# Cloud Storage Data Verification Using Signcryption Scheme
## 3 Proposed Scheme  
### ZSS Signcryption  
This section presents an improved version of the short signcryption scheme using the ZSS signature based on bilinear pairings. We adopted the signcryption from [14] by [PERSON] in 2006. In [14], the author also gives a public verifiability property. However, his work lack privacy-preserving and blockless verification during the verification process because the user needs to forward the original message \(m\) to the verifier. By doing so, users' data might leak to the verifiers. Furthermore, the verifier needs to download message \(m\) to do data verification, which is inefficient. Therefore, in our proposal, we give two additional advantages besides public verifiability that are important for data verification schemes, privacy-preserving and blockless verification. We chose the ZSS signature because it required less pairing operation than other short signatures, such as the BLS signature [18]. Furthermore, ZSS does not need a special hash function, i.e., MapToPoint, used in BLS. We can use a general hash function such as SHA family, or MD5 [18]. As shown in Figure 1, a user will store a file in CSP. First, he will compute signcrypted data \(\sigma\). Then, he will send \(\sigma\) to the CSP. Before CSP stores data in their storage, it will unsigncrypt the \(\sigma\). The detailed process is described as follows. Figure 1: Proposed scheme. * **Setup Phase*
* Given security parameter \(b\) and \(d\). Let \(G_{1}\) be a cyclic additive group and \(G_{2}\) be multiplicative cyclic groups with prime order \(p\), \(P\) is the generator of group \(G_{1}\). The bilinear mapping \(e:G_{1}\times G_{2}\to G_{2}\), three hash functions \(Hash_{1}:\{0,1\}^{*}\to Z_{p},Hash_{2}:G_{1}^{3}\to\{0,1\}^{d}\) and \(Hash_{3}:\{0,1\}^{d}\to\{0,1\}^{b}\), and symmetric encryption scheme \((Enc,Dec)\). Therefore, the system parameters are \(\{b,d,G_{1},G_{2},P,e,Hash_{1},Hash_{2},Hash_{3},Enc,Dec\}\). We provided a list of notations that we used in Table 1.
* The sender chooses a random number from \(Z_{p}\), sets it as their secret key \(SK_{S}\) and computes their public key \(PK_{S}=SK_{S}P\). The recipient chooses a random number from \(Z_{p}\), sets it as their secret key \(SK_{R}\), and computes their public key \(PK_{R}=SK_{R}P\). * **Signcryption. ** User as sender \(S\) generated a signcryption \(\sigma\) for each message \(m\) as follows. 1. Generates \(v=(Hash_{1}(m)+SK_{S})^{-1}\). 2. Choose \(r\leftarrow^{R}\{0,1\}^{d}\) and generate \(V=vP\), \(X=r\oplus Hash_{2}(V,PK_{R},vPK_{R})\). Then, generate \(k=Hash_{3}(r)\), which is a symmetric encryption key. So, \(Y=Enc_{k}(m)\). 3. Therefore, the signcryption \(\sigma=(V,X,Y)\) where \(V\) is a ZSS signature of message \(m\), \(X\) is the randomness of encryption key generation, and \(Y\) is the encryption of message \(m\). * **Unsigncryption. ** After receiving \(\sigma=(V,X,Y)\) from the sender \(S\), the recipient \(R\) start unsigncryption process. 1. \(R\) parse \(\sigma\) to get \((V,X,Y)\). 2. Computes \(r=X\oplus Hash_{2}(V,PK_{R},VSK_{R})\) and \(k=Hash_{3}(r)\). 3. Decrypt \(Y\) to get message \(m\). So, \(m=Dec_{k}(Y)\). 4. If the Equation (2) holds, unsigncryption success; otherwise, \(R\) rejects \(\sigma\) from the sender. \[e(Hash_{1}(m)P+PK_{S},V)=e(P,P)\] (2)  
In order to add randomization to the signature generation process, the author of [14] inserts a random variable \(r\). The consequence is the user must provide the verifier the \(r\)