Advanced
Provably Secure Certificate-Based Signcryption Scheme without Pairings
Provably Secure Certificate-Based Signcryption Scheme without Pairings
KSII Transactions on Internet and Information Systems (TIIS). 2014. Jul, 8(7): 2554-2571
Copyright © 2014, Korean Society For Internet Information
  • Received : December 24, 2013
  • Accepted : May 15, 2014
  • Published : July 28, 2014
Download
PDF
e-PUB
PubReader
PPT
Export by style
Share
Article
Author
Metrics
Cited by
TagCloud
About the Authors
Yang Lu
Jiguo Li

Abstract
Certificate-based cryptography is a new cryptographic paradigm that provides an interesting balance between identity-based cryptography and traditional public key cryptography. It not only simplifies the complicated certificate management problem in traditional public key cryptography, but also eliminates the key escrow problem in identity-based cryptography. As an extension of the signcryption in certificate-based cryptography, certificate-based signcryption provides the functionalities of certificate-based encryption and certificate-based signature simultaneously. However, to the best of our knowledge, all constructions of certificate-based signcryption in the literature so far have to be based on the costly bilinear pairings. In this paper, we propose a certificate-based signcryption scheme that does not depend on the bilinear pairings. The proposed scheme is provably secure in the random oracle model. Due to avoiding the computationally-heavy paring operations, the proposed scheme significantly reduces the cost of computation and outperforms the previous certificate-based signcryption schemes.
Keywords
1. Introduction
I n public-key cryptography, each user has a public key and a private key. The public key is published and publicly accessible while the corresponding private key is kept secret by its owner. In traditional public key cryptography, each public key is generated with no connection to the identity of its owner. Therefore, a public key infrastructure (PKI) is employed for vouching the relationship between a user’s identity and a public key by certificates. However, the traditional PKI technology is faced with many challenges in practice, especially the complicated certificate management problem. In 1984, Shamir [1] introduced the concept of identity-based cryptography. In identity-based cryptography, a user’s public key could be an arbitrary string related to his identity and his private key is computed from his identity by a trusted authority called private key generator (PKG). The biggest merit of identity-based cryptography is that it eliminates the need for public key certificates. However, identity-based cryptography inevitably suffers from the key escrow problem since all the users’ private keys are known to the PKG.
In order to fill the gap between traditional public key cryptography and identity-based cryptography, Al-Riyami and Paterson [2] proposed the notion of certificateless public key cryptography in Asiacrypt 2003. In certificateless public key cryptography, a trusted third party called key generation center (KGC) is employed for generating a partial private key for each user. Each user independently generates a pair of secret key and public key, and then combines his own secret key with the partial private key from the KGC to generate his full private key. Since KGC does not know any user’s private key, certificateless public key cryptography overcomes the key escrow problem. However, as partial private keys should be sent from KGC to users over secure channels, certificateless public key cryptography suffers from the key distribution problem.
In Eurocrypt 2003, Gentry [3] introduced another new paradigm called certificate-based cryptography that represents an interesting balance between identity-based cryptography and traditional public key cryptography. As in traditional public key cryptography, each user in certificate-based cryptography generates a pair of public key and private key, and then requests a certificate from a trusted third party called certifier. The difference is that certificate-based cryptography provides an effective implicit certificate mechanism so that a user needs both his private key and certificate to perform cryptographic operations (such as decryption and signing), while the other communication parties need not obtain the fresh information on this user’s certificate status. As a result, certificate-based cryptography eliminates the third-party queries for the certificate status and simplifies the certificate revocation problem in traditional PKI. Furthermore, since the certifier does not know any user’s private key and the certificates can be sent to their owners publicly, certificate-based cryptography overcomes both the key escrow and distribution problems.
Since its advent, certificate-based cryptography has attracted great interest in the research community and many schemes have been proposed, including many encryption schemes ( e.g. [4 - 10] ) and signature schemes ( e.g. [11 - 16] ). As an extension of the signcryption [17] in the certificate-based setting, Li et al. [18] introduced the concept of certificate-based signcryption, which simultaneously provides the functionalities of certificate-based encryption and certificate-based signature. To the best of our knowledge, there exist three certificate-based signcryption schemes in the literature so far. All these schemes are based on the bilinear pairings. In [18] , Li et al. proposed the first certificate-based signcryption scheme based on Chen and Malone-Lee’s identity-based signcryption scheme [19] . A subsequent paper by Luo et al. [20] proposed a new certificate-based signcryption scheme alone with a security model. However, Luo et al. only partly proved the security of their scheme in the random oracle model [21] . Recently, Li et al. [22] proposed a publicly verifiable certificate-based signcryption scheme which is provably secure in the random oracle model.
In this paper, we focus on the construction of certificate-based signcryption that does not depend on the costly bilinear pairings. As we know, compared with other common cryptographic operations such as prime modular exponentiations in finite fields, the bilinear pairings may be the most expensive ones. As pairing operations will greatly aggravate the computation load of a device, they are extremely disliked by the power-constrained devices, such as wireless sensors, mobile intelligent terminals, etc. Therefore, it is interesting and worthwhile to construct cryptographic schemes without relying on bilinear parings. Based on the Schnorr signature scheme [23 , 24] and the enhanced ElGamal public key encryption scheme proposed by Fujisaki and Okamoto [25] , we develop a pairing-free certificate-based signcryption scheme. In the random oracle model, we prove that the proposed certificate-based signcryption scheme has chosen-ciphertext security under the gap Diffie-Hellman assumption and unforgeability security under the gap discrete logarithm assumption. Without pairings, our scheme significantly reduces the cost of computation and is more efficient than the previous pairing-based certificate-based signcryption schemes. This interesting property makes it be particularly suitable for the computation-limited environments, such as wireless sensor networks and mobile wireless networks.
