Protecting HWSNs from Super Adversaries with Robust Certificateless Signcryption

Abstract

Healthcare Wireless Sensor Networks (HWSNs) have attracted significant attention due to their vital role in diseases’ diagnosis, monitoring, and treatment. By continuously collecting patients’ physiological data and enabling remote medical services, these networks can greatly improve the quality of healthcare. However, the inadequate handling of security and privacy issues poses serious risks to patients. In this context, signcryption schemes are essential cryptographic primitives that simultaneously provide authentication, confidentiality, and data integrity with a low overhead. Recently, Deng et al. proposed a certificateless signcryption (CL-SC) scheme for HWSNs and proved its security in the standard model. In this paper, we demonstrate that their scheme is insecure under an enhanced adversarial model, where a super Type II adversary, which is a malicious key generation center, can replace the system’s master public key using the master secret key under its control, and subsequently forge valid signcryptions on arbitrary messages on behalf of a sensor node. To address this vulnerability, we propose an enhanced CL-SC scheme based on elliptic curve cryptography (ECC). Under the hardness assumptions of the Elliptic Curve Decisional Diffie–Hellman Problem (ECDDHP) and the Computation Attack Algorithm (CAA), the proposed scheme achieves confidentiality and existential unforgeability against both super Type I and super Type II adversaries in the standard model. Performance analysis further shows that our scheme is efficient and well suited for resource-constrained HWSN environments.

1. Introduction

Healthcare Wireless Sensor Networks (HWSNs) have attracted growing attention because of their vital role in monitoring patient conditions and supporting diseases’ diagnosis and treatment. Although these networks enhance the quality of medical services, security concerns remain a major challenge. Signcryption schemes serve as essential cryptographic tools to address these requirements. Recently, Deng et al. introduced a certificateless signcryption (CL-SC) scheme for HWSN security which verifies sensor legitimacy, encrypts patients’ vital data, and preserves sensor anonymity, with the security proof in the standard model. However, in the present paper, we show that their scheme is unfortunately vulnerable to a super Type II adversary. To address this limitation, we propose a new ECC-based CL-SC scheme. Relying on the hardness of the ECDDHP and CAA problems, we demonstrate that our scheme achieves confidentiality and unforgeability against both Type I and Type II super adversaries in the standard model. Owing to its strong security properties and high efficiency, the proposed scheme is well suited for deployment in HWSNs.

The ability of patients’ online tracking, while they are moving, helps medical staff to deliver more appropriate services. As noted earlier, this goal can be accomplished by attaching various sensors to patients and communicating the related signals to hospital staff (see Figure 1). As a result, they can identify abnormal signals as quickly as possible and, if necessary, communicate the information to professionals. The patient can then receive appropriate instructions from a professional doctor by voice, video or SMS. It is clear that this technology has several advantages, including quick disease diagnosis and treatment, increased patient comfort due to not having to visit the doctor, the increased attention of doctors on diseases’ diagnosis and the provision of appropriate recommendations, calmer hospitals, and so on. The security of both the patient-related data and medical messages is very important in an HWSN system. However, as wireless networks have open architectures, HWSNs are susceptible to various security attacks. So, it is very important to handle security issues in these networks. Without handling security challenges, a malicious entity can carry out malicious operations, steal vital data and harm the system beyond repair. It goes without saying that hospital staff must be authenticated in order to safeguard patients from risks such as incorrect medication, dose or timing. As a result, maintaining the security of these networks is an important and difficult task.

The most common method for meeting the security criteria in HWSNs is the use of cryptographic protocols. Authentication and confidentiality are two critical security issues that need to be fixed in an HWSN. Digital signatures and encryption schemes are two well-known cryptographic tools, which can be used to satisfy authenticity and confidentiality, respectively. When it is necessary to meet these two requirements at the same time, the signcryption schemes can be used. These schemes frequently deal with constraints on computing power, communications bandwidth and storage capacity. Additionally, procedures with mobility capabilities must be taken into consideration due to patients’ mobility.

A general signcryption model for an HWSN, which includes of four entities—sensors, controllers, trusted authorities and application providers—is depicted in Figure 2. The trusted authority is typically a third entity that is in charge of supplying the system’s requirements, including keys and certificates, for various public key cryptography approaches. In order to sense and gather physiological data and transmit it to the controller, sensor nodes are established into a person’s body. The controller encrypts the data using a signcryption algorithm before sending it to an application provider. When the signcrypted data is received by the application provider, it checks the sender’s authenticity and decrypts the data with its secret key. Similarly, the application provider can create a signcryption on the information and requests that must be sent to the controller. Once the signcrypted information is received by the controller, it confirms the sender’s authenticity and decrypts the information with its secret key [1].

Public key cryptography (PKC) forms the basis for constructing signcryption mechanisms. In traditional PKC systems, the public key of a user must be validated through a digital certificate issued by a trusted Certificate Authority (CA). This certification process imposes considerable overhead on the CA, including substantial time, financial resources, computational effort, and storage requirements. To address these limitations, Shamir [2] introduced the concept of identity-based PKC (ID-PKC), in which a trusted key generation center (KGC) produces the private keys of the users, while their public keys are derived directly from their unique identifier information. However, because the KGC inherently knows all the users’ private keys, ID-PKC subjects to the inherent drawback of key escrow. To eliminate this weakness, Al-Riyami and Paterson [3] proposed the concept of certificateless PKC (CL-PKC) in 2003. Their model inspired extensive research into PKC frameworks that operate without certificates yet avoid the key escrow vulnerability present in ID-PKC. In this setting, the private key of a user is achieved by the combination of a secret value produced by the user and a partial private key generated by the KGC’s master s ecret key.

In Healthcare Wireless Sensor Networks (HWSNs), confidentiality, authentication, integrity, non-repudiation, and anonymity are key security requirements. Certificateless security models traditionally consider two types of adversaries: a Type I adversary that can replace users’ public keys without access to the master secret key, and a Type II adversary that possesses the master secret key but cannot manipulate users’ public keys. More advanced threat models further introduce super adversaries, where a super Type II adversary represents a malicious key generation center capable of replacing the system’s master public key. In this paper, we adopt this enhanced adversarial model to evaluate the robustness of certificateless signcryption schemes in HWSNs [4].

The rest of the present work is arranged as below. Section 2 reviews related works. Section 3 provides the necessary preliminaries, the system model, and the security requirements associated with a CL-SC scheme. Section 4 reviews the CL-ASC construction of Deng et al. and highlights its security weaknesses. In Section 5, we provide our proposed scheme. Section 6 delivers the corresponding security proofs. Section 7 reports the performance analysis, and Section 8 concludes the paper.

2. Related Work

Barbosa et al. [5] were the first to introduce certificateless signcryption (CL-SC) in 2008. Subsequently, Liu et al. (2010) provided the earliest CL-SC construction that remains secure against a malicious KGC in the standard model [6]. In 2017, Zhang et al. [7] proposed a versatile certificateless generalized signcryption (CL-GSC) mechanism capable of functioning as an encryption, signature, or signcryption primitive. This scheme, however, was later shown to be insecure by Zhou in 2019 [8]. In 2018, Balasubramanian et al. [9] introduced a bilinear-pairing-based CL-SC scheme and claimed its robustness against adaptive chosen ciphertext attacks. In the same year, Luo and Wan [10] put forward a CL-SC construction with security proof in the standard model under the hardness assumptions of the DBDH and CDH problems, asserting that it satisfies both existential unforgeability under adaptive chosen message attacks, and indistinguishability under adaptive chosen ciphertext attacks. Nevertheless, Rastegari et al. [11] identified a fundamental flaw in Luo and Wan’s scheme and subsequently designed a corrected CL-SC protocol with KSSTIS security in the standard model. Yuan [12] later showed that the plaintext in Luo and Wan’s construction [10] can be simply extracted from the ciphertext by both ordinary adversaries and malicious KGCs, and further demonstrated that the scheme cannot withstand forgery attacks by a malicious KGC. Luo and Ma [13] introduced a pairing-free certificateless hybrid signcryption (CL-HSC) scheme in 2019, but Kasyoka et al. [14] revealed in 2021 that it is insecure against public key replacement attacks. They also proposed an improved and more resilient signcryption variant to address these weaknesses. In the context of HWSNs, Ji et al. [15] proposed a new CL-SC scheme in 2018; however, Guo [16] demonstrated in 2019 that their construction is exposed to impersonation, denial-of-service, and message modification attacks. Shan [17] later proposed an efficient certificateless signcryption mechanism tailored for secure communication between sensors and remote control units in HWSNs. Blade and Elkhalil [18] developed a pairing-free CL-SC protocol and proved the security of their scheme in the random oracle model (ROM). Recognizing that many existing solutions assume secure channels for delivering partial private keys, Karati et al. [19] introduced a CL-SC scheme in 2020 that eliminates this assumption. Their approach avoids computationally intensive bilinear pairings and map-to-point hash functions, and relies on the hardness of ECDLP to ensure security in the ROM.

In 2023, Deng et al. [20] introduced a certificateless anonymous signcryption (CL-ASC) protocol tailored for HWSNs. Their construction was proven to achieve existential unforgeability under chosen message attacks (EUF-CMA) and indistinguishability under adaptive chosen ciphertext attacks (IND-CCA2) against both adversarial categories $A_I$ and $A_{II}$ in the standard model. Although many other works, such as [21,22,23,24,25,26,27,28,29], have been presented in the literature in this field to date, none of them have concentrated on Deng et al.’s scheme [20]. In this paper, we focus on Deng et al.’s CL-ASC scheme [20] and demonstrate that unfortunately their scheme fails to remain unforgeable when confronted with a super Type II adversary, an enhanced model introduced by Huang et al. [4], that additionally permits adversarial replacement of the KGC’s public key.

In this work, we show that the scheme introduced by Deng et al. is susceptible to forgery when confronted with a super Type II adversary. Specifically, such an adversary can substitute the KGC’s public key $P_{pub}$ and subsequently generate legitimate signcryption outputs for arbitrary messages on behalf of any sensor node. To address this vulnerability, we present a new CL-SC construction by the use of elliptic curve cryptography (ECC). Relying on the hardness of the ECDDHP for establishing IND-CCA2 security and the CAA for proving EUF-CMA security, we demonstrate that the proposed scheme withstands both Type I and Type II super adversaries in the standard model. Moreover, the scheme’s strong security characteristics and high computational efficiency make it particularly suitable for deploying in HWSNs.

3. Certificateless Setting

Keys are often created by a CA, also known as a KGC, who is implicitly a trusted and granted full authority. However, in a certificateless environment, the key production process is divided between the KGC and the user to avoid a total system failure in the event of a hacked KGC. Nobody, not even the KGC, ever knows the rest of the key, which is a user-generated random value. The user’s entire private key, which consists of both the user’s random secret value and the KGC’s partial key, is used for all cryptographic operations.

