# An Efficient and Provably-Secure Certificateless Proxy-Signcryption Scheme for Electronic Prescription System

Authors: Li Li; Siqin Zhou; Kim-Kwang Raymond Choo; Xiaohong Li; Debiao He
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Electronic prescription is increasingly popular in our society, particularly in technologically advanced countries. Due to strict legal requirements and privacy regulations, authorization and data confidentiality are two important features in electronic prescription system. By combining signature and encryption functions, signcryption is an efficient cryptographic primitive that can be used to provide these two features. While signcryption is a fairly established research area, most signcryption schemes proposed recently have several limitations (e.g., high communication costs, limited bandwidth, and insecurity), and designing secure and practical signcryption schemes remains challenging. In this paper, we propose an improved certificateless proxy signcryption (CLPSC) scheme, based on elliptic curve cryptography (ECC). We also demonstrate that the proposed CLPSC scheme is secure in the random oracle model and evaluate its performance with related schemes. The security and performance evaluations show that the proposed CLPSC scheme can potentially be implemented on resource-constrained low-computing mobile devices in an electronic prescription system.


---

## Body

## 1. Introduction

Recent advances in cryptographic techniques and consumer and communication technologies have resulted in the migration of services from the brick-and-mortar model to an online model, where transactions are being conducted from mobile devices (e.g., Android and iOS devices and potentially wearable and embedded devices). One such industry application is electronic prescriptions (e-prescriptions) [1, 2], where prescriptions are being sent electronically from a medical practitioner/medical practice to the pharmacist/pharmacy. Payments can also be made online (e.g., using credit cards or bank transfers), and the medications can either be picked up from the pharmacy or delivered to the user’s home [3]. Benefits of an e-prescription system extend beyond mere convenience to the users. For example, pharmacists no longer have to ‘decipher’ the hand-written prescription, which saves time and costs (e.g., having to call the medical practitioner to confirm the actual prescription) and minimizing the chance for errors [4]. Such errors can be fatal. For example, in a study by Brits and Verma [5], it was found that illegible handwriting and other prescription errors on prescriptions resulted in “lorazepam injection 4 mg” being misread as “40 mg (lethal dose) by 20% of [the] healthcare workers.”There are situations where the patient may not be able to collect the medication in person, for example, due to physical injury or medical condition (e.g., severe gout attack resulting in the patient unable to walk and collect prescribed medication such as Colchicine). Thus, the patient has to give another individual (e.g., family member or neighbor) the proxy delegation to collect the medication on his/her behalf. Pharmacists have legal obligations when handling, dispensing, and supplying medications, particularly drugs of dependence. Therefore, it is important to ensure the security and efficiency of generating such a delegation in the e-prescription system.One such solution is proxy signcryption, as it allows the delegation of signing privileges in computing devices such as mobile devices. The security of such schemes, as well as many other cryptographic schemes (e.g., key agreement and signature schemes), generally relies on the intractability of hard problems such as Diffie-Hellman problem, integer factorization problem, and discrete logarithm problem [6–10]. In recent times, there have been a large number of proxy-signcryption schemes proposed that are based on bilinear pairings [11–13]. However, such schemes often have high computational and communication costs; thus, they are not suited for deployment on mobile devices. Hence, there have been attempts to design pairing-free proxy-signcryption schemes, such as the certificateless proxy-signcryption (CLPSC) schemes of Liu et al. [14] and Qi et al. [15]. The design of such schemes is challenging. For example, Liu et al. [14] proposed a pairing-free CLPSC scheme based on elliptic curve cryptography (ECC), with reduced computational and communication costs. This scheme is, however, vulnerable to public key replacement attack when deployed on resource-constrained devices.More recently in 2017, Bhatia and Verma [16] proposed an efficient ECC-based pairing-free CLPSC scheme. However, we reveal in this paper that Bhatia and Vermas’s scheme also cannot resist the public key replacement attack. Specifically, we demonstrate that it is vulnerable to a public key replacement attack by a Type 1 adversary. Then, we propose an improved protocol to mitigate the security weakness. We also demonstrate the security of the improved protocol in the random oracle model and compare with other related schemes in terms of computation costs and security properties.In the next section, we present relevant background materials. In Section3, we reveal the vulnerability in the scheme of Bhatia and Verma. Then, we present the proposed scheme in Section 4 and analyze its security in Section 5. A comparative analysis with existing schemes is presented in Section 6. Finally, we conclude this paper in Section 7.


## 2. Preliminaries

### 2.1. Syntax Definition of CLPSC Scheme

In general, the CLPSC scheme comprises three different entities: an original signcrypter (OS), a receiver (R), and a proxy signcrypter (PS). An OS (e.g., a patient) delegates to PS (e.g., a trusted individual such as a family member or neighbor) the authority to signcrypt a message [17, 18]. During proxy signcryption, OS sends his/her signing authority to PS with a delegation warrant, which consists of the identities of the delegator, a message space, and the validity time of the delegation. The warrant requires OS’s signature and PS’s public key. PS will generate a signcrypted ciphertext with its signature and send a signcrypted ciphertext to R. Upon receiving the signcrypted ciphertext, R (e.g., the pharmacist) unsigncrypts it and checks whether the proxy signature is valid. If it is valid, then PS is authorized to perform tasks such as collect OS’ medication; otherwise, PS’ request is denied. The CLPSC scheme contains the following polynomial algorithms:(i)
Setup: This algorithm invoked by a Key Generation Center (KGC). It takes security parameter k as an input and runs setup algorithm to obtain system parameter ψ and the master key s.(ii)
Extract-Partial-Private-Key: KGC takes system parameters ψ, master key s, and a user ID as inputs and outputs the partial private key dID of the user.(iii)
Set-Secret: This algorithm takes security parameter k and system parameters ψ as inputs and outputs the secret value sID.(iv)
Set-Private Key: It inputs system parameters ψ, a user’s secret value sID, and a user’s partial private key dID and outputs the public key SKID=(sID,dID).(v)
Set-Public Key: It inputs system parameters ψ and a user’s secret value xID and outputs the public key PKID=(PID,KID).(vi)
Gen-Delegation: It inputs system parameter ψ, a warrant MW, an ID, and public/private key of the original signer and then outputs a partial proxy key.(vii)
Verify-Delegation: It inputs system parameter ψ, a warrant MW, a partial proxy key, an original signer’s ID, and his/her public key, using the protocol to check whether the partial proxy key is from a legitimate user. If yes, then it outputs 1; otherwise, it outputs 0.(viii)
Gen-Proxy-Key: It inputs the system parameter ψ, the partial proxy key, and the proxy signer’s partial key and outputs a proxy key.(ix)
Proxy-Signcryption: It inputs the system parameter ψ, a delegation warrant MW, a message m, an ID and public key of an original signcrypter (OS), an ID and public key of a proxy signcrypter (PS), and a proxy key and outputs a proxy signcrypted ciphertext σ.(x)
Proxy-Unsigncryption: It inputs the system parameter ψ, a message M, a warrant MW, an original signcrypter (OS)’s identity and public key, and a proxy signcrypter (PS)’s identity and public key. If the signature is verified to be correct, then it returns 1; otherwise, it returns 0.


### 2.2. Formal Security Model for CLPSC Scheme

#### 2.2.1. Adversaries

In this section, we discuss two kinds of adversaries in the CLPSC schemes, as well as the types of oracle queries the adversaries have access to.Type I adversaryA1 is a dishonest user who has the ability to replace public key, but A1 is not capable of obtaining the system master key. Type II adversary A2 is a malicious-but-passive KGC. This adversary can access the master key and generates the partial private key of users, but it is not able to replace the public key. Now, we describe eight oracle queries that can be accessed by both adversaries:(i)
Create-User-Oracle: This oracle inputs a users’ identity ID. If the ID exists, then PKID of the corresponding ID is returned. Otherwise, it generates the private key SKID=(dID,sID) and the public key PKID=(PID,KID), adds (ID,SKID,PKID) to the list L, and returns PKID.(ii)
Reveal-Partial-Private-Key-Oracle: This oracle looks for list L of an input users’ ID. If the ID exists and then returns the corresponding dID. Otherwise, it return null.(iii)
Reveal-Secret-Key-Oracle: This oracle looks for list L of an input users’ ID. If the ID exists, then returns the corresponding sID. Otherwise, returns null.(iv)
Replace-Public-Key-Oracle: This oracle can pick a random value instead of the users’ public key. Upon receiving the target ID, the oracle replaces a corresponding public key in the list L.(v)
Generate-Delegation-Oracle: Upon receiving the system parameter ψ, an original signers private key SKID=(dID,sID), and a warrant MW, this oracle can generate a delegation and send to the proxy signcrypter at a later stage.(vi)
Proxy-Key-Oracle: This oracle takes an original signers identity IDO, a proxy signers identity IDP, and a warrant MW as inputs and outputs the proxy key and sends it to the proxy signer.(vii)
Proxy-Signcrypt-Oracle: This oracle takes a message M, a warrant MW, an original signers identity IDO, and a proxy signers’ identity IDP as inputs and generates a proxy signature σIDP as an output.(viii)
Proxy-Unsigncrypt-Oracle: This oracle takes the system parameter ψ, the delegation warrant MW, the signcrypted message δ, the public keys PKID and ID of the original user and the proxy signer, and the private key SKID of the receiver as inputs and checks if the delegation warrant MW is valid. If the verification is true, then it unsigncrypts signcrypted message δ and returns a plaintext m. Otherwise it returns error.


