# A Hyperelliptic Curve Cryptosystem Based Proxy Promised Signcryption Scheme

Authors: Farhad Ullah Khan; Fahad Algarni; Insaf Ullah; Hanen Karamti; Muhammad Anwaar Manzar; Ahmed Saeed Alzahrani; Muhammad Adnan Aziz; Muhammad Asghar Khan
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Signcryption is the method of combining a digital signature with encryption in a single logical step to get the cryptographic primitives of a public key. However, in addition to signcryption, we sometimes require anonymity and delegation of rights. In this paper, we propose a scheme called proxy promised signcryption to address all of these objectives simultaneously. In this scheme, the actual sender or signer delegates authority to an agent known as signcrypter for signcryption of the actual ciphertext. The agent entity is facilitated to generate a promised signcrypted text. The signcrypted text is then communicated to the intended recipient. The proposed work aims to reduce computation and communication costs, which has been tested by comparing it to existing schemes. The results obtained from this comparison support the aims of our scheme. The proposed scheme’s security has also been evaluated using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The results validate that our scheme resists well-known cyberattacks.


---

## Body

## 1. Introduction

Transmitting data/information over an unreliable channel needs assurance and security. Data is an essential entity of any business/organization that is why for providing safety to the transmittable data, we need confidentiality, authenticity, and integrity. Confidentiality is provided by encryption algorithms; digital signature algorithms are employed for authenticity to be ensured, while using a one-way hash function, the integrity is assured. Before 1997, the sending data of the sender was to be encrypted first, and then the ciphertext signature of the data would be calculated, where it was a time-wasting process that used more machine cycles. Confiscating this restriction, Zheng [1] devised the word “signcryption.” According to this scheme, a single step is used to combine digital signature with encryption to reduce computational cost and communication overhead. Therefore, some applications such as online contract signing and so on need proxy communication to be involved as a man-in-the-middle (MITM), while, in some sort of situation rights, delegation and deniability properties are mutually required. Hence, to provide a proxy communication membo, [2] was the first that coined a proxy signature scheme. A proxy signature or rights delegation is the process of handing over signing authority by an original sender to an agent known as a proxy signer; there the agent (proxy) makes a signature on the behalf of the original sender. Zhang [3] contributed a complete and partial proxy signature with certificates. Zeng and Park [4] designed a threshold proxy signature scheme. Xiao [5] presented a new scheme called a multiproxy signature. Gamage et al. [6] stretched the scheme to alter proxy signature with proxy signcryption. Chan and Wei [7] projected a new proxy signcryption-based scheme on threshold property, while Ji-Guo et al. [8] demonstrated that the Chan and Wei [9] scheme is unable to satisfy strong unforgeability, nonrepudiation, and identifiability so that an improved scheme was offered. A proxy signcryption scheme [10] was proposed by Zhang that has properties of forward secrecy and message public verifiability, while this scheme suffers from limitations of cost deficiency. A novel research called warrant-based proxy signcryption was a project that is based on IF assumption proposed by Zhou et al. [11]. In this scheme, an attempt was made to define syntax and formalize notions of security. Another scheme named proxy signcryption that is established on discrete logarithm was projected by Elkamchouchi et al. [12]. In this scheme, a demonstration touch by numerical examples was given as well. Elkamchouchi et al. [13] made an attempt again that is known as a “proxy signcryption scheme with forward secrecy and public verifiability.” This scheme was proposed for the original and the agent (proxy) signcrypter, while there a situation may occur in the form of a vulnerability known as an MITM attack. A proxy signcryption schemes was projected by Elkamchouchi et al. [14] founded on DLP. The scheme is totally employed using mathematics for realistic parameters (256 bit). Moreover, when the identity of the original signcrypter is verified, then the authorized proxy signcrypter might be able to craft legal proxy signatures. Using a BP in a PKI setting, Lo and Tsai [15] projected a competent signcryption. Thereafter, Lo and Tsai [16] initiated that the Lo and Tsai [15] scheme is vulnerable in terms of the chosen warrant attack (CWA). Hence, using BP, an identity-based proxy signcryption was proposed by Fei-Yu et al. [17] where the forward secrecy public verifiability was the future aspects of the scheme. This scheme [17] was exploited as insecure by Wang et al. [18]. Thereafter, an Id-based proxy signcryption was proposed by Wang and Cao [19]. An Id-based threshold proxy signcryption scheme was attempted by Wang and Liu [20].Currently, the security service of deniability got a greater attraction in the area of cryptography because of the personal privacy protections