# An Elliptic Curve Signcryption Scheme and Its Application

Authors: Ping Zhang; Yamin Li; Huanhuan Chi
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Two basic security requirements in communication are confidentiality and authentication. Signcryption is an ideal technique to transmit encrypted and authenticated data. In view of the shortcomings of existing signcryption schemes and the high security of elliptic curve cryptography (ECC), we design a ECC-based signcryption scheme and evaluate it in terms of security, computational overhead, and communication overhead. Finally, we consider the application of our secure and efficient signcryption scheme in the smart lock key management system and analyze the bit-oriented performance of the designed key management scheme.


---

## Body

## 1. Introduction

With the rapid development of Internet, there are an increasing number of smart devices, among which the smart lock is one of the typical representatives. Compared with other smart devices, the smart lock requires higher security. When designing the smart lock, the security is the first problem to be considered.Confidentiality and authentication are two basic security requirements in communication. In general, encryption can ensure the confidentiality of the message, and digital signature can ensure the authentication of the message. In order to meet these two requirements at the same time, the traditional method is either “Encrypt before signing” or “sign before encryption”. However, these will result in a large amount of computation and communication costs. In 1997, Zheng [1] firstly proposed the notion of signcryption. Signcryption not only meets these two security requirements at the same time, but also its computational and communication costs are much lower than the traditional methods described above. Signcryption is an ideal way to transmit information encrypted and authenticated. Therefore, it also can be used for mobile device authentication. The information on which authentication is based generally includes the following three categories: (1) information known to the user, such as passwords; (2) things owned by the user, such as smart cards; and (3) biometrics of the user, such as fingerprints. Single-factor authentication generally refers to password-based authentication. Two-factor authentication refers to the smart-card-based password authentication. Multifactor authentication refers to authentication that uses two or more pieces of information. Signcryption has broad application prospects in e-commerce, e-government, and key management.At present, the secure and practical public key cryptosystems include RSA cryptosystem (based on the big integer factorization problem), DSA cryptosystem (based on the discrete logarithm problem in the finite field), and ECC cryptosystem (based on the ECDLP). Among them, ECC cryptosystem has the highest security when the key length is the same.The ECC cryptosystem was independently proposed by Neal Koblitz [2] and V. S. Miller [3] in 1985. It uses the elliptic curve whose variables and coefficients are elements in the finite field. The security of ECC is based on the ECDLP. Different from the discrete logarithm problem in the finite multiplication group, the ECDLP on the finite field is more difficult to solve, which cannot be solved by all known algorithms in polynomial time. In the general discrete logarithm problem, the algebraic operation on the finite field includes two operations, field addition and field multiplication, which makes the general discrete logarithm problem can be solved in subexponential time. However, in the ECDLP, the algebraic operation only includes the point addition operation on the elliptic curve. Therefore, all the discrete logarithm algorithms cannot solve the ECDLP in subexponential time except some very special elliptic curves.In view of the shortcomings of the existing key management scheme of the smart lock, the advantages of signcryption scheme, and the high security of ECC, this paper designs a signcryption scheme based on elliptic curve and firstly applies the signcryption scheme to the key management scheme of the smart lock system.


### 1.1. Related Works

Since the signcryption scheme was put forward in 1997, there have been several specific schemes based on different difficult assumptions ([1, 4–6]). In addition to the basic security objectives, some new features are introduced in the study of signcryption schemes, such as identity-based signcryption scheme ([6–11]), hybrid signcryption scheme [12], key encapsulation mechanism (KEM) and data encapsulation mechanism (DEM-)-based signcryption scheme [13], certificateless signcryption scheme [14], verifiable signcryption scheme [10], attribute-based signcryption scheme ([15, 16]), functional signcryption scheme [17], or key invisible signcryption scheme [18].Malone-Lee [7] defined the security model of identity-based signcryption scheme in 2002 and constructed the first identity-based signcryption scheme using bilinear pairings. In 2003, Nalla et al. [19] proposed an identity-based signcryption scheme on bilinear pairings of elliptic curves. This scheme is an improvement of Lee’s [7] signcryption scheme. In 2004, with the difficulty of q-Diffie-Hellman problem (q-DH) in Gap-Diffie-Hellman group, Libert et al. [20] proposed a new public key authenticated signcryption scheme. This scheme is particularly efficient. The cost of signcryption operation is almost the same as that of ElGamal encryption, and the inverse operation only needs one pairing evaluation and three power calculations. Under the assumption of q-strong Diffie-Hellman, they proved the unforgeability of this scheme. In 2009, based on the encryption scheme of water [21], Yu et al. [22] proposed the first identity-based signcryption scheme without random oracle.In 2012, Kar [23] proposed a provably secure signcryption scheme in the random oracle model by modifying the scheme of Libert et al. [24]. This scheme is safer and more reliable than the scheme of Libert et al. In the random oracle model, they use two hypotheses, strong Diffie-Hellman (SDH) and Diffie-Hellman inversion (DHI), to prove the security of the scheme. In the same year, S. Sharmila et al. [11] firstly proposed an identity-based signcryption scheme with provable security under the standard model. The unforgeability of the scheme is based on the difficulty of computational Diffie-Hellman problem (CDH), and the indistinguishability is based on the difficulty of decisional bilinear Diffie-Hellman problem (DBDH). In 2013, Kar [25] proposed an aggregate signcryption scheme with provable security. The security of the scheme is based on the computational reliability of DBDH and discrete logarithm problem (DL). In 2014, Liu Zhenhua et al. [26] proposed a new revocable identity-based signcryption scheme to revoke malicious users in the signcryption system. In this scheme, the master key is randomly divided into two parts, one is used to construct the initial key, and the other is used to update the key. In the standard model, they proved the IND-CCA2 security based on DBDH difficult problem and the EUF-CMA security based on CDH difficult problem. In 2015, Braeken et al. [27] pointed out some problems of existing pairing-free signcryption scheme. Then, they modified the scheme and extended it to a multiuser signcryption scheme. In 2016, Kar and Naik [28] proposed an effective certificateless signcryption scheme based on bilinear mapping in the random oracle model. They proved the security of the scheme based on the assumptions of the k-CAA, Inv-CDH, q-BDHI, and CDH. In the same year, Han Yiliang et al. [29] combined Niedereiter public key cryptography with CFS signature scheme and constructed a signcryption scheme. This scheme can resist quantum attack and has a small amount of key data. They proved the IND-CCA2 security and EUF-CMA security of the scheme in the random oracle model. In 2017, Zhou Yanwei et al. [30] proposed an efficient certificateless signcryption scheme without bilinear mapping and proved the security of the scheme based on CDH and DL in the random oracle model. Tsai et al. [31] proposed a new multidocument blind signature scheme based on ECC. This scheme adds the design of the signature encryption paradigm to the blind signature scheme to enhance high-level security. In 2018, for the security of hybrid signcryption schemes, Dai et al. [32] studied the replayable CCA security (RCCA) of SKEM+DEM [33] and Tag SKEM+DEM [13]. If the scheme SKEM is RCCA secure and the scheme DEM is RCCA secure, the hybrid signature scheme SKEM+DEM is RCCA secure. If the scheme Tag-SKEM is RCCA secure and the scheme DEM is RCCA secure, the Tag SKEM + DEM hybrid encryption scheme is RCCA secure. In the single-factor authentication research area, He Debiao et al. [34] proposed a password-based remote user authentication scheme without smart cards. The scheme can resist various attacks, such as device stolen attack and privileged insider attack. In the two-factor authentication research area, Wang Ding et al. [35] proposed a smart-card-based password authentication scheme that kills two birds with one stone. By integrating “honeywords” with their proposed “fuzzy-verifiers,” the scheme not only not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound. Our signcryption scheme has highly efficient and satisfies multiple security properties; we believe it can be used as a building block for the authentication phase of a single-factor authentication scheme. When the server and user authenticate each other and generate a session key, they can use our scheme to signcrypt their own messages, respectively, which not only achieves authentication but also provides additional confidentiality.At present, there have been many works on the key management system of smart locks. For data security in narrow band Internet of things (NB-IOT) application environment, Jia Rongyuan et al. [36] proposed a lightweight encryption algorithm and encryption model based on AES [37] and chaos sequence. However, they did not explain how to transmit the key. There are problems such as difficult monitoring, high power consumption requirements, and insecure wireless transmission of wireless smart lock. In order to solve the problems, Zhang Huanlan et al. [38] proposed a 433 MHz wireless module based on Diffie-Hellman key exchange algorithm and corrected block tiny encryption algorithm for double encryption smart lock system. In 2019, under the unreliable UDP data transmission of NB-IoT, Liu Mengjun [39] designed a key transmission interaction scheme to complete the reliable update of the user’s unlock key with as little calculation and communication as possible. However, this scheme will continue to use the old key for unlocking when the unlock key update fails, which is not applicable to public rental housing. Because if the user loses the qualification to rent a house, the unlock key must be updated as soon as possible. In addition, in this work, the session key used between the server and the smart lock has low security. Sha Tao et al. [40] designed an identity verification mechanism based on position proof. They also proposed a timestamp encryption mechanism to prevent remote unlocking and replay attacks by malicious users. However, this work did not explain how the server issued the unlock key to the smart lock, and the smart lock did not upload operating information to the server. Wang et al. [41] designed a complementary multidimensional feature fusion network-based hand gesture recognition (CMFF-HGR) to extract features and achieve hand gesture recognition. The smart lock key management system based on hand gesture recognition is different from the key management scheme proposed in this paper. The smart lock system based on hand gesture recognition requires to memorize the gestures manually, and the hand gesture is easy to be known by others during the unlocking process. However, the key management scheme in this paper does not require manually memorizing the unlock key, and every time the unlock key is different, not being fixed. Therefore, the key management scheme in this paper has higher security.


### 1.2. Contribution

This paper proposed an efficient and secure ECC-based signcryption scheme and applied it to a smart lock key management system. To the best of our knowledge, this work is the first to consider the application of a signcryption scheme in a smart lock key management system. Compared with other smart lock key management schemes, our scheme is more efficient and secure due to the confidentiality and authentication by the signcryption itself, as well as the efficiency and other security properties of our signcryption scheme. In addition, in our key management scheme, the unlock key is delivered to the smartphone by the server, and then, the smartphone unlocks the smart lock through Bluetooth. Therefore, the unlock key is different every time, and the user does not need to memorize a fixed unlock key, which makes our key management scheme more secure and convenient.


