# An Improved Efficient Certificateless Hybrid Signcryption Scheme for Internet of Things

Authors: Yong Wu; Bei Gong; Yu Zhang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The Internet of Things (IoT) is a vast perceptual network formed by a variety of IoT devices connected to each other. In IoT, various devices cooperate with each other to collect and transmit private data of IoT and sustain the efficient and orderly operation of IoT. However, in the complex security situation of IoT, due to the resources of IoT devices being limited, it is difficult for IoT devices to afford the heavy resource consumption of sophisticated data encryption and decryption mechanism, which brings certain security risk to data transmission of IoT. To ensure safe and efficient data transmission, we propose an improved efficient certificateless hybrid signcryption scheme for IoT, which satisfies confidentiality, unforgeability, forward security, public verification, and known session-specific temporary information security; meanwhile, we prove them in random oracle model (ROM). In addition, through simulation experiment, we find that our scheme has higher communication efficiency and computational efficiency compared with existing schemes.


---

## Body

## 1. Introduction

The Internet of Things (IoT) realizes the mapping from the real world to the virtual world through the perception of a large number of IoT devices to the real world. In the virtual world, by sorting out and analyzing massive perceptual data, users can obtain more accurate and effective information, so as to obtain detailed status in the real world, and then realize more accurate and efficient adjustment to the real world. At present, with the extensive development of the IoT, IoT has brought unimaginable convenience to the people and the country. For example, in the smart home, various furniture and equipment can cooperate with each other, so that people can get rid of heavy housework [1]. In the smart medical, through the real-time perception and analysis of the disease, patients can attain more perfect and comprehensive treatment in time [2]. Therefore, IoT plays a key role in people’s production and life and has become one of the most potential technologies in the 21st century [3].In IoT, there are a large number of devices with different structures, which cooperate to transmit sensitive data or private information of IoT, forming an organic whole. However, in order to reduce production costs, manufacturers often adopt overly simple structure design and limited resources in the design and manufacture of IoT devices. It is easy for attackers to guess the general structure of the device and carry out illegal operations such as hacking and misappropriation [4]. Additionally, in the face of the complex security situation of IoT, it is difficult for the resource-constrained devices to afford the heavy resource consumption of sophisticated data transmission mechanism, which also brings certain security risks to the data transmission in IoT [5]. Therefore, for the massive resource-constrained devices in IoT, how to ensure the efficient and secure data transmission has become a key factor in the security of IoT [6].Data encryption has become the primary choice to ensure the security of data transmission and has been successfully applied in many fields such as the Internet. However, in IoT, the normal data encryption mechanism is no longer suitable for data encryption of IoT devices because it consumes too much software and hardware resources or lacks some security features of IoT. In order to reduce the resource consumption in the process of data encryption and improve efficiency and security levels of data transmission, the researchers put forward a series of lightweight data encryption algorithm [7, 8]. Among them, the concept of certificateless hybrid signcryption has attracted extensive attention since it was put forward.Compared with other data encryption methods, the certificateless hybrid signcryption mechanism can greatly reduce the consumption of computing resources and communication resources in the process of data transmission and has higher flexibility and security [9]. In the certificateless cryptosystem, the key generation center (KGC) can generate the user’s partial private key according to the user’s public information and send it to the user through the secure channel. After receiving the partial private key, the user combines its own secret value to generate the full private key. After that, the user computes the public key to complete the initialization of the user key. Compared with other public key cryptosystem, the certificateless cryptosystem gets rid of the problem of public key authentication in traditional cryptosystem based on public key infrastructure (PKI). Meanwhile, the full private key of the users in the certificateless public key cryptography is generated jointly by the user and KGC and overcomes the key escrow problem in identity-based cryptography [10]. In terms of data encryption algorithm, compared with the traditional “signature before encryption” method, the hybrid signcryption algorithm can achieve the signature and encryption in one calculation turn, which can improve the computing efficiency and provide stronger security for data transmission [11]. Therefore, for resource-constrained devices and complex security situations in IoT, the certificateless hybrid signcryption mechanism can not only greatly reduce the consumption of computing resources and the communication pressure in data transmission but also can provide better security and flexibility for data transmission of IoT [12].However, in the practical application of resource-constrained devices of IoT, the existing certificateless hybrid signcryption schemes are hard to keep the balance between security and efficiency. In security, the capabilities of attackers are also increasing day by day in IoT, and some proposed schemes have certain flaws in the face of new security requirements of IoT [6]. In efficiency, bilinear pairing operation improves the flexibility and security of the algorithm but also increases the computational pressure on devices [13]. However, most existing schemes adopt multiple bilinear pairing operations, which consume too much hardware and software resources and are no longer suitable for the data transmission requirements of resource-constrained devices in IoT. Therefore, to ensure secure and efficient data transmission in IoT, our contribution is therefore as follows.
(1)
We evaluate the security of Gong et al.’s certificateless hybrid signcryption scheme for IoT [14](2)
We propose an improved efficient certificateless hybrid signcryption scheme for IoT(3)
Our scheme can meet confidentiality, unforgeability, forward security, public verification, and known session-specific temporary information security, and we prove them in random oracle model (ROM)(4)
In theoretical analysis and experimental simulation, we find that our scheme has higher communication efficiency and computational efficiency than the existing schemesThe rest of the paper is organized as follows. In Section2 and Section 3, we present research status and preliminaries related to this paper. The review and the evaluation of the Gong’s scheme are carried out in Section 4. In Section 5, we show the specific details of our scheme. In Section 6, we analyze the security of the proposed scheme. In Section 7, we perform theoretical analysis and experimental simulation. In Section 8, we make the summary of this paper.


## 2. Related Work

Since the concept of certificateless hybrid signcryption is put forward, it has attracted more and more attention, and a series of effective schemes had been produced. Li et al. took the lead in proposing the concept of certificateless hybrid signcryption, gave an example of certificateless hybrid signcryption scheme, and declared that their scheme satisfied confidentiality and unforgeability in ROM [9]. However, Li et al.’s scheme uses too many bilinear pairs, resulting in low computational efficiency.To ensure efficient data transmission, a series of feasible methods and schemes were proposed. Yin and Liang proposed a certificateless hybrid signcryption scheme for wireless sensor networks, which performed only two bilinear calculations and improved computational efficiency [15]. However, after receiving valid message, the receiver can forge any information, resulting in Yin and Liang’s scheme not meeting the unforgeability. Yu and Yang proposed a certificateless hybrid signcryption scheme without pairing, which did not require bilinear computation and improved computing efficiency [16]. However, compared with other schemes, this scheme transmits more data and has certain deficiencies in communication efficiency. Luo and Ma proposed a new certificateless hybrid signcryption scheme for cloud storage, which did not require bilinear pairings and reduced the computational pressure in the process of data encryption [17]. However, Kasyoka et al. proved that Luo and Ma’s scheme did not meet the requirement of unforgeability and had certain security defects and proposed an improvement scheme [18].With the gradual improvement of the attacker’s ability, researchers also put forward some certificateless hybrid signcryption schemes to enhance the security of data transmission. Luo et al. proposed a certificateless hybrid signcryption scheme, which can meet confidentiality, unforgeability, and the known session-specific temporary information security [19]. However, this scheme uses too many bilinear operations and has certain deficiencies in computing efficiency. To ensure data security and low computational overhead, Gong et al. proposed a lightweight and secure certificateless hybrid signcryption for the IoT, but it cannot satisfy the requirements of unforgeability, and its security analysis will be explained in Section 4 of this paper [14].


## 3. Preliminaries

### 3.1. Formal Model of Certificateless Hybrid Signcryption

There are three members: KGC, sender, and receiver. The general interaction process is as follows.Setup. The KGC randomly chooses master system keys and generates system parameters params. After the algorithm is executed, KGC publishes the system parameters params to all usersExtract Partial Private Key. The user firstly sends his unique identifierIDi to KGC, which generates the partial private key di of user and sends the partial private key di to the user through secure channelGenerate User Key. After receiving the system parametersparams published by KGC, the user generates the secret value xi and generates the public key Pi. Next, the user publishes the public key Pi and reserves the secret value xiExtract Full Private Key. After receiving partial private keydi sent secretly by KGC, the user generates the full private key si combined with the secret value xi. From there, the user and KGC jointly generate the full private keys si of userSigncryption. Assume that both sender and receiver have completed the initialization of the key. During the signcryption process, the sender generates the session keyK, encrypts the information m with symmetric encryption algorithm, and generates ciphertext σ. After the signcryption is complete, the sender sends the ciphertext σ to the receiverUnsigncryption. After receiving the ciphertextσ, the receiver generates the session key K and decrypts the ciphertext to recover information m or error symbols ⊥. Finally, the receiver executes the authentication equation to judge the validity of the ciphertext


### 3.2. Security Notions

The security of modern cryptographic systems mostly is based on mathematical problems, and this paper is no exception. The mathematical difficult problems proposed in this paper are involved as follows.Definition 1.
Let us say thatG1 is an additive cyclic group and P is the generator of G1. The challenger chooses aP,bP, where a,b∈Zq∗. The computational Diffie-Hellman (CDH) is to compute abP.Definition 2.
Let us say thatG2 is a multiplication cyclic group and P is the generator of G2. The challenger chooses Pa,Pb, where a,b∈Zq∗. The computational Diffie-Hellman (CDH) is to compute Pab.Definition 3.
Let us say thatG1 is an additive cyclic group and P is the generator of G1. The challenger chooses aP,bP,T∈G1, where a,b∈Zq∗. The decisional Diffie-Hellman (DDH) is to determine whether the equation abP=T is true.Definition 4.
Let us say thatG1 is an additive cyclic group, G2 is a multiplication cyclic group, e^:G1×G1⟶G2 is a bilinear pairing, and P is the generator of G1. The challenger chooses aP,bP,cP∈G1 and T∈G2, where a,b,c∈Zq∗. The decisional bilinear Diffie-Hellman (DBDH) is to determine whether the equation e^P,Pabc=T is true.


