# Anonymous and Efficient Certificateless Multirecipient Signcryption Scheme for Ecological Data Sharing

Authors: Pengfei Su; Yong Xie; Ping Liu
Journal: Journal of Sensors
 (2020)

---

## Abstract

Air pollution, water pollution, soil erosion, land desertification, and other environmental issues are becoming more and more serious. And ecological security has become a key issue for the sustainable development of the world, so research on ecology has received more and more attention. At present, ecological data is collected and stored separately by various departments or agencies. In order to conduct better research, various institutions or individuals begin to share their own data. However, data sharing between different organizations is affected by many factors, especially data security issues. At the moment, there is no scheme that has been commonly recognized to solve the problem of ecological data sharing. To provide a secure data sharing way for ecological research, a certificateless multireceiver signcryption scheme is proposed. In this paper, the proposed scheme can solve the key escrow problem, and it can improve efficiency on the basis of ensuring security by adopting elliptic curve cryptography (ECC). A rigorous security analysis proves that the scheme can resist various security attacks and ensure privacy protection based on a random oracle model. Performance analysis also shows that this scheme has the advantage of computational overhead compared to the same type of scheme. Therefore, the scheme is very suitable for the safe sharing of ecological data.


---

## Body

## 1. Introduction

Ecological data is receiving more and more attentions nowadays. It plays an important role in global climate change prediction, ecological network observation and simulation, regional air pollution control, and so on. However, the scope, degree, quality, and usability of data sets mastered by different research institutions vary greatly, which is not conductive to the research in related fields. In order to solve this problem, relevant organizations begin to share their own data, which enables researchers to find and reuse relevant data. Combining data from multiple sources can better raise new questions and accelerate the pace of science. Sharing of relevant data can also make the related scientific research more transparent, which helps boost public trust.In the process of information sharing, on the one hand, the sender of the information only wants the authorized receiver to receive the correct information in order to prevent the information from being maliciously revealed. On the other hand, the recipient of the message wants to verify the sender of the message to prevent the message from being tampered with and the sender from being forged.In view of all the requirements above, the information sent needs to be confidential and verifiable. The confidentiality needs to be implemented by encryption, and the verification needs to be implemented by signature. Traditionally, the method of first signing and then encrypting is adopted, but it is too computationally intensive resulted in the low efficiency. In order to improve the efficiency on the basis of ensuring confidentiality and verification of messages, Zheng [1] proposed the concept of signcryption, which enables encryption and signature to be performed simultaneously; therefore, encryption and signature functions can be realized by one signcryption.With the development of communication, the identity-based multireceiver encryption (IMRE) proposal was presented by Baek et al. [2]; this proposal can encrypt multiple recipients’ messages by one calculation. And then, the IMRE schemes [3–5] were proposed successively. Subsequently, on the basis of the scheme in [2], the identity-based multireceiver signcryption (IMRS) proposal was presented by Duan and Cao [6]. According to this scheme, the sender only needs to perform a signcryption operation to simultaneously send messages to multiple authorized recipients, and each authorized recipient can perform corresponding decryption and verification. The ciphertext received by the receiver does not contain a list of receiver identity information, and the receiver cannot find the relevant information in the ciphertext. It is more effective than one-to-one scheme and is an ideal choice for information sharing. Then, many IMRS schemes [7–14] were proposed. What is more, communicators are paying more and more attentions to personal privacy issues. Usually, people intend to conceal their identities when they use multireceiver signcryption-related devices. In order to realize anonymity, Fan et al. [15] proposed the first anonymous IMRE scheme. However, Wang et al. [16] proposed that the scheme in [15] does not truly achieve that goal. Also, Wang et al. [16] proposed a new anonymity scheme, but Li and Pang [17] proposed that the scheme in [16] still could not completely realize anonymity either. Later, Fan and Tseng [18] proposed an anonymous IMRE scheme and the receiver of the scheme has the capability of identity verification, but the efficiency is not high because of the excessive bilinear parings operations in the scheme. Then, Pang et al. [19] put forward an absolutely cryptonymous IMRS proposal which can realize the anonymity of the receiver and sender. Gradually, people have found a serious problem that these multireceiver schemes have key escrow problems because they cannot block malicious key generation center (KGC) attacks. If nothing is done to solve this problem, the KGC can view all users’ communications and can pretend to be any user, which is insecure.Given the above requirements, Al-Riyami and Paterson [20] proposed a certificateless public key cryptosystem. For the user in this system, he and KGC jointly generate his private key, and the system parameters and his private key jointly determine his public key. The scheme in [20] can solve the problem of certificate management in traditional public key cryptography and key escrow in identity-based cryptosystems, so the certificateless multirecipient scheme has become a research hotspot. Influenced by the scheme in [20], the proposals [21–24] were successively put forward. Selvi et al. [25] came up with the earliest certificateless multireceiver signcryption (CMRS) scheme, but it does not have the confidentiality of messages under external attacks and is inefficient due to the use of a large number of bilinear pairing operations (BPO).Gradually, people began to pursue efficiency on the basis of satisfying the safety function. A cryptonymous certificateless multireceiver encryption (CMRE) proposal was presented by Islam et al. [26]. In order to improve efficiency, the scheme in [26] uses scalar point multiplication operations on elliptic curve cryptography (SPMOOECC), which does not use BPO. Since schemes in [26] can still further improve efficiency, schemes in [27–30] have been proposed successively. The scheme in [27] used the BPO and map-to-point hash function (MTPHF), scheme in [28] and scheme in [30] used lots of SPMOOECC, and scheme in [29] used BPO in the decryption step, all of which greatly limit the efficiency of the scheme. Among them, schemes in [26–30] have no signature function and cannot resist forgery attacks, and schemes in [25, 27–29] did not successfully achieve fair decryption, nor did they implement the verification of part of the private key.Through the analysis of the schemes, we found that the multirecipient signcryption scheme is required to solve the main problems as below during the communication process:(1)
Key escrow problem: malicious KGC can forge encrypted ciphertext and decrypt ciphertext, which dramatically reduces the confidentiality of the message. In order to prevent malicious KGC attacks, we need to solve the key escrow problem(2)
The calculation efficiency is not ideal: in the process of encryption or decryption, BPO or a large number of SPMOOECC will result in inefficiencyIn view of the requirements of ecological data sharing communication and taking into account the shortcomings of existing communication mechanisms, we propose a CMRS scheme for ecological data sharing. Relevant institutions or researchers can send data to other researchers or related institutions through our program. The communication process is shown in Figures1 and 2. When multiple researchers or related organizations share relevant ecological data (such as forest ecological data, grassland ecological data, and desert ecological data), they first exchange key with KGC to obtain their own public key and private key; then, they signcrypt the data and send the signcrypted message to the cloud space; finally, the signcrypted data in the cloud space will be forwarded to the authorized recipient and the receiver performs verification and decryption after receiving the message.Figure 1
Ecological data sharing application framework.Figure 2
Ecological data sharing network framework.The specific features of the scheme are as follows:(1)
The scheme realizes the anonymity of the receiver. Not only the attacker cannot obtain the information of the receiver, but also the receiver does not know the information of other receivers(2)
The scheme uses a certificateless method and can perform partial private key verification. It not only solves the key escrow problem but also ensures the correctness of some private keys received from KGC(3)
The scheme is of high efficiency. Instead of using BPO and exponential operations in the signcryption and decryption phases, the scheme uses the SPMOOECC during encryption and decryption processes and minimizes the number of SPMOOECC, which greatly increases efficiencyFinally, in using the stochastic prediction model, we prove the confidentiality, unforgeability, and recipient anonymity of our CMRS scheme based on the difficult problems.The rest of the paper is as follows: in the second part, the initial knowledge is described. In the third part, the proposed scheme is described. In addition, in the fourth part, the correctness and security of the scheme were analyzed. Next, in the fifth part, the proposed scheme and the existing scheme are compared in terms of efficiency and functionality. Finally, the sixth section summarizes this paper.For ease of understanding, the symbols used are listed in Table1.Table 1
Notations.
NameMeaningBPOBilinear pairing operationsMTPHFMap-to-point hash functionECCElliptic curve cryptographyKGCKey generation centerSPMOOECCScalar point multiplication operations on elliptic curve cryptographyCDHPComputational Diffie-Hellman problemECDLPElliptic curve discrete logarithm problemGpA cycle group of points on ECCPKiPublic key of useri, i represents the user’s identityPGenerator ofGppLarge prime integerPrThe probability of an eventSKiPrivate key of useri, i represents the user’s identityZp∗Nonzero multiplicative group with large primepIMEIdentity-based multireceiver encryptionIMSIdentity-based multireceiver signcryptionCMECertificateless multireceiver encryptionCMSCertificateless multireceiver signcryption


## 2. Preliminaries

We will make an introduction of difficult problems, algorithm model, and security models.


### 2.1. Difficult Problems

It is specified thatGp is a cyclic group on ECC, the generator of Gp is the P, and Zp∗ is the nonzero multiplication group, which depend on the big prime number p. The elliptic curve discrete logarithm problem (ECDLP) and Diffie-Hellman problem (CDHP) are described below:(1) CDHP. Known P,xP,yP∈Gp,x,y∈Zp∗, calculating xyP∈Gp is CDHPDefinition 1.
If the probabilistic polynomial time (PPT) algorithm A can solve CDHP, the probability advantage is specified as(1)AdυACDHP=PrAP,xP,yP=xyP.
CDHP hypothesis: we believe that AdυACDHP can be ignored for any PPT algorithm A.(2) ECDLP. Known P,xP∈Gp,x∈Zp∗, calculating x is ECDLPDefinition 2.
If the PPT algorithm B can solve CDHP, the probability advantage is specified as(2)AdυBECDLP=PrBP,xP=x.
ECDLP hypothesis: we believe that AdυBECDLP can be ignored for any PPT algorithm B.


### 2.2. Algorithm Model

Definition 3.
The algorithm model of this proposal consists ofSetUpAlgorithm, SetSecretValueAlgorithm, ExtractPartialPrivateKeyAlgorithm, SetPublicAndPrivateKeysAlgorithm, SigncryptionAlgorithm, and DesigncryptionAlgorithm:SetUpAlgorithm: input λ, λ is the security parameter; KGC executes the algorithm; the system’s master key s and the public parameter pars are generated by KGC; and KGC exposes pars and secretly saves s.SetSecretValueAlgorithm: enter IDi, IDi is the user’s information; the user executes the algorithm; and the user gets the secret value xi and the secret value parameter Xi .ExtractPartialPrivateKeyAlgorithm: enter the user’s information IDi, the master key s, the secret value parameter Xi, and the public key parameter pars. For the user, KGC uses this algorithm to obtain the partial private key zi and key generation parameter Wi.SetPublicAndPrivateKeysAlgorithm: input the parameter pars of the system, the information IDi of the user, the partial private key zi of the user, the secret value xi, and the key generation parameter Wi and the user uses the algorithm to obtain public key pair PKi and the private key pair SKi.SigncryptionAlgorithm: input the system’s public parameter pars, receiver information L=ID1,ID2⋯.IDn, plaintext M, the recipient’s public key PKi1≤i≤n, the private key SKc of THE transmitter, and the information IDc of the transmitter. The transmitter initiates the algorithm to obtain the ciphertext C=Signcryptionpars,M,L,PKi,SKc,IDc.DesigncryptionAlgorithm: enter the public parameter pars, the recipient’s private key SKi, the recipient’s information IDi, and ciphertext C. The receiver uses the algorithm to gain the plaintext M=Designcryptionpars,C,SKi,IDi and verifies M using the sender’s public key PKc.