### 1.3. Organization

This paper is organized as follows. The first section is the introduction of this paper. The second section introduces the basic knowledge, including elliptic curve discrete logarithm problem, the formal definition, and the security model of signcryption scheme. In the third section, we design a signcryption scheme based on elliptic curve and analyze the correctness, security, and performance of our signcryption scheme. In the fourth section, we apply our signcryption scheme to the key management system of smart lock. Finally, in the fifth section, we summarize the full text and give an outlook for future work.


## 1.1. Related Works

Since the signcryption scheme was put forward in 1997, there have been several specific schemes based on different difficult assumptions ([1, 4–6]). In addition to the basic security objectives, some new features are introduced in the study of signcryption schemes, such as identity-based signcryption scheme ([6–11]), hybrid signcryption scheme [12], key encapsulation mechanism (KEM) and data encapsulation mechanism (DEM-)-based signcryption scheme [13], certificateless signcryption scheme [14], verifiable signcryption scheme [10], attribute-based signcryption scheme ([15, 16]), functional signcryption scheme [17], or key invisible signcryption scheme [18].Malone-Lee [7] defined the security model of identity-based signcryption scheme in 2002 and constructed the first identity-based signcryption scheme using bilinear pairings. In 2003, Nalla et al. [19] proposed an identity-based signcryption scheme on bilinear pairings of elliptic curves. This scheme is an improvement of Lee’s [7] signcryption scheme. In 2004, with the difficulty of q-Diffie-Hellman problem (q-DH) in Gap-Diffie-Hellman group, Libert et al. [20] proposed a new public key authenticated signcryption scheme. This scheme is particularly efficient. The cost of signcryption operation is almost the same as that of ElGamal encryption, and the inverse operation only needs one pairing evaluation and three power calculations. Under the assumption of q-strong Diffie-Hellman, they proved the unforgeability of this scheme. In 2009, based on the encryption scheme of water [21], Yu et al. [22] proposed the first identity-based signcryption scheme without random oracle.In 2012, Kar [23] proposed a provably secure signcryption scheme in the random oracle model by modifying the scheme of Libert et al. [24]. This scheme is safer and more reliable than the scheme of Libert et al. In the random oracle model, they use two hypotheses, strong Diffie-Hellman (SDH) and Diffie-Hellman inversion (DHI), to prove the security of the scheme. In the same year, S. Sharmila et al. [11] firstly proposed an identity-based signcryption scheme with provable security under the standard model. The unforgeability of the scheme is based on the difficulty of computational Diffie-Hellman problem (CDH), and the indistinguishability is based on the difficulty of decisional bilinear Diffie-Hellman problem (DBDH). In 2013, Kar [25] proposed an aggregate signcryption scheme with provable security. The security of the scheme is based on the computational reliability of DBDH and discrete logarithm problem (DL). In 2014, Liu Zhenhua et al. [26] proposed a new revocable identity-based signcryption scheme to revoke malicious users in the signcryption system. In this scheme, the master key is randomly divided into two parts, one is used to construct the initial key, and the other is used to update the key. In the standard model, they proved the IND-CCA2 security based on DBDH difficult problem and the EUF-CMA security based on CDH difficult problem. In 2015, Braeken et al. [27] pointed out some problems of existing pairing-free signcryption scheme. Then, they modified the scheme and extended it to a multiuser signcryption scheme. In 2016, Kar and Naik [28] proposed an effective certificateless signcryption scheme based on bilinear mapping in the random oracle model. They proved the security of the scheme based on the assumptions of the k-CAA, Inv-CDH, q-BDHI, and CDH. In the same year, Han Yiliang et al. [29] combined Niedereiter public key cryptography with CFS signature scheme and constructed a signcryption scheme. This scheme can resist quantum attack and has a small amount of key data. They proved the IND-CCA2 security and EUF-CMA security of the scheme in the random oracle model. In 2017, Zhou Yanwei et al. [30] proposed an efficient certificateless signcryption scheme without bilinear mapping and proved the security of the scheme based on CDH and DL in the random oracle model. Tsai et al. [31] proposed a new multidocument blind signature scheme based on ECC. This scheme adds the design of the signature encryption paradigm to the blind signature scheme to enhance high-level security. In 2018, for the security of hybrid signcryption schemes, Dai et al. [32] studied the replayable CCA security (RCCA) of SKEM+DEM [33] and Tag SKEM+DEM [13]. If the scheme SKEM is RCCA secure and the scheme DEM is RCCA secure, the hybrid signature scheme SKEM+DEM is RCCA secure. If the scheme Tag-SKEM is RCCA secure and the scheme DEM is RCCA secure, the Tag SKEM + DEM hybrid encryption scheme is RCCA secure. In the single-factor authentication research area, He Debiao et al. [34] proposed a password-based remote user authentication scheme without smart cards. The scheme can resist various attacks, such as device stolen attack and privileged insider attack. In the two-factor authentication research area, Wang Ding et al. [35] proposed a smart-card-based password authentication scheme that kills two birds with one stone. By integrating “honeywords” with their proposed “fuzzy-verifiers,” the scheme not only not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound. Our signcryption scheme has highly efficient and satisfies multiple security properties; we believe it can be used as a building block for the authentication phase of a single-factor authentication scheme. When the server and user authenticate each other and generate a session key, they can use our scheme to signcrypt their own messages, respectively, which not only achieves authentication but also provides additional confidentiality.At present, there have been many works on the key management system of smart locks. For data security in narrow band Internet of things (NB-IOT) application environment, Jia Rongyuan et al. [36] proposed a lightweight encryption algorithm and encryption model based on AES [37] and chaos sequence. However, they did not explain how to transmit the key. There are problems such as difficult monitoring, high power consumption requirements, and insecure wireless transmission of wireless smart lock. In order to solve the problems, Zhang Huanlan et al. [38] proposed a 433 MHz wireless module based on Diffie-Hellman key exchange algorithm and corrected block tiny encryption algorithm for double encryption smart lock system. In 2019, under the unreliable UDP data transmission of NB-IoT, Liu Mengjun [39] designed a key transmission interaction scheme to complete the reliable update of the user’s unlock key with as little calculation and communication as possible. However, this scheme will continue to use the old key for unlocking when the unlock key update fails, which is not applicable to public rental housing. Because if the user loses the qualification to rent a house, the unlock key must be updated as soon as possible. In addition, in this work, the session key used between the server and the smart lock has low security. Sha Tao et al. [40] designed an identity verification mechanism based on position proof. They also proposed a timestamp encryption mechanism to prevent remote unlocking and replay attacks by malicious users. However, this work did not explain how the server issued the unlock key to the smart lock, and the smart lock did not upload operating information to the server. Wang et al. [41] designed a complementary multidimensional feature fusion network-based hand gesture recognition (CMFF-HGR) to extract features and achieve hand gesture recognition. The smart lock key management system based on hand gesture recognition is different from the key management scheme proposed in this paper. The smart lock system based on hand gesture recognition requires to memorize the gestures manually, and the hand gesture is easy to be known by others during the unlocking process. However, the key management scheme in this paper does not require manually memorizing the unlock key, and every time the unlock key is different, not being fixed. Therefore, the key management scheme in this paper has higher security.


## 1.2. Contribution

This paper proposed an efficient and secure ECC-based signcryption scheme and applied it to a smart lock key management system. To the best of our knowledge, this work is the first to consider the application of a signcryption scheme in a smart lock key management system. Compared with other smart lock key management schemes, our scheme is more efficient and secure due to the confidentiality and authentication by the signcryption itself, as well as the efficiency and other security properties of our signcryption scheme. In addition, in our key management scheme, the unlock key is delivered to the smartphone by the server, and then, the smartphone unlocks the smart lock through Bluetooth. Therefore, the unlock key is different every time, and the user does not need to memorize a fixed unlock key, which makes our key management scheme more secure and convenient.


## 1.3. Organization

This paper is organized as follows. The first section is the introduction of this paper. The second section introduces the basic knowledge, including elliptic curve discrete logarithm problem, the formal definition, and the security model of signcryption scheme. In the third section, we design a signcryption scheme based on elliptic curve and analyze the correctness, security, and performance of our signcryption scheme. In the fourth section, we apply our signcryption scheme to the key management system of smart lock. Finally, in the fifth section, we summarize the full text and give an outlook for future work.


## 2. Preliminaries

### 2.1. Basic Notation

In the following sections, ifneglλ<1/polyλ for all polynomials polyλ and all sufficiently large λ, we call neglλ is negligible. In this paper, “PPT” represents probabilistic polynomial time.


### 2.2. Elliptic Curve Discrete Logarithm Problem

Definition 1 (Elliptic curve discrete logarithm problem).
Given an elliptic curveEGFq, P is a point on this elliptic curve and its order is a large prime number n (ordP=n). For any random number d, Q=dP can be easily calculated. However, if P and Q are known, it is very difficult to find d.


### 2.3. The Definition of Signcryption Scheme

#### 2.3.1. Syntax

Given the key spaceK, message space M, and signcryption space S, for any sender and receiver, a signcryption scheme SC=setup,keygen,signcrypt,unsigncrypt is a collection of the following four algorithms.
(i)
Setup1λ⟶cp: This is system initialization algorithm. This algorithm requires a security parameter λ as the input of the algorithm and requires common parameters cp as the output of the algorithm(ii)
Keygencp,r⟶PK,SK: This is key generation algorithm, which is a random algorithm. This algorithm requires common parameters cp and random number r as the input of the algorithm and requires key pair PK,SK (PK,SK∈K) as the output of the algorithm(iii)
Signcryptcp,SKS,PKR,m⟶σ: This is signcryption algorithm. This algorithm requires common parameters cp, private key SKS (SKS∈K) of sender, public key PKR (PKR∈K) of receiver, and message m (m∈M) as the input of the algorithm and requires signcryption σσ∈S as the output of the algorithm(iv)
Unsigncryptcp,SKR,PKS,σ⟶m: This is unsigncryption algorithm. This algorithm requires common parameters cp, private key SKR (SKR∈K) of receiver, and public key PKS (PKS∈K) of sender and signcryption σσ∈S as the input of the algorithm. This algorithm outputs message mm∈M or symbol “⊥” (“⊥” indicates that the unsigncryption failed)Definition 2 (Correctness).
For any messagem∈M, any sender (his key pair SKS,PKS was generated by Keygencp,r), any receiver (his key pair SKR,PKR was generated by Keygencp,r), and the following formula holds
(1)Unsigncryptcp,SKR,PKS,Signcryptcp,SKS,PKR,m=m.


