A Traceable Ring Signcryption Scheme Based on SM9 for Privacy Protection

Abstract

To address the issues of insufficient privacy protection, lack of confidentiality, and absence of traceability mechanisms in resource-constrained application scenarios such as IoT nodes or mobile network group communications, this paper proposes a traceable ring signcryption privacy protection scheme based on the SM9 algorithm. In detail, the ring signcryption structure is designed based on the SM9 identity-based cryptography algorithm framework. Additionally, the scheme introduces a dynamic accumulator to compress ciphertext length and optimizes the algorithm to improve computational efficiency. Under the random oracle model, it is proved that the scheme has unforgeability, confidentiality, and conditional anonymity, and it is also demonstrated that conditional anonymity can be used to trace the identity of the actual signcryptor in the event of a dispute. Performance analysis shows that, compared with related schemes, this scheme improves the efficiency of signcryption, and the size of the signcryption ciphertext remains at a constant level.

1. Introduction

In recent years, network communications and information technology have developed rapidly. Multi-user communication has been widely applied in the following scenarios: electronic voting, consortium blockchains, vehicular networks, and information sharing [1,2,3]. However, in an open network environment, multi-user communication faces security issues such as user identity privacy leakage, message tampering, and difficulty in tracing responsibility. Consequently, achieving user anonymity and traceability while ensuring communication confidentiality has become one of the key technologies in information security.

Signcryption refers to completing signing and encryption simultaneously in the same process, which ensures message confidentiality and authenticity, simultaneously achieving reductions in both computational and communication overhead. It is widely used in scenarios such as secure authentication, IoT security, and privacy protection [4,5,6,7]. Ring signcryption combines ring signatures with signcryption technology, allowing the receiver to verify that a message comes from a set of users without knowing the specific signcryptor, thus achieving conditional anonymity of the sender. In recent years, ring signcryption technology has received widespread attention in privacy protection and traceability research. Cai et al. [8] devised a mechanism for conditional privacy preservation specifically designed for (VANET) environments based on ring signcryption, achieving confidentiality protection and message authentication, while supporting identity traceability. Guo et al. [9] constructed a new Certificate-Less Ring Signcryption (CLRSC) scheme, which was proven secure under the random oracle model. Gupta et al. [10] proposed a verifiable anonymous ring signcryption scheme based on elliptic curves, effectively enhancing communication reliability. Luo et al. [11] addressed the problems of single-functionality and difficult-to-verify traceability in VANETs, proposing an innovative framework leveraging generalized ring signcryption and a public verification algorithm. This protocol was proven secure and had lower computational costs compared to similar schemes. Cai et al. [8] proposed a conditional privacy-preserving framework leveraging ring signcryption. However, Du et al. [12] later identified several defects in its construction, including decryption failures and the lack of anonymity and traceability. To overcome these flaws, they presented an enhanced scheme that overcomes these limitations while maintaining high efficiency in VANET environments. Zhan et al. [13] proposed an efficient multi-mode certificate-less ring signcryption scheme for VANET privacy scenarios, addressing the issues of single anonymity level and traceability vulnerability. The scheme integrates three anonymity levels, resists manipulation of traceability parameters, and is proven secure. Zhang et al. [14] designed a Lattice-based Ring Signature Cryption (LRSC) scheme to address privacy leakage and future quantum attack threats faced by existing Blockchain Cold Chain Logistics (BCCL) frameworks, and proved the security of the scheme through formal security proofs.

Although ring signcryption performs well in terms of anonymity and confidentiality compared with other cryptographic primitives, it has certain limitations in providing fine-grained access control. Satar et al. [15] proposed the cipher-policy Attribute-Based Encryption (CP-ABE) scheme, which provides flexible access policies and significantly improves the operational efficiency and security of cloud computing applications. Unlike these attribute-based methods that support complex access structures, traditional ring signature encryption typically has coarse-grained access rights. Therefore, the focus of this study is to optimize the traceability and efficiency of the ring signcryption framework to address the applicability issues in lightweight multi-user communication.

Traditional signcryption schemes are mostly based on Public Key Infrastructure (PKI) and face issues such as complex certificate management. SM9 is a domestically designed Identity-Based Cryptography (IBC) system in China, which generates public keys directly from user identity information without relying on third-party certificates, simplifying key management and offering better practicality. In addition, it is very important to address the inherent key escrow limitations of IBC schemes like SM9. We acknowledge that certificate-less public key cryptography (CL-PKC) can effectively mitigate key escrow issues. Alotaibi et al. [16] points out that ensuring data ownership, privacy, and decentralized control is crucial for mitigating security vulnerabilities in modern IoT ecosystems. However, in our proposed scheme, the KGC, as a trusted authority, will centrally manage the keys to achieve conditional traceability. In recent years, research on SM9-based signcryption has gradually emerged. Lai et al. [17] proposed the first SM9-based signcryption scheme and proved its confidentiality and unforgeability under the random oracle model. Bao et al. [18] combined SM9 with ring signcryption and applied it to an anonymous reservation mechanism for the Internet of Vehicles in electric vehicles, achieving user privacy protection. Yu et al. [19] proposed a Consortium Blockchain-based Identity Ring Signcryption (CB-IDRSC) scheme, introducing multiple private key generators to enhance privacy and decentralization. Luo et al. [20] constructed a conditional privacy-preserving protocol for V2I communication in IoV, which supports heterogeneous cross-domain ring signcryption, enabling cross-domain communication between certificate-based systems and PKI systems, and verified its confidentiality and unforgeability through security proofs.

Anonymity is an important mechanism for protecting user privacy, but it can also be misused to conceal illegal activities. To address the risk of misuse of anonymity mechanisms, researchers have proposed various cryptographic schemes that achieve accountability while protecting privacy. Fujisaki et al. [21,22] proposed traceable ring signatures, introducing a tagging mechanism to restrict repeated signatures and designing sublinear signature schemes to reduce signature overhead. Tang et al. [23] proposed multi-authorized traceable ring signatures for blockchain-based smart grids, achieving signcryptor identification without secret information. To mitigate the privacy leakage in blockchain and avoid the high certificate management costs of Public Key Infrastructure (PKI). An et al. [24] used dynamic cryptographic accumulators [25,26] to propose constant-size ring signature schemes. Theoretical analysis and experimental results based on the Miracl library show that their approach is secure in the random oracle model and achieves higher efficiency than existing solutions, especially in terms of communication costs when the ring size exceeds 20. Ding et al. [27] proposed SM9-based deniable ring signatures, realizing both confirmation and denial functions. Xie et al. [28] introduced dynamic accumulators and designed traceable ring signature schemes, proving their Existential Unforgeability Under Adaptive Chosen-Message-and-Identity Attack (EUF-CMIA) security and conditional anonymity under the random oracle model. Wei et al. [29] further proposed identity-based traceable ring signature schemes that can reveal the signcryptor’s identity in case of disputes and avoid key escrow issues.

However, significant limitations remain in these existing schemes. Firstly, the scheme proposed by Cai et al. [8] has been identified with security flaws, such as failing to satisfy anonymity and being unable to reliably reveal malicious users’ identities. Secondly, regarding efficiency, the computational cost of Yu et al. [19] in both signcryption and unsigncryption phases increases linearly with the number of ring members. Similarly, while Wei et al. [29] achieved constant ciphertext size, their computational cost still grows linearly. These linear inefficiencies can lead to excessive resource consumption and delays, making them unsuitable for resource-constrained environments, especially IoT nodes and mobile networks.