### 2.3. Security Models

The security model required for our scheme consists of information confidentiality, unforgeability, and recipient anonymity. In each security model, there are two types of opponents, calledA1 and A2 [20]. A1 does not know the system master key but A2 does, and A1 can replace the user’s public key but A2 cannot. Specific descriptions are as follows:


#### 2.3.1. Information Confidentiality

Information confidentiality means that an attacker cannot successfully decrypt a plaintext message in his or her own attack. In this scheme, information confidentiality is the indistinguishability of certificateless signcryption in the context of selecting ciphertext attack and selective multiple ID (IN-CMRS-CA) [25]. We defined Game1 for A1’s IN-CMRS-CA and Game2 for A2’s IN-CMRS-CA.Game1: this game is the interaction of opponent A1 and challenger C in the context of IN-CMRS-CA.Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then sends the pars to the A1 and secretly saves s. After A1 receives the pars, the A1 outputs a group of target identities L=ID1,ID2,⋯,IDn, where n is a positive integer.Phase 4.
A1 requires C to perform flexible queries, and C performs feedback. The details are the following:SetSecretValueQuery: A1 requires C to run the SetSecretValueQuery on the ID. After the request is received, C uses the SetSecretValueAlgorithm to get the user’s secret value, and C transmits the result to A1.ExtractPartialPrivateKeyQuery: A1 lets C run the ExtractPartialPrivateKeyQuery against the ID. After the request is received, C executes the ExtractPartialPrivateKeyAlgorithm to gain the partial private key of the user and sends result to A1.SetPublicAndPrivateKeysQuery:A1 requires C to run the SetPublicAndPrivateKeysQuery on the ID. After receiving the request, C executes the SetPublicAndPrivateKeysAlgorithm to get the public and private keys of user and returns them to A1.PublicKeyReplacementQuery: A1 requires C to use the PK’ID to run the PublicKeyReplacementQuery on the ID. Upon receipt, C will retain the PK’ID as the new public key.SigncryptionQuery: A1 lets C perform the SigncryptionQuery with a series of information and plaintext M. After the request is received, C randomly selects the information IDs to execute the SigncryptionAlgorithm to obtain the ciphertext C and transmits C to A1.DesigncryptionQuery: A1 requires C to perform the DesigncryptionQuery for ciphertext C. After the request is received, C executes the DesigncryptionAlgorithm to obtain the plaintext M, after that, verify that M is compliant, and returns M toA1.Challenge: A1 chooses a pair of plaintext M0,M1, the length of the plaintext is the same, and transmits M0,M1 to C. C selects φ∈0,1; then, C uses the selected plaintext Mφ to obtain C∗ and C transmits C∗ to A1.Phase 5.
A1 wants C to provide the same query as Phase 4, but A1 cannot perform the private key portion of SetPublicAndPrivateKeysQuery and ExtractPartialPrivateKeyQuery on the user who has replaced the public key. A1 cannot perform DesigncryptionQuery on ciphertext C∗.Guess: A1 gives φ∗, and if φ∗=φ can be determined, A1 wins, otherwise, A1 fails. The probability advantage of A1 winning is defined as follows:
(3)AdvIN−CMRS−CAA1=2Prφ∗=φ−1.Definition 6.
The probability that anyA1 in the case of IN-CMRS-CA can obtain the Game1 victory in time τ can satisfy AdvIN−CMRS−CAA1≤ε, indicating that the scheme conforms to τ,ε-IN-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game2: this game is the interaction of opponent A2 and challenger C in the context of IN-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits the result to the A2. After successful reception, A2 gives a set of target identifiers L=ID1,ID2,ID3,⋯,IDn,n is a positive integer.Phase 7.
A2 makes a series of queries to C like Phase 4 of Game1, but A2 cannot carry out PublicKeyReplacementQuery. C responds accordingly.Challenge: A2 selects a pair of plaintext M0,M1; the length of the plaintext is the same and transmits M0,M1 to C. C selects φ∈0,1; then, C uses the selected plaintext Mφ to obtain C∗, C transmits C∗ to A2.Phase 8.
A2 needs C to perform the same query as Phase 4, but A2 cannot execute the SetSecretValueQuery for the target identity L, and A2 cannot run the DesigncryptionQuery against the ciphertext C∗.Guess: A2 gives φ∗, and if φ∗=φ can be determined, A2 wins, otherwise, A2 fails. The probability advantage of A2 winning is defined as follows:
(4)AdvIN−CMRS−CAA2=2Prφ∗=φ−1.Definition 9.
The probability that anyA2 in the case of IN-CMRS-CA can obtain the Game2 victory in time τ can satisfy AdvIN−CMRS−CAA2≤ε, indicating that the scheme conforms to τ,ε-IN-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents a time of a polynomial operation.


#### 2.3.2. Unforgeability

The unforgeability of the proposal in this paper is prescribed as the strong unforgeability of certificateless signcryption in the context of selecting ciphertext attacks and optional multiple ID (SU-CMRS-PA) [25]. Game3 and Game4 are used to describe the SU-CMRS-PA of the opponent A1 and A2, respectively.Game3: this section is the mutual response between C and A2 under SU-CMRS-PA. The details are the following:Setup.
This procedure is similar to Setup inGame1.Attack: A1 requires C to perform flexible queries. The queries are similar to Phase 4 in Game1, after which C responds.Forgery: A1 uses L=ID1,ID2,⋯,IDn and plaintext M to forge ciphertext C∗. If any recipient in L can correctly decrypt C∗, then A1 wins, otherwise A1 fails. In this process, SigncryptionQuery cannot get C∗, other restrictions are similar to Phase 5 in Game1.Definition 10.
The probability that anyA1 in the case of SU-CMRS-PA can obtain the Game3 victory in time τ can satisfy AdvSU−CMRS−PAA1≤ε, indicating that the scheme conforms to τ,ε-SU-CMRS-PA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game4: this process is the interaction between C and A2 under SU-CMRS-PA. The details are the following:Setup.
This procedure is similar toSetup in Game2.Attack: A2 performs flexible queries for C. The queries are similar to Phase 4 in Game2, after which C responds.Forgery: A2 uses L=ID1,ID2,⋯,IDnand plaintext M to forge ciphertext C∗. If any recipient in L can correctly decrypt C∗, then A2 wins, otherwise A2 fails. In this process, SigncryptionQuery cannot get C∗, and the other restrictions are similar to Phase 5 in Game2.Definition 11.
The probability that anyA2 in the case of SU-CMRS-PA can obtain the Game4 victory in time τ can satisfy AdvSU−CMRS−PAA2≤ε, indicating that the scheme conforms to τ,ε-SU-CMRS-PA security, ε represents a probabilistic advantage that is not negligible. τ represents the time of a polynomial operation.


#### 2.3.3. Receiver Anonymity

In this scheme, receiver anonymity is prescribed as the anonymous indistinguishability of certificateless signcryption in the context of selecting ciphertext attacks and selective multiple ID (ANO-CMRS-CA) [26]. Game5 and Game6 each implement ANO-CMRS-CA for A1 and A2.Game5: this process is the interaction between C and A1 under ANO-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits pars to A1 and secretly saves s. After receiving, A1 selects L=ID0,ID1 and sends L to C.Phase 12.
This procedure is similar to Phase4 in Game1.Challenge: A1 picks identity list L∗=ID2,ID3,⋯,IDn and plaintext M, A1 transmits them to C. C selects e∈0,1 and forms the ciphertext C∗ with a new set of identity list L∗∗=IDe,ID2,ID3,⋯,IDn, and C transmits C∗ to A1.Phase 13.
This procedure is similar to Phase5 in Game1.
Guess: A1 gives e∗, and If e∗=e can be determined, A1 wins, otherwise, A1 fails. The probability advantage of A1 winning is defined as follows:
(5)AdvANO−CMRS−CAA1=2Pre∗=e−1.Definition 14.
The probability that anyA1 in the case of I ANO-CMRS-CA can obtain the Game5 victory in time τ can satisfy AdvANO−CMRS−CAA1≤ε, indicating that the scheme conforms to τ,ε-ANO-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game6: this process is the interaction between C and A2 under ANO-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits the result to A2, A2 selects L=ID0,ID1 and output L.Phase 15.
This procedure is similar to Phase4 in Game2.Challenge: A2 picks identity list L∗=ID2,ID3,⋯,IDn and a plaintext M, A2 transmits L∗ and M to C. C selects e∈0,1 and forms a ciphertext with a new set of identity list L∗∗=IDe,ID2,ID3,⋯,IDn, and C sends C∗ to A2.Phase 16.
This procedure is similar to Phase5 in Game2.
Guess: A2 gives e∗, and if e∗=e can be determined, A2 wins, otherwise, A2 fails. The probability advantage of A2 winning is defined as follows:
(6)AdvANO−CMRS−CAA2=2Pre∗=e−1.Definition 17.
The probability that anyA2 in the case of ANO-CMRS-CA can obtain the Game6 victory in time τ can satisfy AdvANO−CMRS−CAA2≤ε, indicating that the scheme conforms to τ,ε-ANO-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.


## 2.1. Difficult Problems

It is specified thatGp is a cyclic group on ECC, the generator of Gp is the P, and Zp∗ is the nonzero multiplication group, which depend on the big prime number p. The elliptic curve discrete logarithm problem (ECDLP) and Diffie-Hellman problem (CDHP) are described below:(1) CDHP. Known P,xP,yP∈Gp,x,y∈Zp∗, calculating xyP∈Gp is CDHPDefinition 1.
If the probabilistic polynomial time (PPT) algorithm A can solve CDHP, the probability advantage is specified as(1)AdυACDHP=PrAP,xP,yP=xyP.
CDHP hypothesis: we believe that AdυACDHP can be ignored for any PPT algorithm A.(2) ECDLP. Known P,xP∈Gp,x∈Zp∗, calculating x is ECDLPDefinition 2.
If the PPT algorithm B can solve CDHP, the probability advantage is specified as(2)AdυBECDLP=PrBP,xP=x.
ECDLP hypothesis: we believe that AdυBECDLP can be ignored for any PPT algorithm B.


## 2.2. Algorithm Model

Definition 3.
The algorithm model of this proposal consists ofSetUpAlgorithm, SetSecretValueAlgorithm, ExtractPartialPrivateKeyAlgorithm, SetPublicAndPrivateKeysAlgorithm, SigncryptionAlgorithm, and DesigncryptionAlgorithm:SetUpAlgorithm: input λ, λ is the security parameter; KGC executes the algorithm; the system’s master key s and the public parameter pars are generated by KGC; and KGC exposes pars and secretly saves s.SetSecretValueAlgorithm: enter IDi, IDi is the user’s information; the user executes the algorithm; and the user gets the secret value xi and the secret value parameter Xi .ExtractPartialPrivateKeyAlgorithm: enter the user’s information IDi, the master key s, the secret value parameter Xi, and the public key parameter pars. For the user, KGC uses this algorithm to obtain the partial private key zi and key generation parameter Wi.SetPublicAndPrivateKeysAlgorithm: input the parameter pars of the system, the information IDi of the user, the partial private key zi of the user, the secret value xi, and the key generation parameter Wi and the user uses the algorithm to obtain public key pair PKi and the private key pair SKi.SigncryptionAlgorithm: input the system’s public parameter pars, receiver information L=ID1,ID2⋯.IDn, plaintext M, the recipient’s public key PKi1≤i≤n, the private key SKc of THE transmitter, and the information IDc of the transmitter. The transmitter initiates the algorithm to obtain the ciphertext C=Signcryptionpars,M,L,PKi,SKc,IDc.DesigncryptionAlgorithm: enter the public parameter pars, the recipient’s private key SKi, the recipient’s information IDi, and ciphertext C. The receiver uses the algorithm to gain the plaintext M=Designcryptionpars,C,SKi,IDi and verifies M using the sender’s public key PKc.


## 2.3. Security Models

The security model required for our scheme consists of information confidentiality, unforgeability, and recipient anonymity. In each security model, there are two types of opponents, calledA1 and A2 [20]. A1 does not know the system master key but A2 does, and A1 can replace the user’s public key but A2 cannot. Specific descriptions are as follows:


### 2.3.1. Information Confidentiality

Information confidentiality means that an attacker cannot successfully decrypt a plaintext message in his or her own attack. In this scheme, information confidentiality is the indistinguishability of certificateless signcryption in the context of selecting ciphertext attack and selective multiple ID (IN-CMRS-CA) [25]. We defined Game1 for A1’s IN-CMRS-CA and Game2 for A2’s IN-CMRS-CA.Game1: this game is the interaction of opponent A1 and challenger C in the context of IN-CMRS-CA.Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then sends the pars to the A1 and secretly saves s. After A1 receives the pars, the A1 outputs a group of target identities L=ID1,ID2,⋯,IDn, where n is a positive integer.Phase 4.
A1 requires C to perform flexible queries, and C performs feedback. The details are the following:SetSecretValueQuery: A1 requires C to run the SetSecretValueQuery on the ID. After the request is received, C uses the SetSecretValueAlgorithm to get the user’s secret value, and C transmits the result to A1.ExtractPartialPrivateKeyQuery: A1 lets C run the ExtractPartialPrivateKeyQuery against the ID. After the request is received, C executes the ExtractPartialPrivateKeyAlgorithm to gain the partial private key of the user and sends result to A1.SetPublicAndPrivateKeysQuery:A1 requires C to run the SetPublicAndPrivateKeysQuery on the ID. After receiving the request, C executes the SetPublicAndPrivateKeysAlgorithm to get the public and private keys of user and returns them to A1.PublicKeyReplacementQuery: A1 requires C to use the PK’ID to run the PublicKeyReplacementQuery on the ID. Upon receipt, C will retain the PK’ID as the new public key.SigncryptionQuery: A1 lets C perform the SigncryptionQuery with a series of information and plaintext M. After the request is received, C randomly selects the information IDs to execute the SigncryptionAlgorithm to obtain the ciphertext C and transmits C to A1.DesigncryptionQuery: A1 requires C to perform the DesigncryptionQuery for ciphertext C. After the request is received, C executes the DesigncryptionAlgorithm to obtain the plaintext M, after that, verify that M is compliant, and returns M toA1.Challenge: A1 chooses a pair of plaintext M0,M1, the length of the plaintext is the same, and transmits M0,M1 to C. C selects φ∈0,1; then, C uses the selected plaintext Mφ to obtain C∗ and C transmits C∗ to A1.Phase 5.
A1 wants C to provide the same query as Phase 4, but A1 cannot perform the private key portion of SetPublicAndPrivateKeysQuery and ExtractPartialPrivateKeyQuery on the user who has replaced the public key. A1 cannot perform DesigncryptionQuery on ciphertext C∗.Guess: A1 gives φ∗, and if φ∗=φ can be determined, A1 wins, otherwise, A1 fails. The probability advantage of A1 winning is defined as follows:
(3)AdvIN−CMRS−CAA1=2Prφ∗=φ−1.Definition 6.
The probability that anyA1 in the case of IN-CMRS-CA can obtain the Game1 victory in time τ can satisfy AdvIN−CMRS−CAA1≤ε, indicating that the scheme conforms to τ,ε-IN-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game2: this game is the interaction of opponent A2 and challenger C in the context of IN-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits the result to the A2. After successful reception, A2 gives a set of target identifiers L=ID1,ID2,ID3,⋯,IDn,n is a positive integer.Phase 7.
A2 makes a series of queries to C like Phase 4 of Game1, but A2 cannot carry out PublicKeyReplacementQuery. C responds accordingly.Challenge: A2 selects a pair of plaintext M0,M1; the length of the plaintext is the same and transmits M0,M1 to C. C selects φ∈0,1; then, C uses the selected plaintext Mφ to obtain C∗, C transmits C∗ to A2.Phase 8.
A2 needs C to perform the same query as Phase 4, but A2 cannot execute the SetSecretValueQuery for the target identity L, and A2 cannot run the DesigncryptionQuery against the ciphertext C∗.Guess: A2 gives φ∗, and if φ∗=φ can be determined, A2 wins, otherwise, A2 fails. The probability advantage of A2 winning is defined as follows:
(4)AdvIN−CMRS−CAA2=2Prφ∗=φ−1.Definition 9.
The probability that anyA2 in the case of IN-CMRS-CA can obtain the Game2 victory in time τ can satisfy AdvIN−CMRS−CAA2≤ε, indicating that the scheme conforms to τ,ε-IN-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents a time of a polynomial operation.