### 2.4. The Security Model of Signcryption Scheme

Definition 3 (Confidentiality).
The confidentiality security can be seen as a game between the adversaryO and the challenger C. This game is divided into five phases.
(i)
Keygen phase: ChallengerC runs algorithm Keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR, and sends PKS,PKR to adversary O(ii)
Query phase 1: The adversaryO sends multiple signcryption queries and unsigncryption queries to the challenger C(1)
Signcryption query: The adversaryO submits the message m and the public key PKS,PKR to the challenger C. The challenger C calculates σ=signcryptcp,SKS,PKR,m and sends the result σ to the adversary O(2)
Unsigncryption query: The adversaryO submits the legitimate signcryption result σ and the public key PKS,PKR to the challenger C. The challenger C calculates unsigncryptcp,SKR,PKS,σ and sends the message m or symbol “⊥” to the adversary O(iii)
Challenge phase: The adversaryO submits two messages m0, m1 (m0, m1 have the same length) to the challenger C. The challenger C randomly selects i∈0,1, calculates σ∗=signcryptcp,SKS,PKR,mi and sends the result σ∗ to the adversary O(iv)
Query phase 2: Similar to the query phase 1, the adversaryO continues to send multiple signcryption queries and unsigncryption queries to the challenger C (the adversary O is forbidden from sending unsigncryption query for the result σ∗)(v)
Guess phase: The adversaryO outputs a value i′ as the guess for i. If i′=i, the adversary O wins this game
In this game, the advantage of the adversaryO is AdvO=Pri′=i−1/2.Definition 4 (Unforgeability).
The unforgeability security can be seen as a game between the adversaryO and the challenger C. This game is divided into three phases.
(i)
Keygen phase: ChallengerC runs algorithm keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O(ii)
Query phase: The adversaryO sends multiple signcryption queries and unsigncryption queries to the challenger C(1)
Signcryption query: The adversaryO submits the message m and the public key PKS,PKR to the challenger C. The challenger C calculates σ=signcryptcp,SKS,PKR,m and sends the result σ to the adversary O(2)
Unsigncryption query: The adversaryO submits the legitimate signcryption result σ and the public key PKS,PKR to the challenger C. The challenger C calculates unsigncryptcp,SKR,PKS,σ and sends the message m or symbol “⊥” to the adversary O(iii)
Forgery phase: The adversaryO submits the challenging content, including challenging message m∗ and the forged signcryption σ∗. The challenger C submits the above input to the oracle, and the oracle returns the unsigncryption of signcryption σ∗ to the challenger C. If the result is message m∗, and the adversary O has not used this message as the input for signcryption query before, the adversary O wins this gameIn this game, the advantage of the adversary is his probability of winning the game.


## 2.1. Basic Notation

In the following sections, ifneglλ<1/polyλ for all polynomials polyλ and all sufficiently large λ, we call neglλ is negligible. In this paper, “PPT” represents probabilistic polynomial time.


## 2.2. Elliptic Curve Discrete Logarithm Problem

Definition 1 (Elliptic curve discrete logarithm problem).
Given an elliptic curveEGFq, P is a point on this elliptic curve and its order is a large prime number n (ordP=n). For any random number d, Q=dP can be easily calculated. However, if P and Q are known, it is very difficult to find d.


## 2.3. The Definition of Signcryption Scheme

### 2.3.1. Syntax

Given the key spaceK, message space M, and signcryption space S, for any sender and receiver, a signcryption scheme SC=setup,keygen,signcrypt,unsigncrypt is a collection of the following four algorithms.
(i)
Setup1λ⟶cp: This is system initialization algorithm. This algorithm requires a security parameter λ as the input of the algorithm and requires common parameters cp as the output of the algorithm(ii)
Keygencp,r⟶PK,SK: This is key generation algorithm, which is a random algorithm. This algorithm requires common parameters cp and random number r as the input of the algorithm and requires key pair PK,SK (PK,SK∈K) as the output of the algorithm(iii)
Signcryptcp,SKS,PKR,m⟶σ: This is signcryption algorithm. This algorithm requires common parameters cp, private key SKS (SKS∈K) of sender, public key PKR (PKR∈K) of receiver, and message m (m∈M) as the input of the algorithm and requires signcryption σσ∈S as the output of the algorithm(iv)
Unsigncryptcp,SKR,PKS,σ⟶m: This is unsigncryption algorithm. This algorithm requires common parameters cp, private key SKR (SKR∈K) of receiver, and public key PKS (PKS∈K) of sender and signcryption σσ∈S as the input of the algorithm. This algorithm outputs message mm∈M or symbol “⊥” (“⊥” indicates that the unsigncryption failed)Definition 2 (Correctness).
For any messagem∈M, any sender (his key pair SKS,PKS was generated by Keygencp,r), any receiver (his key pair SKR,PKR was generated by Keygencp,r), and the following formula holds
(1)Unsigncryptcp,SKR,PKS,Signcryptcp,SKS,PKR,m=m.


## 2.3.1. Syntax

Given the key spaceK, message space M, and signcryption space S, for any sender and receiver, a signcryption scheme SC=setup,keygen,signcrypt,unsigncrypt is a collection of the following four algorithms.
(i)
Setup1λ⟶cp: This is system initialization algorithm. This algorithm requires a security parameter λ as the input of the algorithm and requires common parameters cp as the output of the algorithm(ii)
Keygencp,r⟶PK,SK: This is key generation algorithm, which is a random algorithm. This algorithm requires common parameters cp and random number r as the input of the algorithm and requires key pair PK,SK (PK,SK∈K) as the output of the algorithm(iii)
Signcryptcp,SKS,PKR,m⟶σ: This is signcryption algorithm. This algorithm requires common parameters cp, private key SKS (SKS∈K) of sender, public key PKR (PKR∈K) of receiver, and message m (m∈M) as the input of the algorithm and requires signcryption σσ∈S as the output of the algorithm(iv)
Unsigncryptcp,SKR,PKS,σ⟶m: This is unsigncryption algorithm. This algorithm requires common parameters cp, private key SKR (SKR∈K) of receiver, and public key PKS (PKS∈K) of sender and signcryption σσ∈S as the input of the algorithm. This algorithm outputs message mm∈M or symbol “⊥” (“⊥” indicates that the unsigncryption failed)Definition 2 (Correctness).
For any messagem∈M, any sender (his key pair SKS,PKS was generated by Keygencp,r), any receiver (his key pair SKR,PKR was generated by Keygencp,r), and the following formula holds
(1)Unsigncryptcp,SKR,PKS,Signcryptcp,SKS,PKR,m=m.


## 2.4. The Security Model of Signcryption Scheme

Definition 3 (Confidentiality).
The confidentiality security can be seen as a game between the adversaryO and the challenger C. This game is divided into five phases.
(i)
Keygen phase: ChallengerC runs algorithm Keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR, and sends PKS,PKR to adversary O(ii)
Query phase 1: The adversaryO sends multiple signcryption queries and unsigncryption queries to the challenger C(1)
Signcryption query: The adversaryO submits the message m and the public key PKS,PKR to the challenger C. The challenger C calculates σ=signcryptcp,SKS,PKR,m and sends the result σ to the adversary O(2)
Unsigncryption query: The adversaryO submits the legitimate signcryption result σ and the public key PKS,PKR to the challenger C. The challenger C calculates unsigncryptcp,SKR,PKS,σ and sends the message m or symbol “⊥” to the adversary O(iii)
Challenge phase: The adversaryO submits two messages m0, m1 (m0, m1 have the same length) to the challenger C. The challenger C randomly selects i∈0,1, calculates σ∗=signcryptcp,SKS,PKR,mi and sends the result σ∗ to the adversary O(iv)
Query phase 2: Similar to the query phase 1, the adversaryO continues to send multiple signcryption queries and unsigncryption queries to the challenger C (the adversary O is forbidden from sending unsigncryption query for the result σ∗)(v)
Guess phase: The adversaryO outputs a value i′ as the guess for i. If i′=i, the adversary O wins this game
In this game, the advantage of the adversaryO is AdvO=Pri′=i−1/2.Definition 4 (Unforgeability).
The unforgeability security can be seen as a game between the adversaryO and the challenger C. This game is divided into three phases.
(i)
Keygen phase: ChallengerC runs algorithm keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O(ii)
Query phase: The adversaryO sends multiple signcryption queries and unsigncryption queries to the challenger C(1)
Signcryption query: The adversaryO submits the message m and the public key PKS,PKR to the challenger C. The challenger C calculates σ=signcryptcp,SKS,PKR,m and sends the result σ to the adversary O(2)
Unsigncryption query: The adversaryO submits the legitimate signcryption result σ and the public key PKS,PKR to the challenger C. The challenger C calculates unsigncryptcp,SKR,PKS,σ and sends the message m or symbol “⊥” to the adversary O(iii)
Forgery phase: The adversaryO submits the challenging content, including challenging message m∗ and the forged signcryption σ∗. The challenger C submits the above input to the oracle, and the oracle returns the unsigncryption of signcryption σ∗ to the challenger C. If the result is message m∗, and the adversary O has not used this message as the input for signcryption query before, the adversary O wins this gameIn this game, the advantage of the adversary is his probability of winning the game.


