A Novel Identity-Based Signcryption Scheme in the Standard Model

Abstract

Identity-based signcryption is a useful cryptographic primitive that provides both authentication and confidentiality for identity-based crypto systems. It is challenging to build a secure identity-based signcryption scheme that can be proven secure in a standard model. In this paper, we address the issue and propose a novel construction of identity-based signcryption which enjoys IND-CCA security and existential unforgeability without resorting to the random oracle model. Comparisons demonstrate that the new scheme achieves stronger security, better performance efficiency and shorter system parameters.

1. Introduction

In [1], Shamir introduced the seminal concept of identity-based (ID-based) cryptography in 1984, which is supposed to provide a possible alternative to conventional public key infrastructure in terms of efficiency and convenience. The interesting feature of this kind of cryptosystem is that a user’s public key can be any binary string that can identify the user, such as an email address. Using identities as public keys eliminates the requirement for public-key certificates. The first ID-based signature was proposed in the pioneer paper due to Shamir [1], but ID-based encryption schemes were not founded until Boneh and Franklin [2] invented a practical ID-based encryption from a bilinear pairing in 2001. The ID-based cryptography along with its applications has become a hot research topic in the last decade.

The properties of confidentiality and authentication are essential for computer networks. It seems that they can be easily achieved by consecutively executing a secure encryption scheme and a digital signature scheme. However, this trivial combination is expensive and vulnerable to some subtle attacks [3]. In [4], Zheng introduced the notion of signcryption in 1997, which is a cryptographic primitive that supplies both authentication and confidentiality in a reasonable logic step, at a lower price than that of the traditional signature-then-encryption approach. Many practical and novel signcryption schemes along with their applications have been proposed in the past years (such as [3,5,6,7,8,9,10,11,12]).

An interesting research topic is to combine signcryption and ID-based cryptography [13] to construct secure and efficient ID-based signcryption schemes. In [5], Malone-Lee gave the first ID-based signcryption from bilinear pairings with a corresponding security model, which dealt with privacy and unforgeability. However, Libert and Quisquater [14] showed that Malone-Lee’s scheme does not provide semantic security since the signature of the signcrypted message is visible in the final ciphertext. They also built three new ID-based signcryption schemes, but forward security and public verifiability are mutually exclusive in these schemes. Chow et al. [15] constructed an ID-based signcryption that provides both public verifiability and forward security. Boyen [16] also proposed a novel ID-based signcryption that provides public verifiability, forward security, ciphertext unlinkability and anonymity. Chen and Malone-Lee [17] enhanced the efficiency of Boyen’s scheme in 2005. Subsequently, the concept of ID-based signcryption was further extended to cater to more applications. For example, in 2006, Duan and Cao [8] proposed a multi-receiver ID-based signcryption for more than one receiver scenario. In 2008, Li et al. [7] presented an ID-based broadcast signcryption for the application of broadcasting a message to multiple users in a secure and authenticated manner. In 2010, Liu et al. [18] proposed certificateless signcryption as an extension of ID-based signcryption. Unfortunately, Weng et al. [19] showed that Liu et al.’s scheme is neither semantically secure against chosen ciphertext attacks nor existentially unforgeable against chosen message attacks.

The early signcryption schemes only dealt with some informal security analysis. The situation changed since Baek et al. [20] proposed a formal security model for signcrytion and provided a security proof for Zheng’s original scheme [4] using the random oracle model due to Bellare and Rogaway [21]. In this model, hash functions are treated as ideal random functions. Although the model is powerful to validate the designs of cryptographic schemes, it has received some criticism since the security in this model does not always lead to the security in the real world [22]. Accordingly, it is interesting to design secure ID-based signcryption schemes in the standard model. In 2009, Yu et al. [23] made the first attempt to construct an ID-based signcryption scheme without random oracles. Observing that Yu et al.’s scheme does not reach the semantic security, Jin et al. [24] proposed an improved scheme and claimed that the improvement is secure without using random oracles. Unfortunately, recent cryptanalysis due to Li et al. [25] shows that Jin et al.’s scheme [24] suffers from the indistinguishability against adaptive chosen ciphertexts attack and existential unforgeability against adaptive chosen messages attack. Zhang et al. [26] also built another new scheme, but Li et al. [27] found that Zhang et al.’s scheme does not have IND-CPA security and they proposed an improvement claiming it to achieve both IND-CCA2 and EUF-CMA security. However, a recent analysis due to Selvi et al. [28] concluded that Li et al.’s scheme reaches neither IND-CCA2 property nor EUF-CMA property. Another new construction was given by Li et al. in ProvSec 2011 [29], but, recently, Selvi et al. [28] showed that the proof of the scheme is not correct.