In Section 2, we review some computational assumptions related to our paper. In Section 3, we present the definition and security model of certificate-based signcryption. The proposed certificate-based signcryption scheme is described in Section 4 and analyzed in Section 5 respectively. Finally, we draw our conclusion in Section 6.
2. Computational Assumptions
Let k be a security parameter and p be a k -bit prime number. Let G denote a cyclic group of prime order p , and g a generator of the group G . Below, we review the computational assumptions that are used to prove the security of our proposed certificate-based signcryption scheme.
Definition 1 [26] . The gap Diffie-Hellman (GDH) problem in G is, given a tuple ( g , ga , gb ) for unknown a , b Z * p and access to a decisional Diffie-Hellman (DDH) oracle ODDH that takes ( g , gu , gv , z ) as input and outputs 1 if z = guv and 0 otherwise, to compute gab . The advantage of any probabilistic polynomial-time algorithm AGDH in solving the GDH problem in G is defined as
PPT Slide
Lager Image
The GDH assumption is that, for any probabilistic polynomial-time algorithm AGDH , the advantage Adv ( AGDH ) is negligible.
Definition 2 [27] . The gap Discrete Logarithm (GDL) problem in G is, given a tuple ( g , ga ) for unknown a Z * p and access to a restricted DDH oracle OrDDH that takes ( g , ga , gb , z ) as input and outputs 1 if z = gab and 0 otherwise, to compute a . The advantage of any probabilistic polynomial-time algorithm AGDL in solving the GDL problem in G is defined as
PPT Slide
Lager Image
The GDL assumption is that, for any probabilistic polynomial-time algorithm AGDL , the advantage Adv ( AGDL ) is negligible.
3. Definition and Security Model of Certificate-Based Signcryption
In this paper, a certificate-based signcryption scheme is composed of the following five algorithms: (1) System setup algorithm Setup , which is performed by a certifier to generate a master key and a list of public system parameters; (2) Key-pair generation algorithm KeyPairGen , which is performed by the user to generate a pair of private key and partial public key; (3) Certification algorithm Certify , which is performed by a certifier to generate a certificate and public key for each user in the system; (4) Signcrypt ion algorithm Signcrypt , which is performed by a sender to signcrypt the messages; (5) Designcryption algorithm Designcrypt , which is performed by a receiver to designcrypt the ciphertext sent to him.
Fig. 1 gives the functional description of a certificate-based signcryption scheme.
PPT Slide
Lager Image
Functional description of certificate-based signcryption
Definition 3. A certificate-based signcryption scheme Π = ( Setup , KeyPairGen , Certify , Signcrypt , Designcrypt ) is said to be correct if for any message m , m = Designcrypt ( params , Signcrypt ( params , m , idS , PKS , SKS , CertS , idR , PKR ), idR , SKR , CertR , idS , PKS ), where params are obtained from the system setup algorithm Setup , ( SKS , PKS , CertS ) and ( SKR , PKR , CertR ) are respectively generated according to the the specifications of the key-pair generation algorithm KeyPairGen and the certification algorithm Certify .
As introduced in [20 , 22] , the security model for certificate-based signcryption includes two types of adversaries: Type-I and Type-II. A Type-I adversary (denoted by AI ) simulates a user who wants to gain some information about a message sent to him from its encryption without a certificate. A Type-II adversary (denoted by AII ) simulates a malicious certifier in possession of the master key who wants to attack a target user without the knowledge of this user’s private key.
To simulate potential attacking scenarios, we will use the following six oracles which can be accessed by the adversaries. We assume that the game simulator keeps a history of “query-answer” while interacting with the adversaries. The six oracles are described as follows:
(1) OCreateUser-I ( idU ): This oracle is only queried by the Type-I adversary AI . On input an identity idU , if idU has already been created, the game simulator responds with the public key PKU associated with the identity idU . Otherwise, the game simulator generates a set of private key SKU , public key PKU and certificate CertU for the identity idU , and then returns PKU as the output. In this case, idU is said to be created. For simplicity, we assume that other oracles only respond to an identity which has been created.
(2) OCreateUser-II ( idU ): This oracle is only queried by the Type-II adversary AII . On input an identity idU , if idU has already been created, the game simulator responds with the public key PKU associated with the identity idU . Otherwise, the game simulator first generates a private key SKU and a partial public key PPKU for the identity idU , and then outputs PPKU to AII . Different from OCreateUser-I , this oracle requires AII to help the game simulator to create a new user. As AII simulates a malicious certifier who will generate a full public key and a certificate for any user by itself, it is possible that the game simulator is not aware of the secret(s) used by AII to generate the public key and the certificate of a user. Therefore, when creating a new user, AII should submit the secret(s) to the game simulator. Under the help of AII , the game simulator generates a full public key PKU and a certificate CertU for the identity idU . In this case, idU is said to be created. Similarly, we assume that other oracles only respond to an identity which has been created.
(3) ORequestPrivateKey ( idU ): On input an identity idU , the game simulator outputs the private key SKU associated with the identity idU .
(4) ORequestCertificate ( idU ): On input an identity idU , the game simulator outputs the certificate CertU associated with the identity idU .
(5) OSigncrypt ( m , idS , idR ): On input a message m , a sender’s identity idS and a receiver’s identity idR , the game simulator responds with the result of Signcrypt ( params , m , idS , PKS , SKS , CertS , idR , PKR ). Note that we disallow queries where idS = idR .
(6) ODesigncrypt ( σ , idS , idR ): On input a ciphertext σ , a sender’s identity idS and a receiver’s identity idR , the challenger responds with the result of Designcrypt ( params , σ , idR , SKR , CertR , idS , PKS ). Again, we disallow queries where idS = idR .
A certificate-based signcryption scheme should satisfy both confidentiality (indistinguishability against adaptive chosen-ciphertext attacks (IND-CBSC-CCA2)) and unforgeability (existential unforgeability against adaptive chosen-messages attacks (EUF-CBSC-CMA)).