#### 2.2.2. Security Notions

(i)
Confidentiality
(1)
Definition 1: A certificateless signcryption scheme has ciphertext indistinguishability (IND-CLSC-CCA2) for adaptive selective ciphertext attacks, only if no attacker has no unfair advantage in winning the following games 1 and 2 in polynomial bounded time. (2)
Game 1 IND-CCA: This game captures the confidentiality requirement, based on the indistinguishability of encryptions under adaptively chosen ciphertext attacks against A1. (3)
Initialization: Upon receiving an input k, the setup algorithm is executed to get system parameters ψ and the master key s, then sends system parameters ψ to A1, and keeps the system master key s secretly. (4)
Phase I: A1 can ask for a polynomial bounded number of challenger queries from oracles. (5)
Challenge: A1 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. The challenger chooses a random number b∈{0,1}, proxy signcrypts Mb, to produce a corresponding signcrypted ciphertext δ∗ to A1. (6)
Phase II: A1 can ask for similar queries from oracles as in Phase I, except for Reveal-Partial-Private-Key-Oracle and Reveal-Secret-Key-Oracle with receiver’s identity, Proxy-Unsigncrypt-Oracle with (δ∗,IDO,IDP,IDR), unless their public key has been changed. (7)
Output: At last, A1 outputs Mb′ as the response of signcrypts δ∗. if b′=b, A1 succeeds in the game. (8)
Game 2 IND-CCA: The game captures confidentiality requirements, based on the indistinguishability of encryptions under adaptively chosen ciphertext attacks against the adversary A2. (9)
Initialization: Upon receiving an input k, the setup algorithm is executed to obtain the system parameter ψ and the system master key s and then sends them to A2. (10)
Phase I: A2 can ask for a polynomial bounded number of challenger queries from oracles. (11)
Challenge: A2 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. The challenger chooses a random number b∈{0,1}, proxy signcrypts Mb, to produce a corresponding signcrypted ciphertext δ∗ to the adversary A2. (12)
Phase II: A2 can ask for similar queries from oracles as in Phase I, not including Proxy-Unsigncrypt-Oracle as before. (13)
Output: At last, A2 outputs Mb′ as the response of signcrypts δ∗. if b′=b, A2 succeeds in the game. (ii)
Unforgeability
(1)
Definition 2: The CLPSC scheme is EUF-CMA secure only if no attacker has an unfair advantage in winning the following games 3 and 4 in the polynomial bounded time. (2)
Game 3 EUF-CMA: In this game, the adversary needs to successfully fabricate a valid ciphertext without any delegation warrant. (3)
Initialization: Upon receiving an input k, the setup algorithm is executed to generate the system parameter ψ, the system master key s, and then sends system parameters ψ to A1 but keeps the system master key s secretly. (4)
Queries: A1 can ask for a polynomial bounded number of challenger queries from oracles, including Create-User-Oracle, Reveal-Partial-Private-Key-Oracle, Reveal-Secret-Key-Oracle, Replace-Public-Key-Oracle, Generate-Delegation-Oracle, Reveal-Proxy-Key-Oracle, Proxy-Signcrypt-Oracle, and Proxy-Unsigncrypt-Oracle. (5)
Forgery: At last, A1 outputs a signcryption δ∗ on message M under IDO∗, IDP∗. If δ∗ is a valid ciphertext in Proxy-Signcrypt-Oracle and then A1 succeeds in this game. However, A1 is not permitted to query the Reveal-Partial-Private-Key oracle, the Replace-Public-Key oracle, or the Reveal-Secret-Key oracle of the original user in the game. (6)
Game 4 EUF-CMA: In the game, the challenger interacts with A2 as follows: (7)
Initialization: Upon receiving an input k, the setup algorithm is executed to get system parameters ψ and a system master key s which are sent to A2 later. (8)
Queries: A2 may make adaptively a polynomial bounded number of queries to oracles like Create-User, Reveal-Secret-Key, Generate-Delegation, Reveal-Proxy-Key, Proxy-Signcrypt, and Proxy-Unsigncrypt through the challenger. (9)
Forgery: At last, A2 outputs a signcryption δ∗ on message M under IDO∗, IDP∗. If δ∗ is a valid ciphertext in Proxy-Signcrypt-Oracle, then A1 succeeds in this game. It is mandatory that A2 has not queried Reveal-Secret-Key oracle during the game.


## 2.1. Syntax Definition of CLPSC Scheme

In general, the CLPSC scheme comprises three different entities: an original signcrypter (OS), a receiver (R), and a proxy signcrypter (PS). An OS (e.g., a patient) delegates to PS (e.g., a trusted individual such as a family member or neighbor) the authority to signcrypt a message [17, 18]. During proxy signcryption, OS sends his/her signing authority to PS with a delegation warrant, which consists of the identities of the delegator, a message space, and the validity time of the delegation. The warrant requires OS’s signature and PS’s public key. PS will generate a signcrypted ciphertext with its signature and send a signcrypted ciphertext to R. Upon receiving the signcrypted ciphertext, R (e.g., the pharmacist) unsigncrypts it and checks whether the proxy signature is valid. If it is valid, then PS is authorized to perform tasks such as collect OS’ medication; otherwise, PS’ request is denied. The CLPSC scheme contains the following polynomial algorithms:(i)
Setup: This algorithm invoked by a Key Generation Center (KGC). It takes security parameter k as an input and runs setup algorithm to obtain system parameter ψ and the master key s.(ii)
Extract-Partial-Private-Key: KGC takes system parameters ψ, master key s, and a user ID as inputs and outputs the partial private key dID of the user.(iii)
Set-Secret: This algorithm takes security parameter k and system parameters ψ as inputs and outputs the secret value sID.(iv)
Set-Private Key: It inputs system parameters ψ, a user’s secret value sID, and a user’s partial private key dID and outputs the public key SKID=(sID,dID).(v)
Set-Public Key: It inputs system parameters ψ and a user’s secret value xID and outputs the public key PKID=(PID,KID).(vi)
Gen-Delegation: It inputs system parameter ψ, a warrant MW, an ID, and public/private key of the original signer and then outputs a partial proxy key.(vii)
Verify-Delegation: It inputs system parameter ψ, a warrant MW, a partial proxy key, an original signer’s ID, and his/her public key, using the protocol to check whether the partial proxy key is from a legitimate user. If yes, then it outputs 1; otherwise, it outputs 0.(viii)
Gen-Proxy-Key: It inputs the system parameter ψ, the partial proxy key, and the proxy signer’s partial key and outputs a proxy key.(ix)
Proxy-Signcryption: It inputs the system parameter ψ, a delegation warrant MW, a message m, an ID and public key of an original signcrypter (OS), an ID and public key of a proxy signcrypter (PS), and a proxy key and outputs a proxy signcrypted ciphertext σ.(x)
Proxy-Unsigncryption: It inputs the system parameter ψ, a message M, a warrant MW, an original signcrypter (OS)’s identity and public key, and a proxy signcrypter (PS)’s identity and public key. If the signature is verified to be correct, then it returns 1; otherwise, it returns 0.


## 2.2. Formal Security Model for CLPSC Scheme

### 2.2.1. Adversaries

In this section, we discuss two kinds of adversaries in the CLPSC schemes, as well as the types of oracle queries the adversaries have access to.Type I adversaryA1 is a dishonest user who has the ability to replace public key, but A1 is not capable of obtaining the system master key. Type II adversary A2 is a malicious-but-passive KGC. This adversary can access the master key and generates the partial private key of users, but it is not able to replace the public key. Now, we describe eight oracle queries that can be accessed by both adversaries:(i)
Create-User-Oracle: This oracle inputs a users’ identity ID. If the ID exists, then PKID of the corresponding ID is returned. Otherwise, it generates the private key SKID=(dID,sID) and the public key PKID=(PID,KID), adds (ID,SKID,PKID) to the list L, and returns PKID.(ii)
Reveal-Partial-Private-Key-Oracle: This oracle looks for list L of an input users’ ID. If the ID exists and then returns the corresponding dID. Otherwise, it return null.(iii)
Reveal-Secret-Key-Oracle: This oracle looks for list L of an input users’ ID. If the ID exists, then returns the corresponding sID. Otherwise, returns null.(iv)
Replace-Public-Key-Oracle: This oracle can pick a random value instead of the users’ public key. Upon receiving the target ID, the oracle replaces a corresponding public key in the list L.(v)
Generate-Delegation-Oracle: Upon receiving the system parameter ψ, an original signers private key SKID=(dID,sID), and a warrant MW, this oracle can generate a delegation and send to the proxy signcrypter at a later stage.(vi)
Proxy-Key-Oracle: This oracle takes an original signers identity IDO, a proxy signers identity IDP, and a warrant MW as inputs and outputs the proxy key and sends it to the proxy signer.(vii)
Proxy-Signcrypt-Oracle: This oracle takes a message M, a warrant MW, an original signers identity IDO, and a proxy signers’ identity IDP as inputs and generates a proxy signature σIDP as an output.(viii)
Proxy-Unsigncrypt-Oracle: This oracle takes the system parameter ψ, the delegation warrant MW, the signcrypted message δ, the public keys PKID and ID of the original user and the proxy signer, and the private key SKID of the receiver as inputs and checks if the delegation warrant MW is valid. If the verification is true, then it unsigncrypts signcrypted message δ and returns a plaintext m. Otherwise it returns error.