1.1. Our Contribution

A survey of the previous literature reveals that there does not exist a really secure ID-based signcryption scheme in the standard model. The attempts in ([23,24]) show that a simple combination of Waters’ ID-based encryption [30] and Paterson–Schuldt’s ID-based signature [31] may not produce a secure ID-based signcryption. Therefore, the main contribution of this paper is to fill this gap by proposing an ID-based signcryption scheme whose security proof does not need to resort to the random oracle model. Our construction makes use of Paterson–Schuldt’s ID-based signature [31], Waters’ ID-based encryption [30] and the techniques of constructing selective identity-based encryption due to Boneh and Boyen [32]. We also prove its CCA security and existential unforgeability under some well-studied complexity assumptions. Comparisons show that our scheme outperforms the previous ones in terms of security, computational efficiency and the size of system parameters.

1.2. Organization

The rest of this paper is organized in the following way. Some preliminaries used in our scheme are given in Section 2. The new ID-based signcryption along with the performance comparisons to the existing ones are given in Section 3. The security proof of the new scheme is provided in Section 4. Finally, conclusions are given in Section 5.

2. Preliminaries

Some basic knowledge, including bilinear pairings, complexity assumptions and a formal model for ID-based signcryption, is briefly revisited in this section.

2.1. Bilinear Pairings

$\mathbb{G}$ and ${\mathbb{G}}_{\mathbb{T}}$ are multiplicative cyclic groups of prime order p and g is a generator of $\mathbb{G}$. The map $\widehat{e}:\mathbb{G}\times \mathbb{G}\to {\mathbb{G}}_T$ is an admissible bilinear pairing with the following properties [2]:

• $\widehat{e}(g^a,g^b)=\widehat{e}{(g,g)}^{ab}$ for all $a,b\in Z_p$,
• $\widehat{e}(g,g)\ne 1_{{\mathbb{G}}_T}$,
• $\widehat{e}$ can be efficiently computable.

2.2. Complexity Assumptions

Computational Diffie–Hellman (CDH) Problem [2]: Given $(g,g^a,g^b\in \mathbb{G})$ for some unknown $a,b\in Z_p$, output $g^{ab}$.

The success probability of a polynomial algorithm $\mathcal{A}$ in solving the CDH problem is denoted as

$$Suc{c}_{\mathcal{A},\mathbb{G}}^{CDH}=Pr[\mathcal{A}(g,g^a,g^b)=g^{ab}:a,b\in Z_p].$$

CDH Assumption: Given $(g,g^a,g^b\in \mathbb{G})$ for some unknown $a,b\in Z_p$, $Suc{c}_{\mathcal{A},\mathbb{G}}^{CDH}$ is negligible.

Decisional Bilinear Diffie–Hellman (DBDH) Problem: Given $(g,A=g^a,B=g^b,C=g^c\in \mathbb{G})$ for some unknown $a,b,c\in Z_p$ and an element $Z\in {\mathbb{G}}_T$, determine whether $Z=\widehat{e}{(g,g)}^{abc}$ or not.

The advantage of a distinguisher $\mathcal{B}$ against the DBDH problem is defined as

$$Adv(\mathcal{B})=|Pr[\mathcal{B}(g^a,g^b,g^c,e{(g,g)}^{abc})=1]$$

$$-Pr[\mathcal{B}(g^a,g^b,g^c,e{(g,g)}^z)=1]|.$$

DBDH Assumption: The $(t,ϵ)$-DBDH assumption [2] says that no t-time adversary has at least an $ϵ$ advantage in solving the DBDH problem.

3. Our ID-Based Signcryption Scheme

In this section, we firstly describe our ID-based signcryption scheme. Then, we show the correctness and comparisons to the existing schemes in the same style.

3.1. The New Scheme

The proposed ID-based signcryption consists of the following algorithms.

Setup: On inputting a security parameter k, the PKG chooses two multiplicative cyclic groups $\mathbb{G}$ and ${\mathbb{G}}_T$ of prime order p, a generator g of $\mathbb{G}$ and a bilinear pairing $\widehat{e}:\mathbb{G}\times \mathbb{G}\to {\mathbb{G}}_T$. PKG also picks $u^{\prime },\delta ,v\in \mathbb{G}$, an n-length vector $\overrightarrow{u}=\left(u_i\right)$ whose elements are randomly from $\mathbb{G}$ and a collision resistant hash function $H:{\{0,1\}}^{*}\to Z_p^{*}$. Additionally, PKG picks a secret $\alpha \in Z_p$, $g_2\in \mathbb{G}$ and computes $g_1=g^{\alpha }$. The public parameters are $params=(\mathbb{G},{\mathbb{G}}_T,\widehat{e},g,g_1,g_2,u^{\prime },\delta ,v,\overrightarrow{u})$ and the master secret key is $msk=g_2^{\alpha }$.