To address these issues, this scheme optimizes computational efficiency by introducing a dynamic cryptographic accumulator, achieving constant computational overhead and ciphertext size. This scheme’s constant computational overhead reduces bandwidth and energy consumption during data transmission, making our approach more effective in latency-sensitive scenarios, such as vehicular ad hoc networks (VANETs) and mobile crowdsensing. The comparison of security and efficiency with the relevant schemes is shown in Table 1.

Table 1. Comparison of security features and efficiency with related schemes.

Scheme	Confidentiality	Unforgeability	Anonymity	Traceability	Ciphertext Size	Comp. Cost
Ref. [8]	✓	✓	×	×	$O\left(n\right)$	$O\left(n\right)$
Ref. [19]	✓	✓	✓	×	$O\left(n\right)$	$O\left(n\right)$
Ref. [29]	✓	✓	✓	✓	$O\left(1\right)$	$O\left(n\right)$
Ours	✓	✓	✓	✓	$O\left(1\right)$	$O\left(1\right)$

Comp. cost: Computational cost.

The major contributions of this study are outlined below:

• Designing a traceable ring signcryption scheme based on SM9 by leveraging its identity-binding mechanism to construct an efficient and secure ring signcryption structure;
• Introducing a dynamic accumulator to compress ciphertext length and optimizing the signcryption and decryption algorithms to significantly enhance computational efficiency;
• Proving under the random oracle model that the scheme satisfies unforgeability, confidentiality, and conditional anonymity, thereby achieving strong security guarantees and high efficiency with promising practical applicability.

The rest of the paper is structured as follows. Section 2 provides the mathematical preliminaries. Section 3 presents the proposed traceable ring signcryption scheme based on SM9. Section 4 is dedicated to the correctness verification and security analysis of our scheme. Section 5 evaluates the performance through experimental tests. Finally, Section 6 concludes the paper.

2. Preliminaries

This section establishes the mathematical foundations for the proposed scheme. It encompasses the fundamental definitions of bilinear pairings and the underlying problem assumptions.

2.1. Bilinear Pairing

Define ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$ as additive cyclic groups of order N with generators $P_1$ and $P_2$, respectively, and ${\mathbb{G}}_T$ as a multiplicative cyclic group of order N. The bilinear pair e: ${\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$ is a mapping satisfying the following properties.

• Bilinear: For any element $X\in {\mathbb{G}}_1,Y\in {\mathbb{G}}_2$ and $a,b\in {\mathbb{Z}}_N^{\ast }$, exist $e(\left[a\right]X,\left[b\right]Y)=e{(X,Y)}^{ab}$.
• Non-degenerate: At least one element exists $X\in {\mathbb{G}}_1,Y\in {\mathbb{G}}_2$ satisfied $e(X,Y)\ne 1$.
• Computability: For any $X\in {\mathbb{G}}_1,Y\in {\mathbb{G}}_2$ There is an efficient polynomial algorithm for computation $e(X,Y)$.

2.2. Problem Assumptions

• The $\mathit{q}$-Strong Diffie-Hellman Problem ($\mathit{q}$-SDH). For an unknown positive integer $a\in {\mathbb{Z}}_N^{\ast }$, given $q+2$ elements $(X,Y,\left[a\right]Y,\left[a^2\right]Y,\cdots ,\left[a^q\right]Y)\in {\mathbb{G}}_1\times {\mathbb{G}}_2^{q+1}$, probabilistic polynomial-time (PPT) adversary calculate a pair $\left(c,\left[{\displaystyle \frac{1}{c+a}}\right]X\right)$ where $c\in {\mathbb{Z}}_N^{\ast }$.
• The $\mathit{q}$-Bilinear Diffie-Hellman Inversion Problem ($\mathit{q}$-BDHI). For an unknown positive integer $a\in {\mathbb{Z}}_N^{\ast }$, given $q+2$ elements $(X,Y,\left[a\right]Y,\left[a^2\right]Q,\cdots ,\left[a^q\right]Y)\in {\mathbb{G}}_1\times {\mathbb{G}}_2^{q+1}$, PPT adversary compute $e{(X,Y)}^{1/a}$.

2.3. SM9 Digital Signature Algorithm

SM9 digital signature is an identity-based signature algorithm. It adopts elliptic curvilinear cryptography technology, which is different from the traditional public key signature algorithm. This algorithm uses identification information (such as user names or email addresses) as public keys to achieve identity verification, reducing the complex certificate management process in the traditional Public Key Infrastructure (PKI). The specific description of the SM9 digital signature algorithm scheme is as follows:

• System Initialization. The Key Generation Center (KGC) enters the system security parameter $\lambda$. Build a bilinear pairing e: ${\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$. The KGC randomly selects $ks\in {\mathbb{Z}}_N^{\ast }$ as the main private key and keeps it confidential. It calculates the master public key $P_{pub}=\left[ks\right]P_2$ and publishes it. Define cryptographic hash functions $H_1$: ${\{0,1\}}^{\ast }\to {\mathbb{Z}}_N^{\ast }$ and $H_2$: ${\{0,1\}}^n\times {\mathbb{G}}_T\to {\mathbb{Z}}_N^{\ast }$. The system outputs the public parameters $params=\{e,{\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T,P_1,P_2,P_{pub},H_1,H_2,hid\}$.
• Key Extraction. The KGC utilizes user $I{D}_i$. Generate the user’s signature private key $s{k}_i=\left[t_2\right]P_1$, $t_2=ks·t_1^{-1}$, $t_1=H_1(I{D}_i\Vert hid,N)+ks$.
• Signature. Given User $I{D}_{\pi }$’s private key $s{k}_{\pi }$, message M, and master public key $P_{pub}$, randomly select $r\in {\mathbb{Z}}_N^{\ast }$. Compute ${\sigma }_1=H_2(M\parallel e{(P_1,P_{\mathrm{pub}})}^r)$ and ${\sigma }_2=(r-{\sigma }_1)s{k}_{\pi }$. Output the signature value $\sigma =({\sigma }_1,{\sigma }_2)$.
• Signature Verification. Given master public key $P_{pub}$, User identity $I{D}_{\pi }$, message M, and signature $\sigma$, the verifier computes $P=H_1\left(I{D}_{\pi }\right)·P_2+P_{pub}$. Verify whether the equation ${\sigma }_1=H_2(M\parallel e({\sigma }_2,P)·e{(P_1,P_{pub})}^{{\sigma }_1})$ holds. If it holds, $\sigma$ is a valid signature; otherwise, the signature is invalid.

