# Blockchain as a CA: A Provably Secure Signcryption Scheme Leveraging Blockchains

Authors: Tzung-Her Chen; Ting-Le Zhu; Fuh-Gwo Jeng; Chien-Lung Wang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Although encryption and signatures have been two fundamental technologies for cryptosystems, they still receive considerable attention in academia due to the focus on reducing computational costs and communication overhead. In the past decade, applying certificateless signcryption schemes to solve the higher cost of maintaining the certificate chain issued by a certificate authority (CA) has been studied. With the recent increase in the interest in blockchains, signcryption is being revisited as a new possibility. The concepts of a blockchain as a CA and a transaction as a certificate proposed in this paper aim to use a blockchain without CAs or a trusted third party (TTP). The proposed provably secure signcryption scheme implements a designated recipient beforehand such that a sender can cryptographically facilitate the interoperation on the blockchain information with the designated recipient. Thus, the proposed scheme benefits from the following advantages: (1) it removes the high maintenance cost from involving CAs or a TTP, (2) it seamlessly integrates with blockchains, and (3) it provides confidential transactions. This paper also presents the theoretical security analysis and assesses the performance via the simulation results. Upon evaluating the operational cost in real currency based on Ethereum, the experimental results demonstrate that the proposed scheme only requires a small cost as a fee.


---

## Body

## 1. Introduction

With the rapid development of information and network applications, confidentiality, integrity, and nonrepudiation are the main security concerns. Thus, encryption and digital signatures have become two main fundamental technologies for any well-defined cryptosystem.In 1997, Zheng presented the first signcryption concept that simultaneously fulfilled the functions of both the digital signature and public key encryption in a logical single step and achieved significantly lower costs than those required by “signature followed by encryption” [1]. Since then, there have been increasingly more signcryption schemes formed using either traditional public key infrastructure- (PKI-) based [1, 2], identity-based [3–7], or certificateless-based [8–17] digital signatures.In 1984, Shamir presented a novel identity-based cryptosystem (IBC) [18] in which a random string (identity) was set as the participant’s public key, and the corresponding private key was generated by a trusted third party (TTP) called the key generation center (KGC). This design eliminated the high cost of maintaining a traditional certificate-based PKI. Later, Boneh and Franklin proposed their identity-based encryption (IBE) [19] that fully exploited Shamir’s IBC; this method significantly decreased the computational overhead by eliminating the certificate management problem in the PKI. In 2002, Malone-Lee combined the concepts of the IBC and signcryption to present an identity-based signcryption scheme [5]. Unfortunately, the identity-based signcryption schemes in Ref. [4, 5], to name a few, suffer the key escrow problem.In 2003, Al-Riyami and Paterson proposed certificateless public key cryptography [20], in which the problems of either the utilization of certificate in PKI or the key escrow in IBC are eliminated. Consequently, Barbosa and Farshim proposed the first certificateless-based signcryption scheme [8]. A certificateless signcryption scheme consists of four phases: (1) setup—the KGC generates its key pairs; (2) key generation—a participant chooses his key pair under the assistance of the KGC; (3) signcryption; and (4) unsigncryption. Notably, the participant’s private key is partially generated by the KGC in the key generation phase and the KGC is assumed to be trusted. Furthermore, the KGC’s public key and the signer’s public key are involved in the unsigncryption phase and the authentication of the public keys is necessary. It is obvious that the certificateless signcryption schemes in Ref. [13, 16, 17], to name a few, cannot avoid the high maintenance cost of TTP.Herein, we briefly examine a traditional certificate-based digital signature. Certificates, used to authenticate public keys prior to adoption, are chained as an ordered list containing an entity certificate, a series of intermediate certificates in the middle, and a root certificate at the end of the chain. For example, when Alice intends to use Bob’s public key, the public key will be authenticated by verifying Bob’s certificate first. Bob’s certificate, including his identity information and his public key, is protected by the certificate issuer’s signature. Obviously, it is tamper-proof and unforgeable. However, if someone intends to verify the issuer’s signature, Alice needs to take the next step to confirm the issuer’s public key by verifying the corresponding certificate that is issued by another upper issuer called the intermediate certificate authority (CA). The signatures of the certificates in the certificate chain (see Figure1) must be verified up to the root CA certificate.Figure 1
The structure in a certificate chain.It is clear that maintaining the certificate chain, along with the assumption of a TTP, will increase the overall computational overhead; thus, the use of a blockchain becomes more pertinent. Due to the emergence of Bitcoin [21] in 2009, Ethereum [22] in 2013, and Hyperledger Fabric [23] in 2016, blockchain technologies [21, 22], providing a trusted mechanism without a CA and TTP, have received significant attention and interest in academia and the IT industry.The fundamental technology of blockchains, such as Bitcoin and Ethereum, has gained increasingly more attention and has begun to be applied to various fields, such as medical data access [24–26], the Internet of Things [27, 28], and privacy preservation [29–31]. However, the high cost of certificate-based public key authentication is still problematic.A blockchain is a continuously appending list of blocks (see Figure2) that are linked and secured using cryptographic technologies, and the chain terminates in a genesis block. Each block typically contains an external hash pointer as a link to its previous block and an internal hash of all transactions Tx. A transaction is a group of data, which includes the messages of “from” and “to” and the signatures. Figure 3 illustrates an instance of a transaction Tx in the block number 2752 in an Ethereum test blockchain.Figure 2
The structure of two blocks with some transactions each in a blockchain.Figure 3
The structure of a transaction in the Ethereum blockchain.Basically, an elliptic curve digital signature algorithm (ECDSA) [32] is what facilitates the blockchain concept in Bitcoin, Ethereum, and Hyperledger Fabric. The signature fields “r” and “s” in each transaction, as shown in Figure 3, are proven. For a user in a blockchain, his private key is regarded as his identity and security credential. It is worthwhile to note that the private key is generated and maintained by the user himself, not a trusted third party, and it is used to sign outgoing transactions. Instead of interacting with the blockchain, each user can directly interface with his blockchain node to deposit signed transactions and inspect the blockchain.


### 1.1. Motivation

A blockchain can be viewed as a public decentralized ledger to record all of the transactions in a publicly verifiable and permanent way. The data inTx are tamper-proof and cannot be changed retroactively without altering all subsequent blocks up to the genesis one. The cryptographic advantages of a blockchain are similar to those of a certificate chain such as providing public verification and being tamper-proof. The main difference is that the blockchain is a decentralized trusty mechanism requiring no trusted third party; however, the certificate chain is a centralized trust mechanism with a series of trusted third parties.In this paper, new cryptographic paradigms calledblockchain as a CA and transaction as a certificate are investigated to implement a blockchain without a CA or TTP. Precisely, users’ public keys are extracted and authenticated directly from transactions in blockchains instead of by CAs or a TTP. This combination is named blockchain as a CA (BaaCA). BaaCA has the following advantages.(1)
Avoiding the high maintenance cost of CA and TTP: for a block in the blockchain, a transaction with its ECDSA signature can be treated as certificate-like and utilized to extract the ECDSA public key such that both the public key and the transaction itself are authenticated. In this way, the concepts of a blockchain as a CA and a transaction as a certificate become intriguingly analogous to that of a certificate chain in the PKI.(2)
Seamlessly integrating with blockchains: due to the success of Bitcoin and Ethereum along with the promise of blockchain technologies, it is possible and feasible to combine blockchain technologies with signcryption to achieve the goals of confidentiality, integrity, and nonrepudiation simultaneously.(3)
Providing transaction confidentiality: by combining encryption with a digital signature to achieve the goal of “lower computational cost and communication cost,” a novel signcryption scheme based on a blockchain that provides more benefits is proposed in this paper.