## 3.1. Formal Model of Certificateless Hybrid Signcryption

There are three members: KGC, sender, and receiver. The general interaction process is as follows.Setup. The KGC randomly chooses master system keys and generates system parameters params. After the algorithm is executed, KGC publishes the system parameters params to all usersExtract Partial Private Key. The user firstly sends his unique identifierIDi to KGC, which generates the partial private key di of user and sends the partial private key di to the user through secure channelGenerate User Key. After receiving the system parametersparams published by KGC, the user generates the secret value xi and generates the public key Pi. Next, the user publishes the public key Pi and reserves the secret value xiExtract Full Private Key. After receiving partial private keydi sent secretly by KGC, the user generates the full private key si combined with the secret value xi. From there, the user and KGC jointly generate the full private keys si of userSigncryption. Assume that both sender and receiver have completed the initialization of the key. During the signcryption process, the sender generates the session keyK, encrypts the information m with symmetric encryption algorithm, and generates ciphertext σ. After the signcryption is complete, the sender sends the ciphertext σ to the receiverUnsigncryption. After receiving the ciphertextσ, the receiver generates the session key K and decrypts the ciphertext to recover information m or error symbols ⊥. Finally, the receiver executes the authentication equation to judge the validity of the ciphertext


## 3.2. Security Notions

The security of modern cryptographic systems mostly is based on mathematical problems, and this paper is no exception. The mathematical difficult problems proposed in this paper are involved as follows.Definition 1.
Let us say thatG1 is an additive cyclic group and P is the generator of G1. The challenger chooses aP,bP, where a,b∈Zq∗. The computational Diffie-Hellman (CDH) is to compute abP.Definition 2.
Let us say thatG2 is a multiplication cyclic group and P is the generator of G2. The challenger chooses Pa,Pb, where a,b∈Zq∗. The computational Diffie-Hellman (CDH) is to compute Pab.Definition 3.
Let us say thatG1 is an additive cyclic group and P is the generator of G1. The challenger chooses aP,bP,T∈G1, where a,b∈Zq∗. The decisional Diffie-Hellman (DDH) is to determine whether the equation abP=T is true.Definition 4.
Let us say thatG1 is an additive cyclic group, G2 is a multiplication cyclic group, e^:G1×G1⟶G2 is a bilinear pairing, and P is the generator of G1. The challenger chooses aP,bP,cP∈G1 and T∈G2, where a,b,c∈Zq∗. The decisional bilinear Diffie-Hellman (DBDH) is to determine whether the equation e^P,Pabc=T is true.


## 4. Gong et al.’s Scheme Review and Security Analysis

In this section, we review the scheme proposed by Gong et al. and show the security analysis of Gong et al.’s scheme [14]. In the security analysis, we find that the scheme does not meet the unforgeability and prove it.


### 4.1. The Review of Gong et al.’s Scheme

Assuming that Alice is the sender and Bob is the receiver in the communication process, then the details of Gong et al.’s scheme are as follows.Setup. After receiving the security parameterγ, the KGC selects an additive cyclic group G1, a multiplicative cyclic group G2, a bilinear pairing e^:G1×G1⟶G2, and P as the generator of the additive cyclic group G1, where G1=G2=q. Then, KGC selects four hash functions h1:0,1∗⟶Zq∗, h2:0,1∗2×G1×G22⟶Zq∗, h4:G2×Zq∗×G1⟶0,1n, and h5:G1⟶Zq∗ and one modular function h3:amodb,b=h5R. After that, KGC selects x∈Zq∗ as the master system key and computes Ppub=xP as the system public key. Finally, KGC publishes system parameters params and keeps the master system key x secretExtract Partial Private Key. After receiving the user’s unique identifierIDi∈0,1∗ sent by the user ui, and KGC computes di=xQi as the partial private key of the user ui, where Qi=h1IDi. Next, KGC sends the partial private key di to the user ui through the private channelGenerate User Key. The user selects a random valuexi as the secret value and computes Pi=xiP as the public key. After receiving the partial private key di of the user sent by KGC, the user generates the full private key si=xi,diSigncryption. Suppose Alice and Bob have completed the initialization of the key, and Alice already gets Bob’s public keyPB. The specific process of signcryption is as follows.
(1)
Choosesr∈Zq∗ randomly and compute R=rP(2)
Computesy=PBxAh5R and z=h3QBdA, where QB=h1uB(3)
Computes the session keyK=h4y,z,R(4)
Generates ciphertextc=Enckm(5)
Computesf=h2uA,uB,R,PA,PB and s=rz/xAf and sends the ciphertext σ=c,R,s to BobUnsigncryption. Assume that Bob has obtained the public keyPA of sender Alice and received the signcryption ciphertext σ=c,R,s. The specific process of unsigncryption is as follows.
(1)
Computesy=PAxBh5R and z=h3QAdB, where QA=h1uA(2)
Computes the session keyK=h4y,z,R and generates the message m\⊥=DecKc(3)
Computesf=h2uA,uB,R,PA,PB and checks if the verification equation PAsf=e^zP,R is true(4)
If true, Bob receives the message. If not, Bob drops the message


### 4.2. Security Analysis

Through the analysis of the Gong et al.’s scheme, we find that it cannot meet the unforgeability. It is assumed that the sender Alice and the receiver Bob have generated their key. If the receiver Bob has received a valid ciphertextσ=c,R,s, then Bob is able to forge any ciphertext σ′ and claims that it was sent by the sender Alice. The forgery process is as follows.
(1)
Choosesa∈Zq∗ and R′=Ra=arP(2)
Computesy′=PAxBh5R′ and z=h3QAdB(3)
Computes the session keyK=h4y′,z,R′ and executes the symmetric encryption algorithm to generate the ciphertext c=Enckm′, where m′ is the information Bob wants to get(4)
Computes thef=h2uA,uB,R,PA,PB from the previous communication and the forgeable f′=h2uA,uB,R′,PA,PB(5)
Computess′=asff′−1 and generate the valid forgeable ciphertext σ′=c′,R′,s′The forgeable ciphertextσ′=c′,R′,s′ can be able to overcome the verification equation. The verification process is as follows:
(1)PAs′f′=PAasff′−1f′=PAasf=e^P,PxA·arz/xA=e^P,Parz=e^zP,arP=e^zP,R′.Since then, the receiver Bob has successfully forged a valid signcryption ciphertext. Thus, Gong et al.’s proposed scheme does not satisfy the requirement of unforgeability. Based on the analysis of the Gong et al.’s scheme, we propose an improved scheme, which will be introduced in Section5.


## 4.1. The Review of Gong et al.’s Scheme

Assuming that Alice is the sender and Bob is the receiver in the communication process, then the details of Gong et al.’s scheme are as follows.Setup. After receiving the security parameterγ, the KGC selects an additive cyclic group G1, a multiplicative cyclic group G2, a bilinear pairing e^:G1×G1⟶G2, and P as the generator of the additive cyclic group G1, where G1=G2=q. Then, KGC selects four hash functions h1:0,1∗⟶Zq∗, h2:0,1∗2×G1×G22⟶Zq∗, h4:G2×Zq∗×G1⟶0,1n, and h5:G1⟶Zq∗ and one modular function h3:amodb,b=h5R. After that, KGC selects x∈Zq∗ as the master system key and computes Ppub=xP as the system public key. Finally, KGC publishes system parameters params and keeps the master system key x secretExtract Partial Private Key. After receiving the user’s unique identifierIDi∈0,1∗ sent by the user ui, and KGC computes di=xQi as the partial private key of the user ui, where Qi=h1IDi. Next, KGC sends the partial private key di to the user ui through the private channelGenerate User Key. The user selects a random valuexi as the secret value and computes Pi=xiP as the public key. After receiving the partial private key di of the user sent by KGC, the user generates the full private key si=xi,diSigncryption. Suppose Alice and Bob have completed the initialization of the key, and Alice already gets Bob’s public keyPB. The specific process of signcryption is as follows.
(1)
Choosesr∈Zq∗ randomly and compute R=rP(2)
Computesy=PBxAh5R and z=h3QBdA, where QB=h1uB(3)
Computes the session keyK=h4y,z,R(4)
Generates ciphertextc=Enckm(5)
Computesf=h2uA,uB,R,PA,PB and s=rz/xAf and sends the ciphertext σ=c,R,s to BobUnsigncryption. Assume that Bob has obtained the public keyPA of sender Alice and received the signcryption ciphertext σ=c,R,s. The specific process of unsigncryption is as follows.
(1)
Computesy=PAxBh5R and z=h3QAdB, where QA=h1uA(2)
Computes the session keyK=h4y,z,R and generates the message m\⊥=DecKc(3)
Computesf=h2uA,uB,R,PA,PB and checks if the verification equation PAsf=e^zP,R is true(4)
If true, Bob receives the message. If not, Bob drops the message


