in attribute-based setting, also known as attribute-based signcryption (ABSC). We show that the IND-CCA security and strong unforgeability under chosen message attack of ABSC can be obtained from IND-CPA security of ABE and unforgeability under no message attack of ABS, respectively. Furthermore, our generic constructions are applicable to a combined setup, where the public parameters and keys for the primitives ABS and ABE are identical. The security of all the generic constructions is proven in the standard model.

Keywords: Signcryption; attribute-based signcryption; generic conversion

MSC 2010: 94A60; 94A62

1 Introduction

Signcryption is a primitive, where both the message confidentiality and authenticity are taken care simultaneously. The concept was proposed by Zheng [46] and the signcryption was shown as an efficient way of achieving the message confidentiality and authenticity together as compared to the “Sign then Encrypt” approach. However, the author did not provide any formal security proof of the proposed signcryption as no security model was available. Later, Baek et al. [3] formalized a security model and gave a formal security proof of the signcryption scheme [46] in this model. An et al. [1] proposed three generic paradigms of signcryption, “Encrypt then Sign (ℰ⁢t⁢𝒮)”, “Sign then Encrypt (𝒮⁢t⁢ℰ)” and “Commit then Encrypt and Sign (𝒞⁢t⁢ℰ&𝒮)”. Among these three paradigms, 𝒞⁢t⁢ℰ&𝒮 runs faster than the other paradigms as the Encrypt (resp. Decrypt) and Sign (resp. Ver) modules execute in parallel in the Signcrypt (resp. Unsigncrypt) algorithm. The security of the paradigms ℰ⁢t⁢𝒮, 𝒮⁢t⁢ℰ and 𝒞⁢t⁢ℰ&𝒮 was proven in two-user insider models and two-user outsider models. However, by incorporating the identities of receiver and sender appropriately in signcrypt and unsigncrypt algorithms, the security can be proven in multi-user models as well. The ℰ⁢t⁢𝒮 paradigm preserves sUF-CMA and IND-gCCA security of the primitive signature scheme and encryption scheme, respectively, in insider models. The 𝒮⁢t⁢ℰ paradigm preserves UF-CMA and IND-CCA security of the primitive signature scheme and encryption scheme, respectively, in insider models. On the other hand, 𝒞⁢t⁢ℰ&𝒮 paradigm can preserve only weak security in insider models, viz., the UF-CMA security and IND-gCCA security of the primitive signature scheme and encryption scheme, respectively. Subsequently, many signcryption schemes [30, 29, 25, 26, 12, 10, 4, 8] have been proposed either in PKI-setting or in ℐ⁢𝒟-based setting to improve different constraints, e.g., efficiency, hardness assumptions, security model, standard/random oracle model, tightness of security reduction.

For the last decade, attribute-based encryption (ABE) and attribute-based signature (ABS) became the popular encryption and signature primitives, respectively, because of their versatility. In ABE (resp. ABS) a message is encrypted (resp. signed) under a policy and the key is labeled with a set of attributes. This form of ABE (resp. ABS) is known to be ciphertext-policy attribute-based encryption (CP-ABE) [6, 22, 33, 44, 23] (resp. signature-policy attribute-based signature (SP-ABS) [34, 27, 24, 28]). Its dual form, where the role of policy and set of attributes are interchanged, is called key-policy attribute-based encryption (KP-ABE) [17, 35, 22, 33, 2] (resp. key-policy attribute-based signature (KP-ABS) [41]).

Attribute-based signcryption (ABSC) is a natural extension of signcryption in the ℐ⁢𝒟-based setting. It captures the security of both primitives, ABE and ABS, i.e., ABSC provides three important securities, message confidentiality, unforgeability and signer privacy. It was Gagné et al. [15] who first proposed an ABSC scheme for threshold policies. By applying the generic paradigms of [1], one can obtain ABSC from ABE and ABS. The main problem in these paradigms is that they neither achieve both strong unforgeability and IND-CCA security nor efficiency even if their underlying schemes, ABS and ABE, have the stronger security and efficiency. To address the aforementioned issues and others constraints, many ABSC schemes have been studied, see, e.g., [9, 14, 36, 38].

1.1 Our result

PKI-setting. We revisit the different signcryption paradigms of An et al. [1] who claimed^[1] that IND-gCCA security of the primitive encryption scheme is preserved in the 𝒞⁢t⁢ℰ&𝒮 paradigm if the underlying commitment scheme has hiding and relaxed-concealment properties (for definition, refer to Section 2.3). However, the security claim is correct, but the proof of the claim is ambiguous (see Section 3). In the proof of the claim, An et al. defined two environments, Env1 and Env2, which were shown to be indistinguishable under the hiding property without giving proper justification of the challenge ciphertext computation. The main issue is that the simulator is totally unaware of the decommitment part of the challenge message. We show (in Section 3.1) that Env1 and Env2 are not indistinguishable under the hiding property of the commitment scheme. Thus, revising the proof becomes necessary for validating the claim. Indeed, we provide a revised proof for IND-gCCA security in the 𝒞⁢t⁢ℰ&𝒮 paradigm (in Section 3.2).

None of the aforementioned paradigms, 𝒞⁢t⁢ℰ&𝒮, ℰ⁢t⁢𝒮 and 𝒮⁢t⁢ℰ, achieves both stronger securities^[2] in insider models even if the primitives are assumed to have stronger security. By applying OTS at the outside layer, we extend these paradigms to new paradigms (see Section 4), “Commit then Encrypt and Sign then Sign” (𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮), “Encrypt then Sign then Sign” (ℰ⁢t⁢𝒮⁢t⁢𝒮) and “Sign then Encrypt then Sign” (𝒮⁢t⁢ℰ⁢t⁢𝒮), to guarantee both stronger securities. We also obtain a new paradigm, “Encrypt and Sign then Sign (ℰ&𝒮⁢t⁢𝒮)”, which is surprisingly better than the 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 paradigm in all aspects except that ℰ&𝒮⁢t⁢𝒮 does not guarantee the non-repudiation.

Attribute-based setting. In a similar way, one can obtain the above new paradigms, 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮, ℰ&𝒮⁢t⁢𝒮, ℰ⁢t⁢𝒮⁢t⁢𝒮 and 𝒮⁢t⁢ℰ⁢t⁢𝒮, in the attribute-based setting as well, where IND-gCCA (resp. UF-CMA) security is stretched to IND-CCA (resp. sUF-CMA) security. The only candidates of IND-gCCA secure ABE available in the literature are IND-CCA secure ABE. So, it is a natural question to ask whether the IND-CCA security of ABSC can be entertained even from a low level secure ABE, i.e., IND-CPA secure ABE. Affirmatively, we provide generic ABSC constructions (in Section 5) based on delegation and verifiability [45, 31]. In these constructions, the IND-CCA security and sUF-CMA security of ABSC are achieved from IND-CPA secure ABE and UF-NMA secure ABS, respectively. Recently, Pandit et al. [36] proposed a concrete ABSC scheme using the CP-ABE [22], an SP-ABS modified from [9] and commitment scheme. The authors basically extended the 𝒞⁢t⁢ℰ&𝒮 approach to the new approach 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 in the attribute-based setting to acquire the stronger security in adaptive-predicates models. Their work motivates us to study constructions of ABSC generically. Interestingly, our generic constructions are applicable to the combined setup [36], where the public parameters and keys for the primitives, ABS and ABE, are identical. We also consider generic constructions of signcryption to support the independent setup^[3], where the public parameters and keys for the primitives, ABS and ABE, are independent. In this paper, we provide generic constructions for several variants of ABSC and all the securities are proven in the standard model. The proposed ABSC provides signer privacy if the underlying ABS does so. Unforgeability of the proposed constructions is proven in the adaptive-predicates model (Definition 2.22). The confidentiality models considered here are the adaptive-predicates model (Definition 2.16) and the selective-predicate model (Definition 2.17) according to the adaptive-predicate security and selective-predicate security of the underlying ABE.

1.2 Related work

Signcryption in PKI-setting. As discussed earlier, the security of the paradigms ℰ⁢t⁢𝒮, 𝒮⁢t⁢ℰ and 𝒞⁢t⁢ℰ&𝒮 of [1] was proven in the insider model (where the attacker is supplied the secret key of either the receiver or the sender, and signcrypt and unsigncrypt oracles) and the outsider model (only the signcrypt and unsigncrypt oracles are provided to the attacker). The insider security models used in [1, 3] are weak in the sense that 𝒜 can freely choose all the keys, except both the challenge receiver’s key and sender’s key. This insider security model was referred in [30] as “fixed challenge multi-user insider model” and a short notation “fM-IND-iCCA” (resp. “fM-sUF-CMA”) was used for insider confidentiality (resp. unforgeability).

Stronger insider models were developed by Libert and Quisquater [25], where 𝒜 is free to choose all user keys, except the challenge receiver’s key (resp. sender’s key) in case of confidentiality (resp. unforgeability). In [30], these models are called “dynamic multi-user insider models”. The model for confidentiality (resp. unforgeability) is also known as “dM-IND-iCCA” (resp. “dM-sUF-CMA”). A number of security models and their comparisons were given in details in [30].

Tan [42] proposed a signcryption scheme based on the ℰ⁢t⁢𝒮 structure and the security was proven in dynamic multi-user insider models [25, 30] without assuming random oracle. Although the security was shown to be in stronger insider models, the unforgeability is attained if the key registration (refer to [30] for details) is used.

Matsuda et al. [30] presented a number of generic conversions of signcryption using existing primitives and their simple extensions. For example, the authors optimize the well-known approaches 𝒮⁢t⁢ℰ and ℰ⁢t⁢𝒮 to “Sign then Tag-based Encryption (𝒮⁢t⁢𝒯⁢ℰ)” and “Tag-based Encryption then Sign (𝒯⁢ℰ⁢t⁢𝒮)”, respectively, using tag-based encryption [20]. The former approach achieves dM-UF-iCMA (weak unforgeability) and dM-IND-iCCA security, while the latter attains both stronger securities in dynamic multi-user insider models. For proving dM-sUF-iCMA security for the latter approach, one-to-one property of the primitive signature scheme was assumed. In their other conversion, a generic signcryption was constructed from the tag-based key encapsulation mechanism (TBKEM), data encapsulation mechanism (DEM) and signature scheme. This conversion achieves dM-sUF-iCMA and dM-IND-iCCA security in dynamic multi-user insider models [25, 30], but unforgeability was shown under the assumption of key registration.

Chiba et al. [11] also proposed two generic conversions of signcryption. The first conversion uses the IND-tag-CCA secure TBKEM, IND-CCA secure DEM and strongly unforgeable OTS. The second conversion uses the IND-CCA secure KEM, IND-CCA secure DEM, strongly unforgeable one-time MAC and strongly unforgeable OTS. Both conversions were shown to be secure in the dynamic multi-user insider models [25, 30] neither assuming random oracle nor the key registration.

Attribute-based signcryption.

Attribute-based signcryption is an advanced cryptographic primitive which captures the functionalities of both primitives, ABS and ABE. The first ABSC scheme was proposed by Gagné et al. [15] using the Fuzzy IBE structure [40], but the access control their scheme provides has limited expressibility. Later, Emura et al. [14] proposed an attribute-based signcryption, where sender’s access policy and receiver’s policy are represented by monotone access tree and AND-gate with wildcard, respectively. Both schemes were shown to be secure in the selective-predicate models. However, the signer-privacy was not considered in the former scheme, whereas the latter ABSC scheme lacks this property.

Wang and Huang [43] presented an ABSC scheme, where the receiver’s policies and sender’s policies, that their ABSC scheme supports, are monotone access trees. Confidentiality and unforgeability of their scheme were proven in the adaptive-predicates models. However, confidentiality of the scheme was proven in the generic group model without giving unsigncrypt oracle access to the adversary. The unforgeability of the scheme was proven in the random oracle model.

Chen et al. [9] proposed a combined public-key scheme in attribute-based setting. In this combined scheme, the distributions of public parameters and keys in the underlying ABS and ABE schemes are considered to be identical. Their combined scheme is based on the construction of Waters [44]. The scheme was shown to be selectively secure in the joint security model. Finally, Chen et al. showed a generic extension from this combined scheme to attribute-based signcryption in the 𝒮⁢t⁢ℰ paradigm. Both policies considered in their scheme are monotone span programs. This signcryption scheme possesses the signer-privacy, and the confidentiality and unforgeability of the signcryption scheme were proven in the selective-predicate models.

Recently, Rao et al. [38] presented an ABSC scheme with constant size signcryption and the number of pairings required in unsigncrypt is 6. The receiver’s policies and sender’s policies used in their scheme are monotone span programs. Confidentiality and unforgeability of the scheme were shown in the selective-predicate models. Their ABSC scheme possesses the signer privacy.

2 Preliminaries

Notation. For a set X, x←RX denotes that x is randomly picked from X according to the distribution R. Likewise, x←UX indicates that x is uniformly selected from X. For an algorithm A and variables x,y, the notation x←A⁢(y) (resp. A⁢(y)→x) carries the meaning that when A is run on the input y, it outputs x. The symbol PPT stands for probabilistic polynomial-time. For a,b∈ℕ, define [a,b]:={i∈ℕ:a≤i≤b} and [b]:=[1,b]. Let str1⁢∥…∥⁢strn denote the concatenation of the strings, str1,…,strn∈{0,1}∗. For algorithms A1,…,An and variables x1,…,xn, y1,…,yn, the notation x1←A1(y1);∥…;∥xn←An(yn); stands for the parallel execution of x1←A1⁢(y1),…,xn←An⁢(yn). For a vector Y→k (resp. Y→), the i-th component is denoted by Yk⁢i (resp. Yi). For X→:=(X1,…,Xn) and Y→:=(Y1,…,Yn), the dot product of X→ and Y→ is defined by X→⋅Y→:=∑i=1nXi⁢Yi.

2.1 Access structure and LSSS

Definition 2.1

Definition 2.1 (Access structure)

Let 𝒫={P1,P2,…,Pn} be a set of parties. A collection Γ⊂2𝒫 is said to be monotone if Γ is closed under superset, i.e., for all B, C, if B∈Γ and B⊂C, then C∈Γ. An access structure (resp. monotone access structure) is a collection (resp. monotone collection) Γ of non-empty subsets of 𝒫, i.e., Γ⊂2𝒫∖{∅}. The members of Γ are called authorized sets, and the sets not in Γ are called unauthorized sets.

A monotone access structure Γ can be represented by the set of minimal sets as defined below.

Definition 2.2

Definition 2.2 (Minimal set of a monotone access structure)

Let Γ be a monotone access structure over the set of attributes 𝒫. Then B∈Γ is a minimal set if for all A∈Γ∖{B}, we have A⊄B. The set of all minimal sets in Γ is called the basis of Γ.

An access structure is also represented by the access tree and a linear secret sharing scheme (LSSS). For access tree representation, we refer to [17, 6]. In the following, we define the linear secret sharing scheme of [44, 5] as later we give the construction of attribute-based signcryption using LSSS representation.

Definition 2.3

Definition 2.3 (Linear secret sharing scheme (LSSS))

A secret sharing scheme Π over a set of parties 𝒫={P1,P2,…,Pn} is called linear (over ℤp) if the following holds:

The shares for each party form a vector over ℤp.
There exists a matrix M, called the share generating matrix for Π. The matrix M has ℓ rows and n columns. For all i=1,2,…,ℓ, the i-th row of M is labeled by a party ρ⁢(i) (ρ is the function from {1,2,…,ℓ} to 𝒫). When we consider the column vector v→=(s,r2,…,rn), where s∈ℤp is the secret to be shared and r2,…,rn←Uℤp, then M⁢v→ is the vector of ℓ shares of the secret s according to Π. The share (M⁢v→)i belongs to party ρ⁢(i).

Property of LSSS. Every LSSS according to the above definition enjoys the linear reconstruction property defined as follows. Suppose that Π is an LSSS for an access structure Γ. Let A∈Γ be an authorized set. Let ℐ:={i∈[ℓ]|ρ⁢(i)∈A}. Then there exist constants {αi∈ℤp}i∈ℐ such that ∑i∈ℐαi⁢M→i=(1,0,…,0), where M→i is the i-th row of M. The vector 1→:=(1,0,…,0) is called the target vector. Hence, if {si} are valid shares of any secret s according to Π, then ∑i∈ℐαi⁢si=s. These constants {αi} can be found in time polynomial in the size of the share-generating matrix M.

Span program. Given any monotone access structure, one can obtain the corresponding LSSS representation (denoted by (M,ρ)) by applying the technique of [5]. If the access structure has ℓ nodes, then the LSSS matrix has ℓ rows. For a monotone access structure Γ, the corresponding LSSS representation (M,ρ) is called monotone span program (MSP).

2.2 Commitment scheme

A non-interactive commitment scheme consists of three PPT algorithms: Setup, Commit and Open.

Setup takes a security parameter κ and outputs a public commitment key 𝒞⁢𝒦.
Commit takes as input a message m, the public commitment key 𝒞⁢𝒦 and returns a pair (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆), where com is a commitment of the message m and decom is the decommitment.
Open takes a pair (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆), the public commitment key 𝒞⁢𝒦 as input and outputs m or ⊥.

For correctness, it is required that^[4]𝖮𝗉𝖾𝗇⁢(𝖢𝗈𝗆𝗆𝗂𝗍⁢(m))=m for all messages m∈ℳ, where ℳ is the message space.

2.3 Security of commitment

As usual there are two security properties of a commitment scheme: Hiding and Binding. But, here we consider an additional property, called concealment property, and its weaker variant, relaxed-concealment property. Both the concealment and the relaxed-concealment property are found in [13] in the form of concealment scheme. Eventually, the commitment and concealment scheme have the hiding property as a common security attribute, but they are different due to a lack of either the concealment property or the binding property. In the concealment scheme [13], Dodis and An used the binding property and relaxed-binding property (which are different in the context of commitment scheme) which we call respectively the concealment property and relaxed-concealment property in this paper.

A commitment scheme is said to have hiding, binding, relaxed-binding, concealment and relaxed-concealment properties, respectively, if it satisfies the following:

Hiding. For all PPT 𝒜 the following is negligible:

|Pr⁡[𝒞⁢𝒦←C.Setup⁢(1κ);(m0,m1,s⁢t)←𝒜⁢(𝒞⁢𝒦);b←U{0,1};(𝖼𝗈𝗆b,𝖽𝖾𝖼𝗈𝗆b)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(𝒞⁢𝒦,mb):𝒜⁢(𝒞⁢𝒦,s⁢t,𝖼𝗈𝗆b)=b]-12|.

Binding. For all PPT 𝒜 the following is negligible:

Pr⁡[𝒞⁢𝒦←C.Setup⁢(1κ);(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆′)←𝒜⁢(𝒞⁢𝒦);m←𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆);m′←𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆′):(m≠m′)∧(m,m′≠⊥)].