## 3. Our ECC-Based Signcryption Scheme

### 3.1. Construction

In this section, we define and construct our elliptic curve signcryption schemeSC=setup,keygen,signcrypt,unsigncrypt.
(i)
Setup: Let GFq be a finite field of order q (the length of q is l), E:y2=x3+ax+bmodq (a,b∈GFq,4a3+27b2≠0) be an elliptic curve in finite field GFq, P be the base point of the elliptic curve E. ordP=n, where n is a large prime number. Let h=#EGFq/n (h≪n) is the cofactor. #EGFq represents the number of points of the elliptic curve E defined on the finite field GFq). G1 is an elliptic curve cyclic multiplication group of order q generated by point P. We suppose the plaintext space is 0,1l and select two hash functions H1:G1⟶0,1l, H2:0,1∗⟶Zq. Then, we expose parameters D=q,l,a,b,P,G1,n,h and hash function H1, H2(ii)
Keygen: The sender randomly selects SKS as his private key, and his public key is PKS=SKSP. The receiver randomly selects SKR as his private key, and his public key is PKR=SKRP. Then, they keep the private key SKS,SKR secret and expose the public key PKS,PKR(iii)
Signcrypt: The sender uses PKR and SKS to signcrypt message m(a)
Select a random numberk∈1,n−1(b)
ComputekPKR=K(c)
Computeb=H1K.(d)
Computec=b⊕m(e)
Computee=H2m,K,PKS,PKR.(f)
Computes=k−1e+SKS. If s=0, return to step 1(g)
Get the signcryptionσ=c,e,s, and send it to the recriver(iv)
Unsigncrypt: The receiver gets the signcryption σ=c,e,s and uses PKS and SKR to unsigncrypt it
(a)
Computew=s−1(b)
ComputeX=ewPKR+wPKSSKR(c)
Computeb′=H1X.(d)
Computem=b′⊕c(e)
Computee′=H2m,X,PKS,PKR.(f)
Ife′=e, return m, otherwise return “⊥”.


### 3.2. Correctness

Becauses=k−1e+SKS, we have s−1=ke+SKS−1. Therefore, the following formula holds
(2)X=ewPKR+wPKSSKR=es−1PKR+s−1PKSSKR=es−1SKRP+s−1SKSSKRP=e+SKSs−1SKRP=e+SKSke+SKS−1SKRP=kSKRP=kPKR=K.So, we haveb′=b, e′=e. Here, b′=b ensures that the receiver can restore the sender’s message m; that is, the decryption process is correct. e′=e ensures that the receiver can verify the correctness of the sender’s signature; that is, the verification process is correct. Therefore, our signcryption scheme is correct.


### 3.3. Security

#### 3.3.1. Confidentiality

Confidentiality means that information can only be used by authorized users and cannot be disclosed to unauthorized users. Confidentiality is a required property of encryption. Since signcryption needs to realize both signature and encryption, the signcryption scheme must also have confidentiality. According to Theorem5, our signcryption scheme has confidentiality.Theorem 5.
In the random oracle model, if there is an adversaryO who can win the game of Definition 3 with the advantage of ε, there is a challenger C who can solve the ECDLP problem with the advantage of at least ε′≥ε/qH2+qSig+qUns. qH2, qSig, and qUns represent the number of times the adversary initiates H2 query, signcryption query, and unsigncryption query, respectively.Proof.
At the beginning of the game, the challengerC runs algorithm keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O. The challenger C manages four lists LH1,LH2,LSig,LUns, which are initially empty. LH1,LH2 are used to track the adversary’s queries to oracle H1,H2, respectively, LSig is used to simulate signcryption oracle, and LUns is used to simulate unsigncryption oracle.Next, the adversaryO sends queries to the challenger C.
(1)
(H1 query) If K,b already exists in the list LH1, the challenger returns b. Otherwise, the challenger selects b from 0,1l randomly, stores b in list LH1, and returns b(2)
(H2 query) If m,K,PKS,PKR,e already exists in the list LH2, the challenger returns e. Otherwise, the challenger selects e from Zq randomly, stores m,K,PKS,PKR,e in list LH2, and returns e(3)
(Signcrypt query) The public key of sender is PKS, the public key of receiver is PKR, and the message is m. The challenger selects k from 1,n−1 randomly and computes K=kPKR, b=H1K. H1K can be obtained from the above H1 query. Then, the challenger computes c=b⊕m, e=H2m,K,PKS,PKR. e=H2m,K,PKS,PKR can be obtained from the above H2 query. The challenger computes s=k−1e+SKS and returns c,e,s(4)
(Unsigncrypt query) The public key of sender is PKS, the public key of receiver is PKR, and the signcryption is σ=c,e,s. The challenger computes w=s−1, X=ewPKR+wPKSSKR. If X∉LH1, the challenger returns “⊥”, else computes b′=H1X, m=b′⊕c. If m,X,PKS,PKR∉LH2, the challenger returns “⊥”, else computes e′=H2m,X,PKS,PKR. If e′≠e, the challenger returns “⊥”, else computes mAfter the above-mentioned queries are initiated polynomial times, the game enters the challenge phase. The adversaryO outputs two messages m0,m1. The challenger C randomly selects i from 0,1, b∗ from 0,1l, and e∗ and s∗ from Zq and computes c∗=b∗⊕mi and w∗=s∗−1. When H1 is queried at K∗=e∗w∗+w∗SKSPKR, the value b∗ is returned directly. When H2 is queried at mi,K∗=e∗w∗+w∗SKSPKR,PKS,PKR, the value e∗ is returned directly. The challenger C returns challenging signcryption σ∗=c∗,e∗,s∗ to O. The adversary O initiates the second round of query, which is same as the first round of query, but the adversary O cannot send unsigncryption query for the signcryption result σ∗. At the end of the simulation, the adversary O outputs i′ as the guess for i. If i′=i, the challenger C outputs k=ew+wSKS as an answer to the ECDLP, else the challenger C fails to solve the ECDLP.In the view of the adversaryO, the challenger C provides a simulation environment similar to the actual environment. However, in the challenge phase, the answer of H2 to the query mi,K∗=e∗w∗+w∗SKSPKR,PKS,PKR is different. This is because mi can only be determined at the end of the challenge phase. At this point, qH2+qSig+qUns is the maximum number that H2 is queried. Therefore, the challenger C has an advantage of at least ε′≥ε/qH2+qSig+qUns to solve the ECDLP problem.


#### 3.3.2. Unforgeability

Unforgeability is a required property of signature. Since signcryption needs to realize both signature and encryption, the signcryption scheme must also have unforgeability. According to Theorem6, our signcryption scheme has unforgeability.Theorem 6.
In the random oracle model, if there is an adversaryO who can win the game of Definition 4 with the advantage of ε, there is a challenger C who can solve the ECDLP problem with the advantage of ε/qH1+qH2+qSig+qUns. qH1, qH2, and qSig represent the number of times the adversary initiates H1 query, H2 query, and signcryption query, respectively.Proof.
At the beginning of the game, the challengerC runs algorithm Keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O. The challenger C manages three lists LH1,LH2,LSig, which are initially empty. LH1,LH2 are used to track the adversary’s queries to oracle H1,H2, respectively, LSig is used to simulate signcryption oracle.Suppose the public key of the receiver isPKR, the adversary uses the oracle described in the proof of Theorem 5 to send various queries. After these queries, in the forgery phase, the adversary outputs the forged signcryption result. It can be seen from the proof of Theorem 5 that our simulation is equivalent to the actual attack environment. In order to forge successfully, the adversary must send H1 query and H2 query to get σ∗=c∗,e∗,s∗ corresponding to message m∗. The probability that the adversary chooses the correct record in the list LH1,LH2 is 1/qH1+qH2+qSig+qUns, so the challenger C has the advantage of ε/qH1+qH2+qSig+qUns to solve ECDLP problem.


#### 3.3.3. Integrity

Integrity means that information cannot be accidentally or maliciously deleted, modified, forged, replayed, and inserted during transmission and storage.Theorem 7.
Our signcryption scheme has integrity.Proof.
In our signcryption scheme, it is very difficult for an attacker to tamper with the information between the sender and receiver. Because this tampering requires the hash valueb, and b corresponds to the hash value of a random point of the elliptic curve, due to the collision resistance of the hash function, the attacker cannot determine the point of the elliptic curve corresponding to the hash value b. Furthermore, every part of ciphertext c=b⊕m depends on all message blocks. Once a malicious attacker makes any change to a particular block of information, it will cause the ciphertext to change. Therefore, our signcryption scheme has integrity.


#### 3.3.4. Nonrepudiation

Nonrepudiation in signcryption and signature is the same. Nonrepudiation is preventing a communicating party from denying a previous promise or behavior. In a signcryption scheme, nonrepudiation means that a signer cannot deny that he signed a valid message after signing it.Theorem 8.
Our signcryption scheme has nonrepudiation.Proof.
In our signcryption scheme, when the sender signs messagem, it first calculates the hash value of message m using its own public key PKS and receiver’s public key PKR and then signs this hash value with his own private key SKS. Therefore, the sender cannot deny its signature to message m. In addition, in unsigncryption, the receiver will use the sender’s public key PKS and its own public key PKR to calculate the hash value. If it is equal to the received hash value, it means that the received signature is indeed signed by the sender. Therefore, our scheme has nonrepudiation.


#### 3.3.5. Availability

Availability refers to the property that all resources can be accessed by authorized parties at the appropriate time; i.e., information can be accessed by authorized entities and used on demand.Theorem 9.
Our signcryption scheme has availability.Proof.
In our signcryption scheme, the recipient, as an authorized entity, can use its own private key to obtain the plaintextm signed by the sender through the unsigncryption after obtaining the signcryption and then use the plaintext m to perform other required operations. Therefore, our signcryption scheme has availability.


#### 3.3.6. Forward Secrecy

Forward secrecy means that exposure of private key of the encryptor does not affect the confidentiality of previously encrypted messages.Theorem 10.
Our signcryption scheme has forward secrecy.Proof.
In our signcryption scheme, if the sender’s private key is leaked, the adversary must know the value ofb in order to obtain the previous session content, so he must obtain the value k. However, k is randomly selected by the sender. Even if the adversary obtains the sender’s private key, he still cannot recover the plaintext information. Therefore, our signcryption scheme has forward secrecy.