3.1. Certificateless Signcryption for HWSNs

Figure 3 shows three involved entities in a CL-SC system that applies to HWSNs, i.e., the MS (the medical server), SN (the sensor nodes on patient’s body) and PD (the professional doctor), which are described as below:

• MS: This determines the system’s parameters and publishes them. Additionally, it is responsible for producing a partial private key and pseudo-identity for each PD and SN.
• SN: This is installed on a patient’s body to gather vital sign data, which is subsequently signcrypted and delivered to the PD.
• PD: After receiving a signcrypted message, the PD uses their own private key to unsigncrypt it and retrieve the data.

The following eight steps build a CL-SC scheme applicable for HWSNs:

• Setup: The MS provides the system parameters $params$ on input and a security parameter $\nu$.
• PID-Extract: After receiving the identity $I{D}_s\in \mathrm{\Omega }$ from the SN, the MS creates a pseudo-identity $PI{D}_s$ and transmits it to the SN.
• PPK-Extract: A partial private key $Z_s$ (or $Z_d)$ is created by the MS after receiving $PI{D}_s$ (or $I{D}_d$) of a sensor node SN (or a doctor PD) and is delivered to the SN (or PD) by using a secure channel.
• SV-Set: A secret value $t_s$ (or $t_d$) is selected by the SN (or PD).
• FSK-Set: The full private key $S{K}_s$ (or $S{K}_d)$ is established by the SN (or PD).
• UPK-Generate: The user’s public key $P{K}_s$ (or $P{K}_s$) is produced by the SN (or PD).
• Signcrypt: On inputting $(m,I{D}_d,P{K}_d,PI{D}_s,$ and $S{K}_s)$, SN produces a signcryption $\sigma$ to transmit to the PD.
• Unsigncrypt: On inputting $(\sigma ,I{D}_d,S{K}_d,PI{D}_s,$ and $P{K}_s)$, the PD either decides that the tuple is invalid or returns a message.

3.2. Preliminaries

Some of the required mathematical concepts will be described in this section.

Table 1. Some used notations.

q	A large prime number.
$F_p$	A prime order field.
${\mathbb{Z}}_q^{*}$	A set of positive integers less than q.
$\widehat{e}$	A bilinear map, $\widehat{e}:G_1\times G_1\to G_2$.
$P,Q$	Two generators of $G_1$.
⊕	Bitwise XOR (exclusive OR).
$\lambda$	The master secret key.
$P_{pub}$	The public key of the system.
$H_1$	Collision resistant hash functions $G_2\times G_1^2\to {\{0;1\}}^{l_1}.$
$H_2$	Collision resistant hash functions ${\{0;1\}}^{l_1}\times G_1\to {\mathbb{Z}}_q^{*}.$
$H_3$	Collision resistant hash functions $G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\to {\mathbb{Z}}_q^{*}$.
$H_4$	Collision resistant hash functions ${\{0;1\}}^{l_2}\times G_1^2\times G_2\times {\{0;1\}}^{l_1}\times G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\to {\mathbb{Z}}_q^{*}$.
$H_5$	Collision resistant hash functions $G_1^2\times G_2\times {\{0;1\}}^{l_1}\times G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\to {\{0;1\}}^{l_2}$.
$\mathrm{\Omega }$	The identity space, $\mathrm{\Omega }={\{0,1\}}^{l_1}$.
M	The message space, $M={\{0,1\}}^{l_2}$.
$I{D}_s$	The identity of the sensor node, $I{D}_s\in \mathrm{\Omega }$.
$PI{D}_s$	The pseudo-identity of the sensor node.
$Z_s$	The partial private key of the sensor node.
$t_s$	The secret value of the sensor node.
$S{K}_s$	The private key of the sensor node.
$P{K}_s$	The public key of the sensor node.
$I{D}_d$	The identity of the professional doctor, $I{D}_d\in \mathrm{\Omega }$.
$Z_d$	The partial private key of the professional doctor.
$t_d$	The secret value of the professional doctor.
$S{K}_d$	The private key of the professional doctor.
$P{K}_d$	The public key of the professional doctor.
$m,\sigma$	A message and its signcryption.
$msk$	The master secret key.
UPK	The user’s public key.
PID	A pseudo-identity.
PPK	A partial private key.
FSK	The full secret key.
SV	A secret value.
SC	Signcryption.

displays some of the symbols that are used frequently.

3.2.1. Bilinear Pairing

Suppose that we have two cyclic groups, $G_1$ and $G_2$, of a prime order q, and P is a generator of $G_1$. $\widehat{e}:G_1\times G_1\to G_2$ is considered as a bilinear pairing only if the subsequent characteristics hold:

• Bilinearity: For all $x,y\in {\mathbb{Z}}_q^{*}$, $\widehat{e}(xP,yP)=\widehat{e}{(P,P)}^{xy}$.
• Non-degeneracy: i.e., $\widehat{e}(P,P)\ne 1_{G_2}$.
• Computability: We can design an efficient algorithm for computing $\widehat{e}(P,P)$.

3.2.2. Elliptic Curve Decisional Diffie-Hellman Problem (ECDDHP)

Assume that E is an elliptic curve defined over a finite field and $G\subseteq E\left({\mathbb{F}}_p\right)$ is a cyclic subgroup of prime order q with generator P. For random $a,b\in {\mathbb{Z}}_q^{*}$, consider the following tuple:

$$(P,aP,bP,T),$$

where T is either $abP$ or a random value $R\in G$. The ECDDHP asks to determine whether $T=abP$ holds [30].

3.2.3. Computation Attack Algorithm (CAA)

Let $G_1$ be a cyclic group of prime order q with generator $P\in G_1$. Given the input $(P,aP)$ for some unknown $a\in {\mathbb{Z}}_q^{*}$, the goal of the CAA problem is to compute $(c,{\displaystyle \frac{1}{a+c}}P)$, for some $c\in {\mathbb{Z}}_q^{*}$ [20,31]. It is well known that the CAA problem is computationally hard. Several schemes [20,31,32,33,34] have been constructed based on this hardness assumption.

3.3. Security Requirements

Confidentiality, authentication, integrity, non-repudiation, and anonymity constitute the core security requirements in HWSNs [35]. While a CL-SC mechanism can typically satisfy the first four properties, anonymity often requires an additional design strategy—most commonly the use of pseudonymous identifiers in place of actual user identities. In the certificateless paradigm introduced by Al-Riyami and Paterson [3], two distinct classes of adversaries are considered within the conventional security model [35,36]:

• Type I adversary $A_I$: This type of attacker does not possess the master secret key but is permitted to modify or replace the public keys of users. In essence, $A_I$ behaves as a public key replacement attacker.
• Type II adversary $A_{II}$: This adversary is assumed to have full knowledge of the master secret key but is not able to manipulate users’ public keys. Thus, $A_{II}$ models a malicious but honest KGC.

Huang et al. [4] later refined this framework by introducing a hierarchy of adversarial capabilities, namely, normal adversaries, strong adversaries, and super adversaries. The last and most powerful category significantly broadens the threat landscape. In particular, a super Type II adversary is allowed not only to exploit its possession of the master secret key but also to replace the system-wide public key of the KGC. That is, such an attacker may substitute the legitimate public key $P_{pub}$ with an arbitrary value $P_{pub}^{\prime }$ [37], thereby gaining a strategic advantage in attempts to forge or subvert certificateless operations.

In this work, we adopt Huang et al.’s enhanced adversarial model as the basis for evaluating the robustness of CL-SC constructions, ensuring a more comprehensive and realistic security assessment.

3.3.1. Confidentiality

The below two games for $A_I$ and $A_{II}$ respectively, can be used to illustrate the security of a CL-SC scheme in terms of IND-CCA2.

Game 1. 

C (a challenger) and $A_I$ (a super Type I adversary) engage in this game as follows:

• Initialization: When C receives a security parameter ν, it produces $params$ and $msk$. Next, C transmits $params$ to $A_I$ while keeping $msk$ secret.
• Phase 1 Queries: C must respond to a polynomially bounded number of $A_I$’s inquiries throughout this phase.

  –

  PID-Query($I{D}_s$): $A_I$ acquires a $PI{D}_s$, or pseudo-identity.

  –

  UPK-Query($PI{D}_s$): $A_I$ obtains the $P{K}_s$ value.

  –

  UPK-Query($I{D}_d$): $A_I$ obtains the $P{K}_d$ value.

  –

  Replace-Query($PI{D}_s,P{K}_s^{\prime }$): C replaces $P{K}_s$ with $P{K}_s^{\prime }$.

  –

  Replace-Query($I{D}_d,P{K}_d^{\prime }$): C replaces $P{K}_d$ with $P{K}_d^{\prime }$.

  –

  PPK-Query($PI{D}_s$): $A_I$ acquires the value $Z_s$; it is unable to accomplish that if $Y_s$ is changed.

  –

  PPK-Query($I{D}_d$): $A_I$ acquires the value $Z_d$; it is unable to accomplish that if $Y_d$ is changed.

  –

  SV-Query($PI{D}_s$): $A_I$ acquires the value $t_s$; it is unable to accomplish that if $T_s$ is changed.

  –

  SV-Query($I{D}_d$): $A_I$ acquires the value $t_d$; it is unable to accomplish that if $T_d$ is changed.

  –

  SC-Query($m,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): $A_I$ acquires the signcryption σ.

  –

  USC-Query($\sigma ,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): $A_I$ obtains the symbol ⊥ or the message m.

  Keep in mind that PID-Query($I{D}_s$) and UPK-Query($PI{D}_s$) would be run before any other queries for each SN, and UPK-Query($I{D}_d$) should be run before any other queries for each PD.
• Challenge: Two messages of identical length, $m_0$ and $m_1$, as well as two identities, $PI{D}_{s^{*}}$ and $I{D}_{d^{*}}$, are chosen by $A_I$ and sent to C during this phase. C produces a signcryption, ${\sigma }^{*}$, on $m_{\gamma }$, from $s^{*}$ to $d^{*}$, by flipping a coin to choose $\gamma \in \{0,1\}$ randomly. After that, $A_I$ obtains ${\sigma }^{*}$ from C.
• Phase 2 Queries: Analogous to Phase 1 requests, $A_I$ transmits a polynomially constrained set of queries that C needs to reply to.
• Guess: $A_I$ outputs ${\gamma }^{*}$.

$A_I$ is declared the winner of this game depending on the following occurrences:

1. 

${\gamma }^{*}=\gamma$.

2. 

$S{K}_{d^{*}}$ is not allowed to be obtained by $A_I$.

3. 

If the related public key of user i has already been changed, $A_I$ cannot get $S{K}_i$.

4. 

The replacement of $P{K}_{d^{*}}$ prior to the challenge phase will prevent $A_I$ from obtaining $x_{d^{*}}$.

5. 

$A_I$ is not permitted to submit an unsigncryption query on ${\sigma }^{*}$ of $PI{D}_{s^{*}}$ to $I{D}_{d^{*}}$ in Phase 2 queries, until the $P{K}_{s^{*}}$ or $P{K}_{d^{*}}$ that were used to create ${\sigma }^{*}$ are changed after the challenge is sent.

