# A Provably Secure Proxy Signcryption Scheme Using Bilinear Pairings

Authors: Nai-Wei Lo; Jia-Lun Tsai
Journal: Journal of Applied Mathematics
 (2014)

---

## Abstract

As people in modern societies are busier than any human era and computer network has profound impact on how people work and live through fast and convenient information exchange, people need more help from each other to accomplish more work via network connections in limited period of time. Therefore, privilege delegation mechanism has become a necessary service in modern enterprises and organizations. Proxy signcryption scheme provides a secure privilege delegation mechanism for a person to delegate his privilege to his proxy agent to accomplish things. In 2010, Lin et al. had proposed an efficient signcryption scheme using bilinear pairings. However, we found that the proxy signcryption scheme of Lin et al. is vulnerable to the chosen warrant attack. A provably secure proxy signcryption scheme using bilinear pairings is introduced accordingly. In terms of performance efficiency, the proposed scheme is superior to other existing schemes. In addition, a new security model is proposed to describe proxy signcryption scheme; based on the security model we show that the proposed scheme is provably secure in terms of indistinguishability under adaptive chosen ciphertext attack (IND-CCA2), unforgeability under adaptive chosen message attack (EF-CMA), and unforgeability under adaptive chosen warrant attack (EF-CWA).


---

## Body

## 1. Introduction

Since Diffie and Hellman proposed the concept of public key cryptosystem [1] in 1976, public key cryptosystems have been widely used for constructing secure network applications and communication systems. Generally, public key cryptosystems can be divided into two categories: public key encryption schemes [2–4] and signature schemes [2, 5, 6]. Public key encryption schemes are usually adopted to assure that the content of transmitted messages cannot be learned by an adversary without knowledge of the receiver’s private key. Signature schemes are mainly used to assure that received messages at the destination party are not modified or falsely generated by an adversary. With rapid evolved Internet environment and more complicated business flow processes, secure privilege delegation mechanism has become a necessary function for enterprises, organizations, and even every modern citizen. New application demands such as online proxy auction, digital contract signing, and work transfer for deputy all require privilege delegation mechanism from time to time to help people delegate their authorities to someone or a group of people in order to accomplish certain work in time. Therefore, traditional public key cryptosystems [7–9] may not be able to meet the needs for these newly developed applications in terms of security robustness and operation efficiency.The concept of proxy signature scheme was first proposed by Mambo et al. [10] in 1996. A proxy signature scheme allows the original signer to delegate his/her signing authority to a proxy signer. Once the proxy signer gains the delegated authority from the original signer, the proxy signer can generate a proxy signature on behalf of the original signer. Proxy signature schemes have been adopted in many practical applications, particularly in distributed systems and mobile agent-based systems where the delegation of user authority is commonly applied. In general, proxy delegation can be divided into three types: full delegation, partial delegation, and delegation by warrant. In recent years, several proxy signature schemes have been proposed [8–16].There are occasions in which applications with message transmission feature have to achieve confidentiality, integrity, authenticity, and nonrepudiation simultaneously. In 1997, Zheng first proposed a signcryption scheme in [17] to achieve these security requirements at the same time. The proposed signcryption scheme only allows the designated recipient to recover the original message from the received signcrypted ciphertext generated by the signer and then to verify the validity of this recovered message. Since then, various signcryption schemes were proposed [17–22].In 1999, the concept of proxy signcryption scheme was first introduced by Gamage et al. [23]. Proxy signcryption scheme is subcategorized under signcryption scheme. Proxy signcryption scheme elaborates on the merits of signcryption and proxy signature. In a proxy signcryption scheme, an original signer can generate a proxy credential to delegate his/her signing authority to a proxy signer. Then, the proxy signer can generate a signcrypted message on behalf of the original signer. Only the recipient has the ability to recover the content of this signcrypted message and then to verify the validity of this recovered message content. In case a dispute occurs from the repudiation of the proxy signer or the original signer, the message recipient can announce the proxy signature to a trusted third party for public verification without extra computational cost. Proxy signcryption schemes can be used in applications such as online proxy auction and business contract signing.Recently, bilinear pairing [24, 25] from elliptic curves is widely adopted to develop new public key cryptosystems [26–36]. Accordingly many researchers have utilized bilinear pairings to construct pairings-based proxy signcryption schemes [26–28, 30, 31]. In 2010, Lin et al. proposed an efficient proxy signcryption scheme [31] using bilinear pairings. The scheme of Lin et al. is the first one to propose a public verification mechanism for the message recipient to prove the proxy signer or the original signer is dishonest when a dispute occurs between message signers and message recipient. In addition, only four bilinear pairing operations are required in their scheme. To prove security strength of their proxy signcryption scheme, Lin et al. also give a security model for proxy signcryption scheme and then prove their scheme is secure in terms of IND-CCA2 and EF-CMA under random oracle model.


### 1.1. Contribution

This paper discovers that the signcryption scheme of Lin et al. [31] is vulnerable to two forgery attacks because the proxy credential generated from the original signer is not secure against the chosen warrant attack. In addition, the security model of Lin et al. did not consider unforgeability of generated proxy credential. A new proxy signcryption scheme using bilinear pairings is introduced in which the proposed scheme remedies the vulnerabilities of Lin et al.’s scheme and achieves better performance in terms of computing cost when comparing with other existing schemes. A new security model for proxy signcryption scheme is also presented and used to prove that the proposed scheme is secure in terms of indistinguishability under adaptive chosen ciphertext attack (IND-CCA2), unforgeability under adaptive chosen warrant attack (EF-CWA), and unforgeability under adaptive chosen message attack (EF-CMA) in random oracle.


## 1.1. Contribution

This paper discovers that the signcryption scheme of Lin et al. [31] is vulnerable to two forgery attacks because the proxy credential generated from the original signer is not secure against the chosen warrant attack. In addition, the security model of Lin et al. did not consider unforgeability of generated proxy credential. A new proxy signcryption scheme using bilinear pairings is introduced in which the proposed scheme remedies the vulnerabilities of Lin et al.’s scheme and achieves better performance in terms of computing cost when comparing with other existing schemes. A new security model for proxy signcryption scheme is also presented and used to prove that the proposed scheme is secure in terms of indistinguishability under adaptive chosen ciphertext attack (IND-CCA2), unforgeability under adaptive chosen warrant attack (EF-CWA), and unforgeability under adaptive chosen message attack (EF-CMA) in random oracle.


## 2. Preliminaries

This section introduces bilinear pairings, the definition of proxy signcryption scheme, and mathematical problems used for cryptography as follows.


### 2.1. Bilinear Pairings

The properties of bilinear pairings are introduced as follows. LetG1 be an additive cyclic group, let G2 be a multiplicative cyclic group, and let P be a generator of G1, where G1 and G2 have the prime order q. A bilinear pairing equation e: G1×G1→G2 satisfies the following properties:(1)
bilinear: givenP1, P2, Q1, Q2∈G1, e(P1+P2,Q1)=e(P1,Q1)e(P2,Q1) and e(P1,Q1+Q2)=e(P1,Q1)e(P1,Q2);besides, givena, b∈Zq, e(aP,bQ)=e(abP,Q)=e(P,abQ)=e(P,Q)ab=e(bP,aQ);(2)
nondegenerate: there existsP∈G1 and Q∈G1 such that e(P,Q)≠1, where 1 is the identity element of G2;(3)
computable: for anyP, Q∈G1, the value e(P,Q) is efficiently computed.


