# Practical V2I Secure Communication Schemes for Heterogeneous VANETs
## 4 Four Heterogeneous Signcryption Schemes for V2I Communication Scenarios
### Security Proof
**Attack**: \(C\) keeps four lists \(L_{1}\), \(L_{2}\), \(L_{3}\), and \(L_{k}\) to simulate the hash oracles \(H_{1}\), \(H_{2}\), \(H_{3}\), and the key-generation oracle. * \(H_{1}\) queries: The list \(L_{1}\) with structure \(\left\{ID_{r},\alpha_{r},Q_{r},D_{r}\right\}\) is maintained by_C_. \(C\) randomly chooses \(\alpha_{r}\in Z_{p}^{*}\) and computes \(Q_{r}=\alpha_{r}P,D_{r}=\alpha_{r}aP\). Then, it adds \(\left\{ID_{r},\alpha_{r},Q_{r},D_{r}\right\}\) to \(L_{1}\) list and returns \(Q_{r}\), \(D_{r}\). * \(H_{2}\) queries and \(H_{3}\) queries are the same as in Theorem 1, so we will not describe the details. * Key-generation queries: The list \(L_{k}\) with structure \(\left\{ID_{i},x_{i},pk_{i},sk_{i},d_{i}\right\}\) is maintained by \(C\). When \(F\) requests the query with \(ID_{r}\), \(C\) examines whether \(\left\{ID_{i},x_{i},pk_{i},sk_{i},d_{i}\right\}\) is already in \(L_{k}\). If so, \(C\) transmits \(pk_{i}\) and \(sk_{i}\) to \(F\). Otherwise, \(C\) flips a coin \(d_{i}\in\{0,1\}\) that returns 0 with probability \(\tau\) and 1 with probability \(1-\tau\). If \(d_{i}=0\), \(C\) sets \(sk_{i}=bP,sk_{i}=\bot\), adds \(\left\{ID_{i},\bot,\bot,sk_{i},d_{i}\right\}\) to \(L_{k}\). Otherwise, \(C\) randomly picks \(x_{i}\in Z_{p}^{*}\), sets \(sk_{i}=x_{i}pk_{i}=x_{i}P\), adds \(\left\{ID_{i},x_{i},pk_{i},sk_{i},d_{i}\right\}\) to \(L_{k}\), transmits \(pk_{i}\) and \(sk_{i}\) to \(F\). * Signcrypt queries: \(F\) submits one message \(m_{i}\), the sender \(V_{i}\)'s identity \(ID_{i}\), the receiver's identity \(ID_{r}\) to \(C\). If \(d_{i}=0\), \(C\) returns \(\bot\). Otherwise, \(C\) selects randomly \(r_{i}\in Z_{p}^{*}\), computes\(R_{i}=r_{i}x_{i}P_{pub}k_{i}=e(R_{i},Q_{r})\). Then, \(C\) makes a \(H_{2}\) query on \(k_{i}\) and gets \((\rho_{i},k_{i})\) from \(L_{2}\) list, \(C\) computes \(c_{i}=m_{i}\oplus\rho_{i}\)\(S_{i}=sk_{i}h_{i}P_{pub}=x_{i}h_{i}aP\), and returns \(\sigma_{i}=(c_{i},R_{i},S_{i})\) to \(F\). **Forgery**: \(F\) returns \(n\) senders' identities \(\left\{ID^{*}_{i}\right\}_{i=1}^{n}\), a receiver's identity \(ID^{*}_{r}\), and a new aggregate signcryption ciphertext \(\sigma^{*}\) on messages \(m^{*}=(m^{*}_{1},m^{*}_{2},\ldots,m^{*}_{n})\). \(F\) wins the game if and only if:  
1. The output of \(\mathbf{Unsigncrypt}\)\((\sigma^{*},\left\{pk_{i}\right\}_{i=1}^{n},sk_{ID^{*}_{r}})\) is valid. The advantage of the forger \(F\) can be defined as its probability of winning the game. 2. At least one sender, without losing generality, let \(ID^{*}_{1}\) has not been requested in the key-generation query. In addition, \(\left(\left\{pk^{*}_{i}\right\}_{i=1}^{n},\left\{m^{*}_{i}\right\}_{i=1}^{n}, ID^{*}_{r}\right)\) have never been asked in the Signcrypt queries. For all \(1\leq i\leq n\), \(C\) gets tuples \(\left\{ID^{*}_{i},x^{*}_{i};sk^{*}_{i},pk^{*}_{i},d^{*}_{i}\right\}\)\(\left\{pk^{*}_{i},pk^{*}_{r},R^{*}_{i},c^{*}_{i},h^{*}_{i}\right\}\) from \(L_{k}\) and \(L_{3}\), respectively. If \(d^{*}_{1}=0\) and \(d^{*}_{i}=1(i=2,\ldots,n)\), \(C\) continues. Otherwise, \(C\) aborts. Since \(\sigma^{*}\) meets the Equation (1), then  
\[e(h^{*}_{1}pk^{*}_{1},P_{pub})=e(S^{*},P)e(\sum_{i=2}^{n}h^{*}_{i}pk^{*}_{i},- P_{pub}).\]  
Since \(pk^{*}_{1}=bP\), \(P_{pub}=aP\) and \(pk^{*}_{i}=x^{*}_{i}P\) for all \(2\leq i\leq n\), it can be transformed into:  
\[e(h^{*}_{1}abP,P)=e(S^{*},P)e(-\sum_{i=2}^{n}h^{*}_{i}x^{*}_{i}aP,P).\]  
Hence, \(C\) can compute  
\[abP=(h^{*}_{1})^{-1}(S^{*}-\sum_{i=2}^{n}x^{*}_{i}h^{*}_{i}aP).\]  
Further, we will analyze the possibility of \(C\) success. Define the events \(E_{1}\), \(E_{2}\), and \(E_{3}\) in the following:  
\(E_{1}\): \(C\) does not abort all queries of key-generation. \(E_{2}\): \(F\) produces a valid and nontrivial forged aggregate ciphertext. \(E_{3}\): \(E_{2}\) happens, and \(d^{*}_{1}=0,d^{*}_{i}=1\)\((2\leq i\leq n)\). \(C\) is successful as long as the above events happened. The probability is \(\Pr[E_{1}\wedge E_{2}\wedge E_{3}]\).