#### 3.3.7. Internal Security

The security model of signcryption can be divided into external security and internal security. External security means that the adversary only knows public information. Internal security means that the adversary knows the sender’s or receiver’s private key in addition to the public information. That is, if the sender’s private key is exposed, the adversary still cannot recover the plaintext from the ciphertext; if the receiver’s private key is exposed, the adversary still cannot forge the ciphertext. Obviously, internal security is stronger than external security.Theorem 11.
Our signcryption scheme has internal security.Proof.
On the one hand, in our signcryption scheme, if the adversary wants to recover the plaintextm from the ciphertext c, it must obtain the hash value b. Similar to Theorem 7, due to the collision resistance of the hash function and the randomness of the random number k, the adversary cannot determine the point on the elliptic curve corresponding to the hash value b. Therefore, even if the adversary possesses the sender’s private key, the plaintext still cannot be recovered from the ciphertext. On the other hand, in our signcryption scheme, if the adversary possesses the receiver’s private key, it is also impossible to forge the valid ciphertext c′ of the plaintext m′. The reason is that even if the adversary uses SKR to compute the value of X, gets the hash value b′, and then uses c=b⊕m to get the ciphertext c′ of the plaintext m′, the ciphertext c′ is invalid. Because the ciphertext c in the signcryption result is the encryption of the plaintext m′, and the s in the signcryption result is the signature of the plaintext m, which will make the unsigncryption fail, therefore, our signcryption scheme has internal security.We compare the security of our signcryption scheme with Tsai’s ECC-based signcryption scheme [31] and Zhou’s signcryption scheme [30]. It can be seen from Table 1 that our scheme satisfies the confidentiality, unforgeability, integrity, nonrepudiation, and availability of the other two schemes and also satisfies forward secrecy and internal security. Therefore, compared with the existing signcryption schemes, our signcryption scheme is more secure.Table 1
Security comparison of three signcryption schemes.
ConfidentialityUnforgeabilityIntegrityNonrepudiationAvailabilityForward secrecyInternal securityTsai’s schemeYYYYYNNZhou’s schemeYYYYYNNOur schemeYYYYYYYNote: “Y” means that the scheme has this property; “N” means that the scheme does not have this property.


### 3.4. Performance Evaluation

In this section, we compare the computational and communication overhead of our signcryption scheme with Tsai’s scheme [31] and Zhou’s scheme [30] in detail. Among them, the computational overhead mainly compares the calculation amount of the signcryption and unsigncryption algorithms, and the calculation amount mainly counts the execution times of the point multiplication operation, point addition operation, number multiplication operation, and inversion operation. The XOR operation, Hash operation, and the number addition operation are not counted. The computational overhead and communication overhead of the three schemes are shown in Table 2. In this table, PM, PA, NM, and IN represent the point multiplication operation, point addition operation, number multiplication operation, and inversion operation, respectively; lm represents the length of the plaintext message; G represents the length of the element on the group; and Zn∗ represents the length of the element in Zn∗.Table 2
Performance comparison of three signcryption schemes.
Computational overheadCommunication overheadSigncryptionUnsigncryptionTsai’s scheme4PM+2NM3PM+3PAlm+3G+Zn∗Zhou’s scheme3PM+2PA+2NM+1IN6PM+5PAlm+2Zn∗Our scheme1PM+1NM+1IN2PM+1PA+1IN+2NMlm+2Zn∗Among the various operations counted in Table2, the point multiplication operation takes the most time, followed by the point addition operation. It can be seen from the calculation amount in Table 2 that the computational overhead of our scheme is much less than that of the other two schemes. In addition, the communication overhead of our scheme is comparable to Zhou’s scheme and smaller than Tsai’s scheme. Our scheme has forward security and internal security in addition to the same confidentiality, unforgeability, integrity, nonrepudiation, and availability as the other two schemes. Overall, our scheme is an efficient and secure ECC-based signcryption scheme.


## 3.1. Construction

In this section, we define and construct our elliptic curve signcryption schemeSC=setup,keygen,signcrypt,unsigncrypt.
(i)
Setup: Let GFq be a finite field of order q (the length of q is l), E:y2=x3+ax+bmodq (a,b∈GFq,4a3+27b2≠0) be an elliptic curve in finite field GFq, P be the base point of the elliptic curve E. ordP=n, where n is a large prime number. Let h=#EGFq/n (h≪n) is the cofactor. #EGFq represents the number of points of the elliptic curve E defined on the finite field GFq). G1 is an elliptic curve cyclic multiplication group of order q generated by point P. We suppose the plaintext space is 0,1l and select two hash functions H1:G1⟶0,1l, H2:0,1∗⟶Zq. Then, we expose parameters D=q,l,a,b,P,G1,n,h and hash function H1, H2(ii)
Keygen: The sender randomly selects SKS as his private key, and his public key is PKS=SKSP. The receiver randomly selects SKR as his private key, and his public key is PKR=SKRP. Then, they keep the private key SKS,SKR secret and expose the public key PKS,PKR(iii)
Signcrypt: The sender uses PKR and SKS to signcrypt message m(a)
Select a random numberk∈1,n−1(b)
ComputekPKR=K(c)
Computeb=H1K.(d)
Computec=b⊕m(e)
Computee=H2m,K,PKS,PKR.(f)
Computes=k−1e+SKS. If s=0, return to step 1(g)
Get the signcryptionσ=c,e,s, and send it to the recriver(iv)
Unsigncrypt: The receiver gets the signcryption σ=c,e,s and uses PKS and SKR to unsigncrypt it
(a)
Computew=s−1(b)
ComputeX=ewPKR+wPKSSKR(c)
Computeb′=H1X.(d)
Computem=b′⊕c(e)
Computee′=H2m,X,PKS,PKR.(f)
Ife′=e, return m, otherwise return “⊥”.


## 3.2. Correctness

Becauses=k−1e+SKS, we have s−1=ke+SKS−1. Therefore, the following formula holds
(2)X=ewPKR+wPKSSKR=es−1PKR+s−1PKSSKR=es−1SKRP+s−1SKSSKRP=e+SKSs−1SKRP=e+SKSke+SKS−1SKRP=kSKRP=kPKR=K.So, we haveb′=b, e′=e. Here, b′=b ensures that the receiver can restore the sender’s message m; that is, the decryption process is correct. e′=e ensures that the receiver can verify the correctness of the sender’s signature; that is, the verification process is correct. Therefore, our signcryption scheme is correct.


## 3.3. Security

### 3.3.1. Confidentiality

Confidentiality means that information can only be used by authorized users and cannot be disclosed to unauthorized users. Confidentiality is a required property of encryption. Since signcryption needs to realize both signature and encryption, the signcryption scheme must also have confidentiality. According to Theorem5, our signcryption scheme has confidentiality.Theorem 5.
In the random oracle model, if there is an adversaryO who can win the game of Definition 3 with the advantage of ε, there is a challenger C who can solve the ECDLP problem with the advantage of at least ε′≥ε/qH2+qSig+qUns. qH2, qSig, and qUns represent the number of times the adversary initiates H2 query, signcryption query, and unsigncryption query, respectively.Proof.
At the beginning of the game, the challengerC runs algorithm keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O. The challenger C manages four lists LH1,LH2,LSig,LUns, which are initially empty. LH1,LH2 are used to track the adversary’s queries to oracle H1,H2, respectively, LSig is used to simulate signcryption oracle, and LUns is used to simulate unsigncryption oracle.Next, the adversaryO sends queries to the challenger C.
(1)
(H1 query) If K,b already exists in the list LH1, the challenger returns b. Otherwise, the challenger selects b from 0,1l randomly, stores b in list LH1, and returns b(2)
(H2 query) If m,K,PKS,PKR,e already exists in the list LH2, the challenger returns e. Otherwise, the challenger selects e from Zq randomly, stores m,K,PKS,PKR,e in list LH2, and returns e(3)
(Signcrypt query) The public key of sender is PKS, the public key of receiver is PKR, and the message is m. The challenger selects k from 1,n−1 randomly and computes K=kPKR, b=H1K. H1K can be obtained from the above H1 query. Then, the challenger computes c=b⊕m, e=H2m,K,PKS,PKR. e=H2m,K,PKS,PKR can be obtained from the above H2 query. The challenger computes s=k−1e+SKS and returns c,e,s(4)
(Unsigncrypt query) The public key of sender is PKS, the public key of receiver is PKR, and the signcryption is σ=c,e,s. The challenger computes w=s−1, X=ewPKR+wPKSSKR. If X∉LH1, the challenger returns “⊥”, else computes b′=H1X, m=b′⊕c. If m,X,PKS,PKR∉LH2, the challenger returns “⊥”, else computes e′=H2m,X,PKS,PKR. If e′≠e, the challenger returns “⊥”, else computes mAfter the above-mentioned queries are initiated polynomial times, the game enters the challenge phase. The adversaryO outputs two messages m0,m1. The challenger C randomly selects i from 0,1, b∗ from 0,1l, and e∗ and s∗ from Zq and computes c∗=b∗⊕mi and w∗=s∗−1. When H1 is queried at K∗=e∗w∗+w∗SKSPKR, the value b∗ is returned directly. When H2 is queried at mi,K∗=e∗w∗+w∗SKSPKR,PKS,PKR, the value e∗ is returned directly. The challenger C returns challenging signcryption σ∗=c∗,e∗,s∗ to O. The adversary O initiates the second round of query, which is same as the first round of query, but the adversary O cannot send unsigncryption query for the signcryption result σ∗. At the end of the simulation, the adversary O outputs i′ as the guess for i. If i′=i, the challenger C outputs k=ew+wSKS as an answer to the ECDLP, else the challenger C fails to solve the ECDLP.In the view of the adversaryO, the challenger C provides a simulation environment similar to the actual environment. However, in the challenge phase, the answer of H2 to the query mi,K∗=e∗w∗+w∗SKSPKR,PKS,PKR is different. This is because mi can only be determined at the end of the challenge phase. At this point, qH2+qSig+qUns is the maximum number that H2 is queried. Therefore, the challenger C has an advantage of at least ε′≥ε/qH2+qSig+qUns to solve the ECDLP problem.


### 3.3.2. Unforgeability

Unforgeability is a required property of signature. Since signcryption needs to realize both signature and encryption, the signcryption scheme must also have unforgeability. According to Theorem6, our signcryption scheme has unforgeability.Theorem 6.
In the random oracle model, if there is an adversaryO who can win the game of Definition 4 with the advantage of ε, there is a challenger C who can solve the ECDLP problem with the advantage of ε/qH1+qH2+qSig+qUns. qH1, qH2, and qSig represent the number of times the adversary initiates H1 query, H2 query, and signcryption query, respectively.Proof.
At the beginning of the game, the challengerC runs algorithm Keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O. The challenger C manages three lists LH1,LH2,LSig, which are initially empty. LH1,LH2 are used to track the adversary’s queries to oracle H1,H2, respectively, LSig is used to simulate signcryption oracle.Suppose the public key of the receiver isPKR, the adversary uses the oracle described in the proof of Theorem 5 to send various queries. After these queries, in the forgery phase, the adversary outputs the forged signcryption result. It can be seen from the proof of Theorem 5 that our simulation is equivalent to the actual attack environment. In order to forge successfully, the adversary must send H1 query and H2 query to get σ∗=c∗,e∗,s∗ corresponding to message m∗. The probability that the adversary chooses the correct record in the list LH1,LH2 is 1/qH1+qH2+qSig+qUns, so the challenger C has the advantage of ε/qH1+qH2+qSig+qUns to solve ECDLP problem.


