Pairing free identity based aggregate signcryption scheme

IET Information SecurityVolume 14, Issue 6 p. 625-632 Research ArticleFree Access Pairing free identity based aggregate signcryption scheme Eman Abouelkheir, Corresponding Author Eman Abouelkheir emanabouelkhair@eng.kfs.edu.eg Department of Electrical Engineering, College of Engineering Kafrelsheikh University, Kafrelsheikh, 33516 Egypt Department of Computer Science, College of Sciences and Arts, Qassim University, AlRass, 51452 Saudi ArabiaSearch for more papers by this authorShamia El-sherbiny, Shamia El-sherbiny Department of Electrical Engineering, College of Engineering Kafrelsheikh University, Kafrelsheikh, 33516 EgyptSearch for more papers by this author Eman Abouelkheir, Corresponding Author Eman Abouelkheir emanabouelkhair@eng.kfs.edu.eg Department of Electrical Engineering, College of Engineering Kafrelsheikh University, Kafrelsheikh, 33516 Egypt Department of Computer Science, College of Sciences and Arts, Qassim University, AlRass, 51452 Saudi ArabiaSearch for more papers by this authorShamia El-sherbiny, Shamia El-sherbiny Department of Electrical Engineering, College of Engineering Kafrelsheikh University, Kafrelsheikh, 33516 EgyptSearch for more papers by this author First published: 01 November 2020 https://doi.org/10.1049/iet-ifs.2019.0579Citations: 6AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract The idea of aggregate signcryption was first proposed by Selvi. The aggregation process reduces the communication overhead and hence, it is efficient in low-bandwidth communication networks such as wireless sensor networks and vehicular ad-hoc network VANET. The goal of this study is to propose a secure provably identity based aggregate signcryption scheme ID-ASC without pairings over the elliptic curve cryptography. The proposed scheme is provable secure against confidentiality and unforgeability under random oracle model. Moreover, the proposed ID-ASC reduced the computational complexity when compared to other schemes in literature. 1 Introduction Confidentiality and authenticity are two fundamental security requirements of Public Key Cryptography. These two requirements are achieved by encryption scheme and digital signatures, respectively. Signcryption scheme is a cryptographic primitive that performs signature and encryption simultaneously in a single logical step [1 ]. An aggregate signature scheme is a digital signature scheme which was first proposed by Boneh and others [2 ]. Aggregate signature allows aggregation of different signatures by n different users on different messages . The primary objective of an aggregate signature scheme is to achieve both computation and communication efficiency. In aggregate signature, multiple signatures from various users are combined into a single compact signature. Aggregation can be used to reduce the usage of certificate chains in public key infrastructure settings. The aggregate signature has many applications such as traffic control, signing documents for official purpose, bank and business scenarios, message authentication between vehicles in VANET and so on. Signcryption comes into the picture to introduce hiding a message so that only the receiver will be able to get back the message. An aggregate signcryption scheme can be constructed of the individual signcryption aggregation. The aggregation is done taking n distinct signcryptions on n messages signed by n distinct users. Aggregate signcryption can effectively solve the user privacy security issues in VANET. In certain scenario, using the concept of aggregation in VANET, the session key for the message communication between vehicles could be exchanged effectively in secure manner. Pairing-based cryptography has many prime properties. It is supposed that pairing-based cryptography can present a desired security level with smaller parameters as the general elliptic curve cryptography. Suppose that an elliptic curve E is defined over the field . Then the elliptic curve cryptography is working with elements which are defined over . But the pairing-based cryptography is working with the functions and elements defined over , where k is some security parameter. The security of the pairing-based cryptography depends directly on the intractable level of either elliptic curve discrete log problem (ECDLP) in the group or discrete log problem in the group . Due to the previous clarification, this paper proposes a new pairing free identity based aggregate signcryption scheme based on the general elliptic curve cryptography [3 ]. The rest of this paper is organised as follows. In Section 2, related works are summarised. Section 3 introduces preliminary material. The formal definition of the generic model of ID-ASC schemes is presented in Section 4, and it describes the security notation of the proposed ID-ASC scheme. In Section 5, the proposed ID-ASC is presented. The security analysis is discussed in Section 6. The comparative study and communication over head of the proposed scheme are carried out in Sections 7 and 8. Finally, conclusions are provided in Section 9. 