### 1.2. Contribution

In view of prior work, this paper proposes a provably secure BaaCA-based signcryption scheme. The main contributions of the proposed scheme are highlighted as follows.(1)
Usingblockchain as a CA and transaction as a certificate to form a new signcryption scheme, it is feasible to eliminate the high maintenance cost from involving CAs or a TTP compared with the related works.(2)
The theoretical security analysis is demonstrated, and the experimental results show that the proposed scheme can work and interoperate with the Ethereum blockchain. In this way, the proposed scheme does seamlessly comply with a state-of-the-art blockchain.(3)
By combining blockchain technologies with signature and encryption, the proposed scheme achieves the goals of confidentiality, integrity, and nonrepudiation simultaneously. It is worth noting that the proposed scheme presents a new paradigm of providing confidentiality to transactions in the Bitcoin and Ethereum blockchains with a minor impact.The rest of this paper is organized as follows. The related preliminaries are given in the next section. The proposed scheme with the formal system and security models are illustrated inSection 3. Section 4 presents the formal theoretical security proofs under the random oracle model along with the experimental results. The performance analysis is given in Section 5. Discussion and conclusions are given in Sections 6 and 7, respectively.


## 1.1. Motivation

A blockchain can be viewed as a public decentralized ledger to record all of the transactions in a publicly verifiable and permanent way. The data inTx are tamper-proof and cannot be changed retroactively without altering all subsequent blocks up to the genesis one. The cryptographic advantages of a blockchain are similar to those of a certificate chain such as providing public verification and being tamper-proof. The main difference is that the blockchain is a decentralized trusty mechanism requiring no trusted third party; however, the certificate chain is a centralized trust mechanism with a series of trusted third parties.In this paper, new cryptographic paradigms calledblockchain as a CA and transaction as a certificate are investigated to implement a blockchain without a CA or TTP. Precisely, users’ public keys are extracted and authenticated directly from transactions in blockchains instead of by CAs or a TTP. This combination is named blockchain as a CA (BaaCA). BaaCA has the following advantages.(1)
Avoiding the high maintenance cost of CA and TTP: for a block in the blockchain, a transaction with its ECDSA signature can be treated as certificate-like and utilized to extract the ECDSA public key such that both the public key and the transaction itself are authenticated. In this way, the concepts of a blockchain as a CA and a transaction as a certificate become intriguingly analogous to that of a certificate chain in the PKI.(2)
Seamlessly integrating with blockchains: due to the success of Bitcoin and Ethereum along with the promise of blockchain technologies, it is possible and feasible to combine blockchain technologies with signcryption to achieve the goals of confidentiality, integrity, and nonrepudiation simultaneously.(3)
Providing transaction confidentiality: by combining encryption with a digital signature to achieve the goal of “lower computational cost and communication cost,” a novel signcryption scheme based on a blockchain that provides more benefits is proposed in this paper.


## 1.2. Contribution

In view of prior work, this paper proposes a provably secure BaaCA-based signcryption scheme. The main contributions of the proposed scheme are highlighted as follows.(1)
Usingblockchain as a CA and transaction as a certificate to form a new signcryption scheme, it is feasible to eliminate the high maintenance cost from involving CAs or a TTP compared with the related works.(2)
The theoretical security analysis is demonstrated, and the experimental results show that the proposed scheme can work and interoperate with the Ethereum blockchain. In this way, the proposed scheme does seamlessly comply with a state-of-the-art blockchain.(3)
By combining blockchain technologies with signature and encryption, the proposed scheme achieves the goals of confidentiality, integrity, and nonrepudiation simultaneously. It is worth noting that the proposed scheme presents a new paradigm of providing confidentiality to transactions in the Bitcoin and Ethereum blockchains with a minor impact.The rest of this paper is organized as follows. The related preliminaries are given in the next section. The proposed scheme with the formal system and security models are illustrated inSection 3. Section 4 presents the formal theoretical security proofs under the random oracle model along with the experimental results. The performance analysis is given in Section 5. Discussion and conclusions are given in Sections 6 and 7, respectively.


## 2. Preliminaries

### 2.1. Signature via ECDSA

The ECDSA algorithm [32] includes four phases; they are the setup, key generation, signature generation, and signature verification phases. They are briefly described below.Setup phase: LetE be the given curve with its default field and equation. Then, base point P of a prime order on the curve and the multiplicative order n of point P can be determined. A hash function is given as follows: H1:0,1∗⟶ℱn.Key generation phase: The signer performs the following operations.(1)
Choose an integerd, such that 0<d<n, as the private key.(2)
ComputeQ=d×P as the corresponding public key. Then, the private key is d and the public key is Q, n.Signature generation phase: The signer signs messagem by doing the following operations.(1)
Computee=H1m.(2)
Choose an integerk such that 0<k<n, where k is a cryptographically secure random number.(3)
Compute the curve pointx1,y1=k×P.(4)
Computer=x1modn≠0 and s=k−1×e+d×rmodn≠0. Message m and its corresponding signatures r,s are sent to the recipient/verifier.Signature verification phase: The verifier performs the following operations to verify the validation of the signature of messagem.(1)
Computee=H1m.(2)
Computew=s−1modn, u1=e×wmodn, and u2=r×wmodn.(3)
ComputeX=u1P+u2Q≠0.(4)
Choosex-coordinate X as v.(5)
Checkv?=r.If it holds, the signature ofm is successfully authenticated.


### 2.2. Encryption via ECC

To encrypt or decrypt messagem in ECC, the operations [33] are as follows.Encryption phase:(1)
Choose an integerk such that 0<k<n, where k is a cryptographically secure random number.(2)
Suppose messagem maps to the curve point M.(3)
Compute the curve pointC1=k×P.(4)
Compute the curve pointC2=M+k×Q. Send C1andC2 to the recipient.Decryption phase:(1)
Compute the curve pointM=C2−d×C1.(2)
Decode pointM to obtain plaintext m.


## 2.1. Signature via ECDSA

The ECDSA algorithm [32] includes four phases; they are the setup, key generation, signature generation, and signature verification phases. They are briefly described below.Setup phase: LetE be the given curve with its default field and equation. Then, base point P of a prime order on the curve and the multiplicative order n of point P can be determined. A hash function is given as follows: H1:0,1∗⟶ℱn.Key generation phase: The signer performs the following operations.(1)
Choose an integerd, such that 0<d<n, as the private key.(2)
ComputeQ=d×P as the corresponding public key. Then, the private key is d and the public key is Q, n.Signature generation phase: The signer signs messagem by doing the following operations.(1)
Computee=H1m.(2)
Choose an integerk such that 0<k<n, where k is a cryptographically secure random number.(3)
Compute the curve pointx1,y1=k×P.(4)
Computer=x1modn≠0 and s=k−1×e+d×rmodn≠0. Message m and its corresponding signatures r,s are sent to the recipient/verifier.Signature verification phase: The verifier performs the following operations to verify the validation of the signature of messagem.(1)
Computee=H1m.(2)
Computew=s−1modn, u1=e×wmodn, and u2=r×wmodn.(3)
ComputeX=u1P+u2Q≠0.(4)
Choosex-coordinate X as v.(5)
Checkv?=r.If it holds, the signature ofm is successfully authenticated.


## 2.2. Encryption via ECC

To encrypt or decrypt messagem in ECC, the operations [33] are as follows.Encryption phase:(1)
Choose an integerk such that 0<k<n, where k is a cryptographically secure random number.(2)
Suppose messagem maps to the curve point M.(3)
Compute the curve pointC1=k×P.(4)
Compute the curve pointC2=M+k×Q. Send C1andC2 to the recipient.Decryption phase:(1)
Compute the curve pointM=C2−d×C1.(2)
Decode pointM to obtain plaintext m.


