## 2 Preliminaries
### Zss Signcryption  
Reference [22] proposed a signcryption scheme, as depicted in Algorithm 1, which incorporated an improved version of a signature algorithm by [PERSON], [PERSON], and [PERSON] (ZSS). In prior signcryption work by [23], the user forwarded the original message \(m\) to a trusted third party (TTP). By doing so, user data might have leaked to the TTP and were no longer private. In the ZSS signature generation, the author included a random value \(r\). The user also needed to pass the \(r\) value to the TTP, which allowed the TTP to compute a symmetric encryption key, \(k\), by using \(H_{3}(r)\), making it dangerous. Different from [23], the author suggests that in the process of verifying a message, the original message itself does not need to be sent to the verifier. This ensures that the message remains private and improves the efficiency of the verification process, as the verifier does not have to download the message beforehand.  
```
\(Signcryption\): When a user acts as the sender \(S\), they generate a signcryption \(\sigma\) for the message \(m\), as follows: 1. Generate \(v=(Hash_{1}(m)+SK_{S})^{-1}\). 2. Choose \(r\leftarrow^{R}\{0,1\}^{d}\) and generate \(V=vP\), \(X=r\oplus Hash_{2}(V,PK_{R},vPK_{R})\). Then, generate \(k=Hash_{3}(r)\), which is a symmetric encryption key. So, \(Y=Enc_{k}(m)\). 3. Therefore, the signcryption \(\sigma=(V,X,Y)\), where \(V\) is a ZSS signature of message \(m\), \(X\) is the randomness of the encryption key generation, and \(Y\) is the encryption of the message \(m\). \(Unsigncryption\): After receiving \(\sigma\) = (V, X, Y) from the sender S, the recipient R starts the unsigncryption process. 1. \(R\) parses \(\sigma\) to obtain \((V,X,Y)\). 2. Compute \(r=X\oplus Hash_{2}(V,PK_{R},VSK_{R})\) and \(k=Hash_{3}(r)\). 3. Decrypt \(Y\) to obtain message \(m\). So, \(m=Dec_{k}(Y)\). 4. If Equation (1) holds, unsigncryption succeeds; otherwise, \(R\) rejects \(\sigma\) from the sender. \[e(Hash_{1}(m)P+PK_{S},V)=e(P,P)\] (1)
```  
**Algorithm 1** Modified ZSS signcryption by [22]  
_Signcryption_: When a user acts as the sender \(S\), they generate a signcryption \(\sigma\) for the message \(m\), as follows: 1. Generate \(v=(Hash_{1}(m)+SK_{S})^{-1}\). 2. Choose \(r\leftarrow^{R}\{0,1\}^{d}\) and generate \(V=vP\), \(X=r\oplus Hash_{2}(V,PK_{R},vPK_{R})\). Then, generate \(k=Hash_{3}(r)\), which is a symmetric encryption key. So, \(Y=Enc_{k}(m)\). 3. Therefore, the signcryption \(\sigma=(V,X,Y)\), where \(V\) is a ZSS signature of message \(m\), \(X\) is the randomness of the encryption key generation, and \(Y\) is the encryption of the message \(m\). \(Unsigncryption\): After receiving \(\sigma\) = (V, X, Y) from the sender S, the recipient R starts the unsigncryption process. 1. \(R\) parses \(\sigma\) to obtain \((V,X,Y)\). 2. Compute \(r=X\oplus Hash_{2}(V,PK_{R},VSK_{R})\) and \(k=Hash_{3}(r)\). 3. Decrypt \(Y\) to obtain message \(m\). So, \(m=Dec_{k}(Y)\). 4. If Equation (1) holds, unsigncryption succeeds; otherwise, \(R\) rejects \(\sigma\) from the sender. \[e(Hash_{1}(m)P+PK_{S},V)=e(P,P)\] (1)  
* **ParamGen.** Given the security parameters \(b\) and \(d\), let \(G_{1}\) be a cyclic additive group and \(G_{2}\) be a multiplicative cyclic group with the prime order \(p\); \(P\) is the generator of group \(G_{1}\). The bilinear mapping \(e\): \(G_{1}\times G_{2}\to G_{2}\), three hash functions \(Hash_{1}\): \(\{0,1\}^{*}\to Z_{p},Hash_{2}\): \(G_{1}^{3}\rightarrow\{0,1\}^{d}\), \(Hash_{3}\): \(\{0,1\}^{d}\rightarrow\{0,1\}^{b}\), and a symmetric encryption scheme \((Enc,Dec)\) are utilized. Therefore, the system parameters are \(\{b,d,G_{1},G_{2},P,e,Hash_{1},Hash_{2},Hash_{3},Enc,Dec\}\).
* **KeyGen.** The sender chooses a random number from \(Z_{p}\), sets it as the secret key \(SK_{S}\), and computes the public key \(PK_{S}=SK_{S}P\). The recipient chooses a random number from \(Z_{p}\), sets it as the secret key \(SK_{R}\), and computes the public key \(PK_{R}=SK_{R}P\).