# An Anonymous Multireceiver with Online/Offline Identity-Based Encryption

Authors: Qihua Wang; Fagen Li; Huaqun Wang
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

Anonymous multireceiver encryption scheme can not only protect the privacy of the receiver but also ensure the security of message. However, the computational cost of this scheme is very large. It is not suitable for the sender which has limited resources, such as mobile devices and sensor nodes. In this work, an anonymous multireceiver online/offline identity-based encryption is proposed based on offline/online and identity-based encryption (IBE). In identity-based encryption scheme, the sender can encrypt the message using the unique information of the user (such as identity number or e-mail address) as its public key. The receiver obtains the private key from a central authority. For mobile device with limited resource, the online/offline encryption scheme can reduce the computational cost. Compared to the previous anonymous multireceiver schemes, the proposed scheme can efficiently encrypt message with offline/online method and ensure the anonymity of receivers. The analysis results also show that our scheme is efficient in terms of computational cost by comparing to the previous works.


---

## Body

## 1. Introduction

Multireceiver communication [1] is a crucial way to send and receive message. It can effectively solve the problem of key management and data sending. Multireceiver encryption also is converted to broadcast encryption [2] in certain extent. In multireceiver encryption strategy, the sender/encryptor can select any receiver. In broadcast encryption scheme, the sender/encryptor sends message to a group of users; only the legal uses can decrypt the ciphertext. This scheme is widely used in pay-TV applications, the distribution of copyright materials, etc.In [3], the authors use the idea of identity-based encryption (IBE for short) for reference. The identity information of the receiver is converted to a public key. The receiver’s private key which is distributed by a Key Generator Center (KGC) is connected with the identity information. The receiver can use the private key to decrypt the ciphertext. In [4], Lu and Hu addressed a pairing based multireceiver encryption scheme which can broadcast sensitive information in a complex environment, but it did not protect the privacy of the users. That is to say, this scheme cannot reach the anonymity of the users. A secure and efficient anonymous multireceiver IBE scheme was proposed in [5]. Based on [5], an anonymous multireceiver IBE scheme was improved by Wang et al. [6]. The proposed method cannot truly attain the anonymity of the receiver's information, and the receiver's privacy was not protected. In [5, 6], a legal receiver can easily verify whether a specific user is one of the legal receiver or not using only two bilinear pairing computational costs. Li et al. [7] analyzed the security vulnerabilities that exist in [6], but they did not give specific solutions. In order to deal with the privacy of the legal receivers, a really anonymous multireceiver IBE scheme was proposed in [8]. In the proposed scheme, all users can receive the broadcast ciphertext of the sender/encryptor, but only the receiver which was selected by the sender/encryptor can decrypt the ciphertext information. No one except the sender knows who the receiver is. The key issue of this scheme is how to design encryption scheme by using Lagrange interpolation function. Chien [9] proposed an improved scheme which can achieve the receiver’s anonymity and enhance the security of the message. However, in encryption phase, this scheme requires a number of bilinear pairing operations which is proportional to the number of receivers. He et al. [10] addressed an efficient certificateless anonymous multireceiver encryption scheme according to elliptic curve cryptography for devices with limited resources. The anonymous multirecipient IBE scheme can be used in pay per-view TV channel and sensitive program order. The receiver does not want any other receivers to know his or her identity information.In IBE, the computational cost of multiplication and exponentiation operations in groups is larger. It takes much more time and battery power to execute exponential operations for the receiver with limited energy such as mobile phones or mobile devices. In IBE, data encryption needs bilinear pairing operation which can increase the runtime of encryption because the computational cost of bilinear pairing operation is very large. It is difficult to complete the encryption task in a short time for lightweight devices such as wireless sensor nodes or smart cards. Moreover, the anonymous multireceiver IBE takes more time compared to standard IBE.One challenge in the anonymous multireceiver IBE is that the added functionality may increase the computation cost compared to standard public key cryptography. Online/offline technology can effectively reduce encryption time. The first online/offline IBE scheme was proposed by Guo et al. [11]. The scheme divided the encryption process into two stages: online stage and offline stage. In offline stage, the complex operation is preprocessed. In online encryption stage, the sender performs simple operations and generates the ciphertext. The online phase would be very fast. Moreover, it requires little computational cost in this phase. The online/offline encryption strategy is more suitable for lightweight equipment such as wireless sensor nodes or smart cards [12, 13]. Online/offline identity-based encryption scheme has attracted extensive attention, and series of research results have emerged [14–16]. Recently online/offline technology is also used in attribute-based encryption [17, 18]. However, previous literatures did not apply the online/offline scheme to the anonymous multireceiver IBE.In this article, we concentrate on multireceiver IBE scheme that takes into consideration online/offline encryption. The offline information cannot be reused in previous work. In our proposed scheme, a few operations can be done in offline phase. The offline ciphertext which is computed in offline phase can be reused for the same receiver sets. This method can reduce the computation cost for the senders when they encrypt the message to the same receive sets.Our motivating application for the work in this way is mobile device with limited resources. The preparation computation can be done while the mobile device is plugged into a power supply, and then when it is on the move without plugging, it performs the encryption operations with little computational cost.The structure of this work is organized as follows. Section2 reviews the cryptographic backgrounds and Section 3 describes an anonymous multireceiver online/offline identity-based encryption. The security proof and performance analysis are given in Section 4. Finally, Section 5 is the conclusions of this work.


## 2. Preliminary

Some fundamental backgrounds related to this work are given in this section.


### 2.1. Lagrange Interpolation Theorem

Fitting the curve through these pointsx1,y1,x2,y2,…,(xt,yt) can be expressed as follows [6]:(1)fx=∑i=1tFix=∑i=0taixiwhere for each i(2)Fix=yi∏1≤j≠i≤tx-xjxi-xj=yix=xi0x∈x1,…,xi-1,xi+1,…,xtxi is mapped by identity information idi of the receiver.


### 2.2. Bilinear Maps

LetG1 and G2 be two multiplicative cyclic groups with the same prime order p. Let P be a generator of G1. Let e:G1×G1→G2 be a bilinear map which has the following properties [19]:(1)
Bilinearity:∀Q,R∈G1 and a,b∈Zp,  e(Q,R)=e(aP,bP)=e(P,P)ab.(2)
Nondegeneracy:∃Q,R∈G1, such that e(R,Q)≠1. 1 denotes the identity element of G2.(3)
Computability:∀Q,R∈G1; there is an efficient polynomial algorithm to calculate e(Q,R).According to the bilinearity, the bilinear mappinge has the following specific property:(3)eaP,bP=eP,Pab=ebP,aP


### 2.3. Hard Problems

The following security assumptions are used in many encryption schemes. We will use them to deal with some problems in our scheme. In our paper,P denotes the generator of G1.(1)
Computational Diffie-Hellman problem: given(P,aP,bP) for any a,b∈Zq∗, compute Pab.(2)
Bilinear Diffie-Hellman (BDH) problem: given(P,aP,Pb,cP) for some a,b,c∈Zq∗ compute e(g,g)abc.(3)
Cobilinear Diffie-Hellman (Co-BDH) problem [6]: given (P,aP,bP,Q) for any a,b∈Zq∗ and Q∈G1, compute e(P,Q)ab.(4)
Codecision bilinear Diffie-Hellman (Co-DBDH) problem [6]: given (P,aP,bP,Q,Z) for any a,b∈Zq∗, Q∈G1 and Z∈G2, decide whether Z=e(P,Q)ab.(5)
Codecision bilinear Diffie-Hellman (Co-DBDH) assumption [5]: an algorithm B with an output β∈{0,1} has advantage ε in solving the Co-DBDH problem if (4)PrBP,aP,bP,Q,eP,Qab=1-PrBP,aP,bP,Q,Z=1≥ε(6)
Given two groupsG1 and G2 of the same prime order q, (P,αP,α2P,…,αqP), α∈Zp∗, a generator P of G1, and a bilinear map e:G1×G1=G2,q-bilinear Diffie-Hellman inversion (q-BDHI) problem is to compute e(P,P)1/α.(7)
Given two groupsG1 and G2 of the same prime order q, (P,αP,γ), α∈Zp∗, γ∈Zp∗, a generator P of G1, and a bilinear map e:G1×G1=G2 the modified bilinear inverse Diffie-Hellman (mBIDH) problem is to compute e(P,P)1/α+γ.