Relaxed-binding. For all PPT 𝒜 the following is negligible:

Pr⁡[𝒞⁢𝒦←C.Setup⁢(1κ);(m,s⁢t)←𝒜⁢(𝒞⁢𝒦);(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(m);𝖽𝖾𝖼𝗈𝗆′←𝒜⁢(𝒞⁢𝒦,s⁢t,𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆);m′←𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆′):(m≠m′)∧(m′≠⊥)].

Remark 2.4

It is immediate that the relaxed-binding property is weaker than the binding property.

Concealment. For all PPT 𝒜 the following is negligible:

Pr⁡[𝒞⁢𝒦←C.Setup⁢(1κ);(𝖼𝗈𝗆,𝖼𝗈𝗆′,𝖽𝖾𝖼𝗈𝗆)←𝒜⁢(𝒞⁢𝒦);m←𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆);m′←𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆′,𝖽𝖾𝖼𝗈𝗆):(𝖼𝗈𝗆≠𝖼𝗈𝗆′)∧(m,m′≠⊥)].

Relaxed-concealment. For all PPT 𝒜 the following is negligible:

Pr⁡[𝒞⁢𝒦←C.Setup⁢(1κ);(m,s⁢t)←𝒜⁢(𝒞⁢𝒦);(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(m);𝖼𝗈𝗆′←𝒜⁢(𝒞⁢𝒦,s⁢t,𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆);m′←𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆′,𝖽𝖾𝖼𝗈𝗆):(𝖼𝗈𝗆≠𝖼𝗈𝗆′)∧(m′≠⊥)].

Remark 2.5

It is easy to check that the relaxed-concealment property is weaker than the concealment property.

2.4 Public key encryption scheme

A public key encryption (PKE) scheme consists of three PPT algorithms: Gen-Enc, Encrypt and Decrypt.

Gen-Enc. Input: a security parameter κ. Output: a public key and private key pair (𝒫⁢𝒦,𝒮⁢𝒦).
Encrypt. Input: a message m and public key 𝒫⁢𝒦. Output: a ciphertext C.
Decrypt. Input: a public key 𝒫⁢𝒦, private key 𝒮⁢𝒦 and a ciphertext C. Output: a message m or ⊥.

For correctness, it is required that m=𝖣𝖾𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒦,𝒮⁢𝒦,𝖤𝗇𝖼𝗋𝗒𝗉𝗍⁢(m,𝒫⁢𝒦)) for all (𝒫⁢𝒦,𝒮⁢𝒦)←Gen-Enc⁢(1κ) and all messages m∈ℳ.

2.5 Security of public key encryption scheme

Definition 2.6

A public key encryption scheme is said to be IND-CCA secure if for all PPT adversaries 𝒜:=(𝒜1,𝒜2), the advantage 𝖠𝖽𝗏𝒜,𝖯𝖪𝖤IND-CCA⁢(κ) is at most a negligible function in security parameter κ, where 𝒜 is provided the access to decrypt oracle 𝒪D and NRn is the natural restriction that 𝖢∗ was never queried to 𝒪D.

𝖠𝖽𝗏𝒜,𝖯𝖪𝖤IND-CCA⁢(κ):=|Pr⁡[(𝒫⁢𝒦,𝒮⁢𝒦)←Gen-Enc⁢(1κ);(m0,m1,s⁢t)←𝒜1𝒪D⁢(1κ,𝒫⁢𝒦);b←U{0,1};𝖢∗←𝖤𝗇𝖼𝗋𝗒𝗉𝗍⁢(mb,𝒫⁢𝒦);b′←𝒜2𝒪D⁢(1κ,𝒫⁢𝒦,𝖢∗,s⁢t):b=b′∧𝖭𝖱𝗇]-12|.

A weaker version is called IND-CPA security, where 𝒜 is forbidden to ask the decrypt oracle.

IND-gCCA security. Now we will consider a security definition, called IND-gCCA security [1] which comes in between IND-CCA and IND-CPA. It is defined similarly to IND-CCA, except for the natural restriction NRn. In IND-gCCA security, NRn is defined in a more generalized way. Indeed, let ℛ be an equivalence relation over the ciphertexts. We call this relation decryption-respecting if ℛ⁢(𝖢1,𝖢2)=𝖳𝗋𝗎𝖾 implies 𝖣𝖾𝖼𝗋𝗒𝗉𝗍⁢(𝖢1)=𝖣𝖾𝖼𝗋𝗒𝗉𝗍⁢(𝖢2). The decrypt oracle query for C is restricted by ℛ⁢(𝖢∗,𝖢)=𝖥𝖺𝗅𝗌𝖾 instead of equality. A public key encryption is said to be IND-gCCA secure if there is a decryption-respecting relation ℛ such that it is secure in the above sense. The decryption-respecting relation ℛ can be defined over both the ciphertexts and public keys but not the secret keys. The IND-gCCA security can be extended in the area of other cryptographic primitives, e.g., IBE, ABE, ABSC. Similarly, one can define the notion of OW-gCCA and NM-gCCA security.

2.6 Public key signature scheme

A public key signature (PKS) scheme consists of three PPT algorithms: Gen-Sign, Sign and Ver.

Gen-Sign takes a security parameter κ. It outputs a verification key and signing key pair (𝒫⁢𝒦,𝒮⁢𝒦).
Sign takes a message m and a signing key 𝒮⁢𝒦 as input. It returns a signature δ.
Ver receives a message m, a signature δ and a verification key 𝒫⁢𝒦 as input. It returns a boolean value 1 for acceptance or 0 for rejection.

For correctness, it is required that 1=𝖵𝖾𝗋⁢(m,𝖲𝗂𝗀𝗇⁢(m,𝒮⁢𝒦),𝒫⁢𝒦) for all (𝒫⁢𝒦,𝒮⁢𝒦)←Gen-Sign⁢(1κ) and all messages m∈ℳ.

2.7 Unforgeability of public key signature

Definition 2.7

A PKS scheme is said to be strongly unforgeable (sUF-CMA) if for all PPT adversaries 𝒜, the advantage 𝖠𝖽𝗏𝒜,PKSsUF-CMA⁢(κ) is at most a negligible function in κ, where 𝒜 is provided the access to sign oracle 𝒪Sg and NRn is the natural restriction that if δ←𝒪Sg⁢(m,𝒫⁢𝒦), then (m,δ)≠(m∗,δ∗).

𝖠𝖽𝗏𝒜,PKSsUF-CMA⁢(κ):=Pr⁡[(𝒫⁢𝒦,𝒮⁢𝒦)←Gen-Sign⁢(1κ);(m∗,δ∗)←𝒜𝒪Sg⁢(1κ,𝒫⁢𝒦):𝖵𝖾𝗋⁢(m∗,δ∗,𝒫⁢𝒦)=1∧𝖭𝖱𝗇].

A weaker version of strong unforgeability is called simply unforgeability or weak unforgeability (UF-CMA), where the condition (m,δ)≠(m∗,δ∗) is replaced by m≠m∗.

One-time signature. A signature scheme is said to be one-time signature scheme (OTS) if 𝒜 is allowed to access the oracle 𝒪Sg at most once. Throughout, we use the notations (𝗏𝗄,𝗌𝗂𝗀𝗇𝗄), (OTS.Gen,OTS.Sign,OTS.Ver) and 𝖠𝖽𝗏𝒜,𝖮𝖳𝖲sUF-CMA⁢(κ) for (𝒫⁢𝒦,𝒮⁢𝒦), (Gen-Sign,𝖲𝗂𝗀𝗇,𝖵𝖾𝗋) and 𝖠𝖽𝗏𝒜,PKSsUF-CMA⁢(κ), respectively, to represent the objects related to strongly unforgeable OTS.

Instantiation of strongly unforgeable OTS. There are many OTS schemes [21, 39, 37] available in the literature, but most of them are not strongly unforgeable. The OTS schemes which follow the one-way function paradigm of [16] can be transformed to strongly unforgeable OTS schemes by the transformation of [16]. The transformation of [16] is based on the universal one-way hash function (UOWHF) of [32]. The public key vk of the strongly unforgeable OTS in [16] includes the description of 2⁢ℓ randomly chosen UOWHFs (where ℓ is the size of the message), so the size of the public key vk becomes larger. To solve this issue, Huang et al. [19] proposed a generic construction, where the one-way function of the primitive weakly unforgeable OTS is replaced by a randomly one (collision-resistance) hash function. They showed an efficient instantiation of strongly unforgeable OTS, referred to as strong HORS, using the efficient weakly unforgeable OTS [39]. For details, we refer to [19, Section 5].

2.8 Public key signcryption scheme

A signcryption scheme in the PKI setting consists of five PPT algorithms: Setup, 𝖪𝖾𝗒𝖦𝖾𝗇R, 𝖪𝖾𝗒𝖦𝖾𝗇S, Signcrypt and Unsigncrypt.

Setup. Input: a security parameter κ. Output: public parameters 𝒫⁢𝒫.
𝖪𝖾𝗒𝖦𝖾𝗇S. Input: public parameters 𝒫⁢𝒫. Output: a public key and private key pair (𝒫⁢𝒦S,𝒮⁢𝒦S) for the sender.
𝖪𝖾𝗒𝖦𝖾𝗇R. Input: public parameters 𝒫⁢𝒫. Output: a public key and private key pair (𝒫⁢𝒦R,𝒮⁢𝒦R) for the receiver.
Signcrypt. Input: public parameters 𝒫⁢𝒫, a message m, the sender’s private key 𝒮⁢𝒦S and the receiver’s public key 𝒫⁢𝒦R. Output: a signcryption.
Unsigncrypt. Input: public parameters 𝒫⁢𝒫, a signcryption U, the receiver’s private key 𝒮⁢𝒦R and the sender’s public key 𝒫⁢𝒦S. Output: a message m or ⊥ (indicates invalid).

For correctness, it is required that 𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,𝒮⁢𝒦S,𝒫⁢𝒦R),𝒮⁢𝒦R,𝒫⁢𝒦S)=m for all 𝒫⁢𝒫←𝖲𝖾𝗍𝗎𝗉⁢(1κ), all (𝒫⁢𝒦S,𝒮⁢𝒦S)←𝖪𝖾𝗒𝖦𝖾𝗇S⁢(𝒫⁢𝒫), all (𝒫⁢𝒦R,𝒮⁢𝒦R)←𝖪𝖾𝗒𝖦𝖾𝗇R⁢(𝒫⁢𝒫) and all m∈ℳ.

2.9 Security of signcryption

The dynamic multi-user insider models [30, 25] for confidentiality and unforgeability are defined below.

Definition 2.8

A signcryption scheme is said to be adaptively secure (dM-IND-iCCA) if for all PPT adversaries 𝒜:=(𝒜1,𝒜2), the advantage 𝖠𝖽𝗏𝒜,𝖲𝖢IND-CCA⁢(κ) is at most a negligible function in security parameter κ, where 𝒜 is provided the access to unsigncrypt oracle 𝒪U and signcrypt oracle 𝒪S and NRn is the natural restriction that (𝖴∗,𝒫⁢𝒦S∗) was never queried to 𝒪U and (𝒫⁢𝒦S∗,𝒮⁢𝒦S∗) is a valid pair.

𝖠𝖽𝗏𝒜,𝖲𝖢IND-CCA⁢(κ):=|Pr⁡[𝒫⁢𝒫←𝖲𝖾𝗍𝗎𝗉⁢(1κ);(𝒫⁢𝒦R∗,𝒮⁢𝒦R∗)←𝖪𝖾𝗒𝖦𝖾𝗇R⁢(𝒫⁢𝒫);(m0,m1,𝒫⁢𝒦S∗,𝒮⁢𝒦S∗,s⁢t)←𝒜1{𝒪S,𝒪U}⁢(𝒫⁢𝒫,𝒫⁢𝒦R∗);b←U{0,1};𝖴∗←𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,mb,𝒮⁢𝒦S∗,𝒫⁢𝒦R∗);b′←𝒜2{𝒪S,𝒪U}⁢(𝒫⁢𝒫,𝒫⁢𝒦R∗,𝒫⁢𝒦S∗,𝒮⁢𝒦S∗,𝖴∗,s⁢t):b=b′∧𝖭𝖱𝗇]-12|.

Definition 2.9

A signcryption scheme is said to be strong unforgeable (dM-sUF-iCMA) if for all PPT adversaries 𝒜, the advantage 𝖠𝖽𝗏𝒜,𝖲𝖢sUF-CMA⁢(κ) is at most a negligible function in κ, where 𝒜 is provided the access to unsigncrypt oracle 𝒪U and signcrypt oracle 𝒪S and NRn is the natural restriction that if U is the replied signcryption for (m,𝒫⁢𝒦R), then (𝖴,m,𝒫⁢𝒦R)≠(𝖴∗,m∗,𝒫⁢𝒦R∗) and (𝒫⁢𝒦R∗,𝒮⁢𝒦R∗) is a valid pair.

𝖠𝖽𝗏𝒜,𝖲𝖢sUF-CMA⁢(κ):=Pr⁡[𝒫⁢𝒫←𝖲𝖾𝗍𝗎𝗉⁢(1κ);(𝒫⁢𝒦S∗,𝒮⁢𝒦S∗)←𝖪𝖾𝗒𝖦𝖾𝗇S⁢(𝒫⁢𝒫);(𝖴∗,𝒫⁢𝒦R∗,𝒮⁢𝒦R∗)←𝒜{𝒪S,𝒪U}⁢(𝒫⁢𝒫,𝒫⁢𝒦S∗,𝒫⁢𝒦R∗,𝒮⁢𝒦R∗);m∗←𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖴∗,𝒫⁢𝒦R∗,𝒮⁢𝒦S∗):m∗≠⊥∧𝖭𝖱𝗇].

A weaker version of strong unforgeability is called simply unforgeability or weak unforgeability (dM-UF-iCMA), where the condition (𝖴,m,𝒫⁢𝒦R)≠(𝖴∗,m∗,𝒫⁢𝒦R∗) is replaced by (m,𝒫⁢𝒦R)≠(m∗,𝒫⁢𝒦R∗).

2.10 Attribute-based encryption

Let 𝒰 be a universe of attributes. Let Γ be an access structure over 𝒰 and A be a subset of 𝒰. We say Γ is satisfied by A if A∈Γ. Let ΣΓ:={Γ|Γ⊂2𝒫∖{∅}} and ΣA:={A|A⊂𝒰}. We define a binary relation ∼ over ΣA×ΣΓ (resp. ΣΓ×ΣA) as follows: A∼Γ (resp. Γ∼A) if and only if A∈Γ.

Terminology. From now onwards, we use the notations 𝒳 and 𝒴 to denote the set of key indices and the set of associated data indices, respectively. For the attribute-based setting, we assume (𝒳,𝒴) carries the meaning of either (ΣA,ΣΓ) or (ΣΓ,ΣA). Let 𝒋:=𝒰 be called the system parameter. So, it is clear that 𝒳 and 𝒴 are defined over 𝒋.

An attribute-based encryption (ABE) scheme consists of four PPT algorithms: Setup, KeyGen, Encrypt and Decrypt.

Setup takes a security parameter κ and a system parameter 𝒋 as input and outputs public parameters 𝒫⁢𝒫 and master secret ℳ⁢𝒮⁢𝒦.
KeyGen takes as input public parameters 𝒫⁢𝒫, master secret ℳ⁢𝒮⁢𝒦 and a key index x∈𝒳 and outputs a secret key 𝒮⁢𝒦x corresponding to x.
Encrypt takes public parameters 𝒫⁢𝒫, a message m and an associated data index y∈𝒴 as input and returns a ciphertext C which implicitly contains y.
Decrypt takes as input public parameters 𝒫⁢𝒫, a ciphertext C and a secret key 𝒮⁢𝒦x. It returns a value from ℳ∪{⊥}.

For correctness, it is required that x∼y implies 𝖣𝖾𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖤𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,y),𝒮⁢𝒦x)=m for all (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋), all x∈𝒳, all 𝒮⁢𝒦x←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x), all y∈𝒴 and all m∈ℳ.

An attribute-based encryption is called ciphertext-policy attribute-based encryption (CP-ABE) if (𝒳,𝒴)=(ΣA,ΣΓ); otherwise it is called the key-policy attribute-based encryption (KP-ABE).

2.11 Security of ABE scheme

Definition 2.10

Definition 2.10 (Adaptive-predicate IND-CCA security)

An ABE scheme is said to be adaptively secure (AP-IND-CCA) if for all PPT adversaries 𝒜:=(𝒜1,𝒜2), the advantage 𝖠𝖽𝗏𝒜,ABEIND-CCA⁢(κ) is at most a negligible function in security parameter κ, where 𝒜 is provided the access to keyGen oracle 𝒪K and decrypt oracle 𝒪D and NRn is the natural restriction that (𝖢∗,x) with x∼y∗ was never queried to 𝒪D, and x≁y∗ for each key index x queried to 𝒪K.

𝖠𝖽𝗏𝒜,ABEIND-CCA⁢(κ):=|Pr⁡[(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋);(m0,m1,y∗,s⁢t)←𝒜1{𝒪K,𝒪D}⁢(𝒫⁢𝒫);b←U{0,1};𝖢∗←𝖤𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,mb,y∗);b′←𝒜2{𝒪K,𝒪D}⁢(𝒫⁢𝒫,𝖢∗,s⁢t):b=b′∧𝖭𝖱𝗇]-12|.

Likewise in selective-predicate IND-CCA (SP-IND-CCA) security, the adversary 𝒜 submits the challenge index y∗ before receiving 𝒫⁢𝒫 of ABE.

A weaker notion of security can be defined similarly as above, except 𝒜 is not allowed to access the 𝒪D oracle. It is called IND-CPA security in both adaptive-predicate (AP-IND-CPA) and selective predicate (SP-IND-CPA) models.

2.12 Attribute-based signature

An attribute-based signature (ABS) scheme consists of four PPT algorithms: Setup, KeyGen, Sign and Ver.

Setup takes a security parameter κ and a system parameter 𝒋 as input and outputs public parameters 𝒫⁢𝒫 and master secret ℳ⁢𝒮⁢𝒦.
KeyGen takes as input public parameters 𝒫⁢𝒫, master secret ℳ⁢𝒮⁢𝒦 and a key index x∈𝒳 and outputs a secret key 𝒮⁢𝒦x corresponding to x.
Sign takes public parameters 𝒫⁢𝒫, a message m, a secret key 𝒮⁢𝒦x and an associated data index y∈𝒴 with x∼y and returns a signature δ.
Ver receives public parameters 𝒫⁢𝒫, a message m, a signature δ and a claim associated data index y as input. It returns a boolean value 1 for acceptance or 0 for rejection.