### 2.2. The Definition of Proxy Signcryption Scheme

The roles of a proxy signcryption scheme can be divided into three parties: an original signerUO, a proxy signer Up, and a designated recipient Uv. In a proxy signcryption scheme, an original signer generates a proxy credential to delegate his/her signing authority to a proxy signer. The proxy signer then generates a signcrypted message by using the proxy credential and his/her secret key. Next, the proxy signer sends the signcrypted message to a designated recipient through insecure network. Upon receiving the signcrypted message, only the designated recipient can recover the message content from the signcrypted message and then verify its validity. If a dispute occurs later, the message recipient can announce the proxy signature for public verification without extra computational cost. A proxy signcryption scheme consists of the following algorithms.(i)
Setup. This algorithm takes a secure parameter 1k as input and then returns public parameters of systemparams.(ii)
Proxy-Credential-Generation (PCG). This algorithm takes the private key of original signerosk and a warrant mw as input and then returns a proxy credential σp on the warrant mw for the proxy signer.(iii)
Signcrypted-Message-Generation (SMG). This algorithm takes a message m, a proxy credential σp, a warrant mw, a private key of proxy signerpsk, and a proxy credential as input and then outputs a signcrypted message σs.(iv)
Signature-Recovery-and-Verification (SRV). This algorithm takes a signcrypted message σs, the private key of designated recipientrsk, a warrant mw, and the public key pair of original signer and proxy signer (opk,ppk) and then returns a plaintext m and its converted ordinary proxy signature σ if the signcrypted message σs is valid. Otherwise, this algorithm returns an error symbol ¶.


### 2.3. Mathematical Problems for Cryptography

We introduce mathematical problems applied within our scheme for security as follows.Discrete Logarithm Problem (DLP). Given {P,Q=aP}∈G1, it is hard to find an integer a∈Zq* from Q=aP.Bilinear Diffie-Hellman Problem (BDHP). Given an instance {P,A=aP,B=bP,C=cP}∈G1 for some a,b,c∈Zq*, it is hard to compute e(P,P)abc, where P is the generator.


## 2.1. Bilinear Pairings

The properties of bilinear pairings are introduced as follows. LetG1 be an additive cyclic group, let G2 be a multiplicative cyclic group, and let P be a generator of G1, where G1 and G2 have the prime order q. A bilinear pairing equation e: G1×G1→G2 satisfies the following properties:(1)
bilinear: givenP1, P2, Q1, Q2∈G1, e(P1+P2,Q1)=e(P1,Q1)e(P2,Q1) and e(P1,Q1+Q2)=e(P1,Q1)e(P1,Q2);besides, givena, b∈Zq, e(aP,bQ)=e(abP,Q)=e(P,abQ)=e(P,Q)ab=e(bP,aQ);(2)
nondegenerate: there existsP∈G1 and Q∈G1 such that e(P,Q)≠1, where 1 is the identity element of G2;(3)
computable: for anyP, Q∈G1, the value e(P,Q) is efficiently computed.


## 2.2. The Definition of Proxy Signcryption Scheme

The roles of a proxy signcryption scheme can be divided into three parties: an original signerUO, a proxy signer Up, and a designated recipient Uv. In a proxy signcryption scheme, an original signer generates a proxy credential to delegate his/her signing authority to a proxy signer. The proxy signer then generates a signcrypted message by using the proxy credential and his/her secret key. Next, the proxy signer sends the signcrypted message to a designated recipient through insecure network. Upon receiving the signcrypted message, only the designated recipient can recover the message content from the signcrypted message and then verify its validity. If a dispute occurs later, the message recipient can announce the proxy signature for public verification without extra computational cost. A proxy signcryption scheme consists of the following algorithms.(i)
Setup. This algorithm takes a secure parameter 1k as input and then returns public parameters of systemparams.(ii)
Proxy-Credential-Generation (PCG). This algorithm takes the private key of original signerosk and a warrant mw as input and then returns a proxy credential σp on the warrant mw for the proxy signer.(iii)
Signcrypted-Message-Generation (SMG). This algorithm takes a message m, a proxy credential σp, a warrant mw, a private key of proxy signerpsk, and a proxy credential as input and then outputs a signcrypted message σs.(iv)
Signature-Recovery-and-Verification (SRV). This algorithm takes a signcrypted message σs, the private key of designated recipientrsk, a warrant mw, and the public key pair of original signer and proxy signer (opk,ppk) and then returns a plaintext m and its converted ordinary proxy signature σ if the signcrypted message σs is valid. Otherwise, this algorithm returns an error symbol ¶.


## 2.3. Mathematical Problems for Cryptography

We introduce mathematical problems applied within our scheme for security as follows.Discrete Logarithm Problem (DLP). Given {P,Q=aP}∈G1, it is hard to find an integer a∈Zq* from Q=aP.Bilinear Diffie-Hellman Problem (BDHP). Given an instance {P,A=aP,B=bP,C=cP}∈G1 for some a,b,c∈Zq*, it is hard to compute e(P,P)abc, where P is the generator.


## 3. Review and Cryptanalysis of the Proxy Signcryption Scheme of Lin et al.

This section briefly reviews the proxy signcryption scheme of Lin et al. [31] and then shows that their scheme is vulnerable to two forgery attacks as follows.


### 3.1. Review of the Proxy Signcryption Scheme of Lin et al.

We briefly review the proxy signcryption scheme of Lin et al. [31] in this subsection. Details of each algorithm are described as follows.Setup. Let G1 and G2 be two groups of the same prime order q, where P is a generator of G1. First of all, the system authority SA chooses a pairing function e: G1×G1→G2 and three collision-resistant hash functions: h1:{0,1}k×G1→Zq, h2:G1→G1, and h3:G2×G1→{0,1}k. Next, SA publishes (G1, G2, q, P, e, e(P,P), h1, h2, h3) as public parameters. Each signer also chooses a random number xi as his/her private key and then computes the corresponding public key Yi=xiP.Proxy-Credential-Generation. When an original signer UO wants to delegate his/her signing privilege to a proxy signer Up, the original signer UO chooses a random number d∈Zq and then generates a proxy credential (σ,N,mw) by computing the following equations:
(1)N=dP,σ=xo+d(mw)mod⁡q,
where mw is the warrant including the identities of the original signer UO and the proxy signer Up. Next, the original signer UO sends the proxy credential (σ,N,mw) to a proxy signer Up. After receiving the proxy credential (σ,N,mw), the proxy signer Up verifies the validity of the received proxy credential by computing the values at both sides of the equality symbol in the following equation:
(2)σP=Yo+mwN.
If (2) holds with the two computed values, the proxy credential (σ,N,mw) is accepted; otherwise, the proxy signer Up requests the original signer to resend the proxy credential (σ,N,mw).Signcrypted-Message-Generation. When the proxy signer Up wants to generate a signcrypted message on a plaintext message m∈R{0,1}k, he/she computes
(3)R=rP,S=r(h1(m,R)+xp+σ)-1P,V=e(h2(σYv),xpYv),X=EV(S),Y=h3(V,R)⊕m,
where r is a random number and EV is the symmetric encryption function with the secret key V. Next, the proxy signer Up sends the signcrypted message (R,X,Y,N) and mw to the designated recipient Uv.Signature-Recovery-and-Verification. For a signcrypted message (R,X,Y,N), the designated recipient Uv can recover the message m and the proxy signature (S,R,N) by computing the following equations:
(4)V=e(h2(xv(Yo+mwN)),xvYp),m=h3(V,R)⊕Y,S=DV(X),
where DV is the symmetric decryption function with the key V. Next, the recipient Uv verifies the validity of the proxy signature by computing the values at both sides of the equality symbol in the following equation:
(5)e(h1(m,R)P+Yp+Yo+mwN,S)=e(P,R).
If (5) holds with the two computed values, the proxy signature (S,R,N) is accepted by the designated recipient Uv; otherwise, the proxy signature (S,R,N) is rejected. In case a dispute occurs later, the designated recipient Uv can reveal the proxy signature as well as the message m and the warrant mw to any trusted third party. A trusted third party can use (5) to perform an evaluation task and know whether the proxy signer Up is dishonest or not.