Game 2. 

C (a challenger) and $A_{II}$ (a super Type II adversary) engage in this game as described below.

• Initialization: When C receives a security parameter ν, it generates $params$ and $msk$. Next, $A_{II}$ obtains $params$ and $msk$ from C.
• Phase 1 Queries: C must respond to a polynomially finite number of $A_{II}$’s inquiries throughout this phase.
• Challenge: Two messages of identical length, $m_0$ and $m_1$, as well as two identities, $PI{D}_{s^{*}}$ and $I{D}_{d^{*}}$, are chosen by $A_{II}$ and sent to C during this phase. C generates a signcryption, ${\sigma }^{*}$, on $m_{\gamma }$, from $s^{*}$ to $d^{*}$, by flipping a coin to pick $\gamma \in \{0,1\}$ randomly. After that, $A_{II}$ obtains ${\sigma }^{*}$ from C.
• Phase 2 Queries: Analogous to Phase 1 requests, $A_{II}$ transmits a polynomially constrained set of queries that C needs to reply to.
• Guess: $A_{II}$ outputs ${\gamma }^{*}$.

$A_{II}$ is declared the winner of this game depending on the following occurrences:

1. 

${\gamma }^{*}=\gamma$,

2. 

$S{K}_{d^{*}}$ cannot be obtained by $A_{II}$.

3. 

$A_{II}$ is not permitted to submit an Unsigncryption query on ${\sigma }^{*}$ of $PI{D}_{s^{*}}$ to $I{D}_{d^{*}}$, in Phase 2 queries.

Definition 1. 

According to IND-CCA2, a CL-SC scheme is defined as $(t,ϵ)$-confidential if no super adversaries ($A_I$ or $A_{II}$) are able to be the winner of Games 1 and 2 in a maximum duration of t, with at least ${\displaystyle \frac{1}{2}}+ϵ$ probability, through submitting at most $q_{PD}$ PID-Queries, $q_{UD}$ UPK-Queries ($=0$ for $A_{II}$), $q_{RD}$ Replace-Queries ($=0$ for $A_{II}$), $q_{VD}$ SV-Queries, $q_{SC}$ SC-Queries, $q_{KD}$ PPK-Queries and $q_{UN}$ USC-Queries.

3.3.2. Unforgeability

We can apply the subsequent games (Games 3 and 4) to prove the unforgeability of a CL-SC scheme in the sense of EUF-CMA for $A_I$ and $A_{II}$, accordingly.

Game 3. 

C and $A_I$ engage in this game as described below.

• Initialization: This is the same as that in Game 1.
• Queries: C is responsible for replying to a polynomially finite number of $A_I$’s inquiries throughout this phase.
• Forgery: On a message $m^{*}$, $A_I$ generates a forged signcryption ${\sigma }^{*}$ from $PI{D}_{s^{*}}$ to $I{D}_{d^{*}}$.

$A_I$ is declared the winner of this game depending on the following:

1. 

${\sigma }^{*}$ is a valid signcryption.

2. 

$S{K}_{s^{*}}$ cannot be obtained by $A_I$.

3. 

If the related public key of user i has already been changed, $A_I$ cannot get $S{K}_i$.

4. 

$A_I$ is unable to acquire $x_{s^{*}}$.

5. 

$A_I$ is not permitted to submit a signcryption query on $m^{*}$ of $PI{D}_{s^{*}}$ to $I{D}_{d^{*}}$.

Game 4. 

C and $A_{II}$ engage in this game as described below.

• Initialization: This is the same as that in Game 2.
• Queries: C must respond to a polynomially finite number of $A_{II}$’s inquiries throughout this phase.
• Forgery: On a message $m^{*}$, $A_{II}$ creates a forged signcryption ${\sigma }^{*}$ from $PI{D}_{s^{*}}$ to $I{D}_{d^{*}}$.

$A_{II}$ is declared as the winner of this game depending on the following:

1. 

${\sigma }^{*}$ is a valid signcryption.

2. 

$S{K}_{s^{*}}$ cannot be obtained by $A_{II}$.

3. 

$A_{II}$ is not permitted to submit a signcryption query on $m^{*}$ of $PI{D}_{s^{*}}$ to $I{D}_{d^{*}}$.

Definition 2. 

According to EUF-CMA, a CL-SC scheme is defined as $(t,ϵ)$-unforgeable if no super adversaries ($A_I$ or $A_{II}$) are able to be the winner of Games 3 and 4 in a maximum duration of t, with at least ${\displaystyle \frac{1}{2}}+ϵ$ probability, through submitting at most $q_{PD}$ PID-Queries, $q_{UD}$ UPK-Queries ($=0$ for $A_{II}$), $q_{RD}$ Replace-Queries ($=0$ for $A_{II}$), $q_{VD}$ SV-Queries, $q_{SC}$ SC-Queries, $q_{KD}$ PPK-Queries and $q_{UN}$ USC-Queries.

4. An Overview of Deng et al.’s Scheme

4.1. The Algorithms

The steps of Deng et al.’s suggested signcryption scheme are described below [20]:

• Setup: When the security parameter $\nu$ is entered, the following actions are carried out by the MS:

  –

  The selection of a bilinear pairing $\widehat{e}:G_1\times G_1\to G_2$, where $G_1$ and $G_2$ are two cyclic groups of a prime order $q>2^{\nu }$;

  –

  The selection of two generators of $G_1$, P and Q, and setting $E=\widehat{e}(P,P)$;

  –

  Establishing $M={\{0,1\}}^{l_2}$ as the message space and $\gamma ={\{0,1\}}^{l_1}$ the identity space;

  –

  Choosing five secure hash functions:

  $H_1$: $G_2\times G_1^2\to {\{0;1\}}^{l_1}$;

  $H_2$: ${\{0;1\}}^{l_1}\times G_1\to {\mathbb{Z}}_q^{*}$;

  $H_3$: $G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\to {\mathbb{Z}}_q^{*}$;

  $H_4$: ${\{0;1\}}^{l_2}\times G_1^2\times G_2\times {\{0;1\}}^{l_1}\times G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\to {\mathbb{Z}}_q^{*}$;

  $H_5$: $G_1^2\times G_2\times {\{0;1\}}^{l_1}\times G_1^2\times {\{0;1\}}^{l_1}\times G_1^2\to {\{0;1\}}^{l_2}$.

  where $G_1^2=G_1\times G_1$;

  –

  The selection of a number $\lambda$ from ${\mathbb{Z}}_q^{*}$, and computing $P_{pub}=\lambda P$ and setting $msk=\lambda$;

  –

  Keeping $\lambda$ secret and releasing $params=\{G_1,G_2,q,\widehat{e},P,Q,P_{pub},E,H_1\sim H_5\}$.

• PID-Extract: After obtaining the $I{D}_s\in \mathrm{\Omega }$ of the SN, the MS carries out the subsequent actions to produce the pseudo-identity $PI{D}_s$:

  –

  Picking $n_s,r_s\in {\mathbb{Z}}_q^{*}$ at random and calculating $N_s=n_{s}P,R_s=r_{s}P$;

  –

  Computing ${\mathrm{\Delta }}_s=\widehat{e}(n_s{r}_{s}P,\lambda Q),PI{D}_s=I{D}_s\oplus H_1({\mathrm{\Delta }}_s,N_s,R_s)$;

  –

  Setting a list $FI=(PI{D}_s,n_s,N_s,r_s,R_s)$ and forwarding $PI{D}_s$ to SN.

• PPK-Extract:

  –

  On input $PI{D}_s$, the MS picks $y_s\in {\mathbb{Z}}_q^{*}$ by random and sets $Y_s=y_{s}P,$ $k_s=H_2(PI{D}_s,Y_s)$ and $x_s=y_s+k_s\lambda$. Then, the MS uses a secure channel to forward $Z_s=(Y_s,x_s)$ to the SN.

  –

  After receiving the PD’s real identity $I{D}_d$, the MS picks $y_d\in {\mathbb{Z}}_q^{*}$ by random and computes $Y_d=y_{d}P,$ $k_d=H_2(I{D}_d,Y_d)$ and $x_d=y_d+k_d\lambda$. Then, the MS uses a secure channel to forward $Z_d=(Y_d,x_d)$ to the PD.

• SV-Set: The SN and PD pick random values $t_s\in {\mathbb{Z}}_q^{*}$ and $t_d\in {\mathbb{Z}}_q^{*}$ as their secret values, respectively.
• FSK-Set: The SN and PD set $S{K}_s=(t_s,x_s)$ and $S{K}_d=(t_d,x_d)$, respectively.
• UPK-Generate: $P{K}_s=(T_s,Y_s)$ and $P{K}_d=(T_d,Y_d)$ are set by the SN and PD, respectively, where $T_s=t_{s}P$ and $T_d=t_{d}P$.
• Signcrypt: The SN performs the following actions to create $\sigma$ on m for a PD as a recipient:

  –

  Picking random values $f,v{\in }_R{\mathbb{Z}}_q^{*}$, and computing $F=fP,V=vP$;

  –

  Setting $k_d=H_2(I{D}_d,Y_d)$;

  –

  Setting $g=H_3(F,V,I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$;

  –

  Setting $\mathrm{\Lambda }=\widehat{e}(fvP,Y_d+k_d{P}_{pub}+g{T}_d)$;

  –

  Setting $h=H_4(m,F,V,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$;

  –

  Setting $W={\displaystyle \frac{1}{x_s+h{t}_s}}P$;

  –

  Setting $\alpha =H_5(F,V,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)\oplus m$.

  Finally, SN returns $\sigma =(\alpha ,F,V,W)$ and forwards it to the PD.
• Unsigncrypt: Upon receiving $\sigma =(\alpha ,F,V,W)$, the PD executes the following actions:

  –

  Setting $k_s=H_2(PI{D}_s,Y_s)$;

  –

  Setting $g=H_3(F,V,I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$;

  –

  Setting $\mathrm{\Lambda }=\widehat{e}{(F,V)}^{x_d+g{t}_d}$;

  –

  Setting $m=H_5(F,V,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)\oplus \alpha$;

  –

  Setting $h=H_4(m,F,V,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$.

  Finally, the PD accepts the message m, if

  $$\widehat{e}(W,Y_s+k_s{P}_{pub}+h{T}_s)=E.$$
  Otherwise, the signcryption is rejected.

Based on the hardness of the DBDH problem, Deng et al. asserted that their suggested CL-SC scheme is EUF-CMA and IND-CCA2 against both $A_I$ and $A_{II}$ in the standard model (i.e., without the assumption of random oracles) [20]. Nevertheless, we will illustrate that their proposed scheme is insecure faced with a super Type II adversary.