## 4.2. Security Analysis

Through the analysis of the Gong et al.’s scheme, we find that it cannot meet the unforgeability. It is assumed that the sender Alice and the receiver Bob have generated their key. If the receiver Bob has received a valid ciphertextσ=c,R,s, then Bob is able to forge any ciphertext σ′ and claims that it was sent by the sender Alice. The forgery process is as follows.
(1)
Choosesa∈Zq∗ and R′=Ra=arP(2)
Computesy′=PAxBh5R′ and z=h3QAdB(3)
Computes the session keyK=h4y′,z,R′ and executes the symmetric encryption algorithm to generate the ciphertext c=Enckm′, where m′ is the information Bob wants to get(4)
Computes thef=h2uA,uB,R,PA,PB from the previous communication and the forgeable f′=h2uA,uB,R′,PA,PB(5)
Computess′=asff′−1 and generate the valid forgeable ciphertext σ′=c′,R′,s′The forgeable ciphertextσ′=c′,R′,s′ can be able to overcome the verification equation. The verification process is as follows:
(1)PAs′f′=PAasff′−1f′=PAasf=e^P,PxA·arz/xA=e^P,Parz=e^zP,arP=e^zP,R′.Since then, the receiver Bob has successfully forged a valid signcryption ciphertext. Thus, Gong et al.’s proposed scheme does not satisfy the requirement of unforgeability. Based on the analysis of the Gong et al.’s scheme, we propose an improved scheme, which will be introduced in Section5.


## 5. The Proposed Scheme

In this section, we take the communication between Alice and Bob as an example to introduce our scheme in detail, where Alice represents the sender and Bob represents the receiver. For increasing readability, the main symbols involved in our scheme are introduced in Table1.Table 1
The symbol description table.
SymbolDescriptionPThe generator ofG1sMaster system keyPpubSystem public keySKi=xi,DiUser’s full private keyPKi=Pi,RiUser’s full public keyh1,h2,h3Hash functionSetup. LetG1 and G2 be an additive cyclic group and a multiplicative cyclic group, where G1=G2=p and p is a prime. Choose a bilinear pairing e^:G1×G1⟶G2, P be the generator of G1 and a pair of symmetric encryption and decryption algorithms (Enc, Dec). Select three hash functions h1,h2,h3: h1=0,1l⟶Zq∗, h2=G1×G2×G1⟶0,1n, and h3=0,1l×0,1l×G22×G14⟶Zq∗, where l is the length of identity and n is the length of session key, respectively. Then, the KGC chooses s∈Zq∗ as the master system key and computes Ppub=sP as the system public key. Finally, the KGC publishes the system parameters params=G1,G2,q,e^,P,Ppub,h1,h2,h3,Enc,Dec and keeps the master system key s secretExtract Partial Private Key. After receiving the unique identifierIDi∈0,1l of user, the KGC randomly selects ri∈Zq∗, computes Qi=h1IDi, Ri=riP, and generates the partial private key Di=ri+s·h1IDi. Finally, KGC sends the partial private key Di and Ri to the userGenerate User Key. After receiving the partial private keyDi and the partial public key Ri, the user randomly chooses xi∈Zq∗ as the secret value and computes Pi=e^P,Ppubxi as the public key. Note that the user combines Ri and Pi to generate the full public keys PKi=Ri,PiExtract the Full Private Key. The user combines the secret valuexi and the partial private key Di to generate the full private key SKi=xi,DiSigncryption. Before performing signcryption, the sender Alice has obtained the full public keyPKA=RA,PA, the full private key SKA=xA,DA, the message m needed to be transmitted, system parameters params, the full public key PKB=RB,PB, and identity IDB of the receiver Bob. The detailed process is as follows.
(1)
Choosesr∈Zq∗ randomly and compute R=rP(2)
Computest1=RB+PpubQBr and t2=PBxA, where QB=h1IDB(3)
Computes session keyk=h2t1,t2,R and generates the ciphertext c=Enckm(4)
Computesh=h3IDA,IDB,PA,PB,RA,RB,Ppub,R and s=r+hDA/xA(5)
Sends ciphertextσ=c,R,s to receiver BobUnsigncryption. Before performing unsigncryption, the receiver Bob has obtained the full public keyPKB=RB,PB, the full private key SKB=xB,DB, the ciphertext σ=c,R,s, the system parameters params, the full public key PKA=RA,PA, and identity IDA of the sender Alice. The detailed process is as follows.
(1)
Computest1=RDB and t2=PAxB(2)
Computes session keyk=h2t1,t2,R and generate the message m=Deckc or error symbol ⊥(3)
Computesh=h3IDA,IDB,PA,PB,RA,RB,Ppub,R(4)
Checks if the equationPAs=e^R+hRA+hQAPpub,Ppub holds. If true, the Bob receives the message m; otherwise, the message is dropped


### 5.1. Correctness

(2)t1=RB+PpubQBr=rBP+sQBPr=rB+sQBrP=DBR,t2=PBxA=e∧P,PpubxBxA=e^P,PpubxAxB=PAxB,PAs=PAr+hDA/xA=e^P,PpubxAr+hDA/xA=e^P,Ppubr+hDA=e^r+hDAP,Ppub=e^R+hrA+sh1IDAP,Ppub=e^R+hRA+hQAPpub,Ppub.


## 5.1. Correctness

(2)t1=RB+PpubQBr=rBP+sQBPr=rB+sQBrP=DBR,t2=PBxA=e∧P,PpubxBxA=e^P,PpubxAxB=PAxB,PAs=PAr+hDA/xA=e^P,PpubxAr+hDA/xA=e^P,Ppubr+hDA=e^r+hDAP,Ppub=e^R+hrA+sh1IDAP,Ppub=e^R+hRA+hQAPpub,Ppub.


## 6. Security Analysis

There are two kinds of security adversaryA1,A2 in certificateless public key cryptosystems. The adversary A1, impersonating the user in cryptosystems, can replace the public key of any user in system. The adversary A2, impersonating the KGC in cryptosystems, can obtain the master system key. In this section, we discuss the security attributes of our scheme from the perspective of two types of attackers.