### 3.2. Cryptanalysis of the Scheme of Lin et al.

Two forgery attacks on the scheme of Lin et al. are discovered by utilizing security weakness of the proxy credential through chosen warrant attack. Details of two forgery attacks are addressed as follows.Forgery Attack 1. We show that a malicious proxy signer can forge any valid proxy credential on his/her chosen warrant mw′ if he/she obtains a valid proxy credential as follows.Assume that a malicious proxy signer, who has a valid proxy credential(σ,N,mw) on a warrant mw, wants to forge a valid proxy credential (σ,N′,mw′) on his/her chosen warrant mw′. The malicious proxy signer needs to generate
(6)N′=mwmw′N,
where mw′ is his/her chosen warrant. Now, the forged proxy credential (σ,N′,mw′) is created by the malicious proxy signer without knowledge of the private key of the original signer.In the following, we show that the forged proxy credential(σ,N′,mw′) can pass the proxy credential verification equation shown in (2):
(7)σP=Yo+mw′N′=Yo+mw′mwmw′·dP=Yo+mwN,
where N′=(mw/mw′)N, N=dP.Forgery Attack 2. We show that any adversary can forge a proxy signature (S′,R′,N′) on his/her chosen message m′ and his/her chosen warrant mw′ without knowledge of any valid proxy credential (σ,N,mw), the private key of the original signer, and the private key of the proxy signer as follows.Assume that an adversaryA wants to forge a proxy signature (S′,R′,N′) on his/her chosen message m′and warrant mw′. The adversary A first computes
(8)N′=(mw′)-1(-YP-Yo),(9)R′=r′P,(10)S′=h1(m′,R′)-1R′,
where r′ is a random number. Now, the adversary A forges a valid proxy signature (S′,R′,N′) on his/her chosen message m′ and warrant mw′. In consequence, the proxy signcryption scheme of Lin et al. does not support nonrepudiation.In the following, we show that the forged proxy signature(S′,R′,N′) can pass the proxy signature verification equation shown in (5):
(11)e(h1(m′,R′)P+Yp+Yo+mw′N′,S′)=e(h1(m′,R′)P+Yp+Yo-Yo-Yp,S′)by(8)=e(h1(m′,R′)P,h1(m′,R′)-1R′)by(10)=e(P,R′).


## 3.1. Review of the Proxy Signcryption Scheme of Lin et al.

We briefly review the proxy signcryption scheme of Lin et al. [31] in this subsection. Details of each algorithm are described as follows.Setup. Let G1 and G2 be two groups of the same prime order q, where P is a generator of G1. First of all, the system authority SA chooses a pairing function e: G1×G1→G2 and three collision-resistant hash functions: h1:{0,1}k×G1→Zq, h2:G1→G1, and h3:G2×G1→{0,1}k. Next, SA publishes (G1, G2, q, P, e, e(P,P), h1, h2, h3) as public parameters. Each signer also chooses a random number xi as his/her private key and then computes the corresponding public key Yi=xiP.Proxy-Credential-Generation. When an original signer UO wants to delegate his/her signing privilege to a proxy signer Up, the original signer UO chooses a random number d∈Zq and then generates a proxy credential (σ,N,mw) by computing the following equations:
(1)N=dP,σ=xo+d(mw)mod⁡q,
where mw is the warrant including the identities of the original signer UO and the proxy signer Up. Next, the original signer UO sends the proxy credential (σ,N,mw) to a proxy signer Up. After receiving the proxy credential (σ,N,mw), the proxy signer Up verifies the validity of the received proxy credential by computing the values at both sides of the equality symbol in the following equation:
(2)σP=Yo+mwN.
If (2) holds with the two computed values, the proxy credential (σ,N,mw) is accepted; otherwise, the proxy signer Up requests the original signer to resend the proxy credential (σ,N,mw).Signcrypted-Message-Generation. When the proxy signer Up wants to generate a signcrypted message on a plaintext message m∈R{0,1}k, he/she computes
(3)R=rP,S=r(h1(m,R)+xp+σ)-1P,V=e(h2(σYv),xpYv),X=EV(S),Y=h3(V,R)⊕m,
where r is a random number and EV is the symmetric encryption function with the secret key V. Next, the proxy signer Up sends the signcrypted message (R,X,Y,N) and mw to the designated recipient Uv.Signature-Recovery-and-Verification. For a signcrypted message (R,X,Y,N), the designated recipient Uv can recover the message m and the proxy signature (S,R,N) by computing the following equations:
(4)V=e(h2(xv(Yo+mwN)),xvYp),m=h3(V,R)⊕Y,S=DV(X),
where DV is the symmetric decryption function with the key V. Next, the recipient Uv verifies the validity of the proxy signature by computing the values at both sides of the equality symbol in the following equation:
(5)e(h1(m,R)P+Yp+Yo+mwN,S)=e(P,R).
If (5) holds with the two computed values, the proxy signature (S,R,N) is accepted by the designated recipient Uv; otherwise, the proxy signature (S,R,N) is rejected. In case a dispute occurs later, the designated recipient Uv can reveal the proxy signature as well as the message m and the warrant mw to any trusted third party. A trusted third party can use (5) to perform an evaluation task and know whether the proxy signer Up is dishonest or not.