2.4. Dynamic Accumulators

Dynamic accumulators allow users to prove that an element belongs to a set without revealing individual members of the set. It can be used in anonymous credentials, group signatures, and ring signatures. This paper combines the dynamic accumulator scheme proposed by [24,25] and includes the following 4 algorithms:

• Accumulator Initialization Algorithm. Following the definition of the bilinear pairing $e:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$, randomly select $s\in {\mathbb{Z}}_N^{\ast }$ and set $L=\{P_1,\left[s\right]P_1,\left[s^2\right]P_1,\dots ,\left[s^q\right]P_1\}$, where q is the maximum upper limit of elements that can be accumulated. Create a dynamic accumulator instance by randomly selecting $u\in {\mathbb{Z}}_N^{\ast }$ and initializing the accumulator value as $V_0=u·P_1$.
• Accumulator Evaluation Algorithm. Given the accumulator value $V_0$ and the set $B=\{b_1,\dots ,b_k\}\subset {\mathbb{Z}}_N^{\ast }\setminus \{-s\}$ with $k\le q$, the accumulator value ${\prod }_{i=1}^k(b_i+s)V_0$ can be computed using the tuple L without knowing s.
• Accumulator Member Addition Algorithm. To add a member $b^{\prime }\notin B$, update the accumulator value to $V^{\prime }=(b^{\prime }+s)V$, and update the witness to $W^{\prime }=V+(b^{\prime }-b)W$.
• Accumulator Member Deletion Algorithm. To delete a member $b^{\prime }\in B$, update the accumulator value to $V^{\prime }={(b^{\prime }+s)}^{-1}V$, and update the witness to $W^{\prime }={(b^{\prime }-b)}^{-1}(W-V^{\prime })$.

3. Traceable Ring Signcryption Scheme Based on SM9

This section elaborates on the architectural framework and the detailed design of the traceable ring signcryption scheme based on the SM9 algorithm.

3.1. System Model

The system model diagram of the proposed scheme, which is explicitly designed for resource-constrained applications (e.g., IoT sensing nodes or vehicular communication units), is shown in Figure 1.

Figure 1. System model.

The three entities in the model collaboratively fulfill the system’s security and functional requirements. A trusted third party, KGC, performs system initialization and global key generation. In the framework based on SM9, the selection of KGC complies with the SM9 national standards [30] and is usually chosen from authoritative institutions that are strictly regulated by laws and administrative policies. Its credibility has been certified through strict security audits and physical security measures. To ensure that it does not abuse the master key, ring members perform ring-signcryption operations on plaintext data after receiving keys and accumulator-related parameters generated by the KGC. Receivers are responsible for decrypting and verifying the signcrypted ciphertext. In the event of disputes or malicious users performing anonymous signcryption, the KGC can trace and arbitrate the real signcryptor using a tracing algorithm and reveal their identity information.

• $\mathrm{Setup}$: The KGC sets the system parameters and generates the master public-private key pair.
• $\mathrm{KeyGen}$: Ring members and receivers register their identity with the KGC, which generates and distributes a public-private key pair bound to their identity.
• $\mathrm{Signcrypt}$: A designated signcryptor is chosen, and all ring members perform the ring signcryption algorithm on the plaintext data, generating accumulator-related parameters. The actual signcryptor remains anonymous within the ring structure.
• Unsigncrypt: After receiving the ciphertext, the recipient runs the signature decryption algorithm to obtain the plaintext data and verify the authenticity of the message.
• $\mathrm{Trace}$: A trusted third-party KGC can run the signcryptor tracing algorithm to traverse the ring user set and identify the actual signcryptor.

3.2. Algorithm Description

In this section, we detail the concrete algorithm of a traceable ring signcryption mechanism utilizing the SM9 standard. The scheme design employs the notation of the SM9 identity-based cryptographic algorithm, integrating ring signatures and signcryption techniques to achieve a unified approach to anonymity, confidentiality, and traceability. The overall operation of the scheme consists of five processes: setup, keygen, signcryption, unsigncryption, and trace.

3.2.1. Setup

The KGC generates a random integer $ks\in {\mathbb{Z}}_N^{\ast }$ as the master private key. It then computes the master public signing key $P_{pub2}=\left[ks\right]P_2\in {\mathbb{G}}_2$ and the master public encryption key $P_{pub1}=\left[ks\right]P_1\in {\mathbb{G}}_1$. The KGC keeps $ks$ secret, precomputes $g=e{(P_1,P_2)}^{ks}$, and publishes $P_{pub1}$ and $P_{pub2}$. Additionally, the KGC selects a 1-byte identifier for private key generation and generates a function identifier $hid$.

The KGC defines three hash functions: $H_1:{\{0,1\}}^{\ast }\to {\mathbb{Z}}_N^{\ast },H_2:{\{0,1\}}^n\times {\mathbb{G}}_T\times {\{0,1\}}^{\ast }\to {\mathbb{Z}}_N^{\ast },H_3:{\mathbb{G}}_1^3\times {\mathbb{G}}_T\times {\{0,1\}}^{\ast }\to {\{0,1\}}^n$.

For the accumulator parameters, a random integer $s\in {\mathbb{Z}}_N^{\ast }$ is selected. The system computes $S_{pub}=\left[s\right]P_2\in {\mathbb{G}}_2$ and the auxiliary set $L=\{P_1,\left[s\right]P_1,\left[s^2\right]P_1,\dots ,\left[s^q\right]P_1\}\subset {\mathbb{G}}_1$, where q denotes the maximum capacity of the accumulator. $S_{pub}$ and L are then made public. These parameters may be generated by the KGC or a trusted third party.

3.2.2. KeyGen

The KGC denotes the user’s identifier as $ID$ and proceeds to generate the corresponding signature and decryption private keys. Specifically, the KGC computes $t_1=H_1(ID\Vert hid,N)+ks$. If $t_1=0$, the system master key must be regenerated, requiring updates to the private keys of all existing users. Otherwise, the KGC computes $t_2=ks·t_1^{-1}$, and subsequently derives the signature private key $sk=\left[t_2\right]P_1$ and the decryption private key $dk=\left[t_2\right]P_2$. Finally, $sk$ and $dk$ are securely transmitted to the user.

3.2.3. Signcrypt

Given the recipient identity $I{D}_{\eta }$ and the ring user set $U_n=\{I{D}_1,I{D}_2,\dots ,I{D}_n\}$ (where $n\le q$), the signcryptor $I{D}_{\pi }$ ($1\le \pi \le n$) generates the signcryption of message M by performing the following steps:

• Step 1: Generate a random integer $r_0\in {\mathbb{Z}}_N^{\ast }$ and calculate ${\omega }_0=g^{r_0}$, ${\nu }_{\eta }=H_1(I{D}_{\eta }\Vert \mathit{hid},N)$, and $R_0=(r_0·{\nu }_{\eta })P_1+r_0·P_{pub1}$.
• Step 2: Compute the integers ${\nu }_i=H_1(I{D}_i\Vert hid,N)$ for all $1\le i\le n$. Then, compute the following elements in ${\mathbb{G}}_1$: $V=\left[{\prod }_{i=1}^n({\nu }_i+s)\right]P_1\mathrm{and}{W}_{\pi }=\left[{\prod }_{\begin{array}{c}j=1\\ j\ne \pi \end{array}}^n({\nu }_j+s)\right]P_1.$
• Step 3: Compute the elements in ${\mathbb{G}}_T$: $g_1=e(P_1,P_{pub2})·e(V,P_2)\mathrm{and}{g}_2=e(W_{\pi }+s{k}_{\pi },P_2).$
• Step 4: Generate random integers $r_1,r_2\in {\mathbb{Z}}_N^{\ast }$, and calculate the element $\omega \in {\mathbb{G}}_T$: $\omega =g_1^{r_1}·g_2^{r_2}.$
• Step 5: Calculate the hash value $h=H_2(U_n\Vert M\Vert \omega ,N)$.
• Step 6: Compute $R,S\in {\mathbb{G}}_1$ and $T\in {\mathbb{G}}_2$ as follows: $R=[r_1-h]W_{\pi },S=[r_1-h]s{k}_{\pi },T=[r_2{(r_1-h)}^{-1}+{\nu }_{\pi }]P_2.$
• Step 7: Compute the ciphertext $c=M\oplus H_3(R_0\Vert R\Vert S\Vert {\omega }_0\Vert I{D}_{\eta })$.
• Step 8: Output the signcryption $\sigma =(c,R,R_0,S,T,h)$ and send $U_n$ and $\sigma$ to the recipient.