### 3.3.3. Integrity

Integrity means that information cannot be accidentally or maliciously deleted, modified, forged, replayed, and inserted during transmission and storage.Theorem 7.
Our signcryption scheme has integrity.Proof.
In our signcryption scheme, it is very difficult for an attacker to tamper with the information between the sender and receiver. Because this tampering requires the hash valueb, and b corresponds to the hash value of a random point of the elliptic curve, due to the collision resistance of the hash function, the attacker cannot determine the point of the elliptic curve corresponding to the hash value b. Furthermore, every part of ciphertext c=b⊕m depends on all message blocks. Once a malicious attacker makes any change to a particular block of information, it will cause the ciphertext to change. Therefore, our signcryption scheme has integrity.


### 3.3.4. Nonrepudiation

Nonrepudiation in signcryption and signature is the same. Nonrepudiation is preventing a communicating party from denying a previous promise or behavior. In a signcryption scheme, nonrepudiation means that a signer cannot deny that he signed a valid message after signing it.Theorem 8.
Our signcryption scheme has nonrepudiation.Proof.
In our signcryption scheme, when the sender signs messagem, it first calculates the hash value of message m using its own public key PKS and receiver’s public key PKR and then signs this hash value with his own private key SKS. Therefore, the sender cannot deny its signature to message m. In addition, in unsigncryption, the receiver will use the sender’s public key PKS and its own public key PKR to calculate the hash value. If it is equal to the received hash value, it means that the received signature is indeed signed by the sender. Therefore, our scheme has nonrepudiation.


### 3.3.5. Availability

Availability refers to the property that all resources can be accessed by authorized parties at the appropriate time; i.e., information can be accessed by authorized entities and used on demand.Theorem 9.
Our signcryption scheme has availability.Proof.
In our signcryption scheme, the recipient, as an authorized entity, can use its own private key to obtain the plaintextm signed by the sender through the unsigncryption after obtaining the signcryption and then use the plaintext m to perform other required operations. Therefore, our signcryption scheme has availability.


### 3.3.6. Forward Secrecy

Forward secrecy means that exposure of private key of the encryptor does not affect the confidentiality of previously encrypted messages.Theorem 10.
Our signcryption scheme has forward secrecy.Proof.
In our signcryption scheme, if the sender’s private key is leaked, the adversary must know the value ofb in order to obtain the previous session content, so he must obtain the value k. However, k is randomly selected by the sender. Even if the adversary obtains the sender’s private key, he still cannot recover the plaintext information. Therefore, our signcryption scheme has forward secrecy.


### 3.3.7. Internal Security

The security model of signcryption can be divided into external security and internal security. External security means that the adversary only knows public information. Internal security means that the adversary knows the sender’s or receiver’s private key in addition to the public information. That is, if the sender’s private key is exposed, the adversary still cannot recover the plaintext from the ciphertext; if the receiver’s private key is exposed, the adversary still cannot forge the ciphertext. Obviously, internal security is stronger than external security.Theorem 11.
Our signcryption scheme has internal security.Proof.
On the one hand, in our signcryption scheme, if the adversary wants to recover the plaintextm from the ciphertext c, it must obtain the hash value b. Similar to Theorem 7, due to the collision resistance of the hash function and the randomness of the random number k, the adversary cannot determine the point on the elliptic curve corresponding to the hash value b. Therefore, even if the adversary possesses the sender’s private key, the plaintext still cannot be recovered from the ciphertext. On the other hand, in our signcryption scheme, if the adversary possesses the receiver’s private key, it is also impossible to forge the valid ciphertext c′ of the plaintext m′. The reason is that even if the adversary uses SKR to compute the value of X, gets the hash value b′, and then uses c=b⊕m to get the ciphertext c′ of the plaintext m′, the ciphertext c′ is invalid. Because the ciphertext c in the signcryption result is the encryption of the plaintext m′, and the s in the signcryption result is the signature of the plaintext m, which will make the unsigncryption fail, therefore, our signcryption scheme has internal security.We compare the security of our signcryption scheme with Tsai’s ECC-based signcryption scheme [31] and Zhou’s signcryption scheme [30]. It can be seen from Table 1 that our scheme satisfies the confidentiality, unforgeability, integrity, nonrepudiation, and availability of the other two schemes and also satisfies forward secrecy and internal security. Therefore, compared with the existing signcryption schemes, our signcryption scheme is more secure.Table 1
Security comparison of three signcryption schemes.
ConfidentialityUnforgeabilityIntegrityNonrepudiationAvailabilityForward secrecyInternal securityTsai’s schemeYYYYYNNZhou’s schemeYYYYYNNOur schemeYYYYYYYNote: “Y” means that the scheme has this property; “N” means that the scheme does not have this property.


## 3.3.1. Confidentiality

Confidentiality means that information can only be used by authorized users and cannot be disclosed to unauthorized users. Confidentiality is a required property of encryption. Since signcryption needs to realize both signature and encryption, the signcryption scheme must also have confidentiality. According to Theorem5, our signcryption scheme has confidentiality.Theorem 5.
In the random oracle model, if there is an adversaryO who can win the game of Definition 3 with the advantage of ε, there is a challenger C who can solve the ECDLP problem with the advantage of at least ε′≥ε/qH2+qSig+qUns. qH2, qSig, and qUns represent the number of times the adversary initiates H2 query, signcryption query, and unsigncryption query, respectively.Proof.
At the beginning of the game, the challengerC runs algorithm keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O. The challenger C manages four lists LH1,LH2,LSig,LUns, which are initially empty. LH1,LH2 are used to track the adversary’s queries to oracle H1,H2, respectively, LSig is used to simulate signcryption oracle, and LUns is used to simulate unsigncryption oracle.Next, the adversaryO sends queries to the challenger C.
(1)
(H1 query) If K,b already exists in the list LH1, the challenger returns b. Otherwise, the challenger selects b from 0,1l randomly, stores b in list LH1, and returns b(2)
(H2 query) If m,K,PKS,PKR,e already exists in the list LH2, the challenger returns e. Otherwise, the challenger selects e from Zq randomly, stores m,K,PKS,PKR,e in list LH2, and returns e(3)
(Signcrypt query) The public key of sender is PKS, the public key of receiver is PKR, and the message is m. The challenger selects k from 1,n−1 randomly and computes K=kPKR, b=H1K. H1K can be obtained from the above H1 query. Then, the challenger computes c=b⊕m, e=H2m,K,PKS,PKR. e=H2m,K,PKS,PKR can be obtained from the above H2 query. The challenger computes s=k−1e+SKS and returns c,e,s(4)
(Unsigncrypt query) The public key of sender is PKS, the public key of receiver is PKR, and the signcryption is σ=c,e,s. The challenger computes w=s−1, X=ewPKR+wPKSSKR. If X∉LH1, the challenger returns “⊥”, else computes b′=H1X, m=b′⊕c. If m,X,PKS,PKR∉LH2, the challenger returns “⊥”, else computes e′=H2m,X,PKS,PKR. If e′≠e, the challenger returns “⊥”, else computes mAfter the above-mentioned queries are initiated polynomial times, the game enters the challenge phase. The adversaryO outputs two messages m0,m1. The challenger C randomly selects i from 0,1, b∗ from 0,1l, and e∗ and s∗ from Zq and computes c∗=b∗⊕mi and w∗=s∗−1. When H1 is queried at K∗=e∗w∗+w∗SKSPKR, the value b∗ is returned directly. When H2 is queried at mi,K∗=e∗w∗+w∗SKSPKR,PKS,PKR, the value e∗ is returned directly. The challenger C returns challenging signcryption σ∗=c∗,e∗,s∗ to O. The adversary O initiates the second round of query, which is same as the first round of query, but the adversary O cannot send unsigncryption query for the signcryption result σ∗. At the end of the simulation, the adversary O outputs i′ as the guess for i. If i′=i, the challenger C outputs k=ew+wSKS as an answer to the ECDLP, else the challenger C fails to solve the ECDLP.In the view of the adversaryO, the challenger C provides a simulation environment similar to the actual environment. However, in the challenge phase, the answer of H2 to the query mi,K∗=e∗w∗+w∗SKSPKR,PKS,PKR is different. This is because mi can only be determined at the end of the challenge phase. At this point, qH2+qSig+qUns is the maximum number that H2 is queried. Therefore, the challenger C has an advantage of at least ε′≥ε/qH2+qSig+qUns to solve the ECDLP problem.


## 3.3.2. Unforgeability

Unforgeability is a required property of signature. Since signcryption needs to realize both signature and encryption, the signcryption scheme must also have unforgeability. According to Theorem6, our signcryption scheme has unforgeability.Theorem 6.
In the random oracle model, if there is an adversaryO who can win the game of Definition 4 with the advantage of ε, there is a challenger C who can solve the ECDLP problem with the advantage of ε/qH1+qH2+qSig+qUns. qH1, qH2, and qSig represent the number of times the adversary initiates H1 query, H2 query, and signcryption query, respectively.Proof.
At the beginning of the game, the challengerC runs algorithm Keygencp,r to generate a sender key pair SKS,PKS and a receiver key pair SKR,PKR and sends PKS,PKR to adversary O. The challenger C manages three lists LH1,LH2,LSig, which are initially empty. LH1,LH2 are used to track the adversary’s queries to oracle H1,H2, respectively, LSig is used to simulate signcryption oracle.Suppose the public key of the receiver isPKR, the adversary uses the oracle described in the proof of Theorem 5 to send various queries. After these queries, in the forgery phase, the adversary outputs the forged signcryption result. It can be seen from the proof of Theorem 5 that our simulation is equivalent to the actual attack environment. In order to forge successfully, the adversary must send H1 query and H2 query to get σ∗=c∗,e∗,s∗ corresponding to message m∗. The probability that the adversary chooses the correct record in the list LH1,LH2 is 1/qH1+qH2+qSig+qUns, so the challenger C has the advantage of ε/qH1+qH2+qSig+qUns to solve ECDLP problem.