### 2.3.2. Unforgeability

The unforgeability of the proposal in this paper is prescribed as the strong unforgeability of certificateless signcryption in the context of selecting ciphertext attacks and optional multiple ID (SU-CMRS-PA) [25]. Game3 and Game4 are used to describe the SU-CMRS-PA of the opponent A1 and A2, respectively.Game3: this section is the mutual response between C and A2 under SU-CMRS-PA. The details are the following:Setup.
This procedure is similar to Setup inGame1.Attack: A1 requires C to perform flexible queries. The queries are similar to Phase 4 in Game1, after which C responds.Forgery: A1 uses L=ID1,ID2,⋯,IDn and plaintext M to forge ciphertext C∗. If any recipient in L can correctly decrypt C∗, then A1 wins, otherwise A1 fails. In this process, SigncryptionQuery cannot get C∗, other restrictions are similar to Phase 5 in Game1.Definition 10.
The probability that anyA1 in the case of SU-CMRS-PA can obtain the Game3 victory in time τ can satisfy AdvSU−CMRS−PAA1≤ε, indicating that the scheme conforms to τ,ε-SU-CMRS-PA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game4: this process is the interaction between C and A2 under SU-CMRS-PA. The details are the following:Setup.
This procedure is similar toSetup in Game2.Attack: A2 performs flexible queries for C. The queries are similar to Phase 4 in Game2, after which C responds.Forgery: A2 uses L=ID1,ID2,⋯,IDnand plaintext M to forge ciphertext C∗. If any recipient in L can correctly decrypt C∗, then A2 wins, otherwise A2 fails. In this process, SigncryptionQuery cannot get C∗, and the other restrictions are similar to Phase 5 in Game2.Definition 11.
The probability that anyA2 in the case of SU-CMRS-PA can obtain the Game4 victory in time τ can satisfy AdvSU−CMRS−PAA2≤ε, indicating that the scheme conforms to τ,ε-SU-CMRS-PA security, ε represents a probabilistic advantage that is not negligible. τ represents the time of a polynomial operation.


### 2.3.3. Receiver Anonymity

In this scheme, receiver anonymity is prescribed as the anonymous indistinguishability of certificateless signcryption in the context of selecting ciphertext attacks and selective multiple ID (ANO-CMRS-CA) [26]. Game5 and Game6 each implement ANO-CMRS-CA for A1 and A2.Game5: this process is the interaction between C and A1 under ANO-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits pars to A1 and secretly saves s. After receiving, A1 selects L=ID0,ID1 and sends L to C.Phase 12.
This procedure is similar to Phase4 in Game1.Challenge: A1 picks identity list L∗=ID2,ID3,⋯,IDn and plaintext M, A1 transmits them to C. C selects e∈0,1 and forms the ciphertext C∗ with a new set of identity list L∗∗=IDe,ID2,ID3,⋯,IDn, and C transmits C∗ to A1.Phase 13.
This procedure is similar to Phase5 in Game1.
Guess: A1 gives e∗, and If e∗=e can be determined, A1 wins, otherwise, A1 fails. The probability advantage of A1 winning is defined as follows:
(5)AdvANO−CMRS−CAA1=2Pre∗=e−1.Definition 14.
The probability that anyA1 in the case of I ANO-CMRS-CA can obtain the Game5 victory in time τ can satisfy AdvANO−CMRS−CAA1≤ε, indicating that the scheme conforms to τ,ε-ANO-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game6: this process is the interaction between C and A2 under ANO-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits the result to A2, A2 selects L=ID0,ID1 and output L.Phase 15.
This procedure is similar to Phase4 in Game2.Challenge: A2 picks identity list L∗=ID2,ID3,⋯,IDn and a plaintext M, A2 transmits L∗ and M to C. C selects e∈0,1 and forms a ciphertext with a new set of identity list L∗∗=IDe,ID2,ID3,⋯,IDn, and C sends C∗ to A2.Phase 16.
This procedure is similar to Phase5 in Game2.
Guess: A2 gives e∗, and if e∗=e can be determined, A2 wins, otherwise, A2 fails. The probability advantage of A2 winning is defined as follows:
(6)AdvANO−CMRS−CAA2=2Pre∗=e−1.Definition 17.
The probability that anyA2 in the case of ANO-CMRS-CA can obtain the Game6 victory in time τ can satisfy AdvANO−CMRS−CAA2≤ε, indicating that the scheme conforms to τ,ε-ANO-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.


## 2.3.1. Information Confidentiality

Information confidentiality means that an attacker cannot successfully decrypt a plaintext message in his or her own attack. In this scheme, information confidentiality is the indistinguishability of certificateless signcryption in the context of selecting ciphertext attack and selective multiple ID (IN-CMRS-CA) [25]. We defined Game1 for A1’s IN-CMRS-CA and Game2 for A2’s IN-CMRS-CA.Game1: this game is the interaction of opponent A1 and challenger C in the context of IN-CMRS-CA.Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then sends the pars to the A1 and secretly saves s. After A1 receives the pars, the A1 outputs a group of target identities L=ID1,ID2,⋯,IDn, where n is a positive integer.Phase 4.
A1 requires C to perform flexible queries, and C performs feedback. The details are the following:SetSecretValueQuery: A1 requires C to run the SetSecretValueQuery on the ID. After the request is received, C uses the SetSecretValueAlgorithm to get the user’s secret value, and C transmits the result to A1.ExtractPartialPrivateKeyQuery: A1 lets C run the ExtractPartialPrivateKeyQuery against the ID. After the request is received, C executes the ExtractPartialPrivateKeyAlgorithm to gain the partial private key of the user and sends result to A1.SetPublicAndPrivateKeysQuery:A1 requires C to run the SetPublicAndPrivateKeysQuery on the ID. After receiving the request, C executes the SetPublicAndPrivateKeysAlgorithm to get the public and private keys of user and returns them to A1.PublicKeyReplacementQuery: A1 requires C to use the PK’ID to run the PublicKeyReplacementQuery on the ID. Upon receipt, C will retain the PK’ID as the new public key.SigncryptionQuery: A1 lets C perform the SigncryptionQuery with a series of information and plaintext M. After the request is received, C randomly selects the information IDs to execute the SigncryptionAlgorithm to obtain the ciphertext C and transmits C to A1.DesigncryptionQuery: A1 requires C to perform the DesigncryptionQuery for ciphertext C. After the request is received, C executes the DesigncryptionAlgorithm to obtain the plaintext M, after that, verify that M is compliant, and returns M toA1.Challenge: A1 chooses a pair of plaintext M0,M1, the length of the plaintext is the same, and transmits M0,M1 to C. C selects φ∈0,1; then, C uses the selected plaintext Mφ to obtain C∗ and C transmits C∗ to A1.Phase 5.
A1 wants C to provide the same query as Phase 4, but A1 cannot perform the private key portion of SetPublicAndPrivateKeysQuery and ExtractPartialPrivateKeyQuery on the user who has replaced the public key. A1 cannot perform DesigncryptionQuery on ciphertext C∗.Guess: A1 gives φ∗, and if φ∗=φ can be determined, A1 wins, otherwise, A1 fails. The probability advantage of A1 winning is defined as follows:
(3)AdvIN−CMRS−CAA1=2Prφ∗=φ−1.Definition 6.
The probability that anyA1 in the case of IN-CMRS-CA can obtain the Game1 victory in time τ can satisfy AdvIN−CMRS−CAA1≤ε, indicating that the scheme conforms to τ,ε-IN-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game2: this game is the interaction of opponent A2 and challenger C in the context of IN-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits the result to the A2. After successful reception, A2 gives a set of target identifiers L=ID1,ID2,ID3,⋯,IDn,n is a positive integer.Phase 7.
A2 makes a series of queries to C like Phase 4 of Game1, but A2 cannot carry out PublicKeyReplacementQuery. C responds accordingly.Challenge: A2 selects a pair of plaintext M0,M1; the length of the plaintext is the same and transmits M0,M1 to C. C selects φ∈0,1; then, C uses the selected plaintext Mφ to obtain C∗, C transmits C∗ to A2.Phase 8.
A2 needs C to perform the same query as Phase 4, but A2 cannot execute the SetSecretValueQuery for the target identity L, and A2 cannot run the DesigncryptionQuery against the ciphertext C∗.Guess: A2 gives φ∗, and if φ∗=φ can be determined, A2 wins, otherwise, A2 fails. The probability advantage of A2 winning is defined as follows:
(4)AdvIN−CMRS−CAA2=2Prφ∗=φ−1.Definition 9.
The probability that anyA2 in the case of IN-CMRS-CA can obtain the Game2 victory in time τ can satisfy AdvIN−CMRS−CAA2≤ε, indicating that the scheme conforms to τ,ε-IN-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents a time of a polynomial operation.


## 2.3.2. Unforgeability

The unforgeability of the proposal in this paper is prescribed as the strong unforgeability of certificateless signcryption in the context of selecting ciphertext attacks and optional multiple ID (SU-CMRS-PA) [25]. Game3 and Game4 are used to describe the SU-CMRS-PA of the opponent A1 and A2, respectively.Game3: this section is the mutual response between C and A2 under SU-CMRS-PA. The details are the following:Setup.
This procedure is similar to Setup inGame1.Attack: A1 requires C to perform flexible queries. The queries are similar to Phase 4 in Game1, after which C responds.Forgery: A1 uses L=ID1,ID2,⋯,IDn and plaintext M to forge ciphertext C∗. If any recipient in L can correctly decrypt C∗, then A1 wins, otherwise A1 fails. In this process, SigncryptionQuery cannot get C∗, other restrictions are similar to Phase 5 in Game1.Definition 10.
The probability that anyA1 in the case of SU-CMRS-PA can obtain the Game3 victory in time τ can satisfy AdvSU−CMRS−PAA1≤ε, indicating that the scheme conforms to τ,ε-SU-CMRS-PA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game4: this process is the interaction between C and A2 under SU-CMRS-PA. The details are the following:Setup.
This procedure is similar toSetup in Game2.Attack: A2 performs flexible queries for C. The queries are similar to Phase 4 in Game2, after which C responds.Forgery: A2 uses L=ID1,ID2,⋯,IDnand plaintext M to forge ciphertext C∗. If any recipient in L can correctly decrypt C∗, then A2 wins, otherwise A2 fails. In this process, SigncryptionQuery cannot get C∗, and the other restrictions are similar to Phase 5 in Game2.Definition 11.
The probability that anyA2 in the case of SU-CMRS-PA can obtain the Game4 victory in time τ can satisfy AdvSU−CMRS−PAA2≤ε, indicating that the scheme conforms to τ,ε-SU-CMRS-PA security, ε represents a probabilistic advantage that is not negligible. τ represents the time of a polynomial operation.


## 2.3.3. Receiver Anonymity

In this scheme, receiver anonymity is prescribed as the anonymous indistinguishability of certificateless signcryption in the context of selecting ciphertext attacks and selective multiple ID (ANO-CMRS-CA) [26]. Game5 and Game6 each implement ANO-CMRS-CA for A1 and A2.Game5: this process is the interaction between C and A1 under ANO-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits pars to A1 and secretly saves s. After receiving, A1 selects L=ID0,ID1 and sends L to C.Phase 12.
This procedure is similar to Phase4 in Game1.Challenge: A1 picks identity list L∗=ID2,ID3,⋯,IDn and plaintext M, A1 transmits them to C. C selects e∈0,1 and forms the ciphertext C∗ with a new set of identity list L∗∗=IDe,ID2,ID3,⋯,IDn, and C transmits C∗ to A1.Phase 13.
This procedure is similar to Phase5 in Game1.
Guess: A1 gives e∗, and If e∗=e can be determined, A1 wins, otherwise, A1 fails. The probability advantage of A1 winning is defined as follows:
(5)AdvANO−CMRS−CAA1=2Pre∗=e−1.Definition 14.
The probability that anyA1 in the case of I ANO-CMRS-CA can obtain the Game5 victory in time τ can satisfy AdvANO−CMRS−CAA1≤ε, indicating that the scheme conforms to τ,ε-ANO-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.Game6: this process is the interaction between C and A2 under ANO-CMRS-CA. The details are the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars and the master key s, then transmits the result to A2, A2 selects L=ID0,ID1 and output L.Phase 15.
This procedure is similar to Phase4 in Game2.Challenge: A2 picks identity list L∗=ID2,ID3,⋯,IDn and a plaintext M, A2 transmits L∗ and M to C. C selects e∈0,1 and forms a ciphertext with a new set of identity list L∗∗=IDe,ID2,ID3,⋯,IDn, and C sends C∗ to A2.Phase 16.
This procedure is similar to Phase5 in Game2.
Guess: A2 gives e∗, and if e∗=e can be determined, A2 wins, otherwise, A2 fails. The probability advantage of A2 winning is defined as follows:
(6)AdvANO−CMRS−CAA2=2Pre∗=e−1.Definition 17.
The probability that anyA2 in the case of ANO-CMRS-CA can obtain the Game6 victory in time τ can satisfy AdvANO−CMRS−CAA2≤ε, indicating that the scheme conforms to τ,ε-ANO-CMRS-CA security, ε represents a nonnegligible probability advantage and τ represents the time of a polynomial operation.