### 2.4. Security Definition

According to the works [3, 5, 6], a general model and security formalization problem is given. Security formalization problem is indistinguishability encryptions of chosen ciphertext attacks, under selective multi-ID (IND-CCA-sMID for short) [5, 6]. The notion of IND-CCA-sMID is given as follows.Definition 1 ((IND-CCA-sMID) [5, 6]).
LetA be a polynomial-time algorithm attacker. Symbol ∏ denotes a general multireceiver IBE scheme. Attacker A interacts with the challenger in the following steps.
Setup. The challenger executes the setup algorithm. Attacker A attains the resulting public parameters from challenger. The attacker does not know any information about private key. The challenger keeps the master key secret.
Phase 1. A outputs multiple targets identities (id1,…,idt) where t denotes a positive integer.
Phase 2. A publishes private key extraction queries. When a private key extraction query with identity idi is received, the challenger obtains private key dj=Extract(params,s,idj) by running the private key extraction algorithm. The only constraint is that idj≠idi for i=1,…,t.
Phase 3. A publishes decryption queries for target identity information. When a decryption query denoted by (C∗,idi) for some t∈{1,2,…,t} is received, the challenger creates a private key which is denoted by di associated with identity information idi. The challenger returns the information D=Deccrypt(params,C∗,idi,di) to A.
Challenge. A outputs a target plaintext message pair (M0,M1); the challenger randomly selects β∈{0,1} and creates a target ciphertext information C=Encrypt(params,id1,…,idt,Mβ). Ciphertext C is given to A by the challenger.
Phase 4. A publishes the private key extraction queries and decryption queries for target identities, and query methods are the same as in phase 2 and phase 3, respectively. Restrictive condition is that C∗≠C.
Guess. To the end, A outputs the result of conjecture β′∈{0,1}. We can say that A wins the game if β′=β. A′s conjecture advantage is defined as follows:(5)Adv∏IND-CCA-sMIDA=Prβ=β′-12.Our scheme ∏ is said to be (τ,ε)-IND-CCA-sMID secure if the conjecture advantage Adv∏IND-CCA-sMID(A) of any attacker A with polynomial running time τ is less than ε.A breaks IND-CCA-sMID of ∏ with (τ,q1,q2,ε) if and only if the conjecture advantage of the attack A is not less than ε with the running time τ. q1 and q2 denote the number of private of key extraction queries and decryption queries, respectively. Scheme ∏ is said to be (τ,q1,q2,ε)- IND-CCA-sMID secure if there is no polynomial-time algorithm attacker A with (τ,q1,q2,ε) that can break IND-CCA-sMID of scheme ∏.


## 2.1. Lagrange Interpolation Theorem

Fitting the curve through these pointsx1,y1,x2,y2,…,(xt,yt) can be expressed as follows [6]:(1)fx=∑i=1tFix=∑i=0taixiwhere for each i(2)Fix=yi∏1≤j≠i≤tx-xjxi-xj=yix=xi0x∈x1,…,xi-1,xi+1,…,xtxi is mapped by identity information idi of the receiver.


## 2.2. Bilinear Maps

LetG1 and G2 be two multiplicative cyclic groups with the same prime order p. Let P be a generator of G1. Let e:G1×G1→G2 be a bilinear map which has the following properties [19]:(1)
Bilinearity:∀Q,R∈G1 and a,b∈Zp,  e(Q,R)=e(aP,bP)=e(P,P)ab.(2)
Nondegeneracy:∃Q,R∈G1, such that e(R,Q)≠1. 1 denotes the identity element of G2.(3)
Computability:∀Q,R∈G1; there is an efficient polynomial algorithm to calculate e(Q,R).According to the bilinearity, the bilinear mappinge has the following specific property:(3)eaP,bP=eP,Pab=ebP,aP


## 2.3. Hard Problems

The following security assumptions are used in many encryption schemes. We will use them to deal with some problems in our scheme. In our paper,P denotes the generator of G1.(1)
Computational Diffie-Hellman problem: given(P,aP,bP) for any a,b∈Zq∗, compute Pab.(2)
Bilinear Diffie-Hellman (BDH) problem: given(P,aP,Pb,cP) for some a,b,c∈Zq∗ compute e(g,g)abc.(3)
Cobilinear Diffie-Hellman (Co-BDH) problem [6]: given (P,aP,bP,Q) for any a,b∈Zq∗ and Q∈G1, compute e(P,Q)ab.(4)
Codecision bilinear Diffie-Hellman (Co-DBDH) problem [6]: given (P,aP,bP,Q,Z) for any a,b∈Zq∗, Q∈G1 and Z∈G2, decide whether Z=e(P,Q)ab.(5)
Codecision bilinear Diffie-Hellman (Co-DBDH) assumption [5]: an algorithm B with an output β∈{0,1} has advantage ε in solving the Co-DBDH problem if (4)PrBP,aP,bP,Q,eP,Qab=1-PrBP,aP,bP,Q,Z=1≥ε(6)
Given two groupsG1 and G2 of the same prime order q, (P,αP,α2P,…,αqP), α∈Zp∗, a generator P of G1, and a bilinear map e:G1×G1=G2,q-bilinear Diffie-Hellman inversion (q-BDHI) problem is to compute e(P,P)1/α.(7)
Given two groupsG1 and G2 of the same prime order q, (P,αP,γ), α∈Zp∗, γ∈Zp∗, a generator P of G1, and a bilinear map e:G1×G1=G2 the modified bilinear inverse Diffie-Hellman (mBIDH) problem is to compute e(P,P)1/α+γ.


## 2.4. Security Definition

According to the works [3, 5, 6], a general model and security formalization problem is given. Security formalization problem is indistinguishability encryptions of chosen ciphertext attacks, under selective multi-ID (IND-CCA-sMID for short) [5, 6]. The notion of IND-CCA-sMID is given as follows.Definition 1 ((IND-CCA-sMID) [5, 6]).
LetA be a polynomial-time algorithm attacker. Symbol ∏ denotes a general multireceiver IBE scheme. Attacker A interacts with the challenger in the following steps.
Setup. The challenger executes the setup algorithm. Attacker A attains the resulting public parameters from challenger. The attacker does not know any information about private key. The challenger keeps the master key secret.
Phase 1. A outputs multiple targets identities (id1,…,idt) where t denotes a positive integer.
Phase 2. A publishes private key extraction queries. When a private key extraction query with identity idi is received, the challenger obtains private key dj=Extract(params,s,idj) by running the private key extraction algorithm. The only constraint is that idj≠idi for i=1,…,t.
Phase 3. A publishes decryption queries for target identity information. When a decryption query denoted by (C∗,idi) for some t∈{1,2,…,t} is received, the challenger creates a private key which is denoted by di associated with identity information idi. The challenger returns the information D=Deccrypt(params,C∗,idi,di) to A.
Challenge. A outputs a target plaintext message pair (M0,M1); the challenger randomly selects β∈{0,1} and creates a target ciphertext information C=Encrypt(params,id1,…,idt,Mβ). Ciphertext C is given to A by the challenger.
Phase 4. A publishes the private key extraction queries and decryption queries for target identities, and query methods are the same as in phase 2 and phase 3, respectively. Restrictive condition is that C∗≠C.
Guess. To the end, A outputs the result of conjecture β′∈{0,1}. We can say that A wins the game if β′=β. A′s conjecture advantage is defined as follows:(5)Adv∏IND-CCA-sMIDA=Prβ=β′-12.Our scheme ∏ is said to be (τ,ε)-IND-CCA-sMID secure if the conjecture advantage Adv∏IND-CCA-sMID(A) of any attacker A with polynomial running time τ is less than ε.A breaks IND-CCA-sMID of ∏ with (τ,q1,q2,ε) if and only if the conjecture advantage of the attack A is not less than ε with the running time τ. q1 and q2 denote the number of private of key extraction queries and decryption queries, respectively. Scheme ∏ is said to be (τ,q1,q2,ε)- IND-CCA-sMID secure if there is no polynomial-time algorithm attacker A with (τ,q1,q2,ε) that can break IND-CCA-sMID of scheme ∏.


