# Cloud Storage Data Verification Using Signcryption Scheme
## 4 Discussion and Security Analysis
### Computational Cost  
To analyze our scheme performance, we present the computational cost comparison of our scheme with four other signcryption schemes in Table 3. We will discuss several aspects: signature type, computational cost, signature size, and time complexity. First, signature type. There are differences in the digital signature used in each scheme. Our scheme and [14] are using ZSS signature scheme. This signature is more efficient because it has fewer pairing operations than the BLS signature used in [21]. In addition, the ZSS signature does not need a special hash function like in the BLS signature (i.e., MapToPoint). It can use a general hash function such as the SHA family or MD5. The second is computational cost. Table 3 also shows costs for the sender that computes signcryption and the recipient that computes the unsigncryption scheme. The pairing and exponential operations are considered high-cost operations. Unfortunately, the attribute-based signature required more exponential operations than other schemes. In the [19], the sender needs to do nine exponential operations, and in [20], the sender requires eight exponential operations. Unlike the two previous schemes, the BLS-based signature in [21] required the sender to do fourteen multiplication and two pairing operations. However, in our proposed scheme, the computational cost for the sender is \(n(1 Exp+1 Inv+1 Mul+1 Add+3 Hash)\) and for the recipient is \(n(1 Add+2 Hash+P)\). The sender needs to do fewer exponentiation and multiplication operations than other schemes. The recipient also has less operation when doing a unsigncryption scheme. Furthermore, in our unsigncryption scheme, the bilinear pairing of \(e(P,P)\) can be precomputed. So, there is only one pairing operation. In addition, even though our scheme has more hash operations, the cost hash function is negligible compared to the other operations. Nevertheless, our computational cost is the same as our based reference, which is [14]. Another variable to measure our scheme performance is to analyze the signature length and time complexity. In terms of signature length, the BLS signature size is approximately 160 bits [22], while ZSS is around 260 bits [14]. The bigger the signature size means, the more time needed to complete signcryption or unsigncryption. In terms of time complexity, our scheme and four other schemes have linear time complexity (\(O(n)\)), except the recipient \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref** & **S/R** & \begin{tabular}{c} **Signature** \\ **Type** \\ \end{tabular} & \begin{tabular}{c} **Signature** \\ **Size (bits)** \\ \end{tabular} & \
\begin{tabular}{c} **Computational** \\ **Cost** \\ \end{tabular} &
\begin{tabular}{c} **Time** \\ **Complexity** \\ \end{tabular} \\ \hline
[19] & \begin{tabular}{c} S \\ R \\ \end{tabular} & \begin{tabular}{c} Attribute- \\ based \\ \end{tabular} & n/a & \
\begin{tabular}{c} \(n(9 Exp)\) \\ \end{tabular} &
\begin{tabular}{c} \(O(n)\) \\ \end{tabular} \\ \hline
[20] & \begin{tabular}{c} S \\ R \\ \end{tabular} & \begin{tabular}{c} Attribute- \\ based \\ \end{tabular} & n/a & \
\begin{tabular}{c} \(n(8 Exp)\) \\ \end{tabular} &
\begin{tabular}{c} \(O(n)\) \\ \end{tabular} \\ \hline
[21] & \begin{tabular}{c} S \\ R \\ \end{tabular} & \begin{tabular}{c} BLS \\ \end{tabular} & 160 & \
\begin{tabular}{c} \(n(14 Mul+2P)\) \\ \end{tabular} &
\begin{tabular}{c} \(O(n)\) \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Computational cost and time complexity comparison. part in [19] that has constant time complexity (\(O(1)\)). The former indicates that the time in this instance relies on the input \(n\). The greater the value of \(n\), the longer the required time. The latter shows that the required time is always constant and does not depends on the input variable. The discussion above shows that [21] has a shorter signature size but high computational cost. Our scheme and [14] have lower computational costs than [21], but we have longer signature sizes.