Remark on Computation: Since the secret accumulator value s is unknown to the signcryptor, V and $W_{\pi }$ in Step 2 cannot be computed by directly plugging in s. Instead, the signcryptor utilizes the public parameters $L=\{P_1,\left[s\right]P_1,\left[s^2\right]P_1,\dots ,\left[s^q\right]P_1\}$.

Taking V as an example, the signcryptor expands the polynomial $f\left(x\right)={\prod }_{i=1}^n({\nu }_i+x)$:

$$f\left(x\right)=\prod _{i=1}^n({\nu }_i+x)=c_0+c_{1}x+c_2{x}^2+\cdots +c_n{x}^n.$$

(1)

The coefficients $c_k$ depend only on the known values ${\nu }_i$ and can be calculated efficiently. V is computed as a linear combination: $V=\left[c_0\right]P_1+\left[c_1\right]\left(\left[s\right]P_1\right)+\left[c_2\right]\left(\left[s^2\right]P_1\right)+\cdots +\left[c_n\right]\left(\left[s^n\right]P_1\right).$ Under fixed system parameters and ring users, the coefficients for Steps 2 and 3 can be precomputed to improve efficiency.

3.2.4. Unsigncrypt

Upon receiving the ring user set $U_n$ and the signcryption ${\sigma }^{\prime }=(c^{\prime },R^{\prime },R_0^{\prime },S^{\prime },T^{\prime },h^{\prime })$, the recipient $I{D}_{\eta }$ decrypt to obtain the plaintext $M^{\prime }$ and verify the ring signature by following these steps:

• Step 1: Check whether $h^{\prime }\in {\mathbb{Z}}_N^{\ast }$, $R^{\prime },S^{\prime }\in {\mathbb{G}}_1$, and $T^{\prime }\in {\mathbb{G}}_2$. If any of these checks fail, abort the decryption.
• Step 2: Compute the integers ${\nu }_i=H_1(I{D}_i\Vert hid,N)$ for all $1\le i\le n$. Simultaneously, compute the element $V\in {\mathbb{G}}_1$ as follows: $V=\left[{\prod }_{i=1}^n({\nu }_i+s)\right]P_1.$
• Step 3: Compute the element $g_1\in {\mathbb{G}}_T$: $g_1=e(P_1,P_{pub2})·e(V,P_2).$
• Step 4: Compute the element ${\omega }^{\prime }\in {\mathbb{G}}_T$: ${\omega }^{\prime }=e(R^{\prime },S_{pub}+T^{\prime })·e(S^{\prime },P_{pub2}+T^{\prime })·g_1^{h^{\prime }}.$
• Step 5: Calculate the shared secret ${\omega }_0^{\prime }=e(R_0^{\prime },d{k}_{\eta })$ and recover the message $M^{\prime }$: $M^{\prime }=c^{\prime }\oplus H_3(R_0^{\prime }\Vert {\omega }^{\prime }\Vert {\omega }_0^{\prime }\Vert I{D}_{\eta }).$
• Step 6: Recompute the hash value $h_2$: $h_2=H_2(U_n\Vert M^{\prime }\Vert {\omega }^{\prime },N).$
• Step 7: Check whether the equation $h_2=h^{\prime }$ holds. If it holds, the verification passes and $M^{\prime }$ is accepted as the valid message; otherwise, the verification fails.

3.2.5. Trace

Based on the SM9 ring signcryption model, we define a traceability algorithm, which is a deterministic process executed by an arbitrator. This mechanism allows the arbitrator to exonerate a specific user or identify the actual signcrypter. We assume that the accumulator manager—who holds the secret parameter s—acts as the arbitrator when disputes arise.

Furthermore, we define a valid signcryption $\sigma =(c,R,R_0,S,T,h)$ of message M generated by the ring user set $U_n=\{I{D}_1,I{D}_2,\dots ,I{D}_n\}$. To determine whether $\sigma$ was generated by a specific user $I{D}_{\pi }$ ($1\le \pi \le n$), the arbitrator performs the following steps:

• Parameter Calculation: Compute the integers ${\nu }_i=H_1(I{D}_i\Vert hid,N)$ for all $i=1,\dots ,n$.
• Verification Values Computation: Compute the group elements $T_1,T_2\in {\mathbb{G}}_T$: $T_1=e\left(S,\left[{\nu }_{\pi }\right]P_2+P_{pub2}\right),T_2=e\left(\left[{\displaystyle \frac{1}{{\prod }_{i=1,i\ne \pi }^n({\nu }_i+s)}}\right]R,P_{pub2}\right).$
• Identity Confirmation: Check whether $T_1=T_2$ holds. If it implies equality, output the signcryptor’s identity as $I{D}_{\pi }$.

4. Theoretical Analysis

This section presents the theoretical analysis of the proposed scheme, explicitly verifying its mathematical correctness and formally proving its security properties in the random oracle model.

4.1. Correctness Analysis

The following analyzes the correctness of this scheme, including the correctness of encryption and decryption, as well as the correctness of signature verification.

• The correctness of the unsigncryption process relies on the equality ${\omega }_0^{\prime }={\omega }_0$.

  $$\begin{array}{cc}\hfill {\omega }_0^{\prime }& =e\left(R_0^{\prime },d{k}_{\eta }\right)\hfill \\ & =e\left(\left(r_0·{\nu }_{\eta }\right)P_1+r_0·P_{pub1},t_2·P_2\right)\hfill \\ & =e\left(\left({\nu }_{\eta }+ks\right)r_0·P_1,{\left({\nu }_{\eta }+ks\right)}^{-1}·ks·P_2\right)\hfill \\ & =e\left(r_0·P_1,ks·P_2\right)\hfill \\ & =e{\left(P_1,P_2\right)}^{ks·r_0}\hfill \\ & =g^{r_0}={\omega }_0\hfill \end{array}.$$

  (2)
  In conclusion, the equation ${\omega }_0^{\prime }={\omega }_0$ holds, and encryption and decryption are correct.
• Assuming honest protocol execution and data integrity during transmission, the correctness of the signature verification hinges on the equality ${\omega }^{\prime }=\omega$.

  $$\begin{array}{cc}& {\omega }^{\prime }=e\left(R^{\prime },S_{pub}+T^{\prime }\right)e\left(S^{\prime },P_{pub2}+T^{\prime }\right)g_1^h\hfill \\ & =e\left([r_1-h]W_{\pi },S_{pub}+\left[{\nu }_{\pi }\right]P_2\right)·e\left([r_1-h]W_{\pi },\left[r_2{(r_1-h)}^{-1}\right]P_2\right)·\hfill \\ & e\left([r_1-h]s{k}_{\pi },P_{pub2}+\left[{\nu }_{\pi }\right]P_2\right)e\left([r_1-h]s{k}_{\pi },\left[r_2{(r_1-h)}^{-1}\right]P_2\right)g_1^h\hfill \\ & =e\left([r_1-h]V,P_2\right)e\left([r_1-h]P_1,P_{pub2}\right)e\left(W_{\pi }+s{k}_{\pi },\left[r_2\right]P_2\right)g_1^h\hfill \\ & =g_1^{r_1-h}·g_2^{r_2}·g_1^h\hfill \\ & =g_1^{r_1}·g_2^{r_2}\hfill \\ & =\omega \hfill \end{array}$$

  (3)
  Consequently, the equality $h_2=h^{\prime }$ holds, the signature verification of this plan is correct.