## 3. The Proposed Encryption Scheme

In this section, we introduce a novel anonymous multireceiver IBE on the basis of offline/online encryption. Our scheme ensures both the confidentiality of the information and the anonymity of the receiver. The process of our encryption scheme is given in Figure1. As shown in Figure 1, the system framework comprises three types of participants:Sender, Receiver, andKGC.Figure 1
The process of our encryption scheme.Sender.The sender encrypts the information and sends the ciphertext message to the designed receivers.Receiver.The receiver can decrypt the ciphertext message according to the private key.KGC.It is responsible for the generation of receivers’ private keys.In this section, an anonymous multireceiver online/offline IBE is proposed according to literature [6, 20]. Our encryption scheme usually consists of six algorithms as follows:Setup, Key extract, Offline encryption, Online encryption, andDecryption. In the following, we will describe the processes of our encryption scheme in detail.Setup Phase.The algorithm works in setup phase as follows:(1)
Pick a random values∈Zq∗,andP1∈G1.(2)
ComputePpub=sP.(3)
Select six one-way hash functions.H : { 0,1 } ∗ → Z q ∗,  H1:{0,1}∗→G1∗,  H2:G2→{0,1}w,  H4:{0,1}w→{0,1}w, H5:G2∥{0,1}∗∥G2×G2×⋯×G2,→{0,1}z,  z<w, H6:G2→{0,1}l,  l<w,  l+z=w. The symbols w,z, and l are some positive integers. They denote the length of binary data.(4)
Issue the public parametersq,G1,G2,e,n,P,Ppub,H,H1,H2,H4,H5,H6 and make the private key msk=s secret.Private Key Extract Phase.Input public parameters and the identity information idi of the receiver, and the PKC executes the algorithm as follows:(1)
ComputeQi=H1(idi).(2)
Compute the secret keydi for the identity idi of the receiver as(6)di=di1,di2=sQi+P1,1Hidi+sPOffline Encryption Phase.In this phase, the sender computes the following steps:(1)
Randomly choosex∈Zq∗ and compute K=e(P,P)x;(2)
Fori=1tot, randomly choose y1i∈Zq, and computer Ci1=(xPpub)+(xy1iP).(3)
Pick a randomr∈Zq∗; compute U=rP.(4)
Fori=1tot, randomly choose αi∈Zq; compute yi=αi-1rmodq.(5)
Fori=1tot, compute(7)Ri=∑j=1tajiyjQj=∑j=1tbjiQj(6)
Fori=1tot, compute(8)Ki=αiPpubOnline Encryption Phase (1)
According to the identity information, compute each potential receiver’sxi and Qi. Fori=1 to t, compute xi=H(idi) and Qi=H1(idi). (2)
f i ( x ) can be calculated, respectively, as follows: Fori=1 to t, compute(9)fix=∏1≤j≤t,j≠ix-xjxi-xj=ai1+ai2x+⋯+aitxt-1Inputting messageM and selecting t identities of the receivers, the sender performs the following steps.ComputeV=H6K∥H5(K∥M∥K1∥⋯∥Kt)⊕H2(e(Ppub,P1)r),W=EH4(H5(K∥M∥K1∥⋯∥Kt))(M), where E(·)denotes the symmetric encryption function.Fori=1 to t, compute(10)C1i=xHidi-y1iThe result ciphertext is C~=(U=rP,K1,…,Kt,V,W,C11,C12,…,C1t,R1,…,Rt).Decryption.Given ciphertext information C~, the legal receiver uses the private key to perform the tasks as follows:(1)
Computexi=H(idi).(2)
Computeλi=R1+xiR2+⋯xit-1Rt.(3)
ComputeH6(K)∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2e(U,di1)/e(Ki,λi).(4)
ComputeK=e(C1+(C1iP),di2) and separate H6(K)∥H5(K∥M∥K1∥⋯∥Kt) to obtain H5(K∥M∥K1∥⋯∥Kt).(5)
ComputeM′=DH4(H5(K||M||K1||⋯||Kt))(W), where D(·) denotes the symmetric decryption function. Test whether H5(K∥M∥K1∥⋯∥Kt)=H5(K∥M′∥K1∥⋯∥Kt) or not. Decrypted message M′ is message M if equality holds.


## 4. Security and Performance Analysis

In Section4, we first give the correctness analysis of our scheme, and then we compare security and computational cost with the previous literatures [5, 6, 8, 9].


### 4.1. Security Analysis

In Section4.1, the correctness and security of our encryption scheme are analyzed.


#### 4.1.1. Correctness

For each authorized receiver, it can decrypt the ciphertext by the following way. First, it can computeK′ and then recover the message M′ in the following way:(11)K′=eCi1+C1iP,di2=exPpub+xy1iP+xHidi-y1iP,1Hidi+sP=exsP+xHidiP,1Hidi+sP=esx+xHidiP,1Hidi+sP=eP,Px=KFor each authorized receiveri(i∈[1,t]) with identity idi, the receiver i can compute xi=H(idi) and structure function λ(x). It can obtain λi using Lagrange interpolating polynomial theorem.(12)λi=R1+xiR2+⋯+xii-1Ri+⋯+xit-1Rt=a11+a12xi+⋯+a1txt-1y1Q1+⋯+ai1+ai2xi+⋯+aitxit-1yiQi+⋯+at1+at2xi+⋯+attxt-1ytQt=yiQiThe receiver can obtain(13)eU,di1eKi,λi=erP,sQi+P1eαiPpub,yiQi=erP,sQierP,sP1ePpub,Qiαiyi=esP,QiresP,P1rePpub,Qir=esP,P1r=ePpub,P1r.Thus, the authorized receiver can perform the following steps:(1)
H6K∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2(e(Ppub,P1)r).(2)
SeparateH6(K)∥H5(K∥M∥K1∥⋯∥Kt) to obtain H5(K∥M∥K1∥⋯∥Kt).(3)
Finally, the authorized receiver decrypts the ciphertextM′=DH4(H5(K∥M∥K1∥⋯∥Kt))(W).