### 2.2.2. Security Notions

(i)
Confidentiality
(1)
Definition 1: A certificateless signcryption scheme has ciphertext indistinguishability (IND-CLSC-CCA2) for adaptive selective ciphertext attacks, only if no attacker has no unfair advantage in winning the following games 1 and 2 in polynomial bounded time. (2)
Game 1 IND-CCA: This game captures the confidentiality requirement, based on the indistinguishability of encryptions under adaptively chosen ciphertext attacks against A1. (3)
Initialization: Upon receiving an input k, the setup algorithm is executed to get system parameters ψ and the master key s, then sends system parameters ψ to A1, and keeps the system master key s secretly. (4)
Phase I: A1 can ask for a polynomial bounded number of challenger queries from oracles. (5)
Challenge: A1 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. The challenger chooses a random number b∈{0,1}, proxy signcrypts Mb, to produce a corresponding signcrypted ciphertext δ∗ to A1. (6)
Phase II: A1 can ask for similar queries from oracles as in Phase I, except for Reveal-Partial-Private-Key-Oracle and Reveal-Secret-Key-Oracle with receiver’s identity, Proxy-Unsigncrypt-Oracle with (δ∗,IDO,IDP,IDR), unless their public key has been changed. (7)
Output: At last, A1 outputs Mb′ as the response of signcrypts δ∗. if b′=b, A1 succeeds in the game. (8)
Game 2 IND-CCA: The game captures confidentiality requirements, based on the indistinguishability of encryptions under adaptively chosen ciphertext attacks against the adversary A2. (9)
Initialization: Upon receiving an input k, the setup algorithm is executed to obtain the system parameter ψ and the system master key s and then sends them to A2. (10)
Phase I: A2 can ask for a polynomial bounded number of challenger queries from oracles. (11)
Challenge: A2 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. The challenger chooses a random number b∈{0,1}, proxy signcrypts Mb, to produce a corresponding signcrypted ciphertext δ∗ to the adversary A2. (12)
Phase II: A2 can ask for similar queries from oracles as in Phase I, not including Proxy-Unsigncrypt-Oracle as before. (13)
Output: At last, A2 outputs Mb′ as the response of signcrypts δ∗. if b′=b, A2 succeeds in the game. (ii)
Unforgeability
(1)
Definition 2: The CLPSC scheme is EUF-CMA secure only if no attacker has an unfair advantage in winning the following games 3 and 4 in the polynomial bounded time. (2)
Game 3 EUF-CMA: In this game, the adversary needs to successfully fabricate a valid ciphertext without any delegation warrant. (3)
Initialization: Upon receiving an input k, the setup algorithm is executed to generate the system parameter ψ, the system master key s, and then sends system parameters ψ to A1 but keeps the system master key s secretly. (4)
Queries: A1 can ask for a polynomial bounded number of challenger queries from oracles, including Create-User-Oracle, Reveal-Partial-Private-Key-Oracle, Reveal-Secret-Key-Oracle, Replace-Public-Key-Oracle, Generate-Delegation-Oracle, Reveal-Proxy-Key-Oracle, Proxy-Signcrypt-Oracle, and Proxy-Unsigncrypt-Oracle. (5)
Forgery: At last, A1 outputs a signcryption δ∗ on message M under IDO∗, IDP∗. If δ∗ is a valid ciphertext in Proxy-Signcrypt-Oracle and then A1 succeeds in this game. However, A1 is not permitted to query the Reveal-Partial-Private-Key oracle, the Replace-Public-Key oracle, or the Reveal-Secret-Key oracle of the original user in the game. (6)
Game 4 EUF-CMA: In the game, the challenger interacts with A2 as follows: (7)
Initialization: Upon receiving an input k, the setup algorithm is executed to get system parameters ψ and a system master key s which are sent to A2 later. (8)
Queries: A2 may make adaptively a polynomial bounded number of queries to oracles like Create-User, Reveal-Secret-Key, Generate-Delegation, Reveal-Proxy-Key, Proxy-Signcrypt, and Proxy-Unsigncrypt through the challenger. (9)
Forgery: At last, A2 outputs a signcryption δ∗ on message M under IDO∗, IDP∗. If δ∗ is a valid ciphertext in Proxy-Signcrypt-Oracle, then A1 succeeds in this game. It is mandatory that A2 has not queried Reveal-Secret-Key oracle during the game.


## 2.2.1. Adversaries

In this section, we discuss two kinds of adversaries in the CLPSC schemes, as well as the types of oracle queries the adversaries have access to.Type I adversaryA1 is a dishonest user who has the ability to replace public key, but A1 is not capable of obtaining the system master key. Type II adversary A2 is a malicious-but-passive KGC. This adversary can access the master key and generates the partial private key of users, but it is not able to replace the public key. Now, we describe eight oracle queries that can be accessed by both adversaries:(i)
Create-User-Oracle: This oracle inputs a users’ identity ID. If the ID exists, then PKID of the corresponding ID is returned. Otherwise, it generates the private key SKID=(dID,sID) and the public key PKID=(PID,KID), adds (ID,SKID,PKID) to the list L, and returns PKID.(ii)
Reveal-Partial-Private-Key-Oracle: This oracle looks for list L of an input users’ ID. If the ID exists and then returns the corresponding dID. Otherwise, it return null.(iii)
Reveal-Secret-Key-Oracle: This oracle looks for list L of an input users’ ID. If the ID exists, then returns the corresponding sID. Otherwise, returns null.(iv)
Replace-Public-Key-Oracle: This oracle can pick a random value instead of the users’ public key. Upon receiving the target ID, the oracle replaces a corresponding public key in the list L.(v)
Generate-Delegation-Oracle: Upon receiving the system parameter ψ, an original signers private key SKID=(dID,sID), and a warrant MW, this oracle can generate a delegation and send to the proxy signcrypter at a later stage.(vi)
Proxy-Key-Oracle: This oracle takes an original signers identity IDO, a proxy signers identity IDP, and a warrant MW as inputs and outputs the proxy key and sends it to the proxy signer.(vii)
Proxy-Signcrypt-Oracle: This oracle takes a message M, a warrant MW, an original signers identity IDO, and a proxy signers’ identity IDP as inputs and generates a proxy signature σIDP as an output.(viii)
Proxy-Unsigncrypt-Oracle: This oracle takes the system parameter ψ, the delegation warrant MW, the signcrypted message δ, the public keys PKID and ID of the original user and the proxy signer, and the private key SKID of the receiver as inputs and checks if the delegation warrant MW is valid. If the verification is true, then it unsigncrypts signcrypted message δ and returns a plaintext m. Otherwise it returns error.


## 2.2.2. Security Notions

(i)
Confidentiality
(1)
Definition 1: A certificateless signcryption scheme has ciphertext indistinguishability (IND-CLSC-CCA2) for adaptive selective ciphertext attacks, only if no attacker has no unfair advantage in winning the following games 1 and 2 in polynomial bounded time. (2)
Game 1 IND-CCA: This game captures the confidentiality requirement, based on the indistinguishability of encryptions under adaptively chosen ciphertext attacks against A1. (3)
Initialization: Upon receiving an input k, the setup algorithm is executed to get system parameters ψ and the master key s, then sends system parameters ψ to A1, and keeps the system master key s secretly. (4)
Phase I: A1 can ask for a polynomial bounded number of challenger queries from oracles. (5)
Challenge: A1 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. The challenger chooses a random number b∈{0,1}, proxy signcrypts Mb, to produce a corresponding signcrypted ciphertext δ∗ to A1. (6)
Phase II: A1 can ask for similar queries from oracles as in Phase I, except for Reveal-Partial-Private-Key-Oracle and Reveal-Secret-Key-Oracle with receiver’s identity, Proxy-Unsigncrypt-Oracle with (δ∗,IDO,IDP,IDR), unless their public key has been changed. (7)
Output: At last, A1 outputs Mb′ as the response of signcrypts δ∗. if b′=b, A1 succeeds in the game. (8)
Game 2 IND-CCA: The game captures confidentiality requirements, based on the indistinguishability of encryptions under adaptively chosen ciphertext attacks against the adversary A2. (9)
Initialization: Upon receiving an input k, the setup algorithm is executed to obtain the system parameter ψ and the system master key s and then sends them to A2. (10)
Phase I: A2 can ask for a polynomial bounded number of challenger queries from oracles. (11)
Challenge: A2 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. The challenger chooses a random number b∈{0,1}, proxy signcrypts Mb, to produce a corresponding signcrypted ciphertext δ∗ to the adversary A2. (12)
Phase II: A2 can ask for similar queries from oracles as in Phase I, not including Proxy-Unsigncrypt-Oracle as before. (13)
Output: At last, A2 outputs Mb′ as the response of signcrypts δ∗. if b′=b, A2 succeeds in the game. (ii)
Unforgeability
(1)
Definition 2: The CLPSC scheme is EUF-CMA secure only if no attacker has an unfair advantage in winning the following games 3 and 4 in the polynomial bounded time. (2)
Game 3 EUF-CMA: In this game, the adversary needs to successfully fabricate a valid ciphertext without any delegation warrant. (3)
Initialization: Upon receiving an input k, the setup algorithm is executed to generate the system parameter ψ, the system master key s, and then sends system parameters ψ to A1 but keeps the system master key s secretly. (4)
Queries: A1 can ask for a polynomial bounded number of challenger queries from oracles, including Create-User-Oracle, Reveal-Partial-Private-Key-Oracle, Reveal-Secret-Key-Oracle, Replace-Public-Key-Oracle, Generate-Delegation-Oracle, Reveal-Proxy-Key-Oracle, Proxy-Signcrypt-Oracle, and Proxy-Unsigncrypt-Oracle. (5)
Forgery: At last, A1 outputs a signcryption δ∗ on message M under IDO∗, IDP∗. If δ∗ is a valid ciphertext in Proxy-Signcrypt-Oracle and then A1 succeeds in this game. However, A1 is not permitted to query the Reveal-Partial-Private-Key oracle, the Replace-Public-Key oracle, or the Reveal-Secret-Key oracle of the original user in the game. (6)
Game 4 EUF-CMA: In the game, the challenger interacts with A2 as follows: (7)
Initialization: Upon receiving an input k, the setup algorithm is executed to get system parameters ψ and a system master key s which are sent to A2 later. (8)
Queries: A2 may make adaptively a polynomial bounded number of queries to oracles like Create-User, Reveal-Secret-Key, Generate-Delegation, Reveal-Proxy-Key, Proxy-Signcrypt, and Proxy-Unsigncrypt through the challenger. (9)
Forgery: At last, A2 outputs a signcryption δ∗ on message M under IDO∗, IDP∗. If δ∗ is a valid ciphertext in Proxy-Signcrypt-Oracle, then A1 succeeds in this game. It is mandatory that A2 has not queried Reveal-Secret-Key oracle during the game.