For correctness, it is required that 𝖵𝖾𝗋⁢(𝒫⁢𝒫,m,𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x,y),y)=1 for all (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋), all messages m∈ℳ, all x∈𝒳, all 𝒮⁢𝒦x←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x) and all indices y∈𝒴 with x∼y.

2.13 Security of ABS scheme

Definition 2.11

Definition 2.11 (Signer privacy)

An ABS scheme is said to be perfectly private if for all (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉, all key indices x1,x2∈𝒳, all keys 𝒮⁢𝒦x1←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x1), 𝒮⁢𝒦x2←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x2), all messages m∈ℳ, and all claim indices y∈𝒴 such that x1∼y and x2∼y, the distributions of 𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x1,y) and 𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x2,y) are identical.

Next, we define an alternative signature algorithm, 𝖠𝗅𝗍𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,ℳ⁢𝒮⁢𝒦,y): it first produces a secret key 𝒮⁢𝒦x←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x) for a key index x such that x∼y and then runs δ←𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x,y). For an ABS scheme with signer-privacy, 𝖠𝗅𝗍𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,ℳ⁢𝒮⁢𝒦,y) and 𝖲𝗂𝗀𝗇⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x,y) are identical for all x with x∼y. Therefore, we may replace the Sign oracle by the AltSign oracle for an ABS with signer-privacy whenever it is required.

Definition 2.12

Definition 2.12 (Adaptive-predicate unforgeability)

An ABS scheme is said to be adaptive-predicate existential unforgeable (AP-UF-CMA) if for all PPT adversaries 𝒜, the advantage 𝖠𝖽𝗏𝒜,ABSUF-CMA⁢(κ) is at most a negligible function in κ, where 𝒜 is provided the access to keyGen oracle 𝒪K and sign oracle 𝒪Sg and NRn is the natural restriction that (m∗,y∗) was never queried to 𝒪Sg oracle, and x≁y∗ for each key index x queried to 𝒪K.

𝖠𝖽𝗏𝒜,ABSUF-CMA⁢(κ):=Pr⁡[(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋);(δ∗,m∗,y∗)←𝒜{𝒪K,𝒪Sg}⁢(𝒫⁢𝒫):𝖵𝖾𝗋⁢(𝒫⁢𝒫,m∗,δ∗,y∗)=1∧𝖭𝖱𝗇].

Remark 2.13

The above unforgeability is also called weak unforgeability in the sense that 𝒜 is not allowed to forge for the queried messages. In strong unforgeability (we use notation AP-sUF-CMA), the adversary 𝒜 may forge δ∗ for a queried message pair (m∗,y∗) but the replied signature δ on (m∗,y∗) must be different from δ∗.

Remark 2.14

There is another variant of unforgeability, called selective-predicate unforgeability in both weak and strong sense, where 𝒜 submits a challenge index y∈𝒴 (later on which it will forge) before obtaining the 𝒫⁢𝒫 of ABS.

UF-NMA. So far, we have defined the unforgeability in chosen message attack, where 𝒜 is allowed to ask for any number (polynomial) of signature queries of his own choice. In contrast, 𝒜 is forbidden to ask any signature query in no message attack (NMA). Similarly to above, the unforgeability can be defined in the sense of selective-predicate (called SP-UF-NMA) and adaptive-predicate (AP-UF-NMA).

SP-ABS and KP-ABS. Similar to ABE, there are two forms of ABS, signature-policy attribute-based signature (SP-ABS) and key-policy attribute-based signature (KP-ABS). The ABS is called the SP-ABS if (𝒳,𝒴)=(ΣA,ΣΓ) and KP-ABS if (𝒳,𝒴)=(ΣΓ,ΣA).

2.14 Attribute-based signcryption

An attribute-based signcryption (ABSC) scheme consists of four PPT algorithms: Setup, KeyGen, Signcrypt and Unsigncrypt.

Setup takes a security parameter κ and a system parameter 𝒋 as input, outputs the public parameters 𝒫⁢𝒫 and the master secret ℳ⁢𝒮⁢𝒦. The index spaces 𝒳 and 𝒴 are defined over the system parameter 𝒋.
KeyGen takes public parameters 𝒫⁢𝒫, master secret ℳ⁢𝒮⁢𝒦 and a key index x∈𝒳 as input and outputs a secret key 𝒮⁢𝒦x corresponding to x.
Signcrypt takes public parameters 𝒫⁢𝒫, a message m∈ℳ, a signing key 𝒮⁢𝒦x, an associated data index ys∈𝒴 for signer with x∼ys and an associated data index ye∈𝒴 for receiver as input and returns a signcryption U for (ys,ye) (we assume that U implicitly contains ye).
Unsigncrypt takes as input public parameters 𝒫⁢𝒫, a signcryption U, a secret key 𝒮⁢𝒦x and an associated index ys∈𝒴 for signer. It returns a value from ℳ∪{⊥}.

For correctness, it is required that 𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖴,𝒮⁢𝒦x~,ys)=m for all (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋), all m∈ℳ, all key indices x∈𝒳, all 𝒮⁢𝒦x←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x), all signer associated indices ys∈𝒴 with x∼ys, all receiver’s associated indices ye∈𝒴, all signcryptions 𝖴←𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x,ys,ye), all key indices x~∈𝒳 with x~∼ye, and all 𝒮⁢𝒦x~←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x~).

2.15 Security of ABSC

Definition 2.15

Definition 2.15 (Signer privacy)

An ABSC scheme is said to be perfectly private if for all (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉, all key indices x1,x2∈𝒳, all keys 𝒮⁢𝒦x1←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x1), 𝒮⁢𝒦x2←𝖪𝖾𝗒𝖦𝖾𝗇⁢(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦,x2), all messages m∈ℳ, all signer associated indices ys∈𝒴 such that x1∼ys and x2∼ys, and all receiver’s associated indices ye∈𝒴, the distributions of 𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x1,ys,ye) and 𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x2,ys,ye) are identical.

Similar to AltSign defined in Section 2.13, for the ABSC scheme having signer-privacy, one may replace the 𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,𝒮⁢𝒦x,ys,ye) oracle by an alternative signcrypt oracle 𝖠𝗅𝗍𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,m,ℳ⁢𝒮⁢𝒦,ys,ye) in the following two definitions.

Definition 2.16

Definition 2.16 (Adaptive-predicates IND-CCA security)

An ABSC scheme is said to be adaptively secure (APs-IND-CCA) if for all PPT adversaries 𝒜:=(𝒜1,𝒜2), the advantage 𝖠𝖽𝗏𝒜,ABSCIND-CCA⁢(κ) is at most a negligible function in security parameter κ, where 𝒜 is provided the access to keyGen oracle 𝒪K, signcrypt oracle 𝒪S and unsigncrypt oracle 𝒪U, and NRn is the natural restriction that (𝖴∗,x,ys∗) with x∼ye∗ was never queried to 𝒪U, and x≁ye∗ for each key index x queried to 𝒪K.

𝖠𝖽𝗏𝒜,ABSCIND-CCA⁢(κ):=|Pr⁡[(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋);(m0,m1,x,ys∗,ye∗,s⁢t)←𝒜1{𝒪K,𝒪S,𝒪U}⁢(𝒫⁢𝒫);b←U{0,1};𝖴∗←𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,mb,𝒮⁢𝒦x,ys∗,ye∗);b′←𝒜2{𝒪K,𝒪S,𝒪U}⁢(𝒫⁢𝒫,𝖴∗,s⁢t):b=b′∧𝖭𝖱𝗇]-12|.

Definition 2.17

Definition 2.17 (Selective-predicate IND-CCA security)

Similarly to Definition 2.16, except in this model, 𝒜 has to submit the challenge receiver’s data-index ye∗ before receiving 𝒫⁢𝒫 of ABSC and the challenge sender’s data-index ys∗ in the challenge phase.

Remark 2.18

The selective-predicate IND-CCA (SP-IND-CCA) security model (Definition 2.17) is weaker than the APs-IND-CCA security model (Definition 2.16).

Definition 2.19

Definition 2.19 (Selective-predicates IND-CCA security)

Similarly to Definition 2.16, except in this model, 𝒜 has to submit the challenge receiver’s data-index ye∗ and challenge sender’s data-index ys∗ before receiving 𝒫⁢𝒫 of ABSC.

Remark 2.20

Selective-predicates IND-CCA (SPs-IND-CCA) security model (Definition 2.19) is weaker than the SP-IND-CCA security model (Definition 2.17).

Definition 2.21

Definition 2.21 (Adaptive-predicates unforgeability)

An ABSC scheme is said to be adaptive-predicates existential unforgeable (APs-UF-CMA) if for all PPT 𝒜, the advantage 𝖠𝖽𝗏𝒜,ABSCUF-CMA⁢(κ) is at most a negligible function in κ, where 𝒜 is provided the access to keyGen oracle 𝒪K, signcrypt oracle 𝒪S and unsigncrypt oracle 𝒪U, and NRn is the natural restriction that (m∗,ys∗,ye∗) was never queried to oracle 𝒪S, and x≁ys∗ for each key index x∈𝒳 queried to 𝒪K oracle.

𝖠𝖽𝗏𝒜,ABSCUF-CMA⁢(κ):=Pr⁡[(𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋);(𝖴∗,ys∗,ye∗)←𝒜{𝒪K,𝒪S,𝒪U}⁢(𝒫⁢𝒫);m∗←𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖴∗,𝒮⁢𝒦x,ys∗,ye∗);where ⁢x∼ye∗:m∗≠⊥∧𝖭𝖱𝗇].

Definition 2.22

Definition 2.22 (Adaptive-predicates strong unforgeability)

The above unforgeability (Definition 2.21) is also called weak unforgeability in the sense that 𝒜 is not allowed to forge for the queried messages. In strong unforgeability (we use the notation APs-sUF-CMA), the restriction (m,ys,ye)≠(m∗,ys∗,ye∗) is replaced by (𝖴,m,ys,ye)≠(𝖴∗,m∗,ys∗,ye∗), where U is the reply for the query (m,x,ys,ye) to oracle 𝒪S.

Definition 2.23

Definition 2.23 (Selective-predicate strong unforgeability)

Similarly to Definition 2.22, except in this model, 𝒜 has to submit the challenge sender’s data-index ys∗ before receiving 𝒫⁢𝒫 of ABSC and the challenge receiver’s data-index ye∗ at the time of forgery.

Remark 2.24

The selective-predicate sUF-CMA (SP-sUF-CMA) security model (Definition 2.23) is weaker than the APs-sUF-CMA security model (Definition 2.22).

Definition 2.25

Definition 2.25 (Selective-predicates strong unforgeability)

Similarly to Definition 2.22, except in this model, 𝒜 has to submit the challenge sender’s data-index ys∗ and challenge receiver’s data-index ye∗ before receiving 𝒫⁢𝒫 of ABSC.

Remark 2.26

Selective-predicates sUF-CMA (SPs-sUF-CMA) security model (Definition 2.25) is weaker than the SP-sUF-CMA security model (Definition 2.23).

Discussion. In this paper, we are interested in ABSC based on “combined-framework” (mainly) and “independent-framework”. In case of independent-framework, the system parameter is of the form 𝒋:=(𝒋s,𝒋e), where 𝒋s and 𝒋e are the system parameters for the signing and encryption, respectively. The key space and associated data space are of the form 𝒳:=(𝒳s,𝒳e) and 𝒴:=(𝒴s,𝒴e), where (𝒳s,𝒴s) and (𝒳e,𝒴e) are defined over 𝒋s and 𝒋e, respectively. For a combined-framework, 𝒋:=𝒋s=𝒋e, 𝒳:=𝒳s=𝒳e, 𝒴:=𝒴s=𝒴e and 𝒮⁢𝒦x:=𝒮⁢𝒦xs=𝒮⁢𝒦xe, i.e., the signing key and decryption key are the same.

Variants of ABSC. Note that the system parameter 𝒋=(𝒋s,𝒋e) is basically the universe, 𝒰=(𝒰s,𝒰e). Let Γs and Γe be the policies over the universes 𝒰s and 𝒰e, respectively. Let As and Ae be the sets of attributes from the universes 𝒰s and 𝒰e, respectively. With the styles of ABS and ABE, there are four forms of ABSC, namely S-E-ABSC for S∈{SP, KP}, E∈{CP,KP}. More formally, the indices in SP-CP-ABSC, KP-KP-ABSC, SP-KP-ABSC and KP-CP-ABSC are respectively represented by

(xs:=As,ys:=Γsxe:=Ae,ye:=Γe),(xs:=Γs,ys:=Asxe:=Γe,ye:=Ae),(xs:=As,ys:=Γsxe:=Γe,ye:=Ae),(xs:=Γs,ys:=Asxe:=Ae,ye:=Γe).

We note that there are only two variants of ABSC based on combined-framework, viz., SP-CP-ABSC and KP-KP-ABSC.

3 Review of commit then encrypt and sign paradigm

In this section, we discuss the 𝒞⁢t⁢ℰ&𝒮 paradigm of [1] in details in two-user insider models and it can be easily extended to the multi-user insider model. Let Π𝖯𝖪𝖤:=(Gen-Enc, ℰ, 𝒟), Π𝖯𝖪𝖲:=(Gen-Sign, 𝒮, 𝒱) and Π𝖢𝗈𝗆𝗆𝗂𝗍:=(C.Setup, Commit, 𝖮𝗉𝖾𝗇) be the primitive encryption scheme, signature scheme and commitment scheme, respectively. Let R and S denote receiver and sender, respectively. The public parameters of the signcryption scheme are set as 𝒫⁢𝒫:=𝒞⁢𝒦, where 𝒞⁢𝒦←C.Setup⁢(1κ). The receiver’s public key and private key pair is obtained by running (𝒫⁢𝒦R,𝒮⁢𝒦R)←Gen-Enc⁢(1κ) and similarly the sender’s public key and private key pair is (𝒫⁢𝒦S,𝒮⁢𝒦S), where (𝒫⁢𝒦S,𝒮⁢𝒦S)←Gen-Sign⁢(1κ). To signcrypt a message m, the sender runs (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(m), then executes in parallel δ←𝒮⁢(𝖼𝗈𝗆,𝒮⁢𝒦S) and 𝖢←ℰ(𝖽𝖾𝖼𝗈𝗆, 𝒫𝒦R) and returns the signcryption 𝖴:=(𝖼𝗈𝗆,δ,𝖢). To unsigncrypt a signcryption U, the receiver runs 𝖿𝗅𝖺𝗀←𝒱⁢(δ,𝒫⁢𝒦S) and 𝖽𝖾𝖼𝗈𝗆←𝒟⁢(𝖢,𝒮⁢𝒦R) in parallel. If 𝖿𝗅𝖺𝗀=𝖳𝗋𝗎𝖾, it returns 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆), else ⊥.

For the proof of confidentiality of the 𝒞⁢t⁢ℰ&𝒮 paradigm, An et al. [1] assumed a property of the commitment scheme that for each decom there is a unique com. In this paper, we refer to this property as the concealment property (defined in Section 2.3). Actually, in the confidentiality proof a weaker version of the concealment property, called relaxed-concealment, was used. The security of the 𝒞⁢t⁢ℰ&𝒮 paradigm are guaranteed by the following theorem.

Theorem 3.1

Theorem 3.1 ([1, Theorem 4])

Assume that ΠPKE is IND-gCCA secure, ΠPKS is UF-CMA secure and ΠCommit is a commitment scheme. Suppose ΠCommit has the relaxed-concealment property. Then, in the insider security model, we have:

𝒞⁢t⁢ℰ&𝒮 is IND-gCCA secure if and only if Π𝖢𝗈𝗆𝗆𝗂𝗍 satisfies the hiding properties.
𝒞⁢t⁢ℰ&𝒮 is UF-CMA secure if and only if Π𝖢𝗈𝗆𝗆𝗂𝗍 satisfies the relaxed-binding properties.

Thus, the security of ΠPKE and ΠPKS are preserved in C⁢t⁢E&S if and only if ΠCommit has the hiding and relaxed-binding and relaxed-concealment properties.

Requirement of relaxed-concealment. Here we provide a motivation for using the relaxed concealment property of the commitment scheme in the 𝒞⁢t⁢ℰ&𝒮 paradigm. This motivation will be used to describe the design principle of the new paradigm 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 in Section 4.1. As discussed in [1, Section 5], a commitment scheme whose decommitment is of the form 𝖽𝖾𝖼𝗈𝗆=(m,r), where r is the randomness used in Commit, possesses the concealment property. We pick up the commitment scheme from Halevi and Micali [18], which is not in the above form. This commitment scheme has hiding and binding properties in the standard model, but does not enjoy the relaxed-concealment property. We briefly describe Halevi and Micali’s commitment scheme. Let H:={h:T→ℳ} be a family of universal hash functions, where ℳ:={0,1}n is a message space and T:={0,1}ℓ. Let ℳ⁢𝒟:T→{0,1}k be a message digest function. To commit a message m∈ℳ, it chooses a member (x,h)∈T×H randomly such that h⁢(x)=m and returns (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆), where 𝖼𝗈𝗆:=(h,y), y:=ℳ⁢𝒟⁢(x) and 𝖽𝖾𝖼𝗈𝗆:=x. To open the commitment, it checks y=?ℳ⁢𝒟⁢(𝖽𝖾𝖼𝗈𝗆) and if equality holds, returns h⁢(𝖽𝖾𝖼𝗈𝗆), else ⊥. Now we show that the above commitment scheme does not possess the relaxed-concealment property. An adversary 𝒜 gives a message m of its own choice. Then 𝒜 is provided (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆) of the message m, where 𝖼𝗈𝗆:=(h,y), y:=ℳ⁢𝒟⁢(x), m=h⁢(x) and 𝖽𝖾𝖼𝗈𝗆:=x. Finally, 𝒜 submits 𝖼𝗈𝗆~:=(h~,y) as an evidence for breaking the relaxed-concealment property, where h~ (≠h) is any member of the family H. Since 𝖼𝗈𝗆≠𝖼𝗈𝗆~ and 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆~,𝖽𝖾𝖼𝗈𝗆)=h~⁢(x)=m~≠⊥, (𝖼𝗈𝗆~,𝖽𝖾𝖼𝗈𝗆) is a valid commitment and decommitment pair.