For the confidentiality, we consider the following two different adversarial games “IND-CBSC-CCA2 Game-I” and “IND-CBSC-CCA2 Game-II”. IND-CBSC-CCA2 Game-I is the game played between the Type-I adversary AI and a game simulator, in which state represents some state information, Oracles-I means that the adversary AI can adaptively query the oracles { OCreateUser-I , ORequestPrivateKey , ORequestCertificate , OSigncrypt , ODesigncrypt } with the following constraints: (1) The identity id * R cannot be submitted to the oracle ORequestCertificate ; (2) ( σ * , id * S , id * R ) cannot be submitted to the oracle ODesigncrypt . IND-CBSC-CCA2 Game-II is the game played between the Type-II adversary AII and a game simulator, in which state represents some state information, Oracles-II means that the adversary AII can adaptively query the oracles { OCreateUser-II , ORequestPrivateKey , OSigncrypt , ODesigncrypt } with the following constraints: (1) The identity id * R cannot be submitted to the oracle ORequestPrivateKey ; (2) ( σ * , id * S , id * R ) cannot be submitted to the oracle ODesigncrypt .
PPT Slide
Lager Image
In both two games, we say that an adversary wins the game if b = b' . The adversary’s advantage in winning the game is defined to be Adv ( AX ) = 2|Pr[ b = b' ] - 1/2|, where X is either I or II.
Definition 4. A certificate-based signcryption scheme is said to be IND-CBSC-CCA2 secure if no probabilistic polynomial-time adversary has non-negligible advantage in both the games IND-CBSC-CCA2 Game-I and IND-CBSC-CCA2 Game-II.
For the unforgeability, we consider the following two different adversarial games “EUF-CBSC-CMA Game-I” and “EUF-CBSC-CMA Game-II”. EUF-CBSC-CMA Game-I is the game played between the Type-I adversary AI and a game simulator, in which Oracles-III means that the adversary AI can adaptively query the oracles { OCreateUser-I , ORequestPrivateKey , ORequestCertificate , OSigncrypt , ODesigncrypt } with the following constraints: (1) The identity id * S cannot be submitted to the oracle ORequestCertificate ; (2) ( σ * , id * S , id * R ) is not produced by the oracle OSigncrypt . EUF-CBSC-CMA Game-II is the game played between the Type-II adversary AII and a game simulator, in which Oracles-IV means that the adversary AII can adaptively query the oracles { OCreateUser-II , ORequestPrivateKey , OSigncrypt , ODesigncrypt } with the following constraints: (1) The identity id * S cannot be submitted to the oracle ORequestPrivateKey ; (2) ( σ * , id * S , id * R ) is not produced by the oracle OSigncrypt .
PPT Slide
Lager Image
In both two games, we say that an adversary wins the game if it outputs a valid forgery ( σ * , id * S , id * R ), namely that the result of Designcrypt ( params , σ * , id * R , SK * R , Cert * R , id * S , PK * S ) is not the symbol ⊥ . The adversary’s advantage is defined to be the probability that it wins the game.
Definition 5. A certificate-based signcryption scheme is said to be EUF-CBSC-CMA secure if no probabilistic polynomial-time adversary has non-negligible advantage in both the adversarial games EUF-CBSC-CMA Game-I and EUF-CBSC-CMA Game-II.
4. Description of the Proposed Certificate-Based Signcryption Scheme
We now present the proposed certificate-based signcryption scheme. As mentioned previously, our scheme is based on the Schnorr signature scheme [23 , 24] and the enhanced ElGamal public key encryption scheme proposed by Fujisaki and Okamoto [25] . A formal description of the scheme is as follows:
(1) Setup ( k ): The certifier performs as follows: choose a group G of k -bit prime order p and a random generator g G ; choose a random value α Z * p and compute g 1 = ga ; choose three cryptographic hash functions H 1 : {0,1} * × G × G Z * p , H 2 :{0,1} lm × G × {0,1} * × G × G Z * p and H 3 : G →{0,1} lm , where lm denotes the bit-length of a plaintext; output a list of public parameters params = { G , p , g , g 1 , lm , H 1 , H 2 , H 3 } and a master key msk = α .
(2) KeyPairGen ( params ): A user with identity idU chooses a random value x Z * p as his private key SKU and computes his partial public key PPKU = gx .
(3) Certify ( params , msk , idU , PPKU ): The certifier performs as follows: set PKU (1) = PPKU ; choose a random value y Z * p and compute PKU (2) = gy ; compute CertU = y + αH 1 ( idU , PKU (1) , PKU (2) ); output the user idU ’s public key PKU = ( PKU (1) , PKU (2) ) and certificate CertU .
(4) Signcrypt ( params , m , idS , PKS , SKS , CertS , idR , PKR ): To send a message m ∈ {0,1} lm to a user idR , the sender idS does the following: choose a random value r Z * p and compute R = gr ; compute u = r ( SKS + CertS + h ) -1 , where h = H 2 ( m , R , idS , PKS (1) , PKS (2) ); compute v = ( PKR (1) ⋅, PKR (2) g 1 H1(idR,PKR(1),PKR(2)) ) r and then c = m H 3 ( v ); output the ciphertext σ = ( h , u , c ).
(5) Designcrypt ( params , σ , idR , SKR , CertR , idS , PKS ): To designcrypt a ciphertext σ from the sender idS , the receiver idR does the following: parse the ciphertext σ as ( h , u , c ); compute R' = ( PKS (1) ⋅, PKS (2) g 1 H1(idS,PKS(1),PKS(2)) gh ) u and then v' = ( R' ) SKR+CertR ; compute m' = c H 3 ( v' ); check whether h = H 2 ( m' , R' , idS , PKS (1) , PKS (2) ). If it does, output the message m' , otherwise output an invalid symbol ⊥.