Extract: Identities in the new scheme are represented as bitstrings of length n, just as in Waters’ scheme [30]. Suppose the sender, say, Alice’s identity is $I{D}_A$, represented as a bit string $\mathsf{e}=({\mathsf{e}}_1,{\mathsf{e}}_2,\cdots ,{\mathsf{e}}_n)$, and the receiver Bob’s identity is $I{D}_B=\mathtt{f}=(f_1,f_2,\cdots ,f_n)$. PKG picks $r_e,r_f\in Z_q^{*}$ and computes their secret keys as follows:

$$d_{\mathsf{e}}=(d_{{\mathsf{e}}_1},d_{{\mathsf{e}}_2})=(g_2^{\alpha }{(u^{\prime }\prod _{i=1}^n{u}_i^{e_i})}^{r_e},g^{r_e}),$$

$$d_{\mathsf{f}}=(d_{{\mathsf{f}}_1},d_{{\mathsf{f}}_2})=(g_2^{\alpha }{(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_f},g^{r_f}).$$

Signcrypt: To signcrypt a message $M\in {\mathbb{G}}_T$ to Bob, Alice picks a random value $r_m$ and executes the steps below.

• Compute $c_2=\widehat{e}{(g_1,g_2)}^{r_m}M$,
• Compute $c_3=g^{r_m}$,
• Compute $c_4={(u^{\prime }{\prod }_{i=1}^n{u}_i^{f_i})}^{r_m}$,
• Set $c_5=d_{e_2}$,
• Compute $h=H(I{D}_A,I{D}_B,c_2,c_3,c_4,c_5)$,
• Compute $c_1=d_{e_1}{(\delta ·v^h)}^{r_m}$ and output the ciphertext $c=(c_1,c_2,c_3,c_4,c_5)$.

Unsigncrypt: Receiving a signcrypted ciphertext $c=(c_1,c_2,c_3,c_4,c_5)$, Bob checks its validity and decrypts it as follows:

• Compute $h=H(I{D}_A,I{D}_B,c_2,c_3,c_4,c_5)$.
• Verify if the following equality holds. If it holds, go to the next step. Otherwise, reject the ciphertext:

  $$\widehat{e}(c_1,g)=\widehat{e}(g_1,g_2)\widehat{e}(u^{\prime }\prod _{i=1}^n{u}_i^{e_i},c_5)\widehat{e}(\delta ·v^h,c_3).$$
• Recover the plaintext $c_2\widehat{e}(d_{f_2},c_4){\widehat{e}(d_{f_1},c_3)}^{-1}\to M$.

3.2. Correctness

The correctness of the proposed scheme can be verified directly by the property of bilinear pairing, after $h=H(I{D}_A,I{D}_B,c_2,c_3,c_4,c_5)$ is determined:

$$\begin{array}{cc}\widehat{e}(c_1,g)\hfill & =\widehat{e}(d_{e_1}{(\delta ·v^h)}^{r_m},g)\hfill \\ & =\widehat{e}(g_2^{\alpha }{\left(u^{\prime }\prod _{i=1}^n{u}_i^{e_i}\right)}^{r_e}{(\delta ·v^h)}^{r_m},g)\hfill \\ & =\widehat{e}(g_2^{\alpha },g)\widehat{e}({\left(u^{\prime }\prod _{i=1}^n{u}_i^{e_i}\right)}^{r_e},g)\widehat{e}({(\delta ·v^h)}^{r_m},g)\hfill \\ & =\widehat{e}(g_2,g^{\alpha })\widehat{e}(u^{\prime }\prod _{i=1}^n{u}_i^{e_i},g^{r_e})\widehat{e}(\delta ·v^h,g^{r_m})\hfill \\ & =\widehat{e}(g_1,g_2)\widehat{e}(u^{\prime }\prod _{i=1}^n{u}_i^{e_i},c_5)\widehat{e}(\delta ·v^h,c_3),\hfill \end{array}$$