## 3.2. Cryptanalysis of the Scheme of Lin et al.

Two forgery attacks on the scheme of Lin et al. are discovered by utilizing security weakness of the proxy credential through chosen warrant attack. Details of two forgery attacks are addressed as follows.Forgery Attack 1. We show that a malicious proxy signer can forge any valid proxy credential on his/her chosen warrant mw′ if he/she obtains a valid proxy credential as follows.Assume that a malicious proxy signer, who has a valid proxy credential(σ,N,mw) on a warrant mw, wants to forge a valid proxy credential (σ,N′,mw′) on his/her chosen warrant mw′. The malicious proxy signer needs to generate
(6)N′=mwmw′N,
where mw′ is his/her chosen warrant. Now, the forged proxy credential (σ,N′,mw′) is created by the malicious proxy signer without knowledge of the private key of the original signer.In the following, we show that the forged proxy credential(σ,N′,mw′) can pass the proxy credential verification equation shown in (2):
(7)σP=Yo+mw′N′=Yo+mw′mwmw′·dP=Yo+mwN,
where N′=(mw/mw′)N, N=dP.Forgery Attack 2. We show that any adversary can forge a proxy signature (S′,R′,N′) on his/her chosen message m′ and his/her chosen warrant mw′ without knowledge of any valid proxy credential (σ,N,mw), the private key of the original signer, and the private key of the proxy signer as follows.Assume that an adversaryA wants to forge a proxy signature (S′,R′,N′) on his/her chosen message m′and warrant mw′. The adversary A first computes
(8)N′=(mw′)-1(-YP-Yo),(9)R′=r′P,(10)S′=h1(m′,R′)-1R′,
where r′ is a random number. Now, the adversary A forges a valid proxy signature (S′,R′,N′) on his/her chosen message m′ and warrant mw′. In consequence, the proxy signcryption scheme of Lin et al. does not support nonrepudiation.In the following, we show that the forged proxy signature(S′,R′,N′) can pass the proxy signature verification equation shown in (5):
(11)e(h1(m′,R′)P+Yp+Yo+mw′N′,S′)=e(h1(m′,R′)P+Yp+Yo-Yo-Yp,S′)by(8)=e(h1(m′,R′)P,h1(m′,R′)-1R′)by(10)=e(P,R′).


## 4. The Proposed Scheme

This section presents our efficient proxy signcryption scheme. Details of each algorithm are described as follows.Setup. Let G1 and G2 be two groups of the same prime order q and let P be a generator of G1. In the beginning, system authority SA chooses a pairing function e: G1×G1→G2 and four collision-resistant one-way hash functions: h1:{0,1}k×G1→Zq, h2:{0,1}k×G1→Zq, h3:G1→G1, and h4:G2×G1→{0,1}k. Then, SA publishes (G1, G2, q, P, e, e(P,P), h1, h2, h3, h4) as its public parameters. Each signer also chooses a random number xi as his/her private key and then computes his/her corresponding public key Yi=xiP.Proxy-Credential-Generation. Assume that an original signer UO wants to delegate his/her signing authority to a proxy signer; he/she first computes
(12)R1=r1P,(13)so=xo+h1(mw,R1)r1mod⁡q,
where r1 is a random number and mw is the warrant. The original signer UO then sends the proxy credential (R1, so, mw) to the proxy signer Up via a secure channel. Upon receiving the proxy credential (R1, so, mw), the proxy signer Up can verify its validity by computing the values at both sides of the equality symbol in the following equation:
(14)soP=Yo+h1(mw,R1)R1.
If (14) holds with the two computed values, the proxy credential is accepted; otherwise, the proxy credential signature is rejected. In the following, we show the derivation and verification process for (14):
(15)soP=(xo+h1(mw,R1)r1)Pby(13)=xoP+h1(mw,R1)r1P=Yo+h1(mw,R1)R1,
where xoP=Yo and R1=r1P.Signcrypted-Message-Generation. In order to generate a signcrypted message on his/her chosen message m, the proxy signer Up computes
(16)R2=r2P,(17)sp=1r2·h2(m,mw,R1,R2)+xp+soP,(18)V=e(h3(soYv),xpYv),(19)X=EV(sp),(20)Y=h4(V,R2)⊕m.
Then, the proxy signer Up sends the signcrypted message (R1, R2, X, Y) and the warrant mw to the designated recipient Uv.Signature-Recovery-and-Verification. Upon receiving a signcrypted message (R1, R2, X, Y), the recipient Uv first recovers the message m by computing the following equations:
(21)V=e(h3(xv(Yo+h1(mw,R1)R1)),xvYp),m=h4(V,R2)⊕Y.
Next, the recipient Uv computes
(22)sp=DV(X)
and then verifies the validity of the proxy signature (R1, R2, sp) by computing the values at both sides of the equality symbol in the following equation:
(23)e(h1(mw,R1)R1,sp)h2(m,mw,R1,R2)R2+Yp+Yo+h1(mw,R1)R1,sp)=e(P,P).
If (23) holds with the two computed values, the recipient Uv accepts the proxy signature; otherwise, he/she rejects the proxy signature. Notice that the value of e(P,P) is precomputed as one of the public parameters during system setup phase; therefore, the computational cost for the value of e(P,P) can be ignored here.If a dispute between the proxy signer and the recipient occurs, the designated recipientUv can send the message m, the warrant mw, and the proxy signature (R1, R2, sp) to any trusted third party. A trusted third party can use (23) to perform an evaluation task and know whether the proxy signer Up is dishonest.In the following, we show the derivation and verification process for (23):
(24)e(h2(m,mw,R1,R2)R2+Yp+Yo+h1(mw,R1)R1,sp)=e(1h2(m,mw,R1,R2)r2+xp+xO+h1(mw,R1)r1P)h2(m,mw,R1,R2)R2+Yp+Yo+h1(mw,R1)R1,1h2(m,mw,R1,R2)r2+xp+xo+h1(mw,R1)r1P)by(12),(14),(16),and(17)=e(P,P).


## 5. Security Analysis

In the literature of Lin et al. [31], they had proposed a security model for proxy signcryption scheme. However, the security model of Lin et al. is incomplete as unforgeability of proxy credential was not considered.To prove security robustness of the proposed proxy signcryption scheme, we propose a new security model for proxy signcryption scheme. Consequently, this proposed security model is applied to prove that our proposed scheme is secure in terms of IND-CCA2, EF-CWA, and EF-CMA under random oracle.


### 5.1. Security Model

Three security requirements for proxy signcryption scheme are message confidentiality, proxy credential unforgeability, and proxy signcryption unforgeability. We give a new security model for proxy signcryption scheme as follows.Definition 1 (confidentiality).
A proxy signcryption scheme achieves confidentiality under adaptive chosen ciphertext attacks if no adversaryA can play the following game with a challenger B and win this game within a probabilistic polynomial time period by possessing nonnegligible advantage.Setup. At the beginning, B runs this algorithm to generate all public parametersparams and then publishes them. Thus, A can obtain these public parametersparams.Phase 1.
An adversaryA has the ability to execute the following queries adaptively.(i)
Proxy-Credential-Generation (PCG) Query. When A calls the PCG query with his/her chosen warrant mw, B returns the corresponding proxy credential to A.(ii)
Signcrypted-Message-Generation (SMG) Query. When A calls the SMG query with his/her chosen message m, B first generates the proxy signature for the message m. Then, B generates the signcrypted message δ and then returns it to A.(iii)
Signature-Recovery-and-Verification (SRV) Query. When A calls the SRV query, upon receiving a signcrypted message δ and its warrant mw from A, B returns a plaintext message m and its convertible proxy signature if the signcrypted message is valid. Otherwise, B returns an error symbol ⊥ to A.Challenge. A sends two plaintext messages m0 and m1 to B, where these two messages with the same length are chosen by the adversary A. Next, B flips a coin λ→{0,1} and then generates a signcrypted message δ* for the message mλ. B sends the signcrypted message δ* to A as a challenge.Phase 2.
A has the ability to call several new queries defined in Phase 1. Once A receives the signcrypted message δ*,  A can call multiple queries except SRV queries to guess which message, m0 or m1, is signcrypted inside δ*.Guess. Finally, A outputs a bit λ′ as its guess. If λ′=λ, A wins this game, where the advantage of A to win the game is Adv(A)=|Pr[λ′=λ]-1/2|.Definition 2 (proxy credential unforgeability).
A proxy signcryption scheme achieves proxy credential unforgeability under adaptive chosen warrant attacks if no adversaryA can play the following game with a challenger B and win this game within a probabilistic polynomial time period by possessing nonnegligible advantage.Setup. In this algorithm, B generates all public parametersparams and then publishes these parameters. Thus, these parametersparams can be learned by A.Phase 1.
A can call multiple PCG queries defined in Phase 1 of Definition 1 with his/her chosen warrant mw.Forgery. The adversary A forges a valid proxy credential δ′ based on his/her chosen warrant mw′ without calling any PCG query.Definition 3 (proxy signcryption unforgeability).
A proxy signcryption scheme achieves proxy signcryption unforgeability under adaptive chosen message attacks if no adversaryA can play the following game with a challenger B and win this game within a probabilistic polynomial time period by possessing nonnegligible advantage.Setup. First of all, B runs the setup algorithm to generate all public parametersparams and then publishes these parameters. Therefore, A can obtain these parametersparams.Phase 1.
In this phase,A can ask B to generate the proxy signature with his/her chosen message m by calling PSG queries defined in Phase 1 of Definition 1.Forgery. The adversary A forges a valid proxy signature δ′′ based on his/her chosen message m′ without calling any PSG query.