#### 4.1.2. The Confidentiality of Message

In order to decrypt the ciphertext information, the decryptor should know the symmetric secret keyH4(H5(K∥M∥K1∥⋯∥Kt)).FromH6(K)∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2(e(Ppub,P1)r), we can know that the only way to obtain the symmetric secret key is to calculate H2(e(Ppub,P1)r). If decryptor is not an authorized receiver, he/she would deal with the Co-BDH problem to compute e(P,P1)sr. In order to make our paper rigorous and complete, Theorem 2 is given in detail according to the proving process of papers [5, 6].Theorem 2.
Our proposed scheme is(τ,qH,qH1,qH2,qH4,qH5,qH6,q1,q2,ε)- IND-CCA-sMID secure under the (τ′,ε′)-codecision bilinear Diffie-Hellman assumption, where ε′≥ε and τ′≃τ+(qH1+qH5+q1)O(τ1)+q2O(τ1+τ2)+qHO(1)+qH2O(1)+qH4O(1)+qH6O(1). qH,qH1,qH2,qH4,qH5, and qH6 denote the number of queries of hash functions ,H1,H2,H4,H5, and H6.Proof.
Assume thatA is a (τ,qH,qH1,qH2,qH4,qH5,qH6,q1,q2,ε) attacker that can break our scheme ∏. The challenger B can resolve the Co-DBDH problem with advantage ε′ in runtime time τ′ by using A. According to the Co-DBDH assumption, the confidentiality of the proposed scheme can be guaranteed.
Assume thatB is given the tuple (q,G1,G2,e,n,P,aP,bP,Q,Z) as an instance of the Co-DBDH problem. B simulates the challenging environment in IND-CCA-sMID game for A as follows.
Phase 1. Assume that A output is the target identity information (id1,id2,…,idt) where t is a positive integer.
Setup. B sets P1=Q and Ppub=bP. B gives the public parameters N to the attacker A where N=(q,G1,G2,e,n,P,P1,Ppub,H,H1,H2,H4,H5,H6) and n is a positive integer and denotes the number of all users. Let T,T1,T2,T4,T5,T6 store the results of querying hash functions H,H1,H2,H4,H5,H6, respectively.
H-Query. Input identity information idj to H. B checks T. If there exists (idj,xj) in T return xj. Otherwise, do the following steps:(1)
Pick a randomly integerxj∈Zq∗.(2)
Put(idj,xj) to T.(3)
Returnxj.
H 1-Query. Input identity information idj to H1. B checks the T1. If there exists (idj,lj,Qj) in T1 return Qj. Otherwise, do the following steps:(1)
Pick a randomly integerlj∈Zq∗.(2)
Ifi∈{1,2,…,t} compute Qj=ljP else compute Qj=ljP-P1.(3)
Put(idj,lj,Qj) to T1.(4)
ReturnQj.
H 2-Query. Input Zj∈G2 to H2. B checks the T2. If there exists (Zj,δj) in T2, return δj. Otherwise, do the following steps:(1)
Pick a randomly stringδj∈{0,1}w.(2)
Put(Zj,δj) to T2 and return δj.
H 6-Query. Input Zj′∈G2 to H6. B checks T6. If there exists (Zj′,δj′) in T6 return δj′. Otherwise, do the following steps:(1)
Pick a randomly stringδj′∈{0,1}l.(2)
Put(Zj′,δj′) to T6 and return δj′.
H 5-Query. Input (Kj′,ℵj,Mj) to H5. B checks T5. If there exists (Kj′,ℵj,Mj,ρj,Γj) in T5 where Kj′,Γj∈G2,  ρj∈Zq∗,  ℵj∈G2×G2×⋯×G2 return ρj. Otherwise, do the following steps:(1)
Pick a randomly stingρj∈Zq∗ and compute Γj=ρjP.(2)
Put(Qj′,ℵj,Mj,ρj,Γj) to T5 and return ρj.
H 4-Query. Input σj∈{0,1}w to H4. B checks T4. If there exists (σj,ηj) in T4 return ηj. Otherwise, do the following steps:(1)
Pick a randomly stringηj∈{0,1}w.(2)
Put(σj,ηj) to T4 and return ηj.
Phase 2. A issues private key extraction queries for idj where j∈{1,2,…,t}. B does the following steps:(1)
If there exists(idj,lj,Qj) in T1, then compute dj1=lj1Ppub; otherwise, pick a randomly integer lj∈Zq∗ and compute dj1=ljPpub, Qj=ljP-P1.(2)
Put(idj,lj,Qj) to T1 and return dj1 to A.
Phase 3. A issues decryption query (C∗,idi) for identity information idi where i∈[1,t] and C∗=(U,K1,…,Kt,V,W,C11,C12,…,C1t). B does the following steps:(1)
SearchT5 to obtain (Kj′,ℵj,Mj,ρj,Γj) when Γj=Kj′. If not found, return “reject” to A.(2)
Computexi=H(idi).(3)
Computeλi=R1+xiR2+⋯xit-1Rt(4)
Compute(14)σ′=V⊕H2ePpub,ρjP1eU,liPpubeKi,λiwhere(15)ePpub,ρjP1eU,liPpub=esP,ρjP1eU,lisP=eρjP,sP1eU,lisP=eU,sP1eU,lisP=eU,sP1+Qi=eU,di1(5)
SetK=Kj′ and separate η′=H5(K∥Mj∥K1∥⋯∥Kt) from σ′.(6)
Test whetherMj=DH4(σ′)(W) or not. If not, return “reject” to A; else return Mj to A.
Challenge. A outputs a plaintext information pair (M0,M1). When receiving (M0,M1), B does the following steps:(1)
Randomly pickβ∈{0,1}.(2)
Fori=1,2,…,t search T1 to obtain li according to idi.(3)
SetU=aP=rP and Ι=Z.(4)
Fori=1,2,…,t compute(16)fix=∏1≤j≠i≤tx-xjxj-xi=ai1+ai2x+⋯+aitxt-1where aij∈Zq,j∈{1,2,…,t}.(5)
Pick a randomly integerαi∈Zq∗. For i=1,2,…,t compute(17)Ri=∑j=1tajiαj-1ljU=∑j=1taj,iαj-1rljP=∑j=1tajiyjQj=∑j=1tbjiQjKi=αiPpubC1i=xH1idi-y1i(6)
ComputeK=e(Ci1+(C1iP),di2).(7)
Setξ=H5(K∥Mβ∥K1∥⋯∥Kt), where ξ∈{0,1}z and create a target ciphertext information C, where C=(U,K1,K2,…,Kt,H6(K)∥ξ⊕H2(Ι),EH4(ξ)(Mβ)).(8)
ReturnC to attacker A.
Phase 4. A publishes private key extraction and decryption queries, and they are the same as phases 2 and 3. The constraint condition of decryption queries is that C∗≠C.
Guess. To the end, A outputs the guessing result β′∈{0,1}. If β′=β then B outputs 1; else it outputs 0. If I=e(P,Q)ab then(18)HK∥ξ⊕H2Ι=H6K∥ξ⊕H2ebP,Qa=H6K∥ξ⊕H2ePpub,P1r
That is to say,C is a valid ciphertext message. Otherwise, K is a randomized element of G2 and C is invalid. According to the above constructions, B simulates the random oracles hash function {H,H1,H2,H4,H5,H6}, the private key extraction, and the decryption queries inphases 2, 3, and4 successfully. So, we have(19)Pr⁡BP,aP,bP,Q,eP,Qab=1=Pr⁡β′=βwhere Pr[β′=β]-1/2≥ε, and Pr[B(P,aP,bP,Q,Z)=1]=1/2, Z is a random element in G2. Hence, we obtain(20)PrBP,aP,bP,Q,eP,Qab=1-PrBP,aP,bP,Q,Z=1≥12±ε-12=εThus, ε′≥ε and τ′≃τ+(qH1+qH5+q1)O(τ1)+q2O(τ1+τ2)+qHO(1)+qH2O(1)+qH4O(1)+qH6O(1). qH,qH1,qH2,qH4,qH5, and qH6 denote the number of queries to hash function, H1,H2,H4,H5, and H6.


#### 4.1.3. The Anonymity of Receivers

Fan et al.’s encryption strategy [5] cannot satisfy the anonymity of multireceiver. Every legal receiver can easily verify whether anyone is a legal receiver or not. A legal receiver with identity idi can computef(H(idk)), where idk denotes the identity information of the receiver. If equation e(Qi,f(H(xk)))=e(Qk,f(H(xi))) holds, the receiver with identity idk is an authorized receiver. In order to achieve multireceiver anonymously, Wang et al. [6] improved the multireceiver anonymous encryption scheme. For a ciphertext, Qi,Ppub,r are fixed 9 in their scheme. The authorized receiver with identity information idi can obtain value r from decryption process, although the numerical value of symbol r is randomly generated in encryption stage. If the equation eλHidl,υHidl=e(H1(idl),Ppub)r holds, the receiver with identity idl also is an authorized receiver. Random number r can be recovered by symmetric key and message M. Unfortunately, their encryption scheme cannot protect the privacy of the receiver. That is to say, it did not satisfy the anonymity of the receiver.In our proposed scheme, the above problems are solved. Only the authorized receiver can decrypt ciphertext information. Each receiver does not know whether others are authorized receivers or not. Thus, the privacy of the user can be protected.Theorem 3.
Our scheme satisfies the anonymity of receiver if the Co-DBDH problem is hard.In this work, we do not give the proofs of Theorem3. We can refer to literature [9] and literature [8] for details.Theorem 4.
In the random oracle model, our scheme is IND-CCA2 secure under the q-BDHI and mBIDH assumptions.This proof is similar to the proof of literature [21, 22]. Please refer to literature [21, 22] for details.