## 3. Review and Analysis of Bhatia and Verma’s CLPSC Scheme

### 3.1. Review of Bhatia and Verma’s CLPSC Scheme

In this section, we review the scheme of Bhatia and Verma, which consists of the following 10 polynomial time algorithms.Setup. After the key generation center (KGC, who has the responsibility for system keys and the partial private keys of users) has chosen a security parameter k, the algorithm performs the following steps:(1)
Chooses an elliptic curveE/Ep over prime finite field Fp(2)
Chooses a cyclic subgroup G of the elliptic curve group, sets P as a generator of order q(3)
Chooses a master secret keys∈Zq∗ and generates Ppub=sP as a master public key(4)
Lets the message space be{0,1}l and selects four different hash functions H1,H2,H3,H4:(1)H1:0,1∗×G→Zq∗H2:0,1∗×G×G×G×G→Zq∗H3:G→0,1lH4:0,1∗→Zq∗(5)
At last, outputs the system parametersψ={E,Fp,G,P,H1,H2,H3,H4,Ppub}.Extract-Partial-Private-Key. Taking the system parameters ψ, system private key s, and IDO as inputs, KGC can calculate the partial private key dO=kO+hOs of user O, where kO∈Zq∗ is randomly chosen. Then, KO=kOP,hO=H1(IDO,KO),(dO,KO) are sent to the user in a secure communication channel.Set-Secret. Upon receiving (dO,KO), the user O verifies whether the parameters come from a legitimate KGC by computing dOP=KO+hOPpub. After successful verification, O picks a random sO as its secret value and computes PO=sOP.Set-Private-Key. Given system parameters, partial private key dO, and secret value sO as inputs, this algorithm outputs a private key pair SKO=(sO,dO).Set-Public-Key. Given system parameters ψ,PO,KO as inputs, this algorithm outputs a public key pair PKO=(PO,KO).Gen-Delegation. Having the inputs, the original signcrypters private key pair SKO=(sO,dO), public key pair PKO=(PO,KO), and message warrant MW, this algorithm generates the delegation DO→P on MW. Then, the user O randomly chooses a∈Zq∗, computes K=aP, and further computes t as follows:(2)t=a+h1dO+sO,where h1=H2(MW∥IDP,K,KO,PO,Ppub). The delegation DO→P=(IDO,IDP,MW,K,KO,PO,t) is sent to the proxy signcrypter (PS) later.Verify-Delegation. The PS verifies whether the delegation is legitimate by computing(3)h1=H2MW∥IDP,K,KO,PO,PpubhO=H1IDO,KOand checks whether(4)tp=h1KO+hOPpub+POIf not, the proxy signcrypter rejects the delegation request.Gen-Proxy-Key. Upon successful verification, PS computes a proxy signing key(5)DP=t+h2dP+sP,where h2=H2(MW∥IDO,K,KP,PP,Ppub).Proxy-Signcryption. Given proxy key DP, message M, and public key of the receiver (PR,KR) as inputs, it generates a signcrypted ciphertext on O’s behalf. Specifically, PS randomly chooses u∈Zq∗ and further calculates U=uP,V=uPR,h=H3(V),h3=H4(M∥IDO∥IDR∥IDP). The detail processes of generating proxy signcryption on message M are described as follows:(6)z=M⊕h(7)S=u+h3DPAfter that, the signcrypted ciphertext (IDO,KO,PO, MW,IDP,KP,PP,U,K,z,S) is sent to R by PS.Proxy-Unsigncryption. After receiving a complete signcrypted ciphertext (IDO,KO,PO,MW,IDP,KP,PP, U,K,z,S), the receiver R unsigncrypts V=sRU,M=z⊕H3(V) and(8)SP=h3K+h1KO+PO+hOPpub+h2KP+PP+hCPpub+UIf the above equation holds, then R accepts the message.


### 3.2. Analysis of Bhatia and Verma’s CLPSC Scheme

We will now present a successful public key replacement attack by a Type 1 adversaryA1 against the scheme.Step 1.
A 1 chooses three random numbers a∗∈Zq∗,z1∈Zq∗,z2∈Zq∗ and computes(9)K′=a′P(10)KO′=z1P(11)PO′=z2P-hO′Ppub(12)hO′=H1IDO,KO′Then, it generates a forged public key pair KO′,PO′ and substitutes the original public key of OS.Step 2.
Given a message warrantMW′, which can be intercepted from the communication channel between OS and PS, OS computes t′=(a′+h1′(z1+z2)), where h1′=H2(MW∥IDP,K′,KO′,PO′,Ppub). Then, it sends the delegation D(O→P)=(IDO,IDP,MW′,K′,KO′,PO′,t′) to the proxy signcrypter (PS).Step 3.
After PS receivesD(O→P), it computes h1′=H2(MW∥IDP,K′,KO′,PO′,Ppub) and hO′=H1(IDO,KO′) to verify the delegation. Then, it checks whether t′P=h1′(KO′+hO′Ppub+PO′)+K′. Note that(13)t′P=a′+h1′z1+z2Pt′P=a′P+h1′z1P+h1′z2PAccording (10), (11), and (12), we compute(14)t′P=K′+h1′KO′+h1′PO′+hO′Ppubt′P=K′+h1′KO′+PO′+hO′PpubBy using the above K′,KO′,PO′,t′ from A1 to the proxy signcrypter, the verification is successful. In other words, the delegation D(O→P) in the scheme of Bhatia and Verma can be forged.Given the linear relationship betweendO and sO in the equation, the adversary can use a fake public key to bypass the process of verify-delegation. Specifically, the adversary forges the fake secret key and computes the fake public key, because there is no equation to verify or bind the public key (KO,PO) in the verification process. Therefore, in our improved CLPSC scheme, we construct a hash function hs that contains PO as the coefficient of sO. If the adversary executes the public key replacement attack, then the adversary will need to randomly choose sO′∈Zq∗ and the coefficient hs′ will be changed too. This prevents the forgery of PO′.