Using the above commitment scheme [18], we show that signcryption in the 𝒞⁢t⁢ℰ&𝒮 paradigm does not preserve IND-gCCA security of the primitive encryption scheme Π𝖯𝖪𝖤 in insider model. In fact, we show that the signcryption in the 𝒞⁢t⁢ℰ&𝒮 paradigm is not even OW-gCCA secure. We consider the family of universal hash functions to be H:={hL,b:L∈{0,1}n×ℓ,b∈{0,1}n}, where hL,b is defined by hL,b⁢(r):=L⁢r⊕b and ⊕ stands for the bitwise XOR-operation. An adversary 𝒜 is given a challenge signcryption 𝖴∗=(𝖼𝗈𝗆∗,δ∗,𝖢∗) of an arbitrary message m∗, where

𝖼𝗈𝗆∗=(h∗,y∗),h∗:=hL∗,b∗,m∗=h∗⁢(𝖽𝖾𝖼𝗈𝗆∗),𝖽𝖾𝖼𝗈𝗆∗∈T,

y∗=ℳ⁢𝒟⁢(𝖽𝖾𝖼𝗈𝗆∗),𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆∗),δ∗←𝒮⁢(𝖼𝗈𝗆∗,𝒮⁢𝒦S∗).

The adversary 𝒜 picks b~∈{0,1}n∖{0⁢⋯⁢0} and sets

h~:=hL∗,b∗⊕b~.

Using 𝒮⁢𝒦S∗ of the sender, 𝒜 produces a new signcryption 𝖴~:=(𝖼𝗈𝗆~,δ~,𝖢∗), where 𝖼𝗈𝗆~:=(h~,y∗) and δ~:=𝒮⁢(𝖼𝗈𝗆~,𝒮⁢𝒦S∗). Since

𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝖴~,𝒮⁢𝒦R∗,𝒫⁢𝒦S∗)=h~⁢(𝖽𝖾𝖼𝗈𝗆∗)=hL∗,b∗⊕b~⁢(𝖽𝖾𝖼𝗈𝗆∗)

=hL∗,b∗⁢(𝖽𝖾𝖼𝗈𝗆∗)⊕b~=h∗⁢(𝖽𝖾𝖼𝗈𝗆∗)⊕b~=m∗⊕b~

≠m∗=𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝖴∗,𝒮⁢𝒦R∗,𝒫⁢𝒦S∗),

we have ℛ⁢((𝖴∗,𝒫⁢𝒦S∗),(𝖴~,𝒫⁢𝒦S∗))=𝖥𝖺𝗅𝗌𝖾. The adversary 𝒜 makes an unsigncrypt oracle query on (𝖴~,𝒫⁢𝒦S∗) and gets back m∗⊕b~ as reply. Since b~ is known to 𝒜, it recovers the underlying message m∗ of 𝖴∗. Hence, the signcryption in the 𝒞⁢t⁢ℰ&𝒮 paradigm using the commitment scheme of [18] is not OW-gCCA secure in the insider model. We note that the above attack happens due to the following reason. The signcryptions 𝖴∗ and 𝖴~ have different commitments 𝖼𝗈𝗆∗ and 𝖼𝗈𝗆~, but identical decommitment 𝖽𝖾𝖼𝗈𝗆∗, such that (𝖼𝗈𝗆~,𝖽𝖾𝖼𝗈𝗆∗) is a valid commitment and decommitment pair. The above happens due to the lack of the relaxed-concealment property of [18]. Therefore, the relaxed-concealment property is a very crucial requirement for preserving IND-gCCA security in the 𝒞⁢t⁢ℰ&𝒮 paradigm.

3.1 Ambiguity in proof of confidentiality

As discussed above, IND-gCCA security of Π𝖯𝖪𝖤 is preserved in the 𝒞⁢t⁢ℰ&𝒮 paradigm if the commitment scheme has hiding and relaxed-concealment properties. But, the IND-gCCA security proof of the 𝒞⁢t⁢ℰ&𝒮 paradigm described in [1] is ambiguous. In fact, their proof of confidentiality does not even work for IND-CPA security. Here is the illustration. Let Π𝖯𝖪𝖤′:=(Gen-Enc′,ℰ′,𝒟′) be an auxiliary encryption scheme defined as follows:

Gen-Enc′⁢(1κ): Gen-Enc⁢(1κ);
ℰ′⁢(m): returns 𝖴:=(𝖼𝗈𝗆,𝖢), where (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(m) and 𝖢←ℰ⁢(𝖽𝖾𝖼𝗈𝗆) (for simplicity, we omit either the private key or public key from the inputs of the respective algorithms);
𝒟′⁢(𝖴): returns 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝒟⁢(𝖢)), where 𝖴=(𝖼𝗈𝗆,𝖢).

To conclude the confidentiality part of Theorem 3.1, it is sufficient to prove the following lemma.

Lemma 3.2

Lemma 3.2 (cf. [1, Lemma 1])

If ΠPKE is IND-gCCA secure and ΠCommit has hiding and relaxed-concealment properties, then ΠPKE′ is IND-gCCA secure.

To prove this lemma, An et al. [1] defined two environments: Env1 and Env2. Env1 is the real environment and Env2 is the same as Env1 except for the challenge ciphertext construction, i.e., in Env2 the challenge ciphertext is of the form 𝖴∗:=(𝖼𝗈𝗆⁢(0),𝖢∗), where (𝖼𝗈𝗆⁢(0),𝖽𝖾𝖼𝗈𝗆⁢(0))←𝖢𝗈𝗆𝗆𝗂𝗍⁢(0) and (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mb) with b←U{0,1} and 𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆∗). An et al. first showed that Env1 and Env2 are indistinguishable under the hiding property of the commitment scheme; see the proof of [1, Lemma 1 (B)]. Then they showed that 𝒜 has at most negligible advantage in Env2 if the primitive encryption scheme is IND-gCCA secure and Π𝖢𝗈𝗆𝗆𝗂𝗍 has the relaxed-concealment property.

We claim that Env1 and Env2 are not indistinguishable under the hiding property of Π𝖢𝗈𝗆𝗆𝗂𝗍. Indeed, we assume that the primitive encryption scheme Π𝖯𝖪𝖤 is not OW-CPA. For example, consider the encryption function of Π𝖯𝖪𝖤 to be the identity function. So, one can recover the message from a given ciphertext C. The only difference between Env1 and Env2 is the construction of the challenge ciphertext in the auxiliary encryption scheme Π𝖯𝖪𝖤′. Suppose the challenge ciphertext 𝖴∗:=(𝖼𝗈𝗆~,𝖢∗) is given to 𝒜, where (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mb), 𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆∗) and 𝖼𝗈𝗆~←U{𝖼𝗈𝗆∗,𝖼𝗈𝗆⁢(0)}. Since Π𝖯𝖪𝖤 is not OW-CPA, so 𝒜 can recover 𝖽𝖾𝖼𝗈𝗆∗ from 𝖢∗. Then 𝒜 runs 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆~,𝖽𝖾𝖼𝗈𝗆∗) and if Open outputs m0 or m1, then 𝒜 confirms Env1, else Env2.

Essentially, we found an issue in the simulation described in [1]. An et al. showed that if an adversary 𝒜′ can distinguish Env1 and Env2, then a simulator 𝒜1 can be constructed to break the hiding property of Π𝖢𝗈𝗆𝗆𝗂𝗍 as follows. In the simulation, 𝒜′ sends two equal length messages m0 and m1 to 𝒜1. Then 𝒜1 picks b←U{0,1} and sends 0,mb to the challenger 𝒞⁢ℋ of Π𝖢𝗈𝗆𝗆𝗂𝗍. Then 𝒞⁢ℋ chooses m∗←U{0,mb} and returns 𝖼𝗈𝗆∗ to 𝒜1, where (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(m∗). Now, 𝒜1 answers the challenge ciphertext 𝖴∗:=(𝖼𝗈𝗆∗,𝖢∗←ℰ(𝖽𝖾𝖼𝗈𝗆∗)) for Π𝖯𝖪𝖤′ to 𝒜′. However, it was not clear from the simulation proof, nor could we perceive, how 𝒜1 could construct the challenge ciphertext 𝖴∗ without the knowledge of 𝖽𝖾𝖼𝗈𝗆∗. We therefore give a revised proof below.

3.2 Revised proof of 𝒞⁢t⁢ℰ&𝒮 paradigm

Theorem 3.3

If ΠPKE is IND-gCCA secure and the commitment scheme ΠCommit has hiding and relaxed-concealment properties, then the auxiliary encryption scheme ΠPKE′ is IND-gCCA secure.

Proof.

Let R be the underlying decryption-respecting relation of the IND-gCCA secure encryption scheme Π𝖯𝖪𝖤. We define a relation ℛ′ over ciphertexts for Π𝖯𝖪𝖤′ as follows: ℛ′⁢(𝖴1,𝖴2)=𝖳𝗋𝗎𝖾 if ℛ⁢(𝖢1,𝖢2)=𝖳𝗋𝗎𝖾 and 𝖼𝗈𝗆1=𝖼𝗈𝗆2. It is easy to check that ℛ′ is a decryption-respecting relation over the ciphertexts. Let 𝖴∗=(𝖼𝗈𝗆∗,𝖢∗) denote the challenge ciphertext, where (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mb) and 𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆∗). Let 𝖴=(𝖼𝗈𝗆,𝖢) be any query to the decrypt oracle. We define an event

𝖤:=[(𝖼𝗈𝗆∗≠𝖼𝗈𝗆)∧ℛ(𝖢∗,𝖢)=𝖳𝗋𝗎𝖾∧𝖮𝗉𝖾𝗇(𝖼𝗈𝗆,𝒟(𝖢))≠⊥].

We will apply the hybrid arguments over the following games:

GameReal: The original IND-gCCA game of the encryption scheme.
Game0: Same as GameReal, except for the answers to the decrypt queries satisfying the event E after the challenge phase. In this case, 𝒞⁢ℋ always returns ⊥ to the adversary 𝒜.
Game1: Same as Game0, except for the challenge ciphertext, viz., 𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆r),𝖽𝖾𝖼𝗈𝗆r←UD, where D is the decommitment space.

Using Lemmas 3.4, 3.5 and 3.6, we have

𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′IND-gCCA⁢(κ)=𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′Real⁢(κ)

≤|𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′Real⁢(κ)-𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′0⁢(κ)|+|𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′0⁢(κ)-𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′1⁢(κ)|+|𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′1⁢(κ)|

≤𝖠𝖽𝗏ℬ0,𝖢𝗈𝗆𝗆𝗂𝗍RConceal⁢(κ)+2.𝖠𝖽𝗏ℬ1,𝖯𝖪𝖤IND-gCCA⁢(κ)+𝖠𝖽𝗏ℬ2,𝖢𝗈𝗆𝗆𝗂𝗍Hiding⁢(κ)

where ℬ0,ℬ1 and ℬ2 are PPT algorithms whose running times are the same as that of 𝒜. This concludes the theorem. ∎

Lemma 3.4

GameReal and Game0 are indistinguishable under the relaxed-concealment property of ΠCommit. That is, for any adversary A, there is a PPT algorithm B such that

|𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′Real⁢(κ)-𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′0⁢(κ)|≤𝖠𝖽𝗏ℬ,𝖢𝗈𝗆𝗆𝗂𝗍RConceal⁢(κ).

Proof.

First of all note that both games GameReal and Game0 are identical except for the answers to the decrypt queries satisfied by the event E. Suppose there is an adversary 𝒜 who can distinguish the games with advantage ϵ. Then we will establish a PPT algorithm ℬ for breaking the relaxed-concealment property of the commitment scheme Π𝖢𝗈𝗆𝗆𝗂𝗍 with probability at least ϵ. Let 𝒞⁢ℋ be the challenger for the commitment scheme Π𝖢𝗈𝗆𝗆𝗂𝗍. The challenger first runs the setup algorithm of the commitment scheme and gives the public commitment key 𝒞⁢𝒦 to ℬ. Then ℬ returns the same key 𝒞⁢𝒦 to the adversary 𝒜.

Phase 1 query. Let 𝖴=(𝖼𝗈𝗆,𝖢) be any decrypt query made by 𝒜. The simulator ℬ returns 𝒟′⁢(𝖴)=𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝒟⁢(𝖢)) to 𝒜.

Challenge phase.𝒜 submits two equal length messages m0 and m1 to ℬ. Then ℬ picks b←U{0,1} and sends mb to the challenger 𝒞⁢ℋ. The challenger 𝒞⁢ℋ runs (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mb) and gives (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗) to ℬ. Then ℬ executes 𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆∗) and returns 𝖴∗:=(𝖼𝗈𝗆∗,𝖢∗) to 𝒜.

Phase 2 query. Let 𝖴=(𝖼𝗈𝗆,𝖢) be any decrypt query made by 𝒜. If U is a valid query, then we have ℛ′⁢(𝖴∗,𝖴)=𝖥𝖺𝗅𝗌𝖾. For this query, if the event E occurs, then ℬ returns (𝖼𝗈𝗆,𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗) to 𝒞⁢ℋ and aborts. Otherwise it answers similarly as phase 1 query.

Guess.𝒜 sends a guess b′ to ℬ. (ℬ does nothing with b′.)

Analysis. The probability of the event E is ϵ. By this event, we have 𝖼𝗈𝗆∗≠𝖼𝗈𝗆, ℛ⁢(𝖢∗,𝖢)=𝖳𝗋𝗎𝖾 and 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝒟⁢(𝖢))=𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)≠⊥. Now ℛ⁢(𝖢∗,𝖢)=𝖳𝗋𝗎𝖾 implies that 𝖽𝖾𝖼𝗈𝗆∗=𝖽𝖾𝖼𝗈𝗆. Therefore, (𝖼𝗈𝗆,𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗) is a witness for breaking the relaxed-concealment property. ∎

Lemma 3.5

Game0 and Game1 are indistinguishable under IND-gCCA security of the primitive encryption scheme ΠPKE. That is, for any adversary A, there is a PPT algorithm B such that

12⁢|𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′0⁢(κ)-𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′1⁢(κ)|=𝖠𝖽𝗏ℬ,𝖯𝖪𝖤IND-gCCA⁢(κ).

Proof.

If 𝒜 can break the indistinguishability of the games with advantage ϵ, then we will construct a PPT algorithm ℬ for breaking the IND-gCCA security of Π𝖯𝖪𝖤 with probability ϵ. Let 𝒞⁢ℋ be the challenger for the primitive encryption scheme Π𝖯𝖪𝖤. ℬ first runs the setup algorithm of the commitment scheme and gives the public commitment key 𝒞⁢𝒦 to 𝒜.

Phase 1 query. Let 𝖴=(𝖼𝗈𝗆,𝖢) be any decrypt query made by 𝒜. ℬ makes a decrypt query on C to 𝒞⁢ℋ and obtains 𝖽𝖾𝖼𝗈𝗆=𝒟⁢(𝖢) as reply. It then returns 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆) to 𝒜.

Challenge phase.𝒜 submits two equal length messages m0 and m1 to ℬ. Then ℬ picks b←U{0,1} and runs (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mb). Then it chooses 𝖽𝖾𝖼𝗈𝗆r←UD and sends (𝖽𝖾𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆r) to the challenger 𝒞⁢ℋ who chooses 𝖽𝖾𝖼𝗈𝗆β←U{𝖽𝖾𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆r} and sends 𝖢∗←ℰ⁢(𝖽𝖾𝖼𝗈𝗆β) to ℬ. The simulator ℬ sets 𝖴∗:=(𝖼𝗈𝗆∗,𝖢∗) and returns it to 𝒜.

Phase 2 query. Let 𝖴=(𝖼𝗈𝗆,𝖢) be any decrypt query made by 𝒜. ℬ makes a decrypt query on C to 𝒞⁢ℋ. If 𝒞⁢ℋ replies ⊥, then ℬ returns ⊥, else 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆) to 𝒜.

Guess.𝒜 sends a guess b′ to ℬ. If b=b′, then ℬ replies β′=0, else β′=1.

Analysis. The only difference between Game0 and Game1 is the challenge construction. For a valid decrypt query on 𝖴=(𝖼𝗈𝗆,𝖢), we have ℛ′⁢(𝖴∗,𝖴)=𝖥𝖺𝗅𝗌𝖾 which in turn implies three possible cases:

[𝖼𝗈𝗆∗≠𝖼𝗈𝗆∧ℛ⁢(𝖢∗,𝖢)=𝖳𝗋𝗎𝖾],
[𝖼𝗈𝗆∗=𝖼𝗈𝗆∧ℛ⁢(𝖢∗,𝖢)=𝖥𝖺𝗅𝗌𝖾],
[𝖼𝗈𝗆∗≠𝖼𝗈𝗆∧ℛ(𝖢∗,𝖢)=𝖥𝖺𝗅𝗌𝖾].

Since in the last two cases ℛ⁢(𝖢∗,𝖢)=𝖥𝖺𝗅𝗌𝖾, ℬ makes a decrypt query on C to 𝒞⁢ℋ and obtains decom as reply. ℬ then returns 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆) to 𝒜. The only case to discuss is (a). Note that in the simulation 𝒜 is given ⊥ for this case. We divide case (a) into two subcases:

E,
[𝖼𝗈𝗆∗≠𝖼𝗈𝗆∧ℛ⁢(𝖢∗,𝖢)=𝖳𝗋𝗎𝖾∧𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝒟⁢(𝖢))=⊥].

By definition of Game0 and Game1, the adversary is returned ⊥ if E occurs. So the only subcase left is (a2). Since in this case 𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝒟⁢(𝖢))=⊥, 𝒜 will get ⊥ as reply. From the challenge phase, it is straightforward that the challenge ciphertext is properly distributed. Therefore, all the answers to the oracle queries and the challenge ciphertext are perfectly simulated. The advantage of ℬ in breaking IND-gCCA security of the primitive encryption scheme Π𝖯𝖪𝖤 is given by

𝖠𝖽𝗏ℬ,𝖯𝖪𝖤IND-gCCA(κ)=|𝖯𝗋[β=β′]-12|

=|𝖯𝗋[β=0,β′=0]+𝖯𝗋[β=1,β′=1]-12|

=|12𝖯𝗋[β′=0|β=0]+12𝖯𝗋[β′=1|β=1]-12|

=|12𝖯𝗋[β′=0|β=0]-12𝖯𝗋[β′=0|β=1]|

=|12𝖯𝗋[b=b′|β=0]-12𝖯𝗋[b=b′|β=1]|

=12⁢|𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′0⁢(κ)-𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′1⁢(κ)|.∎

Lemma 3.6

For any adversary A, there is a PPT algorithm B such that

𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′1⁢(κ)≤𝖠𝖽𝗏ℬ,𝖢𝗈𝗆𝗆𝗂𝗍Hiding⁢(κ).

Proof.

We will establish a PPT algorithm ℬ for breaking the hiding property of Π𝖢𝗈𝗆𝗆𝗂𝗍 with at least advantage ϵ if 𝒜 has an advantage ϵ:=𝖠𝖽𝗏𝒜,𝖯𝖪𝖤′1⁢(κ) in Game1. Let 𝒞⁢ℋ be the challenger for the commitment scheme Π𝖢𝗈𝗆𝗆𝗂𝗍. Then 𝒞⁢ℋ first runs the setup algorithm of the commitment scheme and gives the public commitment key 𝒞⁢𝒦 to ℬ. Then the same key 𝒞⁢𝒦 is given to 𝒜.