## 3. The Proposed Signcryption Scheme

The proposed BaaCA-based signcryption scheme including its system and security models is illustrated in this section. The notations used in the proposed scheme are described first in Table1.Table 1
Notations of the proposed scheme.
SymbolDescriptionkGlobal security parameterE,Fq,q,G,n,P,andFn∗Elliptic curve global parametersHi.,i=1,2One-way hash functiondA,PubA,PseudonameASender Alice’s private/public key pairs and pseudo namedB,PubB,PseudonameBRecipient Bob’s private/public key pairs and pseudo namedataAData sent from sender to recipientdataA1Public part ofdataAdataA2Sensitive part ofdataAri,siECDSA signaturecCiphertextTxTransactionASystem definitionThe proposed BaaCA-based signcryption scheme includes three different entities: a sender, a recipient, and the blockchain.(1)
Sender: a sender called Alice, with her private/public key pairdA,PubB, is sending data dataA to a specified recipient. First, the data dataA are split into two parts: dataA1 and dataA2. Note that the privacy-sensitive part of dataA is put into dataA2 and the other remaining part of dataA will be packaged into dataA1. Second, Alice executes the BaaCA-based signcryption algorithm to generate the encryption key key, which is used to transform dataA2 into ciphertext c and to create the signature rA,sA at the same time. Finally, Alice posts the transaction TxA=dataA1,c,rA,sA to the recipient via the blockchain.(2)
Recipient: a recipient called Bob, with his private/public key pairdB,PubB, will perform the decryption and verification processes when he gets transaction TxA to obtain the original data dataA. To decrypt ciphertext c, Bob has to execute the signcryption algorithm first to generate the decryption key key′, which is the same as Alice’s encryption key. Consequently, Bob uses key′ to decrypt c to obtain the privacy-sensitive data dataA2 and then recover the original data dataA. When performing verification, first, Bob uses both the signature rA,sA and dataA to generate Alice’s public key PubA′. Therefore, Bob can use PubA′ to extract Alice’s account address and check whether the account address is the same as that in transaction TxA. Please note that each account address is transformed from the relative public key in the blockchain. If they are the same, Bob can ensure that data dataA are sent by sender Alice.(3)
Blockchain: the blockchain acts as a digital ledger that records all transactions that have ever happened. That is, the blockchain is treated as a CA and the tamper-proof transactions are treated as thecertificates to extract the related public keys.The proposed scheme consists of five algorithms. They are system setup, key generation, public-key extraction, signcryption, and unsigncryption. For simplicity, we denote them asSetup, KeyGen, PKExtract, Signcryption, and Unsigncryption, respectively. The details are described below.(i)
Setup: it is a probabilistic algorithm for generating the public parameters params of the system using a security parameter k as the input. It can be represented as params←Setupk.(ii)
KeyGen: it is a probabilistic algorithm that randomly chooses private key di as its input to generate its corresponding public key Pubi and its relative account addressPseudonymi. It can be represented as di,Pubi,Pseudonymi←KeyGendi.(iii)
PKExtract: it is a deterministic algorithm that sets ECDSA signature ri,si as its input and returns its relative public key Pubi. It can be represented as Pubi=PKExtractri,si.(iv)
Signcryption: it is a probabilistic algorithm that takes the sender’s private key dA, the recipient’s public key PubB, and datadataA=dataA1‖dataA2 as inputs and outputs the corresponding signature rA,sA, ciphertext c, and nonsensitive part of data dataA1. The outputs are denoted as ω. It can be represented as ω←SigncryptiondataA,dA,PubBω=dataA1,c,rA,sA.(v)
Unsigncryption: it is a deterministic algorithm that takes the sender’s public key PubA, the recipient’s private key dB, and ω as inputs and outputs either the corresponding dataA if the signature rA,sA is valid or Reject. It can be represented as dataA/Reject←Unsigncryptionω,dB,PubA.


### 3.1. Security Model

There are two security concerns about the security model of the proposed BaaCA-based signcryption scheme in this paper. They are confidentiality and unforgeability.(1)
Confidentiality. The property of confidentiality in the proposed BaaCA-based signcryption scheme is essentially provided since it is only the specified recipient that knows data dataA. The following experiment ExpAIND−BaaCA−CCAk, played with the adversary IND-BaaCA-CCA denoted as A and a challenger denoted as C, proves the property of confidentiality under chosen ciphertext attacks.(i)
Setup:C runs this algorithm to obtain public parameters params and then distributes the public parameters to the adversary A.(ii)
Queries (phase 1):A makes a number of oracle queries to C and C would give some information to A. In the experiment, the following queries are allowed:(a)
KeyGen queries:A sends dA to C, and then C runs KeyGendA⟶dA,PubA,PseudonymA and returns dA,PubA,PseudonymA to A.(b)
Signcryption queries:A sends dataA,dA,PubB to C, and then C runs SigncryptiondataA,dA,PubB⟶ω,ω=dataA1,c,rA,sA and returns ω to A.(c)
Unsigncryption queries:A sends ω,dB,PubA to C, and then C runs Signcryptionω,dB,PubA⟶dataA/Reject and returns dataA/Rej to A.(iii)
Challenge: after finishing phase 1, adversaryA chooses two data dataA0 and dataA1 with an arbitrary private key dA∗, which he wishes to challenge. C randomly chooses a bit b∈0,1 for the two challenged data and then runs signcryption queries to obtain the result ω∗. Finally, C sends it to A.(iv)
Queries (phase 2): after receivingω∗, adversary A asks a number of queries similar to those in phase 1 but ω∗,dB∗,PubA∗ will be not sent to C under unsigncryption queries.(v)
Guess: finally, adversaryA chooses a bit b′ from 0,1. The adversaryA is said to win this experiment if b′=b. We can define the advantage of A in this experiment asAdvAIND−BaaCA−CCAk=Prb′=b−1/2.(2)
Unforgeability. In the proposed BaaCA-based signcryption scheme, unforgeability is essential to ensuring that the signature is secure against adaptively chosen message attacks. The following experiment ExpAEU−BaaCA−CMAk, played with an adversary EU-BaaCA-CMA denoted as A and a challenger denoted as C, proves the existential property of unforgeability under the chosen message attack.(i)
Setup: it is the same as that in the experimentExpAIND−BaaCA−CCA.(ii)
Queries: it is the same as phase 1 of queries in the experimentExpAIND−BaaCA−CCA.(iii)
Output: the adversaryA is said to win this experiment if A obtains the signature ω∗ together with two arbitrary private keys dA∗ and dB∗ such that(1)
dataA∗←Unsigncryptionω∗,dB∗,PubA∗.(2)
dataA∗,dA∗,PubB∗ is never sent to C as inputs for the signcryption queries, where dataA∗ are the data corresponding to the forgery.Definition 1.
The proposed BaaCA-based signcryption scheme is said to be secure if there is no adversaryA that wins the experiment ExpAIND−BaaCA−CCAk with a nonnegligible probability ε.Definition 2.
The proposed BaaCA-based signcryption scheme is said to be secure if there is no adversaryA that wins the experiment ExpAEU−BaaCA−CMAk with a nonnegligible probability ε. The security of the proposed BaaCA-based signcryption scheme is based on the computational difficulty of some well-known hard problems defined below.Definition 3.
The elliptic curve discrete logarithm problem (ECDLP): ifa∈ℱn∗ is unknown, compute a by giving P and aP.Definition 4.
The elliptic curve computational Diffie–Hellman problem (ECCDHP): ifa,b∈ℱn∗ is unknown, compute abP by giving P, aP, and bP.
In this paper, the appropriateG is determined by blockchains where the ECDLP and ECCDHP are assumed to be computationally difficult.