2 Related works The concept of public key signcryption was proposed by Zheng [4 ]. The idea of this kind of cryptographic primitive is to perform encryption and signature in a single logical step to obtain confidentiality, integrity, authentication and non-repudiation more efficiently than the sign-then-encrypt approach. Identity-based cryptosystems were first introduced by Shamir in 1984 [5 ]. Identity-based cryptosystems eliminate trust problems encountered in certificate-based public key infrastructures. There is no need to link a public key to its owner's identity since they function as a singular element. Malone-Lee [6 ] developed the first identity-based signcryption scheme. Selvi and others [7 ] proposed an identity based threshold signcryption scheme and formally proved its security in the existing security model. Muniz and Laud [8 ] proposed the first strong forward-secure identity-based signcryption scheme. Gentry and Ramzan [9 ] proposed an efficient identity-based aggregate signature scheme. This scheme achieves both full aggregation and also a constant number of pairing operations during signature verification. Selvi and others [10, 11 ] analysed the security in some of the existing aggregate signature schemes [12, 13 ] and proposed two identity-based aggregate signature schemes. However, Selvi and others [11 ] presented the security model for unforgeability without introducing the security proof. The scheme proposed in [11 ] cannot be considered an identity based system because the user's public key in Selvi and others' scheme is not an identity-based public key [14, 15 ]. Eslami and Pakniat [16 ] proposed certificateless aggregate signcryption based on pairing cryptography with formal security proof. Selvi and others [1 ] proposed the first identity-based aggregate signcryption along with a formal security model and a formal security proof. Also, Jayaprakash Kar [17 ] proposed a provably secure bilinear pairings identity-based aggregate signcryption scheme under the random oracle. Karati proposed [18 ] identity-based signcryption scheme for crowdsourced industrial internet of things environments with formal security proof. Lin et al. [19 ] proposed a pairing-free and secure certificateless signcryption scheme. Luo and Ma [20 ] proposed certificateless hybrid signcryption for cloud storage with formal security proof. Signcrytion is a tool that achieves both authentication and encryption in a single logical step. Zeadally [21 ] proposed an identity-based conditional privacy-preserving authentication scheme, the proposed scheme does not use bilinear pairings, the performance analysis of that work showed that the proposed scheme has lower computation and communication costs compared to some previously developed schemes and hence it can be suitable for vehicular ad-hoc networks. Zhang et al. [22 ] proposed privacy-preserving authentication scheme based on Chinese remainder theorem to establish a secure communication in VANETs. Using Chinese remainder theorem improved the transmission efficiency, also, the scheme introduced in that work used finger print instead of using password and real identity for identity verification in addition to using elliptic curve in signature verification. The performance analysis of the scheme introduced in [22 ] had proven its effectiveness in VANETs compared to existing schemes. In this paper, an aggregate signcryption scheme without pairings is proposed. The signcryption in the proposed scheme is a modification of the aggregate signature schemes presented in [18 ]. The proposed aggregate signcryption scheme without pairings is provably secure under the elliptic discrete logarithm problem and the elliptic curve computation Diffie Hellman problem in random oracle. Also, the advantages of identity-based cryptosystems provide an effective way to overcome the key escrow problem. Moreover, the proposed ID-ASC can effectively improve computation and communication efficiency and has been formally proven to satisfy confidentiality and unforgeability in the random oracle model. 