5. Analysis of the Proposed Certificate-Based Signcryption Scheme
- 5.1 Correctness
Theorem 1. The proposed certificate-based signcryption scheme is correct.
Proof. This theorem can be proved by the following equations:
R' = ( PKS (1) PKS (2) g 1 H1(idS,PKS(1),PKS(2)) gh ) u =
PPT Slide
Lager Image
= gr = R , v' = ( R' ) SKR+CertR = g r(SKR+CertR) = ( PKR (1) PKR (2) g 1 H1(idR,PKR(1),PKR(2)) ) r = v .
- 5.2 Security
We show that our scheme achieves the IND-CBSC-CCA2 security under the GDH assumption and the EUF-CBSC-CMA security under the GDL assumption in the random oracle model.
Theorem 2. In the random oracle model, the proposed certificate-based signcryption scheme is IND-CBSC-CCA2 secure under the GDH assumption.
This theorem can be proved by combining the following two lemmas.
Lemma 1. Suppose that H 1 ~ H 3 are random oracles and AI is a Type-I adversary against the IND-CBCS-CCA2 security of the proposed scheme with advantage ε and running time τ . Assume also that AI makes at most qcu queries to the oracle OCreateUser-I , qpri queries to the oracle ORequestPrivateKey , qcer queries to the oracle ORequestCertificate , qsc queries to the oracle OSigncrypt , qdsc queries to the oracle ODesigncrypt and qi queries to the random oracles Hi (1 ≤ i ≤ 3) respectively. Then there exists an algorithm AGDH to solve the GDH problem in the group G with advantage
PPT Slide
Lager Image
and running time τ' τ + ( q 1 + q 2 + q 3 + qcer + qpri ) O (1) + qcu (3 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τDDH + O (1)), where τexp and τDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the DDH oracle.
Proof. Assume that the algorithm AGDH is given a random GDH problem instance ( G , p , g , ga , gb , ODDH ). Its goal is to compute gab by interacting with AI as follows:
At the beginning of the game, the algorithm AGDH randomly chooses an index θ ∈ [1, qcu ] and sets g 1 = ga . It then starts IND-CBCS-CCA2 Game-I by supplying the adversary AI with the public parameters params = { G , p , g , g 1 , lm , H 1 , H 2 , H 3 }, where H 1 ~ H 3 are random oracles controlled by AGDH . Note that the certifier’s master key is the value a which is unknown to the algorithm AGDH .
During the query-answer phase, the adversary AI can adaptively make queries to the oracles H 1 , H 2 , H 3 , OCreateUser-I , ORequestPrivateKey , ORequestCertificate , OSigncrypt and ODesigncrypt . The algorithm AGDH responds as follows:
H 1 queries : AGDH maintains a list H 1 List of tuples 〈 idi , PKi (1) , PKi (2) , h 1 〉. On receiving such a query on ( idi , PKi (1) , PKi (2) ), AGDH first checks if H 1 List contains a tuple 〈 idi , PKi (1) , PKi (2) , h 1 〉. If it does, AGDH outputs h 1 to AI directly. Otherwise, it outputs a random value h 1 Z * p to AI and inserts a new tuple 〈 idi , PKi (1) , PKi (2) , h 1 〉 into H 1 List.
H 2 queries : AGDH maintains a list H 2 List of tuples 〈 m , R , idi , PKi (1) , PKi (2) , h 2 〉. On receiving such a query on ( m , R , idi , PKi (1) , PKi (2) ), AGDH first checks if H 2 List contains a tuple 〈 m , R , idi , PKi (1) , PKi (2) , h 2 〉. If it does, AGDH outputs h 2 to AI directly. Otherwise, it outputs a random value h 2 Z * p to AI and inserts a new tuple 〈 m , R , idi , PKi (1) , PKi (2) , h 2 〉 into H 2 List.
H 3 queries : AGDH maintains a list H 3 List of tuples 〈 v , h 3 〉. On receiving such a query on v , AGDH first checks if H 3 List contains a tuple 〈 v , h 3 〉. If it does, AGDH outputs h 3 to AI directly. Otherwise, it outputs a random value v ∈ {0,1} lm to AI and inserts a new tuple 〈 v , h 3 〉 into H 3 List.
OCreateUser-I queries : AGDH maintains a list UserList of tuples 〈 idi , SKi , PKi , Certi 〉. On receiving such a query on idi , AGDH performs as follows: (1) If UserList contains a tuple 〈 idi , SKi , PKi , Certi 〉, output PKi to AI directly; (2) Otherwise, if idi is the θ -th distinct identity submitted to this oracle, choose two random values xθ , yθ Z * p , set SKθ = xθ and compute PKθ =( gxθ , gyθ ), insert a new tuple 〈 idθ , SKθ , PKθ , ⊥〉 into UserList and output PKθ to AI ; (3) Otherwise, randomly choose xi , ti , ei Z * p , set SKi = xi and Certi = ti , compute PKi = ( PKi (1) , PKi (2) ) = ( gxi , gti , g 1 ei ), insert 〈 idi , PKi (1) , PKi (2) , ei 〉 and 〈 idi , SKi , PKi , Certi 〉 into H 1 List and UserList respectively, and output PKi to AI .
ORequestPrivateKey queries : On receiving such a query on idi , AGDH retrieves a tuple of the form 〈 idi , SKi , PKi , Certi 〉 from the list UserList and returns SKi to AI .
ORequestCertificate queries : On receiving such a query on idi , AGDH aborts if idi = idθ . Otherwise, it retrieves a tuple of the form 〈 idi , SKi , PKi , Certi 〉 from UserList and returns Certi to AI .