### 3.2. The Proposed Scheme

According to the benefits of theblockchain as a CA concept, the proposed scheme uses a variant of the ECDSA to produce a new signcryption scheme. Since the ECDSA is the default signature algorithm in Bitcoin, Ethereum, and Hyperledger Fabric, the proposed scheme is seamlessly compliant with the blockchains.The proposed model consists of two participants of a blockchain: Alice as asender and Bob as a recipient. Both of the participants are external actors of the blockchain and have their relative blockchain accounts and some recorded-in-block transactions. Suppose Alice and Bob, denoted as PseudonymA and PseudonymB, respectively, with the addresses in the fields “from” or “to” in Figure 3 have their private and public key pairs (dA, PubA=dA×P) and (dB, PubB=dB×P) in the blockchain network, respectively.The main design comes from the method that generates the private key from the existing transactions signed by Bob and Alice in the blockchain. Herein, a transaction is regarded as a certificate of Alice or Bob.Alice is connected with the blockchain, receives Bob’s previous signature from a transaction stored in the blockchain, and then extracts Bob’s public keyPubB. The encryption key is obtained by executing k×PubB, where k is a one-time padded random number generated by Alice since Bob can extract this key by performing dB×R when he has R, where R=k×P.The proposed signcryption scheme consists of five phases: the setup phase, key generation phase, public-key extraction phase, signcryption phase, and unsigncryption phase.(i)
Setup phase:(1)
Determine the elliptic curveE in the finite field ℱq, where q is a prime number such that all the points on E represent a finite group, e.g., G, with the prime multiplicative order n and a generator P. For example, the ECDSA curve used in Bitcoin and Ethereum is secp256k1, which refers to the curve E: y2 = x3 + 7 [34] defined over the field ℱn∗, while the curves ECC P256 and P384 are adopted by Hyperledger Fabric.(2)
H1:0,1∗⟶ℱn and H2:G×0,1∗⟶ℱn∗ are two collision resistant hash functions, where ℱn and G have been described in (1).(3)
The system parametersparams:=G,n,P,q,E,ℱn∗,ℱq,T are public.(ii)
Key generation phase:(1)SHA_256SHA_2560x00RIPEMD_160SHA_256PubB2224,(1)
Suppose that Alice has her ECDSA private and public key pairsdA,PubA=dA×P and Bob has his key pairs dB,PubB=dB×P for their accounts on the blockchain, respectively.(2)
The ECDSA private and public key pairs are used to specify the address, i.e.,PseudonymA and PseudonymB. For Bitcoin, Bob’s address is computed as Base_58 (0x00||RIPEMD_160 (SHA_256 (PubB))||.where Base_58 represents a large integer as alphanumeric text, RIPEMD_160 and SHA_256 are two well-known cryptographic hash functions, and || denotes concatenation. For Ethereum, the address is(2)B96…255SHA−3PubB,where B96…255 is denoted as the right most 160 bits of the SHA-3 hash.(iii)
Public-key extraction phase: because there is no certificate chain in the Bitcoin and Ethereum blockchains, Alice must extract Bob’s public key from Bob’s transactionTxB=dataB,rB,sB, where TxB is public verifiable and tamper-proof once stored in the blockchain. With the ECDSA signature rB,sB and the transaction data dataB, Alice is able to extract Bob’s public key PubB by conducting the following operations.(1)
e=H1dataB.(2)
RorR′←rB=x1, where R=x1,y1, and R′=x1,−y1.(3)
PubB=rB−1×sBR−ePmodn. PubB′=rB−1×sBR′−ePmodn.Actually, Bitcoin and Ethereum transactions require an extra parameter, i.e., the field “v” in Figure 3, to identify which point is correct.(4)
Check if the generated node address fromPubB via equations (1) or (2) for Bitcoin or Ethereum, respectively, is equal to Bob’s account address. If it is, PubB is Bob’s public key and Bob’s transaction TxB in the blockchain is also authenticated.(iv)
Signcryption phase: suppose Alice’s transaction isTxA=dataA,rA,sA, where dataA are composed of two parts: dataA1 are public and dataA2 are privacy-sensitive. Alice does the following operations to generate the signature of TxA and the ciphertext of dataA2. Note that the signature in this algorithm is designed to be verified by the designated verifier, i.e., Bob. k∈R1,…,n−1.(1)
RA=k×P.(2)
RA=x1,y1.(3)
rA=x1modn. K=k×PubB.key=H2K,PseudonymA,PseudonymB.c=dataA2⊕key.(4)
e=H1dataA=H1dataA1,dataA2. sA=k−1×e+dA×rAmodn.(5)
Returnω=dataA1,c,rA,sA.(5)–(7) are the operations of both key agreement and encryption. Finally, Alice broadcasts the transactionTxA=ω into the blockchain and discards the random number k and the encryption key key.(v)
Unsigncryption phase: upon interacting with the blockchain to obtainTxA=ω=dataA1,c,rA,sA, Bob verifies the validation of the signature and simultaneously decrypts the ciphertext to obtain dataA2 by doing the following operations.(1)
Find two pointsRA and RA′ of the same value rA as the x-coordinate. The transaction practically involves an extra parameter, say v in Figure 3, to identify RA and RA′, say RA. K′=dB×RA.(2)
key′=H2K′,PseudonymA,PseudonymB.(3)
dataA2′ = c⊕key′.(4)
e′=H1dataA1,dataA2′.(5)
PubA′=rA−1×sARA−e′Pmodn.(6)
Check if the generated node address fromPubA′ by equation (1) or (2) is equal to Alice’s account address.(2)–(4) are both key agreement and decryption operations. If (7) is true,PubA′is Alice’s public key and this transaction TxA is also authenticated. Then, the data dataA are output; otherwise, we get Reject.


### 3.3. Correctness of Public-Key Extraction, Encryption, and Signature

The correctness of public key extraction in the proposed protocol is derived from the precision of the hash value of the extracted public keyhPubB′ to the address hPubB indicated in the transaction on the blockchain, where h. represents equation (1) or (2). We have PubB′=rB−1×sBRB−eP = rB−1×k−1×e+dB×rB×k×P−e×P = rB−1×dB×rB×P = dB×P=PubB. Thus, the equation hPubB′=hPubB holds.The correctness of the encryption in the proposed protocol is derived from the situationkey′=key. If it holds, dataA2′=dataA2. In the signcryption phase, Alice’s encryption key is key=H2k×PubB,PseudonymA,PseudonymB,dataA1. In addition, in the unsigncryption phase, the decryption key that Bob obtains is key′=H2dB×RA,PseudonymA,PseudonymB. Since dB×RA=dB×k×P=k×dB×P=k×PubB, we have key=key′, and thus dataA2′=c⊕key′=dataA2⊕key⊕key′=dataA2.The correctness of the signature in the proposed protocol is derived from the same proof as that of correctness of public-key extraction. In this way, the signaturerA,sA is also authenticated. Thus, the proof is omitted here.