3 Preliminaries This section presents the computational assumption that is relevant to the proposed scheme. Table 1 shows the notations used. Also, the elliptic curve discrete logarithm problems are discussed here. Table 1. Description of notation Notation Description P point over elliptic curve is a group generators large prime numbers C challenger A the adversary TypeI adversary in Game I TypeII adversary in Game II Ext extraction oracle user identity Signcrypt signcryption oracle the ciphertext the aggregate signcryption the adversary identity groups of a large prime number with pair of integers N integer number, finite field integer set group message user secrete key user public key S master secrete key public key generator public key cryptographic collision resistant hash functions aggregate 3.1 Elliptic curve computational Diffie-Hellman problem (CDH) Let j and p be prime numbers such that and P be a point over elliptic curve is a group generators of . The CDH problem is given for to compute abP. The advantage of solving the CDH problem of any polynomial time algorithm is defined as The CDH assumption is that, the advantage is negligible for any polynomial time algorithm . 3.2 Elliptic curve discrete logarithm problem Let t and q be prime numbers such that and P be a point over elliptic curve is a group generators of . The ECDLP in is given by the tuple for unknown , to compute a. The advantage of solving the ECDLP of any polynomial time algorithm is defined as The ECDL assumption is that, the advantage is negligible for any polynomial time algorithm . 4 Security notions Security of signcryption depends on two different mechanisms: one is ensuring confidentiality, and the other is authentication. On a high level, confidentiality is defined somewhat related to the privacy of an ordinary encryption, while authentication to that of an ordinary digital signature. The security proof focuses on the indistinguishability of signcryptexts under a chosen ciphertext attack, and existential unforgeability of signcryptexts under a chosen message attack, since they are the strongest. 4.1 Definition 1 [Confidentiality] An identity based signcryption scheme is semantically secure or has indistinguishability against adaptive chosen ciphertext attack is no polynomial bounded adversary has a non-negligible advantage in the following game. This is defined by two types of games: Game I – the game is performed by a challenger C and a TypeI adversary , and Game II – the game is performed by a challenger C and a TypeII adversary . In both games, C and an adversary run the following queries. 4.2 Initial The challenger C runs the setup algorithm with the security parameter k as input and sends the system parameters param to the adversary A and keeps the master private key msk secret. The adversary A performs polynomial bounded number of queries to the oracles provided to A. The description of the queries in the first phase is listed below: 4.2.1 Extraction oracle . A submits an identity to the extraction oracle and receives the private key pairs corresponding to . 4.2.2 Signcryption oracle A submits a message , the signer identity and the receiver identity to the challenger C. C computes private key , for and runs the algorithm to obtain signcryption . Finally C returns to A. 4.2.3 Unsigncryption oracle A submits the receiver identity to C. C generates the private key pair by querying the key extraction oracle. C unsigncrypts using the private key pairs and returns the output to A. If is an invalid signcrypted ciphertext returns a symbol for rejection from to . A can submit adaptively the queries to the oracle. Let messages are chosen by A. Identities and of the sender and receiver on which A would like to be challenged. Two random bits are chosen by the challenger C and computes the aggregate signcryption by running and aggregate algorithm and sends to A. A performs polynomially bounded number of new queries in the first stage, with the restrictions that A cannot query the unsigncryption oracle for the unsigncryption of or the extract oracles for the private keys pairs of . A returns a bit , then wins at the end of the game. The success probability is: , where Adv denotes the advantage for the adversary in the above game. 4.3 Definition 2 [Unforgeability] An identity based aggregate signcryption scheme is said to be existentially secure against adaptively chosen-message attacks if no polynomial bounded adversary has a non-negligible advantage in the following game. This is defined