(1)

and

$$\begin{array}{cc}& c_2\widehat{e}(d_{f_2},c_4){\widehat{e}(d_{f_1},c_3)}^{-1}\hfill \\ =\hfill & \widehat{e}{(g_1,g_2)}^{r_m}M\widehat{e}(g^{r_f},{(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_m})\hfill \\ & {\widehat{e}(g_2^{\alpha }{(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_f},g^{r_m})}^{-1}\hfill \\ =\hfill & \widehat{e}{(g_1,g_2)}^{r_m}M\widehat{e}(g^{r_f},{(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_m})\hfill \\ & \widehat{e}{(g_2^{\alpha },g^{r_m})}^{-1}\hfill \\ & {\widehat{e}({(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_f},g^{r_m})}^{-1}\hfill \\ =\hfill & \widehat{e}{(g_1,g_2)}^{r_m}M\widehat{e}(g^{r_f},{(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_m})\hfill \\ & \widehat{e}{(g_2,g_1)}^{-r_m}\hfill \\ & {\widehat{e}({(u^{\prime }\prod _{i=1}^n{u}_i^{f_i})}^{r_m},g^{r_f})}^{-1}\hfill \\ =\hfill & M.\hfill \end{array}$$

(2)

3.3. Comparisons

We compare the security and the performance efficiency of our scheme to those of the known ID-based signcryption without random oracles in [23,24,26,27]. $M_G$, $E_G$, $M_{G_T}$, $E_{G_T}$, $I_{G_T}$, and $\widehat{e}$, denote the multiplication in G, the exponentiation in G, the multiplication in $G_T$, the exponentiation in $G_T$, the inversion in $G_T$ and the pairing operation, respectively. The comparisons of the five schemes are summarized in

Table 1. Security and performance comparisons.

Schemes	Signcrypt	Unsigncrypt	Size	Params	EUF	CCA
Yu2009 [23]	$1\widehat{e}+2E_G+2E_{G_T}+$	$6\widehat{e}+2M_{G_T}+1I_{G_T}+$	$4\left|G\right|+1|G_T|$	$(2n+5)G$	√	×
	$(3+(n_u+n_m)/2)M_G$	$(1+(n_u+n_m)/2)M_G$
Jin2010 [24]	$1\widehat{e}+2E_G+2E_{G_T}+1\varphi +$	$6\widehat{e}+2M_{G_T}+1I_{G_T}+1{\varphi }^{-1}+$	$4\left|G\right|+1|G_T|$	$(2n+5)G$	×	×
	$(3+(n_u+n_m)/2)M_G$	$(1+(n_u+n_m)/2)M_G$
Zhang2010 [26]	$1\widehat{e}+3E_G+1E_{G_T}+$	$6\widehat{e}+3M_{G_T}+1I_{G_T}+$	$4\left|G\right|+1|G_T|+1|Z_p|$	$(2n+5)G$	×	×
	$(4+(n_u+n_m)/2)M_G$	$(6+(n_u+n_m)/2)M_G$
Li2012 [27]	$1\widehat{e}+6E_G+1E_{G_T}+1\varphi +$	$6\widehat{e}+2M_{G_T}+1I_{G_T}+$	$4\left|G\right|+1|G_T|+1|Z_p|$	$(2n+5)G$	×	×
	$(n_u+\left(n_m\right)/2+4)M_G$	$(3+(n_u+n_m)/2)M_G$
Ours	$1\widehat{e}+4E_G+1E_{G_T}+$	$6\widehat{e}+2M_{G_T}+1I_{G_T}+$	$4\left|G\right|+1|G_T|$	$(n+6)G$	√	√
	$1M_{G_T}+(3+n/2)M_G$	$1E_G+(2+n/2)M_G$

.

The Extract algorithm is omitted in the comparison since these schemes utilize the same secret key extraction. The Signcrypt column and the Unsigncrypt column specify the computation cost of generating a signcrypted ciphertext and unsigncrypting a ciphertext in each scheme. The Size column shows the length of a ciphertext, represented by elements in $\mathbb{G}$ and ${\mathbb{G}}_T$. The Params column gives the number of group elements in G to be included in system parameters. The EUF column and CCA column indicate whether the scheme is secure against adaptive chosen message attack and adaptive chosen ciphertext attack. The symbol × means it is vulnerable to the attack while √ indicates that it can resist the attack. Note that the scheme in [23,24,26,27] can not be regarded as secure since they suffer either the IND-CCA attack or the IND-CCA attack. The new scheme achieves both IND-CCA security and EUF-CMA security. From this point of view, our scheme outperforms the previous ones in terms of security.