### 6.1. Confidentiality

Lemma 5.
Assuming that the adversaryA1 can be able to win the game GameA1IND−CCA2−1 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, qsk secret value queries, qpsk the partial private key queries, and qrpk the replace public key queries, the challenger C can solve the CDH problem with the follow probability ε′. Note that qT=q1+qsk+qpsk+qpk.
(3)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq121q2.Proof.
The challengerC takes adversary A1 as the subroutine, gives the adversary A1 the P,aP,bP. And the target is compute the abP through the game between adversary A1 and the challenger C.
Setup. The challengerC executes the setup algorithm and generates the system public parameters params
Phase 1. The adversaryA1 execute the following polynomially bounded queries. Note that before the adversary executes queries, the challenger C chooses randomly I,J∈1,q1 for the challenged phase.
h1 query: the challenger C initializes and updates data table L1, where the tuple format is IDi,li. When adversary A1 executes the h1 query with the user identity IDi as input, C firstly checks if L1 contains item IDi,li. If L1 contains the tuple IDi,li, C returns the li to A1. If not, C randomly chooses the li∈Zq∗, adds or updates the new item IDi,li to L1, and returns li to A1
h2 query: the challenger C initializes and updates data table L2, where the tuple format is t1,t2,R,k. When adversary A1 executes the h2 query with the t1,t2,R as the input, the challenger C firstly checks if L2 contains the related tuple t1,t2,R,k. If L2 contains the tuple t1,t2,R,k, C returns the k to A1. If not, C randomly chooses k∈0,1n, inserts the new item t1,t2,R,k to the list L2, and returns the k to A1
h3 query: the challenger C initializes and updates data table L3, where the tuple format is IDA,IDB,PA,PB,RA,RB,Ppub,R,h. When the adversary A1 executes the h3 query with the IDA,IDB,PA,PB,RA,RB,Ppub,R as input, the challenger C firstly checks if L3 contains the interrelated tuple. If L2 contains this tuple, C returns the h to A1. If not, C randomly chooses h∈Zq∗, adds or updates the new item IDA,IDB,PA,PB,RA,RB,Ppub,R,h to L3, and returns h to A1
Secret value query: the challengerC initializes and updates data table Lk, where the tuple format is IDi,Pi,Ri,Di,xi. When adversary A1 executes the secret value query with the IDi as the input, the challenger C firstly checks if Lk contains the interrelated tuple IDi,Pi,−,−,xi. If Lk contains this tuple, C returns the xi to A1. If not, C chooses xi∈Zq∗ randomly, computes Pi=e^P,Ppubxi, adds or updates the item IDi,Pi,−,−,xi to Lk, and returns xi to A1. Note that if IDi=IDJ, C aborts this game
Partial private key query: with theIDi as the input, the challenger C firstly checks if Lk contains the interrelated tuple IDi,−,−,−,Di. If Lk contains this tuple, C returns the Di to A1. Otherwise, if IDi≠IDJ, C chooses ri∈Zq∗ and computes Ri=riP and Di=ri+sli, where li is from the list L1. Next, C adds or updates the item IDi,−,−,−,Di to Lk and returns Di to A1. Note that if IDi=IDJ, C aborts this game
Public key query: when adversaryA1 executes the public key query with the IDi as the input, the challenger C firstly checks if Lk contains list item IDi,Pi,Ri,−,−. If Lk contains this tuple, C returns the PKi=Ri,Pi to A1. Otherwise, if IDi≠IDJ, C executes the secret value query and partial private key query. If IDi=IDJ, C sets xJ∈Zq∗,DJ=b∈G1 and computes PJ=e^P,PpubxJ and RJ=bP−lJPpub, where lJ is from the list L1. Next, C adds or updates the item IDi,Pi,Ri,−,− to Lk and returns PKi=Ri,Pi to A1
Replace public key query: with theIDi,PKi′=Ri′,Pi′ as the input, C updates the list Lk with the new item IDi,Pi′,Ri′,−,−
Signcryption query: when adversaryA1 executes the signcryption query with the IDA,IDB,m as the input, c firstly checks whether IDA=IDJ. If IDA≠IDJ, C executes the normal signcryption process according to our scheme. If IDA=IDJ, the full private key of IDA cannot be obtained, and C queries the full private key SKB=xB,DB of IDB and the full public key PKA=PA,RA of IDA from Lk and performs the following operation.
(1)
Choosesr,v∈Zq∗ randomly and computes R′=rP−vRA−vh1IDAPpub(2)
Inserts intoL3 with the new item IDA,IDB,PA,PB,RA,RB,Ppub,R′,h, where h=v(3)
Computest1=R′DB and t2=PAxB(4)
Computes session keyk′=h2t1,t2,R′, inserts into the L2 with the new item t1,t2,R′,k′, and generates the ciphertext c′=Enck′m(5)
Computess′=r/xJ and returns the ciphertext σ′=c′,R′,s′ to A1
After Bob receives the ciphertextσ′=c′,R′,s′, it can pass the verification, with the following computation:
(4)e^R′+h′RA+h′QAPpub,Ppub=e^rP−vRA−vQAPpub+vRA+vQAPpub,Ppub=e^rP,Ppub=e^P,Ppubr/xJxJ=PAs
Unsigncryption query: when adversaryA1 executes the unsigncryption query with the IDA,IDB,σ=c,R,s as the input, c firstly checks whether IDB=IDJ. If IDB≠IDJ, C executes the normal unsigncryption process according to our scheme. If IDB=IDJ, the full private key of IDB cannot be obtained, and C queries SKA=xA,DA of IDA and PKB=PB,RB of IDB from Lk and performs the following operation.
(1)
Computest2=PBxA(2)
Retrieves each itemt1,t2,R,k in L2 to determine whether t1=RDB is true. If the equation is true, it computes k=h2t1,t2,R and generates the message m=Deckc or error symbol ⊥(3)
Getsh from the list L3 with IDA,IDB,PA,PB,RA,RB,Ppub,R as input(4)
Checks if the equationPAs=e^R+hRA+hh1IDAPpub,Ppub holds. If true, C returns the message m to A1; otherwise, C returns the symbol ⊥ to A1
Challenge. After the queries in Phase 1, the adversaryA1 selects two same length plaintext m1,m2 and two user’s identity IDA,IDB. In this phase, IDA and IDB are the users that A1 will challenge. Before the challenge, the full private key SKB cannot be queried and PKB cannot be replaced. If IDA≠IDI or IDB≠IDJ, C aborts the game. Otherwise, C generates the ciphertext σ by following the steps.
(1)
SetsR∗=aP, chooses v∈Zq∗,t1∗∈G1, and computes t2=PBxA(2)
Chooses session keyk∗=h2t1∗,t2,R∗ and generates the ciphertext c∗=Enckmλ, where λ∈0,1(3)
Adds the new itemIDA,IDB,PA,PB,RA,RB,Ppub,R∗,v to the list L3(4)
Computess∗=a+h∗DA/xA, generates the ciphertext σ∗=c∗,R∗,s∗, and returns σ∗ to A1
Phase 2. In this stage, the adversaryA1 can execute the polynomially bounded queries like Phase 1. Note that SKB of IDB cannot be queried, PKB cannot be replaced, and the ciphertext σ=c,R,s with sender IDI and receiver IDJ cannot be executed unsigncryption query
Guess. The challenger computes the probability of solving the CDH through the adversaryA1 that wins the game. If the A1 wins the game, the list L2 will store q2 items, one of which is the answer to the CDH problem. Thus, C chooses the t1 in every item of L2 to test.
(5)t1=RB+PpubQBr=DBR=rDBP=abP
Analysis. Let us compute the probability of the challengerC cab by solving the CDH problem. In this game, there are two conditions for the challenger to solve CDH: the challenger C does not abort in this game and the adversary A1 successfully wins this game. Firstly, the challenger C abandons the challenge by following four events. Note that qT=q1+qsk+qpsk+qpk.
(1)
Event 1: the adversaryA1 executes the partial private key query of IDJ, and the probability of this event is qpsk/qT(2)
Event 2: the adversaryA1 executes the secret value query of IDJ, and the probability of this event is qsk/qT(3)
Event 3: the adversaryA1 executes the replace public key query of IDJ, and the probability of this event is qrpk/qT(4)
Event 4: when the adversaryA1 executes challenges, the user IDB,IDAare not challenged user identity, that is, IDB≠IDJ,IDA≠IDI, and the probability of this event is 1−1/Cq12
Therefore, we calculate the probability thatC does not give up the game with the probability 1−qpsk/qT1−qsk/qT1−qrpk/qT1/Cq12.
Secondly, the challengerC goes through the list L2 and selects t1 as the answer to the CDH. Thus, the probability of finding the correct solution to CDH is 1/q2. Therefore, with the adversary A1 as the subroutine, the challenger C solves the CDH with the following probability ε′.
(6)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq121q2Lemma 6.
Assuming that the adversaryA2 can be able to win the game GameA2IND−CCA2−2 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, and qsk secret value queries, the challenger C can solve the CDH problem with the follow probability ε′.
(7)ε′=ε1−qskqT1Cq121q2.Proof.
The challengerC takes adversary A2 as the subroutine, gives the adversary A2 the P,Pa,Pb. And the target is compute the Pab through the interactions between adversary A2 and the challenger C.
Setup. The challengerC executes the setup algorithm and generates the system public parameters params
Phase 1. The adversaryA2 executes the following polynomially bounded queries. Note that before the adversary executes queries, the challenger C chooses randomly I,J∈1,q1 for the challenged phase.
h1 query: the challenger C initializes and updates data table L1, where the tuple format is IDi,li. When adversary A2 executes the h1 query with the user identity IDi as input, C firstly checks if L1 contains the interrelated tuple IDi,li. If L1 contains the tuple IDi,li, C returns the li to A2. If not, C randomly chooses the li∈Zq∗, adds or updates the new item IDi,li to L1, and returns li to A2
h2 query: the challenger C initializes and updates data table L2, where the tuple format is t1,t2,R,k. When adversary A2 executes the h2 query with the t1,t2,R as the input, the challenger C firstly checks if L2 contains the interrelated tuple t1,t2,R,k. If L2 contains the tuple t1,t2,R,k, C returns the k to A2. If not, C randomly chooses k∈0,1n, inserts the new item t1,t2,R,k to L2, and returns the k to A2
h3 query: the challenger C initializes and updates data table L3, where the tuple format is IDA,IDB,PA,PB,RA,RB,Ppub,R,h. When the adversary A2 executes the h3 query with the IDA,IDB,PA,PB,RA,RB,Ppub,R as the input, the challenger C firstly checks if L3 contains the interrelated tuple. If L2 contains this tuple, C returns the h to A2. If not, C randomly chooses h∈Zq∗, adds or updates the new item IDA,IDB,PA,PB,RA,RB,Ppub,R,h to L3, and returns h to A2
Secret value query: the challengerC initializes and updates data table Lk, where the tuple format is IDi,Pi,Ri,Di,xi. When adversary A2 executes the secret value query with the IDi as the input, the challenger C firstly checks if Lk contains the interrelated item IDi,−,−,−,xi. If Lk contains this tuple, C returns the xi to A2. If not, C randomly chooses xi∈Zq∗, computes Pi=e^P,Ppubxi, adds or updates the item IDi,−,−,−,xi to Lk, and returns xi to A2. Note that if IDi=IDJ, C aborts this game
Partial private key query: with theIDi as the input, the challenger C firstly checks if Lk contains the interrelated item IDi,−,−,−,Di. If Lk contains this tuple, C returns the Di to A2. Otherwise, C randomly chooses Di∈Zq∗, adds or updates the item IDi,−,−,−,Di to Lk, and returns DitoA2
Public key query: with theIDi as the input, the challenger C firstly checks if Lk contains the interrelated item IDi,Pi,Ri,−,−. If Lk contains this tuple, C returns the PKi=Ri,Pi to A2. Otherwise, if IDi≠IDI or IDi≠IDJ, C executes the secret value query with IDi, gets the secret value xi from Lk, and computes Pi=e^P,Ppubxi. If IDi=IDI, C sets a∈Zq∗ and computes PI=e^P,Ppuba. If IDi=IDJ, C sets b∈Zq∗ and computes PJ=e^P,Ppubb. Then, C chooses ri∈Zq∗ and computesRi=ri∗P, where li is from L1. Next, C adds or updates the Lk with the tuple IDi,Pi,Ri,−,− and returns PKi=Pi,Ri to A2
Signcryption query: when adversaryA2 executes the signcryption query with the IDA,IDB,m as the input, C firstly checks whether IDA=IDJ. If IDA≠IDJ, C executes the normal signcryption process according to our scheme. If IDA=IDJ, the full private key of IDA cannot be obtained, C queries the full private key SKB=xB,DB of IDB and the full public key PKA=PA,RA of IDA from Lk and performs the following operation.
(1)
Choosesr,v∈Zq∗ randomly and computes R′=r−vlAsP−vRA, where lA is from L1(2)
Inserts intoL3 with the new item IDA,IDB,PA,PB,RA,RB,Ppub,R′,h, where h=v(3)
Computest1′=R′DB and t2=PAxB(4)
Computes session keyk′=h2t1′,t2,R′, inserts into the L2 with the new item t1′,t2,R′,k′, and generates c′=Enck′m(5)
Computess′=r/xB and returns the ciphertext σ′=c′,R′,s′toA2
The adversaryA2 can pass the verification, with the following computation:
(8)e^R′+h′RA+h′QAPpub,Ppub=e^r−vlAsP−vRA+vRA+vQAPpub,Ppub=e^R−vlAPpub−vRA+vRA+vliPpub,Ppub=e^rP,Ppub=e^P,Ppubr/xBxB=PAs
Unsigncryption query: when adversaryA2 executes the unsigncryption query with the IDA,IDB,σ=c,R,s as the input, C firstly checks whether IDB=IDJ. If IDB≠IDJ, C executes the normal unsigncryption process according to our scheme. If IDB=IDJ, the full private key of IDB cannot be obtained, and C queries SKA=xA,DA of IDA and PKB=PB,RB of IDB from Lk and performs the following operation.
(1)
Computest1=RDB(2)
Retrieves each itemt1,t2,R,k in L2 to determine whether t2=PBxA is true. If the equation is true, it computes k=h2t1,t2,R and generates the message m=Deckc or error symbol ⊥(3)
Computesh=h3IDA,IDB,PA,PB,RA,RB,Ppub,R(4)
Checks if the equationPAs=e^R+hRA+hh1IDAPpub,Ppub holds. If true, C returns the message m to A2; otherwise, C returns the symbol ⊥ to A2
Challenge. After the queries in Phase 1, the adversaryA2 selects two same length plaintext m1,m2 and two user’s identity IDA,IDB. In this phase, IDA and IDB are the users that A2 will challenge. Before the challenge, the secret value xB of IDB cannot be queried. If IDA≠IDI or IDB≠IDJ, the challenger C aborts the game. Otherwise, C generates the ciphertext c by the following steps.
(1)
Choosesr∈Zq∗, v∈Zq∗, and t2∗∈G2(2)
ComputesR∗=rP and t1=rRB+PpubQB(3)
Computes the session keyk∗=h2t1,t2∗,R∗ and generates the ciphertext c∗=Enck∗mλ, where λ∈0,1(4)
Adds the new itemIDA,IDB,PA,PB,RA,RB,Ppub,R∗,v to the list L3(5)
Computess∗=r+h∗DA/xA, generates the ciphertext σ∗=c∗,R∗,s∗, and returns σ∗ to A2
Phase 2. In this stage, the adversaryA2 can execute the polynomially bounded queries like Phase 1. Note that the secret value xB of IDB cannot be queried and the ciphertext σ=c,R,s with sender IDI and receiver IDJ cannot be executed in the unsigncryption query
Guess. The challenger computes the probability of solving the CDH through the adversaryA2 that wins the game. If the A2 wins the game, the list L2 will store q2 items, one of which is the answer to the CDH problem. C chooses the t2 in every item for test.
(9)t2=PBxA=e^R,PpubxAxB=e^P,PpubxAxB=PAxB
Analysis. Let us compute the probability of the challengerC that can solve the CDH problem. In this game, there are two conditions for the challenger to solve CDH: the challenger C does not abort in this game and the adversary A2 successfully wins this game. Firstly, the challenger C abandons the challenge by following two events. Note that qT=q1+qsk.
(1)
Event 1: the adversaryA2 executes the secret value query of IDJ, and the probability of this event is qsk/qT(2)
Event 2: when the adversaryA2 executes challenges, the user IDB,IDAare not challenged user identity, that is, IDB≠IDJ,IDA≠IDI. The probability of this event is 1−1/Cq12
Therefore, we calculate the probability thatC does not give up the game with the probability 1−qsk/qT1/Cq12.
Secondly, the challengerC goes through the list L2 and selects t2 as the answer to the CDH. Thus, the probability of finding the correct solution to CDH is 1/q2. Therefore, with the adversary A2 as the subroutine, the challenger C solves the CDH with the following probability ε′.
(10)ε′=ε1−qskqT1Cq121q2