by two types of games: Game I – the game is performed by a challenger C and a type I adversary and Game II – the game is performed by a challenger C and a TypeII adversary . In both games, C and an adversary run the following queries: (i) The challenger C runs the setup algorithm with the security parameter k as input and sends the system parameters param to the adversary A and keeps the master private key msk secret. (ii) A performs polynomial bounded number of queries to the same oracles described in ID_ASC-IND-CCA2 game which are simulated by the challenger C. The queries may be adaptive, i.e. the current query may depend on the previous query responses. The adversary A returns a recipient identity and a ciphertext . A submits a signcryption ciphertext and two identity and , A wins the game if the ciphertext is decrypted as a signed message having , result of the otherwise returns the symbol . Formally, takes a security parameter k, the global parameters param, aggregate signcryption secret key of the receiver and to generate the plaintext and the signature , i.e. A submit a signcryption ciphertext global parameters param, k and identity returns such that . There will be no signcryption oracle decrypts to such that . No extra query was made on . A 's advantage is defined as 4.4 Definition 3 An identity based aggregate signcryption scheme (ID_ASC) is said to be existentially unforgeable against adaptive chosen-ciphertext attacks (AUTH-IDB_ASC-CCA) if no polynomial bounded adversary (PPT) has a non-negligible in the Game I or Game II. 5 Proposed ID-based aggregate signcryption scheme without pairings 5.1 Setup Given security parameter k (usually 160), the PKG chooses of a large prime number p with , is a pair of integers which are smaller than q and satisfy . E is the selected elliptic curve over the finite field . P is the base point or generator of a group of points on E of . Also, O is the point at infinity and n is the order of the point P, with n being a prime number, and . The PKG selects a cryptographic collision resistant hash function The PKG selects a random number as the master key and computes the master public key . The PKG keeps s secret and publishes the system parameters 5.2 Extract This algorithm follows of the following steps: (i) Given an identity , PKG computes and the partial private key . (ii) PKG chooses a random number and computes . (iii) PKG computes , for all users i = 1…n, . (iv) The PKG sends the corresponding secrete key and the public key to the users through a secrete channel. 5.3 Signcryption With input : (i) Chooses a random number and computes: , and (ii) Computes: , , and (iii) Computes: , (iv) Computes The signcryption of on message is 5.4 Aggregate On input a set of signcryption , , and the corresponding identity such that are the signcryption of message by : (i) , , (ii) The aggregate signcryption will be 5.5 Unsigncryption With input the receiver with the identity uses his secrete key to decrypt and verify the aggregate signcryption. The receiver follows the following steps: (i) Uses his secrete key to recover the point as follows: (ii) Computes , then (iii) The receiver knew , and computes , and (iv) Checks if the following equations holds: If the receiver accepts the aggregate signcryption . 5.6 Proof of correctness (1) (2) 6 Security analysis In this section, the proposed scheme is proven to be secure in random oracle model with respect to security properties IND - ID - ASC - CCA2, EUF - ID - ASC - CMA under the both games TypeI adversary and TypeII adversary defined in the above three definitions. The objective of the security proof for Theorem 1 is that the attacker C simulates the games of TypeI and II with the adversary and , respectively. In the random oracle model, the adversary and for IND - ID - ASC - CCA2 able to query all the random oracles; setup, , , , , Signcrypt query, aggregate signcrypt query and Aggregate Unsigncrypt query. C will respond to all queries. Proof.The confidentiality of the proposed scheme will be proved through the following theorems. 6.1 Theorem 1 Suppose that the CDH is intractable. The IDB-ASC scheme above is IND - ID - ASC - CCA2 secure in the random oracle model. This theorem can be proved by the following lemmas: Lemma 1 for the Type I adversary, and Lemma 2 for the Type II adversary. 