Phase 1 query. Let 𝖴=(𝖼𝗈𝗆,𝖢) be any decrypt query made by 𝒜. The simulator ℬ returns 𝒟′⁢(𝖴) to 𝒜.

Challenge phase.𝒜 submits two equal length messages m0 and m1 to ℬ. Then ℬ submits the same message pair (m0,m1) to 𝒞⁢ℋ. The challenger 𝒞⁢ℋ picks b←U{0,1} and runs (𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mb). Then 𝒞⁢ℋ sends the challenge commitment part 𝖼𝗈𝗆∗ to ℬ. Then ℬ chooses 𝖽𝖾𝖼𝗈𝗆r←UD and sends the challenge ciphertext 𝖴∗:=(𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆r) to 𝒜.

Phase 2 query. Same as phase 1 except that ℬ returns ⊥ for ℛ′⁢(𝖴∗,𝖴)=𝖥𝖺𝗅𝗌𝖾.

Guess.𝒜 sends a guess b′ to ℬ. Then ℬ returns the same b′ to 𝒞⁢ℋ.

Analysis. It is straightforward.∎

Extension to multi-user setting. Although the paradigm and its proof are discussed in a two-user setting, it is very natural to extend it to a multi-user setting by adding the identities of the users as given in [1]. In fact, a signcryption U in multi-user setting is given by 𝖴:=(𝖼𝗈𝗆,𝒮(𝖼𝗈𝗆∥ℐ𝒟R),ℰ(𝖽𝖾𝖼𝗈𝗆∥ℐ𝒟S),ℐ𝒟S,ℐ𝒟R), where ℐ⁢𝒟S and ℐ⁢𝒟R are the identities^[5] of S and R, respectively, and (𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(m).

Remark 3.7

Attribute-based signcryption in the 𝒞⁢t⁢ℰ&𝒮 paradigm can be obtained similarly just by replacing ℐ⁢𝒟R (resp. ℐ⁢𝒟S) by receiver’s policy Γe (resp. sender’s policy Γs).

4 Strongly unforgeable and IND-CCA secure signcryption

To start with our result, we first discuss some drawbacks of the different paradigms 𝒞⁢t⁢ℰ&𝒮, ℰ⁢t⁢𝒮 and 𝒮⁢t⁢ℰ of [1]. The IND-CCA security (resp. strong unforgeability) is not preserved in the ℰ⁢t⁢𝒮 (resp. 𝒮⁢t⁢ℰ) approach. Similarly, neither strong unforgeability nor IND-CCA security is preserved in the 𝒞⁢t⁢ℰ&𝒮 approach. Moreover, to entertain the IND-CCA security (resp. strong unforgeability) in 𝒮⁢t⁢ℰ and 𝒞⁢t⁢ℰ&𝒮 (resp. ℰ⁢t⁢𝒮 and 𝒞⁢t⁢ℰ&𝒮) paradigms, the primitive encryption (resp. signature) scheme must be IND-CCA (resp. sUF-CMA) secure. In this section, the IND-gCCA security (resp. weak unforgeability) is lifted to IND-CCA security (resp. strong unforgeability) in all the paradigms using the power of OTS. Although the technique (based on OTS) in [19] can be used for sUF-CMA conversion, tackling both the confidentiality and authenticity using OTS is very challenging because if one of them is not properly taken care of, it may be vulnerable to attack. We manage the (sUF-CMA) OTS very carefully to have both the dM-IND-iCCA security and dM-sUF-iCMA in all the paradigms from the IND-gCCA secure encryption scheme and UF-CMA signature scheme.

4.1 Strong unforgeability and IND-CCA security in 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 approach

Let

Π𝖢𝗈𝗆𝗆𝗂𝗍:=(C.Setup,𝖢𝗈𝗆𝗆𝗂𝗍,𝖮𝗉𝖾𝗇),Π𝖯𝖪𝖤:=(Gen-Enc,ℰ,𝒟),

Π𝖯𝖪𝖲:=(Gen-Sign,𝒮,𝒱),Π𝖮𝖳𝖲:=(𝖦𝖾𝗇,OTS.Sign,OTS.Ver)

be the commitment scheme, primitive encryption scheme, primitive signature scheme and one-time signature scheme, respectively. The proposed construction of the signcryption scheme

Π𝖲𝖢:=(𝖲𝖾𝗍𝗎𝗉,𝖪𝖾𝗒𝖦𝖾𝗇S,𝖪𝖾𝗒𝖦𝖾𝗇R,𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍,𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍)

is given in Scheme 4.1. We note that the sender sends the signcryption U to the receiver together with the public keys (𝒫⁢𝒦R,𝒫⁢𝒦S).

Scheme 4.1

Scheme 4.1 (Signcryption in C⁢t⁢E&S⁢t⁢S approach)

𝖲𝖾𝗍𝗎𝗉⁢(1κ): It runs 𝒞⁢𝒦←C.Setup⁢(1κ) and sets 𝒫⁢𝒫:=𝒞⁢𝒦. (For brevity, we omit 𝒫⁢𝒫 in the rest of this section.)
𝖪𝖾𝗒𝖦𝖾𝗇S: It runs Gen-Sign⁢(1κ) to produce the public key and private key pair (𝒫⁢𝒦S,𝒮⁢𝒦S).
𝖪𝖾𝗒𝖦𝖾𝗇R: It runs Gen-Enc⁢(1κ) to produce the public key and private key pair (𝒫⁢𝒦R,𝒮⁢𝒦R).
𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(m,𝒮⁢𝒦S,𝒫⁢𝒦R):=((𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍(m);∥(𝗏𝗄,𝗌𝗂𝗀𝗇𝗄)←OTS.Gen(1κ);δw←𝒮(𝖼𝗈𝗆∥𝗏𝗄,𝒮𝒦S);∥𝖢←ℰ(𝖽𝖾𝖼𝗈𝗆∥𝗏𝗄,𝒫𝒦R);δo←OTS.Sign(δw∥𝖢∥𝖼𝗈𝗆∥ℐ𝒟R,𝗌𝗂𝗀𝗇𝗄);it returns 𝖴:=(𝖼𝗈𝗆,δ:=(δw,δo,𝗏𝗄),𝖢)).
𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝖴,𝒮⁢𝒦R,𝒫⁢𝒦S):={𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)if ⁢(OTS.Ver(δw∥𝖢∥𝖼𝗈𝗆∥ℐ𝒟R,δo,𝗏𝗄)=1;∥𝒱(𝖼𝗈𝗆∥𝗏𝗄,δw,𝒫𝒦S)=1;∥let 𝖽𝖾𝖼𝗈𝗆∥𝗏𝗄′:=𝒟(𝖢,𝒮𝒦R);𝗏𝗄=𝗏𝗄′;where 𝖴=(𝖼𝗈𝗆,δ=(δw,δo,𝗏𝗄),𝖢)),⊥otherwise.

Before describing the intuition of our construction, we first review why the 𝒞⁢t⁢ℰ&𝒮-paradigm of [1] does not provide the stronger security. The reasons are described as follows.

In the dM-IND-iCCA model, the adversary 𝒜 can alter the challenge signcryption 𝖴∗:=(𝖼𝗈𝗆∗,δw∗,𝖢∗) to a new signcryption 𝖴~:=(𝖼𝗈𝗆∗,δ~w,𝖢∗), where 𝒜 generates the new signature δ~w on the same message com using the key 𝒮⁢𝒦S∗. Then 𝒜 makes a unsigncrypt query on 𝖴~ and gets the message mb as reply.
Similarly in the dM-sUF-iCMA model, 𝒜 can alter a given signcryption 𝖴:=(𝖼𝗈𝗆,δw,𝖢) for a receiver’s 𝒫⁢𝒦R to another signcryption 𝖴~:=(𝖼𝗈𝗆,δw,𝖢~), where 𝖢~ is computed as follows. Since 𝒜 knows 𝒮⁢𝒦R, it first extracts out decom from C, then re-encrypts to produce the new ciphertext 𝖢~.
Now we discuss an attack, where the 𝒞⁢t⁢ℰ&𝒮 paradigm fails to provide the weak unforgeability (in the dM-UF-iCMA model) even if the primitive signature scheme Π𝖯𝖪𝖲 is strongly unforgeable. This attack is known as identity fraud attack [1] in multi-user setting. In this attack, 𝒜 first obtains a signcryption 𝖴:=(𝖼𝗈𝗆,δw,𝖢) for (m,𝒫⁢𝒦R,𝒫⁢𝒦S). Then 𝒜 extracts out decom from C, then re-encrypts the message decom for different receiver’s ℐ⁢𝒟R~ to produce the new ciphertext 𝖢~. So, 𝖴~:=(𝖼𝗈𝗆,δw,𝖢~) is a forgery for the new message (m,𝒫⁢𝒦R~,𝒫⁢𝒦S). The above attack can be prevented by appending the receiver’s identity ℐ⁢𝒟R to the message of Π𝖯𝖪𝖲 and the sender’s identity ℐ⁢𝒟S to the message of Π𝖯𝖪𝖤 as suggested in [1].

The review says that the above attacks happened due to the ability of 𝒜 to alter a given signcryption U to new signcryption 𝖴~ by changing its components, viz., δw and C.

Intuition of our design. To prevent the aforementioned attacks, we sign both the components δw and C together with com and ℐ⁢𝒟R, i.e., δw∥𝖢∥𝖼𝗈𝗆∥ℐ𝒟R using a strongly unforgeable OTS. In this new design the verification key vk of OTS is embedded in both routines 𝒮 and ℰ. More closely, the signing message com for 𝒮 is changed to 𝖼𝗈𝗆∥𝗏𝗄 and the plaintext decom for ℰ is changed to 𝖽𝖾𝖼𝗈𝗆∥𝗏𝗄. Our approach basically extends 𝒞⁢t⁢ℰ&𝒮 to a new paradigm called “Commit then Encrypt and Sign then Sign” (𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮) (as referred by [36]). The dM-IND-iCCA security of the proposed construction Π𝖲𝖢 in Scheme 4.1 relies on the hiding property of Π𝖢𝗈𝗆𝗆𝗂𝗍, IND-gCCA security of Π𝖯𝖪𝖤 and strong unforgeability of Π𝖮𝖳𝖲. The dM-sUF-iCMA security of the proposed construction relies on UF-CMA security of Π𝖯𝖪𝖲 and strong unforgeability of Π𝖮𝖳𝖲.

Role of OTS. The OTS prevents changing a given signcryption to a new signcryption. Indeed, let (𝗏𝗄,𝗌𝗂𝗀𝗇𝗄) be a key-pair for the OTS. To generate a signcryption, vk is binded in both components δw and C, and all the components δw, C, com and ℐ⁢𝒟R are signed together by the OTS scheme using the key signk.

Strong unforgeability of ΠSC. Suppose 𝒜 gets a signcryption U by querying the signcrypt oracle. Since we assume the weak unforgeability of Π𝖯𝖪𝖲, so 𝒜 can not forge to Π𝖯𝖪𝖲 for a new message (other than 𝖼𝗈𝗆∥𝗏𝗄). So, the only parts 𝒜 may change are δo, C and ℐ⁢𝒟R to produce the new signcryption 𝖴~. Since vk is unaltered and Π𝖮𝖳𝖲 has the strong unforgeability, the above modification is not possible.
Confidentiality of ΠSC. Let 𝖴∗=(𝖼𝗈𝗆∗,δ∗=(δw∗,δo∗,𝗏𝗄∗),𝖢∗) be the challenge signcryption for Π𝖲𝖢 in the dM-IND-iCCA model. Note that 𝖴∗ is the signcryption of mb, where b←U{0,1}. Since Π𝖢𝗈𝗆𝗆𝗂𝗍 has the hiding property, so 𝖼𝗈𝗆∗ does not leak any information of b. Since Π𝖯𝖪𝖤 has IND-gCCA security, so 𝖢∗ does not leak any information of b. To get the benefit of unsigncrypt oracle, first 𝒜 will alter 𝖴∗ to 𝖴~ without changing 𝖢∗ (as it only contains the information of b) and then it makes an unsigncrypt query on 𝖴~. Since 𝖢∗ is unchanged, so is 𝗏𝗄∗. So, the only parts 𝒜 may change are δo∗, δw∗, 𝖼𝗈𝗆∗ and ℐ⁢𝒟R∗ to produce the new signcryption 𝖴~. Since Π𝖮𝖳𝖲 has strong unforgeability, the last modification is not possible.

Reason for keeping com to the message of OTS. In this design, if com is not put to the message of OTS, then we can find an attack in the dM-IND-iCCA model as follows. Suppose, Π𝖯𝖪𝖲 and Π𝖢𝗈𝗆𝗆𝗂𝗍 lack the 1-1 property^[6] and the relaxed-concealment property, respectively. Let 𝖴∗=(𝖼𝗈𝗆∗,δ∗=(δw∗,δo∗,𝗏𝗄∗),𝖢∗) be the challenge signcryption. Then following the attack discussed in Section 3 (using the commitment scheme of [18]), 𝒜 may produce a valid signcryption 𝖴~:=(𝖼𝗈𝗆~,δ∗,𝖢∗) by changing only the commitment part of 𝖴∗, where δw∗ is a signature for both messages 𝖼𝗈𝗆∗∥𝗏𝗄∗ and 𝖼𝗈𝗆~∥𝗏𝗄∗. Then 𝒜 continues the attack as discussed in Section 3 to break the confidentiality in the dM-IND-iCCA model. Therefore, if we assume either the 1-1 property of Π𝖯𝖪𝖲 or the relaxed-concealment property of Π𝖢𝗈𝗆𝗆𝗂𝗍, then we do not require to add com to the message of OTS.

Reason for keeping I⁢DR to the message of OTS. The reason for adding the receiver’s identity ℐ⁢𝒟R to the message of OTS is to prevent the identity fraud attack.

Theorem 4.2

If the primitive encryption scheme ΠPKE is IND-gCCA secure, the commitment scheme ΠCommit has the hiding property and ΠOTS is a strongly unforgeable one-time signature scheme, then the proposed signcryption scheme ΠSC in Scheme 4.1 is dM-IND-iCCA secure (Definition 2.8).

Proof.

Let 𝖴∗=(𝖼𝗈𝗆∗,δ∗,𝖢∗) denote the challenge signcryption for (𝒫⁢𝒦S∗,𝒮⁢𝒦S∗), where δ∗=(δw∗,δo∗,𝗏𝗄∗). Let (𝖴,𝒫⁢𝒦S) be any unsigncrypt query, where 𝖴=(𝖼𝗈𝗆,δ,𝖢) and δ=(δw,δo,𝗏𝗄). We define an event

𝖤:=(𝗏𝗄∗=𝗏𝗄).

We will apply the hybrid arguments over the following games:

GameReal: The original dM-IND-iCCA game of the signcryption scheme.
Game0: Same as GameReal, except that on unsigncrypt query the challenger always returns ⊥ if E occurs.
Game1: Same as Game0, except for the construction of challenge signcryption, viz., 𝖢∗←ℰ(𝖽𝖾𝖼𝗈𝗆r∥𝗏𝗄∗), 𝖽𝖾𝖼𝗈𝗆r←UD, where D is the decommitment space.

Using Lemmas 4.3, 4.4 and 4.5, we have the following reduction:

𝖠𝖽𝗏𝒜,𝖲𝖢IND-CCA⁢(κ)=𝖠𝖽𝗏𝒜,𝖲𝖢Real⁢(κ)

≤|𝖠𝖽𝗏𝒜,𝖲𝖢Real⁢(κ)-𝖠𝖽𝗏𝒜,𝖲𝖢0⁢(κ)|+|𝖠𝖽𝗏𝒜,𝖲𝖢0⁢(κ)-𝖠𝖽𝗏𝒜,𝖲𝖢1⁢(κ)|+|𝖠𝖽𝗏𝒜,𝖲𝖢1⁢(κ)|

≤𝖠𝖽𝗏ℬ0,𝖮𝖳𝖲sUF-CMA⁢(κ)+2.𝖠𝖽𝗏ℬ1,𝖯𝖪𝖤IND-gCCA⁢(κ)+𝖠𝖽𝗏ℬ2,𝖢𝗈𝗆𝗆𝗂𝗍Hiding⁢(κ),

where ℬ0,ℬ1 and ℬ2 are PPT algorithms whose running times are identical to those of 𝒜. This concludes the theorem. ∎

Lemma 4.3

GameReal and Game0 are indistinguishable under the strong unforgeability of the one-time signature scheme ΠOTS. That is, for any adversary A, there is a PPT algorithm B such that

|𝖠𝖽𝗏𝒜,𝖲𝖢Real⁢(κ)-𝖠𝖽𝗏𝒜,𝖲𝖢0⁢(κ)|≤𝖠𝖽𝗏ℬ,𝖮𝖳𝖲sUF-CMA⁢(κ).

Proof.

GameReal and Game0 are identical if the unsigncrypt queries do not satisfy the event E. Suppose there is an adversary 𝒜 who can distinguish the games with advantage ϵ. We will construct a PPT algorithm ℬ for breaking strong unforgeability of Π𝖮𝖳𝖲 with probability at least ϵ. Let 𝒞⁢ℋ be the challenger for the primitive OTS scheme Π𝖮𝖳𝖲. 𝒞⁢ℋ runs (𝗏𝗄∗,𝗌𝗂𝗀𝗇𝗄∗)←OTS.Gen and gives 𝗏𝗄∗ to ℬ. Then ℬ runs (𝒫⁢𝒦R∗,𝒮⁢𝒦R∗)←Gen-Enc⁢(1κ) and gives 𝒫⁢𝒦R∗ to 𝒜. Algorithm ℬ also runs 𝒞⁢𝒦←C.Setup⁢(1κ) and sends the public commitment key 𝒞⁢𝒦 to 𝒜.

Phase 1 query. It consists of the following queries in an adaptive manner:

Signcrypt query. Let (m,𝒫⁢𝒦S) be any signcrypt query made by 𝒜. Then, using the desired private key, ℬ runs the Signcrypt algorithm (as described in Scheme 4.1) and returns the output to 𝒜.
Unsigncrypt query. Let (𝖴,𝒫⁢𝒦S) be any unsigncrypt query made by 𝒜, where 𝖴=(𝖼𝗈𝗆,δ,𝖢). If the query satisfies the event E, then it produces a forgery δo for the message δw∥𝖢∥𝖼𝗈𝗆∥ℐ𝒟R∗ in Π𝖮𝖳𝖲 and aborts, else it runs the Unsigncrypt algorithm using the decryption key and returns the output to 𝒜.