OSigncrypt queries : On receiving such a query on ( m , idS , idR ), AGDH does the following: (1) If idS = idθ , AGDH randomly chooses u , h 2 Z * p , h 3 ∈{0,1} lm , runs the simulation algorithm for the random oracle H 1 to get h 1 = H 1 ( idS , PKS (1) , PKS (2) ), and computes R = (
PPT Slide
Lager Image
g 1 h1 g h2 ) u , v = R SKR+CertR , c = m h 3 . Then, AGDH inserts 〈 m , R , idθ , PKθ (1) , PKθ (2) , h 2 〉 and 〈 v , h 3 〉 into H 2 List and H 3 List respectively and returns σ = ( h 2 , u , c ) as the ciphertext to AI . Note that AGDH fails if H 2 List or H 3 List is already defined in the corresponding value but this only happens with probability smaller than ( q 2 + q 3 + 2 qsc )/2 k . (2) Otherwise, AGDH can answer the query according to the specification of the algorithm Signcrypt since it knows the sender idS ’s private key and certificate.
ODesigncrypt queries : On receiving such a query on ( σ = ( h , u , c ), idS , idR ), AGDH does the following: (1) If idR = idθ , AGDH first runs the simulation algorithm for the random oracle H 1 to get h 1 = H 1 ( idR , PKR (1) , PKR (2) ) and h' 1 = H 1 ( idS , PKS (1) , PKS (2) ), and then checks if there exist a tuple 〈 m , R , idS , PKS (1) , PKS (2) , h 〉 in H 2 List and a tuple 〈 v , h 3 〉 in H 3 List such that R = ( PKS (1) PKS (2) g 1 h'1 gh ) u , m = c h 3 and ODDH ( g , R , PKR (1) PKR (2) g 1 h1 , v ) = 1. If such two tuples exist, AGDH returns m to AI as the designcryption of σ ; otherwise, it rejects σ . Note that a valid ciphertext is rejected with probability smaller than qdsc /2 k across the whole game. (2) Otherwise, AGDH designcrypts σ in the normal way since it knows the receiver idR ’s private key and certificate.
At the challenge phase, AI outputs two distinct messages m 0 and m 1 of equal length, a sender identity id * S and a receiver identity id * R , on which it wants to be challenged. If id * R idθ ≠, then AGDH aborts. Otherwise, AGDH randomly chooses c * ∈ {0,1} lm and u * , h * 2 , ∈ Z * p , sets R * = gb , and outputs σ * = ( h * 2 , u * , c * ) as the challenge ciphertext to AI . Observe that the decryption of c * is c * H 3 ( PKθ (1) PKθ (2) g 1 H1(idθ, PKθ(1), PKθ(2)) ) b ).
At the guess phase, AI outputs a bit which is ignored by AGDH . Note that AI cannot recognize that the challenge ciphertext σ * is an invalid ciphertext unless it queries H 3 ( PKθ (1) PKθ (2) g 1 H1(idθ, PKθ(1), PKθ(2)) ) b ). It is clear that a successful AI is very likely to query H 3 ( PKθ (1) PKθ (2) g 1 H1(idθ, PKθ(1), PKθ(2)) ) b ) if the simulation is indistinguishable from a real attack environment. To produce a result, AGDH randomly chooses a tuple 〈 v , h 3 〉 from H 3 List and outputs
PPT Slide
Lager Image
as the solution to the given GDH problem. Obviously, if v = ( PKθ (1) PKθ (2) g 1 H1(idθ, PKθ(1), PKθ(2)) ) b , then we have T = gab .
This completes the simulation. We now estimate the advantage of AGDH in solving the given GDH problem. From the above construction, the simulation fails if any of the following events occurs: (1) E 1 : AI does not choose idθ as the challenge receiver identity id * R ; (2) E 2 : AI queries ORequestCertificate on the identity idθ ; (3) E 3 : AGDH aborts in answer AI ’s query to OSigncrypt because of a collision on H 2 or H 3 ; (4) E 4 : AGDH rejects a valid ciphertext at some point of the game. We clearly have that Pr[¬ E 1 ] = 1/ qcu and ¬ E 1 implies ¬ E 2 . We also already observed that Pr[ E 3 ] ≤ qsc ( q 2 + q 3 + 2 qsc )/2 k and Pr[ E 4 ] ≤ qdsc /2 k . Thus, we have that
PPT Slide
Lager Image
Since AGDH selects the correct tuple from H 3 List with probability 1/( q 3 + qsc ), we have that the advantage of AGDH in solving the GDH problem is
PPT Slide
Lager Image
The time complexity of the algorithm AGDH is dominated by the exponentiations and the calls to the DDH oracle in the oracle simulations. From the above description of AGDH , it is easy to see that thetime complexity of AGDH is bound by τ' τ + ( q 1 + q 2 + q 3 + qcer + qpri ) O (1) + qcu (3 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τDDH + O (1)) , where τexp and τDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the DDH oracle.
Lemma 2. Suppose that H 1 ~ H 3 are random oracles and AII is a Type-II adversary against the IND-CBCS-CCA2 security of the proposed scheme with advantage ε and running time τ . Assume also that AII makes at most qcu queries to the oracle OCreateUser-II , qpri queries to the oracle ORequesrPrivateKey , qsc queries to the oracle OSigncrypt , qdsc queries to the oracle ODesigncrypt and qi queries to the random oracles Hi (1 ≤ i ≤ 3). Then there exists an algorithm AGDH to solve the GDH problem in the group G with advantage
PPT Slide
Lager Image
and running time τ' τ + ( q 1 + q 2 + q 3 + qpri ) O (1) + qcu (2 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τDDH + O (1)), where τexp and τDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the DDH oracle.
Proof. Assume that AGDH is given a random GDH problem instance ( G , p , g , ga , gb , ODDH ). Its goal is to compute gab by interacting with AII as follows:
At the beginning of the game, AGDH first randomly chooses α Z * p and an index θ ∈ [1, qcu ]. It then computes g 1 = ga and starts IND-CBSC-CCA2 Game-II by supplying AII with the master key msk = α and the public parameters params = { G , p , g , g 1 , lm , H 1 , H 2 , H 3 }, where H 1 ~ H 3 are random oracles controlled by AGDH .