## 3.3.3. Integrity

Integrity means that information cannot be accidentally or maliciously deleted, modified, forged, replayed, and inserted during transmission and storage.Theorem 7.
Our signcryption scheme has integrity.Proof.
In our signcryption scheme, it is very difficult for an attacker to tamper with the information between the sender and receiver. Because this tampering requires the hash valueb, and b corresponds to the hash value of a random point of the elliptic curve, due to the collision resistance of the hash function, the attacker cannot determine the point of the elliptic curve corresponding to the hash value b. Furthermore, every part of ciphertext c=b⊕m depends on all message blocks. Once a malicious attacker makes any change to a particular block of information, it will cause the ciphertext to change. Therefore, our signcryption scheme has integrity.


## 3.3.4. Nonrepudiation

Nonrepudiation in signcryption and signature is the same. Nonrepudiation is preventing a communicating party from denying a previous promise or behavior. In a signcryption scheme, nonrepudiation means that a signer cannot deny that he signed a valid message after signing it.Theorem 8.
Our signcryption scheme has nonrepudiation.Proof.
In our signcryption scheme, when the sender signs messagem, it first calculates the hash value of message m using its own public key PKS and receiver’s public key PKR and then signs this hash value with his own private key SKS. Therefore, the sender cannot deny its signature to message m. In addition, in unsigncryption, the receiver will use the sender’s public key PKS and its own public key PKR to calculate the hash value. If it is equal to the received hash value, it means that the received signature is indeed signed by the sender. Therefore, our scheme has nonrepudiation.


## 3.3.5. Availability

Availability refers to the property that all resources can be accessed by authorized parties at the appropriate time; i.e., information can be accessed by authorized entities and used on demand.Theorem 9.
Our signcryption scheme has availability.Proof.
In our signcryption scheme, the recipient, as an authorized entity, can use its own private key to obtain the plaintextm signed by the sender through the unsigncryption after obtaining the signcryption and then use the plaintext m to perform other required operations. Therefore, our signcryption scheme has availability.


## 3.3.6. Forward Secrecy

Forward secrecy means that exposure of private key of the encryptor does not affect the confidentiality of previously encrypted messages.Theorem 10.
Our signcryption scheme has forward secrecy.Proof.
In our signcryption scheme, if the sender’s private key is leaked, the adversary must know the value ofb in order to obtain the previous session content, so he must obtain the value k. However, k is randomly selected by the sender. Even if the adversary obtains the sender’s private key, he still cannot recover the plaintext information. Therefore, our signcryption scheme has forward secrecy.


## 3.3.7. Internal Security

The security model of signcryption can be divided into external security and internal security. External security means that the adversary only knows public information. Internal security means that the adversary knows the sender’s or receiver’s private key in addition to the public information. That is, if the sender’s private key is exposed, the adversary still cannot recover the plaintext from the ciphertext; if the receiver’s private key is exposed, the adversary still cannot forge the ciphertext. Obviously, internal security is stronger than external security.Theorem 11.
Our signcryption scheme has internal security.Proof.
On the one hand, in our signcryption scheme, if the adversary wants to recover the plaintextm from the ciphertext c, it must obtain the hash value b. Similar to Theorem 7, due to the collision resistance of the hash function and the randomness of the random number k, the adversary cannot determine the point on the elliptic curve corresponding to the hash value b. Therefore, even if the adversary possesses the sender’s private key, the plaintext still cannot be recovered from the ciphertext. On the other hand, in our signcryption scheme, if the adversary possesses the receiver’s private key, it is also impossible to forge the valid ciphertext c′ of the plaintext m′. The reason is that even if the adversary uses SKR to compute the value of X, gets the hash value b′, and then uses c=b⊕m to get the ciphertext c′ of the plaintext m′, the ciphertext c′ is invalid. Because the ciphertext c in the signcryption result is the encryption of the plaintext m′, and the s in the signcryption result is the signature of the plaintext m, which will make the unsigncryption fail, therefore, our signcryption scheme has internal security.We compare the security of our signcryption scheme with Tsai’s ECC-based signcryption scheme [31] and Zhou’s signcryption scheme [30]. It can be seen from Table 1 that our scheme satisfies the confidentiality, unforgeability, integrity, nonrepudiation, and availability of the other two schemes and also satisfies forward secrecy and internal security. Therefore, compared with the existing signcryption schemes, our signcryption scheme is more secure.Table 1
Security comparison of three signcryption schemes.
ConfidentialityUnforgeabilityIntegrityNonrepudiationAvailabilityForward secrecyInternal securityTsai’s schemeYYYYYNNZhou’s schemeYYYYYNNOur schemeYYYYYYYNote: “Y” means that the scheme has this property; “N” means that the scheme does not have this property.


## 3.4. Performance Evaluation

In this section, we compare the computational and communication overhead of our signcryption scheme with Tsai’s scheme [31] and Zhou’s scheme [30] in detail. Among them, the computational overhead mainly compares the calculation amount of the signcryption and unsigncryption algorithms, and the calculation amount mainly counts the execution times of the point multiplication operation, point addition operation, number multiplication operation, and inversion operation. The XOR operation, Hash operation, and the number addition operation are not counted. The computational overhead and communication overhead of the three schemes are shown in Table 2. In this table, PM, PA, NM, and IN represent the point multiplication operation, point addition operation, number multiplication operation, and inversion operation, respectively; lm represents the length of the plaintext message; G represents the length of the element on the group; and Zn∗ represents the length of the element in Zn∗.Table 2
Performance comparison of three signcryption schemes.
Computational overheadCommunication overheadSigncryptionUnsigncryptionTsai’s scheme4PM+2NM3PM+3PAlm+3G+Zn∗Zhou’s scheme3PM+2PA+2NM+1IN6PM+5PAlm+2Zn∗Our scheme1PM+1NM+1IN2PM+1PA+1IN+2NMlm+2Zn∗Among the various operations counted in Table2, the point multiplication operation takes the most time, followed by the point addition operation. It can be seen from the calculation amount in Table 2 that the computational overhead of our scheme is much less than that of the other two schemes. In addition, the communication overhead of our scheme is comparable to Zhou’s scheme and smaller than Tsai’s scheme. Our scheme has forward security and internal security in addition to the same confidentiality, unforgeability, integrity, nonrepudiation, and availability as the other two schemes. Overall, our scheme is an efficient and secure ECC-based signcryption scheme.


## 4. Our Key Management Scheme

In this section, our ECC-based signcryption scheme will be applied to the key management scheme in the smart lock system. In Subsection4.1, we recall the model of the smart lock system. In Subsection 4.2, we give an overview of the key management scheme for the smart lock system. In Subsection 4.3, we use the above ECC-based signcryption scheme as a building block to construct our key management scheme of the smart lock system. Finally, in Subsection 4.4, we observe the bit-oriented overhead of our smart lock key management scheme through experimental simulations.


### 4.1. The Model of the Smart Lock System

There are three main parties in a smart lock system [40], that is, smart phone (SP) of user, smart lock (SL), and management server (MS), which is shown in Figure 1. Among them, MS receives the request from the user’s SP, reviews the user’s qualification, receives the operation information of SL, manages the unlock key, and helps SL and SP exchange the public key. SL communicates with MS through narrow band Internet of Things (NB-IOT) and receives the signcryption for the unlock key. SP of the legitimate user applies for the unlock key to MS and sends the signcryption of this unlock key to SL through Bluetooth.Figure 1
Architecture of smart lock system.In the smart lock system, MS is trusted, which cannot disclose the unlock key to the adversary. MS will send correct unlock key to SL and legitimate user and cancel the unlock key of the expired user. SL is safe, controllable, and will not disclose the unlock key. The user is semi-honest. Although he will follow the rule of the key management scheme, he will try to use the obtained information to unlock when his key expires or he has no key.Each smart lock has a unique international mobile equipment identity (IMEI), which is a 15-digit “electronic serial number.” In this paper, the IMEI will be used to generate a session key for the smart lock.


### 4.2. The Overview of Key Management Scheme

In the key management scheme of the smart lock system, MS and SL generate their own private keys, respectively, and then calculate their own public keys through ECC and send the public key to each other. They realize the key exchange and generate the shared session key between them. MS generates the unlock key, uses the session key to encrypt the unlock key, and sends the encryption result to SL. SL uses the session key to encrypt its operation information and uploads the encryption result to MS. This two communications adopt AES symmetric encryption through the Nb-IOT. After the user applies to MS for the house, MS reviews the user’s qualification. If the user does not meet the conditions, MS refuses to send the key to him. If the user meets the conditions, MS sends the user’s public key to SL. At the same time, MS uses the user’s public key to encrypt the unlock key and sends the encryption result and the public key of SL to the user. The user uses his private key to decrypt the unlock key. This communication uses elliptic curve public key cryptosystem. After that, the user can use the received public key of SL and his own private key to signcrypt the unlock key and send the signcryption result to SL. SL uses the received public key of user and his own private key to de-signcrypt the signcryption, thus obtaining the unlock key. The process above uses our ECC-based signcryption scheme. Finally, SL compares the unlock key from the user with its own unlock key. If the two unlock keys are different, SL cannot be unlocked.During the lifetime, the smart lock system can periodically update the key according to the security status. If the user loses the housing qualification, MS regenerates the unlock key and sends it to SL. The user cannot unlock with the old key.