that is necessary for business and real-life scenarios. Suppose a bidder that does not want to disclose the bid’s basic contents to a third party or even to anybody. Thus, in such a case, the deniability property enables the bidder to deny self-participation if any conflict occurs. For “deniable authentication,” a protocol was proposed by dwork [21] that provided a facility to enable a sender to communicate secrets without revealing self-privacy. To provide an efficient deniable authentication in a protocol, Aumann and Rabin [22] contributed to a scheme based on the factoring problem. However, this protocol was less efficient because of the high computational cost and communication overhead. After this, Deng et al. [23] coined two deniable authentication protocols based on the hardiness of the discrete logarithm problem (DLP). While these schemes also led to high computational costs and communication overhead. Another deniable authentication protocol was suggested by Fan et al. [22]. The protocol was operated on the Diffie–Hellman key exchange fashion to secure communication. However, there was a vulnerability to providing sender anonymity. A ring signature concept was coined by Noar [24] with the inclusion of forward deniability in terms of ring authentication. This kept hiding the original sender from all possible senders in a group. To hide the actual sender with noninteractive deniable authentication (NIdA), Susilo and Mu [25] planned a scheme based on ring authentication protocol. The scheme provided a facility to restrict the anticipated receiver to identify the original sender amongst group/groups. But the high computation was the limitation of the scheme. Using a generalized ElGamal signature, Lee et al. [26] contributed a scheme based on noninteractive deniability. By using the proposed security model, that is, noninteractive deniable authentication protocol, the nominated verifier has the competency to enquire about unforgeability and deniability. A scheme called “fully authentication service” was contributed by Harn and Jian Ren [27] for e-mail applications. To design e-mail authentication supported by Pretty Good Privacy (PGP) and Secure/Multipurpose Internet Mail Extensions (S/MIME), this scheme used cryptographic functions. To provide protection and anonymity to the original sender, Hwang and Sung [28] combined deniable authentication with encryption approaches called promised signcryption. Promised signcryption approach enables the signcrypter to generate a signcryptext with deniability property. However, there are some low-resource devices such as mobile phones and digital assistants that have low computational capabilities and consume more battery power to perform some heavy cryptographic computations. Addressing the aforementioned constraints, Insaf et al. [29] combined the properties of proxy signcryption and promised signcryption in a single approach known as proxy promised signcryption. In this approach, the original signer gives the signing rights to another entity called promised signcrypter (proxy). Later on, the proxy signcrypter generates the promised signcryption on behalf of the original sender/signer. Unfortunately, the approach [29] suffered from high processing cycles and greater bandwidth.Most of the time, many issues are being faced regarding security in communication and the transition of data from one node to another [30]. In this regard, if some open channels are used for information exchange, vulnerability may arise, that is, intruders can achieve more opportunities to attack the crucial data. Thus, for the sake of secure communication, some techniques are needed that may provide a secure transmission approach to data, that is, confidentiality, authenticity, integrity, and nonrepudiation are the required properties in this regard. Moreover, low resource consumption and less burden on network channels is the main aim of current communications. For the sake of enhancement of both the aforementioned facilities, we have tried HECC instead of ECC in our research and targeted three former attempts in the field, that is, Insaf [29], Elkamchouchi [31], and Ismail [32]. Due to the small key size, our scheme will result to consume laser computation cost and same as a small amount of communication overhead. The security validations of our scheme are run under a well-known tool of a simulation called AVISPA [33].


## 2. Preliminaries

Suppose ƒ is the decisive attribute and let us sayƒ∗ is the closure of that very ƒ attribute. Hence, the hyperelliptic curve (HEC) Hɛ of genus g > 1 that’s over the attribute of ƒ can be narrated as (Hɛ): z2 + h (g) z = ƒ (δ), where (δ, ℨ) ∈ƒ∗ƒ. Furthermore, the degree of at most g and ƒ (δ) = ƒ (δ) is a polynomial, that is, h (δ) ∈ƒ (δ) having degree 2g + 1. A pair of polynomials can be the divisor of HEC and can be represented using the Mumford [34]. It is clear that the most vital factor of every cryptographic system (CS) is the discrete logarithm problem (DLP) that is actually in some abelian groups. Let us say a randomly selected number is λ that is picked from the abelian group and that is being computed as λ. D = d + d + d + … + d shows a scalar multiplication of the said divisor. That is known as an HEC discrete logarithm problem, as it picks up a random number, that is, λ from λ. D + d + d + …… + d is some sort of infeasible.