During the question-answer phase, AII can adaptively make queries to the oracles H 1 , H 2 , H 3 , OCreateUser-II , ORequestPrivateKey , OSigncrypt and ODesigncrypt . AGDH answers AII ’s queries to H 1 , H 2 , H 3 , OSigncrypt and ODesigncrypt as in the proof of Lemma 1 and handles other queries as follows:
OCreateUser-II queries : AGDH maintains a list UserList of tuples 〈 idi , SKi , PKi , Certi , yi 〉. On receiving such a query on idi , AGDH performs as follows: (1) If UserList contains a tuple 〈 idi , SKi , PKi , Certi , yi 〉, output PKi to AII directly. (2) Otherwise, if idi is the θ -th distinct identity submitted to this oracle, set PKθ (1) = ga and output PKθ (1) to AII . After receiving a value yθ Z * p from AII , compute PKθ (2) = gyθ , run the simulation algorithm for the random oracle H 1 to get a hash value h 1 = H 1 ( idθ , PKθ (1) , PKθ (2) ), compute Certθ = yθ + αh 1 and insert a new tuple 〈 idθ , ⊥, PKθ , Certθ , yθ 〉 into UserList. (3) Otherwise, randomly choose xi Z * p , set SKi = xi , compute PKi (1) = gxi and output PKi (1) to AII . After receiving a value yi Z * p from AII , compute PKi (2) = gyi , run the simulation algorithm for the random oracle H 1 to get a hash value h 1 = H 1 ( idi , PKi (1) , PKi (2) ) , compute Certi = yi + αh 1 and insert a new tuple 〈 idi , SKi , PKi , Certi , yi 〉 into UserList.
ORequestPrivateKey queries : On receiving such a query on idi , AGDH aborts if idi = idθ . Otherwise, it retrieves a tuple of the form 〈 idi , SKi , PKi , Certi , yi 〉 from UserList and returns SKi to AII .
At the challenge phase, AII outputs two distinct messages m 0 and m 1 of equal length, a sender identity id * S and a receiver identity id * R , on which it wants to be challenged. If id * R idθ , AGDH aborts. Otherwise, AGDH randomly chooses c * ∈ {0,1} lm and u * , h * 2 , ∈ Z * p , sets R * = gb , and outputs σ * = ( h * 2 , u * , c * ) to AII as the challenge ciphertext. Observe that the decryption of c * is c * H 3 ( PKθ (1) PKθ (2) g 1 H1(idθ,PKθ(1),PKθ(2)) ) b ).
At the guess phase, AII outputs a bit which is ignored by AGDH . Note that AII cannot recognize that the challenge ciphertext σ * is not a valid ciphertext unless it queries H 3 ( PKθ (1) PKθ (2) g 1 H1(idθ,PKθ(1),PKθ(2)) )b). It is clear that a successful AII is very likely to query H 3 ( PKθ (1) PKθ (2) g 1 H 1 ( idθ , PKθ (1) , PKθ (2) )) b ). if the simulation is indistinguishable from a real attack environment. To produce a result, AGDH randomly chooses a tuple 〈 v , h 3 〉 from H 3 List and outputs
PPT Slide
Lager Image
as the solution to the given GDH problem. Obviously, if v = ( PKθ (1) PKθ (2) g 1 H1(idθ,PKθ(1),PKθ(2)) ) b , then we have T = gab .
We now estimate the advantage of AGDH in solving the given GDH problem.
From the above construction, the simulation fails if any of the following events occurs: (1) E 1 : AII does not choose idθ as the challenge receiver identity id * R ; (2) E 2 : AII queries ORequestPrivateKey on the identity idθ ; (3) E 3 : AGDH aborts in answer AII ’s OSigncrypt query because of a collision on H 2 or H 3 ;(4) E 4 : AGDH rejects a valid ciphertext at some point of the game. We clearly have that Pr[¬ E 1 ] = 1/ qcu and ¬ E 1 implies ¬ E 2 . We also already observed that Pr[ E 3 ] ≤ qsc ( q 2 + q 3 + 2 qsc )/2 k and Pr[ E 4 ] ≤ qdsc /2 k . Thus, we have that
PPT Slide
Lager Image
Since AGDH selects the correct tuple from H 3 List with probability 1/( q 3 + qsc ), the advantage of AGDH in solving the GDH problem is
PPT Slide
Lager Image
The time complexity of the algorithm AGDH is dominated by the exponentiations and the calls to the DDH oracle in the oracle simulations. From the above description of AGDH , it is easy to see that thetime complexity of AGDH is bound by τ' τ + ( q 1 + q 2 + q 3 + qpri ) O (1) + qcu (2 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τDDH + O (1)), where τexp and τDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the DDH oracle.
Theorem 3. In the random oracle model, the proposed certificate-based signcryption scheme is EUF-CBSC-CMA secure under the GDL assumption.
This theorem can be proved by combining the following two lemmas.
Lemma 3. Suppose that H 1 ~ H 3 are random oracles and AI is a Type-I adversary against the EUF-CBSC-CMA security of the proposed scheme who makes at most qcu queries to the oracle OCreateUser-I , qpri queries to the oracle ORequestPrivateKey , qcer queries to the oracle ORequestCertificate , qsc queries to the oracle OSigncrypt , qdsc queries to the oracle ODesigncrypt and qi queries to the random oracles Hi (1 ≤ i ≤ 3). Assume also that AI produces a forgery with probability ε ≥ ( qsc + 1)( qsc + q 2 )/2 k within atime τ . Then there exists an algorithm AGDL to solve the GDL problem in the group G with advantage ε' ≥ 1/9 and running time τ' ≤ 23 qcu q 2 [ τ + ( q 1 + q 2 + q 3 + qcer + qpri ) O (1) + qcu (2 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τrDDH + O (1))][ ε (1 - qdsc /2 k )(1 - qsc ( q 2 + q 3 + 2 qsc )/2 k )] -1 , where τexp and τrDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the restricted DDH oracle.