Challenge phase.𝒜 submits two equal length messages (m0,m1) and a challenge sender’s key pair (𝒫⁢𝒦S∗,𝒮⁢𝒦S∗) to ℬ. Then ℬ picks b←U{0,1} and runs

(𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍(mb),δw∗←𝒮(𝖼𝗈𝗆∗∥𝗏𝗄∗,𝒮𝒦S∗) and 𝖢∗←ℰ(𝖽𝖾𝖼𝗈𝗆∗∥𝗏𝗄∗,𝒫𝒦R∗).

Then it queries for one-time signature to 𝒞⁢ℋ for the message δw∗∥𝖢∗∥𝖼𝗈𝗆∗∥ℐ𝒟R∗ and obtains the replied signature δo∗. It returns the challenge signcryption 𝖴∗:=(𝖼𝗈𝗆∗,δ∗:=(δw∗,δo∗,𝗏𝗄∗),𝖢∗) to 𝒜.

Phase 2 query. Same as phase 1.

Guess.𝒜 sends a guess b′ to ℬ. (ℬ does nothing with b′.)

Analysis. Both games are identical unless the event E occurs. By the natural restriction of the dM-IND-iCCA model, we have 𝖴∗≠𝖴. The event E implies 𝗏𝗄∗=𝗏𝗄. So, altogether we have

δo∗⁢∥δw∗∥⁢𝖢∗⁢∥𝖼𝗈𝗆∗∥⁢ℐ⁢𝒟R∗≠δo⁢∥δw∥⁢𝖢⁢∥𝖼𝗈𝗆∥⁢ℐ⁢𝒟R∗.

Therefore, δo is a valid forgery for the message δw∥𝖢∥𝖼𝗈𝗆∥ℐ𝒟R∗. ∎

Lemma 4.4

Game0 and Game1 are indistinguishable under IND-gCCA security of the primitive encryption scheme ΠPKE. That is, for any adversary A, there is a PPT algorithm B such that

12⁢|𝖠𝖽𝗏𝒜,𝖲𝖢0⁢(κ)-𝖠𝖽𝗏𝒜,𝖲𝖢1⁢(κ)|≤𝖠𝖽𝗏ℬ,𝖯𝖪𝖤IND-gCCA⁢(κ).

Proof.

Similarly to above, we will construct a PPT algorithm ℬ for breaking the IND-gCCA security of Π𝖯𝖪𝖤 with advantage at least ϵ. Let 𝒞⁢ℋ be the challenger for the primitive encryption scheme Π𝖯𝖪𝖤. 𝒞⁢ℋ runs (𝒫⁢𝒦R∗,𝒮⁢𝒦R∗)←Gen-Enc⁢(1κ) and gives 𝒫⁢𝒦R∗ to ℬ. Then ℬ runs 𝒞⁢𝒦←C.Setup⁢(1κ) and sends (𝒞⁢𝒦,𝒫⁢𝒦R∗) to 𝒜.

Phase 1 query. It consists of the following queries:

Signcrypt query. Let (m,𝒫⁢𝒦S) be any signcrypt query made by 𝒜. Then, using the desired private key, ℬ runs the Signcrypt algorithm and returns the output to 𝒜.
Unsigncrypt query. Let (𝖴,𝒫⁢𝒦S) be any unsigncrypt query made by 𝒜, where 𝖴=(𝖼𝗈𝗆,δ,𝖢). Algorithm ℬ makes a decrypt query C to 𝒞⁢ℋ and gets the reply. Then ℬ follows the rest of the Unsigncrypt algorithm and returns the output to 𝒜.

Challenge phase.𝒜 submits two equal length messages (m0,m1) and a challenge sender’s key pair (𝒮⁢𝒦S∗,𝒫⁢𝒦S∗) to ℬ. Then ℬ picks b←U{0,1} and runs

(𝗏𝗄∗,𝗌𝗂𝗀𝗇𝗄∗)←OTS.Gen(1κ),(𝖼𝗈𝗆∗,𝖽𝖾𝖼𝗈𝗆∗)←𝖢𝗈𝗆𝗆𝗂𝗍(mb) and δw∗←𝒮(𝖼𝗈𝗆∗∥𝗏𝗄∗,𝒮𝒦S∗).

It then chooses 𝖽𝖾𝖼𝗈𝗆r←UD and sends the challenge messages (𝖽𝖾𝖼𝗈𝗆∗∥𝗏𝗄∗,𝖽𝖾𝖼𝗈𝗆r∥𝗏𝗄∗) to 𝒞⁢ℋ. The challenger 𝒞⁢ℋ chooses 𝖽𝖾𝖼𝗈𝗆β∥𝗏𝗄∗←U{𝖽𝖾𝖼𝗈𝗆∗∥𝗏𝗄∗,𝖽𝖾𝖼𝗈𝗆r∥𝗏𝗄∗}, runs 𝖢∗←ℰ(𝖽𝖾𝖼𝗈𝗆β∥𝗏𝗄∗,𝒫𝒦R∗) and gives 𝖢∗ to ℬ. Then ℬ runs δo∗←OTS.Sign(δw∗∥𝖢∗∥𝖼𝗈𝗆∗∥ℐ𝒟R∗,𝗌𝗂𝗀𝗇𝗄∗). Then ℬ returns the challenge signcryption 𝖴∗:=(𝖼𝗈𝗆∗,δ∗:=(δw∗,δo∗,𝗏𝗄∗),𝖢∗) to 𝒜.

Phase 2 query. It consists of the following queries:

Signcrypt query. Same as phase 1.
Unsigncrypt query. Let (𝖴,𝒫⁢𝒦S) be any unsigncrypt query made by 𝒜. If the query satisfies E, it returns ⊥ to 𝒜, else it proceeds the same way as in phase 1.

Guess.𝒜 sends a guess b′ to ℬ. If b=b′, then ℬ replies β′=0, else β′=1.

Analysis. We first notice that the only difference between Game0 and Game1 is the construction of challenge signcryption. From the challenge phase it is obvious that the challenge signcryption is perfectly simulated. In fact, if 𝖽𝖾𝖼𝗈𝗆β=𝖽𝖾𝖼𝗈𝗆∗ (resp. 𝖽𝖾𝖼𝗈𝗆β=𝖽𝖾𝖼𝗈𝗆r), the distribution of 𝖴∗ is exactly identical to that of Game0 (resp. Game1). Since the signcrypt queries are answered exactly by running the Signcrypt algorithm, we have to focus only on the answers to the unsigncrypt queries. If E occurred, then in both games, 𝒜 will get ⊥ as requirement. If E does not occur, then 𝗏𝗄∗≠𝗏𝗄 and so ℛ⁢(𝖢∗,𝖢)=𝖥𝖺𝗅𝗌𝖾, where R is the decryption-respecting relation for the primitive encryption scheme Π𝖯𝖪𝖤. In this case, ℬ makes a decrypt query on C and 𝒞⁢ℋ will reply a valid message 𝒟⁢(𝖢) to ℬ. So, a legitimate answer to the unsigncrypt query U will be given to 𝒜. Therefore, all the answers to the queries and the challenge signcryption are perfectly simulated. The advantage of ℬ in breaking the IND-gCCA security of the primitive encryption scheme Π𝖯𝖪𝖤 is given by

𝖠𝖽𝗏ℬ,𝖯𝖪𝖤IND-gCCA(κ)=|𝖯𝗋[β=β′]-12|≥12|𝖠𝖽𝗏𝒜,𝖲𝖢0(κ)-𝖠𝖽𝗏𝒜,𝖲𝖢1(κ)|.∎

Lemma 4.5

For any adversary A, there is a PPT algorithm B such that

𝖠𝖽𝗏𝒜,𝖲𝖢1⁢(κ)≤𝖠𝖽𝗏ℬ,𝖢𝗈𝗆𝗆𝗂𝗍Hiding⁢(κ).

Proof.

Similar to the proof Lemma 3.6. ∎

Theorem 4.6

If the primitive signature scheme ΠPKS is UF-CMA secure and ΠOTS is a strongly unforgeable OTS scheme, then the proposed signcryption scheme ΠSC in Scheme 4.1 is dM-sUF-iCMA secure (Definition 2.9).

Proof.

Let 𝒜 be an adversary that can break the strong unforgeability of Π𝖲𝖢 with non-negligible advantage ϵ. Suppose 𝒜 has made ν signcrypt queries to the signcrypt oracle. Let 𝖴i=(𝖼𝗈𝗆i,δi,𝖢i) with δi=(δw(i),δo(i),𝗏𝗄(i)) be the replied signcryption to the i-th query for (mi,𝒫⁢𝒦R(i)) for i∈[ν]. Let 𝖴∗=(𝖼𝗈𝗆∗,δ∗,𝖢∗) be the forgery by 𝒜 for the message (m∗,𝒫⁢𝒦R∗). We define an event

𝖥𝗈𝗋𝗀𝖾𝖽:=𝗏𝗄∗∉{𝗏𝗄(i):i∈[ν]}.

Then we have

ϵ≤Pr⁡[𝒜⁢ Succeeds]:=Pr⁡[𝒜⁢ Succeeds∧𝖥𝗈𝗋𝗀𝖾𝖽]+Pr⁡[𝒜⁢ Succeeds∧¬⁡(𝖥𝗈𝗋𝗀𝖾𝖽)]

⇒Pr⁡[𝒜⁢ Succeeds∧𝖥𝗈𝗋𝗀𝖾𝖽]≥ϵ/2 or Pr⁡[𝒜⁢ Succeeds∧¬⁡(𝖥𝗈𝗋𝗀𝖾𝖽)]≥ϵ/2.

Case Forged. We establish a PPT algorithm ℬ𝖯𝖪𝖲 for forging to the primitive signature scheme Π𝖯𝖪𝖲 with advantage at least ϵ/2. Let 𝒞⁢ℋ be the challenger for the primitive signature scheme Π𝖯𝖪𝖲. The challenger 𝒞⁢ℋ runs (𝒫⁢𝒦S∗,𝒮⁢𝒦S∗)←Gen-Sign⁢(1κ) and gives 𝒫⁢𝒦S∗ to ℬ𝖯𝖪𝖲. Algorithm ℬ𝖯𝖪𝖲 runs 𝒞⁢𝒦←C.Setup⁢(1κ) and sends (𝒞⁢𝒦,𝒫⁢𝒦S∗) to 𝒜.

Signcrypt query answering. Let (mi,𝒫⁢𝒦R(i)) be any signcrypt query to ℬ𝖯𝖪𝖲 by 𝒜. Algorithm ℬ𝖯𝖪𝖲 executes (𝖼𝗈𝗆i,𝖽𝖾𝖼𝗈𝗆i)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mi) and (𝗏𝗄(i),𝗌𝗂𝗀𝗇𝗄(i))←OTS.Gen⁢(1κ). Then ℬ𝖯𝖪𝖲 makes a signature query for 𝖼𝗈𝗆i∥𝗏𝗄(i) to 𝒞⁢ℋ and gets the replied signature δw(i) from 𝒞⁢ℋ. Then ℬ𝖯𝖪𝖲 runs 𝖢i←ℰ(𝖽𝖾𝖼𝗈𝗆i∥𝗏𝗄(i),𝒫𝒦R(i)), δo(i)←OTS.Sign(δw(i)∥𝖢i∥𝖼𝗈𝗆i∥ℐ𝒟R(i),𝗌𝗂𝗀𝗇𝗄(i)) and sets 𝖴i:=(𝖼𝗈𝗆i,δi,𝖢i), where δi:=(δw(i),δo(i),𝗏𝗄(i)). It returns the signcryption 𝖴i to 𝒜.

Unsigncrypt query answering. Let (𝖴,𝒫⁢𝒦R) be any unsigncrypt query made by 𝒜, where 𝖴=(𝖼𝗈𝗆,δ,𝖢). ℬ𝖯𝖪𝖲 runs the Unsigncrypt algorithm using 𝒮⁢𝒦R and returns the output to 𝒜.

Forgery.𝒜 outputs a tuple (𝖴∗,𝒫⁢𝒦R∗,𝒮⁢𝒦R∗), where 𝖴∗=(𝖼𝗈𝗆∗,δ∗,𝖢∗) and δ∗=(δw∗,δo∗,𝗏𝗄∗). It is required that (𝒫⁢𝒦R∗,𝒮⁢𝒦R∗) is a valid key pair. Then ℬ𝖯𝖪𝖲 forges the signature δw∗ for 𝖼𝗈𝗆∗∥𝗏𝗄∗ to the primitive signature scheme Π𝖯𝖪𝖲.

Analysis. By the event Forged, for all vk involved in answering signcrypt queries, 𝗏𝗄(i)≠𝗏𝗄∗, and so 𝖼𝗈𝗆∗∥𝗏𝗄∗ has not been queried for signature to 𝒞⁢ℋ. Therefore δw∗ is a valid forgery for the message 𝖼𝗈𝗆∗∥𝗏𝗄∗.

Case ¬⁡(Forged). Similarly to above, we will develop an algorithm ℬ𝖮𝖳𝖲 for forging to the primitive strong unforgeable one-time signature scheme Π𝖮𝖳𝖲 with advantage at least ϵ/2⁢ν. Let 𝒞⁢ℋ be the challenger for the primitive signature scheme Π𝖮𝖳𝖲. The challenger 𝒞⁢ℋ runs (𝗏𝗄∗,𝗌𝗂𝗀𝗇𝗄∗)←𝖦𝖾𝗇⁢(1κ) and gives 𝗏𝗄∗ to ℬ𝖮𝖳𝖲. Algorithm ℬ𝖮𝖳𝖲 runs (𝒫⁢𝒦S∗,𝒮⁢𝒦S∗)←Gen-Sign⁢(1κ), 𝒞⁢𝒦←C.Setup⁢(1κ) and gives (𝒞⁢𝒦,𝒫⁢𝒦S∗) to 𝒜. Then it picks j←U[ν] as a guess such that 𝗏𝗄∗=𝗏𝗄(j).

Signcrypt query answering. Let (m(i),𝒫⁢𝒦R(i)) be the i-th signcrypt query to ℬ𝖮𝖳𝖲 by 𝒜.

i≠j: ℬ𝖮𝖳𝖲 executes (𝖼𝗈𝗆i,𝖽𝖾𝖼𝗈𝗆i)←𝖢𝗈𝗆𝗆𝗂𝗍⁢(mi), (𝗏𝗄(i),𝗌𝗂𝗀𝗇𝗄(i))←OTS.Gen⁢(1κ). Then it runs δw(i)←𝒮(𝖼𝗈𝗆i∥𝗏𝗄(i),𝒮𝒦S∗), 𝖢i←ℰ(𝖽𝖾𝖼𝗈𝗆i∥𝗏𝗄(i),𝒫𝒦R(i)) and δo(i)←OTS.Sign(δw(i)∥𝖢i∥𝖼𝗈𝗆i∥ℐ𝒟R(i),𝗌𝗂𝗀𝗇𝗄(i)). It sets δi:=(δw(i),δo(i),𝗏𝗄(i)) and returns the signcryption 𝖴i:=(𝖼𝗈𝗆i,δi,𝖢i) to 𝒜.
i=j: Same as above, except ℬ𝖮𝖳𝖲 does not execute OTS.Gen⁢(1κ) but it sets 𝗏𝗄(j):=𝗏𝗄∗ and it makes a one-time signature query to 𝒞⁢ℋ for the message δw(j)∥𝖢j∥𝖼𝗈𝗆j∥ℐ𝒟R(j) and gets the replied signature δo(j).

Unsigncrypt query answering. Same as above.

Forgery.𝒜 outputs a tuple (𝖴∗,𝒫⁢𝒦R∗,𝒮⁢𝒦R∗), where 𝖴∗:=(𝖼𝗈𝗆∗,δ∗,𝖢∗) and δ∗:=(δw∗,δo∗,𝗏𝗄∗). It is required that (𝒫⁢𝒦R∗,𝒮⁢𝒦R∗) is a valid key pair. Then ℬ𝖮𝖳𝖲 forges the signature δo∗ for δw∗∥𝖢∗∥𝖼𝗈𝗆∗∥ℐ𝒟R∗ to the primitive one-time signature scheme Π𝖮𝖳𝖲.

Analysis. With probability 1/ν, ℬ𝖮𝖳𝖲 correctly guesses j such that the event Forged happens. Now, we only have to show that

δo∗⁢∥δw∗∥⁢𝖢∗⁢∥𝖼𝗈𝗆∗∥⁢ℐ⁢𝒟R∗≠δo(j)⁢∥δw(j)∥⁢𝖢j⁢∥𝖼𝗈𝗆j∥⁢ℐ⁢𝒟R(j).

To obtain a contradiction, suppose that equality holds. Then δo∗=δo(j), δw∗=δw(j), 𝖢∗=𝖢j, 𝖼𝗈𝗆∗=𝖼𝗈𝗆j and ℐ⁢𝒟R∗=ℐ⁢𝒟R(j). Since 𝖢∗=𝖢j, we have 𝖽𝖾𝖼𝗈𝗆∗∥𝗏𝗄∗=𝖽𝖾𝖼𝗈𝗆j∥𝗏𝗄(j). Using 𝖼𝗈𝗆∗=𝖼𝗈𝗆j and 𝖽𝖾𝖼𝗈𝗆∗=𝖽𝖾𝖼𝗈𝗆j, we have m∗=mj. Altogether we have (𝖴∗,m∗,𝒫⁢𝒦R∗)=(𝖴j,mj,𝒫⁢𝒦R(j)) which is a contradiction to the definition of strong existential unforgeability of signcryption scheme Π𝖲𝖢. ∎

4.2 Other paradigms

Similar to 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮, we extend the basic paradigms ℰ⁢t⁢𝒮 and 𝒮⁢t⁢ℰ to ℰ⁢t⁢𝒮⁢t⁢𝒮 and 𝒮⁢t⁢ℰ⁢t⁢𝒮, respectively, to assure the stronger security. We also provide a new paradigm, namely ℰ&𝒮⁢t⁢𝒮, which is comparatively efficient than the 𝒞⁢t⁢ℰ&𝒮 approach. The design principle of these paradigms is similar to that of 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮. The paradigms are briefly described in Table 1. For brevity, we omit the keys 𝒫⁢𝒦S, 𝒮⁢𝒦S, 𝒫⁢𝒦R, 𝒮⁢𝒦R, vk and signk from the algorithms 𝒱, 𝒮, ℰ, 𝒟, OTS.Ver and OTS.Sign, respectively. Demonstrated in Table 1 are only two algorithms, Signcrypt and Unsigncrypt; the others are as in Scheme 4.1. The security statements are given as follows.

Theorem 4.7

If ΠPKS is UF-CMA secure and ΠOTS is sUF-CMA secure, then the proposed signcryptions ΠSC given in Table 1 are dM-sUF-iCMA secure (Definition 2.9).

Theorem 4.8

If ΠPKE is IND-gCCA secure and ΠOTS is sUF-CMA secure, then the proposed signcryptions ΠSC given in Table 1 are dM-IND-iCCA secure (Definition 2.8).