### 6.2. Unforgeability

Lemma 7.
Assuming that the adversaryA1 can be able to win the game GameA1EUF−CMA−1 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, qsk secret value queries, qpsk the partial private key queries, and qrpk the replace public key queries, the challenger C can solve the DBDH problem with the follow probability ε′.
(11)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq12.Proof.
The proof is similar to Lemma5. The challenger C takes adversary A1 as the subroutine and gives the adversary A1 the P,aP,bP,cP∈G1,Z∈G2. And the target is determined whether Pabc=Z is true through the game between adversary A1 and the challenger C. In Phase 1, the adversary A1 can execute the polynomially bounded queries, and C returns the corresponding answer to A1. The adversary A1 cannot perform the query about the full private key and replace public key of IDA and the signcryption query with the sender IDA and the receiver IDB. In the forgery phase, the adversary A1 generates the forgery ciphertext σ′=c′,R′,s′. If the adversary A1 wins the game and the challenger C does not abort the game, C makes the a=xA, b=ri/xA, c=s, and Z=e^R,Ppub. And the probability ε′ that the challenger C solves DBDH is the following. Note that qT=q1+qsk+qpsk+qpk.
(12)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq12.Lemma 8.
Assuming that the adversaryA2 can be able to win the game GameA2EUF−CMA−2 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, and qsk secret value queries, the challenger C can solve the DDH problem with the following probability ε′. Note that qT=q1+qsk.
(13)ε′=ε1−qskqT1Cq12.Proof.
The proof is similar to Lemma6. The challenger C takes adversary A1 as the subroutine and gives the adversary A2 the Pa,Pb,Z∈G2. And the target is determined whether Pab=Z is true through the interactions between adversary A2 and the challenger C. In Phase 1, the adversary A2 can execute the polynomially bounded queries, and C returns the corresponding answer to A2. The adversary A2 cannot perform the query about the secret value of IDA and the signcryption query with IDA to IDB. In the forgery phase, A2 generates the forgery ciphertext σ′=c′,R′,s′. If the adversary A2 wins the game and the challenger C does not abort the game, C makes the a=sxA, b=hrA/xA, and Z=e^hRA,Ppub=PshrA. And the probability ε′ that the challenger C solves DDH is the following:
(14)ε′=ε1−qskqT1Cq12.


### 6.3. Forward Security

To prove that our scheme meets forward security, we discuss the security situation of our scheme from two kinds of adversaryA1,A2. For the adversary A1, it can obtain all the private key of the sender IDA and all the ciphertext information in the previous communication. However, it is difficult for the adversary A1 to decrypt the ciphertext and get the corresponding message m. The symmetric key of the ciphertext is generated by the the Hash function h2 with t1,t2 and R. In the communication, the adversary A1 can recover t2=PBxA and get R from previous ciphertext. However, based on the CDH, the adversary A1 cannot calculate t1=RDBaP=R,bP=DB. Therefore, adversary A1 cannot recover the message m from the previous communication. For the adversary A2, it can get the master system key s but cannot obtain the partial private key DB of the receiver Bob. Thus, the proof of A2 is similar to that of the first type of attacker. Based on CDH, it is difficult for the adversary to calculate the t1 and the session key k and decrypt the ciphertext. Therefore, our scheme can meet forward security.


### 6.4. Public Verification

All users in the certificateless public key system can authenticate any ciphertextσ=c,R,s. When receiving a ciphertext σ, IDA, PKA=PA,RA, IDB and PKB=PB,RB, any user of the system can compute h=h3IDA,IDB,PA,PB,RA,RB,Ppub,R and execute the authentication equation PAs=e^R+hRA+hQAPpub,Ppub to determine whether the ciphertext is valid or not. In the process of authentication, decryption operations and the full private keys of the sender or receiver are not required, and verification can be quickly implemented. Therefore, our scheme can meet public verification.


### 6.5. Known Session-Specific Temporary Information Security

Assuming that the adversary has obtained the random valuer of the sender’s signcryption process, the adversary still cannot obtain any valuable information. For the adversary A1, it can obtain IDA, PKA=PA,RA, IDB, and PKB=PB,RB and generates t1=RB+PpubQBr and R=rP. However, based the assumption of CDH problem, it is difficult for the adversary A1 to calculate the t2=PBxA and computes the correct session key k. For the adversary A2, it can obtain the master system key s of KGC but cannot obtain the secret value of xA. Thus, the proof of A2 is similar to the proof of A1 and the adversary A2 cannot correct session key k based on the assumption of CDH problem. Therefore, our scheme can meet known session-specific temporary information security.