## 3. The Proposed Scheme

Our scheme includesSetUpAlgorithm, KeyExtractAlgorithm, SigncryptionAlgorithm, and DesigncryptionAlgorithm. The KeyExtractAlgorithm includes SetSecretValueAlgorithm, ExtractPartialPrivateKeyAlgorithm, and SetPublicAndPrivateKeysAlgorithm.


### 3.1. Setup Algorithm

KGC performs the corresponding steps for obtaining the public parameter and master keys. The details are the following:(1)
Inputλ, λ is the security parameter and KGC selects a large prime number p on the finite field at random and generates a finite field Fp with p order. Next, a suitable elliptic curve Ep is generated on the domain Fp, and an addition cycle group Gp is determined on the elliptic curve Ep, and the generator of Gp is P(2)
Select a positive whole numbers∈Zp∗ at random, s is the system master key and secretly save and calculate the system public key Ppub,Ppub=sP(3)
Select five safe and reliable hash function as follows:(7)H1=0,1∗×Gp×Gp⟶Zp∗,H2=Gp×0,1∗⟶Zp∗,H3=Gp×0,1∗⟶Zp∗,H4=Zp∗⟶0,1∗,H5=0,1∗×0,1∗×Gp×Gp×0,1∗×Gp×Zp∗×Zp∗×Zp∗×⋯.×Zp∗×Zp∗⟶Zp∗(4)
The appropriate symmetric encryption algorithmEk and decryption algorithm Dk are selected at random. k as a symmetric key(5)
Output the public parameterspars=Ep,Gp,Ek,Dk,p,P,Ppub,H1,H2,H3,H4,H5.


### 3.2. Key Extract Algorithm

The user and KGC perform the corresponding steps for obtaining the user’s private and public keys.(1)
SetSecretValueAlgorithm: user IDi randomly selects xi∈Zp∗ as a secret value and keeps it in secret, calculates Xi=xiP, and sends IDi and Xi to KGC via a secure channel(2)
ExtractPartialPrivateKeyAlgorithm: after receiving, KGC randomly selects the integer wi∈Zp∗, then calculates Wi=wiP and hi=H1IDi,Xi,Wi, and then calculates yi=wi+hismodq and zi=yi+H2sXi,IDimodq, finally sending zi and Wi to the user IDi via a secure channel(3)
SetPublicAndPrivateKeysAlgorithm: after the user IDi receives zi and Wi, it calculates yi=zi–H2xiPpub,IDi and Yi=yiP. Then, check if the equation yiP=Wi+hiPpub is established, and if so, the user receives successfully. Otherwise, the reception failsThe userIDi public key pair is PKi=Xi,Yi, private key pair is SKi=xi,yi. PKi is published by KGC.


### 3.3. Signcryption Algorithm

The sender uses the public parameterpars, its own private key SKc, plaintext M, a set of recipient information L=ID1,ID2,⋯,IDn, the recipient’s public key PKi1≤i≤n, and the information IDc of a transmitter for signcryption:
(1)
Select the integerr∈Zp∗ at random and then calculate R=rP(2)
Calculateαi=H3rXi,IDi,i=1,2,3,⋯n(3)
Select the whole numberξ at random, ξ∈Zp∗, then calculate the formula:
(8)fx=.∏j=1nx−αi+fx=∏j=1nx−αi+ξmodp=a0+a1x⋯+an−1xn−1+xn,ai∈Zp∗(4)
Calculatek=H4ξ,J=EkMIDc.(5)
Calculatehc=H5M,IDc,Xc,PKc,J,R,a0,a1,⋯.an, where σ=xc+yc+hcrmodq(6)
Generate ciphertextC=J,R,a0,a1,⋯.an,σ and send the ciphertext to all recipients


### 3.4. Designcryption Algorithm

The receiverIDi decrypts after receiving the ciphertext C=J,R,a0,a1,⋯.an,σ. Proceed as follows:
(1)
Calculateαi∗=H3xi,R,IDi(2)
Calculatefαi∗⟶ξ(3)
Calculatek=H4ξ and MIDc=DkJ(4)
Search and obtainPKc, calculate hc=H5M,IDc,Xc,PKc,J,R,a0,a1,⋯.an.And judge whetherσP=Xc+Yc+hcR is established, If successful, the recipient receives the plaintext M and then exits. Otherwise, the recipient rejects and quits.


## 3.1. Setup Algorithm

KGC performs the corresponding steps for obtaining the public parameter and master keys. The details are the following:(1)
Inputλ, λ is the security parameter and KGC selects a large prime number p on the finite field at random and generates a finite field Fp with p order. Next, a suitable elliptic curve Ep is generated on the domain Fp, and an addition cycle group Gp is determined on the elliptic curve Ep, and the generator of Gp is P(2)
Select a positive whole numbers∈Zp∗ at random, s is the system master key and secretly save and calculate the system public key Ppub,Ppub=sP(3)
Select five safe and reliable hash function as follows:(7)H1=0,1∗×Gp×Gp⟶Zp∗,H2=Gp×0,1∗⟶Zp∗,H3=Gp×0,1∗⟶Zp∗,H4=Zp∗⟶0,1∗,H5=0,1∗×0,1∗×Gp×Gp×0,1∗×Gp×Zp∗×Zp∗×Zp∗×⋯.×Zp∗×Zp∗⟶Zp∗(4)
The appropriate symmetric encryption algorithmEk and decryption algorithm Dk are selected at random. k as a symmetric key(5)
Output the public parameterspars=Ep,Gp,Ek,Dk,p,P,Ppub,H1,H2,H3,H4,H5.


## 3.2. Key Extract Algorithm

The user and KGC perform the corresponding steps for obtaining the user’s private and public keys.(1)
SetSecretValueAlgorithm: user IDi randomly selects xi∈Zp∗ as a secret value and keeps it in secret, calculates Xi=xiP, and sends IDi and Xi to KGC via a secure channel(2)
ExtractPartialPrivateKeyAlgorithm: after receiving, KGC randomly selects the integer wi∈Zp∗, then calculates Wi=wiP and hi=H1IDi,Xi,Wi, and then calculates yi=wi+hismodq and zi=yi+H2sXi,IDimodq, finally sending zi and Wi to the user IDi via a secure channel(3)
SetPublicAndPrivateKeysAlgorithm: after the user IDi receives zi and Wi, it calculates yi=zi–H2xiPpub,IDi and Yi=yiP. Then, check if the equation yiP=Wi+hiPpub is established, and if so, the user receives successfully. Otherwise, the reception failsThe userIDi public key pair is PKi=Xi,Yi, private key pair is SKi=xi,yi. PKi is published by KGC.


## 3.3. Signcryption Algorithm

The sender uses the public parameterpars, its own private key SKc, plaintext M, a set of recipient information L=ID1,ID2,⋯,IDn, the recipient’s public key PKi1≤i≤n, and the information IDc of a transmitter for signcryption:
(1)
Select the integerr∈Zp∗ at random and then calculate R=rP(2)
Calculateαi=H3rXi,IDi,i=1,2,3,⋯n(3)
Select the whole numberξ at random, ξ∈Zp∗, then calculate the formula:
(8)fx=.∏j=1nx−αi+fx=∏j=1nx−αi+ξmodp=a0+a1x⋯+an−1xn−1+xn,ai∈Zp∗(4)
Calculatek=H4ξ,J=EkMIDc.(5)
Calculatehc=H5M,IDc,Xc,PKc,J,R,a0,a1,⋯.an, where σ=xc+yc+hcrmodq(6)
Generate ciphertextC=J,R,a0,a1,⋯.an,σ and send the ciphertext to all recipients


## 3.4. Designcryption Algorithm

The receiverIDi decrypts after receiving the ciphertext C=J,R,a0,a1,⋯.an,σ. Proceed as follows:
(1)
Calculateαi∗=H3xi,R,IDi(2)
Calculatefαi∗⟶ξ(3)
Calculatek=H4ξ and MIDc=DkJ(4)
Search and obtainPKc, calculate hc=H5M,IDc,Xc,PKc,J,R,a0,a1,⋯.an.And judge whetherσP=Xc+Yc+hcR is established, If successful, the recipient receives the plaintext M and then exits. Otherwise, the recipient rejects and quits.


## 4. Correctness Analysis and Security Proofs

### 4.1. Correctness Analysis

Theorem 18.
Confirm that the part private key of the user inKeyExtractAlgorithm is right.Proof.
In order for the user’s partial private key to be verified correctly,yiP=Wi+hiPpub needs to be established. The specific inference of this equation is as follows:
(9)yiP=wi+hisP=wiP+hisP=Wi+hiPpub.
The establishment of the formulayiP=Wi+hiPpub determines that the verification of the part private key is right in the KeyExtractAlgorithm.Theorem 19.
TheDesigncryptionAlgorithm is right.Proof.
The formulaσP=Xc+Yc+hcR guarantees the correctness of the DesigncryptionAlgorithm. The specific inference of the formula is as follows:
(10)σP=xi+yi+hcrP=xiP+yiP+hcrP=Xc+Yc+hcR.
The formulaσP=Xc+Yc+hcR holds, so it is determined that the DesigncryptionAlgorithm is correct.