### 5.2. Security Proof

This subsection shows the proposed scheme is secure against the chosen ciphertext attack (IND-CCA2), the adaptive chosen warrant attack (EF-CWA), and the adaptive chosen message attack (EF-CMA) under random oracle as follows.Theorem 4 (confidentiality).
Lettλ be the time for executing one bilinear pairing operation. If no adversary A can (t′,ε′)-break the bilinear Diffie-Hellman problem in probabilistic polynomial time, the proposed proxy signcryption scheme can (t,qh1,qh2,qh3,qh4,qPCG,qSMG,qSRV,ε)-withstand the existential forgery under adaptive chosen ciphertext attack (IND-CCA2) in random oracle model, where
(25)ε′≥(2ε-qSRV(2-k)),t′≈t+tλ(qSMG+2qSRV).Proof.
Suppose that an algorithmB tries to resolve BDHP by taking (P,aP,bP,cP) as inputs. The algorithm B simulates itself as the challenger to serve A in the following game, where A can only ask at most qhi times of hi oracles (i=1,2,3,4), qPCG times of PCG query, qSMG times of SMG query, and qSRV times of SRV query within the period of probabilistic polynomial time t.
Setup. B runs the setup algorithm to generate all necessary public parameters (G1, G2, q, P, e, h1, h2, h3, h4) and then sends (G1, G2, q, P, e, h1, h2, h3, h4) and (Yp=aP, Yv=bP, Yo=wP) to A.
Phase
1. In this phase, A can call the following queries supported by B.(i)
h1Hash Query. When A calls a h1 hash query on his/her chosen warrant mw and R1, B first checks whether (mw, R1) exists in the h1-list. If the pair indeed exists, B returns the existing v1 to A. Otherwise, B randomly selects a number v1∈Zp, stores (mw, R1, v1) into the h1-list, and returns v1 to A.(ii)
h2Hash Query. If A sends the tuple (m, mw, R1, R2) to the oracle h2 as a query request, B first checks whether the tuple exists in the h2-list. If it exists, B returns the existing v2 to A. Otherwise, B randomly selects a number v2∈Zp, stores (m, mw, R1, R2, v2) into the h2-list, and returns v2 to A.(iii)
h3Hash Query. If A calls a h3 hash query with the value soYv, B first checks whether this value exists in the h3-list. If it exists, B returns the existing V3 to A. Otherwise, B returns V3=v3P to A and then stores the tuple (soYv, v3, V3) into the h3-list, where v3∈Zp is a random number.(iv)
h4Hash Query. When A calls a h4 hash query with his own chosen value pair (V, R2), B first checks whether this pair (V, R2) exists in the h4-list. If the pair exists, B returns the existing v4 to A. Otherwise, B generates and returns v4 to A before storing the tuple (V, R2, v4) into the h4-list, where v4∈Zp is a random number.(v)
Proxy-Credential-Generation (PCG) Query. When A calls this query with his own chosen warrant mw, B first chooses two random numbers k1 and v1 and then computes so=k1P and R1=v1-1(k1P-wP), where v1=h1(mw,R1) has never been queried before. Then, B returns so and R1 to A.(vi)
Signcrypted-Message-Generation (SMG) Query. When A calls a SMG query with a message m, B first computes sp=k2P and R2=v2-1(k2-1P-aP-wP+v1R1), where k2, v1, and v2 are three random numbers and v2=h2(m,mw,R1,R2) and v1=h1(mw,R1) have never been queried before. Next, B calls an h3(so(bP)) query to get (v2,V2). B then computes V=e(v2(aP),(bP)) and the pair (X,Y), and then B returns the signcrypted message (R1,R2,X,Y) and the warrant mw to A.(vii)
Signature-Recovery-and-Verification (SRV) Query. When A calls a SRV query with a signcrypted message (R1, R2, X, Y) and its corresponding warrant mw, B searches the h4-list according to R1 and R2 and then recovers the message m. Next, B checks the validity of associated proxy signature. If the validity of the proxy signature is confirmed, B returns the warrant mw, the message m, and its proxy signature (R1, R2, sp). Otherwise, B returns ⊥ to indicate that the proxy signature is invalid.
Challenge. When A sends two plaintext messages m0 and m1 to B, B first calls a PCG query to obtain so*=k1P and R1*=v1*-1(k1P-wP), where k1 and v1 are two random numbers and v1*=h1(mw*,R1*) has never been queried before. Next, B flips a coin λ→{0,1} to determine the value of λ and accordingly calls one PCG query and one SMG query to compute R2*=v2*-1(k2-1P-aP-wP+v1*R1), sp*=k2P, and Y*=v3*⊕mλ, where h2(σ*Yv)=z(cP), V*=e(z(cP),a(bP)), v3*=h3(V*,R2*), and v2*=h2(m*,mw*,R1*,R2*). Finally, B returns the signcrypted message δ*={R1*,R2*,X*,V*,mw} for the message mλ.
Phase
2. A can call new queries defined in Phase  1, but A cannot call any SRV query for the signcrypted message δ*={R1*,R2*,X*,V*,mw} to get the message mλ.
Analysis of the Game. Let SRVERR be the event that a SRV query returns the failure message ⊥ for a valid signcrypted message δ={R1,R2,X,V,mw} during the entire game, let GP be the event that the entire game is perfect (i.e., no adversary can break the game.), and let QH4* be the event that indicates the total number of query times for h4 oracle. The advantage of A is defined as Adv(A) = |Pr[λ=λ′]-1/2|≤(1/2)Pr[¬GP]; in consequence, we have
(26)ε=|Pr[λ=λ′]-12|≤(12)Pr⁡[¬GP]=(12)(Pr[QH4*∨SRVERR])≤(12)(Pr[QH4*]+Pr[SRVERR]).
In Phase  2 of our game, if A never calls h4 hash query, the simulation will fail. Therefore, B would have nonnegligible probability to solve the bilinear Diffie-Hellman problem with probability at least
(27)ε′≥(2ε-qSRV(2-k)).
Time complexity of the algorithm B is t′≈t+tλ(qSMG+2qSRV), where tλ is the time for executing one bilinear pairing operation.Theorem 5 (proxy credential unforgeability).
The proposed proxy signcryption scheme is secure against existential forgery under adaptive chosen warrant attacks (EF-CWA) if no adversaryA can (t′,ε′)-break the DLP, where
(28)ε≥10(qPCG+1)(qPCG+qh1)2k,t′≤120686qh1tε.Proof.
We show that the proposed signcryption scheme can achieve security requirement for proxy credential unforgeability as follows, whereA can only call at most qhi times of hi oracles (i=1,2,3,4) and qPCG times of PCG query within the period of probabilistic polynomial time t. An algorithm B can be constructed to break the DLP by playing the game with an adversary A. In this game, the query algorithms and public parameters are the same as those ones defined in Theorem 4. Notice that each hash query has its own hash list to maintain corresponding tuples.
Setup. B runs the setup algorithm to generate all necessary public parameters (Yp=aP, Yv=bP, Yo=wP, G1, G2, q, P, e, h1, h2, h3, h4) for the adversary A.
Phase  1. In this phase, we allow A to call multiple PCG queries and h1 queries as those ones defined in Phase  1 of the proof of Theorem 4.
Analysis of the Game. Suppose that A can only call at most qPCG times of PCG query and qh1 times of h1 hash query, and the game simulation is perfect in random oracle. By applying the forking lemma, if ε≥10(qPCG+1)(qPCG+qh1)/2k, let B output two proxy credentials (so, R1, mw) and (so*, R1, mw) based on the same warrant mw such that h1(mw,R1)≠h1*(mw,R1). Then, B computes (so-so*)/(h1(mw,R1)-h1*(mw,R1))mod⁡q as the value of w*. According to the forking lemma, it indicates that B has the ability to solve one DLP instance within the period of time t′≤120686qh1t/ε.Theorem 6 (proxy signcryption unforgeability).
The proxy signcryption scheme can(t, qh1, qh2, qh3, qh4, qPCG, qSMG, qSRV, ε)-withstand adaptive chosen message attacks (EF-CMA) if no adversary A, who plays the game with the challenger B, can (t′,ε′)-break BDHP in probabilistic polynomial time t, where
(29)ε′≥(ε-(qh3+1)/2k)(qh3qh4),t′≈t+tλqSMG.Proof.
Suppose that an adversaryA can (t,qh1,qh2,qh3,qh4,qPCG,qSMG,qSRV,ε)-break the proposed scheme with nonnegligible advantage ε, where t indicates the maximum time consumption used to break the proposed scheme. In this game, the adversary A can call at most qhi times of hi oracles (i=1,…,4), qPCG times of PCG query, and qSMG times of SMG query. Then, an algorithm B can be constructed to break the BDHP problem by playing the game with an adversary A. The query algorithms and public parameters are the same as those ones defined in Theorem 4. Notice that each hash query has its own hash list to maintain corresponding tuples.
Setup. B runs this setup algorithm to generate all necessary public parameters (Yp=aP, Yv=bP, Yo=wP, G1, G2, q, P, e, h1, h2, h3, h4) and then returns these public parameters to A.
Phase
1. In this phase, A can call multiple PCG queries, SMG queries, and hi(i=1,…,4) queries as those ones defined in Phase 1 of the proof of Theorem 4.
Analysis of the Game. In the following, we prove that if an adversary A can break the proposed scheme, then there is an algorithm B which can break the BDHP problem. Assume that the adversary A can call at most qPCG times of PCG query and qhi times of hi hash queries (i=1,…,4). Let SMV be the event that the adversary A can forge a valid signature and let QH3 and QH4 be the events that indicate the total number of query times for h3 and h4 queries by the adversary A, respectively. Obviously, the probability that the adversary A can correctly guess the hash value without querying h3 or h4 hash queries is less than 2-k. Then, we have the following inequality:
(30)ε=Pr[SMV]=Pr[SMV∣QH3]+Pr[SMV∣¬QH3]≤Pr[SMV∣QH3]+2-k=Pr⁡[SMVQH3∧QH4]+Pr⁡[SMV∣QH3∧¬QH4]+2-k≤Pr[SMV∣QH3∧QH4]+qh3(2-k)+2-k.
Thus, we can rewrite the inequality to get the following inequality:
(31)Pr[SMV∣QH3∧QH4]≥ε-(qh3+1)2-k.
When the event SMV occurs under the condition that both h3 and h4 hash queries have been called, the probability that B returns V*z-1=e(P,P)abc is only (qh3qh4)-1. Therefore, the probability that B breaks BDHP is only
(32)ε′≥(ε-(qh3+1)/2k)(qh3qh4)
within the period of time t′≈t+tλqSMG, where tλ is the time for executing one bilinear pairing operation.