## 6.1. Confidentiality

Lemma 5.
Assuming that the adversaryA1 can be able to win the game GameA1IND−CCA2−1 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, qsk secret value queries, qpsk the partial private key queries, and qrpk the replace public key queries, the challenger C can solve the CDH problem with the follow probability ε′. Note that qT=q1+qsk+qpsk+qpk.
(3)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq121q2.Proof.
The challengerC takes adversary A1 as the subroutine, gives the adversary A1 the P,aP,bP. And the target is compute the abP through the game between adversary A1 and the challenger C.
Setup. The challengerC executes the setup algorithm and generates the system public parameters params
Phase 1. The adversaryA1 execute the following polynomially bounded queries. Note that before the adversary executes queries, the challenger C chooses randomly I,J∈1,q1 for the challenged phase.
h1 query: the challenger C initializes and updates data table L1, where the tuple format is IDi,li. When adversary A1 executes the h1 query with the user identity IDi as input, C firstly checks if L1 contains item IDi,li. If L1 contains the tuple IDi,li, C returns the li to A1. If not, C randomly chooses the li∈Zq∗, adds or updates the new item IDi,li to L1, and returns li to A1
h2 query: the challenger C initializes and updates data table L2, where the tuple format is t1,t2,R,k. When adversary A1 executes the h2 query with the t1,t2,R as the input, the challenger C firstly checks if L2 contains the related tuple t1,t2,R,k. If L2 contains the tuple t1,t2,R,k, C returns the k to A1. If not, C randomly chooses k∈0,1n, inserts the new item t1,t2,R,k to the list L2, and returns the k to A1
h3 query: the challenger C initializes and updates data table L3, where the tuple format is IDA,IDB,PA,PB,RA,RB,Ppub,R,h. When the adversary A1 executes the h3 query with the IDA,IDB,PA,PB,RA,RB,Ppub,R as input, the challenger C firstly checks if L3 contains the interrelated tuple. If L2 contains this tuple, C returns the h to A1. If not, C randomly chooses h∈Zq∗, adds or updates the new item IDA,IDB,PA,PB,RA,RB,Ppub,R,h to L3, and returns h to A1
Secret value query: the challengerC initializes and updates data table Lk, where the tuple format is IDi,Pi,Ri,Di,xi. When adversary A1 executes the secret value query with the IDi as the input, the challenger C firstly checks if Lk contains the interrelated tuple IDi,Pi,−,−,xi. If Lk contains this tuple, C returns the xi to A1. If not, C chooses xi∈Zq∗ randomly, computes Pi=e^P,Ppubxi, adds or updates the item IDi,Pi,−,−,xi to Lk, and returns xi to A1. Note that if IDi=IDJ, C aborts this game
Partial private key query: with theIDi as the input, the challenger C firstly checks if Lk contains the interrelated tuple IDi,−,−,−,Di. If Lk contains this tuple, C returns the Di to A1. Otherwise, if IDi≠IDJ, C chooses ri∈Zq∗ and computes Ri=riP and Di=ri+sli, where li is from the list L1. Next, C adds or updates the item IDi,−,−,−,Di to Lk and returns Di to A1. Note that if IDi=IDJ, C aborts this game
Public key query: when adversaryA1 executes the public key query with the IDi as the input, the challenger C firstly checks if Lk contains list item IDi,Pi,Ri,−,−. If Lk contains this tuple, C returns the PKi=Ri,Pi to A1. Otherwise, if IDi≠IDJ, C executes the secret value query and partial private key query. If IDi=IDJ, C sets xJ∈Zq∗,DJ=b∈G1 and computes PJ=e^P,PpubxJ and RJ=bP−lJPpub, where lJ is from the list L1. Next, C adds or updates the item IDi,Pi,Ri,−,− to Lk and returns PKi=Ri,Pi to A1
Replace public key query: with theIDi,PKi′=Ri′,Pi′ as the input, C updates the list Lk with the new item IDi,Pi′,Ri′,−,−
Signcryption query: when adversaryA1 executes the signcryption query with the IDA,IDB,m as the input, c firstly checks whether IDA=IDJ. If IDA≠IDJ, C executes the normal signcryption process according to our scheme. If IDA=IDJ, the full private key of IDA cannot be obtained, and C queries the full private key SKB=xB,DB of IDB and the full public key PKA=PA,RA of IDA from Lk and performs the following operation.
(1)
Choosesr,v∈Zq∗ randomly and computes R′=rP−vRA−vh1IDAPpub(2)
Inserts intoL3 with the new item IDA,IDB,PA,PB,RA,RB,Ppub,R′,h, where h=v(3)
Computest1=R′DB and t2=PAxB(4)
Computes session keyk′=h2t1,t2,R′, inserts into the L2 with the new item t1,t2,R′,k′, and generates the ciphertext c′=Enck′m(5)
Computess′=r/xJ and returns the ciphertext σ′=c′,R′,s′ to A1
After Bob receives the ciphertextσ′=c′,R′,s′, it can pass the verification, with the following computation:
(4)e^R′+h′RA+h′QAPpub,Ppub=e^rP−vRA−vQAPpub+vRA+vQAPpub,Ppub=e^rP,Ppub=e^P,Ppubr/xJxJ=PAs
Unsigncryption query: when adversaryA1 executes the unsigncryption query with the IDA,IDB,σ=c,R,s as the input, c firstly checks whether IDB=IDJ. If IDB≠IDJ, C executes the normal unsigncryption process according to our scheme. If IDB=IDJ, the full private key of IDB cannot be obtained, and C queries SKA=xA,DA of IDA and PKB=PB,RB of IDB from Lk and performs the following operation.
(1)
Computest2=PBxA(2)
Retrieves each itemt1,t2,R,k in L2 to determine whether t1=RDB is true. If the equation is true, it computes k=h2t1,t2,R and generates the message m=Deckc or error symbol ⊥(3)
Getsh from the list L3 with IDA,IDB,PA,PB,RA,RB,Ppub,R as input(4)
Checks if the equationPAs=e^R+hRA+hh1IDAPpub,Ppub holds. If true, C returns the message m to A1; otherwise, C returns the symbol ⊥ to A1
Challenge. After the queries in Phase 1, the adversaryA1 selects two same length plaintext m1,m2 and two user’s identity IDA,IDB. In this phase, IDA and IDB are the users that A1 will challenge. Before the challenge, the full private key SKB cannot be queried and PKB cannot be replaced. If IDA≠IDI or IDB≠IDJ, C aborts the game. Otherwise, C generates the ciphertext σ by following the steps.
(1)
SetsR∗=aP, chooses v∈Zq∗,t1∗∈G1, and computes t2=PBxA(2)
Chooses session keyk∗=h2t1∗,t2,R∗ and generates the ciphertext c∗=Enckmλ, where λ∈0,1(3)
Adds the new itemIDA,IDB,PA,PB,RA,RB,Ppub,R∗,v to the list L3(4)
Computess∗=a+h∗DA/xA, generates the ciphertext σ∗=c∗,R∗,s∗, and returns σ∗ to A1
Phase 2. In this stage, the adversaryA1 can execute the polynomially bounded queries like Phase 1. Note that SKB of IDB cannot be queried, PKB cannot be replaced, and the ciphertext σ=c,R,s with sender IDI and receiver IDJ cannot be executed unsigncryption query
Guess. The challenger computes the probability of solving the CDH through the adversaryA1 that wins the game. If the A1 wins the game, the list L2 will store q2 items, one of which is the answer to the CDH problem. Thus, C chooses the t1 in every item of L2 to test.
(5)t1=RB+PpubQBr=DBR=rDBP=abP
Analysis. Let us compute the probability of the challengerC cab by solving the CDH problem. In this game, there are two conditions for the challenger to solve CDH: the challenger C does not abort in this game and the adversary A1 successfully wins this game. Firstly, the challenger C abandons the challenge by following four events. Note that qT=q1+qsk+qpsk+qpk.
(1)
Event 1: the adversaryA1 executes the partial private key query of IDJ, and the probability of this event is qpsk/qT(2)
Event 2: the adversaryA1 executes the secret value query of IDJ, and the probability of this event is qsk/qT(3)
Event 3: the adversaryA1 executes the replace public key query of IDJ, and the probability of this event is qrpk/qT(4)
Event 4: when the adversaryA1 executes challenges, the user IDB,IDAare not challenged user identity, that is, IDB≠IDJ,IDA≠IDI, and the probability of this event is 1−1/Cq12
Therefore, we calculate the probability thatC does not give up the game with the probability 1−qpsk/qT1−qsk/qT1−qrpk/qT1/Cq12.
Secondly, the challengerC goes through the list L2 and selects t1 as the answer to the CDH. Thus, the probability of finding the correct solution to CDH is 1/q2. Therefore, with the adversary A1 as the subroutine, the challenger C solves the CDH with the following probability ε′.
(6)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq121q2Lemma 6.
Assuming that the adversaryA2 can be able to win the game GameA2IND−CCA2−2 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, and qsk secret value queries, the challenger C can solve the CDH problem with the follow probability ε′.
(7)ε′=ε1−qskqT1Cq121q2.Proof.
The challengerC takes adversary A2 as the subroutine, gives the adversary A2 the P,Pa,Pb. And the target is compute the Pab through the interactions between adversary A2 and the challenger C.
Setup. The challengerC executes the setup algorithm and generates the system public parameters params
Phase 1. The adversaryA2 executes the following polynomially bounded queries. Note that before the adversary executes queries, the challenger C chooses randomly I,J∈1,q1 for the challenged phase.
h1 query: the challenger C initializes and updates data table L1, where the tuple format is IDi,li. When adversary A2 executes the h1 query with the user identity IDi as input, C firstly checks if L1 contains the interrelated tuple IDi,li. If L1 contains the tuple IDi,li, C returns the li to A2. If not, C randomly chooses the li∈Zq∗, adds or updates the new item IDi,li to L1, and returns li to A2
h2 query: the challenger C initializes and updates data table L2, where the tuple format is t1,t2,R,k. When adversary A2 executes the h2 query with the t1,t2,R as the input, the challenger C firstly checks if L2 contains the interrelated tuple t1,t2,R,k. If L2 contains the tuple t1,t2,R,k, C returns the k to A2. If not, C randomly chooses k∈0,1n, inserts the new item t1,t2,R,k to L2, and returns the k to A2
h3 query: the challenger C initializes and updates data table L3, where the tuple format is IDA,IDB,PA,PB,RA,RB,Ppub,R,h. When the adversary A2 executes the h3 query with the IDA,IDB,PA,PB,RA,RB,Ppub,R as the input, the challenger C firstly checks if L3 contains the interrelated tuple. If L2 contains this tuple, C returns the h to A2. If not, C randomly chooses h∈Zq∗, adds or updates the new item IDA,IDB,PA,PB,RA,RB,Ppub,R,h to L3, and returns h to A2
Secret value query: the challengerC initializes and updates data table Lk, where the tuple format is IDi,Pi,Ri,Di,xi. When adversary A2 executes the secret value query with the IDi as the input, the challenger C firstly checks if Lk contains the interrelated item IDi,−,−,−,xi. If Lk contains this tuple, C returns the xi to A2. If not, C randomly chooses xi∈Zq∗, computes Pi=e^P,Ppubxi, adds or updates the item IDi,−,−,−,xi to Lk, and returns xi to A2. Note that if IDi=IDJ, C aborts this game
Partial private key query: with theIDi as the input, the challenger C firstly checks if Lk contains the interrelated item IDi,−,−,−,Di. If Lk contains this tuple, C returns the Di to A2. Otherwise, C randomly chooses Di∈Zq∗, adds or updates the item IDi,−,−,−,Di to Lk, and returns DitoA2
Public key query: with theIDi as the input, the challenger C firstly checks if Lk contains the interrelated item IDi,Pi,Ri,−,−. If Lk contains this tuple, C returns the PKi=Ri,Pi to A2. Otherwise, if IDi≠IDI or IDi≠IDJ, C executes the secret value query with IDi, gets the secret value xi from Lk, and computes Pi=e^P,Ppubxi. If IDi=IDI, C sets a∈Zq∗ and computes PI=e^P,Ppuba. If IDi=IDJ, C sets b∈Zq∗ and computes PJ=e^P,Ppubb. Then, C chooses ri∈Zq∗ and computesRi=ri∗P, where li is from L1. Next, C adds or updates the Lk with the tuple IDi,Pi,Ri,−,− and returns PKi=Pi,Ri to A2
Signcryption query: when adversaryA2 executes the signcryption query with the IDA,IDB,m as the input, C firstly checks whether IDA=IDJ. If IDA≠IDJ, C executes the normal signcryption process according to our scheme. If IDA=IDJ, the full private key of IDA cannot be obtained, C queries the full private key SKB=xB,DB of IDB and the full public key PKA=PA,RA of IDA from Lk and performs the following operation.
(1)
Choosesr,v∈Zq∗ randomly and computes R′=r−vlAsP−vRA, where lA is from L1(2)
Inserts intoL3 with the new item IDA,IDB,PA,PB,RA,RB,Ppub,R′,h, where h=v(3)
Computest1′=R′DB and t2=PAxB(4)
Computes session keyk′=h2t1′,t2,R′, inserts into the L2 with the new item t1′,t2,R′,k′, and generates c′=Enck′m(5)
Computess′=r/xB and returns the ciphertext σ′=c′,R′,s′toA2
The adversaryA2 can pass the verification, with the following computation:
(8)e^R′+h′RA+h′QAPpub,Ppub=e^r−vlAsP−vRA+vRA+vQAPpub,Ppub=e^R−vlAPpub−vRA+vRA+vliPpub,Ppub=e^rP,Ppub=e^P,Ppubr/xBxB=PAs
Unsigncryption query: when adversaryA2 executes the unsigncryption query with the IDA,IDB,σ=c,R,s as the input, C firstly checks whether IDB=IDJ. If IDB≠IDJ, C executes the normal unsigncryption process according to our scheme. If IDB=IDJ, the full private key of IDB cannot be obtained, and C queries SKA=xA,DA of IDA and PKB=PB,RB of IDB from Lk and performs the following operation.
(1)
Computest1=RDB(2)
Retrieves each itemt1,t2,R,k in L2 to determine whether t2=PBxA is true. If the equation is true, it computes k=h2t1,t2,R and generates the message m=Deckc or error symbol ⊥(3)
Computesh=h3IDA,IDB,PA,PB,RA,RB,Ppub,R(4)
Checks if the equationPAs=e^R+hRA+hh1IDAPpub,Ppub holds. If true, C returns the message m to A2; otherwise, C returns the symbol ⊥ to A2
Challenge. After the queries in Phase 1, the adversaryA2 selects two same length plaintext m1,m2 and two user’s identity IDA,IDB. In this phase, IDA and IDB are the users that A2 will challenge. Before the challenge, the secret value xB of IDB cannot be queried. If IDA≠IDI or IDB≠IDJ, the challenger C aborts the game. Otherwise, C generates the ciphertext c by the following steps.
(1)
Choosesr∈Zq∗, v∈Zq∗, and t2∗∈G2(2)
ComputesR∗=rP and t1=rRB+PpubQB(3)
Computes the session keyk∗=h2t1,t2∗,R∗ and generates the ciphertext c∗=Enck∗mλ, where λ∈0,1(4)
Adds the new itemIDA,IDB,PA,PB,RA,RB,Ppub,R∗,v to the list L3(5)
Computess∗=r+h∗DA/xA, generates the ciphertext σ∗=c∗,R∗,s∗, and returns σ∗ to A2
Phase 2. In this stage, the adversaryA2 can execute the polynomially bounded queries like Phase 1. Note that the secret value xB of IDB cannot be queried and the ciphertext σ=c,R,s with sender IDI and receiver IDJ cannot be executed in the unsigncryption query
Guess. The challenger computes the probability of solving the CDH through the adversaryA2 that wins the game. If the A2 wins the game, the list L2 will store q2 items, one of which is the answer to the CDH problem. C chooses the t2 in every item for test.
(9)t2=PBxA=e^R,PpubxAxB=e^P,PpubxAxB=PAxB
Analysis. Let us compute the probability of the challengerC that can solve the CDH problem. In this game, there are two conditions for the challenger to solve CDH: the challenger C does not abort in this game and the adversary A2 successfully wins this game. Firstly, the challenger C abandons the challenge by following two events. Note that qT=q1+qsk.
(1)
Event 1: the adversaryA2 executes the secret value query of IDJ, and the probability of this event is qsk/qT(2)
Event 2: when the adversaryA2 executes challenges, the user IDB,IDAare not challenged user identity, that is, IDB≠IDJ,IDA≠IDI. The probability of this event is 1−1/Cq12
Therefore, we calculate the probability thatC does not give up the game with the probability 1−qsk/qT1/Cq12.
Secondly, the challengerC goes through the list L2 and selects t2 as the answer to the CDH. Thus, the probability of finding the correct solution to CDH is 1/q2. Therefore, with the adversary A2 as the subroutine, the challenger C solves the CDH with the following probability ε′.
(10)ε′=ε1−qskqT1Cq121q2