6.1.1 Lemma 1 Assuming the intractability of CDH problem, the proposed ID-ASC scheme is secure against adversary during Game I under adaptive chosen ciphertext attack in the random oracle model. Proof.We suppose that a Type I adversary AI exists for the proposed scheme. C can solve the CDH problem given . In the following, C simulates a challenger that answer queries made by . Setup phase : C chooses a group G and a generator point P for the group G1. Then, C chooses a random number and calculates . C executes A as a subroutine and proceeds as challenger in the IND - IDB - ASC - CCA2 game. C has all the four hash oracles: , , , , then gives the public . can ask for different queries to C. C responds correspondingly to the various queries by . The various queries are as follows: Ho-query : In the first of the game, C chooses a random number and calculates . C sends the system parameters to . With an input ID, X, C chooses a random q and returns it to In another case, can query for the public component corresponding to an identity ID since might to know the actual X corresponding to an ID. When queries ID as the i th query, C does the following: If , C sets and , x is unknown, X is the part of the elliptic curve discrete logarithm problem that C wants to solve. Then C stores in . If , choose a random , sets , returns to the user such that and stores Extract queries : When queries for private key of C does the following: C checks the to verify whether or not there is an entry for ID. If does not contain an entry for ID, return Otherwise, if the entry corresponding to ID in is of the form and returns , if then C recovers the tuple from and returns where and input ID to query where and compute and then returns d to H1 queries : When is submitted in for the first time C returns checks of whether the tuples in C returns , otherwise C chooses a new random includes the tuple to the and return H2 queries : When is submitted in for the first time C returns checks of whether the tuples in C returns , otherwise C chooses a new random includes to the then C returns tP. H3 queries : When is submitted in for the first time C returns checks of whether the tuples in C returns , otherwise C chooses a new random includes to the then C returns sP. Signcryption oracle : For each new query C proceeds as follows: If , C signcrypts m as follows: If the public key of has been replaced: i Obtains and by calling oracle on ID and , respectively, ii) Chooses a random number and computes: , and , obtained from calling on ID iii) Computes : a by calling on input b by calling on input . c by calling on input iv) Obtains the secrete key d from the Extract query and computes: , v Computes The signcryption of ID on message m is Otherwise, C signcrypts m in the usual manner by using (obtained from the query) and (obtained from Extract query) If and hence (i) Obtains and by calling oracle on ID and , respectively, (ii) Generates two random values and sets (iii) Calls with to obtain and computes (iv) Obtains by calling on input , and computes (v) Defines the hash value , by and updates with (vi) Obtains by calling , and sets , , and (vii) Returns and this is a valid signcryption Aggregate unsigncryption queries : For each new query on , C proceeds as follows: (i) It runs with to obtain and C then executes aggregate verify algorithm and returns if the verification does not succeed. (ii) For (suppose that replaces the public key of ; otherwise, response to this query is more simple). If ; C does the following: a Calls with to obtain and computes b Checks for a tuple . If such a tuple exists. C decrypts it using the hash value h otherwise it replaces the entry in for a random number h and decrypts using this h If (a) Then cannot be calculated. To return a appropriate answer, C goes through and looks for a tuple . If such an entry exists, C decrypts it using the hash value h (b) If C reaches this point of execution, it places the entry for a random value h on the list and decrypts using this h. The symbol denotes an unknown value. Finally, A outputs two messages sets , , and n + 1 identities and . C places a query on Ho with input . If the index of is not, C fails. Otherwise, it proceeds to the public keys and corresponding to . Then, it sets with randomly selected and selects a random bit . C obtains hash values from the and from oracles and sets , where is obtained from oracle, s is obtained from oracle, and is calculated by calling the Extract oracle on . C then computes and . C obtains from Ho query and applies the aggregate algorithm and sends the output to 6.1.2 Lemma 2 The proposed ID-ASC scheme is secure during Game II by using adversary , assuming that the CDH problem is hard in and Proof.We suppose that a Type I adversary exists for the proposed scheme. C can solve the