## 3.1. Security Model

There are two security concerns about the security model of the proposed BaaCA-based signcryption scheme in this paper. They are confidentiality and unforgeability.(1)
Confidentiality. The property of confidentiality in the proposed BaaCA-based signcryption scheme is essentially provided since it is only the specified recipient that knows data dataA. The following experiment ExpAIND−BaaCA−CCAk, played with the adversary IND-BaaCA-CCA denoted as A and a challenger denoted as C, proves the property of confidentiality under chosen ciphertext attacks.(i)
Setup:C runs this algorithm to obtain public parameters params and then distributes the public parameters to the adversary A.(ii)
Queries (phase 1):A makes a number of oracle queries to C and C would give some information to A. In the experiment, the following queries are allowed:(a)
KeyGen queries:A sends dA to C, and then C runs KeyGendA⟶dA,PubA,PseudonymA and returns dA,PubA,PseudonymA to A.(b)
Signcryption queries:A sends dataA,dA,PubB to C, and then C runs SigncryptiondataA,dA,PubB⟶ω,ω=dataA1,c,rA,sA and returns ω to A.(c)
Unsigncryption queries:A sends ω,dB,PubA to C, and then C runs Signcryptionω,dB,PubA⟶dataA/Reject and returns dataA/Rej to A.(iii)
Challenge: after finishing phase 1, adversaryA chooses two data dataA0 and dataA1 with an arbitrary private key dA∗, which he wishes to challenge. C randomly chooses a bit b∈0,1 for the two challenged data and then runs signcryption queries to obtain the result ω∗. Finally, C sends it to A.(iv)
Queries (phase 2): after receivingω∗, adversary A asks a number of queries similar to those in phase 1 but ω∗,dB∗,PubA∗ will be not sent to C under unsigncryption queries.(v)
Guess: finally, adversaryA chooses a bit b′ from 0,1. The adversaryA is said to win this experiment if b′=b. We can define the advantage of A in this experiment asAdvAIND−BaaCA−CCAk=Prb′=b−1/2.(2)
Unforgeability. In the proposed BaaCA-based signcryption scheme, unforgeability is essential to ensuring that the signature is secure against adaptively chosen message attacks. The following experiment ExpAEU−BaaCA−CMAk, played with an adversary EU-BaaCA-CMA denoted as A and a challenger denoted as C, proves the existential property of unforgeability under the chosen message attack.(i)
Setup: it is the same as that in the experimentExpAIND−BaaCA−CCA.(ii)
Queries: it is the same as phase 1 of queries in the experimentExpAIND−BaaCA−CCA.(iii)
Output: the adversaryA is said to win this experiment if A obtains the signature ω∗ together with two arbitrary private keys dA∗ and dB∗ such that(1)
dataA∗←Unsigncryptionω∗,dB∗,PubA∗.(2)
dataA∗,dA∗,PubB∗ is never sent to C as inputs for the signcryption queries, where dataA∗ are the data corresponding to the forgery.Definition 1.
The proposed BaaCA-based signcryption scheme is said to be secure if there is no adversaryA that wins the experiment ExpAIND−BaaCA−CCAk with a nonnegligible probability ε.Definition 2.
The proposed BaaCA-based signcryption scheme is said to be secure if there is no adversaryA that wins the experiment ExpAEU−BaaCA−CMAk with a nonnegligible probability ε. The security of the proposed BaaCA-based signcryption scheme is based on the computational difficulty of some well-known hard problems defined below.Definition 3.
The elliptic curve discrete logarithm problem (ECDLP): ifa∈ℱn∗ is unknown, compute a by giving P and aP.Definition 4.
The elliptic curve computational Diffie–Hellman problem (ECCDHP): ifa,b∈ℱn∗ is unknown, compute abP by giving P, aP, and bP.
In this paper, the appropriateG is determined by blockchains where the ECDLP and ECCDHP are assumed to be computationally difficult.


## 3.2. The Proposed Scheme

According to the benefits of theblockchain as a CA concept, the proposed scheme uses a variant of the ECDSA to produce a new signcryption scheme. Since the ECDSA is the default signature algorithm in Bitcoin, Ethereum, and Hyperledger Fabric, the proposed scheme is seamlessly compliant with the blockchains.The proposed model consists of two participants of a blockchain: Alice as asender and Bob as a recipient. Both of the participants are external actors of the blockchain and have their relative blockchain accounts and some recorded-in-block transactions. Suppose Alice and Bob, denoted as PseudonymA and PseudonymB, respectively, with the addresses in the fields “from” or “to” in Figure 3 have their private and public key pairs (dA, PubA=dA×P) and (dB, PubB=dB×P) in the blockchain network, respectively.The main design comes from the method that generates the private key from the existing transactions signed by Bob and Alice in the blockchain. Herein, a transaction is regarded as a certificate of Alice or Bob.Alice is connected with the blockchain, receives Bob’s previous signature from a transaction stored in the blockchain, and then extracts Bob’s public keyPubB. The encryption key is obtained by executing k×PubB, where k is a one-time padded random number generated by Alice since Bob can extract this key by performing dB×R when he has R, where R=k×P.The proposed signcryption scheme consists of five phases: the setup phase, key generation phase, public-key extraction phase, signcryption phase, and unsigncryption phase.(i)
Setup phase:(1)
Determine the elliptic curveE in the finite field ℱq, where q is a prime number such that all the points on E represent a finite group, e.g., G, with the prime multiplicative order n and a generator P. For example, the ECDSA curve used in Bitcoin and Ethereum is secp256k1, which refers to the curve E: y2 = x3 + 7 [34] defined over the field ℱn∗, while the curves ECC P256 and P384 are adopted by Hyperledger Fabric.(2)
H1:0,1∗⟶ℱn and H2:G×0,1∗⟶ℱn∗ are two collision resistant hash functions, where ℱn and G have been described in (1).(3)
The system parametersparams:=G,n,P,q,E,ℱn∗,ℱq,T are public.(ii)
Key generation phase:(1)SHA_256SHA_2560x00RIPEMD_160SHA_256PubB2224,(1)
Suppose that Alice has her ECDSA private and public key pairsdA,PubA=dA×P and Bob has his key pairs dB,PubB=dB×P for their accounts on the blockchain, respectively.(2)
The ECDSA private and public key pairs are used to specify the address, i.e.,PseudonymA and PseudonymB. For Bitcoin, Bob’s address is computed as Base_58 (0x00||RIPEMD_160 (SHA_256 (PubB))||.where Base_58 represents a large integer as alphanumeric text, RIPEMD_160 and SHA_256 are two well-known cryptographic hash functions, and || denotes concatenation. For Ethereum, the address is(2)B96…255SHA−3PubB,where B96…255 is denoted as the right most 160 bits of the SHA-3 hash.(iii)
Public-key extraction phase: because there is no certificate chain in the Bitcoin and Ethereum blockchains, Alice must extract Bob’s public key from Bob’s transactionTxB=dataB,rB,sB, where TxB is public verifiable and tamper-proof once stored in the blockchain. With the ECDSA signature rB,sB and the transaction data dataB, Alice is able to extract Bob’s public key PubB by conducting the following operations.(1)
e=H1dataB.(2)
RorR′←rB=x1, where R=x1,y1, and R′=x1,−y1.(3)
PubB=rB−1×sBR−ePmodn. PubB′=rB−1×sBR′−ePmodn.Actually, Bitcoin and Ethereum transactions require an extra parameter, i.e., the field “v” in Figure 3, to identify which point is correct.(4)
Check if the generated node address fromPubB via equations (1) or (2) for Bitcoin or Ethereum, respectively, is equal to Bob’s account address. If it is, PubB is Bob’s public key and Bob’s transaction TxB in the blockchain is also authenticated.(iv)
Signcryption phase: suppose Alice’s transaction isTxA=dataA,rA,sA, where dataA are composed of two parts: dataA1 are public and dataA2 are privacy-sensitive. Alice does the following operations to generate the signature of TxA and the ciphertext of dataA2. Note that the signature in this algorithm is designed to be verified by the designated verifier, i.e., Bob. k∈R1,…,n−1.(1)
RA=k×P.(2)
RA=x1,y1.(3)
rA=x1modn. K=k×PubB.key=H2K,PseudonymA,PseudonymB.c=dataA2⊕key.(4)
e=H1dataA=H1dataA1,dataA2. sA=k−1×e+dA×rAmodn.(5)
Returnω=dataA1,c,rA,sA.(5)–(7) are the operations of both key agreement and encryption. Finally, Alice broadcasts the transactionTxA=ω into the blockchain and discards the random number k and the encryption key key.(v)
Unsigncryption phase: upon interacting with the blockchain to obtainTxA=ω=dataA1,c,rA,sA, Bob verifies the validation of the signature and simultaneously decrypts the ciphertext to obtain dataA2 by doing the following operations.(1)
Find two pointsRA and RA′ of the same value rA as the x-coordinate. The transaction practically involves an extra parameter, say v in Figure 3, to identify RA and RA′, say RA. K′=dB×RA.(2)
key′=H2K′,PseudonymA,PseudonymB.(3)
dataA2′ = c⊕key′.(4)
e′=H1dataA1,dataA2′.(5)
PubA′=rA−1×sARA−e′Pmodn.(6)
Check if the generated node address fromPubA′ by equation (1) or (2) is equal to Alice’s account address.(2)–(4) are both key agreement and decryption operations. If (7) is true,PubA′is Alice’s public key and this transaction TxA is also authenticated. Then, the data dataA are output; otherwise, we get Reject.