## 6.2. Unforgeability

Lemma 7.
Assuming that the adversaryA1 can be able to win the game GameA1EUF−CMA−1 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, qsk secret value queries, qpsk the partial private key queries, and qrpk the replace public key queries, the challenger C can solve the DBDH problem with the follow probability ε′.
(11)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq12.Proof.
The proof is similar to Lemma5. The challenger C takes adversary A1 as the subroutine and gives the adversary A1 the P,aP,bP,cP∈G1,Z∈G2. And the target is determined whether Pabc=Z is true through the game between adversary A1 and the challenger C. In Phase 1, the adversary A1 can execute the polynomially bounded queries, and C returns the corresponding answer to A1. The adversary A1 cannot perform the query about the full private key and replace public key of IDA and the signcryption query with the sender IDA and the receiver IDB. In the forgery phase, the adversary A1 generates the forgery ciphertext σ′=c′,R′,s′. If the adversary A1 wins the game and the challenger C does not abort the game, C makes the a=xA, b=ri/xA, c=s, and Z=e^R,Ppub. And the probability ε′ that the challenger C solves DBDH is the following. Note that qT=q1+qsk+qpsk+qpk.
(12)ε′=ε1−qpskqT1−qskqT1−qrpkqT1Cq12.Lemma 8.
Assuming that the adversaryA2 can be able to win the game GameA2EUF−CMA−2 with a nonnegligible advantages ε after q1h1 queries, q2h2 queries, q3h3 queries, qpk public key queries, and qsk secret value queries, the challenger C can solve the DDH problem with the following probability ε′. Note that qT=q1+qsk.
(13)ε′=ε1−qskqT1Cq12.Proof.
The proof is similar to Lemma6. The challenger C takes adversary A1 as the subroutine and gives the adversary A2 the Pa,Pb,Z∈G2. And the target is determined whether Pab=Z is true through the interactions between adversary A2 and the challenger C. In Phase 1, the adversary A2 can execute the polynomially bounded queries, and C returns the corresponding answer to A2. The adversary A2 cannot perform the query about the secret value of IDA and the signcryption query with IDA to IDB. In the forgery phase, A2 generates the forgery ciphertext σ′=c′,R′,s′. If the adversary A2 wins the game and the challenger C does not abort the game, C makes the a=sxA, b=hrA/xA, and Z=e^hRA,Ppub=PshrA. And the probability ε′ that the challenger C solves DDH is the following:
(14)ε′=ε1−qskqT1Cq12.