4.2. Cryptanalysis of Deng et al.’s Scheme

We shall demonstrate that a super Type II adversary can forge Deng et al.’s CL-SC scheme. Specifically, a super adversary $A_{II}$ can replace the public key of the KGC, $P_{pub}$, and then forge legitimate signcryptions on any messages on behalf of a SN. The details of our designed attack are described below.

In order to create a forged signcryption on a message m instead of an SN for a recipient PD, $A_{II}$ performs the subsequent actions:

• Picks random values $f,v{\in }_R{\mathbb{Z}}_q^{*}$, and computes $F=fP$ and $V=vP$.
• Sets $k_d=H_2(I{D}_d,Y_d)$.
• Sets $g=H_3(F,V,I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$.
• Sets $\mathrm{\Lambda }=\widehat{e}(fvP,Y_d+k_d{P}_{pub}+g{T}_d)$.
• Sets $h=H_4(m,F,V,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$.
• Selects $r\in {\mathbb{Z}}_q^{*}$ by random and computes $W=r^{-1}P$.
• Sets $\alpha =H_5(F,V,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)\oplus m$.

Then, $A_{II}$ replaces the real public key $P_{pub}$ with a new one $P_{pub}^{*}={k_s}^{-1}(rP-Y_s-h{T}_s)$, where $k_s=H_2(PI{D}_s,Y_s)$. Finally, $A_{II}$ outputs $\sigma =(\alpha ,F,V,W)$ and sends it to the PD.

It is simple to verify if the signcryption is valid by performing the following calculation:

$$\begin{array}{cc}\hfill & \widehat{e}(W,Y_s+k_s{P}_{pub}^{*}+h{T}_s)\hfill \\ \hfill & =\widehat{e}(r^{-1}P,Y_s+k_s\left(k_s^{-1}(rP-Y_s-h{T}_s)\right)+h{T}_s)\hfill \\ \hfill & =\widehat{e}(r^{-1}P,rP)=\widehat{e}{(P,P)}^{\left(r{r}^{-1}\right)}=\widehat{e}(P,P)=E.\hfill \end{array}$$

So, in the PD’s perspective, $\sigma$ is a legitimate signcryption from the SN using the substituted public key $P_{pub}^{*}$.

5. Our Improved CL-SC Scheme

Here, we fix the problem identified in Section 4 by improving Deng et al.’s scheme. The algorithms of our enhanced CL-SC scheme are as follows:

1.

Setup, PID-Extract, PPK-Extract, SV-Set, FPK-Set and UPK-Generate: These steps are similar to those of Deng et al.’s scheme described in Section 4.

2.

Signcrypt: To generate $\sigma$ on m for a recipient PD, the SN carries out the subsequent operations:

• Picks $f{\in }_R{\mathbb{Z}}_q^{*}$ by random and computes $F=fP$.
• Sets $k_d=H_2(I{D}_d,Y_d)$.
• Sets $g=H_3(F,I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$.
• Sets $\mathrm{\Lambda }=\widehat{e}(f{t}_{s}P,Y_d+k_d{P}_{pub}+g{T}_d)$.
• Sets $h=H_4(m,F,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s,P_{pub})$.
• Sets $W={\displaystyle \frac{1}{x_s+h{t}_s}}P$.
• Sets $\alpha =H_5(F,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)\oplus m$.

Finally, the SN returns $\sigma =(\alpha ,F,W)$ and forwards it to the PD.

3.

Unsigncrypt: Once $\sigma =(\alpha ,F,W)$ is received by the PD, they perform the following operations:

• Sets $k_s=H_2(PI{D}_s,Y_s)$.
• Sets $g=H_3(F,I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$.
• Sets $\mathrm{\Lambda }=\widehat{e}{(F,T_s)}^{x_d+g{t}_d}$.
• Sets $m=H_5(F,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)\oplus \alpha$.
• Sets $h=H_4(m,F,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s,P_{pub})$.
• The message m is accepted if $\widehat{e}(W,Y_s+k_s{P}_{pub}+h{T}_s)=E$. Otherwise, the signcription is rejected.

It is straightforward to check the correctness of the improved scheme, via

$$\begin{array}{cc}\hfill \widehat{e}{(F,T_s)}^{x_d+g{t}_d}& =\widehat{e}{(fP,t_{s}P)}^{x_d+g{t}_d}\hfill \\ \hfill & =\widehat{e}(f{t}_{s}P,(x_d+g{t}_d)P)\hfill \\ \hfill & =\widehat{e}(f{t}_{s}P,Y_d+K_d{P}_{pub}+g{T}_d)=\mathrm{\Lambda },\hfill \end{array}$$

and

$$\begin{array}{cc}\hfill & \widehat{e}(W,Y_s+K_s{P}_{pub}+h{T}_s)=\hfill \\ \hfill & \widehat{e}({\displaystyle \frac{1}{x_s+h{t}_s}}P,y_{s}P+K_s\lambda P+h{t}_{s}P)=\hfill \\ & \widehat{e}({\displaystyle \frac{1}{y_s+K_s\lambda +h{t}_s}}P,(y_s+K_s\lambda +h{t}_s)P)=\hfill \\ \hfill & \widehat{e}(P,P)=E.\hfill \end{array}$$

It is worth mentioning that in the modified version of Deng et al.’s scheme, the shortcoming of the original version mentioned in Section 4.2 is fixed. In the signcrypt algorithm, h is computed as $h=H_4(m,F,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s,P_{pub})$, instead of $h=H_4(m,F,\mathrm{\Lambda },I{D}_d,P{K}_d,PI{D}_s,P{K}_s)$. When $P_{pub}$ is taken into account as one of the inputs of $H_4(.)$, a super adversary $A_{II}$ is unable to replace a public key $P_{pub}$ because, when substituting $P_{pub}$ with $P_{pub}^{*}={k_s}^{-1}(rP-Y_s-h{T}_s)$, $A_{II}$ cannot obtain h without having $P_{pub}^{*}$ in hand. As a result, $A_{II}$ is unable to forge legal signcryption by the method described in Section 4.2. Furthermore, by eliminating one auxiliary parameter in the signcryption construction, the proposed scheme reduces the overall computational complexity; consequently, as can be observed from the performance evaluation in the next section, our scheme incurs a lower computational cost compared to Deng et al.’s scheme.

6. Proof of Security

Now, we provide a formal security proof of the enhanced CL-SC scheme within the standard model (SM).

6.1. Confidentiality

Theorem 1. 

Our enhanced CL-SC scheme achieves IND-CCA2 security against both super adversaries $A_I$ and $A_{II}$ in the standard model, if the ECDDHP problem is assumed to be computationally infeasible.

To prove Theorem 1, we adopt the adversarial model described in Section 3.3.1 to imply the two below lemmas.

Lemma 1. 

Suppose that there exists an $A_I$ capable of winning Game 1 and breaking the IND-CCA2 security of the CL-SC scheme with an advantage of at least ϵ. Then, it is possible to construct an algorithm $C_1$ that solves an ECDDHP with a non-negligible advantage $ϵ·{\displaystyle \frac{1}{q_{UD}}}{e}^{-q_{UN}/q_{UD}}$, where $q_{UD},q_{RD},q_{KD},q_{UN}$ denote the query numbers issued to the UPK, Replace, PPK and USC oracles, respectively.

Proof. 

Let $A_I$ be a polynomial-time super adversary in Game 1 that succeeds in compromising the confidentiality of the proposed CL-SC scheme with at least $ϵ$ probability. We construct an algorithm $C_1$ that invokes $A_I$ as a subroutine in order to solve an ECDDHP problem. While designing $C_1$, we assume that following the random selection of $I{D}_{d^{\prime }}$ as the target ID, $C_1$ is given the standpoint of an ECDDHP $(P,aP,bP,cP)$ and tries to use $A_I$ to ascertain whether or not $abP=cP$.

Initialization. $C_1$ sets the public parameters and sends them to $A_I$ after randomly choosing $I{D}_{d^{\prime }}$ as the target ID. It is crucial to keep in mind that $C_1$ does not know $\lambda$.

Phase 1 Queries. A polynomially bounded number of inquiries may be sent to $C_1$ by $A_I$.

• PID-Query($I{D}_s$): $C_1$ execute the PID-Extract phase to retrieve $PI{D}_s$.
• UPK-Query($PI{D}_s$): $C_1$ keeps a record of $(PI{D}_s,T_s,t_s,Y_s,y_s)$ in $L_{US}$. $C_1$ selects $t_s,y_s\in {\mathbb{Z}}_q^{*}$ at random, establishes $P{K}_s=(t_{s}P,y_{s}P)$, and subsequently includes $(PI{D}_s,T_s,t_s,Y_s,y_s)$ in $L_{US}$.
• UPK-Query($I{D}_d$): $C_1$ keeps a record of $L_{UD}$ of tuple $(I{D}_d,T_d,t_d,Y_d,y_d)$ and performs the subsequent actions:

  1.

  If $I{D}_d=I{D}_{d^{\prime }}$, $C_1$ selects $t_d^{\prime }\in {\mathbb{Z}}_q^{*}$ at random, assigns $I{D}_d=I{D}_d^{\prime }$ and $P{K}_d=P{K}^{\prime }=(t_d^{\prime }P,aP)$, and subsequently includes $(I{D}_d^{\prime },T_d^{\prime },t_d^{\prime },aP,y_d^{\prime }=\perp )$ in $L_{UD}$.

  2.

  If not, $C_1$ selects $t_d,y_d\in {\mathbb{Z}}_q^{*}$, establishes $P{K}_d=(t_{d}P,y_{d}P)$, and subsequently includes $(I{D}_d,T_d,t_d,Y_d,y_d)$ in the $L_{UD}$ table.

• Replace-Query($PI{D}_s,P{K}_s^{″}$): A list $L_{RS}$ of tuples $(PI{D}_s,P{K}_s,$ and $P{K}_s^{″})$ is maintained by $C_1$. $C_1$ inserts $(PI{D}_s,P{K}_s,$ and $P{K}_s^{″})$ to $L_{RS}$ and updates $P{K}_s$ with $P{K}_s^{″}$.
• Replace-Query($I{D}_d,P{K}_d^{″}$): A list $L_{RD}$ of tuples $(I{D}_d,P{K}_d,$ and $P{K}_d^{″})$ is maintained by $C_1$. $C_1$ inserts $(I{D}_d,P{K}_d,$ and $P{K}_d^{″})$ to $L_{RD}$ and updates $P{K}_d$ with $P{K}_d^{″}$.
• PPK-Query($PI{D}_s$): A list $L_{KS}$ of tuples $(PI{D}_s$ and $Z_s)$ is maintained by $C_1$. Upon finding $(PI{D}_s,t_{s}P,t_s,y_{s}P,$ and $y_s)$ in $L_{US}$, $C_1$ adds $(PI{D}_s$ and $Z_s)$ to $L_{KS}$ after running the PPK-Generate step to produce $Z_s=(x_s,Y_s)$.
• PPK-Query($I{D}_d$): A list $L_{KD}$ of tuples $(I{D}_d;Z_d)$ is maintained by $C_1$; then, $C_1$ performs the subsequent actions:

  1.