Proof. Assume that AGDL is given a random GDL problem instance ( G , p , g , ga , OrDDH ). Its goal is to compute a by interacting with AI as follows:
At the beginning of the game, AGDL first randomly chooses α Z * p and an index θ ∈ [1, qcu ]. It then computes g 1 = gα and starts EUF-CBSC-CMA Game-I by supplying AI with the public parameters params = { G , p , g , g 1 , lm , H 1 , H 2 , H 3 }, where H 1 ~ H 3 are random oracles controlled by AGDL .
During the query-answer phase, AI can adaptively make queries to the oracles H 1 , H 2 , H 3 , OCreateUser-I , ORequestPrivateKey , ORequestCertificate , OSigncrypt and ODesigncrypt . AGDL answers AI ’s queries to H 1 , H 2 , H 3 , ORequestPrivateKey , ORequestCertificate and OSigncrypt in the same way as the proof of Lemma 1 and handles other queries as follows:
OCreateUser-I queries : AGDL maintains a list UserList of tuples 〈 idi , SKi , PKi , Certi 〉. On receiving such a query on idi , AGDL performs as follows: (1) If UserList contains a tuple 〈 idi , SKi , PKi , Certi 〉, output PKi to AI . (2) Otherwise, if idi is the θ -th distinct identity submitted to this oracle, randomly choose xθ Z * p , set SKθ = xθ and PKθ = ( gxθ , ga ), insert 〈 idθ , SKθ , PKθ , ⊥〉 into UserList and output PKθ to AI . (3) Otherwise, randomly choose xi , yi Z * p , set SKi = xi and PKi = ( PKi (1) , PKi (2) ) = ( gxi , gyi ); run the simulation algorithm for the random oracle H 1 to get a hash value h 1 = H 1 ( idi , PKi (1) , PKi (2) ) and compute Certi = yi + αh 1 ; insert 〈 idi , SKi , PKi , Certi 〉 into UserList and output PKi to AI .
ODesigncrypt queries : On receiving such a query on ( σ = ( h , u , c ), idS , idR ), AGDL does the following: (1) If idR = idθ , AGDL first runs the simulation algorithm for the random oracle H 1 to get h 1 = H 1 ( idR , PKR (1) , PKR (2) ) and h' 1 = H 1 ( idS , PKS (1) , PKS (2) ), and then checks if there exist a tuple 〈 m , R , idS , PKS (1) , PKS (2) , h 〉 in H 2 List and a tuple 〈 v , h 3 〉 in H 3 List such that R = ( PKS (1) PKS (2) g 1 h'1 gh ) u , m = c h 3 and OrDDH ( g , ga , R , v R SKRαh1 ) = 1. If such two tuples exist, AGDL returns m to AI as the designcryption of σ ; otherwise, it rejects σ . Note that a valid ciphertext is rejected with probability smaller than qdsc /2 k across the whole game. (2) Otherwise, AGDL can answer the query according to the specification of the algorithm Signcrypt since it knows the sender idR ’s private key and certificate.
Finally, AI outputs a valid ciphertext σ * = ( h * , u * , c * ) from id * S to id * R . If id * S idθ , then AGDL aborts. Otherwise, having the knowledge of id * R ’s private key and certificate, AGDL can designcrypt σ * to obtain m * and R * . Then, AGDL uses the oracle replay technique [28] to generate one more valid ciphertext σ *′ = ( h *′ , u *′ , c *′ ) from σ * such that h * h *′ and u * u *′ . Since σ * and σ *′ are both valid ciphertexts for the same message and randomness, we obtain the following relations:
PPT Slide
Lager Image
where h 1 = H 1 ( idθ , PKθ (1) , PKθ (2) ). Then, we have
PPT Slide
Lager Image
PPT Slide
Lager Image
PPT Slide
Lager Image
Therefore, AGDL can compute
PPT Slide
Lager Image
as the solution to the given GDL problem.
From the Lemma 4 in [28] , if AI produces a forgery with probability ε ≥ 10( qsc + 1)( qsc + q 2 )/2 k , then AGDL can use the oracle replay technique to generate one more valid ciphertext with advantage ε' ≥ 1/9. Since AGDL can resolve the given GDL problem after it generates one more valid ciphertext from the valid ciphertext forged by AI , we get that the advantage of AGDL in solving the GDL problem is ε' ≥ 1/9.
Also from the Lemma 4 in [28] , thetime complexity of AGDL in solving the given GDL problem is bound by τ' ≤ 23 qcuq 2 [ τ + ( q 1 + q 2 + q 3 + qcer + qpri ) O (1) + qcu (2 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τrDDH + O (1))][ ε (1 - qdsc /2 k )(1 - qsc ( q 2 + q 3 + 2 qsc )/2 k )] -1 , where τexp and τrDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the restricted DDH oracle.
Lemma 4. Suppose that H 1 ~ H 3 are random oracles and AII is a Type-II adversary against the EUF-CBSC-CMA security of the proposed scheme that makes at most qcu queries to the oracle OCreateUser-II , qpri queries to the oracle ORequestPrivateKey , qsc queries to the oracle OSigncrypt , qdsc queries to the oracle ODesigncrypt and qi queries to the random oracles Hi (1 ≤ i ≤ 3). Assume also that AII produces a forgery with probability ε ≥ 10( qsc + 1)( qsc + q 2 )/2 k within atime τ . Then there exists an algorithm AGDL to solve the GDL problem in the group G with advantage ε' ≥ 1/9 and running time τ' ≤ 23 qcuq 2 [ τ + ( q 1 + q 2 + q 3 + qpri ) O (1) + qcu (2 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τrDDH + O (1))][ ε (1 - qdsc /2 k )(1 - qsc ( q 2 + q 3 + 2 qsc )/2 k )] -1 , where τexp and τrDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the restricted DDH oracle.