### 4.2. Security Proofs

We have security proofs of the proposal based on the safety model outlined in section2. Theorem 20 and Theorem 23 guarantee confidentiality of the message, Theorem 26 and Theorem 27 ensure unforgeability, and recipient anonymity is ensured by Theorem 28 and Theorem 31.Theorem 20.
There is an opponentA1 under the IN-CMRS-CA, in the polynomial time τ, if A1 wins the Game1 victory with a probability advantage ε that cannot be ignored, (A1 can request up to qi hash queries Hii=1,2,3,4,5, qcKeyQuery, SetSecretValueQuery, qbExtractPrivateKeyQuery, qpkSetPublicAndPrivateKeysQuery, qrPublicKeyReplacementQuery, qaSigncryptionQuery, and qdDesigncryptionQuery), then within time τ’≤τ+2qc+3qdOτs, challenger C’s interaction with opponent A1 makes C overcome CDHP with a probability advantage of ε’≥2ε−qdq5/2k/nq3,τs is the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that opponentA1 can attack the IN-CMRS-CA security, the probability advantage is ε, and under the stochastic prediction model, A1 requires challenger C to perform queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A1 interaction to overcome CDHP. C and opponent A1 will interact with the followings:Setup.
C performs the corresponding steps for obtaining the public parameter pars=Ep,Gp,Ek,Dk,p,P,Ppub=aP,H1,H2,H3,H4,H5 and master key =a∈Zp∗, and then transmits pars to A1 and save s. After the recipient receives it, A1 selects the target identity L=ID1,ID2,⋯,IDn and transmits L to C, n denotes a positive whole number. H1,H2,H3,H4,andH5 are all random oracles; they are controlled by C. The details are the following:
(1)
H1HashQuery: the tuple IDj,Xj,Wj is taken as input, and A1 requires C to execute H1HashQuery. After receiving, C checks whether the tuple IDj,Xj,Wj,dj exists in list L1. If it exists, C will send dj to A1. Otherwise, C selects dj∈Zp∗ at random and sends dj to A1 and restores the tuple IDj,Xj,Wj,dj into list L1(2)
H2HashQuery: the tuple sXj,IDj and XjPpub,IDj are taken as input, and A1 requires C to execute H2HashQuery. After receiving, C checks whether the tuple sXj,IDj,θj and XjPpub,IDj,δj exist in the list L2. If yes, C will send θj and δj to A1. Otherwise, C selects two integer θj and δj∈Zp∗ at random and transmits them to A1 and restores the tuple sXj,IDj,θj and XjPpub,IDj,δj into list L2(3)
H3HashQuery: the tuple rXj,IDj is taken as input, and A1 requires C to execute H3HashQuery. After receiving, C judges whether or not the tuple rXj,IDj,αj exists in the list L3. If it exists, C will send αj to A1. Otherwise, C selects αj∈Zp∗ at random and sends αj to A1 and restores the tuple rXj,IDj,αj into list L3(4)
H4HashQuery: the tuple ξ is taken as input, and A1 requires C to execute H4HashQuery. After receiving, C judges whether or not the tuple ξ,k exists in the list L4. If it exists, C will send k to A1. Otherwise, C selects k∈Zp∗ at random, and sends k to A1, and re-stores the tuple ξ,k into list L4(5)
H5HashQuery: The tuple M,IDj,Xj,PKj,J,R,a0,a1,⋯.an is taken as input, and A1 requires C to execute H5HashQuery. After receiving, C judges whether or not the tuple M,IDj,Xj,PKj,J,R,a0,a1,⋯.an,hj exists in list L5. If it exists, C will send hj to A1. Otherwise, C selects hj∈Zp∗ at random, and sends hj to A1 and restores the tuple M,IDj,Xj,PKj,J,R,a0,a1,⋯.an,hj into list L5Phase 21.
A1 requires C to perform flexible queries and C performs feedback. The details are the following:
(1)
KeyQuery: C checks if the tuple IDj,SKj,PKj,xj,zj exists in the list LC. If it exists, C reserves the tuple IDj,SKj,PKj,xj,zj. Otherwise, C does the following:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C selects two integers xj,wj∈Zp∗ at random, sets Xj=xjPandSKj⟵⊥, computes Wj=wjP,yj=wj+H1IDi,Xi,Wismodq, Yj=yjP,PKj=Xj,Yj and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,dj in list L1, respectively(b)
IfIDj!=IDi,i=1,2,3,⋯,n, C selects two integers xj,zj∈Zp∗ at random, sets Xj=xjP, computes yi=zi–H2xiPpub,IDi,Yj=yjP,PKj=Xj,Yj,SKj=xj,yj and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,dj in list L1, respectively(2)
SetSecretValueQuery:A1 requires C to execute the SetSecretValueQuery on IDj. After receiving the request, C checks whether there are tuples IDj,SKj,PKj,xj,zj in list LC. if it exists, C sends xj to A1, otherwise, C performs the KeyQuery to generate a tuple IDj,SKj,PKj,xj,zj and then sends xj to A1(3)
ExtractPartialPrivateKeyQuery:A1 requires C to perform the ExtractPartialPrivateKeyQuery on IDj. After receiving the request, the details are the followings:
(a)
IfIDj=IDi,i=1,2,3,⋯,n,C sends “failure” to A1(b)
IfIDj!=IDi,i=1,2,3,⋯,n,C judges whether or not the tuple IDj,SKj,PKj,wj,xj,zj exists in the list LC, and if so, C sends zj to A1, otherwise, C performs the KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends zj to A1(4)
SetPublicAndPrivateKeysQuery: A1 requires C to execute the public key portion of SetPublicAndPrivateKeysQuery on the IDj. After the recipient receives it, C judges whether or not the tuple IDj,SKj,PKj,xj,zj exists in list LC. If it exists, C sends PKj to A1, otherwise C performs KeyQuery to generate a tuple IDj,SKj,PKj,xj,zj and then send PKj to A1
A1 requires C to execute the private key portion of SetPublicAndPrivateKeysQuery on the IDj. After the recipient receives it, C responds:
(a)
IfIDj=IDi,fori=1,2,3,⋯,n,C sends “failure” to A1(b)
IfIDj!=IDi,fori=1,2,3,⋯,n,C judges whether or not the tuple IDj,SKj,PKj,wj,xj,zj exists in list LC, and if so, C sends SKj to A1, otherwise, C uses KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends SKj to A1(5)
PublicKeyReplacementQuery:A1 requires C to perform a PublicKeyReplacementQuery on IDj with PKj′. After the recipient receives it, Cqueries the tuple IDj,SKj,PKj,wj,xj,zj in list LC, and uses PKj′ instead of PKj. Next, C restores the tuple IDj,SKj,PKj,xj,zj in list LC(6)
SigncryptionQuery:A1 requires C to perform the SigncryptionQuery for plaintext M and information IDs. After receiving the request, C determines if IDs!=IDi is correct, i=1,2,3,⋯,n. If the expression is correct, C executes the SetPublicAndPrivateKeysQuery to generate the private key SKs and ciphertext C, and then sends C to A1 if not, C implement s the corresponding operation
(a)
Selectr∈Zp∗ at random and calculate Select
(11)R=rP,rXj=rxjP,αj=H3rXj,IDj,j=1,2,3,⋯,n;ξ∈Zp∗ at random and define the formula:
(12)fx=∏j=1nx−αi+ξmodp=a0+a1x+⋯+an−1xn−1+xn,ajϵZp.∗(b)
Calculatek=H4ξ,J=EkMIDs,h=H5M,IDs,Xs,PKs,J,R,a0,a1,⋯,an−1,σ=xs+ys+hmodq;(c)
Selectz∈Zp∗ at random(d)
Output the ciphertextC=J,R,a0,a1,⋯,an−1,σ to A1(7)
DesigncryptionQuery:A1 requires C to perform a DesigncryptionQuery for ciphertext C. After receiving the request, C selects IDj at random and verifies whether IDj=IDi is true, i=1,2,3,⋯,n. If the formula is true, C sends “failure” to A1 Otherwise, C will perform the corresponding operation:
(a)
Search for the tupleIDj,SKj,PKj,xj,zj in list LC to obtain SKj and compute αj=H3xjR,IDj(b)
Calculatefx=a0+a1x+⋯+an−1xn−1+xn, generate ξ with αj and fx.(c)
Calculatek=H4ξ,MIDs=DkJ(d)
Consider whether the equationσP=Xs+Ys+hsR can be established. If it is established, C sends M to A1 If not, C sends “failure” to A1
Challenge:A1 selects the plaintext M0,M1 at random, they are equal in length, and they are transmitted to C. After receiving, C selects a bit φ∈0,1at random, C uses Mφ to get the ciphertext C∗, and Mφ is the selected plaintext. The details are the following:
(a)
StipulateR=yPKi,rXi=yPKi+Ppub and αi=H3rXi,,i=1,2,3,⋯,n(b)
Selectξ∈Zp∗ at random and define the formula:
(13)fx=∏j=1nx−αi+ξmodp=a0+a1x+⋯+an−1xn−1+xn,ajϵZp∗p(c)
Calculatek=H4ξ,J∗=EkIDs and h=M,IDs,Xs,PKs,J,R,a0,a1,.⋯an(d)
Selectz∈Zp∗at random(e)
Output theC∗=J∗,Wi,z,h,a0,a1,⋯,an−1 to A1Phase 22.
A1 requires C to perform the same queries as Phase 4, but A1 cannot run the DesigncryptionQuery against C∗.
Guess: A1 gives a φ∗ at random. If φ∗=φ, then A1 wins, C outputs CDHP’s solution xyP=rXi−R. Otherwise, C outputs “failure.”
From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery; therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A1 requires C to execute the qdDesigncryptionQuery, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=2/nq3. in the running time τ’≤τ+2qc+3qdOτs, C ‘s interaction with opponent A1 makes C overcome CDHP, and the probability advantage is ε’≥εdεg≥2ε−qdq5/2k/nq3,τs is the time of the SPMOOECC.Theorem 23.
There is an opponentA2 under the IN-CLMS-CA. In the polynomial time τ, if the A2 wins the Game2 victory with a probability advantage ε that cannot be ignored, (A2 can request up to qi hash queriesHii=1,2,3,4,5, qcKeyQuery, qeSetSecretValueQuery, qbExtractPrivateKeyQuery, qpkSetPublicAndPrivateKeysQuery, qaSigncryptionQuery, and qdDesigncryptionQuery.), then within time τ’≤τ+3qc+3qdOτs, challenger C’s interaction with opponent A2 makes C overcome CDHP with a probability advantage of ε’≥2ε−qdq5/2k/nq3, τs is the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that the opponentA2 can attack the IN-CMRS-CA security, the probability advantage is ε, and under the stochastic prediction model, A2 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A2 interaction to overcome CDHP. C and opponent A2 will interact with the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars=Ep,Gp,Ek,Dk,p,P,K=xP,Ppub,H1,H2,H3,H4,H5 and master key s∈Zp∗, and then returns the result to A2, where x∈Zp∗. After receiving the result, A2 outputs L=ID1,ID2,ID3,⋯,IDn, where n is a positive integer. H1,H2,H3,H4,andH5 are random predictions controlled by C, the interactions between A2 and C is similar to Setup in Theorem 20.Phase 24.
A2 requires C to perform flexible queries and C performs feedback. The details are the following:
(1)
KeyQuery:C checks if there is a tuple IDj,SKj,PKj,xj,zj in the list LC. If it exists, C reserves the tuple. Otherwise, C will perform related operations as follows:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C selects two integers xj,wj∈Zp∗ at random and computes Wj=wjP,yj=wj+H1IDj,Xj,Wjsmodq, Yj=yjP,PKj=Xj,Yj, and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,hj in list L1, respectively, where Xj=xjP and SKj⟵⊥(b)
IfIDj!=IDi,i=1,2,3,⋯,n,C selects two integers xj,zj∈Zp∗ at random, and sets Xj=xjP, computes yi=zi–H2xiPpub,IDi,Yj=yjP,PKj=Xj,Yj,SKj=xj,yj, and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,hj in list L1, respectively(2)
SetSecretValueQuery:A2 requires C to execute SetSecretValueQuery for c. Upon receipt of the request, C executes as follows:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C sends “failure” to A2(b)
IfIDj!=IDi,i=1,2,3,⋯,n, C judges whether or not the tuple IDj,SKj,PKj,xj,zj exists in list LC. If yes, C returns xj toA2. Otherwise, C uses KeyQuery to generate the tuple IDj,SKj,PKj,xj,zj and sends xj to A2.(3)
ExtractPartialPrivateKeyQuery: A2 requires C to perform ExtractPartialPrivateKeyQuery against IDj. After the recipient receives it, C checks whether there is a tuple IDj,SKj,PKj,xj,zj in list LC. If it exists, C sends zj to A2. Otherwise, C runs KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends zj to A2(4)
SetPublicAndPrivateKeysQuery:A2 requires C to perform the public key portion of SetPublicAndPrivateKeysQuery against IDj. After receiving the request, C checks whether there is a tuple IDj,SKj,PKj,xj,zj in list LC. If it exists, C sends PKj to A2. Otherwise, C runs KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends PKj to A2
A2 requires C to perform the private key portion of SetPublicAndPrivateKeysQuery against IDj. After the recipient receives it, C responded with the following response:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C sends “failure” to A2(b)
IfIDj!=IDi,i=1,2,3,⋯,n, C judges whether or not the tuple IDj,SKj,PKj,xj,zj exists in list LC. If yes, C returns SKj to A2. Otherwise, C run the KeyQuery to generate the tuple IDj,SKj,PKj,xj,zj and sends SKj to A2(5)
SigncryptionQuery: this section is similar to the SigncryptionQuery in Theorem 20(6)
DesigncryptionQuery: this section is similar to the DesigncryptionQuery in Theorem 20
Challenge: A2 selects plaintext M0,M1 at random, they are equal in length, and transmits the result to C. After receiving the result, C.selects φ∈0,1 at random and obtains the ciphertext C∗ generated by Mφ:
(a)
StipulateR=yPKi+Y,rXi=yPKi+Ppub and αi=H3rXi,IDi,i=1,2,3,⋯,n,Y=K+Ppub(b)
Selectξ∈Zp∗ at random and define the formula:
(14)fx=∏j=1nx−αi+ξmodp=a0+a1x+⋯+an−1xn−1+xn,aiϵZp∗(c)
Calculatek=H3ξ,J∗=EkMφIDs and
(15)h=H5m,IDs,Xs,Ys,J,R,a0,a1,⋯.an;(d)
Selectz∈Zp∗ at random(e)
Output the ciphertextC∗=J∗,R,z,h,a0,a1,⋯,an−1 to A2Phase 25.
A2 requires C to perform the same queries as Phase 4, but A2 cannot run the DesigncryptionQuery against C∗.
Guess:A2 gives a φ∗ at random. If φ∗=φ, then A2 wins, C outputs CDHP’s solution xyP=R−rXi . If not C outputs “failure.”
From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery, therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A2 requires C to execute the qd DesigncryptionQuery, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=2/nq3. In the running time τ’≤τ+3qc+3qdOτs, C’s interaction with opponent A2 makes C overcome CDHP, and the probability advantage is τsτsε’≥2ε−qdq5/2k/nq3, τs is the time of the SPMOOECC.Theorem 26.
There is an opponentA1 under the SU-CMRS-PA. In the polynomial time τ, if the A1 wins the Game3 victory with a probability advantage that cannot be ignored (A1 can obtain queries similar to that obtained by A1 in Theorem 20), then within time τ’≤τ+2qc+2qaOτs, challenger C can overcome CDHP by interacting with opponent A1 with a probability advantage of ε’≥ε–qa/2k/2, τsis the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that the opponentA1 can attack the SU-CMRS-PA security, the probability advantage is ε, under the stochastic prediction model, A1 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A1 interaction to overcome CDHP. C and opponent A1 will interact with the following:Setup.
The process is similar toSetup in Theorem 20.
Attack:A1 requires C to perform flexible queries similar to Phase 4 in Theorem 20.
Forgery:A2 falsifies ciphertext C∗=J,R,z,h,a0,a1,⋯,an−1 using L=ID1,ID2,⋯,IDn and a plaintext M. If the formula σP=Xs+Ys+hsR can be established, C∗ faked successfully, defining PK’i=y−1PKi and rXi=yPKi+Ppub, C calculates rXi=PKi’+xyP, and outputs xyP=rXi−PKi,xyP is the CDHP’s solution. Otherwise C returns “failure”.
From the above discussion, it is concluded that the probability of success of theqa SigncryptionQuery is at least εa=ε−qa/2k. calculates xyP in the forgery process, and the probability of xP correct is at least εg=1/2. Therefore, C can overcome CDHP by interacting with opponent A1 within the running time τ’≤τ+2qc+2qaOτs, and the probability advantage is ε’≥εaεg=ε–qa/ε–qa/2. τs is the time of the SPMOOECC.Theorem 27.
There is an opponentA2 under the SU-CMRS-PA. In the polynomial time τ, if the A2 wins the Game4 victory with a probability advantage ε that cannot be ignored (A2 can obtain queries similar to that obtained by A2 in Theorem 23), then within time τ’≤τ+3qc+2qaOτs, challenger C can overcome CDHP by interacting with opponent A2 with a probability advantage of ε’≥ε−qa/2k/2, τs is the time of SPMOOECC.Proof.
Under a non-negligible probability, it is assumed that the opponentA2 can attack the SU-CMRS-PA security, the probability advantage is ε, under the stochastic prediction model, A2 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, Challenger C obtains xyP through the opponent A2 interaction to overcome CDHP. The details are the followings:Setup.
The process is similar toSetup in Theorem 23.
Attack:A1 requires C to perform flexible queries similar to Phase 4 in Theorem 23.
Forgery:A2 falsifies ciphertext C∗=J,R,z,h,a0,a1,⋯,an−1 using L=ID1,ID2,⋯,IDn and a plaintext M. If the formula σP=Xs+Ys+hsR can be established, C∗ faked successfully, defining PK’i=y−1PKi and rXi=yPKi+Ppub, C calculates rXi=PKi+xyP and outputs xyP=rXi−PKi, xyP is the CDHP’s solution. Otherwise C returns “failure.”From the above discussion, it is concluded that the probability of success of theqaSigncryptionQuery is at least εa=ε−qa/2k calculates xyP in the forgery process, and the probability of xyP correct is at least εg=1/2 Therefore, in the running time τ’≤τ+3qc+2qaOτs, C’s interaction with opponent A2 makes C overcome CDHP, and the probability advantage is ε’≥εaεg=ε–qa/2k/2. τs is the time of the SPMOOECC.Theorem 28.
There is an opponentA1 under the ANO-CMRS-CA. In the polynomial time τ, if the A1 wins the Game5 victory with a probability advantage ε that cannot be ignored (A1 can obtain queries similar to that obtained by A1 in Theorem 20), within time τ’≤τ+2qc+3qdOτs, challenger C can overcome CDHP by interacting with opponent A1 with a probability advantage of ε’≥ε−qdq5/2k/nq3, τs is the time of SPMOOECC.Proof.
Under a non-negligible probability, it is assumed that the opponentA1 can attack the ANO-CMRS-CA security, the probability advantage is ε, under the stochastic prediction model, A1 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A1 interaction to overcome CDHP. The details are the followings:Setup.
C execution of this algorithm is used to generate the public parameter pars=Ep,Gp,Ek,Dk,p,P,Ppub=xP,H1,H2,H3,H4,H5 and the master key s=a∈Zp∗, then sends the pars to the A1 and secretly saves s. After the A1 receives the pars, the A1 outputs L=ID0,ID1, where n is a positive integer. H1,H2,H3,H4,andH5 are all random oracles, they are controlled by C. The interaction is similar to Setup in Theorem 20, and the two sides of the interaction are A1 and C.Phase 29.
A1 makes a series of queries to C like Phase 4 in Theorem 20.
Challenge:A1 selects the target identifier L∗=ID2,ID3,⋯,IDn and plaintext M, and sends L∗ and M to C. After receiving, C selects a bit e∈0,1 and uses the new target identifier L∗∗=IDe,ID2,ID3,⋯,IDn to obtain the ciphertext C∗:
(a)
CalculateR=yPKi,rXi=yPKi+Ppubandαj=H3rXi,IDi(b)
Selectξ∈Zp∗ at random and define the formula:
(16)fx=∏j=1nx−αi+ξmodp=a0+a1x⋯+an−1xn−1+xn,ai∈Zp∗(c)
Calculatek=H3ξ,J∗=EkMφIDsandh∗=H4M,IDs,Xs,Ys,J,R,a0,a1,.⋯an(d)
Selectz∈Zp∗at random(e)
Output the ciphertextC∗=J∗,R,z,h,a0,a1,⋯,an−1toA1Phase 30.
A1 requires C to execute the queries, and the contents are similar to Phase 5, but A1 cannot run the DesigncryptionQuery against C∗.
Guess:A1 gives a e∗ at random. If e∗=e, then A1 wins, C outputs CDHP’s solution xyP=rXi−R . If not, C outputs “failure.”
From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery, therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A1 requires C to execute the qdDesigncryptionQuery, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=1/nq3C can solve CDHP by interacting with opponent A1 in the running time τ’≤τ+2qc+3qdOτs, and the probability advantage is ε’≥εdεg≥ε−qdq5/2k/nq3, τs is the time of the SPMOOECC.Theorem 31.
There is an opponentA2 under the ANO-CMRS-CA In the polynomial time τ, if the A2 wins the Game6 victory with a probability advantage ε that cannot be ignored (A2 can obtain queries similar to that obtained by A2 in Theorem 23.), then within time τ’≤τ+3qc+3qdOτs, challenger C can overcome CDHP by interacting with opponent A2 with a probability advantage of ε’≥ε−qdq5/2k/nq3, τs is the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that the opponentA2 can attack the ANO-CMRS-CA security, the probability advantage is ε, under the stochastic prediction model, A2 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A2 interaction to overcome CDHP. The details are the followings:Setup.
C performs the corresponding steps for obtaining the public parameter pars=Ep,Gp,Ek,Dk,p,P,K=xP,Ppub,H1,H2,H3,H4,H5 and master key s∈Zp∗ and then returns the result to A2, where x∈Zp∗. After receiving the result, A2 outputs L=ID0,ID1. H1,H2,H3,H4,andH5 are random predictions controlled by C. The interaction is similar to Setup in Theorem 20, and the two sides of the interaction are A2 and C.Phase 32.
A2 makes a series of queries to C like Phase 4 in Theorem 23.
Challenge:A2 selects the target identifier L∗=ID2,ID3,⋯,IDnand plaintext M and sends L∗ and M to C. After receiving, C selects a bit e∈0,1 and uses the new target identifier L∗∗=IDe,ID2,ID3,⋯,IDn to obtain the ciphertext C∗:
(a)
CalculateR=yPKi+Y,rXi=yPKi+Ppubandαj=H3rXi,IDi,Y=K+Ppub,i=e,2,3,⋯,n(b)
Selectξ∈Zp∗ at random and define the formula:
(17)fx=∏j=1nx−αi+ξmodp=a0+a1x⋯+an−1xn−1+xn,ai∈Zp∗(c)
Calculatek=H3ξ,J∗=EkMφIDsandh∗=H4M,IDs,Xs,Ys,J,R,a0,a1,.⋯an(d)
Selectz∈Zp∗ at random(e)
Output the ciphertextC∗=J∗,R,z,h,a0,a1,⋯,an−1 to A2Phase 33.
A2 requires C to perform the same queries as Phase 5, but A2 cannot run the DesigncryptionQuery against C∗.
Guess:A2 gives a e∗ at random. If e∗=e, then A2 wins, C outputs CDHP’s solution xyP=R−rXi . If not C outputs “failure.”From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery; therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A2 requires C to execute the qdDesigncryptionQuery process, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=1/nq3. In the running time τ’≤τ+3qc+3qdOτs, C’s interaction with opponent A2 makes C overcome CDHP, and the probability advantage is ε’≥εdεg≥ε−qdq5/2k/nq3, τs is the time of the SPMOOECC.


