Anonymous Certificateless Multi-Receiver Signcryption Scheme Without Secure Channel

The certificateless multi-receiver signcryption scheme provides the sender with the ability to send the same message to multiple authorized receivers contemporaneously, and at the same time, it can avoid the key escrow problem in the existing identity-based multi-receiver signcryption schemes, which makes it to get great attention in the field of one-to-many communication.However, in the existing certificateless multi-receiver signcryption schemes, a secure channel is essential for their key extract algorithm, which brings some troubles in practical applications.On one hand, the security of the partial private key depends on the secure channel.Once the secure channel is broken by an attacker, the user's partial private key may be leaked.On the other hand, maintaining the secure channel increases the economic cost and implementation complexity of the application systems.Motivated by these concerns, we propose a new anonymous certificateless multi-receiver signcryption scheme, in which the key generation center only utilizes a public channel to send the pseudo partial private key to the user during the key extract algorithm, and the designated user can work out the real partial private key from the pseudo partial private key while others cannot.The avoidance of the secure channel improves the security of the proposed scheme and makes the communication system much lighter.INDEX TERMS Cryptography, certificateless public key cryptography, multi-receiver signcryption, one-tomany communication, key escrow problem, receiver anonymity.were proposed.Combining the idea of signcryption [12], Duan and Cao [3] proposed the first identity-based multireceiver signcryption (IBMS) scheme and gave the unforgeability security model in their paper.Then, some IBMS schemes [13]-[16] were put forward one by one.In recent years, privacy leakage incidents occur frequently [17], and people's awareness of privacy protection has gradually increased.People do not want it to be known by others which websites they visited or which TV programs they watched [18].With the emphasis on privacy protection, receiver anonymity was introduced into the IBME/IBMS scheme.Many researchers tried to achieve receiver anonymity in multi-receiver encryption/signcryption schemes by using different methods.Fan et al.[19] put forward the first anonymous IBME scheme, attempting to hide the information of authorized receivers in a Lagrange interpolating polynomial to avoid the disclosure of receivers.Unfortunately, Wang et al. [20] demonstrated that this approach cannot truly achieve receiver anonymity because any authorized receiver can judge whether another person is an authorized receiver.Meanwhile, Wang et al. [20] proposed an improved IBME scheme to ameliorate receiver anonymity.Regrettably, Li and Pang [21] proved that in Wang et al.'s scheme, authorized receivers were still able to determine the identities of other authorized receivers.Later, Tseng et al. [22] proposed an anonymous IBME scheme, which uses a modular polynomial to mix and hide the information of authorized receivers, and they re-defined the adversarial model of receiver anonymity under multi-receiver setting because the previous receiver anonymity security model is suitable for single receiver setting.Inspired by this method, Fan and Tseng [23] proposed another anonymous IBME scheme with chosen ciphertext attack (CCA) security.Their scheme provides authentication function for the receivers, but it uses too many bilinear parings operations, resulting in its low efficiency.In 2016, to perfect privacy protection mechanism, Pang et al. [24] proposed a completely anonymous IBMS scheme, which offers both receiver anonymity and sender anonymity.However, all the schemes mentioned above have the key escrow problem, because they are designed based on the identity-based cryptosystem (IBC) [25].That is to say, in these schemes, the key generation center (KGC) holds the private keys of all users, so it could peek at all users' communication information and could disguise himself as any user to sign a message.To solve the key escrow problem, Al-Riyami and Paterson [26] proposed the certificateless public key cryptography (CL-PKC), which attracts the attention of many scholars and institutions rapidly, and based on Al-Riyami et al.'s thought, many certificateless encryption/signcryption schemes [27]-[30] were proposed successively.Selvi et al. [31] proposed the first certificateless multi-receiver signcryption (CLMS) scheme, and defined the message confidentiality security model and unforgeability security model of the CLMS scheme.However, Selvi et al.'s scheme does not satisfy the message