### 4.2. Performance Analysis

In this section, the computational consumption of our scheme is given. In order to analyze the computational performance, some notations of the symbols are summarized in Table1.Table 1
The notations of the symbols.
Symbols Meanings of the symbols n The number of all users t The number of authorized receivers,t∈[1,n] C P The computational cost of one bilinear pairing operation C E n c The cost of symmetric encryption or decryption one message C S m The computational cost of one scalar multiplication inG1 C E x - z The computational cost of exponentiation computation inZq∗ C M u - z The computational cost of multiplication inZq∗ C M u The computational cost of multiplication inG1 C A d d - z The computational cost of addition inZq∗ C A d d The computational cost of addition inG1 C E x The computational cost of exponentiation computation inG2 C H The computational cost of one general hash operation C H - p The computational cost of one hash-to-point operation L E c p The bit length of an element inG1. L H The length of hash value L E n c The bit length of a plaintext messagesThe implementation environment is on a mobile phone (Samsung Galaxy S5 with a Quad-core 2.45G processor, 2G bytes memory, and the Google Android 4.4.2 operating system) [10]. The implementation runtime results of main operations are listed in Table 2 [10, 23]. The efficiency comparison is summarized in Tables 3 and 4. The computational cost in our scheme is compared to literature [5, 6, 8, 9]. In addition, the mentioned five schemes contain encryption and decryption computational cost. From Table 5, we can see that our scheme is nearly identical to the ciphertext length of other schemes in [5, 6, 8, 9]. As shown from Table 6, our offline/online encryption scheme is the same as literature [8, 9], and encryption schemes of them are anonymous. However, literature [8] and literature [9] do not use the offline/online encryption scheme.Table 2
Computational cost of main operations.
Operations Computational cost (ms) C P 32.713 C H - p 33.582 C S m 13.401 C A d d 0.056 C E x - z 0.002 C E x 2.249 C H 0.006 C E n c 0.001 C A d d - z 0.001 C M u - z 0.001 C M u 0.008Table 3
The comparisons of computation cost in different encryption schemes.
Scheme The cost of encryption Literature [5] t + 3 C H + t C H - p + t 2 + 1 + t 2 + 2 t - 2 t - 1 2 C M u - z + t 2 + t + 2 C S m + C E x + C E x - z + t 2 + t - 1 t - 1 2 C A d d - z + t t - 1 C A d d + C P Literature [6] t + 3 C H + t C H - p + t 2 + t + t 2 + 2 t - 2 t - 1 2 C M u - z + 2 t 2 + t + 1 C S m + C E x + t C E x - z + t 2 + t - 1 t - 1 2 C A d d - z + 2 t t - 1 C A d d + C P Literature [8] t + 4 C H + t C H - p + t 2 + t + t 2 + 2 t - 2 t - 1 2 C M u - z + t + 1 C S m + C E x + t C E x - z + t 2 + t - 1 t - 1 2 C A d d - z + t t - 1 C M u + C P Literature [9] ( t + 2 ) C H + ( t + 2 ) C S m + t C P Proposed scheme t C H + t C H - p + t ( t - 1 ) C A d d - z + t ( t - 1 ) C M u - z + t ( t - 1 ) C E x - z + C pTable 4
The comparisons of computation cost in different decryption schemes.
Scheme The cost of decryption Literature [5] 3 C H + t C S m + ( t - 1 ) C E x - z + ( t - 1 ) C A d d + 2 C P Literature [6] 3 C H + ( 2 t - 1 ) C S m + 2 ( t - 1 ) C E x - z + 2 ( t - 1 ) C A d d + 2 C P Literature [8] 6 C H + ( t - 1 ) C S m + ( t - 2 ) C E x - z + ( t - 1 ) C A d d + 2 C P Literature [9] ( t + 2 ) C H + ( t + 2 ) C S m + t C P Proposed scheme 6 C H + t C A d d + ( t - 2 ) C E x - z + 3 C P + C E xTable 5
The comparisons of ciphertext length in different schemes.
Scheme The length of ciphertext Literature [5] ( t + 2 ) L E c p + L H + L E n c Literature [6] ( 2 t + 2 ) L E c p + L H + L E n c Literature [8] ( 2 t + 1 ) L E c p + L H + L E n c Literature [9] ( t + 2 ) L E c p + L H + L E n c Proposed scheme ( 3 t + 1 ) L E c p + L H + L E n cTable 6
Comparison of different schemes.
Scheme Offline/online encryption Anonymity Literature [5] no no Literature [6] no no Literature [8] no yes Literature [9] no yes Proposed scheme yes yesFrom Tables3 and 4, we can see that our scheme needs one bilinear pairing operation and three bilinear pairing operations in encryption phase and decryption phase. The number of bilinear pairing operation increases linearly with the number of recipients in encryption and decryption phase in literature [9]. Bilinear pairing operation requires a lot of calculation consumption. It is not suitable for mobile devices with limited energy. From Table 6, we know that only our scheme uses offline/online encryption.In order to give an intuitive knowledge, Figures2 and 3 also describe the computational cost in encryption and decryption schemes, respectively. Symbol t denotes the number of authorized receivers in Figures 2 and 3. According to Tables 2 and 3, we can easily compute the runtime of encryption and decryption scheme at different literatures [5, 6, 8, 9]. The computational cost on encryption and decryption is summarized in Figures 2 and 3, respectively. From Figure 2, we can see that the computational cost in [9] is the least, and our proposed scheme consumes little computation time in encryption. Literature [9] does not use offline/online encryption, and computational cost in our proposed scheme contains runtime of offline encryption and online encryption. When receivers decrypt the ciphertext, our scheme consumes the minimum computation time. As legal receiver t increases, the computational cost increases gradually in Figures 2 and 3.Figure 2
Computational cost of different scheme in encryption.Figure 3
Computational cost of different scheme in decryption.


## 4.1. Security Analysis

In Section4.1, the correctness and security of our encryption scheme are analyzed.


### 4.1.1. Correctness

For each authorized receiver, it can decrypt the ciphertext by the following way. First, it can computeK′ and then recover the message M′ in the following way:(11)K′=eCi1+C1iP,di2=exPpub+xy1iP+xHidi-y1iP,1Hidi+sP=exsP+xHidiP,1Hidi+sP=esx+xHidiP,1Hidi+sP=eP,Px=KFor each authorized receiveri(i∈[1,t]) with identity idi, the receiver i can compute xi=H(idi) and structure function λ(x). It can obtain λi using Lagrange interpolating polynomial theorem.(12)λi=R1+xiR2+⋯+xii-1Ri+⋯+xit-1Rt=a11+a12xi+⋯+a1txt-1y1Q1+⋯+ai1+ai2xi+⋯+aitxit-1yiQi+⋯+at1+at2xi+⋯+attxt-1ytQt=yiQiThe receiver can obtain(13)eU,di1eKi,λi=erP,sQi+P1eαiPpub,yiQi=erP,sQierP,sP1ePpub,Qiαiyi=esP,QiresP,P1rePpub,Qir=esP,P1r=ePpub,P1r.Thus, the authorized receiver can perform the following steps:(1)
H6K∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2(e(Ppub,P1)r).(2)
SeparateH6(K)∥H5(K∥M∥K1∥⋯∥Kt) to obtain H5(K∥M∥K1∥⋯∥Kt).(3)
Finally, the authorized receiver decrypts the ciphertextM′=DH4(H5(K∥M∥K1∥⋯∥Kt))(W).