Assume that the output length of the secure hash functions used in the schemes are same, that is, $n_u=n_m=n$. $2n+5$ group elements are required as public parameters in [23,24,26,27] while only $n+6$ elements are needed in our scheme. Namely, the length of public parameters of the new scheme is only about one half of that of the schemes in [23,24,26,27]. From this point of view, a shorter public parameter makes the new scheme more suitable for low storage requirement of applications. For the communication cost, the scheme in [26] shares the same size of the resulted signcryption ciphertext and [27], which is comparatively longer than that of our new scheme and the schemes in [23,24]. Although the schemes [23,24] and the new scheme get the same length of a signcrypted ciphertext, our scheme achieves better performance than the schemes in [23,24] because nearly $n/2$ multiplications in $G_1$ are less required in Signcrypt and Unsigncrypt algorithms, respectively. Note that the proposed protocol is quite efficient. According to the the benchmark for exponentiations and pairing [33], it costs about 11.07 ms to signcrypt a plantext and 33.31 ms to unsigncrypt a ciphertext in our protocol.

4. Security of the New Scheme

In this section, we prove that the new scheme achieves the properties of IND-CCA and EUF-CMA in the standard model.

Theorem 1.

Assume that there exists an adversary $\mathcal{A}$ that can distinguish two valid signcrypted ciphertexts with an advantage ϵ when running in time t and asking at most $q_e$ private key extraction queries, $q_s$ signcryption queries and $q_u$ unsigncryption queries. Then, there exists a distinguisher $\mathcal{C}$ that can solve an instance of the DBDH problem in time $t+O((q_e+q_s+q_u)n_u{t}_{mul}+(q_e+q_s)t_{exp}+q_u{t}_{pair})$ with an advantage

$$Adv\left(\mathcal{C}\right)>\frac{1}{8(q_e+q_s+q_u)(n+1)},$$

where $t_{mul}$, $t_{exp}$ and $t_{pair}$ denote the time for a multiplication, an exponentiation in $\mathbb{G}$ and a pairing computation, respectively.

Proof. 

The distinguisher $\mathcal{C}$ is given a random DBDH problem instance $(g,g^{\alpha },g^{\beta },g^{\gamma },Z\in G_T)$, and he tries to tell whether $Z=e{(g,g)}^{\alpha \beta \gamma }$ or not. $\mathcal{C}$ will act as $\mathcal{A}$’s challenger and run $\mathcal{A}$ as a subroutine in the IND-CCA game. The following proof is inspired by the techniques due to [30,31,32]. ☐

Setup: $\mathcal{C}$ sets $l=4q_e$, picks the values below randomly and keeps them secret:

• an integer $0<k<n$,
• an integer $x^{\prime }\in Z_l$, and an n-length vector $\overrightarrow{x}=\left(x_i\right)$ where $x_i\in Z_l$,
• an integer $y^{\prime }\in Z_p$, and an n-length vector $\overrightarrow{y}=\left(y_i\right)$ where $y_i\in Z_p$,
• three integers $t,a,c\in Z_p$.

Additionally, $\mathcal{C}$ chooses a collision resistent hash function $H:{\{0,1\}}^{*}\to Z_p$. For ease of description, we define the following functions as in [30] for an identity $\mathsf{e}=(e_1,\cdots ,e_n)$:

• $F\left(\mathsf{e}\right)=(p-lk)+x^{\prime }+{\displaystyle \sum _{i=1}^n}{e}_i{x}_i,$
• $J\left(\mathsf{e}\right)=y^{\prime }+{\displaystyle \sum _{i=1}^n}{e}_i{y}_i,$
• $K\left(\mathsf{e}\right)=\left\{\begin{array}{cc}0,\hfill & \mathrm{if}{x}^{\prime }+{\displaystyle \sum _{i=1}^n}{x}_i=0\left(\mathrm{mod}l\right),\hfill \\ 1,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$

Then, $\mathcal{C}$ sets public parameters as follows:

• Set $g_1=g^{\alpha },g_2=g^{\beta }$ where $g^{\alpha },g^{\beta }$ are from the input of the DBDH problem instance.
• Assign $u^{\prime }=g_2^{p-kl+x^{\prime }}{g}^{y^{\prime }}$ and $u_i=g_2^{x_i}{g}^{y_i}$ and set $\overrightarrow{u}=(u_1,u_2,\cdots ,u_n).$
• Set $\delta =g^a$ and $v=g^c.$

Note that from the viewpoint of the adversary $\mathcal{A}$, the public parameters assigned above share the same distribution with the real construction. Additionally, for any identity $\mathsf{e}$, we have $u^{\prime }{\displaystyle \prod _{i=1}^n}{u}_i^{e_i}=g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(e\right)}.$