## 3.1. Review of Bhatia and Verma’s CLPSC Scheme

In this section, we review the scheme of Bhatia and Verma, which consists of the following 10 polynomial time algorithms.Setup. After the key generation center (KGC, who has the responsibility for system keys and the partial private keys of users) has chosen a security parameter k, the algorithm performs the following steps:(1)
Chooses an elliptic curveE/Ep over prime finite field Fp(2)
Chooses a cyclic subgroup G of the elliptic curve group, sets P as a generator of order q(3)
Chooses a master secret keys∈Zq∗ and generates Ppub=sP as a master public key(4)
Lets the message space be{0,1}l and selects four different hash functions H1,H2,H3,H4:(1)H1:0,1∗×G→Zq∗H2:0,1∗×G×G×G×G→Zq∗H3:G→0,1lH4:0,1∗→Zq∗(5)
At last, outputs the system parametersψ={E,Fp,G,P,H1,H2,H3,H4,Ppub}.Extract-Partial-Private-Key. Taking the system parameters ψ, system private key s, and IDO as inputs, KGC can calculate the partial private key dO=kO+hOs of user O, where kO∈Zq∗ is randomly chosen. Then, KO=kOP,hO=H1(IDO,KO),(dO,KO) are sent to the user in a secure communication channel.Set-Secret. Upon receiving (dO,KO), the user O verifies whether the parameters come from a legitimate KGC by computing dOP=KO+hOPpub. After successful verification, O picks a random sO as its secret value and computes PO=sOP.Set-Private-Key. Given system parameters, partial private key dO, and secret value sO as inputs, this algorithm outputs a private key pair SKO=(sO,dO).Set-Public-Key. Given system parameters ψ,PO,KO as inputs, this algorithm outputs a public key pair PKO=(PO,KO).Gen-Delegation. Having the inputs, the original signcrypters private key pair SKO=(sO,dO), public key pair PKO=(PO,KO), and message warrant MW, this algorithm generates the delegation DO→P on MW. Then, the user O randomly chooses a∈Zq∗, computes K=aP, and further computes t as follows:(2)t=a+h1dO+sO,where h1=H2(MW∥IDP,K,KO,PO,Ppub). The delegation DO→P=(IDO,IDP,MW,K,KO,PO,t) is sent to the proxy signcrypter (PS) later.Verify-Delegation. The PS verifies whether the delegation is legitimate by computing(3)h1=H2MW∥IDP,K,KO,PO,PpubhO=H1IDO,KOand checks whether(4)tp=h1KO+hOPpub+POIf not, the proxy signcrypter rejects the delegation request.Gen-Proxy-Key. Upon successful verification, PS computes a proxy signing key(5)DP=t+h2dP+sP,where h2=H2(MW∥IDO,K,KP,PP,Ppub).Proxy-Signcryption. Given proxy key DP, message M, and public key of the receiver (PR,KR) as inputs, it generates a signcrypted ciphertext on O’s behalf. Specifically, PS randomly chooses u∈Zq∗ and further calculates U=uP,V=uPR,h=H3(V),h3=H4(M∥IDO∥IDR∥IDP). The detail processes of generating proxy signcryption on message M are described as follows:(6)z=M⊕h(7)S=u+h3DPAfter that, the signcrypted ciphertext (IDO,KO,PO, MW,IDP,KP,PP,U,K,z,S) is sent to R by PS.Proxy-Unsigncryption. After receiving a complete signcrypted ciphertext (IDO,KO,PO,MW,IDP,KP,PP, U,K,z,S), the receiver R unsigncrypts V=sRU,M=z⊕H3(V) and(8)SP=h3K+h1KO+PO+hOPpub+h2KP+PP+hCPpub+UIf the above equation holds, then R accepts the message.


## 3.2. Analysis of Bhatia and Verma’s CLPSC Scheme

We will now present a successful public key replacement attack by a Type 1 adversaryA1 against the scheme.Step 1.
A 1 chooses three random numbers a∗∈Zq∗,z1∈Zq∗,z2∈Zq∗ and computes(9)K′=a′P(10)KO′=z1P(11)PO′=z2P-hO′Ppub(12)hO′=H1IDO,KO′Then, it generates a forged public key pair KO′,PO′ and substitutes the original public key of OS.Step 2.
Given a message warrantMW′, which can be intercepted from the communication channel between OS and PS, OS computes t′=(a′+h1′(z1+z2)), where h1′=H2(MW∥IDP,K′,KO′,PO′,Ppub). Then, it sends the delegation D(O→P)=(IDO,IDP,MW′,K′,KO′,PO′,t′) to the proxy signcrypter (PS).Step 3.
After PS receivesD(O→P), it computes h1′=H2(MW∥IDP,K′,KO′,PO′,Ppub) and hO′=H1(IDO,KO′) to verify the delegation. Then, it checks whether t′P=h1′(KO′+hO′Ppub+PO′)+K′. Note that(13)t′P=a′+h1′z1+z2Pt′P=a′P+h1′z1P+h1′z2PAccording (10), (11), and (12), we compute(14)t′P=K′+h1′KO′+h1′PO′+hO′Ppubt′P=K′+h1′KO′+PO′+hO′PpubBy using the above K′,KO′,PO′,t′ from A1 to the proxy signcrypter, the verification is successful. In other words, the delegation D(O→P) in the scheme of Bhatia and Verma can be forged.Given the linear relationship betweendO and sO in the equation, the adversary can use a fake public key to bypass the process of verify-delegation. Specifically, the adversary forges the fake secret key and computes the fake public key, because there is no equation to verify or bind the public key (KO,PO) in the verification process. Therefore, in our improved CLPSC scheme, we construct a hash function hs that contains PO as the coefficient of sO. If the adversary executes the public key replacement attack, then the adversary will need to randomly choose sO′∈Zq∗ and the coefficient hs′ will be changed too. This prevents the forgery of PO′.


## 4. Proposed CLPSC Scheme

Here, we present our proposed scheme that consists of the following three basic components: prescriber (e.g., a medical practitioner), transaction hub, and pharmacy that has implemented the electronic prescription system. Patient’s medical information (e.g., patient’s medical record, medication history) is stored in the database. The prescriber can find this information by searching on the database using the patient’s unique information, such as names, dates of birth, and current addresses. Once the record is found, the doctor can update or upload a new prescription recording new medical information to the server after reviewing it (see Figure1). The transaction hub works like a database for recording the patient file or all prescriptions. After downloading the patients prescription and successfully executing the proxy-unsigncryption, the pharmacy will dispense the medication listed in the electronic prescription to the proxy signcrypter.Figure 1
Improved CLPSC scheme for electronic prescription system.Now, we describe how to send the proxy delegation from the original signcrypter OS to the proxy signcrypter PS securely.(i)
Setup: KGC picks a security parameter s∈Zq∗ as an input of this algorithm. After running this algorithm, system parameters ψ=E,Fp,G,P,H1,H2,H3,H4,Ppub will be published, where E/Ep is an elliptic curve chosen by KGC over prime finite field Fp, G is a cyclic subgroup of the elliptic curve group, P is a generator of G, q is the order of G, and Ppub=sP can be easily computed. In addition, there are four cryptographic collision resistant hash functions as follows:(15)H1:0,1∗×G→Zq∗H2:0,1∗×G×G×G×G→Zq∗H3:G→0,1lH4:0,1∗→Zq∗The message space is{0,1}l.(ii)
Extract-Partial-Private-Key: This algorithm takes system parameters ψ, system private key s, and user O’s identity IDO as inputs and computes dO=kO+hOs to obtain the extract-partial-private-key of entity O, where kO∈Zq∗ is randomly chosen. KO=kOP,hO=H1(IDO,KO) is computed, and the results (dO,KO) are sent to entity O via a secure communicate channel (this algorithm is run by the KGC.)(iii)
Set-Secret: This algorithm takes system parameters ψ, user O’s identity IDO as inputs and runs to verify whether dOP=KO+hOPpub. If the verification passes, then entity O picks a random sO∈Zq∗ as its secret value and computes its partial public key PO=sOP; otherwise, the process fails (his algorithm is run by users).(iv)
Set-Private-Key: This algorithm takes system parameters ψ, partial private key dO, and secret value sO as inputs and generates a private key pair SKO=(sO,dO) as the output (this algorithm is run by users.)(v)
Set-Public-Key: Given system parameters ψ,PO, and KO as inputs, this algorithm generates a public key pair PKO=(PO,KO) as the output. When this algorithm completes executing, user publishes the public key PKO (this algorithm is run by users.)(vi)
Gen-Delegation: Given the original signcrypters private key pair SKO=(sO,dO), public key pair PKO=(PO,KO), and message warrant MW as input, this algorithm generates the delegation DO→P on MW as the output. Then, the entity O randomly chooses a∈Zq∗, computes K=aP and computes t as follows: t=(a+h1(dO+sOhs)), where h1=H2(MW∥IDP,K,KO,PO,Ppub),hs=H1(IDO,PO). The delegation DO→P=IDO,IDP,MW,KO,PO,t is finally sent to PS.(vii)
Verify-Delegation: PS verifies whether the delegation is valid by computing (16)h1=H2MW∥IDP,K,KO,PO,PpubhO=H1IDO,KOhs=H1IDO,POand
checks whether(17)tp=h1KO+hOPpub+hsPO+KIf the following does not hold, then it implies that the delegation is invalid.(viii)
Gen-Proxy-Key: Upon successful verification, PS generates a proxy signing key DP=(t+h2(dP+sP)), where h2=H2(MW∥IDO,K,PP,KP,Ppub)(ix)
Proxy-Signcryption: Given the proxy key DP, an original message M, and the receiver’s public key PR,KR as inputs, a signcrypted message is generated for R. The following describe the details: PS randomly chooses u∈Zq∗, computes U=uP,V=uPR,h=H3(V),h3=H4(M∥IDO∥IDP∥IDR), and the proxy signcryption of message M is generated as follows: z=M⊕h,S=(u+h3DP). After that the signcrypted ciphertext (IDO,KO,PO,MW,IDP,KP,PP,U,K,z,S) is sent to the receiver R by PS.(x)
Proxy-Unsigncryption: Upon receiving the signcrypted ciphertext (IDO, KO,PO,MW,IDP,KP,PP,U,K,z,S), R calculates V=sRU,M=z⊕H3(V), and only if the following holds, will R accept the message:(18)SP=h3K+h1KO+PO+hOPpub+h2KP+PP+hPPpub+U