## 3.3. Correctness of Public-Key Extraction, Encryption, and Signature

The correctness of public key extraction in the proposed protocol is derived from the precision of the hash value of the extracted public keyhPubB′ to the address hPubB indicated in the transaction on the blockchain, where h. represents equation (1) or (2). We have PubB′=rB−1×sBRB−eP = rB−1×k−1×e+dB×rB×k×P−e×P = rB−1×dB×rB×P = dB×P=PubB. Thus, the equation hPubB′=hPubB holds.The correctness of the encryption in the proposed protocol is derived from the situationkey′=key. If it holds, dataA2′=dataA2. In the signcryption phase, Alice’s encryption key is key=H2k×PubB,PseudonymA,PseudonymB,dataA1. In addition, in the unsigncryption phase, the decryption key that Bob obtains is key′=H2dB×RA,PseudonymA,PseudonymB. Since dB×RA=dB×k×P=k×dB×P=k×PubB, we have key=key′, and thus dataA2′=c⊕key′=dataA2⊕key⊕key′=dataA2.The correctness of the signature in the proposed protocol is derived from the same proof as that of correctness of public-key extraction. In this way, the signaturerA,sA is also authenticated. Thus, the proof is omitted here.


## 4. Security Analysis

Two theorems are described in detail before the security analytics and proofs of the proposed BaaCA-based signcryption scheme are given.Theorem 1.
(IND-BaaCA-CCA). The proposed BaaCA-based signcryption scheme is indistinguishable against chosen ciphertext attacks when the ECDDHP problem is hard to resolve.Proof.
Assume there exists an IND-BaaCA-CCA adversary,A, who wins the experiment ExpAIND−BaaCA−CCAwith a nonnegligible probability ε based on Definition 1. A challenger C is designed to take A as the subprogram to solve the ECCDHP problem based on Definition 4 with a nonnegligible probability. Challenger C is assigned an instance G,n,P,q,E,ℱn∗,ℱq,kP,dBP and tries to compute the value k×dBP∈G.
At first, challengerC maintains four lists L1,L2,LS,andLu, respectively, corresponding to H1,H2, signcryption, and unsigncryption query oracles. Then, C plays the following experiment ExpAIND−BaaCA−CCAwith A. In addition, we assume that A queries oracle H2q2 times and queries KeyGen qK times.(1)
Setup:C sends Aparams:=G,n,P,q,E,ℱn∗,ℱq,H1,H2, which is an instance for solving the ECCDHP problem. Two hash functions Hi.,i=1,2, controlled by C, are regarded as random oracles.(2)
Queries (phase 1):A makes a number of oracle queries to C and C should answer to give Asome information. In the experiment, the following queries are allowed.(1)
OracleH1: dataA1,dataA2.Case 1:dataA1,dataA2,e∈L1, return e.Case 2:dataA1,dataA2,e∉L1, choose random e∈ℱn∗ add dataA1,dataA2,e to L1, and then return e.(2)
OracleH2: K,PseudonymA,PseudonymB.Case 1:K,PseudonymA,PseudonymB,key∈L2 and return key.Case 2:K,PseudonymA,PseudonymB,key∉L2, choose random key∈ℱn∗, add K,PseudonymA,PseudonymB,key to L2, and then return key.(3)
KeyGen queries:dACase 1:dA,PubA,PseudonymA∈LK, return dA,PubA,PseudonymA.Case 2:dA,PubA,PseudonymA∉LK, generate public key PubA and account address PseudonymA via equation (1) or (2), and then add dA,PubA,PseudonymA to LK. Finally, return (dA,PubA,PseudonymA.(4)
Signcryption queries:dataA,dA,PubB(a)
Choose randomk∈ℱn∗.(b)
ComputeR=kP=x1,y1.(c)
dataA1‖dataA2←dataA.(d)
ComputerA=x1modn.(e)
ComputeK=k⋅PubB.(f)
Computekey=H2K,PseudonymA,PseudonymB, where H2. is from oracle H2.(g)
Computec=dataA2⊕key.(h)
Computee=H1dataA1,dataA2, where H1. is from oracle H1.(i)
ComputesA=k−1e+dArAmodn, where dA is taken from the KeyGen queries.(j)
AdddA,PubB,dataA1,c,rA,sA to LS.(k)
Returnω=dataA1,c,rA,sA.(5)
Unsigncryption queries:ω,dB,PubA(a)
Find two pointsR and R′ with the same value r as their x coordinate. The transaction practically involves an extra parameter to identify R and R′, say R.(b)
ComputeK=dB⋅R.(c)
ComputedataA2′=c⊕key.(d)
Computee=H1dataA1,dataA2.(e)
Check whetherPubA?=r−1×sR−e′P holds or not.(f)
ReturndataA and add dataA,dA,PubB to Lu; otherwise, return Reject.(1)
Challenge: after finishing phase 1,A chooses two datasetsdataA0 and dataA1 with an arbitrary private key dA∗, which are to be challenged. Here, dA=dA with probability 1/qK. Then, C randomly chooses a bit b∈0,1for the two challenged datasets and then runs the signcryption algorithm to obtain a result ω∗=dataA1∗,c∗,rA∗,sA∗. Finally, C sends ω∗ to A.(2)
Queries (phase 2): after receivingω∗, adversary A asks a number of queries that are the same as in phase 1 but ω∗ is never sent to C for unsigncryption queries.(3)
Guess: adversaryA produces a bit b′ from 0,1. C ignores the bit thatA produces and randomly chooses K, which is stored in L2, as the solution for the given instance of ECCDHP problem. If A does not query oracle H2, C will terminate. In contrast, if A has some advantages to produce the bit correctly, it means that the query to H2 is required. Therefore, there is enough information in L2 to help C obtain the correct K with probability 1/q2 because A queries oracle H2q2 times and only one K is right. If so, K=dB×R=dB×kP is the solution with probability ε/qKq2 for the given instance of ECCDHP problem. This is contradictory to our hypothesis at the beginning of the security proof. Thus, this concludes the proof of Theorem 1.Theorem 2.
(EU-BaaCA-CMA). The proposed BaaCA-based signcryption scheme is existentially unforgeable against an adaptively chosen message attack when the ECDLP problem is hard to resolve.Proof.
Assume there is an EU-BaaCA-CMA adversary, who wins the defined experimentExpAEU−BaaCA−CMA with a nonnegligible probability ε. We will design a challenger C to take A as its subprogram for solving the ECDLP problem with a nonnegligible probability. The instance G,n,P,q,E,ℱn∗,ℱq,kP of the ECDLP problem is given to challenger C, and C will try to compute the value k∈ℱn∗.
At first, challengerC maintains five lists L1,L2,LK,LS,andLu, respectively, corresponding to H1,H2, KeyGen, signcryption, and unsigncryption oracles. Then, C plays the following experiment ExpAIND−BaaCA−CCA with A. In addition, we assume that A queries oracle H2q2 times and queries KeyGen qK times.(1)
Setup:C sends params:=G,n,P,q,E,ℱn∗,ℱq,H1,H2 to A, where G,n,P,q,E,ℱn∗,ℱqis an instance of the ECDLP problem. The hash functions Hi.,i=1,2, controlled by C, are regarded as random oracles.(2)
Queries (phase 1):A makes a number of oracle queries to C and C should answer to give Asome information. In the experiment, the following queries are allowed:(1)
OracleH1: dataA1,dataA2Case 1:dataA1,dataA2,e∈L1 and return e.Case 2:dataA1,dataA2,e∉L1, choose random e∈ℱn∗, add dataA1,dataA2,e to L1, and then return e.(2)
OracleH2: K,PseudonymA,PseudonymBCase 1:K,PseudonymA,PseudonymB,key∈L2 and return key.Case 2:K,PseudonymA,PseudonymB,key∉L2, choose random key∈ℱn∗, add K,PseudonymA,PseudonymB,key to L2, and then return key.(3)
KeyGen queries:dACase 1:dA,PubA,PseudonymA∈LK and return dA,PubA,PseudonymA.Case 2:dA,PubA,PseudonymA∉LK, generate the public key PubA and the account address PseudonymA via equation (1) or (2), add dA,PubA,PseudonymA to LK, and then return dA,PubA,PseudonymA.(4)
Signcryption queries:dataA,dA,PubB(a)
Choose randomk∈ℱn∗.(b)
ComputeR=kP=x1,y1.(c)
dataA1‖dataA2←dataA.(d)
ComputerA=x1modn.(e)
ComputeK=k⋅PubB.(f)
Computekey=H2K,PseudonymA,PseudonymB, where H2. is from H2 oracle.(g)
Computec=dataA2⊕key.(h)
Computee=H1dataA1,dataA2 where H1. is from oracle H1.(i)
ComputesA=k−1e+dArAmodn where dA is taken from the KeyGen queries.(j)
AdddA,PubB,dataA1,c,rA,sA to LS.(k)
Returnω=dataA1,c,rA,sA.(5)
Unsigncryption queries:ω,dB,PubA(a)
Find two pointsR and R′ with the same value r as their x coordinate. The transaction practically involves an extra parameter to identify R and R′, say R.(b)
ComputeK=dB⋅R.(c)
ComputedataA2′=c⊕key.(d)
Computee=H1dataA1,dataA2.(e)
Check whetherPubA?=r−1×sR−e′P holds or not.(f)
ReturndataA and add dataA,dA,PubB to Lu; otherwise, return Reject.(i)
Output: after finishing phase 1,A produces the signature ω∗=dataA1∗,c∗,rA∗,sA∗ along with the verifier dB∗,PubB∗,PseudonymB∗ with probability ε based on Definition 2. If dA∗,dB∗≠dA,dB, Cwill terminate the experiment. However, if dA∗,dB∗=dA,dB with probability1/qK2=2/qKqK−1, C picks the correct K from L2 with probability1/q2 to recover dataA2∗. Finally, C can compute k∗=s∗−1H1dataA1∗,dataA2∗+dA∗r∗ with the probability 2ε/q2qKqK−1 to solve the ECDLP problem. This is contradictory to our hypothesis at the beginning of the security proof. Thus, this concludes the proof of Theorem 2.
Considering the strength of the keys, which is one of the primary factors of cryptographic algorithms, the security analysis of the key strength is further illustrated. There are three state-of-the-art algorithms for hard problems including integer factorization (such as RSA [35]), the discrete logarithm (such as DSA [35]), and the elliptic curve discrete logarithm (such as ECDSA). It is well known that the ECDSA achieves not only the same level of security with a smaller key size but also higher computational efficiency than those of the RSA and DSA. For example, ECC-256 (resp. ECC-224) provides comparable security to RSA-3072 (resp. RSA-2048) [36]. By employing the ECDSA over the standard elliptic curve “secp256k1,” which Ethereum and Bitcoin blockchains have adopted, the proposed scheme also provides the same level of security.