  If $I{D}_d=I{D}_d^{\prime }$, the simulation aborts.

  2.

  Otherwise, after finding $(I{D}_d,t_{d}P,t_d,y_{d}P,$ and $y_d)$ in $L_{UD}$, $C_1$ inserts $(I{D}_d$ and $Z_d)$ to $L_{KD}$ after running the PPK-Generate phase to produce $Z_d=(x_d,Y_d)$.

• SV-Query($PI{D}_s$): $C_1$ returns $t_s$ after locating $(PI{D}_s,t_{s}P,t_s,y_{s}P,$ and $y_s)$ in the table $L_{US}$.
• SV-Query($I{D}_d$): $C_1$ returns $t_d$ after locating $(I{D}_d,t_{d}P,t_d,y_{d}P,$ and $y_d)$ in the table $L_{UD}$.
• SC-Query($m,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): After obtaining $S{K}_s$ using the PPK-Extract and SV-Set algorithms, $C_1$ runs the signcrypt algorithm to produce a signcryption $\sigma$.
• USC-Query($\sigma ,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): $C_1$ performs the subsequent actions:

  1.

  If $I{D}_d\in L_{RD}$, thus, $P{K}_d=(t_{d}P,y_{d}P)$ has been revised to $P{K}_d^{″}=(t^{″}{d}_P,y_d^{″}P)$. If $t_d^{″}\ne t_d$ (or $y_d^{″}\ne y_d$), $A_I$ must provide the value $t_d^{″}$ (or $y_d^{″}$), after which $C_1$ runs the unsigncrypt phase to deliver m or reject the signcryption.

  2.

  If $I{D}_d\notin L_{RD}$ and $I{D}_d\ne I{D}_d^{\prime }$, $C_1$ runs the unsigncrypt phase to deliver m or reject the signcryption.

  3.

  If $I{D}_d\notin L_{RD}$ and $I{D}_d=I{D}_d^{\prime }$, the simulation aborts.

Challenge. Two messages of identical length, $m_0$ and $m_1$, as well as two identities, $I{D}_s^{*}$ and $I{D}_d^{*}$, are chosen by $A_I$ and given to $C_1$ during this phase. The following actions are taken by $C_1$:

• if $I{D}_d^{*}\ne I{D}_d^{\prime }$, $C_1$ selects $\mu \in \{0,1\}$ by random and makes a SC-Query($m_{\mu },I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*}$) to return a signcryption ${\sigma }^{*}$.
• If $I{D}_d^{*}=I{D}_d^{\prime }$, $C_1$ selects $\mu \in \{0,1\}$ by random and performs the following steps:

  1.

  Searches for the tuple $(PI{D}_s^{*},T_s^{*},t_s^{*},Y_s^{*},$ and $y_s^{*})$ in $L_{US}$.

  2.

  Defines the sender’s public key as $P{K}_s^{*}=(t_s^{*}P,y_s^{*}P)$.

  3.

  Calculates $k_s^{*}=H_2(PI{D}_s^{*},Y_s^{*})$ and $x_s^{*}=y_s^{*}+k_s^{*}\lambda$.

  4.

  Retrieves $(I{D}_d^{\prime },T_d^{\prime },t_d^{\prime },aP,y_d^{*}=\perp )$ from the table $L_{UD}$.

  5.

  Sets the recipient’s public key as $P{K}_d^{*}=P{K}_d^{\prime }=(t_d^{\prime }P,aP)$.

  6.

  Sets $k_d^{*}=H_2(I{D}_d^{\prime },aP)$.

  7.

  Defines $F^{*}=bP$.

  8.

  Calculates $g^{*}=H_3(F^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},$ and $P{K}_s^{*})$.

  9.

  Sets

  $${\mathrm{\Lambda }}^{*}=\widehat{e}(cP,T_s^{*})\widehat{e}(F^{*}{t}_s^{*},g{T}_d^{*}).$$

  10.

  Sets

  $$h^{*}=H_4(m_{\mu },F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*},P_{pub}).$$

  11.

  Defines

  $$W^{*}={\displaystyle \frac{1}{x_s^{*}+h^{*}{t}_s^{*}}}P.$$

  12.

  Calculates

  $${\alpha }^{*}=H_5(F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})\oplus m_{\mu }.$$

  Finally, $C_1$ outputs ${\sigma }^{*}=({\alpha }^{*},F^{*},W^{*})$ and forwards it to $A_I$.

Phase 2 Queries. Adversary $A_I$ sends queries to $C_1$, analogous to the Phase 1 query process. Note that $A_I$ is not permitted to submit an unsigncryption query on ${\sigma }^{*}$ from $s^{*}$ to $d^{*}$ unless either $P{K}_{s^{*}}$ or $P{K}_{d^{*}}$ used in the signcryption of $m_{\mu }$ has been updated after the challenge phase.

Guess. $A_I$ eventually generates ${\mu }^{\prime }\in \{0,1\}$.

Solve ECDDHP. $C_1$ returns one if ${\mu }^{\prime }=\mu$ and zero if not.

If $I{D}_d^{*}=I{D}_d^{\prime }$ and $cP=abP$ then

${\mathrm{\Lambda }}^{*}=\widehat{e}(cP,T_s^{*})\widehat{e}(F^{*}{t}_s^{*},g{T}_d^{*})=\widehat{e}(abP,t_s^{*}P)\widehat{e}(b{t}_s^{*}P,g{t}_d^{*}P)=\widehat{e}{(P,P)}^{ab{t}_s^{*}}\widehat{e}{(P,P)}^{b{t}_s^{*}g{t}_d^{*}}=\widehat{e}{(P,P)}^{ab{t}_s^{*}+b{t}_s^{*}g{t}_d^{*}}=\widehat{e}{(P,P)}^{t_s^{*}b(a+g{t}_d^{*})}=\widehat{e}(t_s^{*}bP,aP+g{t}_d^{*}P)=\widehat{e}(t_s^{*}bP,Y_d^{*}+k_d^{*}{P}_{pub}+g{T}_d^{*}).$

This implies that ${\sigma }^{*}$ constitutes a valid signcryption. Consequently, adversary $A_I$ achieves an advantage $ϵ$ in correctly guessing $\mu$. Formally, we have

$$Pr[C_1\to 1\mid cP=abP]=Pr[{\mu }^{*}=\mu \mid cP=abP]={\displaystyle \frac{1}{2}}+ϵ.$$

The signcryption ${\sigma }^{*}$ is invalid if $cP\ne abP$. It demonstrates that all of the elements in ${\sigma }^{*}$ have the same probabilities for $\mu =1$ or $\mu =0$, and therefore $A_I$ cannot have an unfair advantage in determining $\mu$. The result is

$$Pr[C_1\to 1|cP\ne abP]=Pr[{\mu }^{*}=\mu |cP\ne abP]={\displaystyle \frac{1}{2}}.$$

In Game 1, $C_1$ wins if the next events take place:

• $E_1$: $C_1$ does not end the game in $A_I$ queries from the PPK-Query() and does not replace the value $aP$.
• $E_2$: $A_I$ does not fail in USC-Query().
• $E_3$: In the challenge stage, $A_I$ selects $I{D}_{d^{*}}=I{D}_{d^{\prime }}$.

If $Y_d$ has been changed, $A_I$ is unable to run PPK-Query($I{D}_d$) so $L_{RD}\cap L_{KD}=$ is a justified setting.

Let $q_{UD},q_{RD},q_{KD},$ and $q_{UN}$ denote the numbers of queries performed by adversary $A_I$ to the UPK, Replace, PPK and USC oracles, respectively. It follows that

$$Pr[E_2\mid E_1]\ge {\left(1-{\displaystyle \frac{1}{q_{UD}}}\right)}^{q_{UN}}\ge e^{-q_{UN}/q_{UD}}.$$

Furthermore, the probability of event $E_1$ occurring satisfies

$$Pr\left[E_1\right]\ge {\displaystyle \frac{q_{UD}-q_{RD}-q_{KD}}{q_{UD}}}.$$

In addition, if during the challenge phase $I{D}_{d^{*}}=I{D}_{d^{\prime }}$, then the conditional probability of event $E_3$ given $E_1$ and $E_2$ is

$$Pr[E_3\mid E_1,E_2]\ge {\displaystyle \frac{1}{q_{UD}-q_{RD}-q_{KD}}}.$$

Therefore, the overall probability that challenger $C_1$ succeeds in this game is

$$ϵPr\left[E_1{E}_2{E}_3\right]=Pr\left[E_1\right]Pr[E_2\mid E_1]Pr[E_3\mid E_1,E_2]\ge ϵ·{\displaystyle \frac{1}{q_{UD}}}{e}^{-q_{UN}/q_{UD}}.$$

□

Lemma 2. 

Suppose that $A_{II}$ is a super adversary capable of succeeding in Game 2 and breaking the IND-CCA2 security of our enhanced scheme with at least ϵ probability. In such a case, it is possible to construct an algorithm $C_2$ that solves an ECDDHP problem with a non-negligible advantage $ϵ·{\displaystyle \frac{1}{q_{UD}}}{e}^{-q_{UN}/q_{UD}}$, where $q_{UD}$, $q_{VD}$, and $q_{UN}$ denote the numbers of queries issued the UPK, SV and USC oracles, respectively.

Proof. 

Let $A_{II}$ be a polynomial time adversary in Game 2 that has a chance of at least $ϵ$ of breaching the confidentiality of our CL-SC system. We construct the algorithm $C_2$ that calls $A_{II}$ as a procedure to solve an instance of an ECDDHP. When developing $C_2$, we take into account the presumptions that following the random selection of $I{D}_{d^{\prime }}$ as the target ID, $C_2$ is given the standpoint of an ECDDHP $(P,aP,bP,cP)$ and tries to use $A_{II}$ to solve this issue, that is, ascertain whether or not $abP=cP$.

Initialization. $C_2$ sets the public parameters and sends them to $A_{II}$ after randomly choosing $I{D}_{d^{\prime }}$ as the target ID. It is crucial to keep in mind that $C_2$ knows $\lambda$.

Phase 1 Queries. The adversary $A_{II}$ is permitted to issue queries to $C_2$.

• PID-Query($I{D}_s$): This is the same as in Lemma 1.
• UPK-Query($PI{D}_s$): This is the same as in Lemma 1.
• UPK-Query($I{D}_d$): $C_2$ keeps a record of $(I{D}_d,T_d,t_d,Y_d,$ and $y_d)$ in $L_{UD}$ and performs the subsequent actions:

  1.

  On the $I{D}_{d^{\prime }}$ query, $C_2$ chooses $y_d^{\prime }\in {\mathbb{Z}}_q^{*}$ by random, assigns $I{D}_d=I{D}_d^{\prime }$ and $P{K}_d=P{K}^{\prime }=(ap,y_d^{\prime }P)$, and subsequently includes $(I{D}_d^{\prime },T_d^{\prime }=aP,t_d^{\prime }=\perp ,Y_d^{\prime },$ and $y_d^{\prime })$ in $L_{UD}$.