### 4.1. Correctness Analysis

The CLPSC scheme contains two parts of authentication, namely, verification of delegation (i.e., proxy signcrypter PS checks whethertp=h1(KO+hOPpub+hsPO)+K) and proxy-unsigncryption (i.e., message receiver checks whether SP=h3[K+h1(KO+hsPO+hOPpub)+h2(KP+PP+hPPpub)]+U).(i)
Decryption process(19)V′=sRU′=sRuP=uPR=V(ii)
Verification processOne part is(20)t=a+h1dO+sOhstP=a+h1dO+sOhsP=aP+h1dOP+sOhsP=K+h1kO+hOsP+hsPO=K+h1kOP+hOsP+hsPO=K+h1KO+hOPpub+hsPOAnother part is(21)SP=u+h3DPPSP=uP+h3t+h2dP+sPPSP=h3tP+h2dPP+sPP+USP=h3tP+h2dPP+sPP+USP=h3K+h1KO+hsPO+hOPpub+h2KP+PP+hPPpub+U


## 4.1. Correctness Analysis

The CLPSC scheme contains two parts of authentication, namely, verification of delegation (i.e., proxy signcrypter PS checks whethertp=h1(KO+hOPpub+hsPO)+K) and proxy-unsigncryption (i.e., message receiver checks whether SP=h3[K+h1(KO+hsPO+hOPpub)+h2(KP+PP+hPPpub)]+U).(i)
Decryption process(19)V′=sRU′=sRuP=uPR=V(ii)
Verification processOne part is(20)t=a+h1dO+sOhstP=a+h1dO+sOhsP=aP+h1dOP+sOhsP=K+h1kO+hOsP+hsPO=K+h1kOP+hOsP+hsPO=K+h1KO+hOPpub+hsPOAnother part is(21)SP=u+h3DPPSP=uP+h3t+h2dP+sPPSP=h3tP+h2dPP+sPP+USP=h3tP+h2dPP+sPP+USP=h3K+h1KO+hsPO+hOPpub+h2KP+PP+hPPpub+U


## 5. Security Analysis

As defined in Section2.2, there are two types of adversaries: A1 and A2. We consider four games where A1 and A2 can get honest answer when they interact with the challenger.


### 5.1. Confidentiality

We define the fact that the certificateless signcryption scheme is IND-CLSC-CCA2-secure to adaptive chosen ciphertext attacks, only if no attacker with a nonnegligible advantage can win the games in polynomial time.Game 1.
In this game, we assume thatA1 is a dishonest user.Lemma 1.
Assume thatA1 can break the proposed CLPSC scheme with υ′. Let qHi, qCu, qPpk, qSk, qRpk, qGd, qPrk, qSc, and qUsc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Replace-Public-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, Proxy-Signcrypt-queries, and Proxy-Usigncrypt-queries, respectively. There is an algorithm that can solve the ECCDH problem with advantage υ′ in probabilistic polynomial time:(22)υ′≥1qH32υ-qUsc12lt′≤t+O1qH1,qH2,qH3,qH4,qCu,qPpk,qSk,qRPk,qGd,qPrk,qSc,qUsc+tM2qCu+qPpk+2qSc+7qUscwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
Suppose that an algorithm accepts an ECCDH instance(P,xP,yP)∈Gq with unknown x and y; the problem is to compute xyP. In order to solve this problem, the algorithm uses A1 as a subroutine and acts as a challenger C to interact with it in IND-CCA2-I. When the game starts, the challenger C creates and maintains LH1,LH2,LH3,LH4,L1,LPK,LSc lists, which stores the responses to the queries by the adversary A1. The lists are initially set to be empty. When A1 makes a query, C will respond as follows:(i)
H1-Query: C maintains a hash list LH1=<(ID,KID),,z1> as explained below. When A1 asks for the H1-Query-Oracle and if the query ID is found in LH1, then the algorithm returns the record to A1. Otherwise, C chooses a random number z1∈Zq∗ and adds it to LH1.(ii)
H2-Query: C maintains a hash list LH2=<(MW∥IDP,K,KO,PO,Ppub),z2> as explained below. When A1 asks for the H2-Query-Oracle and if the tuple is found in LH2, then the algorithm returns z2 to A1. Otherwise, C chooses a random number z2∈Zq∗ and adds <(MW∥IDP,K,KO,PO,Ppub),z2> to LH2.(iii)
H3-Query: C maintains a hash list LH3=<V,z3> as explained below. When A1 asks for the H3-Query-Oracle and if the tuple <V,z3> is found in LH3, then the algorithm returns z3 to A1. Otherwise, C chooses a random number z3∈{0,1}l and adds it to LH3.(iv)
H4-Query: C maintains a hash list LH3=<(M∥IDO∥IDP∥IDR),z4> as explained below. When A1 asks for the H4-Query-Oracle and if the tuple is found in LH4, then the algorithm returns z4 to A1. Otherwise, C chooses a random number z4∈Zq∗ and adds it to LH4.(v)
Create-User query: C maintains a list Lc=<ID,KID,PID,sID,dID>. If the query ID is found on the Lc, then it returns <ID,KID,PID,sID,dID>. Otherwise, the oracle is simulated as follows:
(1)
C choosing three numbers sO,kO,z1∈Zq∗ randomly(2)
computingPO=sOP,KO=kOP,dO=kO+z1s(3)
adding the tuple〈IDO,KO,sO,dO〉 to list LC and 〈(IDO,KO),z1〉 to LH1, respectively.(vi)
Extract-Partial-Private-Key-Query: When A1 queries dID and if ID=ID∗, then the simulation is stopped. Otherwise, C probes the list Lc for the query ID. If it exists on Lc, then it returns the corresponding dID. Otherwise, C performs the Create-User query, gets <ID,KID,PID,sID,dID>, and sends its partial private key dID to A1.(vii)
Reveal-Secret-Key-Query: If ID=ID∗, then the simulation is stopped. Otherwise, C probes the list Lcfor the query ID. If it exists on Lc, then it returns the corresponding sID. Otherwise, C performs the Create-User query and sends its partial private key sID to A1.(viii)
Replace-Public-Key-Query: A1 can replace the public key PKID=(PID,KID) with a random value PKID′.(ix)
Generate-Delegation-Query: When A1 asks the Generate-Delegation query on (IDO,IDP,MW), C starts to run the Gen-Delegation algorithm and sends the results DO→P=IDO,IDP,MW,KO,PO,a,t to A1.(x)
Reveal-Proxy-Key-Query: C maintains a list of issued proxy keys LPk=IDO,IDP,MW,a,K,t,DP. If the query (IDO,IDP,MW) exists on the LPk, then it returns a proxy key DP. Otherwise, C works as follows:
(1)
performing Generate-Delegation-Query to obtainDO→P=IDO,IDP,MW,KO,PO,a,t.(2)
querying the listL1 with IDP for the corresponding secret key (sP,dP).(3)
computingDP=(t+z2(dP+sP)) and adds the tuple 〈IDO,IDP,MW,K,a,t,DP〉 to list L(Pk). Finally, it sends DP to A1.(xi)
Proxy-Signcrypt-Query: When A1 makes a query for signcrypting a message M with the message warrant MW and three input identities (IDO,IDR,IDP) and if the query entry (IDO, IDP, MW) exists on list LPk, then the corresponding proxy key DP and K on the tuple can be used by C to create a signcrypted message δ. Otherwise, C performs the aforementioned Reveal-Proxy-Key query to obtain the proxy key DP. To generate a signcrypted message on behalf of an original signer, C checks whether IDO and IDR are correct. If not, the proxy-signcryption algorithm is run until the secret key (sO,dO) of user O is obtained. Then, the tuple 〈IDO,PKO,MW,IDR,PKR,M,δ〉 is added to LSc as the result. Otherwise, C performs the following:
(1)
choosing random numbersx,z4∈Zq∗ and computing U=xP,V=xyP.(2)
probingLH3 for (V) and returning z3 as a result.(3)
computingz=M⊕z3S=(x+z4DP) and adding a tuple 〈IDO∥IDR∥IDP,MW〉 to list LH4, where LH4∥IDO∥IDR∥IDP=z4(xii)
Proxy-Unsigncrypt-Query: Taking the signcrypted message δ=(IDO,PO,KO,MW,IDP,PP,KP,U,K,z, S) as inputs, C checks if IDR is a challenging identity. If it is true, C probes LSP for an tuple 〈IDO,PKO,IDR,PKR,∗,δ〉 and obtains the corresponding plaintext message M. Otherwise, C performs as follows:
(1)
taking the secret key of the receiver as an input and calculatingV=sRU.(2)
probingLH3 for (V) and returning z3 to calculate M=z⊕z3.(3)
probing the listLH1 for (IDO, KO) and (IDP, KP), LH2for (IDP∥MW,K,KO,PO,Ppub) and (IDP∥MW,K,KP,PP,Ppub) and LH4 for IDO∥IDR∥IDP,MW, to get z1,z1′,z2,z2′, and z4 respectively. If SP=z4[K+z2(KO+hsPO+hOPpub)+z2′(KP+PP+z1′Ppub)]+U is valid, C returns M. Otherwise, it throws an error message.Challenge. A1 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. A random number b∈{0,1} is chosen by C. What is more, C signcrypts Mb to produce a corresponding signcrypted ciphertext δ∗ to A1. C further probes Lpk for Lpk to obtain z3∗, calculates z∗=Mb⊕z3∗,S∗=x+z3∗DP∗, and adds (Mb∥IDO∗∥IDP∗∥IDR∗,z4∗) to the list. Finally, a signcrypted message δ∗=(IDO∗,KO∗,PO∗,MW∗,IDP∗,KP∗,PP∗,U∗,K∗,z∗,S∗) for Mb is returned by C to A1. C can continue to ask queries with the exception of the Proxy-Unsigncrypt query on δ∗, Reveal-Partial-Private-Key-query, and Reveal-Secret-Key-query in the game.Output. At last, A1 outputs b′ as the guess of value b. If b′=b, then C outputs V=sRU=sRuP as the solution of the ECCDH question; otherwise, the challenge fails.Game 2.
LetA2 be a malicious-but-passive KGC.Lemma 2.
Assume thatA2 has the ability of breaking the proposed CLPSC scheme with an advantage of υ′. Let qHi, qCu, qPpk, qSk, qGd, qPrk, qSc, and qUsc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, Proxy-Signcrypt-queries, and Proxy-Usigncrypt-queries, respectively. In probabilistic polynomial time, there is an algorithm which can solve ECCDH problem with advantage υ′:(23)υ′≥1qH32υ-qUsc12lt′≤t+O1qH1+qH2+qH3+qH4+qCu+qPpk+qSk+qRPk+qGd+qPrk+qSc+qUsc+tM2qCu+2qSc+7qUscwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
The proof for this game is similar to that of Game1, and hence we will not repeat the proof.