## 5.1. Security Model

Three security requirements for proxy signcryption scheme are message confidentiality, proxy credential unforgeability, and proxy signcryption unforgeability. We give a new security model for proxy signcryption scheme as follows.Definition 1 (confidentiality).
A proxy signcryption scheme achieves confidentiality under adaptive chosen ciphertext attacks if no adversaryA can play the following game with a challenger B and win this game within a probabilistic polynomial time period by possessing nonnegligible advantage.Setup. At the beginning, B runs this algorithm to generate all public parametersparams and then publishes them. Thus, A can obtain these public parametersparams.Phase 1.
An adversaryA has the ability to execute the following queries adaptively.(i)
Proxy-Credential-Generation (PCG) Query. When A calls the PCG query with his/her chosen warrant mw, B returns the corresponding proxy credential to A.(ii)
Signcrypted-Message-Generation (SMG) Query. When A calls the SMG query with his/her chosen message m, B first generates the proxy signature for the message m. Then, B generates the signcrypted message δ and then returns it to A.(iii)
Signature-Recovery-and-Verification (SRV) Query. When A calls the SRV query, upon receiving a signcrypted message δ and its warrant mw from A, B returns a plaintext message m and its convertible proxy signature if the signcrypted message is valid. Otherwise, B returns an error symbol ⊥ to A.Challenge. A sends two plaintext messages m0 and m1 to B, where these two messages with the same length are chosen by the adversary A. Next, B flips a coin λ→{0,1} and then generates a signcrypted message δ* for the message mλ. B sends the signcrypted message δ* to A as a challenge.Phase 2.
A has the ability to call several new queries defined in Phase 1. Once A receives the signcrypted message δ*,  A can call multiple queries except SRV queries to guess which message, m0 or m1, is signcrypted inside δ*.Guess. Finally, A outputs a bit λ′ as its guess. If λ′=λ, A wins this game, where the advantage of A to win the game is Adv(A)=|Pr[λ′=λ]-1/2|.Definition 2 (proxy credential unforgeability).
A proxy signcryption scheme achieves proxy credential unforgeability under adaptive chosen warrant attacks if no adversaryA can play the following game with a challenger B and win this game within a probabilistic polynomial time period by possessing nonnegligible advantage.Setup. In this algorithm, B generates all public parametersparams and then publishes these parameters. Thus, these parametersparams can be learned by A.Phase 1.
A can call multiple PCG queries defined in Phase 1 of Definition 1 with his/her chosen warrant mw.Forgery. The adversary A forges a valid proxy credential δ′ based on his/her chosen warrant mw′ without calling any PCG query.Definition 3 (proxy signcryption unforgeability).
A proxy signcryption scheme achieves proxy signcryption unforgeability under adaptive chosen message attacks if no adversaryA can play the following game with a challenger B and win this game within a probabilistic polynomial time period by possessing nonnegligible advantage.Setup. First of all, B runs the setup algorithm to generate all public parametersparams and then publishes these parameters. Therefore, A can obtain these parametersparams.Phase 1.
In this phase,A can ask B to generate the proxy signature with his/her chosen message m by calling PSG queries defined in Phase 1 of Definition 1.Forgery. The adversary A forges a valid proxy signature δ′′ based on his/her chosen message m′ without calling any PSG query.