CDH problem given . In the following; C simulates a challenger that answer queries made by . C generates a master key pair and sends , , P, Mpk and msk to . It chooses an index at random, where is the maximum number of queries that could place to . C answers to queries as follows. Ho-query : On the ith non-repeated query ID, chooses uniformly at random and sets , and . If C request new public key and updates the list with and returns X. If , C returns aP and adds to . From this point on, we denote the lth non-repeated identity queried to this oracle with . Extract : On the ith non-repeated query ID, if , if the entry corresponding to in is of the form and returns , if then C recovers the tuple from and returns where and input ID to , where and compute and then returns d to H1-query : On input , C does the following: (i) C checks if for , if so C returns and stops. (ii) C checks of whether the tuples in for some value of if such a tuple exists C returns to , otherwise C chooses a new random includes the tuple to the and return H2-query : When is submitted in for the first time C returns checks of whether the tuples in C returns , otherwise C chooses a new random includes to the then C returns tP. H3-query : When is submitted in for the first time C returns checks of whether the tuples in C returns , otherwise C, chooses a new random includes to the then C returns sP Signcryption oracle : For each entry C does the following steps: • If C obtains the secret value from the extract and signcrypts the message m in the usual way. C Returns the ciphertext to . If C does the following steps: (i) Obtains and by calling oracle on ID and , respectively, (ii) Chooses a random number and computes: , and (iii) Obtains by calling on , and computes (iv) Obtains by calling on , and computes (v) Obtains by calling on , and computes (vi) Computes: , (vii) Computes , and returns Aggregate unsigncryption queries : For each new query on C proceeds as follows: (i) It runs query with to obtain and C then executes AggregateVerify algorithm and returns if the verification does not succeed. (ii) For If ; C unsigncrypts the ciphertext If ; then a C is unable to compute the correct value of R without knowing the receiver secrete key . b To answer the query consistently, C searches L looking for a tuple , if the value of found, C decrypts using c If C reaches this point of execution, it places the entry for a random value h on the and decrypts using this h. 6.2 Theorem 2 The proposed aggregate signcryption scheme is existentially unforgeable against chosen message attack (EUF-ID-ASC-CMA) in the random oracle model under the CDH intractability assumption and presence of a decisional Diffie–Hellman oracle. The theorem can be proved through the following two lemmas: Lemma 3 for a Type I adversary by , and Lemma 4 for a Type II adversary by . 6.2.1 Lemma 3 The proposed ID-ASC is secure during Game I, assuming that the CDH problem intractability assumption holds. Proof.Suppose C an attacker against the CDH problem during Game I. C will respond the queries made by as follows. Setup : C runs the setup algorithm of the proposed scheme and sets . It chooses a random number the challenge identity, where the maximum number of queries that AI could place to Ho oracle. It then sends . Here, is allowed to make queries to four random oracles as in IND-ID-ASC-CCA2 Game I: , Extract query, , , . In addition, also makes queries to Signcrypt oracle and Aggregate Unsigncrypt queries. Forge : returns a set of users with identities , the corresponding public keys , n messages and a forged aggregate ciphertext . It is required that . Given that each index i has the same probability from the adversary's viewpoint, the selection of all identities in the list have the same probability. If this happens, the simulation success. Without loss of generality, we let . In addition, the Aggregate Unsigncrypt algorithm should return true on forged aggregate signcryption ciphertext, namely where , , and . C recovers from Lo, from and from , now C can solve the ECDLP 6.2.2 Lemma 4 The proposed ID-ASC scheme is secure during Game II, assuming that the CDH intractability assumption holds. Proof.Suppose C an attacker against the CDH problem during Game II. C will respond the queries made by as follows. Setup : C runs the setup algorithm of the proposed scheme and sets . It chooses a random number the challenge identity, where the maximum number of queries that AI could request public key oracle. It then sends the , Here, is allowed to make queries to four random oracles as