### 5.2. Unforgeability

We defined that the certificateless signcryption scheme is EUF-CMA-secure to adaptive chosen ciphertext attacks, only if no attacker with a nonnegligible advantage can win the following games in polynomial time.Game 3.
Assume thatA1 is a dishonest user.Lemma 3.
Assume thatA1 can break the proposed CLPSC scheme with υ′. Let qHi, qCu, qPpk, qSk,qRpk, qGd, qPrk, and qSc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, and Proxy-Signcrypt-queries, respectively. There is an algorithm in probabilistic polynomial time that can solve ECCDH problem with advantage υ′:(24)υ′≥1qH3qH4υ-1+qH412lt′≤t+O1qH1+qH2+qH3+qH4+qCu+qPpk+qSk+qRPk+qGd+qPrk+qSc+qUsc+tM2qCu+qPpk+2qScwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
Suppose that an algorithm accepts an ECCDH instance(P,xP,yP)∈Gq with unknown x and y; the problem is to compute xyP. In order to solve this problem, the algorithm uses A1 as a subroutine and acts as a challenger C to interact with it. C gives honest answer to the queries of A1. When the game starts, the relevant system parameters are created and sent to A1 by C. We set Ppub=xP. Then, A1 can make queries for information. The challenger C creates and maintains LH1,LH2,LH3,LH4,L1,LPK,LSc lists, which store the returns of the responses to the adversary’s queries. The lists are initially set to be empty.Forgery. At last, a signcrypted ciphertext δ∗=(IDA∗,KA∗,PA∗,MW∗,IDP∗,KP∗,PP∗,U∗,K∗,z∗,S∗) on message M and warrant MW∗ is produced as the output, where IDA∗ is the original signer and IDR∗ is the receiver. Unlike normal cases, it does not go through the ProxySigncrypt oracle. IDP∗ is a forge ID as a proxy signer for IDA∗. A1 takes this signcrypted ciphertext δ∗ as an input of the Proxy-Unsigncrypt oracle and makes queries to C except for Reveal-Partial-Private-Key-Oracle and Replace-Public-Key-Oracle or Reveal-Secret-Key-Oracle in probabilistic polynomial time. If Proxy-Unsigncrypt-Oracle is not an error, then A1 succeeds in this game. Otherwise, A1 fails. The solution of the problem is x=(((Dc-t)/h2)-kc-sc)/hc.Game 4.
LetA2 be a malicious-but-passive KGC.Lemma 4.
Assume thatA2 can break the proposed CLPSC scheme with υ′. Let qHi, qCu, qSk, qGd, qPrk, and qSc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, and Proxy-Signcrypt-queries, respectively. In probabilistic polynomial time, there is an algorithm that can solve ECCDH problem with advantage υ′:(25)υ′≥1qH3qH4υ-1+qUsc12lt′≤t+O1qH1+qH2+qH3+qH4+qCu+qSk+qGd+qPrk+qSc+qUsc+tM2qCu+2qScwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
The proof for this game is similar to that of Game3, and hence we will not repeat the proof.


## 5.1. Confidentiality

We define the fact that the certificateless signcryption scheme is IND-CLSC-CCA2-secure to adaptive chosen ciphertext attacks, only if no attacker with a nonnegligible advantage can win the games in polynomial time.Game 1.
In this game, we assume thatA1 is a dishonest user.Lemma 1.
Assume thatA1 can break the proposed CLPSC scheme with υ′. Let qHi, qCu, qPpk, qSk, qRpk, qGd, qPrk, qSc, and qUsc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Replace-Public-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, Proxy-Signcrypt-queries, and Proxy-Usigncrypt-queries, respectively. There is an algorithm that can solve the ECCDH problem with advantage υ′ in probabilistic polynomial time:(22)υ′≥1qH32υ-qUsc12lt′≤t+O1qH1,qH2,qH3,qH4,qCu,qPpk,qSk,qRPk,qGd,qPrk,qSc,qUsc+tM2qCu+qPpk+2qSc+7qUscwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
Suppose that an algorithm accepts an ECCDH instance(P,xP,yP)∈Gq with unknown x and y; the problem is to compute xyP. In order to solve this problem, the algorithm uses A1 as a subroutine and acts as a challenger C to interact with it in IND-CCA2-I. When the game starts, the challenger C creates and maintains LH1,LH2,LH3,LH4,L1,LPK,LSc lists, which stores the responses to the queries by the adversary A1. The lists are initially set to be empty. When A1 makes a query, C will respond as follows:(i)
H1-Query: C maintains a hash list LH1=<(ID,KID),,z1> as explained below. When A1 asks for the H1-Query-Oracle and if the query ID is found in LH1, then the algorithm returns the record to A1. Otherwise, C chooses a random number z1∈Zq∗ and adds it to LH1.(ii)
H2-Query: C maintains a hash list LH2=<(MW∥IDP,K,KO,PO,Ppub),z2> as explained below. When A1 asks for the H2-Query-Oracle and if the tuple is found in LH2, then the algorithm returns z2 to A1. Otherwise, C chooses a random number z2∈Zq∗ and adds <(MW∥IDP,K,KO,PO,Ppub),z2> to LH2.(iii)
H3-Query: C maintains a hash list LH3=<V,z3> as explained below. When A1 asks for the H3-Query-Oracle and if the tuple <V,z3> is found in LH3, then the algorithm returns z3 to A1. Otherwise, C chooses a random number z3∈{0,1}l and adds it to LH3.(iv)
H4-Query: C maintains a hash list LH3=<(M∥IDO∥IDP∥IDR),z4> as explained below. When A1 asks for the H4-Query-Oracle and if the tuple is found in LH4, then the algorithm returns z4 to A1. Otherwise, C chooses a random number z4∈Zq∗ and adds it to LH4.(v)
Create-User query: C maintains a list Lc=<ID,KID,PID,sID,dID>. If the query ID is found on the Lc, then it returns <ID,KID,PID,sID,dID>. Otherwise, the oracle is simulated as follows:
(1)
C choosing three numbers sO,kO,z1∈Zq∗ randomly(2)
computingPO=sOP,KO=kOP,dO=kO+z1s(3)
adding the tuple〈IDO,KO,sO,dO〉 to list LC and 〈(IDO,KO),z1〉 to LH1, respectively.(vi)
Extract-Partial-Private-Key-Query: When A1 queries dID and if ID=ID∗, then the simulation is stopped. Otherwise, C probes the list Lc for the query ID. If it exists on Lc, then it returns the corresponding dID. Otherwise, C performs the Create-User query, gets <ID,KID,PID,sID,dID>, and sends its partial private key dID to A1.(vii)
Reveal-Secret-Key-Query: If ID=ID∗, then the simulation is stopped. Otherwise, C probes the list Lcfor the query ID. If it exists on Lc, then it returns the corresponding sID. Otherwise, C performs the Create-User query and sends its partial private key sID to A1.(viii)
Replace-Public-Key-Query: A1 can replace the public key PKID=(PID,KID) with a random value PKID′.(ix)
Generate-Delegation-Query: When A1 asks the Generate-Delegation query on (IDO,IDP,MW), C starts to run the Gen-Delegation algorithm and sends the results DO→P=IDO,IDP,MW,KO,PO,a,t to A1.(x)
Reveal-Proxy-Key-Query: C maintains a list of issued proxy keys LPk=IDO,IDP,MW,a,K,t,DP. If the query (IDO,IDP,MW) exists on the LPk, then it returns a proxy key DP. Otherwise, C works as follows:
(1)
performing Generate-Delegation-Query to obtainDO→P=IDO,IDP,MW,KO,PO,a,t.(2)
querying the listL1 with IDP for the corresponding secret key (sP,dP).(3)
computingDP=(t+z2(dP+sP)) and adds the tuple 〈IDO,IDP,MW,K,a,t,DP〉 to list L(Pk). Finally, it sends DP to A1.(xi)
Proxy-Signcrypt-Query: When A1 makes a query for signcrypting a message M with the message warrant MW and three input identities (IDO,IDR,IDP) and if the query entry (IDO, IDP, MW) exists on list LPk, then the corresponding proxy key DP and K on the tuple can be used by C to create a signcrypted message δ. Otherwise, C performs the aforementioned Reveal-Proxy-Key query to obtain the proxy key DP. To generate a signcrypted message on behalf of an original signer, C checks whether IDO and IDR are correct. If not, the proxy-signcryption algorithm is run until the secret key (sO,dO) of user O is obtained. Then, the tuple 〈IDO,PKO,MW,IDR,PKR,M,δ〉 is added to LSc as the result. Otherwise, C performs the following:
(1)
choosing random numbersx,z4∈Zq∗ and computing U=xP,V=xyP.(2)
probingLH3 for (V) and returning z3 as a result.(3)
computingz=M⊕z3S=(x+z4DP) and adding a tuple 〈IDO∥IDR∥IDP,MW〉 to list LH4, where LH4∥IDO∥IDR∥IDP=z4(xii)
Proxy-Unsigncrypt-Query: Taking the signcrypted message δ=(IDO,PO,KO,MW,IDP,PP,KP,U,K,z, S) as inputs, C checks if IDR is a challenging identity. If it is true, C probes LSP for an tuple 〈IDO,PKO,IDR,PKR,∗,δ〉 and obtains the corresponding plaintext message M. Otherwise, C performs as follows:
(1)
taking the secret key of the receiver as an input and calculatingV=sRU.(2)
probingLH3 for (V) and returning z3 to calculate M=z⊕z3.(3)
probing the listLH1 for (IDO, KO) and (IDP, KP), LH2for (IDP∥MW,K,KO,PO,Ppub) and (IDP∥MW,K,KP,PP,Ppub) and LH4 for IDO∥IDR∥IDP,MW, to get z1,z1′,z2,z2′, and z4 respectively. If SP=z4[K+z2(KO+hsPO+hOPpub)+z2′(KP+PP+z1′Ppub)]+U is valid, C returns M. Otherwise, it throws an error message.Challenge. A1 submits three distinct identities: IDO of original signcrypter, IDP of proxy signcrypter, and IDR of receiver and two equal length messages M0 and M1. A random number b∈{0,1} is chosen by C. What is more, C signcrypts Mb to produce a corresponding signcrypted ciphertext δ∗ to A1. C further probes Lpk for Lpk to obtain z3∗, calculates z∗=Mb⊕z3∗,S∗=x+z3∗DP∗, and adds (Mb∥IDO∗∥IDP∗∥IDR∗,z4∗) to the list. Finally, a signcrypted message δ∗=(IDO∗,KO∗,PO∗,MW∗,IDP∗,KP∗,PP∗,U∗,K∗,z∗,S∗) for Mb is returned by C to A1. C can continue to ask queries with the exception of the Proxy-Unsigncrypt query on δ∗, Reveal-Partial-Private-Key-query, and Reveal-Secret-Key-query in the game.Output. At last, A1 outputs b′ as the guess of value b. If b′=b, then C outputs V=sRU=sRuP as the solution of the ECCDH question; otherwise, the challenge fails.Game 2.
LetA2 be a malicious-but-passive KGC.Lemma 2.
Assume thatA2 has the ability of breaking the proposed CLPSC scheme with an advantage of υ′. Let qHi, qCu, qPpk, qSk, qGd, qPrk, qSc, and qUsc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, Proxy-Signcrypt-queries, and Proxy-Usigncrypt-queries, respectively. In probabilistic polynomial time, there is an algorithm which can solve ECCDH problem with advantage υ′:(23)υ′≥1qH32υ-qUsc12lt′≤t+O1qH1+qH2+qH3+qH4+qCu+qPpk+qSk+qRPk+qGd+qPrk+qSc+qUsc+tM2qCu+2qSc+7qUscwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
The proof for this game is similar to that of Game1, and hence we will not repeat the proof.