## 4.1. Correctness Analysis

Theorem 18.
Confirm that the part private key of the user inKeyExtractAlgorithm is right.Proof.
In order for the user’s partial private key to be verified correctly,yiP=Wi+hiPpub needs to be established. The specific inference of this equation is as follows:
(9)yiP=wi+hisP=wiP+hisP=Wi+hiPpub.
The establishment of the formulayiP=Wi+hiPpub determines that the verification of the part private key is right in the KeyExtractAlgorithm.Theorem 19.
TheDesigncryptionAlgorithm is right.Proof.
The formulaσP=Xc+Yc+hcR guarantees the correctness of the DesigncryptionAlgorithm. The specific inference of the formula is as follows:
(10)σP=xi+yi+hcrP=xiP+yiP+hcrP=Xc+Yc+hcR.
The formulaσP=Xc+Yc+hcR holds, so it is determined that the DesigncryptionAlgorithm is correct.


## 4.2. Security Proofs

We have security proofs of the proposal based on the safety model outlined in section2. Theorem 20 and Theorem 23 guarantee confidentiality of the message, Theorem 26 and Theorem 27 ensure unforgeability, and recipient anonymity is ensured by Theorem 28 and Theorem 31.Theorem 20.
There is an opponentA1 under the IN-CMRS-CA, in the polynomial time τ, if A1 wins the Game1 victory with a probability advantage ε that cannot be ignored, (A1 can request up to qi hash queries Hii=1,2,3,4,5, qcKeyQuery, SetSecretValueQuery, qbExtractPrivateKeyQuery, qpkSetPublicAndPrivateKeysQuery, qrPublicKeyReplacementQuery, qaSigncryptionQuery, and qdDesigncryptionQuery), then within time τ’≤τ+2qc+3qdOτs, challenger C’s interaction with opponent A1 makes C overcome CDHP with a probability advantage of ε’≥2ε−qdq5/2k/nq3,τs is the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that opponentA1 can attack the IN-CMRS-CA security, the probability advantage is ε, and under the stochastic prediction model, A1 requires challenger C to perform queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A1 interaction to overcome CDHP. C and opponent A1 will interact with the followings:Setup.
C performs the corresponding steps for obtaining the public parameter pars=Ep,Gp,Ek,Dk,p,P,Ppub=aP,H1,H2,H3,H4,H5 and master key =a∈Zp∗, and then transmits pars to A1 and save s. After the recipient receives it, A1 selects the target identity L=ID1,ID2,⋯,IDn and transmits L to C, n denotes a positive whole number. H1,H2,H3,H4,andH5 are all random oracles; they are controlled by C. The details are the following:
(1)
H1HashQuery: the tuple IDj,Xj,Wj is taken as input, and A1 requires C to execute H1HashQuery. After receiving, C checks whether the tuple IDj,Xj,Wj,dj exists in list L1. If it exists, C will send dj to A1. Otherwise, C selects dj∈Zp∗ at random and sends dj to A1 and restores the tuple IDj,Xj,Wj,dj into list L1(2)
H2HashQuery: the tuple sXj,IDj and XjPpub,IDj are taken as input, and A1 requires C to execute H2HashQuery. After receiving, C checks whether the tuple sXj,IDj,θj and XjPpub,IDj,δj exist in the list L2. If yes, C will send θj and δj to A1. Otherwise, C selects two integer θj and δj∈Zp∗ at random and transmits them to A1 and restores the tuple sXj,IDj,θj and XjPpub,IDj,δj into list L2(3)
H3HashQuery: the tuple rXj,IDj is taken as input, and A1 requires C to execute H3HashQuery. After receiving, C judges whether or not the tuple rXj,IDj,αj exists in the list L3. If it exists, C will send αj to A1. Otherwise, C selects αj∈Zp∗ at random and sends αj to A1 and restores the tuple rXj,IDj,αj into list L3(4)
H4HashQuery: the tuple ξ is taken as input, and A1 requires C to execute H4HashQuery. After receiving, C judges whether or not the tuple ξ,k exists in the list L4. If it exists, C will send k to A1. Otherwise, C selects k∈Zp∗ at random, and sends k to A1, and re-stores the tuple ξ,k into list L4(5)
H5HashQuery: The tuple M,IDj,Xj,PKj,J,R,a0,a1,⋯.an is taken as input, and A1 requires C to execute H5HashQuery. After receiving, C judges whether or not the tuple M,IDj,Xj,PKj,J,R,a0,a1,⋯.an,hj exists in list L5. If it exists, C will send hj to A1. Otherwise, C selects hj∈Zp∗ at random, and sends hj to A1 and restores the tuple M,IDj,Xj,PKj,J,R,a0,a1,⋯.an,hj into list L5Phase 21.
A1 requires C to perform flexible queries and C performs feedback. The details are the following:
(1)
KeyQuery: C checks if the tuple IDj,SKj,PKj,xj,zj exists in the list LC. If it exists, C reserves the tuple IDj,SKj,PKj,xj,zj. Otherwise, C does the following:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C selects two integers xj,wj∈Zp∗ at random, sets Xj=xjPandSKj⟵⊥, computes Wj=wjP,yj=wj+H1IDi,Xi,Wismodq, Yj=yjP,PKj=Xj,Yj and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,dj in list L1, respectively(b)
IfIDj!=IDi,i=1,2,3,⋯,n, C selects two integers xj,zj∈Zp∗ at random, sets Xj=xjP, computes yi=zi–H2xiPpub,IDi,Yj=yjP,PKj=Xj,Yj,SKj=xj,yj and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,dj in list L1, respectively(2)
SetSecretValueQuery:A1 requires C to execute the SetSecretValueQuery on IDj. After receiving the request, C checks whether there are tuples IDj,SKj,PKj,xj,zj in list LC. if it exists, C sends xj to A1, otherwise, C performs the KeyQuery to generate a tuple IDj,SKj,PKj,xj,zj and then sends xj to A1(3)
ExtractPartialPrivateKeyQuery:A1 requires C to perform the ExtractPartialPrivateKeyQuery on IDj. After receiving the request, the details are the followings:
(a)
IfIDj=IDi,i=1,2,3,⋯,n,C sends “failure” to A1(b)
IfIDj!=IDi,i=1,2,3,⋯,n,C judges whether or not the tuple IDj,SKj,PKj,wj,xj,zj exists in the list LC, and if so, C sends zj to A1, otherwise, C performs the KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends zj to A1(4)
SetPublicAndPrivateKeysQuery: A1 requires C to execute the public key portion of SetPublicAndPrivateKeysQuery on the IDj. After the recipient receives it, C judges whether or not the tuple IDj,SKj,PKj,xj,zj exists in list LC. If it exists, C sends PKj to A1, otherwise C performs KeyQuery to generate a tuple IDj,SKj,PKj,xj,zj and then send PKj to A1
A1 requires C to execute the private key portion of SetPublicAndPrivateKeysQuery on the IDj. After the recipient receives it, C responds:
(a)
IfIDj=IDi,fori=1,2,3,⋯,n,C sends “failure” to A1(b)
IfIDj!=IDi,fori=1,2,3,⋯,n,C judges whether or not the tuple IDj,SKj,PKj,wj,xj,zj exists in list LC, and if so, C sends SKj to A1, otherwise, C uses KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends SKj to A1(5)
PublicKeyReplacementQuery:A1 requires C to perform a PublicKeyReplacementQuery on IDj with PKj′. After the recipient receives it, Cqueries the tuple IDj,SKj,PKj,wj,xj,zj in list LC, and uses PKj′ instead of PKj. Next, C restores the tuple IDj,SKj,PKj,xj,zj in list LC(6)
SigncryptionQuery:A1 requires C to perform the SigncryptionQuery for plaintext M and information IDs. After receiving the request, C determines if IDs!=IDi is correct, i=1,2,3,⋯,n. If the expression is correct, C executes the SetPublicAndPrivateKeysQuery to generate the private key SKs and ciphertext C, and then sends C to A1 if not, C implement s the corresponding operation
(a)
Selectr∈Zp∗ at random and calculate Select
(11)R=rP,rXj=rxjP,αj=H3rXj,IDj,j=1,2,3,⋯,n;ξ∈Zp∗ at random and define the formula:
(12)fx=∏j=1nx−αi+ξmodp=a0+a1x+⋯+an−1xn−1+xn,ajϵZp.∗(b)
Calculatek=H4ξ,J=EkMIDs,h=H5M,IDs,Xs,PKs,J,R,a0,a1,⋯,an−1,σ=xs+ys+hmodq;(c)
Selectz∈Zp∗ at random(d)
Output the ciphertextC=J,R,a0,a1,⋯,an−1,σ to A1(7)
DesigncryptionQuery:A1 requires C to perform a DesigncryptionQuery for ciphertext C. After receiving the request, C selects IDj at random and verifies whether IDj=IDi is true, i=1,2,3,⋯,n. If the formula is true, C sends “failure” to A1 Otherwise, C will perform the corresponding operation:
(a)
Search for the tupleIDj,SKj,PKj,xj,zj in list LC to obtain SKj and compute αj=H3xjR,IDj(b)
Calculatefx=a0+a1x+⋯+an−1xn−1+xn, generate ξ with αj and fx.(c)
Calculatek=H4ξ,MIDs=DkJ(d)
Consider whether the equationσP=Xs+Ys+hsR can be established. If it is established, C sends M to A1 If not, C sends “failure” to A1
Challenge:A1 selects the plaintext M0,M1 at random, they are equal in length, and they are transmitted to C. After receiving, C selects a bit φ∈0,1at random, C uses Mφ to get the ciphertext C∗, and Mφ is the selected plaintext. The details are the following:
(a)
StipulateR=yPKi,rXi=yPKi+Ppub and αi=H3rXi,,i=1,2,3,⋯,n(b)
Selectξ∈Zp∗ at random and define the formula:
(13)fx=∏j=1nx−αi+ξmodp=a0+a1x+⋯+an−1xn−1+xn,ajϵZp∗p(c)
Calculatek=H4ξ,J∗=EkIDs and h=M,IDs,Xs,PKs,J,R,a0,a1,.⋯an(d)
Selectz∈Zp∗at random(e)
Output theC∗=J∗,Wi,z,h,a0,a1,⋯,an−1 to A1Phase 22.
A1 requires C to perform the same queries as Phase 4, but A1 cannot run the DesigncryptionQuery against C∗.
Guess: A1 gives a φ∗ at random. If φ∗=φ, then A1 wins, C outputs CDHP’s solution xyP=rXi−R. Otherwise, C outputs “failure.”
From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery; therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A1 requires C to execute the qdDesigncryptionQuery, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=2/nq3. in the running time τ’≤τ+2qc+3qdOτs, C ‘s interaction with opponent A1 makes C overcome CDHP, and the probability advantage is ε’≥εdεg≥2ε−qdq5/2k/nq3,τs is the time of the SPMOOECC.Theorem 23.
There is an opponentA2 under the IN-CLMS-CA. In the polynomial time τ, if the A2 wins the Game2 victory with a probability advantage ε that cannot be ignored, (A2 can request up to qi hash queriesHii=1,2,3,4,5, qcKeyQuery, qeSetSecretValueQuery, qbExtractPrivateKeyQuery, qpkSetPublicAndPrivateKeysQuery, qaSigncryptionQuery, and qdDesigncryptionQuery.), then within time τ’≤τ+3qc+3qdOτs, challenger C’s interaction with opponent A2 makes C overcome CDHP with a probability advantage of ε’≥2ε−qdq5/2k/nq3, τs is the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that the opponentA2 can attack the IN-CMRS-CA security, the probability advantage is ε, and under the stochastic prediction model, A2 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A2 interaction to overcome CDHP. C and opponent A2 will interact with the following:Setup.
C performs the corresponding steps for obtaining the public parameter pars=Ep,Gp,Ek,Dk,p,P,K=xP,Ppub,H1,H2,H3,H4,H5 and master key s∈Zp∗, and then returns the result to A2, where x∈Zp∗. After receiving the result, A2 outputs L=ID1,ID2,ID3,⋯,IDn, where n is a positive integer. H1,H2,H3,H4,andH5 are random predictions controlled by C, the interactions between A2 and C is similar to Setup in Theorem 20.Phase 24.
A2 requires C to perform flexible queries and C performs feedback. The details are the following:
(1)
KeyQuery:C checks if there is a tuple IDj,SKj,PKj,xj,zj in the list LC. If it exists, C reserves the tuple. Otherwise, C will perform related operations as follows:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C selects two integers xj,wj∈Zp∗ at random and computes Wj=wjP,yj=wj+H1IDj,Xj,Wjsmodq, Yj=yjP,PKj=Xj,Yj, and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,hj in list L1, respectively, where Xj=xjP and SKj⟵⊥(b)
IfIDj!=IDi,i=1,2,3,⋯,n,C selects two integers xj,zj∈Zp∗ at random, and sets Xj=xjP, computes yi=zi–H2xiPpub,IDi,Yj=yjP,PKj=Xj,Yj,SKj=xj,yj, and then updates tuples IDj,SKj,PKj,xj,zj in list LC and IDj,Xj,Wj,hj in list L1, respectively(2)