in IND - ID - ASC - CCA2 Game II: , Extract query, , and in addition, also makes queries to Signcrypt oracle and Aggregate Unsigncrypt queries. can make some queries as explained in Game II, and C answers as in Lemma 2, except for the following queries. H1-queries : When is submitted in query for the first time C returns checks of whether the tuples in C returns otherwise C computes includes , to the and sends h to . H3-queries : When is submitted in query for the first time C returns checks of whether the tuples in C returns , otherwise C chooses a new random includes to the and return . Signcryption oracle : For each entry C does the following steps: • If C obtains the secret value from the extract and signcrypts the message m in the usual way. C returns the ciphertext to . If C does the following steps: (i) Obtains and by calling oracle on ID and , respectively, (ii) Chooses two random numbers and sets , and (iii) Obtains by calling on , returned value h. (iv) Defines the hash value , by and s, from and updates with (v) Obtains by calling , and sets , obtained from the Extract oracle and and returns . Aggregate unsigncryption oracle : returns a set of users with identities , the corresponding public keys , n messages and a forged aggregate ciphertext . It is required that . Given that each index i has the same probability from the adversary's viewpoint, the selection of all identities in the list have the same probability. If this happens, the simulation success. Without loss of generality, we let . In addition, the AggregateUnsigncrypt algorithm should return true on forged aggregate signcryption ciphertext, namely where , , , and C recovers from Lo, from L 2 and from L 3, and from now C can solve the EC-CDH problem as 7 Comparative study In this section, the proposed identity based aggregate signcryption scheme without pairings is compared to schemes [17-20, 23 ]. Table 2 shows the symbolic notations for the comparison. The time for all computations is shown with respect to the modular multiplication. Table 3 presents a comparative study from the point of view of computational complexity. The results show that the proposed scheme saves 42% of the computational cost relative to the scheme of Jayaprakash Kar [17 ], 53% from the scheme in [18, 19 ], 41% from the scheme in [20 ] and 82% from the scheme given in [23 ]. Table 2. Cryptographic operations symbolic notations [24 ] Notation Description time complexity for executing the modular multiplication time complexity for executing the elliptic curve scalar point multiplication, time complexity for executing the bilinear pairing operation, time complexity for executing pairing-based exponentiation, time complexity for executing the addition of two elliptic curve points, Table 3. Comparison of computational cost Scheme Signcryption Unsigncryption Total (in Saving time Kar scheme [ 17 ] 2 1 1 – 4 1 - 391 48% Karati scheme [ 18 ] – – 4 – – 2 2 435 53% Lin scheme [ 19 ] – – 5 – – – 5 435 53% Luo scheme [ 20 ] 7 – – – 5 -– – 348 41% Yu scheme [ 23 ] – 2 7 – – 7 1 1131 82% the proposed scheme 3 – – – 4 – – 203 8 Communication over head It means how many bits will be sent with the original message. In this section, we compare the communication over head of our scheme with the schemes introduced in [17-20, 23 ]. Based on [25, 26 ], in which |G 1| ≌ |G 2| ≌ |G | ≌ 1024 bits for bilinear pairing, |P | ≌ 1024 bits for the discrete logarithm problem, |q | ≌ 160 bits for elliptic curve, |n | ≌ 80 bits and |m | = 1024 bits, respectively. The proposed scheme offers the same communication overhead as the scheme in [17 ]. The scheme in [20 ] is less than the proposed scheme in the communication overhead but the proposed scheme saves more computational cost by 41%. The proposed scheme saves 5120−3232 = 1888 bits than the scheme in [19, 20 ]. The proposed scheme saves 6144−3232 = 2912 bits than the scheme in [23 ]. Table 4 introduces a communication over comparison between the proposed scheme and others in literature. Table 4. Comparison of ciphertext size Scheme Ciphertext complexity Bits Jayaprakash Kar scheme [ 17 ] 3232 Karati scheme [ 18 ] |m | + 2|G 1 | + 2|G 2 | + |G | 6144 Lin scheme [ 19 ] |m | + 4|P | 5120 Luo scheme [ 20 ] |m | + 2 | 1344 Yu scheme [ 23 ] |m | + 4|G 1 | + 1|G 2 | 6144 the proposed scheme 3232 9 Conclusion This paper proposes a new identity based aggregate signcryption scheme (ID-ASC) without pairings. The proposed ID-ASC is proven to be secure in random oracles. The security proof focused on the indistinguishability of signcryptexts under chosen ciphertext attack, and existential unforgeability of signcryptexts under chosen message attack. The obtained results from the performance analysis show that the computational complexity of proposed scheme is reduced by 82–42% compared to other schemes. Also, the proposed scheme is efficient in terms of communication overhead. 