## 5.2. Unforgeability

We defined that the certificateless signcryption scheme is EUF-CMA-secure to adaptive chosen ciphertext attacks, only if no attacker with a nonnegligible advantage can win the following games in polynomial time.Game 3.
Assume thatA1 is a dishonest user.Lemma 3.
Assume thatA1 can break the proposed CLPSC scheme with υ′. Let qHi, qCu, qPpk, qSk,qRpk, qGd, qPrk, and qSc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, and Proxy-Signcrypt-queries, respectively. There is an algorithm in probabilistic polynomial time that can solve ECCDH problem with advantage υ′:(24)υ′≥1qH3qH4υ-1+qH412lt′≤t+O1qH1+qH2+qH3+qH4+qCu+qPpk+qSk+qRPk+qGd+qPrk+qSc+qUsc+tM2qCu+qPpk+2qScwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
Suppose that an algorithm accepts an ECCDH instance(P,xP,yP)∈Gq with unknown x and y; the problem is to compute xyP. In order to solve this problem, the algorithm uses A1 as a subroutine and acts as a challenger C to interact with it. C gives honest answer to the queries of A1. When the game starts, the relevant system parameters are created and sent to A1 by C. We set Ppub=xP. Then, A1 can make queries for information. The challenger C creates and maintains LH1,LH2,LH3,LH4,L1,LPK,LSc lists, which store the returns of the responses to the adversary’s queries. The lists are initially set to be empty.Forgery. At last, a signcrypted ciphertext δ∗=(IDA∗,KA∗,PA∗,MW∗,IDP∗,KP∗,PP∗,U∗,K∗,z∗,S∗) on message M and warrant MW∗ is produced as the output, where IDA∗ is the original signer and IDR∗ is the receiver. Unlike normal cases, it does not go through the ProxySigncrypt oracle. IDP∗ is a forge ID as a proxy signer for IDA∗. A1 takes this signcrypted ciphertext δ∗ as an input of the Proxy-Unsigncrypt oracle and makes queries to C except for Reveal-Partial-Private-Key-Oracle and Replace-Public-Key-Oracle or Reveal-Secret-Key-Oracle in probabilistic polynomial time. If Proxy-Unsigncrypt-Oracle is not an error, then A1 succeeds in this game. Otherwise, A1 fails. The solution of the problem is x=(((Dc-t)/h2)-kc-sc)/hc.Game 4.
LetA2 be a malicious-but-passive KGC.Lemma 4.
Assume thatA2 can break the proposed CLPSC scheme with υ′. Let qHi, qCu, qSk, qGd, qPrk, and qSc denote the number of Hi-queries, Create-User-queries, Reveal-Partial-Private-Key-queries, Reveal-Secret-Key-queries, Generate-Delegation-queries, Reveal-Proxy-Key-queries, and Proxy-Signcrypt-queries, respectively. In probabilistic polynomial time, there is an algorithm that can solve ECCDH problem with advantage υ′:(25)υ′≥1qH3qH4υ-1+qUsc12lt′≤t+O1qH1+qH2+qH3+qH4+qCu+qSk+qGd+qPrk+qSc+qUsc+tM2qCu+2qScwhere tM is the time for an ECC-based scalar point multiplication operation.Proof.
The proof for this game is similar to that of Game3, and hence we will not repeat the proof.


## 6. Performance Evaluation

In this section, we compare the efficiency and security of our improved scheme with other proxy-signcryption schemes [15, 16] in the literature. We use the standard cryptographic library MIRACL [19] to measure the runtime, whose comparative summary is given in Table 1, where tpm denotes an ECC-based point multiplication operation time and th denotes general hash operation time.Table 1
Performance comparison.
Scheme [15] [16] Our scheme Proxy key generation 7th 4th 6th Proxy-Signcryption 5tpm+3th 2tpm+2th 2tpm+2th Proxy-Unsigncrytion 10 t p m + 8 t h 7 t p m + 6 t h 7 t p m + 6 t h Total running time(ms) 33.276 19.974 19.988Our evaluation environment is a personal computer (PC; Dell with an I5-4460S 2.90GHz processor, 4G bytes memory and the Window 8 operating system) with the MIRACL library [20]. The curve is E:y2+xy=(x3+ax2+b) over 163 bits random prime, where a=1,b=1. A Koblitz curve ect163k1 over F(2163) is selected from the list of elliptic curves indicated by NIST [21]. In this setup, we have tpm=2.21, th=0.007 approximately. Then, we compute the total runtime with their operation times. From Table 1, we observe that the runtime of [16] and our scheme are less than other schemes. Because our scheme is an improved scheme from [16], the runtime is very close to that of the original scheme. However, from Table 2, it is clear that our scheme is the most secure of these schemes. It is also trivial to note that the original scheme in [16] cannot resist forgery attack, unlike our scheme (at a slight cost of about 0.112 ms).Table 2
Security comparison.
Scheme [15] [16] Our scheme Security proof no yes yes Against forgery attack no no yes


## 7. Conclusion

While signcryption is a fairly established research area, designing secure signcryption schemes remains challenging. For example, in this paper we revisited a recently proposed certificateless proxy-signcryption (CLPSC) scheme of Bhatia and Verma and revealed that the scheme is susceptible to the public key replacement attack by a Type 1 adversary. Then, we presented an improved scheme to mitigate such an attack from both Type 1 and Type 2 adversaries. We also evaluated its security and performance to demonstrate its utility in an electronic prescription system.Future research includes implementing a prototype of the improved protocol for evaluation in a real-world environment.



---

*Source: 7524102-2018-08-29.xml*