4.2. Unforgeability Analysis

This section applies formal security reduction techniques to prove that the ring signcryption scheme proposed in this paper satisfies EUF-CMIA security.

Theorem 1. 

In the random oracle model, if the q-SDH problem is hard, the proposed ring signcryption scheme is EUF-CMIA secure.

Proof of Theorem 1. 

Suppose there is a PPT adversary $\mathcal{A}$ who can win the EUF-CMIA game, then challenger $\mathcal{C}$ can solve the q-SDH problem. $\mathcal{C}$ takes a q-SDH problem instance $(X,Y,\left[a\right]Y,\left[a^2\right]Y,\cdots ,\left[a^q\right]Y)\in {\mathbb{G}}_1\times {\mathbb{G}}_2^{q+1}$ as input. Here, $\psi :{\mathbb{G}}_2\to {\mathbb{G}}_1$ is a homomorphic mapping such that $\left[a^i\right]X=\psi \left(\left[a^i\right]Y\right)$ for $0\le i\le q$. The goal of $\mathcal{C}$ is to find a pair $(c,\left[{\displaystyle \frac{1}{c+a}}\right]X)$ with $c\in Z_N^{\ast }$. $\mathcal{C}$ provides a simulated environment and responds to $\mathcal{A}$’s queries as follows:

• System Initialization. $\mathcal{C}$ randomly selects q distinct integers $w^{\ast },w_1,\cdots ,w_{i^{\ast }-1},w_{i^{\ast }+1},\cdots ,w_q\in {\mathbb{Z}}_N^{\ast }$. Define the following polynomial:

  $$f\left(m\right)=\prod _{\begin{array}{c}i=1\\ i\ne i^{\ast }\end{array}}^q(w_i+m)=\sum _{i=0}^{q-1}{c}_i{m}^i.$$

  (4)
  $\mathcal{C}$ computes $P_1=\left[f\left(a\right)\right]X$ and $P_2=\left[f\left(a\right)\right]Y$. The public keys are set as $P_{pub2}=\left[a\right]P_2$ and $P_{pub1}=\left[a\right]P_1$. $\mathcal{C}$ randomly selects $s\in [1,N-1]$ and generates the accumulator parameters $S_{pub}=\left[s\right]P_2$ and $L=\{P_1,\left[s\right]P_1,\left[s^2\right]P_1,\cdots ,\left[s^q\right]P_1\}$. All other public parameters are computable using the problem instance and the selected parameters, but the master key $msk=a$ is unknown
• Hash Queries. $\mathcal{A}$ will perform three hash queries, with $\mathcal{C}$ controlling the hash oracle to return the results. Let $q_{H_1},q_{H_2},q_{H_3}$ be the maximum number of queries allowed for each hash function, and assume $q=q_{H_1}$. For simplicity, the inputs $hid$ and N in $H_1,H_2$ are omitted. Before the queries start, $\mathcal{C}$ randomly selects an index $i^{\ast }\in [1,q_{H_1}]$ and initializes three empty lists $L_1,L_2,L_3$ to record queries and responses.
  • $H_1$ Query. Let $I{D}_i$ be the input for the i-th query. If $L_1$ already contains an entry for $I{D}_i$, $\mathcal{C}$ returns the stored value. Otherwise, if $i=i^{\ast }$, $\mathcal{C}$ sets $H_1\left(I{D}_i\right)=w^{\ast }$; if $i\ne i^{\ast }$, $\mathcal{C}$ sets $H_1\left(I{D}_i\right)=w_i$. $\mathcal{C}$ returns $H_1\left(I{D}_i\right)$ and records $(i,I{D}_i,H_1\left(I{D}_i\right))$ in $L_1$.
  • $H_2$ Query. Let the input be a tuple of a ring user set $U_i$, a message $M_i$, and an element ${\omega }_i\in {\mathbb{G}}_T$. If a record exists in $L_2$, $\mathcal{C}$ returns it. Otherwise, $\mathcal{C}$ randomly selects $y_i\in [1,N-1]$, sets $H_2(U_i\left|\right|M_i\left|\right|{\omega }_i)=y_i$, records $(U_i,M_i,{\omega }_i,y_i)$ in $L_2$, and returns $y_i$.
  • $H_3$ Query. Let the input be $(R_{0i},R_i,S_i,{\omega }_{0i},I{D}_i)$. If a record exists in $L_3$, $\mathcal{C}$ returns it. Otherwise, $\mathcal{C}$ randomly selects $T_i\in {\{0,1\}}^n$, sets $H_3(R_{0i}\left|\right|R_i\left|\right|S_i\left|\right|{\omega }_{0i}\left|\right|I{D}_i)=T_i$, records $(i,R_{0i},R_i,S_i,{\omega }_{0i},I{D}_i,T_i)$ in $L_3$, and returns $T_i$.
• Query Phase. $\mathcal{A}$ adaptively makes private key, accumulator, and signcryption queries to $\mathcal{C}$.
  • Private Key Query. $\mathcal{A}$ requests the signing private key for identity $I{D}_i$. Let $(i,I{D}_i,H_1\left(I{D}_i\right))$ be the corresponding record in $L_1$. If $i=i^{\ast }$, $\mathcal{C}$ aborts. Otherwise, we have $H_1\left(I{D}_i\right)=w_i$. Define $f_i\left(m\right)=f\left(m\right)/(w_i+m)={\sum }_{j=0}^{q-2}{d}_j{m}^j$. Using the problem instance, $\mathcal{C}$ computes the following:

    $$s{k}_i=a\left[f_i\left(a\right)\right]X=\left[{\displaystyle \frac{a·f\left(a\right)}{w_i+a}}\right]X=\left[{\displaystyle \frac{a}{w_i+a}}\right]P_1.$$

    (5)
    Similarly, $d{k}_i=[a/(w_i+a)]P_2$. The tuple $(s{k}_i,d{k}_i,w_i)$ is valid and computable.
  • Accumulator Query. $\mathcal{A}$ requests the accumulator value for a user set $U_j$. $\mathcal{C}$ computes the element $V\in {\mathbb{G}}_1$ and returns it. If $\mathcal{A}$ specifies a member $I{D}_{\pi }\in U_j$, $\mathcal{C}$ returns the witness pair $(V,W_{\pi })$.
  • Signcryption Ciphertext Query. $\mathcal{A}$ requests the signcryption of message M for user set $U_j$ with sender $I{D}_{\pi }$ and receiver $I{D}_{\eta }$.
    Case 1: If $I{D}_{\pi }\ne I{D}_{i^{\ast }}$, $\mathcal{C}$ can calculate the private key $s{k}_{\pi }$ of the $I{D}_{\pi }$, so it can return the ciphertext $\sigma$ according to the normal signcryption process.
    Case 2: If $I{D}_{\pi }=I{D}_{i^{\ast }}$, $\mathcal{C}$ simulates the ciphertext as follows:

    (a)

    Compute integers ${\nu }_j=H_1\left(I{D}_j\right)$ for $1\le j\le n$. Compute $V=[\prod ({\nu }_j+s)]P_1$ and $W_{\pi }=\left[{\prod }_{j\ne \pi }({\nu }_j+s)\right]P_1$.