SetSecretValueQuery:A2 requires C to execute SetSecretValueQuery for c. Upon receipt of the request, C executes as follows:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C sends “failure” to A2(b)
IfIDj!=IDi,i=1,2,3,⋯,n, C judges whether or not the tuple IDj,SKj,PKj,xj,zj exists in list LC. If yes, C returns xj toA2. Otherwise, C uses KeyQuery to generate the tuple IDj,SKj,PKj,xj,zj and sends xj to A2.(3)
ExtractPartialPrivateKeyQuery: A2 requires C to perform ExtractPartialPrivateKeyQuery against IDj. After the recipient receives it, C checks whether there is a tuple IDj,SKj,PKj,xj,zj in list LC. If it exists, C sends zj to A2. Otherwise, C runs KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends zj to A2(4)
SetPublicAndPrivateKeysQuery:A2 requires C to perform the public key portion of SetPublicAndPrivateKeysQuery against IDj. After receiving the request, C checks whether there is a tuple IDj,SKj,PKj,xj,zj in list LC. If it exists, C sends PKj to A2. Otherwise, C runs KeyQuery to generate tuple IDj,SKj,PKj,xj,zj and sends PKj to A2
A2 requires C to perform the private key portion of SetPublicAndPrivateKeysQuery against IDj. After the recipient receives it, C responded with the following response:
(a)
IfIDj=IDi,i=1,2,3,⋯,n, C sends “failure” to A2(b)
IfIDj!=IDi,i=1,2,3,⋯,n, C judges whether or not the tuple IDj,SKj,PKj,xj,zj exists in list LC. If yes, C returns SKj to A2. Otherwise, C run the KeyQuery to generate the tuple IDj,SKj,PKj,xj,zj and sends SKj to A2(5)
SigncryptionQuery: this section is similar to the SigncryptionQuery in Theorem 20(6)
DesigncryptionQuery: this section is similar to the DesigncryptionQuery in Theorem 20
Challenge: A2 selects plaintext M0,M1 at random, they are equal in length, and transmits the result to C. After receiving the result, C.selects φ∈0,1 at random and obtains the ciphertext C∗ generated by Mφ:
(a)
StipulateR=yPKi+Y,rXi=yPKi+Ppub and αi=H3rXi,IDi,i=1,2,3,⋯,n,Y=K+Ppub(b)
Selectξ∈Zp∗ at random and define the formula:
(14)fx=∏j=1nx−αi+ξmodp=a0+a1x+⋯+an−1xn−1+xn,aiϵZp∗(c)
Calculatek=H3ξ,J∗=EkMφIDs and
(15)h=H5m,IDs,Xs,Ys,J,R,a0,a1,⋯.an;(d)
Selectz∈Zp∗ at random(e)
Output the ciphertextC∗=J∗,R,z,h,a0,a1,⋯,an−1 to A2Phase 25.
A2 requires C to perform the same queries as Phase 4, but A2 cannot run the DesigncryptionQuery against C∗.
Guess:A2 gives a φ∗ at random. If φ∗=φ, then A2 wins, C outputs CDHP’s solution xyP=R−rXi . If not C outputs “failure.”
From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery, therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A2 requires C to execute the qd DesigncryptionQuery, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=2/nq3. In the running time τ’≤τ+3qc+3qdOτs, C’s interaction with opponent A2 makes C overcome CDHP, and the probability advantage is τsτsε’≥2ε−qdq5/2k/nq3, τs is the time of the SPMOOECC.Theorem 26.
There is an opponentA1 under the SU-CMRS-PA. In the polynomial time τ, if the A1 wins the Game3 victory with a probability advantage that cannot be ignored (A1 can obtain queries similar to that obtained by A1 in Theorem 20), then within time τ’≤τ+2qc+2qaOτs, challenger C can overcome CDHP by interacting with opponent A1 with a probability advantage of ε’≥ε–qa/2k/2, τsis the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that the opponentA1 can attack the SU-CMRS-PA security, the probability advantage is ε, under the stochastic prediction model, A1 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A1 interaction to overcome CDHP. C and opponent A1 will interact with the following:Setup.
The process is similar toSetup in Theorem 20.
Attack:A1 requires C to perform flexible queries similar to Phase 4 in Theorem 20.
Forgery:A2 falsifies ciphertext C∗=J,R,z,h,a0,a1,⋯,an−1 using L=ID1,ID2,⋯,IDn and a plaintext M. If the formula σP=Xs+Ys+hsR can be established, C∗ faked successfully, defining PK’i=y−1PKi and rXi=yPKi+Ppub, C calculates rXi=PKi’+xyP, and outputs xyP=rXi−PKi,xyP is the CDHP’s solution. Otherwise C returns “failure”.
From the above discussion, it is concluded that the probability of success of theqa SigncryptionQuery is at least εa=ε−qa/2k. calculates xyP in the forgery process, and the probability of xP correct is at least εg=1/2. Therefore, C can overcome CDHP by interacting with opponent A1 within the running time τ’≤τ+2qc+2qaOτs, and the probability advantage is ε’≥εaεg=ε–qa/ε–qa/2. τs is the time of the SPMOOECC.Theorem 27.
There is an opponentA2 under the SU-CMRS-PA. In the polynomial time τ, if the A2 wins the Game4 victory with a probability advantage ε that cannot be ignored (A2 can obtain queries similar to that obtained by A2 in Theorem 23), then within time τ’≤τ+3qc+2qaOτs, challenger C can overcome CDHP by interacting with opponent A2 with a probability advantage of ε’≥ε−qa/2k/2, τs is the time of SPMOOECC.Proof.
Under a non-negligible probability, it is assumed that the opponentA2 can attack the SU-CMRS-PA security, the probability advantage is ε, under the stochastic prediction model, A2 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, Challenger C obtains xyP through the opponent A2 interaction to overcome CDHP. The details are the followings:Setup.
The process is similar toSetup in Theorem 23.
Attack:A1 requires C to perform flexible queries similar to Phase 4 in Theorem 23.
Forgery:A2 falsifies ciphertext C∗=J,R,z,h,a0,a1,⋯,an−1 using L=ID1,ID2,⋯,IDn and a plaintext M. If the formula σP=Xs+Ys+hsR can be established, C∗ faked successfully, defining PK’i=y−1PKi and rXi=yPKi+Ppub, C calculates rXi=PKi+xyP and outputs xyP=rXi−PKi, xyP is the CDHP’s solution. Otherwise C returns “failure.”From the above discussion, it is concluded that the probability of success of theqaSigncryptionQuery is at least εa=ε−qa/2k calculates xyP in the forgery process, and the probability of xyP correct is at least εg=1/2 Therefore, in the running time τ’≤τ+3qc+2qaOτs, C’s interaction with opponent A2 makes C overcome CDHP, and the probability advantage is ε’≥εaεg=ε–qa/2k/2. τs is the time of the SPMOOECC.Theorem 28.
There is an opponentA1 under the ANO-CMRS-CA. In the polynomial time τ, if the A1 wins the Game5 victory with a probability advantage ε that cannot be ignored (A1 can obtain queries similar to that obtained by A1 in Theorem 20), within time τ’≤τ+2qc+3qdOτs, challenger C can overcome CDHP by interacting with opponent A1 with a probability advantage of ε’≥ε−qdq5/2k/nq3, τs is the time of SPMOOECC.Proof.
Under a non-negligible probability, it is assumed that the opponentA1 can attack the ANO-CMRS-CA security, the probability advantage is ε, under the stochastic prediction model, A1 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A1 interaction to overcome CDHP. The details are the followings:Setup.
C execution of this algorithm is used to generate the public parameter pars=Ep,Gp,Ek,Dk,p,P,Ppub=xP,H1,H2,H3,H4,H5 and the master key s=a∈Zp∗, then sends the pars to the A1 and secretly saves s. After the A1 receives the pars, the A1 outputs L=ID0,ID1, where n is a positive integer. H1,H2,H3,H4,andH5 are all random oracles, they are controlled by C. The interaction is similar to Setup in Theorem 20, and the two sides of the interaction are A1 and C.Phase 29.
A1 makes a series of queries to C like Phase 4 in Theorem 20.
Challenge:A1 selects the target identifier L∗=ID2,ID3,⋯,IDn and plaintext M, and sends L∗ and M to C. After receiving, C selects a bit e∈0,1 and uses the new target identifier L∗∗=IDe,ID2,ID3,⋯,IDn to obtain the ciphertext C∗:
(a)
CalculateR=yPKi,rXi=yPKi+Ppubandαj=H3rXi,IDi(b)
Selectξ∈Zp∗ at random and define the formula:
(16)fx=∏j=1nx−αi+ξmodp=a0+a1x⋯+an−1xn−1+xn,ai∈Zp∗(c)
Calculatek=H3ξ,J∗=EkMφIDsandh∗=H4M,IDs,Xs,Ys,J,R,a0,a1,.⋯an(d)
Selectz∈Zp∗at random(e)
Output the ciphertextC∗=J∗,R,z,h,a0,a1,⋯,an−1toA1Phase 30.
A1 requires C to execute the queries, and the contents are similar to Phase 5, but A1 cannot run the DesigncryptionQuery against C∗.
Guess:A1 gives a e∗ at random. If e∗=e, then A1 wins, C outputs CDHP’s solution xyP=rXi−R . If not, C outputs “failure.”
From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery, therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A1 requires C to execute the qdDesigncryptionQuery, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=1/nq3C can solve CDHP by interacting with opponent A1 in the running time τ’≤τ+2qc+3qdOτs, and the probability advantage is ε’≥εdεg≥ε−qdq5/2k/nq3, τs is the time of the SPMOOECC.Theorem 31.
There is an opponentA2 under the ANO-CMRS-CA In the polynomial time τ, if the A2 wins the Game6 victory with a probability advantage ε that cannot be ignored (A2 can obtain queries similar to that obtained by A2 in Theorem 23.), then within time τ’≤τ+3qc+3qdOτs, challenger C can overcome CDHP by interacting with opponent A2 with a probability advantage of ε’≥ε−qdq5/2k/nq3, τs is the time of SPMOOECC.Proof.
Under a nonnegligible probability, it is assumed that the opponentA2 can attack the ANO-CMRS-CA security, the probability advantage is ε, under the stochastic prediction model, A2 requires challenger C to perform a series of queries. Given P,xP,yP, in the time-limited polynomial, C obtains xyP through the opponent A2 interaction to overcome CDHP. The details are the followings:Setup.
C performs the corresponding steps for obtaining the public parameter pars=Ep,Gp,Ek,Dk,p,P,K=xP,Ppub,H1,H2,H3,H4,H5 and master key s∈Zp∗ and then returns the result to A2, where x∈Zp∗. After receiving the result, A2 outputs L=ID0,ID1. H1,H2,H3,H4,andH5 are random predictions controlled by C. The interaction is similar to Setup in Theorem 20, and the two sides of the interaction are A2 and C.Phase 32.
A2 makes a series of queries to C like Phase 4 in Theorem 23.
Challenge:A2 selects the target identifier L∗=ID2,ID3,⋯,IDnand plaintext M and sends L∗ and M to C. After receiving, C selects a bit e∈0,1 and uses the new target identifier L∗∗=IDe,ID2,ID3,⋯,IDn to obtain the ciphertext C∗:
(a)
CalculateR=yPKi+Y,rXi=yPKi+Ppubandαj=H3rXi,IDi,Y=K+Ppub,i=e,2,3,⋯,n(b)
Selectξ∈Zp∗ at random and define the formula:
(17)fx=∏j=1nx−αi+ξmodp=a0+a1x⋯+an−1xn−1+xn,ai∈Zp∗(c)
Calculatek=H3ξ,J∗=EkMφIDsandh∗=H4M,IDs,Xs,Ys,J,R,a0,a1,.⋯an(d)
Selectz∈Zp∗ at random(e)
Output the ciphertextC∗=J∗,R,z,h,a0,a1,⋯,an−1 to A2Phase 33.
A2 requires C to perform the same queries as Phase 5, but A2 cannot run the DesigncryptionQuery against C∗.
Guess:A2 gives a e∗ at random. If e∗=e, then A2 wins, C outputs CDHP’s solution xyP=R−rXi . If not C outputs “failure.”From the above discussion, it can be concluded that theH5hash provides a valid ciphertext during the DesigncryptionQuery; therefore, the probability of ciphertext being denied is no more than q5/2k. During the attack process, since A2 requires C to execute the qdDesigncryptionQuery process, the probability of C decryption success is εd≥ε–q5qd/2k. The H3 hash satisfies CDHP during the guessing process, so the probability that xyP is correctly calculated by C is at least εg=1/nq3. In the running time τ’≤τ+3qc+3qdOτs, C’s interaction with opponent A2 makes C overcome CDHP, and the probability advantage is ε’≥εdεg≥ε−qdq5/2k/nq3, τs is the time of the SPMOOECC.


