# Practical V2I Secure Communication Schemes for Heterogeneous VANETs
## 4 Four Heterogeneous Signcryption Schemes for V2I Communication Scenarios
### Security Proof  
In the subsection, we will demonstrate our proposed schemes are secure. For each proposed signcryption scheme, we must prove its confidentiality (i.e., indistinguishability against adaptive chosen ciphertext attacks, short for IND-CCA2) and unforgeablity (i.e., existential unforgeability against adaptive chosen messages attacks, short for EUF-CMA) in a random oracle model due to its encryption and signature functions, respectively, which will make our paper very long because we proposed four schemes in all. Therefore, we mainly prove the confidentiality and unforgeability of MOHSC-I (PKI\(\rightarrow\)IBC many-to-one signcryption) scheme as an example to illustrate our reduction idea. In the following, \(t_{m}\) and \(t_{p}\) indicate the time to calculate one scalar multiplication and a bilinear pairing in \(G_{1}\), respectively, and \(n\) is the number of messages. **Theorem 1**. : _(Confidentiality of MOHSC-I scheme): **A** is a probabilistic polynomial-time (PPT) adversary with an advantage \(\varepsilon\) against the IND-CCA2 security within running time \(t\), and asking at most \(q_{i}\) times \(H_{i}\) (\(i=1,2,3\)) queries, \(q_{k}\) times key-generation queries, \(q_{u}\) times unsigcrypt queries, then there exists an algorithm **C** that can solve a DDHP instance with probability \(\varepsilon^{\prime}\geq\tau(1-\tau)^{q_{k}+q_{u}}\varepsilon\) in a time \(t^{\prime}\leq t+O(q_{u})t_{p}+O(2q_{H_{1}}+2q_{k})t_{m}\)._  
Proof. : Here, we show how **C** uses **A** to settle a given DDHP example (\(P\), \(aP\), \(bP\), \(cP\)). **Initial**: **C** firstly executes the **Setup** algorithm to set \(P_{pub}\)=\(aP\) and **PKI-KG** algorithm to get \(n\) senders\({}^{\prime}\)\(\left\{pk_{i}^{*},sk_{i}^{*}\right\}_{i=1}^{n}\), then sends the system parameters and \(\left\{pk_{i}^{*},sk_{i}^{*}\right\}_{i=1}^{n}\) to **A**. **Phase 1**: **C** keeps the lists \(L_{1}\), \(L_{2}\), and \(L_{3}\) to simulate \(H_{1}\), \(H_{2}\), and \(H_{3}\) oracles. Assume that \(H_{1}\) queries are different and the challenged identity \(ID_{r}^{*}\) is sent to \(H_{1}\) sometime. **A** queries \(H_{1}(ID)\) before \(ID\) is applied to other inquiries. * \(H_{1}\) queries: The list \(L_{1}\) with structure \(\left\{ID_{r},\alpha_{r},Q_{r},sk_{r},\xi_{r}\right\}\) is maintained by **C**. When **A** performs the query with \(ID_{r}\), **C** examines whether \(\left\{ID_{r},\alpha_{r},Q_{r},sk_{r},\xi_{r}\right\}\) is already in \(L_{1}\). If so, **C** returns \(Q_{r}\) to **A**. Otherwise, **C** flips a coin \(\xi_{r}\in\left\{0,1\right\}\) that returns \(0\) with possibility \(\tau\) (which will be determined later) and \(1\) with possibility \(1-\tau\): (1) If \(\xi_{r}=1\), **C** computes \(Q_{r}=bP,\alpha_{r}=\bot,sk_{r}=\bot\); (2) Otherwise, **C** chooses a random \(\alpha_{i}\in Z_{p}^{*}\), computes \(Q_{r}=\alpha_{r}P\), \(sk_{r}=\alpha_{r}aP\), adds \(\left\{ID_{r},\alpha_{r},Q_{r},sk_{r},\xi_{r}\right\}\) to \(L_{1}\), and returns \(Q_{r}\) to **A**. * \(H_{2}\) queries: The list \(L_{2}\) has the tuples of \(\left\{k_{i},\rho_{i}\right\}\), which is maintained by **C**. When **A** submits a \(k_{i}\) and issues \(H_{2}\) query, the same answer from \(L_{2}\) will be given if the query has been queried before. Otherwise, **C** chooses \(\rho_{i}\in\left\{0,1\right\}^{n}\) at random, then adds \(\left\{k_{i},\rho_{i}\right\}\) into \(L_{2}\) and sends \(\rho_{i}\) to **A**. * \(H_{3}\) queries: The list \(L_{3}\) has the tuples of \(\left\{pk_{i},pk_{r},R_{i},c_{i},h_{i}\right\}\). When **A** issues a query \(\left\{pk_{i},pk_{r},R_{i},c_{i}\right\}\) to \(H_{3}\), **C** examines whether \(\left\{pk_{i},pk_{r},R_{i},c_{i},h_{i}\right\}\) is already in \(L_{3}\); if so, **C** returns \(h_{i}\) to **A**. Otherwise, **C** chooses a random value \(h_{i}\in Z_{q}^{*}\) as answer and adds \(\left\{pk_{i},pk_{r},R_{i},c_{i},h_{i}\right\}\) to \(L_{3}\). * Key-generation queries: When **A** performs the query with \(ID_{r}\) if \(ID_{r}=ID_{r}^{*}\), **C** returns \(\bot\).