Proof sketch for other paradigms. The proof strategy of the other three paradigms in Table 1 is similar to that of 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮, even simpler than 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 as the other paradigms do not involve the commitment scheme. Therefore, we skip the proofs of the above theorems; we rather sketch the proofs of confidentiality and unforgeability:

Table 1

A brief description of signcryptions in other paradigms.

Paradigm	Signcrypt	Unsigncrypt
ℰ&𝒮⁢t⁢𝒮	((𝗏𝗄,𝗌𝗂𝗀𝗇𝗄)←OTS.Gen⁢(1κ);δw←𝒮(𝗏𝗄);∥𝖢←ℰ(m∥𝗏𝗄);δo←OTS.Sign⁢(δw⁢∥𝖢∥⁢ℐ⁢𝒟R);𝖴:=(δ:=(δw,δo,𝗏𝗄),𝖢))	(If (OTS.Ver(δw∥𝖢∥ℐ𝒟R,δo)=1;∥𝒱(𝗏𝗄,δw)=1;∥m∥𝗏𝗄′←𝒟(𝖢);𝗏𝗄=𝗏𝗄′)it returns ⁢melse ⊥)
ℰ⁢t⁢𝒮⁢t⁢𝒮	((𝗏𝗄,𝗌𝗂𝗀𝗇𝗄)←OTS.Gen⁢(1κ);𝖢←ℰ(m∥𝗏𝗄);δw←𝒮(𝖢∥𝗏𝗄);δo←OTS.Sign⁢(δw⁢∥𝖢∥⁢ℐ⁢𝒟R);𝖴:=(δ:=(δw,δo,𝗏𝗄),𝖢))	(If (OTS.Ver(δw∥𝖢∥ℐ𝒟R,δo)=1;∥𝒱(𝖢∥𝗏𝗄,δw)=1;∥m∥𝗏𝗄′←𝒟(𝖢);𝗏𝗄=𝗏𝗄′)it returns ⁢melse ⊥)
𝒮⁢t⁢ℰ⁢t⁢𝒮	((𝗏𝗄,𝗌𝗂𝗀𝗇𝗄)←OTS.Gen⁢(1κ);δw←𝒮(m∥𝗏𝗄);𝖢←ℰ⁢(δw⁢∥m∥⁢𝗏𝗄);δo←OTS.Sign(𝖢∥ℐ𝒟R);𝖴:=(δo,𝗏𝗄,𝖢))	(If (OTS.Ver(𝖢∥ℐ𝒟R,δo)=1;∥δw⁢∥m∥⁢𝗏𝗄′←𝒟⁢(𝖢);𝒱(m∥𝗏𝗄,δw)=1;𝗏𝗄=𝗏𝗄′)it returns ⁢melse ⊥)

Confidentiality. Let 𝒞⁢ℋ be the challenger for the primitive scheme Π𝖯𝖪𝖤. Let 𝒜 be an adversary who can break the confidentiality of Π𝖲𝖢 in the dM-IND-iCCA model. Then using the power of 𝒜, we establish a PPT simulator ℬ for breaking the IND-gCCA security of Π𝖯𝖪𝖤. Let (𝗏𝗄∗,𝗌𝗂𝗀𝗇𝗄∗) be the key-pair for the OTS used to construct the challenge signcryption for Π𝖲𝖢. In the challenge phase, 𝒜 sends challenge messages m0,m1 and a valid pair (𝒫⁢𝒦S∗,𝒮⁢𝒦S∗) to ℬ. For the paradigms ℰ&𝒮⁢t⁢𝒮 and ℰ⁢t⁢𝒮⁢t⁢𝒮, ℬ gives two challenge messages m0∥𝗏𝗄∗,m1∥𝗏𝗄∗ to 𝒞⁢ℋ. For the 𝒮⁢t⁢ℰ⁢t⁢𝒮 paradigm, ℬ computes δw(i):=𝒮(mi∥𝗏𝗄∗) for i=0,1 and sends the challenge messages δw(0)⁢∥m0∥⁢𝗏𝗄∗,δw(1)⁢∥m1∥⁢𝗏𝗄∗ to 𝒞⁢ℋ. Let 𝖢∗ be the reply from 𝒞⁢ℋ. Then ℬ follows the rest of the Signcrypt algorithm to compute the challenge signcryption 𝖴∗. In the simulation, ℬ has to answer the various queries of 𝒜. The signcrypt queries are answered by the corresponding signing key 𝒮⁢𝒦S. So, the major task is to answer the unsigncrypt queries of 𝒜 as ℬ does not know the key 𝒮⁢𝒦R∗. Let (𝖴:=(.,𝗏𝗄,𝖢),𝒫𝒦S) be any unsigncrypt query. If 𝗏𝗄∗=𝗏𝗄, ℬ aborts. In this case, ℬ forges to the OTS scheme Π𝖮𝖳𝖲. Else it verifies δo and δw (provided the message is available to ℬ to run 𝒱) and makes a decrypt query for C to 𝒞⁢ℋ. Since 𝗏𝗄∗≠𝗏𝗄, we have ℛ⁢(𝖢∗,𝖢)=𝖥𝖺𝗅𝗌𝖾 and 𝒞⁢ℋ returns a valid answer 𝒟⁢(C) to ℬ. Then ℬ verifies δw if it is left and sends the message 𝒟⁢(C) to 𝒜. Whenever 𝒜 sends a guess b′ to ℬ, then ℬ forwards the same guess b′ to 𝒞⁢ℋ.

Unforgeability. Let 𝒜 be an adversary for breaking the strong unforgeability of Π𝖲𝖢 in the dM-sUF-iCMA model. Then using the power of 𝒜, we establish an PPT algorithm ℬ for forging either to Π𝖯𝖪𝖲 or Π𝖮𝖳𝖲. Suppose, 𝒜 will forge 𝖴∗:=(.,𝗏𝗄∗,𝖢∗) for (𝒫⁢𝒦R∗,𝒫⁢𝒦S∗) to Π𝖲𝖢 in the dM-sUF-iCMA model. Similarly to above, ℬ has to answer the various signcrypt and unsigncrypt queries. Since the receiver’s key 𝒮⁢𝒦R is known to ℬ, it can answer the unsigncrypt queries. Let (m,𝒫⁢𝒦R) be any signcrypt query made by 𝒜. Let 𝒞⁢ℋ be the challenger of Π𝖯𝖪𝖲. Then ℬ runs (𝗏𝗄,𝗌𝗂𝗀𝗇𝗄)←OTS.Gen⁢(1κ) and makes the signature queries to 𝒞⁢ℋ for the messages vk, 𝖢∥𝗏𝗄 and m∥𝗏𝗄 for the paradigms ℰ&𝒮⁢t⁢𝒮, ℰ⁢t⁢𝒮⁢t⁢𝒮 and 𝒮⁢t⁢ℰ⁢t⁢𝒮, respectively. Let δw be the replied signature from 𝒞⁢ℋ. Then ℬ follows the rest of the Signcrypt algorithm to answer the signcryption U to 𝒜. We define an event Forged to be 𝗏𝗄∗≠𝗏𝗄 for all vk involved in the replied signcryption (as defined for the 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 paradigm). At the end stage of the unforgeability game, 𝒜 forges 𝖴∗:=(.,𝗏𝗄∗,𝖢∗) to Π𝖲𝖢 for (𝒫⁢𝒦R∗,𝒫⁢𝒦S∗). If Forged happened, i.e., 𝗏𝗄∗≠𝗏𝗄, then ℬ forges δw∗ to Π𝖯𝖪𝖲 for the new messages 𝗏𝗄∗, 𝖢∗∥𝗏𝗄∗ and m∗∥𝗏𝗄∗ for the paradigms ℰ&𝒮⁢t⁢𝒮, ℰ⁢t⁢𝒮⁢t⁢𝒮 and 𝒮⁢t⁢ℰ⁢t⁢𝒮, respectively. If Forged does not occur, then ℬ forges δo∗ to Π𝖮𝖳𝖲 as shown for the 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 paradigm.

4.3 Performance and features

Table 2 shows the comparison of efficiency and other features of the various paradigms in details. The efficiency is measured in two aspects, viz., (1) execution time and (2) signcryption bandwidth. In the former aspect, the term “parallel” means that the two basic subroutines 𝒮 (resp. 𝒱) and ℰ (resp. 𝒟) run in parallel in the main routine Signcrypt (resp. Unsigncrypt). In contrast, the term “sequential” indicates that the aforementioned subroutines run sequentially in an order described by the corresponding paradigm. As a natural choice, the paradigms having parallel execution seem to be faster as compared to the sequential approach. In the latter aspect, the signcryption bandwidth means the number of group elements involved in the final signcryption. As we can see, the paradigm 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 is less bandwidth efficient than the other paradigms. An important feature, namely the non-repudiation (publicly verifiability), means Bob can convince a third party without revealing his secret key that the claimed signcryption actually was sent by Alice. We remark that 𝒮⁢t⁢ℰ⁢t⁢𝒮 has non-repudiation, whereas the paradigm 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 has this feature if the primitive commitment scheme has the binding property.

Table 2

The comparison of performance and features of different paradigms.

Features	𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮	ℰ&𝒮⁢t⁢𝒮	ℰ⁢t⁢𝒮⁢t⁢𝒮	𝒮⁢t⁢ℰ⁢t⁢𝒮
Signcrypt	parallel	parallel	sequential	sequential
Unsigncrypt	parallel	parallel	parallel	sequential
Size	(𝖼𝗈𝗆,δw,δo,𝗏𝗄,𝖢)	(δw,δo,𝗏𝗄,𝖢)	(δw,δo,𝗏𝗄,𝖢)	(δo,𝗏𝗄,𝖢)
Non-Repudiation	✓	X	X	✓
Confidentiality	dM-IND-iCCA	dM-IND-iCCA	dM-IND-iCCA	dM-IND-iCCA
Unforgeability	dM-sUF-iCMA	dM-sUF-iCMA	dM-sUF-iCMA	dM-sUF-iCMA
Requirements to
achieve confidentiality
and unforgeability	(Π𝖮𝖳𝖲:sUF-CMAΠ𝖯𝖪𝖲:UF-CMAΠ𝖯𝖪𝖤:IND-gCCAΠ𝖢𝗈𝗆𝗆𝗂𝗍:Hiding)	(Π𝖮𝖳𝖲:sUF-CMAΠ𝖯𝖪𝖲:UF-CMAΠ𝖯𝖪𝖤:IND-gCCA)	(Π𝖮𝖳𝖲:sUF-CMAΠ𝖯𝖪𝖲:UF-CMAΠ𝖯𝖪𝖤:IND-gCCA)	(Π𝖮𝖳𝖲:sUF-CMAΠ𝖯𝖪𝖲:UF-CMAΠ𝖯𝖪𝖤:IND-gCCA)

5 Generic constructions of attribute-based signcryption

We present generic constructions of signcryption Π𝖠𝖡𝖲𝖢:=(𝖲𝖾𝗍𝗎𝗉,𝖪𝖾𝗒𝖦𝖾𝗇,𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍,𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍) from the primitive schemes Π𝖠𝖡𝖲 and Π𝖠𝖡𝖤. If we want to setup a signcryption to support the system parameters (universes), 𝒋s for signing and 𝒋e for decrypting, then we hire our primitive schemes Π𝖠𝖡𝖲 and Π𝖠𝖡𝖤 to support 𝒋s′ and 𝒋e′, respectively. We remark that the key space 𝒳 and the associated data space 𝒴 are defined over the system parameter 𝒋, i.e., if 𝒋 varies, then 𝒳 and 𝒴 also vary. Throughout this paper, the objects subscripted by s (resp. e) are related to sender (resp. receiver). Considered here are two frameworks, viz., combined-framework and independent-framework. In the combined-framework the setup (resp. KeyGen) of ABSC is identical with the setup of ABE and ABS with common input. Let AB.Setup and AB.KeyGen denote the identical setup algorithm and identical KeyGen algorithms, respectively, of ABE and ABS. For the combined framework, key index x belongs to key space 𝒳, the associated data indices ys and ye are from the same associated data index space 𝒴, where 𝒳 and 𝒴 are defined over the common system parameter 𝒋. For the independent-framework, the setup (resp. KeyGen) of ABS and ABE are not identical. Therefore, we consider the key 𝒮⁢𝒦x consisting of two parts: 𝒮⁢𝒦xs and 𝒮⁢𝒦xe, where xs∈𝒳s for signing and xe∈𝒳e for decrypt. Similarly the data indices involved in signcrypt and unsigncrypt are taken from different data spaces. i.e., ys∈𝒴s and ye∈𝒴e.

Let Π𝖢𝗈𝗆𝗆𝗂𝗍 and Π𝖮𝖳𝖲 be the other two supportive primitives, respectively the commitment scheme and one-time signature scheme, with length of the verification key being (n-1), i.e., 𝗏𝗄∈{0,1}n-1. Throughout this section, we use the notations 𝗏𝗄e:=1∥𝗏𝗄 and 𝗏𝗄s:=0∥𝗏𝗄. We only show the constructions in the 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮 paradigm. The ABSC schemes for the other paradigms, ℰ&𝒮⁢t⁢𝒮, ℰ⁢t⁢𝒮⁢t⁢𝒮 and 𝒮⁢t⁢ℰ⁢t⁢𝒮, can be constructed similarly. We show the confidentiality and unforgeability of the proposed constructions in adaptive-predicates models (Definitions 2.16 and 2.22). Similarly, the confidentiality of the constructions can be proven in the selective-predicate model (Definitions 2.17) using selective-predicate security of the underlying ABE.

5.1 Delegation and verifiability

Definition 5.1

Definition 5.1 (Delegation and re-randomization for ABE (resp. ABS))

Let ≻ be a partial order on 𝒳. An ABE (resp. ABS) scheme is said to have the delegation property with respect to ≻ if there is a PPT algorithm Delegate such that for all x≻x~∈𝒳, for all 𝒫⁢𝒫, ℳ⁢𝒮⁢𝒦, K, Kx with 𝖯𝗋[𝖲𝖾𝗍𝗎𝗉→(𝒫𝒫,ℳ𝒮𝒦)]>0 and 𝖯𝗋[𝖪𝖾𝗒𝖦𝖾𝗇(𝒫𝒫,ℳ𝒮𝒦,x)=Kx]>0 we have

(5.1)𝖯𝗋[𝖣𝖾𝗅𝖾𝗀𝖺𝗍𝖾(𝒫𝒫,Kx,x,x~)=K]=𝖯𝗋[𝖪𝖾𝗒𝖦𝖾𝗇(𝒫𝒫,ℳ𝒮𝒦,x~)=K].

Moreover, it is said to have the re-randomization property if for all x∈𝒳, x≻x.

From the binary relation ∼ for a predicate encryption, we can always define a natural partial order. In fact, x≻x~ for x,x~∈𝒳 (i.e., x has more access than x~) if x~∼y implies x∼y for all y∈𝒴.

Definition 5.2

Definition 5.2 (Verifiability [31, 45])

An attribute-based encryption is said to have verifiability if there is a Verify algorithm such that for all ciphertexts C (possibly ill-format) with the public associated index y, and all x,x~ with x∼y,x~∼y we have

𝖵𝖾𝗋𝗂𝖿𝗒⁢(𝒫⁢𝒫,𝖢,x,x~)=1⇒𝖣𝖾𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖢,𝒮⁢𝒦x)=𝖣𝖾𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,𝖢,𝒮⁢𝒦x~)

and it is a weak format-verifier, i.e., it returns 1 for all correctly-format ciphertexts.^[7]

Roughly speaking, it verifies that a ciphertext is correctly-format, or if it is ill-format, then it can be decrypted to the same message under two keys with two different indices both related to the associated index.

5.2 Construction based on delegation feature

In this section, we propose a generic construction of attribute-based signcryption Π𝖠𝖡𝖲𝖢 from attribute-based signature Π𝖠𝖡𝖲 and attribute-based encryption Π𝖠𝖡𝖤 based on restricted delegation (Definition 5.4). The construction assumes UF-NMA security of Π𝖠𝖡𝖲 and IND-CPA security of Π𝖠𝖡𝖤, and guarantees sUF-CMA and IND-CCA security. The other supportive primitives, Π𝖢𝗈𝗆𝗆𝗂𝗍 and Π𝖮𝖳𝖲, will have the hiding property and strong unforgeability, respectively. In addition, we assume that the primitives Π𝖠𝖡𝖲 and Π𝖠𝖡𝖤 must have restricted delegation with respect to the delegation-friendly index transformer [31] defined below.

Definition 5.3

A triple of maps 𝒯1:𝒳→𝒳′, 𝒯2:𝒳×{0,1}n→𝒳′ and 𝒯3:𝒴×{0,1}n→𝒴′ is called delegation-friendly index-transformer from (∼,𝒳,𝒴) to (∼′,𝒳′,𝒴′) if the following conditions are satisfied for all x∈𝒳, 𝗏𝗄≠𝗏𝗄′∈{0,1}n and y∈𝒴:

x∼y⇔x𝗏𝗄∼′y𝗏𝗄,
x≁y⇒x′≁′y𝗏𝗄,
x𝗏𝗄≁′y𝗏𝗄′,

where we simply denote 𝒯1⁢(x), 𝒯2⁢(x,𝗏𝗄) and 𝒯3⁢(y,𝗏𝗄) by x′, x𝗏𝗄 and y𝗏𝗄, respectively. The items (1), (2), (3) defined above will be referred to as conditions (1), (2), (3) throughout throughout Section 5.2.

Definition 5.4

Definition 5.4 (Restricted delegation for ABE (resp. ABS) [31])

An algorithm Delegate is said to be a restricted-delegatable algorithm for an ABE (resp. ABS) with respect to an index-transformer (𝒯1,𝒯2,𝒯3) if for all x∈𝒳, 𝗏𝗄∈{0,1}n, equation (5.1) holds for the partial order of the form x𝗏𝗄≻x𝗏𝗄 and x′≻x𝗏𝗄.

If the delegation-friendly index-transformer (𝒯1,𝒯2,𝒯3) is applied to ABS (resp. ABE), we use the notation (𝒯1s,𝒯2s,𝒯3s) (resp. (𝒯1e,𝒯2e,𝒯3e)).

A generic construction based on restricted delegation. Let (𝒯1s,𝒯2s,𝒯3s) and (𝒯1e,𝒯2e,𝒯3e) be the valid index-transformers for ABS and ABE, respectively, where domain and range will be understood from the context. For the combined-framework, these transformers are identical. If the notation (𝒯1,𝒯2,𝒯3) is found further in this paper, it will mean index-transformations for both ABS and ABE. In Scheme 5.5, both constructions are given, in combined-framework and independent-framework. In most of the descriptions of the algorithms, we omit public parameters and master secret key as these are understood from the context.