### 4.1.2. The Confidentiality of Message

In order to decrypt the ciphertext information, the decryptor should know the symmetric secret keyH4(H5(K∥M∥K1∥⋯∥Kt)).FromH6(K)∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2(e(Ppub,P1)r), we can know that the only way to obtain the symmetric secret key is to calculate H2(e(Ppub,P1)r). If decryptor is not an authorized receiver, he/she would deal with the Co-BDH problem to compute e(P,P1)sr. In order to make our paper rigorous and complete, Theorem 2 is given in detail according to the proving process of papers [5, 6].Theorem 2.
Our proposed scheme is(τ,qH,qH1,qH2,qH4,qH5,qH6,q1,q2,ε)- IND-CCA-sMID secure under the (τ′,ε′)-codecision bilinear Diffie-Hellman assumption, where ε′≥ε and τ′≃τ+(qH1+qH5+q1)O(τ1)+q2O(τ1+τ2)+qHO(1)+qH2O(1)+qH4O(1)+qH6O(1). qH,qH1,qH2,qH4,qH5, and qH6 denote the number of queries of hash functions ,H1,H2,H4,H5, and H6.Proof.
Assume thatA is a (τ,qH,qH1,qH2,qH4,qH5,qH6,q1,q2,ε) attacker that can break our scheme ∏. The challenger B can resolve the Co-DBDH problem with advantage ε′ in runtime time τ′ by using A. According to the Co-DBDH assumption, the confidentiality of the proposed scheme can be guaranteed.
Assume thatB is given the tuple (q,G1,G2,e,n,P,aP,bP,Q,Z) as an instance of the Co-DBDH problem. B simulates the challenging environment in IND-CCA-sMID game for A as follows.
Phase 1. Assume that A output is the target identity information (id1,id2,…,idt) where t is a positive integer.
Setup. B sets P1=Q and Ppub=bP. B gives the public parameters N to the attacker A where N=(q,G1,G2,e,n,P,P1,Ppub,H,H1,H2,H4,H5,H6) and n is a positive integer and denotes the number of all users. Let T,T1,T2,T4,T5,T6 store the results of querying hash functions H,H1,H2,H4,H5,H6, respectively.
H-Query. Input identity information idj to H. B checks T. If there exists (idj,xj) in T return xj. Otherwise, do the following steps:(1)
Pick a randomly integerxj∈Zq∗.(2)
Put(idj,xj) to T.(3)
Returnxj.
H 1-Query. Input identity information idj to H1. B checks the T1. If there exists (idj,lj,Qj) in T1 return Qj. Otherwise, do the following steps:(1)
Pick a randomly integerlj∈Zq∗.(2)
Ifi∈{1,2,…,t} compute Qj=ljP else compute Qj=ljP-P1.(3)
Put(idj,lj,Qj) to T1.(4)
ReturnQj.
H 2-Query. Input Zj∈G2 to H2. B checks the T2. If there exists (Zj,δj) in T2, return δj. Otherwise, do the following steps:(1)
Pick a randomly stringδj∈{0,1}w.(2)
Put(Zj,δj) to T2 and return δj.
H 6-Query. Input Zj′∈G2 to H6. B checks T6. If there exists (Zj′,δj′) in T6 return δj′. Otherwise, do the following steps:(1)
Pick a randomly stringδj′∈{0,1}l.(2)
Put(Zj′,δj′) to T6 and return δj′.
H 5-Query. Input (Kj′,ℵj,Mj) to H5. B checks T5. If there exists (Kj′,ℵj,Mj,ρj,Γj) in T5 where Kj′,Γj∈G2,  ρj∈Zq∗,  ℵj∈G2×G2×⋯×G2 return ρj. Otherwise, do the following steps:(1)
Pick a randomly stingρj∈Zq∗ and compute Γj=ρjP.(2)
Put(Qj′,ℵj,Mj,ρj,Γj) to T5 and return ρj.
H 4-Query. Input σj∈{0,1}w to H4. B checks T4. If there exists (σj,ηj) in T4 return ηj. Otherwise, do the following steps:(1)
Pick a randomly stringηj∈{0,1}w.(2)
Put(σj,ηj) to T4 and return ηj.
Phase 2. A issues private key extraction queries for idj where j∈{1,2,…,t}. B does the following steps:(1)
If there exists(idj,lj,Qj) in T1, then compute dj1=lj1Ppub; otherwise, pick a randomly integer lj∈Zq∗ and compute dj1=ljPpub, Qj=ljP-P1.(2)
Put(idj,lj,Qj) to T1 and return dj1 to A.
Phase 3. A issues decryption query (C∗,idi) for identity information idi where i∈[1,t] and C∗=(U,K1,…,Kt,V,W,C11,C12,…,C1t). B does the following steps:(1)
SearchT5 to obtain (Kj′,ℵj,Mj,ρj,Γj) when Γj=Kj′. If not found, return “reject” to A.(2)
Computexi=H(idi).(3)
Computeλi=R1+xiR2+⋯xit-1Rt(4)
Compute(14)σ′=V⊕H2ePpub,ρjP1eU,liPpubeKi,λiwhere(15)ePpub,ρjP1eU,liPpub=esP,ρjP1eU,lisP=eρjP,sP1eU,lisP=eU,sP1eU,lisP=eU,sP1+Qi=eU,di1(5)
SetK=Kj′ and separate η′=H5(K∥Mj∥K1∥⋯∥Kt) from σ′.(6)
Test whetherMj=DH4(σ′)(W) or not. If not, return “reject” to A; else return Mj to A.
Challenge. A outputs a plaintext information pair (M0,M1). When receiving (M0,M1), B does the following steps:(1)
Randomly pickβ∈{0,1}.(2)
Fori=1,2,…,t search T1 to obtain li according to idi.(3)
SetU=aP=rP and Ι=Z.(4)
Fori=1,2,…,t compute(16)fix=∏1≤j≠i≤tx-xjxj-xi=ai1+ai2x+⋯+aitxt-1where aij∈Zq,j∈{1,2,…,t}.(5)
Pick a randomly integerαi∈Zq∗. For i=1,2,…,t compute(17)Ri=∑j=1tajiαj-1ljU=∑j=1taj,iαj-1rljP=∑j=1tajiyjQj=∑j=1tbjiQjKi=αiPpubC1i=xH1idi-y1i(6)
ComputeK=e(Ci1+(C1iP),di2).(7)
Setξ=H5(K∥Mβ∥K1∥⋯∥Kt), where ξ∈{0,1}z and create a target ciphertext information C, where C=(U,K1,K2,…,Kt,H6(K)∥ξ⊕H2(Ι),EH4(ξ)(Mβ)).(8)
ReturnC to attacker A.
Phase 4. A publishes private key extraction and decryption queries, and they are the same as phases 2 and 3. The constraint condition of decryption queries is that C∗≠C.
Guess. To the end, A outputs the guessing result β′∈{0,1}. If β′=β then B outputs 1; else it outputs 0. If I=e(P,Q)ab then(18)HK∥ξ⊕H2Ι=H6K∥ξ⊕H2ebP,Qa=H6K∥ξ⊕H2ePpub,P1r
That is to say,C is a valid ciphertext message. Otherwise, K is a randomized element of G2 and C is invalid. According to the above constructions, B simulates the random oracles hash function {H,H1,H2,H4,H5,H6}, the private key extraction, and the decryption queries inphases 2, 3, and4 successfully. So, we have(19)Pr⁡BP,aP,bP,Q,eP,Qab=1=Pr⁡β′=βwhere Pr[β′=β]-1/2≥ε, and Pr[B(P,aP,bP,Q,Z)=1]=1/2, Z is a random element in G2. Hence, we obtain(20)PrBP,aP,bP,Q,eP,Qab=1-PrBP,aP,bP,Q,Z=1≥12±ε-12=εThus, ε′≥ε and τ′≃τ+(qH1+qH5+q1)O(τ1)+q2O(τ1+τ2)+qHO(1)+qH2O(1)+qH4O(1)+qH6O(1). qH,qH1,qH2,qH4,qH5, and qH6 denote the number of queries to hash function, H1,H2,H4,H5, and H6.


### 4.1.3. The Anonymity of Receivers

Fan et al.’s encryption strategy [5] cannot satisfy the anonymity of multireceiver. Every legal receiver can easily verify whether anyone is a legal receiver or not. A legal receiver with identity idi can computef(H(idk)), where idk denotes the identity information of the receiver. If equation e(Qi,f(H(xk)))=e(Qk,f(H(xi))) holds, the receiver with identity idk is an authorized receiver. In order to achieve multireceiver anonymously, Wang et al. [6] improved the multireceiver anonymous encryption scheme. For a ciphertext, Qi,Ppub,r are fixed 9 in their scheme. The authorized receiver with identity information idi can obtain value r from decryption process, although the numerical value of symbol r is randomly generated in encryption stage. If the equation eλHidl,υHidl=e(H1(idl),Ppub)r holds, the receiver with identity idl also is an authorized receiver. Random number r can be recovered by symmetric key and message M. Unfortunately, their encryption scheme cannot protect the privacy of the receiver. That is to say, it did not satisfy the anonymity of the receiver.In our proposed scheme, the above problems are solved. Only the authorized receiver can decrypt ciphertext information. Each receiver does not know whether others are authorized receivers or not. Thus, the privacy of the user can be protected.Theorem 3.
Our scheme satisfies the anonymity of receiver if the Co-DBDH problem is hard.In this work, we do not give the proofs of Theorem3. We can refer to literature [9] and literature [8] for details.Theorem 4.
In the random oracle model, our scheme is IND-CCA2 secure under the q-BDHI and mBIDH assumptions.This proof is similar to the proof of literature [21, 22]. Please refer to literature [21, 22] for details.


## 4.1.1. Correctness

For each authorized receiver, it can decrypt the ciphertext by the following way. First, it can computeK′ and then recover the message M′ in the following way:(11)K′=eCi1+C1iP,di2=exPpub+xy1iP+xHidi-y1iP,1Hidi+sP=exsP+xHidiP,1Hidi+sP=esx+xHidiP,1Hidi+sP=eP,Px=KFor each authorized receiveri(i∈[1,t]) with identity idi, the receiver i can compute xi=H(idi) and structure function λ(x). It can obtain λi using Lagrange interpolating polynomial theorem.(12)λi=R1+xiR2+⋯+xii-1Ri+⋯+xit-1Rt=a11+a12xi+⋯+a1txt-1y1Q1+⋯+ai1+ai2xi+⋯+aitxit-1yiQi+⋯+at1+at2xi+⋯+attxt-1ytQt=yiQiThe receiver can obtain(13)eU,di1eKi,λi=erP,sQi+P1eαiPpub,yiQi=erP,sQierP,sP1ePpub,Qiαiyi=esP,QiresP,P1rePpub,Qir=esP,P1r=ePpub,P1r.Thus, the authorized receiver can perform the following steps:(1)
H6K∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2(e(Ppub,P1)r).(2)
SeparateH6(K)∥H5(K∥M∥K1∥⋯∥Kt) to obtain H5(K∥M∥K1∥⋯∥Kt).(3)
Finally, the authorized receiver decrypts the ciphertextM′=DH4(H5(K∥M∥K1∥⋯∥Kt))(W).