    (b)

    Randomly select $r_0\in {\mathbb{Z}}_N^{\ast }$ and compute ${\omega }_0=g^{r_0}$. Compute ${\nu }_{\eta }=H_1\left(I{D}_{\eta }\right)$ and $R_0=\left[(r_0·{\nu }_{\eta })\right]P_1+\left[r_0\right]P_{pub1}$.

    (c)

    Randomly select $h^{\ast }\in {\mathbb{Z}}_N^{\ast }$, $R^{\ast },S^{\ast }\in {\mathbb{G}}_1$, and $T^{\ast }\in {\mathbb{G}}_2$.

    (d)

    Compute $\omega =e(R^{\ast },S_{pub}+T^{\ast })·e(S^{\ast },P_{pub2}+T^{\ast })·g_1^{h^{\ast }}$.

    (e)

    Set $H_2(U_j\left|\right|M\left|\right|\omega )=h^{\ast }$ and store it in $L_2$. If a collision occurs in $L_2$, $\mathcal{C}$ aborts.

    (f)

    Compute $c=M\oplus H_3(R_0\left|\right|R^{\ast }\left|\right|S^{\ast }\left|\right|{\omega }_0\left|\right|I{D}_{\eta })$ and return $\sigma =(c,R^{\ast },R_0,S^{\ast },T^{\ast },h^{\ast })$.

  • Unsigncryption Query. $\mathcal{A}$ submits ciphertext ${\sigma }^{\ast }$ with receiver $I{D}_{\eta }$. If $I{D}_{\eta }\ne I{D}_{i^{\ast }}$, $\mathcal{C}$ computes the private key $d{k}_{\eta }$ and decrypts normally. If $I{D}_{\eta }=I{D}_{i^{\ast }}$, $\mathcal{C}$ aborts.
• Forgery. $\mathcal{A}$ outputs a forged signcryption ${\sigma }^{\ast }$ on message $M^{\ast }$ for ring $U^{\ast }=\{I{D}_1^{\ast },\cdots ,I{D}_n^{\ast }\}$. $\mathcal{A}$ must not have queried the private keys for $U^{\ast }$ nor the signcryption of $M^{\ast }$ for $U^{\ast }$. If $I{D}_{i^{\ast }}\notin U^{\ast }$, $\mathcal{C}$ aborts. Otherwise, applying the forking lemma, $\mathcal{C}$ rewinds $\mathcal{A}$ to obtain two valid forgeries ${\sigma }_1^{\ast }$ and ${\sigma }_2^{\ast }$ with the same randomness but different hash values $h_1^{\ast }\ne h_2^{\ast }$ and $S_1^{\ast }\ne S_2^{\ast }$. We have the following relations:

  $$S_1^{\ast }=[r_1^{\ast }-h_1^{\ast }]s{k}_{i^{\ast }}=\left[{\displaystyle \frac{a(r_1^{\ast }-h_1^{\ast })f\left(a\right)}{w^{\ast }+a}}\right]X.$$

  (6)
  And similarly for $S_2^{\ast }$. Let ${\displaystyle \frac{xf\left(x\right)}{w^{\ast }+x}}=F\left(x\right)+{\displaystyle \frac{d}{w^{\ast }+x}}$, where $F\left(x\right)\in {\mathbb{Z}}_N\left[x\right]$ and d is a non-zero integer computable from the parameters. $\mathcal{C}$ computes $W^{\ast }$ as follows:

  $$\begin{array}{cc}\hfill W^{\ast }& =\left[{\displaystyle \frac{1}{d}}\right]\left(\left[{\displaystyle \frac{1}{h_2^{\ast }-h_1^{\ast }}}\right](S_1^{\ast }-S_2^{\ast })-\left[F\left(a\right)\right]X\right)\hfill \\ \hfill & =\left[{\displaystyle \frac{1}{d}}\left({\displaystyle \frac{af\left(a\right)}{w^{\ast }+a}}-F\left(a\right)\right)\right]X=\left[{\displaystyle \frac{1}{w^{\ast }+a}}\right]X.\hfill \end{array}$$

  (7)
  Thus, $(w^{\ast },W^{\ast })$ is a valid solution to the q-SDH problem instance.

In conclusion, since the q-SDH problem is computationally hard, the proposed scheme satisfies unforgeability. □

4.3. Confidentiality Analysis

This section applies formal security reduction techniques to prove that the ring signcryption scheme proposed in this paper satisfies Indistinguishability under Adaptive Chosen-Ciphertext Attack (IND-CCA) security.

Theorem 2. 

In the random oracle model, if the q-BDHI problem is hard, the proposed ring signcryption scheme is IND-CCA secure.

Proof of Theorem 2. 

Suppose there is a PPT adversary $\mathcal{A}$ who can win the IND-CCA game, then challenger $\mathcal{C}$ can solve the q-BDHI problem.$\mathcal{C}$ receives a q-BDHI problem instance $(X,Y,\left[a\right]Y,\left[a^2\right]Y,\cdots ,\left[a^q\right]Y)\in {\mathbb{G}}_1\times {\mathbb{G}}_2^{q+1}$, where $\psi :{\mathbb{G}}_2\to {\mathbb{G}}_1$ is a homomorphic mapping. The goal of $\mathcal{C}$ is to compute $e{(X,Y)}^{1/a}$. $\mathcal{C}$ simulates the environment for $\mathcal{A}$ as follows:

• System Initialization. $\mathcal{C}$ randomly selects an index $k\in [1,q]$ and an integer $I_k\in {\mathbb{Z}}_N^{\ast }$. Then, $\mathcal{C}$ chooses $q-1$ distinct random values $w_1,w_2,\cdots ,w_{k-1},w_{k+1},\cdots ,w_q\in {\mathbb{Z}}_N^{\ast }$ and sets $I_i=I_k-w_i$. Define the following polynomial:

  $$f\left(m\right)=\prod _{i=1,i\ne k}^q(m+t_i)=\sum _{i=0}^{q-1}{c}_i{m}^i.$$

  (8)
  $\mathcal{C}$ computes $P_1=\left[f\left(a\right)\right]X$ and $P_2=\left[f\left(a\right)\right]Y$. The accumulator parameters $S_{pub}$ and L are generated using a random $s\in {\mathbb{Z}}_N^{\ast }$ as in the standard setup.
• Hash Queries. Hash queries to $H_1,H_2,H_3$ are handled similarly to the unforgeability proof in Theorem 1, with consistency maintained via lists $L_1,L_2,L_3$.
• Query Phase. $\mathcal{A}$ adaptively makes queries.
  • Private Key Query. $\mathcal{A}$ requests the private key for $I{D}_i$. Let $(i,I{D}_i,w_i)$ be the record in $L_1$. If $i=k$, $\mathcal{C}$ aborts (failure). Otherwise, $\mathcal{C}$ implicitly sets the master secret key as $\alpha =-a-I_k$. The public keys are set as $P_{pub1}=\alpha P_1$ and $P_{pub2}=\alpha P_2$. Define $f_i\left(x\right)=f\left(x\right)/(w_i+x)$. $\mathcal{C}$ computes the private key $s{k}_i$ as follows:

    $$\begin{array}{cc}\hfill s{k}_i& =\left[{\displaystyle \frac{\alpha }{\alpha +I_i}}\right]P_1=P_1-\left[{\displaystyle \frac{I_i}{\alpha +I_i}}\right]P_1\hfill \\ \hfill & =P_1-\left[{\displaystyle \frac{I_i}{(a+w_i)}}\right]P_1=P_1-\left[I_i{f}_i\left(a\right)\right]X.\hfill \end{array}$$