## 3. Proposed Research Model

The initial idea for HEC was defined by Koblitz [35] that is basically an indiscriminate form of an elliptic curve. Here, the points of HEC cannot be imitated from a group like the points of an elliptic curve, while it is computed of the additive abelian group that is achieved from divisors. Comparing HEC with the EC in terms of small base field size, HEC has more consistency and acceptance. Moreover, HEC has lower parameters size and the same security surveillance as that of RSA and elliptic curve while having a facility to reserve fewer hardware resources [36–38]. The newly proposed model is founded on the hardiness of HECDLP that attempts the proxy promised signcryption, and all the signing authorities are transferred to a proxy signcrypter instead the original signcrypter. A signcrypted cryptogram is calculated by the proxy signcrypter via using the original/sender signcrypter’s credentials. This process is consists of the key generation stage (public and private keys), original signcrypter/sender, verification phase (proxy verification), promised signcryption stage (proxy), and unsigncryption stage (receiver). Table 1 shown below.Table 1
Notations for proposed scheme.
Notations of algorithmNotations for HLPSL codeDescriptionKxV′.UbSecret keyUPVpPublic key of senderVPVp′Private key of senderpbPbPublic key of receiverH,h, EH1, H2, EHash functionpaPb′Private key of receiverUbUbPublic key of proxy senderUaUb′Private key of proxy sender℧X′.{H1(X′.d′.Mw′)}_inv(Vp)Signature (warrant message)mwMwWarrant messageZX′.d′General valueCE(V′.Ub.M′′)EncryptionYH2(M′.F′.d′)Hash valueSF′.{H2(M′.F′.d′)}_inv(Pb).d′Signature


## 4. Key Generation Stage

(i)
Original sender: Picks a random number. Up is a private key and generates its public key as Vp = Up.d(ii)
Proxy: Picks random number. Pa is a private key and generates its public key as Pb = Pa.d(iii)
Receiver: Picks random number. Ua is a private key and generates its public key as Ub = Ua.d(iv)
Original sender/signcryptextIn this section, the original sender first selectsX∈ {1, 2, 3, …, n} randomly, calculates Z = X.d mod n, computes g = h (Z, mw), calculates ℧ = (X – UP.g) mod Q where d is the divisor over HEC and UP is a private key of the original sender, and then sends (Z, ℧, mw) to proxy.


### 4.1. Proxy Verification

After receiving (Z,℧, mw) proxy signcrypter, compute Z = ℧.d + g.Vp where g = h (Z, mw) and accept if g = g holds.


### 4.2. Proxy Promised Signcryption

After verification, the proxy picks∈ {1, 2, 3, …, n} randomly, computes Y = H (m// f.d), calculates V = (f +Y.Pa) mod n, computes the secret K = V.Up, computes the ciphertext by using the secret key C = EKx (m), computes S = V.d mod n where Up is the public key of the receiver and Pa is the private key of proxy, and then sends (C, Y, S) to receiver.


### 4.3. Unsigncryption

After receiving the tuple, the receiver first calculates secret keyK = S.Ua, recovers the plain text by using the secret key m = dKx (C), computes V= S – Y.Pb, and computes Y’ = H (Y//m), where Ua is the private key of receiver and Pb is the public key of proxy.The receiver only accepts if Y’ = Y holds.


## 4.1. Proxy Verification

After receiving (Z,℧, mw) proxy signcrypter, compute Z = ℧.d + g.Vp where g = h (Z, mw) and accept if g = g holds.


## 4.2. Proxy Promised Signcryption

After verification, the proxy picks∈ {1, 2, 3, …, n} randomly, computes Y = H (m// f.d), calculates V = (f +Y.Pa) mod n, computes the secret K = V.Up, computes the ciphertext by using the secret key C = EKx (m), computes S = V.d mod n where Up is the public key of the receiver and Pa is the private key of proxy, and then sends (C, Y, S) to receiver.


## 4.3. Unsigncryption

After receiving the tuple, the receiver first calculates secret keyK = S.Ua, recovers the plain text by using the secret key m = dKx (C), computes V= S – Y.Pb, and computes Y’ = H (Y//m), where Ua is the private key of receiver and Pb is the public key of proxy.The receiver only accepts if Y’ = Y holds.