  2.

  Otherwise, $C_2$ chooses $t_d,y_d\in {\mathbb{Z}}_q^{*}$, establishes $P{K}_d=(t_{d}P,y_{d}P)$, and subsequently includes $(I{D}_d,T_d,t_d,Y_d,y_d)$ in $L_{UD}$.

• PPK-Query($PI{D}_s$): This is the same as in Lemma 1.
• PPK-Query($I{D}_d$): A list $L_{KD}$ of tuples $(I{D}_d;Z_d)$ is maintained by $C_2$. After finding $(I{D}_d,t_{d}P,t_d,y_{d}P,$ and $y_d)$ in the table $L_{UD}$, $C_2$ inserts $(I{D}_d$ and $Z_d)$ to $L_{KD}$ after running the PPK-Generate phase to produce $Z_d=(x_d,Y_d)$.
• SV-Query($PI{D}_s$): This is the same as in Lemma 1.
• SV-Query($I{D}_d$): $C_2$ keeps a record of $(I{D}_d$ and $t_d)$ in $L_{VD}$ and performs the subsequent actions:

  1.

  If $I{D}_d=I{D}_d^{\prime }$, $C_2$ aborts and gives up.

  2.

  If not, $C_2$ looks for $(I{D}_d,T_d,t_d,Y_d,$ and $y_d)$ in $L_{KD}$, produces $t_d$, and inserts $(I{D}_d$ and $t_d)$ to $L_{VD}$.

• SC-Query($m,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): This is similar to that of Lemma 1.
• USC-Query($\sigma ,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): This the the same as in Lemma 1.

Challenge. Two messages of identical length, $m_0$ and $m_1$, as well as two identities, $I{D}_s^{*}$ and $I{D}_d^{*}$, are chosen by $A_{II}$ and given to $C_2$ during this phase. The following actions are taken by $C_2$:

• If $I{D}_d^{*}\ne I{D}_d^{\prime }$, then $C_2$ selects $\mu \in \{0,1\}$ by random and makes SC-Query ($m_{\mu },I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*}$) to return a signcryption ${\sigma }^{*}$.
• If $I{D}_d^{*}=I{D}_d^{\prime }$, $C_2$ selects $\mu \in \{0,1\}$ by random and undertakes the following:

  1.

  Retrieves the tuple $(PI{D}_s^{*},T_s^{*},t_s^{*},Y_s^{*}$ and $y_s^{*})$ from the table $L_{US}$.

  2.

  Defines the sender’s public key as $P{K}_s^{*}=(t_s^{*}P,y_s^{*}P)$.

  3.

  Calculates $k_s^{*}=H_2(PI{D}_s^{*},Y_s^{*})$ and $x_s^{*}=y_s^{*}+k_s^{*}\lambda$.

  4.

  Locates $(I{D}_d^{\prime },aP,\perp ,Y_d^{\prime },y_d^{\prime })$ in $L_{UD}$.

  5.

  Assigns the recipient’s public key as $P{K}_d^{*}=P{K}_d^{\prime }=(aP,y_d^{\prime }P)$.

  6.

  Calculates $k_d^{*}=H_2(I{D}_d^{\prime },y_d^{\prime }P)$.

  7.

  Defines $F^{*}=bP$.

  8.

  Evaluates $g^{*}=H_3(F^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})$.

  9.

  Sets

  $${\mathrm{\Lambda }}^{*}=\widehat{e}(t_s^{*}bP,Y_d^{*}+k_d^{*}{P}_{pub})\widehat{e}(cP,g^{*}{T}_s^{*}).$$

  10.

  Calculates

  $$h^{*}=H_4(m_{\mu },F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*},P_{pub}).$$

  11.

  Defines

  $$W^{*}={\displaystyle \frac{1}{x_s^{*}+h^{*}{t}_s^{*}}}P.$$

  12.

  Sets

  $${\alpha }^{*}=H_5(F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})\oplus m_{\mu }.$$

  Finally, $C_2$ outputs ${\sigma }^{*}=({\alpha }^{*},F^{*},W^{*})$ and forwards it to $A_{II}$.

Phase 2 Queries. Similarly to Phase 1 queries, $A_{II}$ asks the oracles a polynomially finite number of queries, and $C_2$ must respond. It should be noted that $A_{II}$ is not permitted to ask ${\sigma }^{*}$ from $s^{*}$ to $d^{*}$ in an unsigncryption inquiry.

Guess. Finally $A_{II}$ returns ${\mu }^{\prime }$.

Solve ECDDHP. $C_2$ outputs one if ${\mu }^{\prime }=\mu$, and zero if not.

If $I{D}_d^{*}=I{D}_d^{\prime }$ and $cP=abP$ then

${\mathrm{\Lambda }}^{*}=\widehat{e}(t_s^{*}bP,Y_d^{*}+K_d^{*}{P}_{pub})\widehat{e}(cP,g^{*}{T}_s^{*})=\widehat{e}{(P,P)}^{t_s^{*}b{x}_d^{*}}\widehat{e}{(P,P)}^{ab{g}^{*}{t}_s^{*}}=\widehat{e}{(P,P)}^{t_s^{*}b(x_d^{*}+a{g}^{*})}=\widehat{e}(t_s^{*}bP,(x_d^{*}+a{g}^{*})P)=\widehat{e}(t_s^{*}bP,x_d^{*}P+g^{*}aP)=\widehat{e}(t_s^{*}bP,Y_d^{*}+K_d^{*}{P}_{pub}+g^{*}{T}_d^{*})$

It means that ${\sigma }^{*}$ is a valid signcryption. Then $A_{II}$ holds the superiority $ϵ$ in determining $\mu$. That is

$$Pr[C_2\to 1|cP=abP]=Pr[{\mu }^{*}=\mu |cP=abP]={\displaystyle \frac{1}{2}}+ϵ.$$

The signcryption ${\sigma }^{*}$ is invalid if $cP\ne abP$. It demonstrates that all of the elements in ${\sigma }^{*}$ have the same probabilities for $\mu =1$ or $\mu =0$, and therefore $A_{II}$ cannot have an unfair advantage in identifying $\mu$. The result is

$$Pr[C_2\to 1|cP\ne abP]=Pr[{\mu }^{*}=\mu |cP\ne abP]={\displaystyle \frac{1}{2}}.$$

$C_2$ is the winner of Game 2 depending on the following:

• $E_1$: $C_2$ does not abort in $A_{II}$ queries from the SV-Query() and does not replaced the value $aP$.
• $E_2$: $A_{II}$ does not fail in USC-Query().
• $E_3$: In the challenge phase, $A_{II}$ selects $I{D}_{d^{*}}=I{D}_{d^{\prime }}$.

Let $q_{UD}$, $q_{VD}$, and $q_{UN}$ denote the numbers of queries made by adversary $A_{II}$ to the UPK, SV and USC oracles respectively. It follows that

$$Pr[E_2\mid E_1]\ge {\left(1-{\displaystyle \frac{1}{q_{UD}}}\right)}^{q_{UN}}\ge e^{-q_{UN}/q_{UD}}.$$

Moreover, the probability of event $E_1$ occurring satisfies

$$Pr\left[E_1\right]\ge {\displaystyle \frac{q_{UD}-q_{VD}}{q_{UD}}}.$$

In addition, if in the challenge phase we have $I{D}_{d^{*}}=I{D}_{d^{\prime }}$, then the conditional probability of event $E_3$ given $E_1$ and $E_2$ is

$$Pr[E_3\mid E_1,E_2]\ge {\displaystyle \frac{1}{q_{UD}-q_{VD}}}.$$

Therefore, the overall probability that challenger $C_1$ succeeds in this game is

$$ϵPr\left[E_1{E}_2{E}_3\right]=Pr\left[E_1\right]Pr[E_2\mid E_1]Pr[E_3\mid E_1,E_2]\ge ϵ·{\displaystyle \frac{1}{q_{UD}}}{e}^{-q_{UN}/q_{UD}}.$$

□

6.2. Unforgeability

Theorem 2. 

Assuming that the CAA problem is computationally hard, our enhanced CL-SC scheme achieves EUF-CMA security against both $A_I$ and $A_{II}$ within the standard model.

We utilize the framework presented in Section 3.3.2 to derive the following two lemmas, which collectively imply Theorem 2.

Lemma 3. 

Suppose that $A_I$ is capable of succeeding in Game 3 and breaking the EUF-CMA security of our CL-SC scheme with at least ϵ probability. In this case, one can construct a simulator $C_3$ that solves a CAA problem with a non-negligible advantage $ϵ·{\displaystyle \frac{1}{q_{US}}}{e}^{-q_{SC}/q_{US}}$, where $q_{US}$, $q_{RS}$, $q_{KS}$, and $q_{SC}$ denote the numbers of queries issued to the UPK, Replace, PPK and SC oracles, respectively.

Proof. 

Let $A_I$ be a PPT super Type I opponent in Game 3 that, with probability $ϵ$, violates the unforgeability of our CL-SC system. We construct an algorithm $C_3$ that defines $A_I$ as a subroutine with the aim to resolve the CAA. With the exception of assuming that $C_3$ is given a CAA instance $(P,aP)$ and tries to utilize $A_I$ to compute $(c,{\displaystyle \frac{c}{a+c}})$, our assumptions are identical to Lemma 1.

Initialization. $C_3$ assigns public parameters and transmits them to $A_I$ after randomly choosing $I{D}_{s^{\prime }}$ as the target ID. It is crucial to keep in mind that $C_3$ does not know $\lambda$.

Queries. $A_I$ is allowed to issue queries to $C_3$.

• PID-Query($I{D}_s$): This is the same as in Lemma 1.
• UPK-Query($PI{D}_s$): $C_3$ keeps a record of $(PI{D}_s,T_s,t_s,Y_s,$ and $y_s)$ in $L_{SD}$ and performs the subsequent actions:

  1.

  On the $PI{D}_{s^{\prime }}$ query, $C_3$ selects $t_s^{\prime }\in {\mathbb{Z}}_q^{*}$ by random, assigns $PI{D}_s=PI{D}_s^{\prime }$ and $P{K}_s=P{K}^{\prime }=(t_s^{\prime }P,aP)$, and subsequently includes $(PI{D}_s^{\prime },T_s^{\prime },t_s^{\prime },aP,y_s^{\prime }=\perp )$ in $L_{SD}$.

  2.

  Otherwise, $C_3$ selects $t_s,y_s\in {\mathbb{Z}}_q^{*}$, establishes $P{K}_s=(t_{d}s,y_{d}P)$, and subsequently includes $(PI{D}_s,T_s,t_s,Y_s,$ and $y_s)$ in $L_{SD}$.