## 5. Performance Analysis

In this section, the performance of the proposed BaaCA-based signcryption scheme is analyzed by comparing the computational costs with those of other related works and the experimental results of the operational costs based on the Ethereum blockchain.


### 5.1. Computational Cost of Signcryption

The computational costs of the proposed scheme mainly come from two phases: the signcryption and unsigncryption phases. The operations executed in each phase are depicted in Table2. In the signcryption phase, Alice will execute two elliptic curve scalar multiplication operations, one map-to-point hash function, and one modular inversion. In the unsigncryption phase, Bob will execute two elliptic curve scalar multiplication operations, one map-to-point hash function, and one modular inversion. It is noted that the proposed scheme does not adopt any pairing operation.Table 2
Comparisons between related signcryption schemes and the proposed scheme.
SchemesPKI-/ID-/certificateless-basedHardness assumptionHigh maintenance cost of CAs or a TTPSeamless compliance with blockchainsComputational costSigncryptionUnsigncryptionTotal costMalone-Lee [5]ID-basedBDHYes (TTP)NoTP4TP435.0tmKarati et al. [4]ID-basedBDHYes (TTP)No3TE + TP2TE + 2TP + Ti377.6tmZhou et al. [13]Certificateless-basedBDHYes (TTP)No8TE + 4TP2TE + 8TP1254.0tmKarati et al. [16]Certificateless-basedBDHYes (TTP)No3TE2TE + 2TP + 2Ti302.2tmRastegari et al. [17]Certificateless-basedBDHYes (TTP)No4TE + 2TP2TE + 8TP996.0tmECDSA + ECCPKI-basedECDLPYes (CA)No(TM + Ti) + (2TM + TH)(2TM + Ti) + (TM + TH)243.2tmThe proposed schemeBlockchain as a CAECDLPNoYes2TM + Ti + TH3TM + Ti + TH214.2tmThe proposed scheme is compared with several existing related works. The computational cost of primitive time-consuming cryptographic operations is adopted from [4, 37] and is summarized as follows. TP≈87tm, TM≈29tm, TH≈23tm, TE≈21tm, and Ti≈11.6tm are the times required to execute a bilinear pairing operation, an elliptic curve scalar point multiplication, a map-to-point hash function, an exponentiation, and a modular inversion, respectively, where tm is the time required to execute a scalar multiplication in ℱn∗.The total computational cost required in the proposed scheme is (5TM + 2Ti + 2TH) = 214.2 tm. Table 2 shows that the computational cost of the proposed BaaCA-based signcryption scheme is nearly 49% that of Malone-Lee [5], 57% that of Karati et al. [4], 17% that of Zhou et al. [13], 71% that of Karati et al. [16], 22% that of Rastegari et al. [17], and 88% that of ECDSA + ECC.Figure4 shows the computational overhead during signcryption and unsigncryption among the proposed scheme and the related works.Figure 4
Performance comparisons among the proposed and the related signcryption schemes in terms of signcryption, unsigncryption, and total costs.


### 5.2. Experimental Results Based on the Ethereum Blockchain

To prove the computational cost of the BaaCA-based signcryption scheme compared with the ECDSA in the original transaction on the Ethereum blockchain, we implement the proposed scheme using the Python programming language and the Ethereum Ropsten Testnet environments [38]. All experiments are carried out with the following settings:(1)
CPU: Intel Core i5-4440 CPU @ 3.1 GHz (quad core).(2)
Physical memory: 16 GB DDR3 1600 MHz.(3)
OS: Windows 7.Finally, the proposed scheme is executed 500 times and its average is taken as our experimental result. Figure5 shows the computational costs of the signcryption and unsigncryption phases. We observe that the cost of the unsigncryption phase is higher than that of the signcryption phase. This is a reasonable result since unsigncryption executes one more elliptic curve scalar point multiplication operation, as shown in Table 2. Moreover, the interval among the test data size is set as 5 kB, and the ratio of the sensitive part to the public part is 1 : 4.Figure 5
Computational costs in the proposed scheme with different amounts of data.In addition to the computational cost, the proposed scheme is also evaluated in terms of its operational cost in real currency. In the proposed scheme, one transaction only is broadcasted into the blockchain in the signcryption phase. The operational cost is estimated by calculating the total amount of gas and then converting it into the real currency. We use the Ethereum Ropsten Testnet environment [38] since it is able to automatically calculate the amount of gas of the proposed scheme. After that, the amount of gas is converted into USD according to the CoinGecko conversion table [39]. At the time of inversion, the rate was 1 gas = 0.000000001 ETH = 1.65×10−7 USD.Figure6 shows the operational costs for different amounts of data. It is observed that the cost increases when the amount of data increases. It is reasonable since more data will lead to greater amounts of gas. However, it seems useless for the result since the cost remains very low. Even if the amount of data increases to 30 kB, the cost in the real currency is still less than 0.35 USD. That means that the proposed scheme is a suitable solution to protect transaction privacy and it only requires a small cost as a fee.Figure 6
The cost of the proposed scheme in USD.