## 5. Security Proof and Comparison

Theorem 1.
The following equality shows the correctness between the original user and proxy:(1)Z′=υ⋅D+gVP,Z′=X−UZ,mwD+gVP,where ℧ = (X - Up. g).(2)Z′=X−UpZmwD+Zmwhwhere g = h (Z, mw).(3)Z′=X−UphZ,mwD+hZ,mwUphWhereVP=UpDZ′=DX−UphZ,mwUphZ,mw,Z′=DX=X⋅D=Z.Theorem 2.
In this section, the unsigncrypter/receiver recovers the secret key by using the following equations:(4)K=SUa,K=VDUaWhereS=VD,K=VUaD,K=VUb,WhereUb=UaD,K = K, where V. Ub = K in promised signcryption section.


## 6. Security Analysis

Our proposed scheme claims the provision of all the security properties that are provided in existing schemes such as confidentiality, warrant integrity, warrant unforgeability, message authenticity, unforgeability, message integrity, deniability, and anonymity. To authenticate the security properties of the proposed scheme, the AVISPA [33] simulation tool is used. AVISPA is mainly a programmed simulation tool that is used to perform a concrete validation, certification, and analysis against the internet safety and sensitive modules, application, and the cryptographic techniques. AVISPA can ensure whether the established protocol is SAFE or UNSAFE, but the security constraints will be essential. An HLPSL language format is necessary for the developed protocol, to find its outcomes. In its initial steps, a code is devised on the basis of HLPSL structures, and furthermore, it is then encoded into machine-understandable structure via the intermediate format (IF). For the said process, an HLPSL2IF translator is used to check the execution in reference to the given initial knowledge and every proxy can create the messages [39, 40].


### 6.1. Confidentiality

In the proposed scheme, it is assured to obey the confidentiality property. According to the scheme, if an attacker “A” makes an attempt to get access to the main subjects of a message, the attacker “A” needs to know about the secret session key “K,” that is:(5)K=v⋅ub,while, in (5),(6)v=ƒ+Y⋅pa.Now, if the eavesdropper tries to calculate the value of “K,” then essentially the eavesdropper will need two effortless efforts to be performed as follows.Case 1.
The value of “K” is essentially needed to be calculated from (5). Moreover, to complete this operation, the eavesdropper will have to know about “V” from (6). That is another computational hard for the said eavesdropper that equals to solving ECDLP.Case 2.
Some calculations may be performed by the attacker to find “V” using (6). But, for this, it is required to find out again the arbitrarily created number “f” in (6) and the key Pa (private) on the proxy side.


### 6.2. Warrant Integrity

Our scheme ensures also warrant integrity. The one-way hash is used to calculate the sender warrant message prior to send, that is,g = h (Z, mw) and then send to proxy. Let us say to calculate Ʊ in (7) where it is also essential for the attacker to find out the sender’s private key “Up” from (8), generating up is a complex job for the attacker and will need to solve another HECDLP.(7)℧=x−up⋅Gmodq,(8)v=up⋅D.


### 6.3. Warrant Unforgeability

In the proposed scheme, warrant unforgeability meets. If the attacker attempts to calculate a valid signature using (9), warrant likes “Ʊ” where(9)℧=x−up⋅G.Hence, in (9), then “A” first needs X from HECDLP to be found out, and in some possibilities, let us say if X is achieved, then:(10)up⋅G=vp,while vp=up⋅D.Here again, it is needed to face a challenge for HECDLP. So facing two times the hard problem cannot forge the sign.


### 6.4. Message Authenticity

In our scheme, the authentication property also meets. If an attacker “A” wants to get access to calculate a forge signature as shown in equation (5), d is publicly available in the network, which is possibly approachable by anyone in the network; then still the calculation of V would be really a complex job as follows:(11)S=v⋅D,(12)v=ƒ+Y⋅pa.Hence, in the situation,f and Pa in (12) are two unknown terms in a single equation to be accessed that results the signature cannot be disclosed; hence, no disclosure to sign leads to the authenticity in actual data.


### 6.5. Message Integrity

In the proposed scheme, prior to sending the message, proxy signcrypter first computes collision-resistant hash function of the message as in (12) and then forwards it to the addressee. If the invader wishes to translate the code/message C in (13) into C, then it is needed to change the m also, into m′. But we are going to use a fender-bender resisting one-way hash function that is computationally insufficient for the invader.(13)Y=HfD,(14)C=kEXm,while at receiver(15)Y′=HYm.So, if the value of Y′ = Y, then accept; otherwise, the message is fake and can be rejected.