• UPK-Query($I{D}_d$): $C_3$ keeps a record of $(PI{D}_d,T_d,t_d,Y_d,$ and $y_d)$ in $L_{UD}$. $C_3$ selects $t_d,y_d\in {\mathbb{Z}}_q^{*}$ by random, establishes $P{K}_s=(t_{d}P,y_{d}P)$, and subsequently includes $(PI{D}_d,T_d,t_d,Y_d,$ and $y_d)$ in $L_{UD}$.
• Replace-Query($PI{D}_s,P{K}_s^{″}$): This is similar to Lemma 1.
• Replace-Query($I{D}_d,P{K}_d^{″}$): This is the same as in Lemma 1.
• PPK-Query($PI{D}_s$): A table $L_{KS}$ of tuples $(PI{D}_s;Z_s)$ is maintained by $C_3$. Then, $C_3$ performs the subsequent actions:

  1.

  If $PI{D}_s=PI{D}_s^{\prime }$, the simulation aborts.

  2.

  Otherwise, after finding $(PI{D}_s,t_{s}P,t_s,y_{s}P,$ and $y_s)$ in $L_{US}$, $C_3$ adds $(I{D}_s$ and $Z_s)$ to $L_{KS}$ after running the PPK-Extract phase to produce $Z_s=(x_s,Y_s)$.

• PPK-Query($I{D}_d$): A table $L_{KD}$ of tuples $(I{D}_d;Z_d)$ is maintained by $C_3$. After finding $(I{D}_d,t_{d}P,t_d,y_{d}P,$ and $y_d)$ in the table $L_{UD}$, $C_3$ inserts $(I{D}_d$ and $Z_d)$ to $L_{KD}$ after running the PPK-Extract phase to produce $Z_d=(x_d,Y_d)$.
• SV-Query($PI{D}_s$): $C_3$ returns $t_s$ after locating $(PI{D}_s,t_{s}P,t_s,y_{s}P,$ and $y_s)$ in the table $L_{US}$.
• SV-Query($I{D}_d$): $C_3$ returns $t_d$ after locating $(I{D}_d,t_{d}P,t_d,y_{d}P,$ and $y_d)$ in the table $L_{UD}$.
• SC-Query($m,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): $C_3$ performs the subsequent actions:

  1.

  If $PI{D}_s\in L_{RS}$, thus, $P{K}_s=(t_{s}P,y_{s}P)$ has been revised to $P{K}_s^{″}=(t^{″}{s}_P,y_s^{″}P)$. If $t_s^{″}\ne t_s$ (or $y_s^{″}\ne y_s$), $A_I$ must provide the value $t_s^{″}$ (or $y_s^{″}$), after which $C_3$ executes the signcrypt algorithm to produce a signcryption $\sigma$.

  2.

  If $PI{D}_s\notin L_{RS}$ and $PI{D}_s\ne PI{D}_s^{\prime }$, $C_3$ runs the signcrypt step to produce a signcryption $\sigma$.

  3.

  If $PI{D}_s\notin L_{RS}$ and $PI{D}_s=I{D}_s^{\prime }$, the simulation aborts.

• USC-Query($\sigma ,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): Once $S{K}_d$ has been obtained using the PPK-Extract and SV-Set algorithms, $C_3$ uses the unsigncrypt procedure to either reject the tuple or produce a message m.

Forgery. Finally, $A_I$ generates a tuple ${\sigma }^{*},PI{D}_s^{*},P{K}_s^{*},I{D}_d^{*},$ and $P{K}_d^{*}$ and succeeds in winning Game 3.

Solve the CAA problem. If $PI{D}_s^{*}\ne PI{D}_s^{\prime }$, $C_3$ aborts. Otherwise, if $PI{D}_s^{*}=PI{D}_s^{\prime }$, $P{K}_s^{*}=P{K}_s^{\prime }=(t_s^{\prime }P,aP)$. As ${\sigma }^{*}$ is a valid signcryption, so $W^{*}={\displaystyle \frac{1}{x_s^{*}+h^{*}{t}_s^{*}}}P$. $C_3$ performs the following to solve the CAA problem:

1.

Searches for tuple $(I{D}_d^{*},T_d^{*},t_d^{*},Y_d^{*},$ and $y_d^{*})$ in $L_{UD}$.

2.

Establishes $P{K}_d^{*}=(t_d^{*}P,y_d^{*}P)$.

3.

Calculates $k_d^{*}=H2(I{D}_d^{*},Y_d^{*}),$ and $x_d^{*}=y_d^{*}+d_s^{*}\lambda$.

4.

Looks up $(PI{D}_s^{\prime },t_s^{\prime }P,t_s^{\prime },aP,\perp )$ in $L_{US}$.

5.

Establishes $P{K}_s^{*}=P{K}_s^{\prime }=(t_s^{\prime }P,aP)$.

6.

Calculates $k_s^{*}=H2(PI{D}_s^{\prime },aP)$.

7.

Calculates $g^{*}=H3(F^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})$.

8.

Establishes ${\mathrm{\Lambda }}^{*}=\widehat{e}{(F^{*},T_s^{*})}^{x_d^{*}+g^{*}{t}_d^{*}}$.

9.

Calculates $m^{*}=H_5(F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})\oplus {\alpha }^{*}$

10.

Calculates $h^{*}=H_4(m_{\mu },F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*},P_{pub})$.

11.

Establishes $c=k_s^{*}\lambda +h^{*}{t}_s^{*}$ (where $t_s^{*}=t_s^{\prime }$).

12.

Produces $(c,W^{*})$, as follows:

$(c,W^{*})=(c,{\displaystyle \frac{1}{x_s^{*}+h^{*}{t}_s^{*}}}P)=(c,{\displaystyle \frac{1}{a+k_s^{*}\lambda +h^{*}{t}_s^{\prime }}}P)=(c,{\displaystyle \frac{1}{a+c}}P)$.

Hence $(c,W^{*})$ is a respondent of the CAA problem.

The subsequent step is to figure out the likelihood that $C_3$ will win. The game will be won by $C_3$ if all three of the following criteria are satisfied:

• $E_1$: $C_3$ does not finish the game in $A_I$ queries from the PPK-Query() and does not replace the value $aP$.
• $E_2$: $A_I$ does not fail in SC-Query().
• $E_3$: In the challenge stage, $A_I$ selects $PI{D}_{s^{*}}=PI{D}_{s^{\prime }}$.

If $Y_S$ has been changed, $A_I$ is unable to run PPK-Query($PI{D}_s$) so $L_{RS}\cap L_{KS}=$ is a justified setting.

Let $q_{US}$, $q_{RS}$, $q_{KS}$, and $q_{SC}$ denote the numbers of queries issued by the adversary $A_I$ to the UPK, Replace, PPK and SC oracles, respectively. It follows that

$$Pr[E_2\mid E_1]\ge {\left(1-{\displaystyle \frac{1}{q_{US}}}\right)}^{q_{SC}}\ge e^{-q_{SC}/q_{US}}.$$

Furthermore, the probability of event $E_1$ occurring satisfies

$$Pr\left[E_1\right]\ge {\displaystyle \frac{q_{US}-q_{RS}-q_{KS}}{q_{US}}}.$$

In addition, if the forgery phase results in $PI{D}_{s^{*}}=PI{D}_{s^{\prime }}$, then the conditional probability of event $E_3$ given $E_1$ and $E_2$ is

$$Pr[E_3\mid E_1,E_2]\ge {\displaystyle \frac{1}{q_{US}-q_{RS}-q_{KS}}}.$$

Hence, the success probability of challenger $C_3$ in this game can be expressed as

$$ϵPr\left[E_1{E}_2{E}_3\right]=Pr\left[E_1\right]Pr[E_2\mid E_1]Pr[E_3\mid E_1,E_2]\ge ϵ·{\displaystyle \frac{1}{q_{US}}}{e}^{-q_{SC}/q_{US}}.$$

□

Lemma 4. 

Let $A_{II}$ be a super Type II adversary that succeeds in Game 4 and breaks the EUF-CMA security of our enhanced CL-SC scheme with at least ϵ probability. In this scenario, we can construct a simulator $C_4$ that solves a given CAA problem with non-negligible advantage $ϵ·{\displaystyle \frac{1}{q_{US}}}{e}^{-q_{SC}/q_{US}}$, where $q_{US}$, $q_{VS}$, and $q_{SC}$ denote the numbers of queries made to the UPK, SV and SC oracles, respectively.

Proof. 

Let $A_{II}$ be a PPT super Type II opponent in Game 4 that, with probability $ϵ$, violates the unforgeability of our CL-SC system. We construct an algorithm $C_4$ that defines $A_{II}$ as a subroutine with the aim to resolve the CAA. With the exception of assuming that $C_4$ is given a CAA instance $(P,aP)$ and tries to utilize $A_{II}$ to compute $(c,{\displaystyle \frac{c}{a+c}})$, our assumptions are identical to Lemma 2.

Initialization. Following the random selection of $PI{D}_s^{\prime }$ as the target ID, $C_4$ chooses $\lambda \in {\mathbb{Z}}_q^{*}$, sets the public parameters, sets $P_{pub}=\lambda P$, and transmits $P_{pub}$ and $\lambda$ to $A_{II}$.

Queries. A polynomial number of queries can be sent to $C_4$ by $A_{II}$.

• PID-Query($I{D}_s$): This is the same as in Lemma 1.
• UPK-Query($PI{D}_s$): $C_4$ keeps a record of $(PI{D}_s,T_s,t_s,Y_s,$ and $y_s)$ in $L_{SD}$ and performs the subsequent actions:

  1.

  On the $PI{D}_{s^{\prime }}$ query, $C_4$ selects $y_s^{\prime }\in {\mathbb{Z}}_q^{*}$ by random, assigns $PI{D}_s=PI{D}_s^{\prime }$ and $P{K}_s=P{K}^{\prime }=(aP,y_s^{\prime }P)$, and subsequently includes $(PI{D}_s^{\prime },aP,t_s^{\prime }=\perp ,y_s^{\prime }P,y_s^{\prime }=\perp )$ in $L_{SD}$.

  2.

  Otherwise, $C_4$ selects $t_s,y_s\in {\mathbb{Z}}_q^{*}$, establishes $P{K}_s=(t_{d}s,y_{d}P)$, and subsequently includes $(PI{D}_s,T_s,t_s,Y_s,y_s)$ in $L_{SD}$.

• UPK-Query($I{D}_d$): This is the same as in Lemma 3.
• PPK-Query($PI{D}_s$): This is the same as in Lemma 1.
• PPK-Query($I{D}_d$): This is the same as in Lemma 3.
• SV-Query($PI{D}_s$): This is the same to Lemma 3.
• SV-Query($I{D}_d$): This is the same as in Lemma 3.
• SC-Query($m,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): This is similar to Lemma 3.
• USC-Query($\sigma ,I{D}_d,P{K}_d,PI{D}_s,P{K}_s$): This is the same as that in Lemma 3.