Extract queries: Adversary $\mathcal{A}$ can issue at most $q_e$ private key extraction queries. For a private key query for an identity $\mathsf{e}$, the challenger $\mathcal{C}$ first checks if $F\left(\mathsf{e}\right)=0$ and aborts with a random guess $b^{\prime }$ of the challenger’s value b in this situation. Otherwise, it picks a random $r_e\in Z_p$ and responds $\mathcal{A}$ for the pair

$$d_e=(d_{e1},d_{e2})=(g_1^{\frac{-J(\mathsf{e})}{F(\mathsf{e})}}{(u^{\prime }\prod _{i=1}^{n_u}{u}_i^{e_i})}^{r_e},g_1^{\frac{-1}{F(\mathsf{e})}}{g}^{r_{\mathsf{e}}}).$$

Let ${\widehat{r}}_e=r_e-\frac{\alpha }{F\left(\mathsf{e}\right)}$, as shown by Waters [30], and the simulation is perfect since

$$\begin{array}{ccc}{d}_{\mathsf{e}1}\hfill & =\hfill & g_1^{\frac{-J\left(\mathsf{e}\right)}{F\left(\mathsf{e}\right)}}{(g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(\mathsf{e}\right)})}^{r_e}\hfill \\ & =\hfill & g_2^{\alpha }{(g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(\mathsf{e}\right)})}^{\frac{-\alpha }{F\left(\mathsf{e}\right)}}{(g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(\mathsf{e}\right)})}^{r_e}\hfill \\ & =\hfill & g_2^{\alpha }{(g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(\mathsf{e}\right)})}^{r_e-\frac{\alpha }{F(\mathsf{e})}}\hfill \\ & =\hfill & g_2^{\alpha }{(g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(\mathsf{e}\right)})}^{{\widehat{r}}_e}\hfill \end{array}$$

and

$$d_{\mathsf{e}2}=g_1^{\frac{-1}{F\left(\mathsf{e}\right)}}{g}^{r_{\mathsf{e}}}=g^{r_{\mathsf{e}}-\frac{\alpha }{F\left(\mathsf{e}\right)}}=g^{{\widehat{r}}_e}.$$

$\mathcal{C}$ can generate a valid private key for $\mathsf{e}$ if and only if $F\left(\mathsf{e}\right)\ne 0(modl)$, for which it suffices to have $F\left(\mathsf{e}\right)\ne 0(modp)$ [30].

Signcryption queries: Adversary $\mathcal{A}$ can issue at most $q_s$ signcryption queries on messages M under a sender’s identity $\mathsf{e}=(e_1,\cdots ,e_n)$ and a receiver’s identity $\mathsf{f}=(f_1,\cdots ,f_n)$. If $F\left(\mathsf{e}\right)\ne 0(modl)$, $\mathcal{C}$ first generates a private key for $\mathsf{e}$ just as he did in the Extract query described above, and then runs the Signcrypt$(M,d_{\mathsf{e}},\mathsf{f})$ algorithm, creates a valid ciphertext and forwards it to answer $\mathcal{A}$’s query. If $F\left(\mathsf{e}\right)=0(modl)$, $\mathcal{C}$ will simply abort.

Unsigncryption queries: Adversary $\mathcal{A}$ can issue at most $q_u$ unsigncryption queries on ciphertexts $c=(c_1,\cdots ,c_5)$ for identities $\mathsf{e}$ and $\mathsf{f}$. $\mathcal{C}$ performs the following steps.

• Compute $h=H(\mathsf{e},\mathsf{f},c_2,c_3,c_4,c_5)$.
• Check if the following equality holds. If it holds, go to next step. Otherwise, reject the ciphertext:

  $$\widehat{e}(c_1,g)=\widehat{e}(g_1,g_2)\widehat{e}(u^{\prime }\prod _{i=1}^n{u}_i^{e_i},c_5)\widehat{e}(\delta ·v^h,c_3).$$
• Check if $F\left(\mathsf{f}\right)\ne 0(modl)$ holds. If it holds, $\mathcal{C}$ firstly generates a private key $(d_{f_1},d_{f_2})$ for the receiver $\mathsf{f}$, and then computes the plaintext $c_2\widehat{e}(d_{f_2},c_4){\widehat{e}(d_{f_1},c_3)}^{-1}\to M$ and forwards it to $\mathcal{A}$. Otherwise, the simulation aborts.