    (9)
    Similarly, $d{k}_i=P_2-\left[I_i{f}_i\left(a\right)\right]Y$. These values are computable using the given q-BDHI instance.
  • Accumulator and Signcryption Queries. These are simulated similarly to Theorem 1.
• Challenge Phase. $\mathcal{A}$ submits two messages $(M_0,M_1)$ and a user set $U^{\ast }$. If the target receiver identity is $I{D}_k$, $\mathcal{C}$ aborts. Otherwise, $\mathcal{C}$ randomly selects $c^{\ast }\in {\{0,1\}}^n$, $R^{\ast },S^{\ast }\in {\mathbb{G}}_1^{\ast },T^{\ast }\in {\mathbb{G}}_2^{\ast }$, and $h^{\ast }\in {\mathbb{Z}}_N^{\ast }$. Crucially, $\mathcal{C}$ sets $R_0^{\ast }=[-t]P_1$ for a random $t\in {\mathbb{Z}}_N^{\ast }$. This implicitly sets the randomness $r^{\ast }=t/a$, although $\mathcal{C}$ does not know a. $\mathcal{C}$ returns the ciphertext ${\sigma }^{\ast }=(c^{\ast },R^{\ast },R_0^{\ast },S^{\ast },T^{\ast },h^{\ast })$. Since $R_0^{\ast }=[-t]P_1=[-tf\left(a\right)]X$, it is a valid element. The adversary cannot distinguish this from a real ciphertext unless they query $H_3$ with the correct ${\omega }_0^{\ast }$.
• Guessing Phase. $\mathcal{A}$ outputs a guess. To have a non-negligible advantage, $\mathcal{A}$ must have queried $H_3$ with ${\omega }_0^{\ast }$. $\mathcal{C}$ selects a random entry from list $L_3$ as the candidate for ${\omega }_0^{\ast }$. The target value satisfies the following:

  $${\omega }_0^{\ast }=g^{r^{\ast }}=e{(P_1,P_{pub2})}^{t/a}=e{(X,Y)}^{{\displaystyle \frac{f{\left(a\right)}^{2}t(-a-I_k)}{a}}}.$$

  (10)
  Using the polynomial expansion $f{\left(a\right)}^2=\left({\sum }_{i=0}^{q-1}{c}_i{a}^i\right)f\left(a\right)t$, we can rewrite the exponent term:

  $${\displaystyle \frac{f{\left(a\right)}^{2}t}{a}}=f\left(a\right)t\sum _{i=0}^{q-2}{c}_{i+1}{a}^i+\left(c_{0}t\sum _{i=0}^{q-2}{c}_{i+1}{a}^i+{\displaystyle \frac{c_0^{2}t}{a}}\right).$$

  (11)
  Substituting this back into Equation (10) allows $\mathcal{C}$ to isolate the term $e{(X,Y)}^{1/a}$. Specifically, the following:

  $$e{(X,Y)}^{{\displaystyle \frac{1}{a}}}={\left({\omega }_0^{\ast }e(t{P}_1,\sum _{i=0}^{q-1}{c}_i{a}^{i}Y)e(I_{k}t(P_1+c_{0}X),\sum _{i=0}^{q-2}{c}_{i+1}{a}^{i}Y)\right)}^{-{\displaystyle \frac{1}{I_k{c}_0^{2}t}}}.$$

  (12)

Thus, if $\mathcal{A}$ succeeds, $\mathcal{C}$ can compute $e{(X,Y)}^{1/a}$, solving the hard q-BDHI problem. This completes the proof. □

4.4. Conditional Anonymity Analysis

The proof of conditional anonymity addresses two aspects: (1) The correctness of the tracing mechanism by the Arbiter (who possesses the accumulator secret s), and (2) The anonymity of the signcryptor against any entity (including the KGC) who does not possess s.

Theorem 3. 

Assuming the random number sources follow a uniform distribution, the proposed ring signcryption scheme satisfies conditional anonymity.

Proof of Theorem 3. 

Let $\sigma =(c,R,R_0,S,T,h)$ be a valid signcryption of message M for the ring $U_n$. Let ${\nu }_i=H_1\left(I{D}_i\right)$.

1. Correctness of Tracing. The Arbiter can identify the real signcryptor $I{D}_{\pi }\in U_n$ by verifying whether $T_1=T_2$. If the signcryptor is indeed $I{D}_{\pi }$, substitute the signature components:

$$\begin{array}{cc}\hfill T_1& =e([r_1-h]s{k}_{\pi },\left[{\nu }_{\pi }\right]P_2+P_{pub2})\hfill \\ \hfill & =e\left(\left[{\displaystyle \frac{(r_1-h)({\nu }_{\pi }+ks)}{{\nu }_{\pi }+ks}}\right]P_1,P_{pub2}\right)=e([r_1-h]P_1,P_{pub2}),\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill T_2& =e\left(\left[{\displaystyle \frac{r_1-h}{{\prod }_{j\ne \pi }({\nu }_j+s)}}\right]W_{\pi },P_{pub2}\right)\hfill \\ \hfill & =e\left(\left[{\displaystyle \frac{(r_1-h){\prod }_{j\ne \pi }({\nu }_j+s)}{{\prod }_{j\ne \pi }({\nu }_j+s)}}\right]P_1,P_{pub2}\right)=e([r_1-h]P_1,P_{pub2}).\hfill \end{array}$$

(14)

Since $T_1=T_2$, the tracing algorithm correctly identifies the signcryptor. For any other user $I{D}_j$ ($j\ne \pi$), since $ks\ne s$, the equation generally does not hold.

2. Anonymity. Suppose $\sigma$ is generated by signcryptor $I{D}_{{\pi }_1}$ using random numbers $(r_1,r_2)$. The signature component is as follows:

$$S=\left[{\displaystyle \frac{(r_1-h)ks}{{\nu }_{{\pi }_1}+ks}}\right]P_1.$$

(15)

This ciphertext can be viewed as being generated by another signcryptor $I{D}_{{\pi }_2}$ using different randomness $(r_1^{\prime },r_2^{\prime })$. Specifically, let $r_1^{\prime }$ be defined such that

$${\displaystyle \frac{r_1-h}{{\nu }_{{\pi }_1}+ks}}={\displaystyle \frac{r_1^{\prime }-h}{{\nu }_{{\pi }_2}+ks}}\Rightarrow r_1^{\prime }={\displaystyle \frac{(r_1-h)({\nu }_{{\pi }_2}+ks)}{{\nu }_{{\pi }_1}+ks}}+h.$$

(16)

Since $r_1$ is uniformly distributed in $[1,N-1]$, $r_1^{\prime }$ is also uniformly distributed. Similarly, $r_2^{\prime }$ can be adjusted to match the component T. Since the randomness is independent and uniform, the distribution of ciphertexts generated by $I{D}_{{\pi }_1}$ is identical to that of $I{D}_{{\pi }_2}$ from the perspective of an adversary without s. Therefore, the scheme ensures anonymity.