### 6.6. Deniability and Anonymity

Our proposed scheme is composed of a private/secret network, where no third parties are considered within the promise between sender and receiver. It is just for the sake of information secrecy. Hence, if the receiver gets involved in violation of the promise, then the sender can deny via changing its source credentials, to keep self-anonymous and not to be proven by the tired one.


## 6.1. Confidentiality

In the proposed scheme, it is assured to obey the confidentiality property. According to the scheme, if an attacker “A” makes an attempt to get access to the main subjects of a message, the attacker “A” needs to know about the secret session key “K,” that is:(5)K=v⋅ub,while, in (5),(6)v=ƒ+Y⋅pa.Now, if the eavesdropper tries to calculate the value of “K,” then essentially the eavesdropper will need two effortless efforts to be performed as follows.Case 1.
The value of “K” is essentially needed to be calculated from (5). Moreover, to complete this operation, the eavesdropper will have to know about “V” from (6). That is another computational hard for the said eavesdropper that equals to solving ECDLP.Case 2.
Some calculations may be performed by the attacker to find “V” using (6). But, for this, it is required to find out again the arbitrarily created number “f” in (6) and the key Pa (private) on the proxy side.


## 6.2. Warrant Integrity

Our scheme ensures also warrant integrity. The one-way hash is used to calculate the sender warrant message prior to send, that is,g = h (Z, mw) and then send to proxy. Let us say to calculate Ʊ in (7) where it is also essential for the attacker to find out the sender’s private key “Up” from (8), generating up is a complex job for the attacker and will need to solve another HECDLP.(7)℧=x−up⋅Gmodq,(8)v=up⋅D.


## 6.3. Warrant Unforgeability

In the proposed scheme, warrant unforgeability meets. If the attacker attempts to calculate a valid signature using (9), warrant likes “Ʊ” where(9)℧=x−up⋅G.Hence, in (9), then “A” first needs X from HECDLP to be found out, and in some possibilities, let us say if X is achieved, then:(10)up⋅G=vp,while vp=up⋅D.Here again, it is needed to face a challenge for HECDLP. So facing two times the hard problem cannot forge the sign.


## 6.4. Message Authenticity

In our scheme, the authentication property also meets. If an attacker “A” wants to get access to calculate a forge signature as shown in equation (5), d is publicly available in the network, which is possibly approachable by anyone in the network; then still the calculation of V would be really a complex job as follows:(11)S=v⋅D,(12)v=ƒ+Y⋅pa.Hence, in the situation,f and Pa in (12) are two unknown terms in a single equation to be accessed that results the signature cannot be disclosed; hence, no disclosure to sign leads to the authenticity in actual data.


## 6.5. Message Integrity

In the proposed scheme, prior to sending the message, proxy signcrypter first computes collision-resistant hash function of the message as in (12) and then forwards it to the addressee. If the invader wishes to translate the code/message C in (13) into C, then it is needed to change the m also, into m′. But we are going to use a fender-bender resisting one-way hash function that is computationally insufficient for the invader.(13)Y=HfD,(14)C=kEXm,while at receiver(15)Y′=HYm.So, if the value of Y′ = Y, then accept; otherwise, the message is fake and can be rejected.


## 6.6. Deniability and Anonymity

Our proposed scheme is composed of a private/secret network, where no third parties are considered within the promise between sender and receiver. It is just for the sake of information secrecy. Hence, if the receiver gets involved in violation of the promise, then the sender can deny via changing its source credentials, to keep self-anonymous and not to be proven by the tired one.