10. References 1Selvi S.S.D. Vivek S.S. Shriram J. et al.: 'Identity based Aggregate signcryption schemes '. Progress in Cryptology – INDOCRYPT 2009 Lecture Notes in Computer Science, Poland, 2009, pp. 378– 397 2Boneh D. Gentry C. Lynn B. et al.: 'Aggregate and verifiably encrypted signatures from bilinear maps '. Lecture Notes in Computer Science Advances in Cryptology — EUROCRYPT 2003, 2003, pp. 416– 432 3Zhengjun C. Lihua L.: 'On the disadvantages of pairing-based cryptography ', Int. J. Netw. Secur., 2015, 17, (4 ), pp. 454– 462 4Zheng Y.: 'Digital signcryption or how to achieve cost(signature & encryption) ≪ cost(signature) cost(encryption) '. dvances in Cryptology — CRYPTO 97 Lecture Notes in Computer Science, India, 1997, pp. 165– 179 5Shamir A.: 'Identity-based cryptosystem and signature schemes '. CRYPTO'84 Adv. Cryptology LNCS, Proc., USA., 1985, pp. 47– 53 6 Cryptology: 'Identity-Based Signcryption' (ePrint Archive), Santa Barbara, USA., 2002/098 7 Cryptology: 'Provably Secure ID-Based Broadcast Signcryption (IBBSC) Scheme' (ePrint Archive), 2008/225 8 Cryptology: 'Strong Forward Security in Identity Based Signcryption', (ePrint Archive), 2011/156 9Gentry C. Ramzan Z.: 'Identity-based Aggregate signatures '. Public Key Cryptography - PKC 2006 Lecture Notes in Computer Science, USA., 2006, pp. 257– 273 10 Cryptology: 'Security Analysis of Aggregate Signature and Batch Verification Signature Schemes', (ePrint Archive), 2009/290 11 Cryptology: 'Efficient and Provably Secure Identity Based Aggregate Signature Schemes with Partial and Full Aggregation', (ePrint Archive), 2010/461 12Seo S.-H. Hwang J.Y. Choi K.Y. et al.: 'Identity-based universal designated multi-verifiers signature schemes ', Comput. Stand. Interfaces, 2008, 30, (5 ), pp. 288– 295 13Wang Z. Wu Q. Ye D.-F. et al.: 'Practical identity-based aggregate signature from bilinear maps ', J. Shanghai Jiaotong Univ. (Sci.), 2008, 13, (6 ), pp. 684– 687 14Le M.-H. Hwang S.O.: 'Certificate-based signcryption scheme without pairing: directly verifying signcrypted messages using a public key ', ETRI J., 2016, 38, (4 ), pp. 724– 734 15Ren X.-Y.: 'Provably secure Aggregate signcryption scheme ', ETRI J., 2012, 34, (3 ), pp. 421– 428 16Eslami Z. Pakniat N.: 'Certificateless aggregate signcryption: security model and a concrete construction secure in the random oracle model ', J. King Saud Univ. – Comput. Inf. Sci., 2014, 26, (3 ), pp. 276– 286 17Kar J.: 'Provably secure identity-based Aggregate signcryption scheme in random oracles ', Int. J. Netw. Secur., 2015, 17, (5 ), pp. 580– 587 18Karati A. Islam S.H. Biswas G.P. et al.: 'Provably secure identity-based signcryption scheme for crowdsourced industrial internet of things environments ', IEEE Internet Things J., 2018, 5, (4 ), pp. 2904– 2914 19Lin X.-J. Sun L. Qu H. et al.: 'Cryptanalysis of A pairing-free certificateless signcryption scheme ', Comput. J., 2017, 61, (4 ), pp. 539– 544 20Luo W. Ma W.: 'Secure and efficient data sharing scheme based on certificateless hybrid signcryption for cloud storage ', Electronics. (Basel), 2019, 8, (5 ), p. 590 21He D. Zeadally S. Xu B. et al.: 'An efficient identity-based conditional privacy-preserving authentication scheme for vehicular Ad hoc networks ', IEEE Trans. Inf. Forensics Sec., 2015, 10, (12 ), pp. 2681– 2691 22Zhang J. Cui J. Zhong H. et al.: 'PA-CRT: Chinese remainder theorem based conditional privacy-preserving authentication scheme in vehicular Ad-hoc networks ', IEEE Trans. Dependable Secur. Comput., 2019, 14, pp. 1– 1 23Yu H. Yang B.: 'Pairing-free and secure certificateless signcryption scheme ', Comput. J., 2017, 60, (8 ), pp. 1187– 1196 24Islam S.H. Biswas G.: 'An efficient and secure strong designated verifier signature scheme without bilinear pairings ', J. Appl. Math. Inf., 2013, 31, (3_4 ), pp. 425– 441 25Ullah I. Amin N.U. Khan J. et al.: 'A novel provable secured signcryption scheme PSSS: A hyper-elliptic curve-based approach ', Mathematics, 2020, 8, (3 ), p. 370 26Yu S. Lee J. Lee K. et al.: 'Secure authentication protocol for wireless sensor networks in vehicular communications ', Sensors, 2018, 18, (10 ), p. 3191 Citing Literature Volume14, Issue6November 2020Pages 625-632 ReferencesRelatedInformation