## 5. Efficiency Analysis and Functional Comparison

Schemes in [25, 27, 29, 30] and our scheme are based on certificateless signcryptions. To reflect the superiority of our scheme, we will compare our scheme with them in terms of functions and efficiency.


### 5.1. Functional Comparison

We have compared the functions of our scheme and the functions of schemes in [25, 27, 29, 30], as shown in Table 2.Table 2
Comparison of functions.
SchemesDecryption fairnessReceiver anonymityPartial private key verifiabilitySignatureSelvi et al. [25]NNNYHung et al. [27]NYNNZhu et al. [29]NNNNWin et al. [30]NNYNOur programYYYYFrom the graph, we can get the following results, schemes in [25, 27, 29, 30] do not satisfy decryption fairness and do not guarantee that each recipient has the same chance of decryption. Schemes in [25, 29, 30] are not anonymous to the recipient, which may result in the disclosure of the recipient information, greatly reducing the encryption effect. Schemes in [25, 27, 29] cannot implement the verifiability of partial private key, which means they can be attacked by malicious KGC. Schemes in [27, 29, 30] have no signature function and cannot prevent an attacker from sending an unreliable messages.


### 5.2. Efficiency Analysis

For the sake of comparison, we have defined some symbols to represent the calculation of different operations in the encryption process and the decryption process, and the corresponding data is taken from [26]. We only consider the calculations defined in Table 3, because what is shown in Table 3 is the key to computational performance.Table 3
Symbols’ definition.
SymbolsSymbols’ definitionTmTime of a modular multiplicationTpmTime of a scalar point multiplication on ECC operation,Tpm≈29Tm.TpaTime of a point addition on ECC operation,Tpa≈0.12Tm.TbTime of a bilinear pairing operation,Tb≈87Tm.TtTime of modular inversion operation,Tt≈11.6Tm.TbeTime of a bilinear pairing exponentiation operation,Tbe≈43.5Tm.ThTime of a map-to-point hash function operation,Th≈29TmWith the integration of encryption and decryption processes, as shown in Table4, Figures 3 and 4, our scheme is better than the schemes in [25, 27, 29, 30], because the scheme in [25] and scheme in [29] use the BPO, scheme in [27] uses the BPO and MTPHF, and scheme in [30] uses lots of SPMOOECC. In this way, these operations all cause a lot of overheads, making the scheme less efficient. Our scheme also uses SPMOOECC, but we attempt to reduce the number of SPMOOECC. Therefore, the performance of our scheme is superior to the scheme in [25, 27, 29, 30].Table 4
Comparison of efficiency.
SchemesSigncryption/encryptionDecryption/designcryptionSelvi et al. [25]n+1Tpm+Ti+n+1Tb+n+1Tbe≈159.5n+171.1TmTpm+Tpa+2Tb+Tbe≈246.62TmHung et al. [27]n+1Tpm+nTbe+nTb+nTh≈188.5n+29TmTpm+Tb≈116TmZhu et al. [29]2n+3Tpm+nTpa+Tb≈58.12n+174Tm2Tb+Tpm+Ti≈214.6TmWin et al. [30]n+2Tpm+nTpa≈29.12n+58Tm4Tpm+4Tpa+2Ti≈139.68TmOur schemen+1Tpm≈29n+29Tm3Tpm+2Tpa≈87.24TmFigure 3
Efficiency in signcryption/encryption. The unit isTm.Figure 4
Efficiency in decryption/designcryption. The unit isTm.


## 5.1. Functional Comparison

We have compared the functions of our scheme and the functions of schemes in [25, 27, 29, 30], as shown in Table 2.Table 2
Comparison of functions.
SchemesDecryption fairnessReceiver anonymityPartial private key verifiabilitySignatureSelvi et al. [25]NNNYHung et al. [27]NYNNZhu et al. [29]NNNNWin et al. [30]NNYNOur programYYYYFrom the graph, we can get the following results, schemes in [25, 27, 29, 30] do not satisfy decryption fairness and do not guarantee that each recipient has the same chance of decryption. Schemes in [25, 29, 30] are not anonymous to the recipient, which may result in the disclosure of the recipient information, greatly reducing the encryption effect. Schemes in [25, 27, 29] cannot implement the verifiability of partial private key, which means they can be attacked by malicious KGC. Schemes in [27, 29, 30] have no signature function and cannot prevent an attacker from sending an unreliable messages.


## 5.2. Efficiency Analysis

For the sake of comparison, we have defined some symbols to represent the calculation of different operations in the encryption process and the decryption process, and the corresponding data is taken from [26]. We only consider the calculations defined in Table 3, because what is shown in Table 3 is the key to computational performance.Table 3
Symbols’ definition.
SymbolsSymbols’ definitionTmTime of a modular multiplicationTpmTime of a scalar point multiplication on ECC operation,Tpm≈29Tm.TpaTime of a point addition on ECC operation,Tpa≈0.12Tm.TbTime of a bilinear pairing operation,Tb≈87Tm.TtTime of modular inversion operation,Tt≈11.6Tm.TbeTime of a bilinear pairing exponentiation operation,Tbe≈43.5Tm.ThTime of a map-to-point hash function operation,Th≈29TmWith the integration of encryption and decryption processes, as shown in Table4, Figures 3 and 4, our scheme is better than the schemes in [25, 27, 29, 30], because the scheme in [25] and scheme in [29] use the BPO, scheme in [27] uses the BPO and MTPHF, and scheme in [30] uses lots of SPMOOECC. In this way, these operations all cause a lot of overheads, making the scheme less efficient. Our scheme also uses SPMOOECC, but we attempt to reduce the number of SPMOOECC. Therefore, the performance of our scheme is superior to the scheme in [25, 27, 29, 30].Table 4
Comparison of efficiency.
SchemesSigncryption/encryptionDecryption/designcryptionSelvi et al. [25]n+1Tpm+Ti+n+1Tb+n+1Tbe≈159.5n+171.1TmTpm+Tpa+2Tb+Tbe≈246.62TmHung et al. [27]n+1Tpm+nTbe+nTb+nTh≈188.5n+29TmTpm+Tb≈116TmZhu et al. [29]2n+3Tpm+nTpa+Tb≈58.12n+174Tm2Tb+Tpm+Ti≈214.6TmWin et al. [30]n+2Tpm+nTpa≈29.12n+58Tm4Tpm+4Tpa+2Ti≈139.68TmOur schemen+1Tpm≈29n+29Tm3Tpm+2Tpa≈87.24TmFigure 3
Efficiency in signcryption/encryption. The unit isTm.Figure 4
Efficiency in decryption/designcryption. The unit isTm.


## 6. Conclusion

In this paper, we propose a CMRS scheme of high efficiency for ecological data sharing. After functional analysis, our scheme satisfies the security requirements, and it solves the problems of decryption fairness, recipient anonymity, and so on. After efficiency analysis, our scheme has high efficiency. It does not use BPO, but uses SPMOOECC for encryption and decryption, and ensures that SPMOOECC is used as little as possible, which greatly improves the efficiency of our scheme. After analysis, we can conclude that our scheme can be well applied to ecological data sharing.



---

*Source: 5132861-2020-08-19.xml*