## 4.1.2. The Confidentiality of Message

In order to decrypt the ciphertext information, the decryptor should know the symmetric secret keyH4(H5(K∥M∥K1∥⋯∥Kt)).FromH6(K)∥H5(K∥M∥K1∥⋯∥Kt)=V⊕H2(e(Ppub,P1)r), we can know that the only way to obtain the symmetric secret key is to calculate H2(e(Ppub,P1)r). If decryptor is not an authorized receiver, he/she would deal with the Co-BDH problem to compute e(P,P1)sr. In order to make our paper rigorous and complete, Theorem 2 is given in detail according to the proving process of papers [5, 6].Theorem 2.
Our proposed scheme is(τ,qH,qH1,qH2,qH4,qH5,qH6,q1,q2,ε)- IND-CCA-sMID secure under the (τ′,ε′)-codecision bilinear Diffie-Hellman assumption, where ε′≥ε and τ′≃τ+(qH1+qH5+q1)O(τ1)+q2O(τ1+τ2)+qHO(1)+qH2O(1)+qH4O(1)+qH6O(1). qH,qH1,qH2,qH4,qH5, and qH6 denote the number of queries of hash functions ,H1,H2,H4,H5, and H6.Proof.
Assume thatA is a (τ,qH,qH1,qH2,qH4,qH5,qH6,q1,q2,ε) attacker that can break our scheme ∏. The challenger B can resolve the Co-DBDH problem with advantage ε′ in runtime time τ′ by using A. According to the Co-DBDH assumption, the confidentiality of the proposed scheme can be guaranteed.
Assume thatB is given the tuple (q,G1,G2,e,n,P,aP,bP,Q,Z) as an instance of the Co-DBDH problem. B simulates the challenging environment in IND-CCA-sMID game for A as follows.
Phase 1. Assume that A output is the target identity information (id1,id2,…,idt) where t is a positive integer.
Setup. B sets P1=Q and Ppub=bP. B gives the public parameters N to the attacker A where N=(q,G1,G2,e,n,P,P1,Ppub,H,H1,H2,H4,H5,H6) and n is a positive integer and denotes the number of all users. Let T,T1,T2,T4,T5,T6 store the results of querying hash functions H,H1,H2,H4,H5,H6, respectively.
H-Query. Input identity information idj to H. B checks T. If there exists (idj,xj) in T return xj. Otherwise, do the following steps:(1)
Pick a randomly integerxj∈Zq∗.(2)
Put(idj,xj) to T.(3)
Returnxj.
H 1-Query. Input identity information idj to H1. B checks the T1. If there exists (idj,lj,Qj) in T1 return Qj. Otherwise, do the following steps:(1)
Pick a randomly integerlj∈Zq∗.(2)
Ifi∈{1,2,…,t} compute Qj=ljP else compute Qj=ljP-P1.(3)
Put(idj,lj,Qj) to T1.(4)
ReturnQj.
H 2-Query. Input Zj∈G2 to H2. B checks the T2. If there exists (Zj,δj) in T2, return δj. Otherwise, do the following steps:(1)
Pick a randomly stringδj∈{0,1}w.(2)
Put(Zj,δj) to T2 and return δj.
H 6-Query. Input Zj′∈G2 to H6. B checks T6. If there exists (Zj′,δj′) in T6 return δj′. Otherwise, do the following steps:(1)
Pick a randomly stringδj′∈{0,1}l.(2)
Put(Zj′,δj′) to T6 and return δj′.
H 5-Query. Input (Kj′,ℵj,Mj) to H5. B checks T5. If there exists (Kj′,ℵj,Mj,ρj,Γj) in T5 where Kj′,Γj∈G2,  ρj∈Zq∗,  ℵj∈G2×G2×⋯×G2 return ρj. Otherwise, do the following steps:(1)
Pick a randomly stingρj∈Zq∗ and compute Γj=ρjP.(2)
Put(Qj′,ℵj,Mj,ρj,Γj) to T5 and return ρj.
H 4-Query. Input σj∈{0,1}w to H4. B checks T4. If there exists (σj,ηj) in T4 return ηj. Otherwise, do the following steps:(1)
Pick a randomly stringηj∈{0,1}w.(2)
Put(σj,ηj) to T4 and return ηj.
Phase 2. A issues private key extraction queries for idj where j∈{1,2,…,t}. B does the following steps:(1)
If there exists(idj,lj,Qj) in T1, then compute dj1=lj1Ppub; otherwise, pick a randomly integer lj∈Zq∗ and compute dj1=ljPpub, Qj=ljP-P1.(2)
Put(idj,lj,Qj) to T1 and return dj1 to A.
Phase 3. A issues decryption query (C∗,idi) for identity information idi where i∈[1,t] and C∗=(U,K1,…,Kt,V,W,C11,C12,…,C1t). B does the following steps:(1)
SearchT5 to obtain (Kj′,ℵj,Mj,ρj,Γj) when Γj=Kj′. If not found, return “reject” to A.(2)
Computexi=H(idi).(3)
Computeλi=R1+xiR2+⋯xit-1Rt(4)
Compute(14)σ′=V⊕H2ePpub,ρjP1eU,liPpubeKi,λiwhere(15)ePpub,ρjP1eU,liPpub=esP,ρjP1eU,lisP=eρjP,sP1eU,lisP=eU,sP1eU,lisP=eU,sP1+Qi=eU,di1(5)
SetK=Kj′ and separate η′=H5(K∥Mj∥K1∥⋯∥Kt) from σ′.(6)
Test whetherMj=DH4(σ′)(W) or not. If not, return “reject” to A; else return Mj to A.
Challenge. A outputs a plaintext information pair (M0,M1). When receiving (M0,M1), B does the following steps:(1)
Randomly pickβ∈{0,1}.(2)
Fori=1,2,…,t search T1 to obtain li according to idi.(3)
SetU=aP=rP and Ι=Z.(4)
Fori=1,2,…,t compute(16)fix=∏1≤j≠i≤tx-xjxj-xi=ai1+ai2x+⋯+aitxt-1where aij∈Zq,j∈{1,2,…,t}.(5)
Pick a randomly integerαi∈Zq∗. For i=1,2,…,t compute(17)Ri=∑j=1tajiαj-1ljU=∑j=1taj,iαj-1rljP=∑j=1tajiyjQj=∑j=1tbjiQjKi=αiPpubC1i=xH1idi-y1i(6)
ComputeK=e(Ci1+(C1iP),di2).(7)
Setξ=H5(K∥Mβ∥K1∥⋯∥Kt), where ξ∈{0,1}z and create a target ciphertext information C, where C=(U,K1,K2,…,Kt,H6(K)∥ξ⊕H2(Ι),EH4(ξ)(Mβ)).(8)
ReturnC to attacker A.
Phase 4. A publishes private key extraction and decryption queries, and they are the same as phases 2 and 3. The constraint condition of decryption queries is that C∗≠C.
Guess. To the end, A outputs the guessing result β′∈{0,1}. If β′=β then B outputs 1; else it outputs 0. If I=e(P,Q)ab then(18)HK∥ξ⊕H2Ι=H6K∥ξ⊕H2ebP,Qa=H6K∥ξ⊕H2ePpub,P1r
That is to say,C is a valid ciphertext message. Otherwise, K is a randomized element of G2 and C is invalid. According to the above constructions, B simulates the random oracles hash function {H,H1,H2,H4,H5,H6}, the private key extraction, and the decryption queries inphases 2, 3, and4 successfully. So, we have(19)Pr⁡BP,aP,bP,Q,eP,Qab=1=Pr⁡β′=βwhere Pr[β′=β]-1/2≥ε, and Pr[B(P,aP,bP,Q,Z)=1]=1/2, Z is a random element in G2. Hence, we obtain(20)PrBP,aP,bP,Q,eP,Qab=1-PrBP,aP,bP,Q,Z=1≥12±ε-12=εThus, ε′≥ε and τ′≃τ+(qH1+qH5+q1)O(τ1)+q2O(τ1+τ2)+qHO(1)+qH2O(1)+qH4O(1)+qH6O(1). qH,qH1,qH2,qH4,qH5, and qH6 denote the number of queries to hash function, H1,H2,H4,H5, and H6.