## 5.1. Computational Cost of Signcryption

The computational costs of the proposed scheme mainly come from two phases: the signcryption and unsigncryption phases. The operations executed in each phase are depicted in Table2. In the signcryption phase, Alice will execute two elliptic curve scalar multiplication operations, one map-to-point hash function, and one modular inversion. In the unsigncryption phase, Bob will execute two elliptic curve scalar multiplication operations, one map-to-point hash function, and one modular inversion. It is noted that the proposed scheme does not adopt any pairing operation.Table 2
Comparisons between related signcryption schemes and the proposed scheme.
SchemesPKI-/ID-/certificateless-basedHardness assumptionHigh maintenance cost of CAs or a TTPSeamless compliance with blockchainsComputational costSigncryptionUnsigncryptionTotal costMalone-Lee [5]ID-basedBDHYes (TTP)NoTP4TP435.0tmKarati et al. [4]ID-basedBDHYes (TTP)No3TE + TP2TE + 2TP + Ti377.6tmZhou et al. [13]Certificateless-basedBDHYes (TTP)No8TE + 4TP2TE + 8TP1254.0tmKarati et al. [16]Certificateless-basedBDHYes (TTP)No3TE2TE + 2TP + 2Ti302.2tmRastegari et al. [17]Certificateless-basedBDHYes (TTP)No4TE + 2TP2TE + 8TP996.0tmECDSA + ECCPKI-basedECDLPYes (CA)No(TM + Ti) + (2TM + TH)(2TM + Ti) + (TM + TH)243.2tmThe proposed schemeBlockchain as a CAECDLPNoYes2TM + Ti + TH3TM + Ti + TH214.2tmThe proposed scheme is compared with several existing related works. The computational cost of primitive time-consuming cryptographic operations is adopted from [4, 37] and is summarized as follows. TP≈87tm, TM≈29tm, TH≈23tm, TE≈21tm, and Ti≈11.6tm are the times required to execute a bilinear pairing operation, an elliptic curve scalar point multiplication, a map-to-point hash function, an exponentiation, and a modular inversion, respectively, where tm is the time required to execute a scalar multiplication in ℱn∗.The total computational cost required in the proposed scheme is (5TM + 2Ti + 2TH) = 214.2 tm. Table 2 shows that the computational cost of the proposed BaaCA-based signcryption scheme is nearly 49% that of Malone-Lee [5], 57% that of Karati et al. [4], 17% that of Zhou et al. [13], 71% that of Karati et al. [16], 22% that of Rastegari et al. [17], and 88% that of ECDSA + ECC.Figure4 shows the computational overhead during signcryption and unsigncryption among the proposed scheme and the related works.Figure 4
Performance comparisons among the proposed and the related signcryption schemes in terms of signcryption, unsigncryption, and total costs.


## 5.2. Experimental Results Based on the Ethereum Blockchain

To prove the computational cost of the BaaCA-based signcryption scheme compared with the ECDSA in the original transaction on the Ethereum blockchain, we implement the proposed scheme using the Python programming language and the Ethereum Ropsten Testnet environments [38]. All experiments are carried out with the following settings:(1)
CPU: Intel Core i5-4440 CPU @ 3.1 GHz (quad core).(2)
Physical memory: 16 GB DDR3 1600 MHz.(3)
OS: Windows 7.Finally, the proposed scheme is executed 500 times and its average is taken as our experimental result. Figure5 shows the computational costs of the signcryption and unsigncryption phases. We observe that the cost of the unsigncryption phase is higher than that of the signcryption phase. This is a reasonable result since unsigncryption executes one more elliptic curve scalar point multiplication operation, as shown in Table 2. Moreover, the interval among the test data size is set as 5 kB, and the ratio of the sensitive part to the public part is 1 : 4.Figure 5
Computational costs in the proposed scheme with different amounts of data.In addition to the computational cost, the proposed scheme is also evaluated in terms of its operational cost in real currency. In the proposed scheme, one transaction only is broadcasted into the blockchain in the signcryption phase. The operational cost is estimated by calculating the total amount of gas and then converting it into the real currency. We use the Ethereum Ropsten Testnet environment [38] since it is able to automatically calculate the amount of gas of the proposed scheme. After that, the amount of gas is converted into USD according to the CoinGecko conversion table [39]. At the time of inversion, the rate was 1 gas = 0.000000001 ETH = 1.65×10−7 USD.Figure6 shows the operational costs for different amounts of data. It is observed that the cost increases when the amount of data increases. It is reasonable since more data will lead to greater amounts of gas. However, it seems useless for the result since the cost remains very low. Even if the amount of data increases to 30 kB, the cost in the real currency is still less than 0.35 USD. That means that the proposed scheme is a suitable solution to protect transaction privacy and it only requires a small cost as a fee.Figure 6
The cost of the proposed scheme in USD.


## 6. Discussion

Since the security model has been formally analyzed in Section3, the main advantages of the proposed scheme compared with related works will be given in this section. The comparisons between the previous related works and the proposed method are given in Table 2. It is obvious that the superiority of the proposed scheme is demonstrated by achieving the following advantages:(1)
Removing the high maintenance cost of involving CAs or a TTP: without having a CA or TTP to register a user in the proposed scheme, key pairs are generated by users themselves. It is clear that with the concepts ofblockchain as a CA and transaction as a certificate, users’ public keys are extracted and authenticated directly from transactions in blockchains instead of by CAs or a TTP. Since blockchains such as Bitcoin and Ethereum have no mechanism to publish users’ public keys, the public key extraction operation in the proposed scheme can achieve the goal of the settlement and the authentication of public keys from transactions directly.(2)
Seamless compliance with blockchains: it is not necessary to maintain a KGC. In the proposed scheme, the signcryption scheme can exploit the ECDSA private/public keys without any modification of blockchains. Furthermore, the encryption key used for confidentiality is deduced under the Diffie–Hellman key exchange [40] such that both the prover and the verifier can obtain an identical secret key. In the signcryption phase, Alice’s transaction is TxA=dataA,rA,sA, where dataA are composed of public dataA1 and privacy-sensitive dataA2. The field “input” in Figure 3, which could be an arbitrary message, can be treated as a privacy-sensitive message while the rest of the fields are treated as public information. Precisely, the “input” field is the ciphertext instead (not the plaintext) in the proposed BaaCA-based scheme. This implies that Alice performs the regular operations of generating a common transaction of blockchains except for the additional encryption-related operations. In this way, the implementation of the proposed scheme affects the “input” field, and so the impact must be minimized.Furthermore, the revisited applicability of the proposed scheme achieves the following advantages:(1)
Preserving transaction confidentiality: the proposed scheme lowers the payload for only encrypting the privacy-sensitive part such that the other part of a transaction may remain as plaintext. Thus, the scheme is compliant with the design of blockchains and protects transaction confidentiality at the same time.(2)
Reducing computational and communication costs: as we know, a signcryption scheme is proven to achieve lower computational and communication costs [1]. Thus, the proposed blockchain-compliant signcryption scheme benefits from the advantages of confidentiality, integrity, and nonrepudiation simultaneously.(3)
Designated recipient: the proposed signcryption scheme sets a designated recipient. When trying to verify signaturerA,sA, a recipient must check whether PubA′ is equal to rA−1×sARA−e′P. Without knowing e′, the recipient cannot accomplish this task. Via Theorem 1, attackers have no feasible way to deduce the decryption key to compute dataA2′and then obtain e′=H1dataA1,dataA2′. Thus, the verification of rA,sA must be performed by the designated verifier. Alternatively, if e′=H1dataA1,c in the signcryption phase, every participant involved in the blockchain can be the verifier.


## 7. Conclusions

As mentioned above, the cryptographic advantages of a blockchain are similar to those of a certificate chain such as providing public verification and being tamper-proof. The main difference is that the blockchain is a decentralized trusty mechanism requiring no trusted third party; however, the certificate chain is a centralized trust mechanism with a series of trusted third parties. Because of the success of Bitcoin and Ethereum along with the promising blockchain technologies, it is possible and feasible to combine blockchain technologies with signcryption. Thus, the concept of blockchain as a CA proposed in this paper aims to skillfully leverage the blockchain and achieves the following advantages: (1) it removes the need to involve CAs or a TTP, (2) it seamlessly complies with blockchains, and (3) it preserves transaction privacy.



---

*Source: 6637402-2021-03-26.xml*