In summary, the scheme achieves conditional anonymity: the identity is hidden from all entities except the Arbiter, who can trace the signcryptor using the secret s in case of disputes. □

5. Performance Analysis

We analyze the computational performance of the traceable ring sigcryption scheme proposed in this paper. This section will conduct a comparative analysis with similar schemes from the perspectives of computational overhead and communication overhead.

It should be noted that for the scheme proposed in this paper, the intermediate parameters V and $W_{\pi }$ of the accumulator generated by the user themselves involve the expansion of the n-th degree polynomial. The complexity of V and $W_{\pi }$ increases with the number of ring members n. Therefore, in this paper, V and $W_{\pi }$ are pre-generated and sent by KGC. This is consistent with what is described in Section 3.2.3 of the scheme design. The storage requirements for these parameters increase with the ring capacity. We explicitly accept this relatively high local storage demand to ensure low-latency transmission.

5.1. Computational Overhead

This section presents a theoretical analysis and experimental verification of the computational overhead of the traceable ring signcryption scheme proposed in this paper. Furthermore, we evaluate its performance advantages by comparing it with representative existing schemes.

Table 2 outlines detailed hardware and software specifications. We conducted 1000 independent experiments on each operation and calculated the average execution time.

Table 2. Experimental environment configuration.

Parameter	Specification
Processor	Intel(R) Core(TM) i7-10750H CPU @ 2.60 GHz
RAM	16.0 GB
Operating system	Windows 10
Cryptographic library	JPBC Library

In the analysis of computational overhead, we focus on the high-cost operations within the two core algorithms: signcryption generation and unsigncryption. Since addition operations and modular inversions in ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$, as well as multiplication operations in ${\mathbb{G}}_T$, are significantly faster than bilinear pairing operations, exponentiations, and hash-to-point operations (differing by at least 2 to 3 orders of magnitude), these lightweight operations are omitted from the quantitative analysis. Precomputation steps are also excluded from the comparison.

We compare the computational overheads incurred in the signcryption and unsigncryption stages of the proposed scheme with those in Refs. [8,19,29]. The average execution times for the fundamental cryptographic operations are listed in Table 3. The number of ring members, denoted by n, is a critical factor affecting computational overhead. For most ring signcryption schemes, the computational cost increases as n grows. The total theoretical computational costs for each scheme are compared in Table 4.

Table 3. Average time required for fundamental cryptographic operations.

Operation Type	Average Time (ms)
Scalar multiplication $T_{em1}$ in ${\mathbb{G}}_1$	8.5173
Scalar multiplication $T_{em2}$ in ${\mathbb{G}}_2$	8.7725
Bilinear pairing $T_{bp}$	4.7182
Exponentiation $T_{bpe}$ in ${\mathbb{G}}_T$	1.0481
Standard hash operation $T_h$	0.0012
Map-to-point hash $T_{h1}$ in ${\mathbb{G}}_1$	26.2335
Multiplication $T_{bpm}$ in ${\mathbb{G}}_T$	0.0036

Table 4. Comparison of theoretical computational costs.

Scheme	Signcryption Phase	Unsigncryption Phase
Ref. [8]	$(n+1)T_{em1}+(n+1)T_{em2}+T_{bp}+(n+2)T_h+(n+1)T_{h1}$	$n{T}_{em1}+3T_{bp}+(n+2)T_h+(n+1)T_{h1}$
Ref. [19]	$n{T}_{em1}+T_{bp}+(n+1)T_h$	$3T_{bp}+(n+1)T_h$
Ref. [29]	$(2n+5)T_{em1}+5T_{bp}+(n-1)T_{bpe}+(n+4)T_h$	$4T_{bp}+(2n+1)T_{em1}+(n+3)T_h$
Ours	$4T_{em1}+T_{em2}+3T_{bpe}+2T_h$	$3T_{bp}+T_{bpe}+2T_h$

As illustrated in Figure 2, as the number of ring members n scales from 10 to 40, the signcryption time of the Ref. [8] exhibits a significant linear increase, rising by 1789 ms. While the Refs. [19,29] also show growth with respect to n, their increase is relatively moderate. In contrast, the scheme proposed in this paper maintains consistently low computation times throughout the entire test range, demonstrating constant efficiency independent of the ring size.

Figure 2. Signcryption computation overhead [8,19,29].

As shown in Figure 3, during the unsigncryption phase, the computational overhead of the Ref. [8] also increases linearly with n, rising by 1430 ms. The Refs. [19,29] also exhibit an upward trend. Conversely, the signcryption and unsigncryption times of our proposed scheme remain stable at approximately 46 ms and 16 ms, respectively.

Figure 3. Unsigncryption computation overhead [8,19,29].

In summary, the computational overhead of the proposed scheme is essentially independent of the ring size. The experimental results clearly demonstrate that our scheme achieves extremely low latency and high stability compared to existing approaches.

5.2. Communication Overhead

In terms of communication overhead, the main consideration is the number of bits of the ring signature-encrypted data. The precomputation step comparison analysis results are shown in Table 5. In the scheme definition, $\left|h\right|$ represents the length of the hash result, $\left|{\mathbb{G}}_1\right|$, $\left|{\mathbb{G}}_2\right|$, $\left|{\mathbb{G}}_T\right|$, and $\left|{\mathbb{Z}}_N^{\ast }\right|$ represent the number of bits of the corresponding group or field elements, and $\left|M\right|$ represents the length of the plaintext message, which are set to 256-bit, 512-bit, 1024-bit, 3072-bit, 256-bit, and 256-bit, respectively.

Table 5. Comparison of the communication overhead.

Plan	Ciphertext Size
Ref. [8]	$(n+1)|{\mathbb{G}}_1|+2|M|$
Ref. [19]	$(n+1)|{\mathbb{G}}_1|+|{\mathbb{Z}}_N^{\ast }|+|M|$
Ref. [29]	$\left|\begin{array}{c}h\end{array}\right|+2\left|\begin{array}{c}{\mathbb{G}}_1\end{array}\right|+3\left|\begin{array}{c}{\mathbb{G}}_T\end{array}\right|$
Ours	$\left|\begin{array}{c}h\end{array}\right|+3\left|\begin{array}{c}{\mathbb{G}}_1\end{array}\right|+\left|\begin{array}{c}{\mathbb{G}}_2\end{array}\right|+\left|\begin{array}{c}M\end{array}\right|$

When the number of ring members is $n=10$, since the signature-encryption communication overhead of the proposed scheme is at a constant level, the calculated communication overhead of the proposed ring signature-encryption scheme is 3072 bits, while the communication overhead of Ref. [8] is 6144 bits, Ref. [19] is 6144 bits, and Ref. [29] is 10,496 bits. The results of the communication overhead indicate that the proposed scheme has certain advantages in terms of ring signature-encryption data communication overhead.

6. Conclusions

Identity-based ring signcryption, as a digital signcryption technology that protects user privacy while avoiding the complex certificate management burdens inherent in PKI architectures, has recently become a research hotspot and has been widely applied. This paper designs an efficient, traceable ring signcryption privacy protection scheme. The correctness of encryption/decryption and signature verification is proven through theoretical derivation. Furthermore, formal security analysis indicates that this scheme is feasible for IND-CCA security and EUF-CMIA security in the random oracle model, and provides conditional anonymity that allows tracing the real identity of the Signcryptor in case of disputes. Theoretical analysis and experimental tests indicate that the proposed scheme has the lowest computational cost compared with similar schemes and possesses broad application prospects.