### 4.3. Our Key Management Scheme

Our key management scheme is detailed as follows:(1)
Key exchange between MS and SL. MS selects private keySKMS. SKMS is confidential and satisfying SKMS<n. MS computes public key PKMS=SKMS×P and sends PKMS to SL through NB-IOT. In the transmission, even if PKMS is attacked, the adversary cannot calculate SKMS by the known P since ECDLP problem(2)
SL selects private keySKSL. SKSL is confidential and satisfying SKSL<n. SL computes public key PKSL=SKSL×P and sends PKSL to MS through NB-IOT. In the transmission, even if PKSL is attacked, the adversary cannot calculate SKSL by the known P since ECDLP problem(3)
After the MS receivesPKSL, it uses the private key SKMS and the received PKSL to generate the secret key(3)K=SKMS×PKSL=SKMS×SKSL×P=xK,yK.Similarly, SL uses the private keySKSL and the received PKMS to generate the secret key
(4)K=SKSL×PKMS=SKSL×SKMS×P=xK,yK.The two secret keysK are equal, which only are known as MS and SL. Because the secret key K is a pair of numbers xK,yK, MS and SL can select the session key kML=xK+lastIMEI according to the factory agreement, and function lastIMEI is the last digit of IMEI of SL. Because xK is known only by MS and SL, the session key kML is also known only by them.
(4)
MS generates128bit unlock key kSL=random and sends encryption result EkMLkSL to SL. At the same time, SL sends the encryption result EkMLInfo to MS and reports the operation information Info, where E is AES symmetric encryption algorithm and random is random generating function(5)
Users download APP through their SP. SP selects private keySKSP. SKSP is confidential and satisfying SKSP<n. SP computes public key PKSP=SKSP×P, sends public key PKSP and the request for unlock key to MS. MS will review the user’s qualification after receiving the user’s request. If the user does not have the housing qualification, the MS rejects his request(6)
If the user has the housing qualification, MS encrypts the unlock key with the received public key of the user and gets the ciphertext(5)C=E′PKSPkSLwhereE′ is elliptic curve public key cryptosystem. Then, MS sends this ciphertext and the public key PKSL to SP and sends the public key PKSP to SL at the same time. In the transmission, even if C is overheard by the adversary, the adversary cannot get kSL by decrypting C since the private key SKSP is not known.
(7)
After receiving the ciphertextC and the public key PKSL, the SP uses its private key SKSP to calculate(6)DSKSPC=DSKSPEPKSPkSL=kSL.Thus, the SP obtains the unlock keykSL of SL.
(8)
SP uses our ECC-based signcryption algorithm to generateSigncryptPKSL,SKSPkSL,t of unlock key kSL and time stamp t, sends the signcryption to SL through Bluetooth. SL uses PKSP and SKSL to calculate(7)DeSigncryptKUSP,SKSLSigncryptPKSL,SKSPkSL,t=kSL,t.After getting the unlock keykSLand time stampt, SL checks them. If the unlock key is wrong, SL will not unlock. Our ECC-based signcryption scheme plays the role of encryption and authentication at the same time. The addition of time stamp can prevent replay attack.
(9)
If the user loses the housing qualification, MS generates a new unlock key and sends it to SL. As a result, the SP cannot unlock with its old keykSLThe flow chart of our key management is shown in Figure2.Figure 2
Flow chart for key management of smart lock system.


### 4.4. Performance Analysis

In this subsection, we observe the bit-oriented overhead of our smart lock key management scheme through experimental simulations. Here, AES symmetric encryption is performed in ECB mode, and theq in the elliptic curve used in our signcryption scheme and the order q of the group G1 are both 160bit. The experimental environment is as follows: AMD Ryzen 7 5800H, reference frequency 3.20 GHz, memory 16GB (DDR4-3200 MHz), and Windows 11 operating system.As can be seen from Figure3, when the length of the unlock key is as high as21×105bit, the time consumed of our key management scheme does not exceed500s. It is worth noting that in the actual deployment of the smart lock key management system, the length of the unlock key is generally not so long. Therefore, our key management scheme is practical and efficient.Figure 3
The performance of our smart lock key management scheme.


## 4.1. The Model of the Smart Lock System

There are three main parties in a smart lock system [40], that is, smart phone (SP) of user, smart lock (SL), and management server (MS), which is shown in Figure 1. Among them, MS receives the request from the user’s SP, reviews the user’s qualification, receives the operation information of SL, manages the unlock key, and helps SL and SP exchange the public key. SL communicates with MS through narrow band Internet of Things (NB-IOT) and receives the signcryption for the unlock key. SP of the legitimate user applies for the unlock key to MS and sends the signcryption of this unlock key to SL through Bluetooth.Figure 1
Architecture of smart lock system.In the smart lock system, MS is trusted, which cannot disclose the unlock key to the adversary. MS will send correct unlock key to SL and legitimate user and cancel the unlock key of the expired user. SL is safe, controllable, and will not disclose the unlock key. The user is semi-honest. Although he will follow the rule of the key management scheme, he will try to use the obtained information to unlock when his key expires or he has no key.Each smart lock has a unique international mobile equipment identity (IMEI), which is a 15-digit “electronic serial number.” In this paper, the IMEI will be used to generate a session key for the smart lock.


## 4.2. The Overview of Key Management Scheme

In the key management scheme of the smart lock system, MS and SL generate their own private keys, respectively, and then calculate their own public keys through ECC and send the public key to each other. They realize the key exchange and generate the shared session key between them. MS generates the unlock key, uses the session key to encrypt the unlock key, and sends the encryption result to SL. SL uses the session key to encrypt its operation information and uploads the encryption result to MS. This two communications adopt AES symmetric encryption through the Nb-IOT. After the user applies to MS for the house, MS reviews the user’s qualification. If the user does not meet the conditions, MS refuses to send the key to him. If the user meets the conditions, MS sends the user’s public key to SL. At the same time, MS uses the user’s public key to encrypt the unlock key and sends the encryption result and the public key of SL to the user. The user uses his private key to decrypt the unlock key. This communication uses elliptic curve public key cryptosystem. After that, the user can use the received public key of SL and his own private key to signcrypt the unlock key and send the signcryption result to SL. SL uses the received public key of user and his own private key to de-signcrypt the signcryption, thus obtaining the unlock key. The process above uses our ECC-based signcryption scheme. Finally, SL compares the unlock key from the user with its own unlock key. If the two unlock keys are different, SL cannot be unlocked.During the lifetime, the smart lock system can periodically update the key according to the security status. If the user loses the housing qualification, MS regenerates the unlock key and sends it to SL. The user cannot unlock with the old key.


## 4.3. Our Key Management Scheme

Our key management scheme is detailed as follows:(1)
Key exchange between MS and SL. MS selects private keySKMS. SKMS is confidential and satisfying SKMS<n. MS computes public key PKMS=SKMS×P and sends PKMS to SL through NB-IOT. In the transmission, even if PKMS is attacked, the adversary cannot calculate SKMS by the known P since ECDLP problem(2)
SL selects private keySKSL. SKSL is confidential and satisfying SKSL<n. SL computes public key PKSL=SKSL×P and sends PKSL to MS through NB-IOT. In the transmission, even if PKSL is attacked, the adversary cannot calculate SKSL by the known P since ECDLP problem(3)
After the MS receivesPKSL, it uses the private key SKMS and the received PKSL to generate the secret key(3)K=SKMS×PKSL=SKMS×SKSL×P=xK,yK.Similarly, SL uses the private keySKSL and the received PKMS to generate the secret key
(4)K=SKSL×PKMS=SKSL×SKMS×P=xK,yK.The two secret keysK are equal, which only are known as MS and SL. Because the secret key K is a pair of numbers xK,yK, MS and SL can select the session key kML=xK+lastIMEI according to the factory agreement, and function lastIMEI is the last digit of IMEI of SL. Because xK is known only by MS and SL, the session key kML is also known only by them.
(4)
MS generates128bit unlock key kSL=random and sends encryption result EkMLkSL to SL. At the same time, SL sends the encryption result EkMLInfo to MS and reports the operation information Info, where E is AES symmetric encryption algorithm and random is random generating function(5)
Users download APP through their SP. SP selects private keySKSP. SKSP is confidential and satisfying SKSP<n. SP computes public key PKSP=SKSP×P, sends public key PKSP and the request for unlock key to MS. MS will review the user’s qualification after receiving the user’s request. If the user does not have the housing qualification, the MS rejects his request(6)
If the user has the housing qualification, MS encrypts the unlock key with the received public key of the user and gets the ciphertext(5)C=E′PKSPkSLwhereE′ is elliptic curve public key cryptosystem. Then, MS sends this ciphertext and the public key PKSL to SP and sends the public key PKSP to SL at the same time. In the transmission, even if C is overheard by the adversary, the adversary cannot get kSL by decrypting C since the private key SKSP is not known.
(7)
After receiving the ciphertextC and the public key PKSL, the SP uses its private key SKSP to calculate(6)DSKSPC=DSKSPEPKSPkSL=kSL.Thus, the SP obtains the unlock keykSL of SL.
(8)
SP uses our ECC-based signcryption algorithm to generateSigncryptPKSL,SKSPkSL,t of unlock key kSL and time stamp t, sends the signcryption to SL through Bluetooth. SL uses PKSP and SKSL to calculate(7)DeSigncryptKUSP,SKSLSigncryptPKSL,SKSPkSL,t=kSL,t.After getting the unlock keykSLand time stampt, SL checks them. If the unlock key is wrong, SL will not unlock. Our ECC-based signcryption scheme plays the role of encryption and authentication at the same time. The addition of time stamp can prevent replay attack.
(9)
If the user loses the housing qualification, MS generates a new unlock key and sends it to SL. As a result, the SP cannot unlock with its old keykSLThe flow chart of our key management is shown in Figure2.Figure 2
Flow chart for key management of smart lock system.


## 4.4. Performance Analysis

In this subsection, we observe the bit-oriented overhead of our smart lock key management scheme through experimental simulations. Here, AES symmetric encryption is performed in ECB mode, and theq in the elliptic curve used in our signcryption scheme and the order q of the group G1 are both 160bit. The experimental environment is as follows: AMD Ryzen 7 5800H, reference frequency 3.20 GHz, memory 16GB (DDR4-3200 MHz), and Windows 11 operating system.As can be seen from Figure3, when the length of the unlock key is as high as21×105bit, the time consumed of our key management scheme does not exceed500s. It is worth noting that in the actual deployment of the smart lock key management system, the length of the unlock key is generally not so long. Therefore, our key management scheme is practical and efficient.Figure 3
The performance of our smart lock key management scheme.


## 5. Conclusion

In this paper, we designed an efficient and secure ECC-based signcryption scheme. Our signcryption scheme has been highly efficient and satisfies multiple security properties; it can also be used for mobile device authentication. Unfortunately, our signcryption scheme is only suitable for single-factor authentication. In the future, it will be interesting to consider applying our signcryption scheme to other application scenarios.In addition, we proposed a practical and efficient key management scheme of the smart lock using our signcryption scheme firstly. Our key management scheme does not require manually memorizing the unlocking key, and every time the unlocking key is different, not being fixed. However, there has been a recent trend to study smart lock systems using deep learning methods. In addition to hand gesture recognition, face recognition is gradually popular. In the future, we will consider how to use deep learning methods in smart lock key management systems.



---

*Source: 7499836-2022-05-06.xml*