Forgery. Ultimately, $A_{II}$ wins Game 4 by producing $({\sigma }^{*},PI{D}_s^{*},P{K}_s^{*},I{D}_d^{*},$ and $P{K}_d^{*})$.

Solve the CAA problem. If $PI{D}_s^{*}\ne PI{D}_s^{\prime }$, then $C_4$ is not successful. If not, $PI{D}_s^{*}=PI{D}_s^{\prime }$, and so $P{K}_s^{*}=P{K}_s^{\prime }=(aP,y_s^{\prime }P)$. Given that ${\sigma }^{*}$ is a valid signcryption, $W^{*}={\displaystyle \frac{1}{x_s^{*}+h^{*}{t}_s^{*}}}P$. $C_4$ solves the CAA problem via the following steps:

1.

Searches for the tuple $(I{D}_d^{*},T_d^{*},t_d^{*},Y_d^{*},$ and $y_d^{*})$ in the table $L_{UD}$.

2.

Establishes $P{K}_d^{*}=(t_d^{*}P,y_d^{*}P)$.

3.

Calculates $k_d^{*}=H2(I{D}_d^{*},Y_d^{*}),x_d^{*}=y_d^{*}+d_s^{*}\lambda$.

4.

Finds $(PI{D}_s^{\prime },ap,\perp ,y_s^{\prime }P,y_s^{\prime })$ in the table $L_{US}$.

5.

Establishes $P{K}_s^{*}=P{K}_s^{\prime }=(aP,y_s^{\prime }P)$.

6.

Calculates $k_s^{*}=H2(PI{D}_s^{\prime },y_s^{\prime }P)$.

7.

Calculates $g^{*}=H3(F^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})$.

8.

Establishes ${\mathrm{\Lambda }}^{*}=\widehat{e}{(F^{*},T_s^{*})}^{x_d^{*}+g^{*}{t}_d^{*}}$.

9.

Calculates $m^{*}=H_5(F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*})\oplus {\alpha }^{*}$

10.

Calculates $h^{*}=H_4(m_{\mu },F^{*},{\mathrm{\Lambda }}^{*},I{D}_d^{*},P{K}_d^{*},PI{D}_s^{*},P{K}_s^{*},P_{pub})$.

11.

Establishes $c={h^{*}}^{-1}(y_s^{*}+\left(k_s^{*}\lambda \right))$ (where $y_s^{*}=y_s^{\prime }$).

12.

Produces $(c,h^{*}{W}^{*})$.

$(c,h^{*}{W}^{*})=(c,{\displaystyle \frac{h^{*}}{x_s^{*}+h^{*}{t}_s^{*}}}P)=(c,{\displaystyle \frac{h^{*}}{y_s^{*}+(k_s^{*}\lambda +h^{*}a)}}P)=(c,{\displaystyle \frac{1}{{h^{*}}^{-1}(k_s^{*}\lambda +y_s^{*})+a}}P)=(c,{\displaystyle \frac{1}{a+c}}P)$

Therefore, $(c,h^{*}{W}^{*})$ is the solution of the CAA problem.

The subsequent step is to figure out the likelihood that $C_4$ will win. The game will be won by $C_4$ if all three of the following criteria are satisfied:

• $E_1$: $C_4$ does not finish the game in $A_{II}$ queries from the SV-Query() and does not replace the value $aP$.
• $E_2$: $A_{I}I$ does not fail in SC-Query().
• $E_3$: In the challenge stage, $A_{II}$ selects $PI{D}_{s^{*}}=PI{D}_{s^{\prime }}$.

Suppose that $q_{US}$, $q_{VS}$, and $q_{SC}$ denote the numbers of queries issued by $A_{II}$ to the UPK, SV and SC oracles, respectively. It follows that

$$Pr[E_2\mid E_1]\ge {\left(1-{\displaystyle \frac{1}{q_{US}}}\right)}^{q_{SC}}\ge e^{-q_{SC}/q_{US}}.$$

Moreover, the probability of event $E_1$ satisfies

$$Pr\left[E_1\right]\ge {\displaystyle \frac{q_{US}-q_{VS}}{q_{US}}}.$$

Additionally, if in the forgery stage we have $PI{D}_{s^{*}}=PI{D}_{s^{\prime }}$, then the probability of event $E_3$ conditioned on $E_1$ and $E_2$ is

$$Pr[E_3\mid E_1,E_2]\ge {\displaystyle \frac{1}{q_{US}-q_{VS}}}.$$

Therefore, the advantage of challenger $C_4$ in this game is given by

$$ϵPr\left[E_1{E}_2{E}_3\right]=Pr\left[E_1\right]Pr[E_2\mid E_1]Pr[E_3\mid E_1,E_2]\ge ϵ{\displaystyle \frac{1}{q_{US}}}{e}^{-q_{SC}/q_{US}}.$$

□

7. Efficiency and Comparison

Verma et al. [38] evaluated devices with constrained computational and energy resources, e.g., wireless sensors and smart meters, by measuring the execution time of fundamental cryptographic operations on a single 798 MHz CPU with 256 MB of RAM. The reported results, summarized in

Table 2. Execution times of cryptographic operations [38].

$O_P$	Bilinear Pairing	67.32 ms
$O_S$	Scalar Multiplication in $G_1$	14.83 ms
$O_E$	Exponentiation in $G_2$	7.87 ms

, serve as the basis for our analysis. To maintain consistency throughout comparisons, we assume that the hash function generates a 160-bit output (e.g., SHA-1), i.e.,

$$\eta =160\mathrm{bit},$$

and that the identity information is represented using a 60-bit string, i.e.,

$$\delta =60\mathrm{bit}.$$

We then performed a detailed comparison of the computational and communication costs of six CL-SC schemes with security proof in the standard model. A standard methodology was employed to ensure the reproducibility of the computational cost estimation. In our proposed CL-SC construction, the signcryption algorithm requires five scalar multiplications in the source group (denoted by $O_S$) and one pairing operation (denoted by $O_P$). Therefore, the computational cost of signcryption is

$$5O_S+O_P=141.47\mathrm{ms}.$$

The unsigncryption phase involves two scalar multiplications, one exponentiation (denoted by $O_E$) and two pairing operations, resulting in a total unsigncryption cost of

$$2O_S+O_E+2O_P=172.17\mathrm{ms}.$$

Accordingly, the total computational cost of our proposed scheme becomes

$$7O_S+O_E+3O_P=313.64\mathrm{ms}.$$

The computational costs of our scheme in comparison with existing CL-SC constructions are illustrated in Figure 4 and shown in

Table 3. Comparing the computational costs of CL-SC schemes.

Scheme	Signcryption	Unsigncryption	Overall Costs
Luo et al. [10]	$4O_S+O_P=126.64$ ms	$2O_S+6O_P=433.58$ ms	$6O_S+7O_P=560.22$ ms
Rastegari et al. [11]	$4O_S+2O_P=193.96$ ms	$2O_S+8O_P=568.22$ ms	$6O_S+10O_P=762.18$ ms
Zhou et al. [39]	$5O_S+3O_E+5O_P=434.36$ ms	$O_S+O_E+8O_P=561.26$ ms	$6O_S+4O_E+13O_P=995.62$ ms
Zhou et al. [40]	$3O_S+4O_E+4O_P=345.25$ ms	$3O_S+2O_E+4O_P=329.51$ ms	$6O_S+6O_E+8O_P=674.74$ ms
Deng et al. [20]	$6O_S+O_P=156.3$ ms	$2O_S+O_E+2O_P=172.17$ ms	$8O_S+O_E+3O_P=328.47$ ms
Ours	$5O_S+O_P=141.47$ ms	$2O_S+O_E+2O_P=172.17$ ms	$7O_S+O_E+3O_P=313.64$ ms

.

In these evaluations, the computational costs are explicitly calculated based on the number of bilinear pairing operations, scalar multiplications in $G_1$, and exponentiations in $G_2$. The results show that, due to requiring fewer expensive cryptographic operations, the proposed CL-SC scheme achieves a significantly lower overall overhead compared to existing schemes.

Furthermore, the public parameters $params$ in our scheme contain three elements from $G_1$ and one from $G_2$, resulting in a total size of

$$(4\times 256)=1024\mathrm{bits}=128\mathrm{bytes}.$$

The ciphertext includes three elements from $G_1$ and one hash value, giving a total length of

$$(3\times 256+160)=928\mathrm{bits}=116\mathrm{bytes}.$$

The comparison of the communication costs of our proposed scheme with the schemes in [10,11,20,39,40] is presented in

Table 4. Comparing the communication costs of CL-SC schemes.

Scheme	Size of Params	Size of Signcryption
Luo et al. [10]	$(\delta +\eta +4)|G_1|=7168$ bytes	$2|G_1|+|G_2|=96$ bytes
Rastegari et al. [11]	$(\delta +4)|G_1|+|G_2|=2080$ bytes	$4|G_1|+|G_2|=160$ bytes
Zhou et al. [39]	$(\delta +5)|G_1|=2080$ bytes	$4|G_1|+2|G_2|=192$ bytes
Zhou et al. [40]	$3|G_1|=96$ bytes	$3|G_1|+3|G_2|=192$ bytes
Deng et al. [20]	$3|G_1|+|G_2|=128$ bytes	$3|G_1|+\eta =116$ bytes
Ours	$3|G_1|+|G_2|=128$ bytes	$3|G_1|+\eta =116$ bytes

and illustrated in Figure 5.

8. Conclusions

In this paper, we conduct a thorough examination of the CL-SC protocol for HWSNs proposed by Deng et al. Although the authors claim that their scheme satisfies confidentiality (IND-CCA2) and unforgeability (EUF-CMA) in the standard model, our analysis demonstrates that the construction does not withstand several well-established cryptographic attack vectors. In particular, we present a concrete attack strategy that highlights fundamental structural weaknesses in their design and shows that the scheme is far from achieving the level of security originally attributed to it. Motivated by these shortcomings, we present a new certificateless signcryption scheme grounded in elliptic curve cryptography (ECC). The proposed construction is rigorously proven to be secure against both types of super adversaries, i.e., a key replacement attacker $A_I$ and a malicious KGC attacker $A_{II}$, adhering to the enhanced adversarial framework for certificateless systems. Specifically, we show that the scheme achieves IND-CCA2 confidentiality based on the hardness assumption of ECDDHP and ensures EUF-CMA unforgeability based on the Computation Attack Algorithm (CAA). Beyond its provable security guarantees, our scheme offers notable computational efficiency, rendering it an attractive and practical solution for resource-constrained environments such as HWSNs. This combination of strong theoretical security and operational effectiveness underscores the suitability of our approach for secure communication in healthcare sensor networks. Future research could explore extending the proposed signcryption scheme into a full protocol by incorporating anti-replay mechanisms such as timestamps. Additionally, comprehensive simulations and statistical testing would be valuable to evaluate the system’s robustness against real-world attacks in practical HWSN environments.