Challenge: After a polynomially bounded number of queries, $\mathcal{A}$ outputs two equal-length plaintexts $M_0,M_1\in {\mathbb{G}}_T$ together with a pair of identities ${\mathsf{e}}^{*},{\mathsf{f}}^{*}$ on which he wishes to be challenged. $\mathcal{C}$ fails the simulation if $\mathcal{A}$ has queried a key extraction query on ${\mathsf{f}}^{*}$ during the first stage and $\mathcal{C}$ will abort if $F\left({\mathsf{f}}^{*}\right)\ne 0(modl)$. Otherwise, $\mathcal{C}$ picks a random bit b and constructs the challenging ciphertext on $M_b$ using the input of the DBDH problem $(g,A,B,C,Z)$ as follows:

• Pick a random number $r_e^{*}\in Z_p$,
• Compute $c_2^{*}=Z{M}_b$,
• Set $c_3^{*}=C$,
• Compute $c_4^{*}=C^{J\left(f^{*}\right)}$,
• Compute $c_5^{*}=g_1^{\frac{-1}{F\left(e^{*}\right)}}{g}^{r_e^{*}}$,
• Compute $h^{*}=H({\mathsf{e}}^{*},{\mathsf{f}}^{*},c_2^{*},c_3^{*},c_4^{*},c_5^{*})\in Z_p$,
• Compute $c_1^{*}=g_1^{\frac{-J\left({\mathsf{e}}^{*}\right)}{F\left({\mathsf{e}}^{*}\right)}}{(g_2^{F\left({\mathsf{e}}^{*}\right)}{g}^{J\left({\mathsf{e}}^{*}\right)})}^{r_e^{*}}{C}^{a+c{h}^{*}}$,
• Output the challenge ciphertext $c^{*}=(c_1^{*},c_2^{*},c_3^{*},c_4^{*},c_5^{*})$.

Suppose that the simulator was given a valid BDH tuple, which is $Z=\widehat{e}{(g,g)}^{\alpha \beta \gamma }$, and we can see that $c^{*}$ is a valid signcryption ciphertext on $M_b$. Otherwise, if Z is a random element of $\mathbb{G}$, the challenging ciphertext gives no information about the simulator’s choice of b.

Adversary $\mathcal{A}$ then issues a second series of queries adaptively that are treated in the same way as in the first stage. The restriction in this phase is that $\mathcal{A}$ is forbidden to make a key extraction query on identity ${\mathsf{f}}^{*}$ and make an unsigncryption query on the challenging ciphertext $c^{*}$ to get the corresponding plaintext. At the end of the game, $\mathcal{A}$ outputs a guess $b^{\prime }$ of b. If $b^{\prime }=b$, $\mathcal{C}$ answers 1 indicating that $Z=\widehat{e}{(g,g)}^{\alpha \beta \gamma }$. Otherwise, $\mathcal{C}$ answers 0 to denote that $Z\ne \widehat{e}{(g,g)}^{\alpha \beta \gamma }$. We now analyze $\mathcal{C}$’s probability of success. The simulation can be completed without aborting on the condition that all extraction queries on identities e satisfy $F\left(\mathsf{e}\right)\ne 0(modl)$, all signcryption queries $(\mathsf{e},\mathsf{f},M)$ satisfy $F\left(\mathsf{e}\right)\ne 0(modl)$, all unsigncryption satisfy $(c,\mathsf{e},and\mathsf{f})$ satisfy$F\left(\mathsf{f}\right)\ne 0(modl)$. In addition, in the DBDH problem solving phase, $F\left({\mathsf{e}}^{*}\right)\ne 0(modl)$ and $F\left({\mathsf{f}}^{*}\right)=0(modl)$. Assume the identities queried in either extract queries or in signcryption queries and unsigncryption queries, not including the challenging identity, are ${\mathsf{e}}_1,{\mathsf{e}}_2,\cdots ,{\mathsf{e}}_{q_I}$. Obviously, we have $q_I<q_e+q_s$. The events $A_i$ and $A^{*}$ are defined as follows:

$$A_i:F\left({\mathsf{e}}_i\right)\ne 0(modl),A^{*}:F\left({\mathsf{f}}^{*}\right)=0(modl).$$

The probability that $\mathcal{C}$ does not abort is

$$Pr[\neg abort]>Pr[\underset{i=1}{\overset{q_I}{\bigwedge }}{A}_i\wedge A^{*}].$$

This probability can be assessed by utilizing Waters’ technique [30]. The computation is not repeated here since it is similar to Waters’ process and the final lower bound is

$$\begin{array}{ccc}Pr[\neg abort]\hfill & >\hfill & \frac{1}{8(q_e+q_s+q_u)(n+1)}.\hfill \end{array}$$

The bound of $\mathcal{C}$’s computation time comes from the fact that $O\left(n_u\right)$ multiplications and $O\left(1\right)$ exponentiations are required in each extract query, $O\left(n_u\right)$ multiplications and $O\left(1\right)$ exponentiations are needed in each signcryption query, and $O\left(n_u\right)$ multiplications and $O\left(1\right)$ pairings are required in each unsigncryption query.