Scheme 5.5

Scheme 5.5 (Generic construction based on restricted delegation)

Independent. Setup(1κ,j): It returns (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦), where
𝒋:=(𝒋s,𝒋e),
𝒫𝒫:=(𝒋′:=(𝒋s′,𝒋e′),𝒞𝒦←C.Setup(1κ),𝒜ℬ𝒮.𝒫𝒫,𝒜ℬℰ.𝒫𝒫),
ℳ𝒮𝒦:=(𝒜ℬ𝒮.ℳ𝒮𝒦,𝒜ℬℰ.ℳ𝒮𝒦),
(𝒜ℬ𝒮.𝒫𝒫,𝒜ℬ𝒮.ℳ𝒮𝒦)←ABS.Setup(1κ,𝒋s′),
(𝒜ℬℰ.𝒫𝒫,𝒜ℬℰ.ℳ𝒮𝒦)←ABE.Setup(1κ,𝒋e′).
We note that the system-indices, 𝒋s′ and 𝒋e′ define the index spaces (𝒳s′,𝒴s′) for hired ABS and (𝒳e′,𝒴e′) for hired ABE, respectively. Actually there is a system-index transformation (referred to as 𝒯0 in Section 5.4) which takes care of moving from 𝒋 to 𝒋′.
Combined. Setup(1κ,j): It returns (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦), where
𝒫𝒫:=(𝒋′,𝒞𝒦←C.Setup(1κ),𝒜ℬ.𝒫𝒫),
ℳ⁢𝒮⁢𝒦:=𝒜⁢ℬ.ℳ⁢𝒮⁢𝒦,
(𝒜ℬ.𝒫𝒫,𝒜ℬ.ℳ𝒮𝒦)←AB.Setup(1κ,𝒋′).
Independent. KeyGen(x): It returns 𝒮⁢𝒦x, where
x:=(xs,xe),
𝒮𝒦x:=(𝒮𝒦xs:=𝒮𝒦xs′′,𝒮𝒦xe:=𝒮𝒦xe′′),
𝒮⁢𝒦xs′′←ABS.KeyGen⁢(xs′),
𝒮⁢𝒦xe′′←ABE.KeyGen⁢(xe′).
Combined. KeyGen(x): It returns 𝒮⁢𝒦x, where
x=xs=xe,
𝒮⁢𝒦x:=𝒮⁢𝒦x′′,
𝒮⁢𝒦x′′←AB.KeyGen⁢(x′).
𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(m,𝒮⁢𝒦xs,ys,ye):=((𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)←𝖢𝗈𝗆𝗆𝗂𝗍(m);∥(𝗏𝗄,𝗌𝗂𝗀𝗇𝗄)←OTS.Gen(1κ);K←𝖣𝖾𝗅𝖾𝗀𝖺𝗍𝖾⁢(𝒮⁢𝒦xs′′,xs′,x𝗏𝗄s)⁢ where ⁢x𝗏𝗄s:=𝒯2s⁢(xs,𝗏𝗄s);δw←ABS.Sign(𝖼𝗈𝗆,K,y𝗏𝗄s);∥𝖢←ABE.Encrypt(𝖽𝖾𝖼𝗈𝗆,y𝗏𝗄e);where ⁢y𝗏𝗄s:=𝒯3s⁢(ys,𝗏𝗄s)⁢ and ⁢y𝗏𝗄e:=𝒯3e⁢(ye,𝗏𝗄e);δo←OTS.Sign(δw∥𝖢∥𝖼𝗈𝗆∥ys,𝗌𝗂𝗀𝗇𝗄);it returns 𝖴:=(𝖼𝗈𝗆,δ:=(δw,δo,𝗏𝗄),𝖢)).
𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝖴,𝒮⁢𝒦xe,ys):={𝖮𝗉𝖾𝗇⁢(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆)if ⁢(OTS.Ver(δw∥𝖢∥𝖼𝗈𝗆∥ys,δo,𝗏𝗄)=1;∥ABS.Ver(𝖼𝗈𝗆,δw,y𝗏𝗄s)=1;∥let 𝖽𝖾𝖼𝗈𝗆←ABE.Decrypt⁢(𝖢,K);where ⁢K←𝖣𝖾𝗅𝖾𝗀𝖺𝗍𝖾⁢(𝒮⁢𝒦xe′′,xe′,x𝗏𝗄e))⊥otherwise.

Correctness. For all (𝒫⁢𝒫,ℳ⁢𝒮⁢𝒦)←𝖲𝖾𝗍𝗎𝗉⁢(1κ,𝒋), all x,x~∈𝒳, all ys,ye∈𝒴 with x~∼ys, all 𝒮⁢𝒦x:=𝒮⁢𝒦x′′←𝖪𝖾𝗒𝖦𝖾𝗇⁢(x′), all 𝒮⁢𝒦x~:=𝒮⁢𝒦x~′′←𝖪𝖾𝗒𝖦𝖾𝗇⁢(x~′) and all 𝖴←𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(m,𝒮⁢𝒦x~,ys,ye), we have

𝖴𝗇𝗌𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍(𝖴,𝒮𝒦x,ys)=𝖮𝗉𝖾𝗇(𝖼𝗈𝗆,ABE.Decrypt(𝒜ℬℰ.𝒫𝒫,𝖢,𝒮𝒦x𝗏𝗄e′))

=𝖮𝗉𝖾𝗇(𝖼𝗈𝗆,𝖽𝖾𝖼𝗈𝗆(resp.⊥)) if x∼ye(resp. x≁ye)

=m(resp.⊥).

The first equality is valid by correctness of ABS, OTS and definition, the second equality by correctness of ABE and condition (1), and the third equality by correctness of the commitment.

Intuition of our design. If we identify ℐ⁢𝒟R with ye and ℐ⁢𝒟S with ys, then the design of the proposed construction is very similar to that of Π𝖲𝖢 (in Section 4.1). On contrary, we do not need to add ye to the message of OTS as it is given as a part of the ciphertext C. We use the convention (as used in ABS [28, 34]) that the sender sends both the signcryption U and ys to the receiver.

Intuition for vks and vke. In the starting of this section, we have defined that 𝗏𝗄s=0∥𝗏𝗄 and 𝗏𝗄e=1∥𝗏𝗄, where 𝗏𝗄∈{0,1}n-1 is the verification key for OTS. The intuition for taking 𝗏𝗄s and 𝗏𝗄e in this form is similar to the padding vk with extra bit 0 or 1 in the construction of CCA-secure HIBE [7]. More precisely, the intuition is the following. In the security proof, the adversary 𝒜 may ask many queries of its own choice as long as the queries are valid in the security model. Let (𝖴,x,ys) be any unsigncrypt query made by 𝒜, where 𝖴=(𝖼𝗈𝗆,δ=(δw,δo,𝗏𝗄),𝖢). A simulator ℬ first makes a key query for x𝗏𝗄e to the challenger 𝒞⁢ℋ for ABS and then answers the unsigncrypt query by the replied key for the index x𝗏𝗄e. If 𝗏𝗄∗ and ys∗ are respectively the verification key and signer policy for the forgery 𝖴∗, for correctness of the unforgeability model of ABS we must require that x𝗏𝗄e≁′y𝗏𝗄s∗, where y𝗏𝗄s∗:=𝒯3s⁢(ys∗,𝗏𝗄s∗). As 𝗏𝗄e≠𝗏𝗄s∗, the above requirement is guaranteed by condition (3).

For the independent-framework, one can set 𝗏𝗄s:=𝗏𝗄e:=𝗏𝗄 with 𝗏𝗄∈{0,1}n. In this case, ℬ does not require the key query for the x𝗏𝗄e to 𝒞⁢ℋ for ABS as ℬ itself plays the role of PKG for ABE. Since we represent the construction for both frameworks together, we keep the former description of 𝗏𝗄s and 𝗏𝗄e.

Theorem 5.6

If ΠABS is perfectly private, then the proposed signcryption scheme ΠABSC in Scheme 5.5 is perfectly private (Definition 2.15).

Proof.

It can be easily verified from the construction given in Scheme 5.5. ∎

Theorem 5.7

Let (T1,T2,T3) be a delegation-friendly index-transformer, ΠABE an AP-IND-CPA secure ABE scheme with the restricted delegation, ΠOTS a strong unforgeable OTS, and ΠCommit a commitment scheme with the hiding property. Then the proposed signcryption scheme ΠABSC in Scheme 5.5 is APs-IND-CCA secure (Definition 2.16).

Proof sketch of Theorem 5.7. Confidentiality of the proposed signcryption scheme Π𝖠𝖡𝖲𝖢 relies on IND-CPA security of Π𝖠𝖡𝖤 and strong unforgeability of Π𝖮𝖳𝖲. Therefore, 𝒜 can not break the claimed confidentiality of Π𝖠𝖡𝖲𝖢 even if 𝒜 forges the primitive ABS scheme Π𝖠𝖡𝖲. Suppose an adversary 𝒜 can break APs-IND-CCA security of the proposed scheme Π𝖠𝖡𝖲𝖢. Then we establish a PPT simulator ℬ for breaking either IND-CPA security of Π𝖠𝖡𝖤 or strong unforgeability of Π𝖮𝖳𝖲 or the hiding property of Π𝖢𝗈𝗆𝗆𝗂𝗍 with the help of 𝒜.

Let (𝗏𝗄∗,𝗌𝗂𝗀𝗇𝗄∗) be the key pair of Π𝖮𝖳𝖲 used in the construction of challenge signcryption. The proof consists of the hybrid arguments over the games GameReal, Game0 and Game1. GameReal is the original APs-IND-CCA game of the signcryption scheme. GameReal is modified to Game0, where for unsigncrypt query of the form 𝖴=(𝖼𝗈𝗆,δ=(δw,δo,𝗏𝗄∗),𝖢)) the adversary 𝒜 always gets ⊥ as reply. Game0 is modified to Game1, where the decommitment part in the construction of challenge signcryption is replaced by a random element from the decommitment space. We show that GameReal and Game0 are indistinguishable under the strong unforgeability of Π𝖮𝖳𝖲. The strong unforgeability basically ensures that the challenge signcryption can not be modified to another signcryption with the same verification key 𝗏𝗄∗.

We prove that Game0 and Game1 are indistinguishable under the IND-CCA security of Π𝖠𝖡𝖤. In the proof, a PPT simulator ℬ is established which is responsible to answer the keygen query, signcrypt query and unsigncrypt query made by 𝒜. Simulator ℬ answers all the queries of 𝒜 with the help of the keygen oracle of ABE as the only resource, which is handled by a challenger 𝒞⁢ℋ for Π𝖠𝖡𝖤. We show that ℬ answers all the queries perfectly without violating the rule of the IND-CPA game of ABE while interacting with 𝒞⁢ℋ.

Finally, we show that 𝒜 has no advantage in Game1 if the primitive commitment scheme Π𝖢𝗈𝗆𝗆𝗂𝗍 has the hiding property.

In the following, we only provide the proof for the combined-framework as there are some issues of distribution or the capability of the simulator ℬ as compared to that of the independent-framework. In the independent-framework, ℬ knows 𝒜⁢ℬ⁢𝒮.ℳ⁢𝒮⁢𝒦 as ℬ itself runs the ABS.Setup algorithm and therefore it can simulate the objects involved in ABS. Here we point out that 𝒜 can not produce a valid signcryption from a given signcryption U even if 𝒜 forges the ABS part of the signcryption U. The reason is the following. For a valid signcryption, all the components are signed using the OTS and the verification key vk is attached to the messages of ABS.Sign and ABE.Encrypt. For the given signcryption U, 𝒜 does not know the signing key signk. Now if 𝒜 produces a new signcryption 𝖴~ from U by forging the ABS part of U, then either 𝖴~ is invalid or the OTS is forged. Since we assume the strong unforgeability of the OTS, 𝒜 can not have any advantage of using the weakness of ABS in the confidentiality game.

Proof.

Let 𝖴∗=(𝖼𝗈𝗆∗,δ∗,𝖢∗) denote the challenge signcryption for (ys∗,ye∗), where δ∗=(δw∗,δo∗,𝗏𝗄∗). Let 𝖴=(𝖼𝗈𝗆,δ,𝖢) be any unsigncrypt query with the policies (ys,ye), where δ=(δw,δo,𝗏𝗄). Let ν be the number of unsigncrypt queries to the unsigncrypt oracle. We define an event E as

𝖤:=[(𝗏𝗄∗=𝗏𝗄)∧(δo∗∥δw∗∥𝖢∗∥𝖼𝗈𝗆∗∥ys∗≠δo∥δw∥𝖢∥𝖼𝗈𝗆∥ys)].

We will apply the hybrid arguments over the following games:

GameReal: The original APs-IND-CCA game of the signcryption scheme.
Game0: Same as GameReal, except that on the unsigncrypt query the challenger always returns ⊥ if E occurs.
Game1: Same as Game0, except for 𝖢∗←ABE.Encrypt⁢(𝖽𝖾𝖼𝗈𝗆r,ye∗), where 𝖽𝖾𝖼𝗈𝗆r←UD and D is the decommitment space.

Using Lemmas 5.8, 5.9 and 5.10, we have the following reduction:

𝖠𝖽𝗏𝒜,ABSCIND-CCA⁢(κ)=𝖠𝖽𝗏𝒜,ABSCReal⁢(κ)

≤|𝖠𝖽𝗏𝒜,ABSCReal⁢(κ)-𝖠𝖽𝗏𝒜,ABSC0⁢(κ)|+|𝖠𝖽𝗏𝒜,ABSC0⁢(κ)-𝖠𝖽𝗏𝒜,ABSC1⁢(κ)|+|𝒜,ABSC⁢1⁢κ|

≤𝖠𝖽𝗏ℬ0,𝖮𝖳𝖲sUF-CMA⁢(κ)+2.𝖠𝖽𝗏ℬ1,ABEIND-CPA⁢(κ)+𝖠𝖽𝗏ℬ2,𝖢𝗈𝗆𝗆𝗂𝗍Hiding⁢(κ),

where ℬ0,ℬ1 and ℬ2 are PPT algorithms whose running times are the same as that of 𝒜. This concludes the theorem. ∎

Lemma 5.8

GameReal and Game0 are indistinguishable under the strong unforgeability of the one-time signature scheme ΠOTS. That is, for any adversary A, there is a PPT algorithm B such that

|𝖠𝖽𝗏𝒜,ABSCReal⁢(κ)-𝖠𝖽𝗏𝒜,ABSC0⁢(κ)|≤𝖠𝖽𝗏ℬ,𝖮𝖳𝖲sUF-CMA⁢(κ).

Proof.

If an adversary 𝒜 can distinguish the games with advantage ϵ, then we will establish a PPT algorithm ℬ for breaking strong unforgeability of Π𝖮𝖳𝖲 with probability at least ϵ. Here ℬ plays two roles, the role of an adversary in the sUF-CMA game and the role of a challenger in the APs-IND-CCA game. The security proof consists of the following phases.

𝒞⁢ℋ runs OTS.Gen to generate (𝗏𝗄∗,𝗌𝗂𝗀𝗇𝗄∗) and then gives 𝗏𝗄∗ to ℬ. Then ℬ runs the Setup algorithm, keeps ℳ⁢𝒮⁢𝒦 to itself and gives the public parameters 𝒫⁢𝒫 to 𝒜.

Phase 1/2 query. It consists of the following queries in an adaptive manner:

KeyGen query. Let x be any key query made by 𝒜. Since ℬ knows ℳ⁢𝒮⁢𝒦, it replies 𝒮⁢𝒦x to 𝒜.
Signcrypt query. Let (m,x,ys,ye) be any signcrypt query made by 𝒜. Then ℬ constructs a key 𝒮⁢𝒦x using ℳ⁢𝒮⁢𝒦. Then, using this key, it runs the Signcrypt algorithm (as described in Scheme 5.5) and answers the signcryption U to 𝒜.
Unsigncrypt query. Let (𝖴,x,ys), where 𝖴=(𝖼𝗈𝗆,δ,𝖢) is any unsigncrypt query made by 𝒜. If this query satisfies the event E, ℬ returns δo and aborts. ℬ first constructs 𝒮⁢𝒦x and then, using this key, it runs the Unsigncrypt algorithm (as described in Scheme 5.5) and returns the output to 𝒜.

Challenge phase.𝒜 submits to ℬ two equal length messages m0,m1, a key index x, a challenge sender’s associated data index ys∗ and a challenge receiver’s associated data index ye∗. Then ℬ computes the key 𝒮⁢𝒦xs as it knows ℳ⁢𝒮⁢𝒦. It picks b←U{0,1} and runs 𝖲𝗂𝗀𝗇𝖼𝗋𝗒𝗉𝗍⁢(𝒫⁢𝒫,mb,ys∗,ye∗), where it queries for one-time signature to 𝒞⁢ℋ for the message δw∗∥𝖢∗∥𝖼𝗈𝗆∗∥ys∗ and gets the replied signature δo∗. It returns 𝖴∗:=(𝖼𝗈𝗆∗,δ∗,𝖢∗) to 𝒜, where δ∗:=(δw∗,δo∗,𝗏𝗄∗).

Guess.𝒜 sends a guess b′ to ℬ. (ℬ does nothing with this b′.)

Analysis. Both games are identical except for the event E with probability ϵ. By the event E, we have δo∗⁢∥δw∗∥⁢𝖢∗⁢∥𝖼𝗈𝗆∗∥⁢ys∗≠δo⁢∥δw∥⁢𝖢⁢∥𝖼𝗈𝗆∥⁢ys. Therefore, δo is a valid forgery for the message δw∥𝖢∥𝖼𝗈𝗆∥ys. ∎

Lemma 5.9

Game0 and Game1 are indistinguishable under IND-CPA security of the primitive encryption scheme ΠABE. That is, for any adversary A, there is a PPT algorithm B such that

12⁢|𝖠𝖽𝗏𝒜,ABSC0⁢(κ)-𝖠𝖽𝗏𝒜,ABSC1⁢(κ)|≤𝖠𝖽𝗏ℬ,ABEIND-CPA⁢(κ).

Proof.

Suppose an adversary 𝒜 breaks the indistinguishability of the games with advantage ϵ. Then we construct a PPT algorithm ℬ for breaking IND-CPA security of Π𝖠𝖡𝖤 with advantage at least ϵ/2. Let 𝒞⁢ℋ be the challenger for the primitive encryption scheme Π𝖠𝖡𝖤. The main challenging task for ℬ is to answer the signcrypt and unsigncrypt queries of 𝒜 without violating the rules of the CPA game with 𝒞⁢ℋ. We show that ℬ perfectly simulates the answers to all queries made by 𝒜 with the help of the only resource supplied by 𝒞⁢ℋ, i.e., the KeyGen oracle. ℬ runs (𝗏𝗄∗,𝗌𝗂𝗀