## 5.2. Security Proof

This subsection shows the proposed scheme is secure against the chosen ciphertext attack (IND-CCA2), the adaptive chosen warrant attack (EF-CWA), and the adaptive chosen message attack (EF-CMA) under random oracle as follows.Theorem 4 (confidentiality).
Lettλ be the time for executing one bilinear pairing operation. If no adversary A can (t′,ε′)-break the bilinear Diffie-Hellman problem in probabilistic polynomial time, the proposed proxy signcryption scheme can (t,qh1,qh2,qh3,qh4,qPCG,qSMG,qSRV,ε)-withstand the existential forgery under adaptive chosen ciphertext attack (IND-CCA2) in random oracle model, where
(25)ε′≥(2ε-qSRV(2-k)),t′≈t+tλ(qSMG+2qSRV).Proof.
Suppose that an algorithmB tries to resolve BDHP by taking (P,aP,bP,cP) as inputs. The algorithm B simulates itself as the challenger to serve A in the following game, where A can only ask at most qhi times of hi oracles (i=1,2,3,4), qPCG times of PCG query, qSMG times of SMG query, and qSRV times of SRV query within the period of probabilistic polynomial time t.
Setup. B runs the setup algorithm to generate all necessary public parameters (G1, G2, q, P, e, h1, h2, h3, h4) and then sends (G1, G2, q, P, e, h1, h2, h3, h4) and (Yp=aP, Yv=bP, Yo=wP) to A.
Phase
1. In this phase, A can call the following queries supported by B.(i)
h1Hash Query. When A calls a h1 hash query on his/her chosen warrant mw and R1, B first checks whether (mw, R1) exists in the h1-list. If the pair indeed exists, B returns the existing v1 to A. Otherwise, B randomly selects a number v1∈Zp, stores (mw, R1, v1) into the h1-list, and returns v1 to A.(ii)
h2Hash Query. If A sends the tuple (m, mw, R1, R2) to the oracle h2 as a query request, B first checks whether the tuple exists in the h2-list. If it exists, B returns the existing v2 to A. Otherwise, B randomly selects a number v2∈Zp, stores (m, mw, R1, R2, v2) into the h2-list, and returns v2 to A.(iii)
h3Hash Query. If A calls a h3 hash query with the value soYv, B first checks whether this value exists in the h3-list. If it exists, B returns the existing V3 to A. Otherwise, B returns V3=v3P to A and then stores the tuple (soYv, v3, V3) into the h3-list, where v3∈Zp is a random number.(iv)
h4Hash Query. When A calls a h4 hash query with his own chosen value pair (V, R2), B first checks whether this pair (V, R2) exists in the h4-list. If the pair exists, B returns the existing v4 to A. Otherwise, B generates and returns v4 to A before storing the tuple (V, R2, v4) into the h4-list, where v4∈Zp is a random number.(v)
Proxy-Credential-Generation (PCG) Query. When A calls this query with his own chosen warrant mw, B first chooses two random numbers k1 and v1 and then computes so=k1P and R1=v1-1(k1P-wP), where v1=h1(mw,R1) has never been queried before. Then, B returns so and R1 to A.(vi)
Signcrypted-Message-Generation (SMG) Query. When A calls a SMG query with a message m, B first computes sp=k2P and R2=v2-1(k2-1P-aP-wP+v1R1), where k2, v1, and v2 are three random numbers and v2=h2(m,mw,R1,R2) and v1=h1(mw,R1) have never been queried before. Next, B calls an h3(so(bP)) query to get (v2,V2). B then computes V=e(v2(aP),(bP)) and the pair (X,Y), and then B returns the signcrypted message (R1,R2,X,Y) and the warrant mw to A.(vii)
Signature-Recovery-and-Verification (SRV) Query. When A calls a SRV query with a signcrypted message (R1, R2, X, Y) and its corresponding warrant mw, B searches the h4-list according to R1 and R2 and then recovers the message m. Next, B checks the validity of associated proxy signature. If the validity of the proxy signature is confirmed, B returns the warrant mw, the message m, and its proxy signature (R1, R2, sp). Otherwise, B returns ⊥ to indicate that the proxy signature is invalid.
Challenge. When A sends two plaintext messages m0 and m1 to B, B first calls a PCG query to obtain so*=k1P and R1*=v1*-1(k1P-wP), where k1 and v1 are two random numbers and v1*=h1(mw*,R1*) has never been queried before. Next, B flips a coin λ→{0,1} to determine the value of λ and accordingly calls one PCG query and one SMG query to compute R2*=v2*-1(k2-1P-aP-wP+v1*R1), sp*=k2P, and Y*=v3*⊕mλ, where h2(σ*Yv)=z(cP), V*=e(z(cP),a(bP)), v3*=h3(V*,R2*), and v2*=h2(m*,mw*,R1*,R2*). Finally, B returns the signcrypted message δ*={R1*,R2*,X*,V*,mw} for the message mλ.
Phase
2. A can call new queries defined in Phase  1, but A cannot call any SRV query for the signcrypted message δ*={R1*,R2*,X*,V*,mw} to get the message mλ.
Analysis of the Game. Let SRVERR be the event that a SRV query returns the failure message ⊥ for a valid signcrypted message δ={R1,R2,X,V,mw} during the entire game, let GP be the event that the entire game is perfect (i.e., no adversary can break the game.), and let QH4* be the event that indicates the total number of query times for h4 oracle. The advantage of A is defined as Adv(A) = |Pr[λ=λ′]-1/2|≤(1/2)Pr[¬GP]; in consequence, we have
(26)ε=|Pr[λ=λ′]-12|≤(12)Pr⁡[¬GP]=(12)(Pr[QH4*∨SRVERR])≤(12)(Pr[QH4*]+Pr[SRVERR]).
In Phase  2 of our game, if A never calls h4 hash query, the simulation will fail. Therefore, B would have nonnegligible probability to solve the bilinear Diffie-Hellman problem with probability at least
(27)ε′≥(2ε-qSRV(2-k)).
Time complexity of the algorithm B is t′≈t+tλ(qSMG+2qSRV), where tλ is the time for executing one bilinear pairing operation.Theorem 5 (proxy credential unforgeability).
The proposed proxy signcryption scheme is secure against existential forgery under adaptive chosen warrant attacks (EF-CWA) if no adversaryA can (t′,ε′)-break the DLP, where
(28)ε≥10(qPCG+1)(qPCG+qh1)2k,t′≤120686qh1tε.Proof.
We show that the proposed signcryption scheme can achieve security requirement for proxy credential unforgeability as follows, whereA can only call at most qhi times of hi oracles (i=1,2,3,4) and qPCG times of PCG query within the period of probabilistic polynomial time t. An algorithm B can be constructed to break the DLP by playing the game with an adversary A. In this game, the query algorithms and public parameters are the same as those ones defined in Theorem 4. Notice that each hash query has its own hash list to maintain corresponding tuples.
Setup. B runs the setup algorithm to generate all necessary public parameters (Yp=aP, Yv=bP, Yo=wP, G1, G2, q, P, e, h1, h2, h3, h4) for the adversary A.
Phase  1. In this phase, we allow A to call multiple PCG queries and h1 queries as those ones defined in Phase  1 of the proof of Theorem 4.
Analysis of the Game. Suppose that A can only call at most qPCG times of PCG query and qh1 times of h1 hash query, and the game simulation is perfect in random oracle. By applying the forking lemma, if ε≥10(qPCG+1)(qPCG+qh1)/2k, let B output two proxy credentials (so, R1, mw) and (so*, R1, mw) based on the same warrant mw such that h1(mw,R1)≠h1*(mw,R1). Then, B computes (so-so*)/(h1(mw,R1)-h1*(mw,R1))mod⁡q as the value of w*. According to the forking lemma, it indicates that B has the ability to solve one DLP instance within the period of time t′≤120686qh1t/ε.Theorem 6 (proxy signcryption unforgeability).
The proxy signcryption scheme can(t, qh1, qh2, qh3, qh4, qPCG, qSMG, qSRV, ε)-withstand adaptive chosen message attacks (EF-CMA) if no adversary A, who plays the game with the challenger B, can (t′,ε′)-break BDHP in probabilistic polynomial time t, where
(29)ε′≥(ε-(qh3+1)/2k)(qh3qh4),t′≈t+tλqSMG.Proof.
Suppose that an adversaryA can (t,qh1,qh2,qh3,qh4,qPCG,qSMG,qSRV,ε)-break the proposed scheme with nonnegligible advantage ε, where t indicates the maximum time consumption used to break the proposed scheme. In this game, the adversary A can call at most qhi times of hi oracles (i=1,…,4), qPCG times of PCG query, and qSMG times of SMG query. Then, an algorithm B can be constructed to break the BDHP problem by playing the game with an adversary A. The query algorithms and public parameters are the same as those ones defined in Theorem 4. Notice that each hash query has its own hash list to maintain corresponding tuples.
Setup. B runs this setup algorithm to generate all necessary public parameters (Yp=aP, Yv=bP, Yo=wP, G1, G2, q, P, e, h1, h2, h3, h4) and then returns these public parameters to A.
Phase
1. In this phase, A can call multiple PCG queries, SMG queries, and hi(i=1,…,4) queries as those ones defined in Phase 1 of the proof of Theorem 4.
Analysis of the Game. In the following, we prove that if an adversary A can break the proposed scheme, then there is an algorithm B which can break the BDHP problem. Assume that the adversary A can call at most qPCG times of PCG query and qhi times of hi hash queries (i=1,…,4). Let SMV be the event that the adversary A can forge a valid signature and let QH3 and QH4 be the events that indicate the total number of query times for h3 and h4 queries by the adversary A, respectively. Obviously, the probability that the adversary A can correctly guess the hash value without querying h3 or h4 hash queries is less than 2-k. Then, we have the following inequality:
(30)ε=Pr[SMV]=Pr[SMV∣QH3]+Pr[SMV∣¬QH3]≤Pr[SMV∣QH3]+2-k=Pr⁡[SMVQH3∧QH4]+Pr⁡[SMV∣QH3∧¬QH4]+2-k≤Pr[SMV∣QH3∧QH4]+qh3(2-k)+2-k.
Thus, we can rewrite the inequality to get the following inequality:
(31)Pr[SMV∣QH3∧QH4]≥ε-(qh3+1)2-k.
When the event SMV occurs under the condition that both h3 and h4 hash queries have been called, the probability that B returns V*z-1=e(P,P)abc is only (qh3qh4)-1. Therefore, the probability that B breaks BDHP is only
(32)ε′≥(ε-(qh3+1)/2k)(qh3qh4)
within the period of time t′≈t+tλqSMG, where tλ is the time for executing one bilinear pairing operation.