## 7. Computational Costs Analysis

Computational cost means the amount of machine cycles to be spent by the entire system, that is, original sender, proxy, and the message recipient. Usually, this cost is predictable by counting the number of principal operations involved in processing cycles. Typically, these operations include hyperelliptic curve divisor multiplications (HECdM). In Table2, we illustrate the computational cost comparison of the proposed scheme with all the three schemes [31, 41] and [29] in terms of operations. We inspected, in the proposed scheme and the schemes [31, 41] and [29], that the costliest operations (major operations) are the hyperelliptic curve divisor multiplication (HECdM) and elliptic curve point’s scalar multiplications (ECPM).Table 2
Computational comparisons in terms of major operations.
ParticipantsScheme [31]Scheme [29]Scheme [41]ProposedSender1-ECPM1-ECPM3-ECPM1-HECdMProxy4-ECPM4-ECPM1-ECPM4-HECdMReceiver3-ECPM2-ECPM1-ECPM1-HECdMTotal8-ECPM7-ECPM5-ECPM6-HECdMTable3 demonstrates the comparison of the proposed with the other three schemes [31, 41] and [33] with respect to milliseconds. It is observed that the single scalar multiplication consumes 4.24 ms for elliptic curve point multiplication (ECPM) and 2.2 ms for hyperelliptic curve divisors scalar multiplication (HECdM) on a PC running jdk1.6 having two cores of Intel CPU with processing speed of 2.00 GHz and primary memory capacity of 4 GB operating with Microsoft Windows Vista [42–44].Table 3
Computational cost reduction in terms of milliseconds.
ParticipantsScheme [31]Scheme (ms) [29]Scheme (ms) [41]Proposed (ms)Sender4.244.2412.722.2Proxy16.9616.964.248.8Receiver12.728.484.242.2Total33.9229.6821.213.2Furthermore, we use the generalized formula for the reduction of computational cost [40]:(16)Existingscheme−proposedschemeExistingscheme.The reduction of the proposed scheme as compared with the scheme [31] is shown below:(17)33.92−13.233.92∗100=61.08.The reduction of the proposed scheme as compared with the scheme [41] is shown below:(18)29.68−13.2⋅29.68∗55.5%.The reduction of the proposed scheme as compared with the scheme [29] is shown below:(19)21.2−13.221.2∗100=37.7%.


## 8. Communication Overhead

In Table4, we show communication cost comparisons of the proposed scheme with existing schemes [31, 41] and [29] with respect to different ciphertext sizes, for example, 128, 256, 512, and 1,024 bits. In the proposed scheme, wireless communication is involved, and there the factor of importance is communication overhead. Due to the bandwidth limits of wireless media, communication overhead for some cryptographic techniques must be kept to a minimum. As a result, a few cryptographic algorithms are required for wireless media to maintain a low communication overhead. Hence, the selection of parameters will mark most of the communication cost for the proposed system and the amount of information that are to be transmitted. For simplification, we assume that:(1)
|H (value)|≅ |q| where q is a large prime number ≫ 2 160(2)
|H (value)|≅ |n| where n is a large prime number ≫ 2 80Table 4
Communication cost comparisons in terms of ciphertext size.
Ciphertext size (bits)Scheme [31]Scheme [29]Scheme [41]ProposedReduction from scheme [31]Reduction from [29, 41]128128 + 128 + 480 + 160128 + 160 + 160128 + 160 + 160128 + 80+80(896 – 288)/896∗100 = 67.85%(448 – 288)/448∗100 = 35.71%256256 + 128 + 480 + 160256 + 160 + 160256 + 160 + 160256 + 80+80(1,024 – 416)/1024∗100 = 59.37%(576 – 416)/576∗100 = 27.77%512512 + 128 + 480 + 160512 + 160 + 160512 + 160 + 160512 + 80+80(1 280 – 672)/1280∗100 = 47.5%(832 – 672)/832∗100 = 19.23%10241,024 + 128 + 480 + 1601,024 + 160 + 1601,024 + 160 + 1601,024 + 80+80(1,792 – 1,184)/1,792∗100 = 33.92%(1,344 – 1,184)/1,344∗100 = 11.90%For the sake to compare communication cost of proposed scheme |C| + |n|+|H (value)| with scheme [31] and scheme [29, 41], we know that the communication cost of scheme [31] is |C| + |mw|+3|q|+| (value)| and schemes [29, 41]are |C|+|q|+|H (value)|.Therefore, the generalized formula for the reduction of communication costs is as follows [40]:(20)Existingscheme−proposedschemeExistingscheme.Communication overhead reduction of the proposed scheme as compared with the scheme [31] is as follows:(21)c+mw+3q+Hvalue−c+n+Hvaluec+mw+3q+Hvalue.Communication overhead reduction of the proposed scheme as compared with the scheme [29, 41] is as follows:(22)c+q+Hvalue−c+n+Hvaluec+q+Hvalue.


## 9. Conclusion

In this article, we proposed proxy promised signcryption, which is based on HECC. The proposed scheme provided all the security requirements of proxy and promised signcryption schemes, where the AVISPA tool is tried to validate the scheme in terms of security analysis and validations. Furthermore, the computation and communication costs bounded 37.7% to 61.08% and 35.71% to 67.85% as compared to existing schemes [31, 41] and [29], respectively. The proposed method is ideal for resource-constrained devices since it can perform rapid implementations, follows rules for a smaller number of public keys, has fewer parameters, uses less power, and has fewer machine processing cycles.



---

*Source: 1232336-2022-04-27.xml*