## 4.1.3. The Anonymity of Receivers

Fan et al.’s encryption strategy [5] cannot satisfy the anonymity of multireceiver. Every legal receiver can easily verify whether anyone is a legal receiver or not. A legal receiver with identity idi can computef(H(idk)), where idk denotes the identity information of the receiver. If equation e(Qi,f(H(xk)))=e(Qk,f(H(xi))) holds, the receiver with identity idk is an authorized receiver. In order to achieve multireceiver anonymously, Wang et al. [6] improved the multireceiver anonymous encryption scheme. For a ciphertext, Qi,Ppub,r are fixed 9 in their scheme. The authorized receiver with identity information idi can obtain value r from decryption process, although the numerical value of symbol r is randomly generated in encryption stage. If the equation eλHidl,υHidl=e(H1(idl),Ppub)r holds, the receiver with identity idl also is an authorized receiver. Random number r can be recovered by symmetric key and message M. Unfortunately, their encryption scheme cannot protect the privacy of the receiver. That is to say, it did not satisfy the anonymity of the receiver.In our proposed scheme, the above problems are solved. Only the authorized receiver can decrypt ciphertext information. Each receiver does not know whether others are authorized receivers or not. Thus, the privacy of the user can be protected.Theorem 3.
Our scheme satisfies the anonymity of receiver if the Co-DBDH problem is hard.In this work, we do not give the proofs of Theorem3. We can refer to literature [9] and literature [8] for details.Theorem 4.
In the random oracle model, our scheme is IND-CCA2 secure under the q-BDHI and mBIDH assumptions.This proof is similar to the proof of literature [21, 22]. Please refer to literature [21, 22] for details.


## 4.2. Performance Analysis

In this section, the computational consumption of our scheme is given. In order to analyze the computational performance, some notations of the symbols are summarized in Table1.Table 1
The notations of the symbols.
Symbols Meanings of the symbols n The number of all users t The number of authorized receivers,t∈[1,n] C P The computational cost of one bilinear pairing operation C E n c The cost of symmetric encryption or decryption one message C S m The computational cost of one scalar multiplication inG1 C E x - z The computational cost of exponentiation computation inZq∗ C M u - z The computational cost of multiplication inZq∗ C M u The computational cost of multiplication inG1 C A d d - z The computational cost of addition inZq∗ C A d d The computational cost of addition inG1 C E x The computational cost of exponentiation computation inG2 C H The computational cost of one general hash operation C H - p The computational cost of one hash-to-point operation L E c p The bit length of an element inG1. L H The length of hash value L E n c The bit length of a plaintext messagesThe implementation environment is on a mobile phone (Samsung Galaxy S5 with a Quad-core 2.45G processor, 2G bytes memory, and the Google Android 4.4.2 operating system) [10]. The implementation runtime results of main operations are listed in Table 2 [10, 23]. The efficiency comparison is summarized in Tables 3 and 4. The computational cost in our scheme is compared to literature [5, 6, 8, 9]. In addition, the mentioned five schemes contain encryption and decryption computational cost. From Table 5, we can see that our scheme is nearly identical to the ciphertext length of other schemes in [5, 6, 8, 9]. As shown from Table 6, our offline/online encryption scheme is the same as literature [8, 9], and encryption schemes of them are anonymous. However, literature [8] and literature [9] do not use the offline/online encryption scheme.Table 2
Computational cost of main operations.
Operations Computational cost (ms) C P 32.713 C H - p 33.582 C S m 13.401 C A d d 0.056 C E x - z 0.002 C E x 2.249 C H 0.006 C E n c 0.001 C A d d - z 0.001 C M u - z 0.001 C M u 0.008Table 3
The comparisons of computation cost in different encryption schemes.
Scheme The cost of encryption Literature [5] t + 3 C H + t C H - p + t 2 + 1 + t 2 + 2 t - 2 t - 1 2 C M u - z + t 2 + t + 2 C S m + C E x + C E x - z + t 2 + t - 1 t - 1 2 C A d d - z + t t - 1 C A d d + C P Literature [6] t + 3 C H + t C H - p + t 2 + t + t 2 + 2 t - 2 t - 1 2 C M u - z + 2 t 2 + t + 1 C S m + C E x + t C E x - z + t 2 + t - 1 t - 1 2 C A d d - z + 2 t t - 1 C A d d + C P Literature [8] t + 4 C H + t C H - p + t 2 + t + t 2 + 2 t - 2 t - 1 2 C M u - z + t + 1 C S m + C E x + t C E x - z + t 2 + t - 1 t - 1 2 C A d d - z + t t - 1 C M u + C P Literature [9] ( t + 2 ) C H + ( t + 2 ) C S m + t C P Proposed scheme t C H + t C H - p + t ( t - 1 ) C A d d - z + t ( t - 1 ) C M u - z + t ( t - 1 ) C E x - z + C pTable 4
The comparisons of computation cost in different decryption schemes.
Scheme The cost of decryption Literature [5] 3 C H + t C S m + ( t - 1 ) C E x - z + ( t - 1 ) C A d d + 2 C P Literature [6] 3 C H + ( 2 t - 1 ) C S m + 2 ( t - 1 ) C E x - z + 2 ( t - 1 ) C A d d + 2 C P Literature [8] 6 C H + ( t - 1 ) C S m + ( t - 2 ) C E x - z + ( t - 1 ) C A d d + 2 C P Literature [9] ( t + 2 ) C H + ( t + 2 ) C S m + t C P Proposed scheme 6 C H + t C A d d + ( t - 2 ) C E x - z + 3 C P + C E xTable 5
The comparisons of ciphertext length in different schemes.
Scheme The length of ciphertext Literature [5] ( t + 2 ) L E c p + L H + L E n c Literature [6] ( 2 t + 2 ) L E c p + L H + L E n c Literature [8] ( 2 t + 1 ) L E c p + L H + L E n c Literature [9] ( t + 2 ) L E c p + L H + L E n c Proposed scheme ( 3 t + 1 ) L E c p + L H + L E n cTable 6
Comparison of different schemes.
Scheme Offline/online encryption Anonymity Literature [5] no no Literature [6] no no Literature [8] no yes Literature [9] no yes Proposed scheme yes yesFrom Tables3 and 4, we can see that our scheme needs one bilinear pairing operation and three bilinear pairing operations in encryption phase and decryption phase. The number of bilinear pairing operation increases linearly with the number of recipients in encryption and decryption phase in literature [9]. Bilinear pairing operation requires a lot of calculation consumption. It is not suitable for mobile devices with limited energy. From Table 6, we know that only our scheme uses offline/online encryption.In order to give an intuitive knowledge, Figures2 and 3 also describe the computational cost in encryption and decryption schemes, respectively. Symbol t denotes the number of authorized receivers in Figures 2 and 3. According to Tables 2 and 3, we can easily compute the runtime of encryption and decryption scheme at different literatures [5, 6, 8, 9]. The computational cost on encryption and decryption is summarized in Figures 2 and 3, respectively. From Figure 2, we can see that the computational cost in [9] is the least, and our proposed scheme consumes little computation time in encryption. Literature [9] does not use offline/online encryption, and computational cost in our proposed scheme contains runtime of offline encryption and online encryption. When receivers decrypt the ciphertext, our scheme consumes the minimum computation time. As legal receiver t increases, the computational cost increases gradually in Figures 2 and 3.Figure 2
Computational cost of different scheme in encryption.Figure 3
Computational cost of different scheme in decryption.


## 5. Conclusion

Finally, conclusion and future work are summarized. An anonymous multireceiver online/offline identity-based encryption was proposed in our work. We developed an efficient offline/online encryption scheme which can ensure the anonymity of the receiver. Our scheme divided encryption into two phases: offline and online. A sender can do a lot of preparatory calculations on offline phases, and a receiver can encrypt the message with little computational cost on online phases. The computational cost of the receivers was improved in the proposed scheme. The analysis results demonstrated that our scheme is secure and efficient, and it is suitable for mobile devices. The preparation computation can be done while mobile device is plugged into a power supply. When it is on the move without plugging, it performs the encryption operations with little computational cost.An interesting future work is that we will pay more attention to anonymous attribute-based encryption using offline/online scheme for mobile devices.



---

*Source: 5702068-2018-08-12.xml*