## 6.3. Forward Security

To prove that our scheme meets forward security, we discuss the security situation of our scheme from two kinds of adversaryA1,A2. For the adversary A1, it can obtain all the private key of the sender IDA and all the ciphertext information in the previous communication. However, it is difficult for the adversary A1 to decrypt the ciphertext and get the corresponding message m. The symmetric key of the ciphertext is generated by the the Hash function h2 with t1,t2 and R. In the communication, the adversary A1 can recover t2=PBxA and get R from previous ciphertext. However, based on the CDH, the adversary A1 cannot calculate t1=RDBaP=R,bP=DB. Therefore, adversary A1 cannot recover the message m from the previous communication. For the adversary A2, it can get the master system key s but cannot obtain the partial private key DB of the receiver Bob. Thus, the proof of A2 is similar to that of the first type of attacker. Based on CDH, it is difficult for the adversary to calculate the t1 and the session key k and decrypt the ciphertext. Therefore, our scheme can meet forward security.


## 6.4. Public Verification

All users in the certificateless public key system can authenticate any ciphertextσ=c,R,s. When receiving a ciphertext σ, IDA, PKA=PA,RA, IDB and PKB=PB,RB, any user of the system can compute h=h3IDA,IDB,PA,PB,RA,RB,Ppub,R and execute the authentication equation PAs=e^R+hRA+hQAPpub,Ppub to determine whether the ciphertext is valid or not. In the process of authentication, decryption operations and the full private keys of the sender or receiver are not required, and verification can be quickly implemented. Therefore, our scheme can meet public verification.


## 6.5. Known Session-Specific Temporary Information Security

Assuming that the adversary has obtained the random valuer of the sender’s signcryption process, the adversary still cannot obtain any valuable information. For the adversary A1, it can obtain IDA, PKA=PA,RA, IDB, and PKB=PB,RB and generates t1=RB+PpubQBr and R=rP. However, based the assumption of CDH problem, it is difficult for the adversary A1 to calculate the t2=PBxA and computes the correct session key k. For the adversary A2, it can obtain the master system key s of KGC but cannot obtain the secret value of xA. Thus, the proof of A2 is similar to the proof of A1 and the adversary A2 cannot correct session key k based on the assumption of CDH problem. Therefore, our scheme can meet known session-specific temporary information security.


## 7. Performance Analysis

### 7.1. Comparison of Communication Efficiency

In this section, we compared the communication efficiency of our scheme with other existed schemes and generate Table2. In Table 2, m indicates the length of data to be transmitted, q indicates the length of each element in Zq∗, and g1 indicates the length of each element in G1.Table 2
Comparison of message lengths during communication.
SchemeCiphertext lengthLuo et al.’s scheme [19]q+2g1+m≈350bitsYin and Liang’s scheme [20]2q+g1+m≈305bitsOur schemeq+g1+m≈285bitsAssume that we use the 80 bit security level in the standard model and the size of messagem is 200 bits, the size of element in Zq∗ is 20 bits, and the size of element of G1 is 65 bits [21]. As can be seen from Table 2, in one communication, the message length of Luo et al.’s scheme is calculated lluo=20+65×2+200=350 bits, the message length of Yin and Liang’s scheme is lyin=20×2+65+200=305 bits, and the message length of our scheme is lour=20+65+200=285 bits. Thus, compared with existing schemes, this scheme transmits less messages and has higher communication efficiency.


### 7.2. Comparison of Computational Efficiency

In this section, we analyze the computational efficiency of the proposed scheme through theoretical calculation and simulation experiments. In theoretical calculation, bilinear pairing computation, multiplication operation, and exponential operation are the three operations that consume the most computing resources in schemes. Therefore, we compare with other schemes on the number of operations of three kinds of calculations and generate Table3, where mul, exp, and pair, respectively, stand for multiplication operation and exponential operation and bilinear pairing operation [22]. As can be seen from Table 3, compared with existing schemes, the proposed scheme reduces the calculation times of multiplication operation and bilinear pairing operation and reduces the calculation pressure of data encryption and decryption.Table 3
Comparison of operation times of different schemes.
SchemeSigncryptionUnsigncryptionNumber of operationsmulexppairmulexppairLuo et al.’s scheme [19]5014049mul+5pairYin and Liang’s scheme [20]60140310mul+4pairOur scheme3103216mul+3exp+pairIn the simulation experiment, we used ubuntu20.04 and pypbc to build a 512-bit standard security model. In the security model, we simulate the running process of the proposed scheme and the comparison schemes, measure the average running time under different size of message, and generate Figure1. From Figure 1, in the process of data transmission, our scheme requires shorter running time than other schemes, and with the increase of the size of data transmission, our scheme has more obvious advantages in computing efficiency. Therefore, our proposed scheme reduces the computational pressure in the data encryption and decryption and is suitable for data transmission of the practical application of IoT.Figure 1
Comparison of running time for different message size.


## 7.1. Comparison of Communication Efficiency

In this section, we compared the communication efficiency of our scheme with other existed schemes and generate Table2. In Table 2, m indicates the length of data to be transmitted, q indicates the length of each element in Zq∗, and g1 indicates the length of each element in G1.Table 2
Comparison of message lengths during communication.
SchemeCiphertext lengthLuo et al.’s scheme [19]q+2g1+m≈350bitsYin and Liang’s scheme [20]2q+g1+m≈305bitsOur schemeq+g1+m≈285bitsAssume that we use the 80 bit security level in the standard model and the size of messagem is 200 bits, the size of element in Zq∗ is 20 bits, and the size of element of G1 is 65 bits [21]. As can be seen from Table 2, in one communication, the message length of Luo et al.’s scheme is calculated lluo=20+65×2+200=350 bits, the message length of Yin and Liang’s scheme is lyin=20×2+65+200=305 bits, and the message length of our scheme is lour=20+65+200=285 bits. Thus, compared with existing schemes, this scheme transmits less messages and has higher communication efficiency.


## 7.2. Comparison of Computational Efficiency

In this section, we analyze the computational efficiency of the proposed scheme through theoretical calculation and simulation experiments. In theoretical calculation, bilinear pairing computation, multiplication operation, and exponential operation are the three operations that consume the most computing resources in schemes. Therefore, we compare with other schemes on the number of operations of three kinds of calculations and generate Table3, where mul, exp, and pair, respectively, stand for multiplication operation and exponential operation and bilinear pairing operation [22]. As can be seen from Table 3, compared with existing schemes, the proposed scheme reduces the calculation times of multiplication operation and bilinear pairing operation and reduces the calculation pressure of data encryption and decryption.Table 3
Comparison of operation times of different schemes.
SchemeSigncryptionUnsigncryptionNumber of operationsmulexppairmulexppairLuo et al.’s scheme [19]5014049mul+5pairYin and Liang’s scheme [20]60140310mul+4pairOur scheme3103216mul+3exp+pairIn the simulation experiment, we used ubuntu20.04 and pypbc to build a 512-bit standard security model. In the security model, we simulate the running process of the proposed scheme and the comparison schemes, measure the average running time under different size of message, and generate Figure1. From Figure 1, in the process of data transmission, our scheme requires shorter running time than other schemes, and with the increase of the size of data transmission, our scheme has more obvious advantages in computing efficiency. Therefore, our proposed scheme reduces the computational pressure in the data encryption and decryption and is suitable for data transmission of the practical application of IoT.Figure 1
Comparison of running time for different message size.


## 8. Conclusion

In this paper, we firstly review and evaluate the certificateless hybrid signcryption proposed by Gong et al. [14]. It is pointed out that there are some deficiencies in its unforgeability. Based on the Gong et al.’s scheme, we propose an improved certificateless hybrid signcryption scheme for IoT and prove that the scheme can meet confidentiality, unforgeability, forward security, public verification, and known session-specific temporary information security in ROM. In addition, through theoretical analysis and simulation experiment, compared with the existing scheme, our scheme consumes less communication resources and computing resources, has higher communication efficiency and computing efficiency, and is suitable for data transmission of the practical application of IoT device.In addition, it needs to be noted that this scheme increases the number of exponential operations in data transmission. In the future work, it can be considered to reduce the number of exponential operations, so as to further reduce the computing pressure of resource-constrained devices in IoT and improve the computing efficiency of this scheme.



---

*Source: 6945004-2022-04-19.xml*