Theorem 2.

Assume that there exists an adversary $\mathcal{F}$ that can $(t,q_e,q_s,q_u,ϵ)$ forge a valid signcryption ciphertext on a message M. Then, we can construct a new algorithm $\mathcal{C}$ to solve the CDH problem.

Proof. 

This proof also proceeds by the reduction approach. Assuming a forger $\mathcal{F}$ for our scheme exists, we will construct a challenger $\mathcal{C}$, who runs $\mathcal{F}$ as a subroutine, to solve an instance of the CDH problem, which contradicts the CDH assumption. Specifically, given a group G, a generator g and two elements $g^{\alpha },g^{\beta }\in G$, $\mathcal{C}$’s goal is to output $g^{\alpha \beta }$. Firstly, $\mathcal{C}$ sets the public parameters of the proof in the same way as he did in the proof 1. Note that $\mathcal{C}$ assigns $g_1=g^{\alpha }$, $g_2=g^{\beta }$, $\delta =g^a$ and $v=g^c$, and for an identity $\mathsf{e}=(e_1,\cdots ,e_n)$, we have $u^{\prime }{\displaystyle \prod _{i=1}^n}{u}_i^{e_i}=g_2^{F\left(\mathsf{e}\right)}{g}^{J\left(e\right)}$. ☐

Then, $\mathcal{A}$ will issue a polynomial number of queries including extraction queries, signcryption queries and unsigncryption queries. C responds to $\mathcal{A}$’s query in the same way as he does in Theorem 1. Finally, if $\mathcal{C}$ does not abort during the simulation, $\mathcal{A}$ will output a valid forgery ciphertext $c^{*}=(c_1^{*},c_2^{*},c_3^{*},c_4^{*},c_5^{*})$ on message $M^{*}$ under a sender ${\mathsf{e}}^{*}$ and a receiver ${\mathsf{f}}^{*}$. If $F\left({\mathsf{e}}^{*}\right)\ne 0$, $\mathcal{C}$ will abort. Otherwise, $\mathcal{C}$ computes $h^{*}=H({\mathsf{e}}^{*},{\mathsf{f}}^{*},c_2^{*},c_3^{*},c_4^{*},c_5^{*})$ and because the forgery is valid, then

$$\begin{array}{ccc}\widehat{e}(c_1^{*},g)\hfill & =\hfill & \widehat{e}(g_1,g_2)\widehat{e}(u^{\prime }\prod _{i=1}^n{u}_i^{e_i},c_5^{*})\widehat{e}(\delta ·v^{h^{*}},c_3^{*})\hfill \\ & =\hfill & \widehat{e}(g^{\alpha },g^{\beta })\widehat{e}(g_2^{F\left({\mathsf{e}}^{*}\right)}{g}^{J\left({\mathsf{e}}^{*}\right)},c_5^{*})\widehat{e}(g^a·{\left(g^c\right)}^{h^{*}},c_3^{*})\hfill \\ & =\hfill & \widehat{e}(g,g^{\alpha \beta })\widehat{e}(g,{\left(c_5^{*}\right)}^{J\left({\mathsf{e}}^{*}\right)})\widehat{e}(g,{\left(c_3^{*}\right)}^{a+c{h}^{*}}).\hfill \end{array}$$

(3)

Accordingly, $\mathcal{C}$ can output $\frac{c_1^{*}}{{\left(c_5^{*}\right)}^{J\left({\mathsf{e}}^{*}\right)}·{\left(c_3^{*}\right)}^{a+c{h}^{*}}}\to g^{\alpha \beta }$ as the solution to the instance of the given CDH problem.

5. Conclusions

In this paper, we put forth a novel identity-based signcryption scheme secure in the standard model since the existing schemes were showed to be insecure. The new construction makes use of the tricks of Boneh–Boyen selective identity-based encryption, Waters’ identity-based encryption, and Paterson–Schuldt’s identity-based signature. The proposed scheme outperforms the previous ones in terms of stronger security, higher performance efficiency and shorter system parameters. We also show that the new scheme achieves the CCA security under the decisional bilinear Diffie–Hellman assumption and the existential unforgeability against adaptive chosen messages attacks under the computational Diffie–Hellman assumption.