## 6. Comparisons on Security and Performance

In this section, we compare the proposed scheme with other existing schemes including the scheme of Li and Chen (LC) [26], the scheme of Wang and Cao (WC) [27], the scheme of Duan et al. (DCZ) [28], the scheme of Elkamchouchi and Abouelseoud (EA) [30], and the scheme of Lin et al. (LWHY) [31]. The comparison on security strength among targeted proxy signcryption schemes is given in Table 1. From Table 1, one can observe that only the proposed scheme provides formal security proof on proxy credential unforgeability. In addition, only the LC scheme, the WC scheme, and the proposed scheme are secure against key-compromised attack and forgery attack. The comparison on performance efficiency among targeted schemes is shown in Table 2. As pairing operation is the most time-consuming operation in comparison with the other computing operations used among targeted schemes [37], only the total number of pairing operations is used to measure performance efficiency for all targeted schemes in Table 2. From Table 2, it is obvious that our scheme is the most efficient proxy signcryption scheme in terms of time consumption for scheme operation. In summary, our scheme provides better security strength and achieves the most efficient operation design among existing schemes.Table 1
Security strength comparison among proxy signcryption schemes.
LC
WC
DCZ
EA
LWHY
Ours
Resistance to key-compromised attack
Yes
Yes
No
No
Yes
Yes
Public verifiability
Yes
Yes
Yes
No
Yes
Yes
Security proof on confidentiality
No
No
No
No
Yes
Yes
Unforgeability proof on proxy credential
No
No
No
No
No
Yes
Unforgeability proof on proxy signcryption
No
No
No
No
Yes
Yes
Resistance to forgery attacks
Yes
Yes
Yes
Yes
No
YesTable 2
Performance efficiency comparison in terms of the total number of pairing operations required among proxy signcryption schemes.
LC
WC
DCZ
EA
LWHY
Ours
Pairing operations for PCG
3
2
3
3
0
0
Pairing operations for SMG
2
1
2
2
1
1
Pairing operations for SRV
8
3
4
7
3
2
The total computation cost(number of pairing operations)
13
6
9
12
4
3


## 7. Conclusion

This paper first shows that the scheme of Lin et al. [31] is vulnerable to two forgery attacks based on chosen warrant attack. Later, a new proxy signcryption scheme is introduced. The proposed scheme only requires one pairing operation to verify the validity of a proxy signature; therefore, the proposed scheme is computationally more efficient than other existing schemes. Moreover, a new security model for proxy signcryption scheme is derived and adopted to prove our scheme achieves the following security features: IND-CCA2, EF-CWA, and EF-CMA under random oracle model.



---

*Source: 454393-2014-05-19.xml*