Proof. Assume that AGDL is given a random GDL problem instance (G, p , g , ga , OrDDH ). Its goal is to compute a by interacting with AII as follows:
At the beginning of the game, AGDL first randomly chooses α Z * p and an index θ ∈ [1, qcu ]. It then computes g 1 = ga and starts EUF-CBSC-CMA Game-II by supplying AII with the master key msk = α and the public parameters params = { G , p , g , g 1 , lm , H 1 , H 2 , H 3 }, where H 1 ~ H 3 are random oracles controlled by AGDL .
During the query-answer phase, AII can adaptively make queries to the oracles H 1 , H 2 , H 3 , OCreateUser-II , ORequestPrivateKey , OSigncrypt and ODesigncrypt . AGDL answers AII ’s queries to H 1 , H 2 , H 3 , OCreateUser-II , ORequestPrivateKey and OSigncrypt in the same way as the proof of Lemma 2 and and handles other queries as follows:
ODesigncrypt queries : On receiving such a query on ( σ = ( h , s , c ), idS , idR ), AGDL does the following: (1) If idR = idθ , AGDL first runs the simulation algorithm for the random oracle H 1 to get h 1 = H 1 ( idR , PKR (1) , PKR (2) ) and h' 1 = H 1 ( idS , PKS (1) , PKS (2) ), and then checks if there exist a tuple 〈 m , R , idS , PKS (1) , PKS (2) , h 〉 in H 2 List and a tuple 〈 v , h 3 〉 in H 3 List such that R = PKS (1) PKS (2) g 1 h' 1 gh ) u , m = c h 3 and OrDDH ( g , ga , R , v R−CertR ) = 1. If such two tuples exist, AGDL returns m to AII as the designcryption of σ ; otherwise, it rejects σ . Note that a valid ciphertext is rejected with probability smaller than qdsc /2 k across the whole game. (2) Otherwise, AGDL designcrypts σ in the normal way since it knows the receiver idR ’s private key and certificate.
Finally, AII outputs a valid ciphertext σ * = ( h * , u * , c * ) from id * S to id * R . If id * S idθ , then AGDL aborts. Otherwise, having the knowledge of the user id * R ’s private key and certificate, AGDL can designcrypt σ * to obtain m * and R * . Then, AGDL uses the oracle replay technique [28] to generate one more valid ciphertext σ *′ = ( h *′ , u *′ , c *′ ) from σ * such that h * h *′ and u * u *′ . Since σ * and σ *′ are both valid ciphertexts for the same message and randomness, we obtain the following relations:
PPT Slide
Lager Image
where h 1 = H 1 ( idθ , PKθ (1) , PKθ (2) ). Then, we have
PPT Slide
Lager Image
PPT Slide
Lager Image
PPT Slide
Lager Image
Therefore, AGDL can compute
PPT Slide
Lager Image
as the solution to the given GDL problem.
From the Lemma 4 in [28] , if AII produces a forgery with probability ε ≥ 10( qsc + 1)( qsc + q 2 )/2 k , then AGDL can use the oracle replay technique to generate one more valid ciphertext with advantage ε' ≥ 1/9. Since AGDL can resolve the given GDL problem after it generates one more valid ciphertext from the valid ciphertext forged by AII , we get that the advantage of AGDL in solving the GDL problem is ε' ≥ 1/9.
Also from the Lemma 4 in [28] , thetime complexity of AGDL in solving the given GDL problem is bound by τ' ≤ 23 qcuq 2 [ τ + ( q 1 + q 2 + q 3 + qpri ) O (1) + qcu (2 τexp + O (1)) + qsc (4 τexp + O (1)) + qdsc (4 τexp + τrDDH + O (1))][ ε (1 - qdsc /2 k )(1 - qsc ( q 2 + q 3 + 2 qsc )/2 k )] -1 , where τexp and τrDDH respectively denote thetime for computing an exponentiation in G and the one for a call to the restricted DDH oracle.
- 5.3 Performance Comparison
We next make a comparison of our proposed scheme and the previous certificate-based signcryption schemes.
The details of the compared schemes are listed in Table 1 , where we compare the schemes on computation complexity of signcryption and designcryption. We mainly consider four atomic operations: pairing, exponentiation in GT , exponentiation in G and hash. Here G is an additive or multiplicative cyclic group, GT is the target group in the setting of bilinear pairing, i.e. , the bilinear pairing is e : G × G GT . For simplicity, we denote these operations by Pa , ExpGT , ExpG and Ha respectively.
Comparison of the certificate-based signcryption schemes
PPT Slide
Lager Image
Comparison of the certificate-based signcryption schemes
From Table 1 , we can see that both the signcryption and designcryption algorithms in our scheme need computing four exponentiations and three hashes. In any other existing paring-based certificate-based signcryption scheme, the signcryption algorithm requires computing at least one bilinear pairing, five exponentiations and three hashes while the designcryption algorithm requires computing at least three pairings, two exponentiations and three hashes. Actually, the computation performance of our scheme can be further optimized when g 1 H1(idU,PKU(1), PKU(2)) can be pre-computed. Such a pre-computation enables us to additionally reduce one exponentiation and one hash computation in both the signcryption algorithm and the designcryption algorithm.
To give a much clearer comparison and also show that our scheme is more suitable for the computation-limited devices, we make a concretetime analysis of the compared schemes. The results are given in Table 2 . Here, we estimate the computationtime of the compared schemes on a standard MICA2 sensor node. According to the experiment results in [29 , 30] , for 80-bit security, one pairing computation takes 1.90s and one exponentiation in the group G takes 0.32s on a MICA2 sensor node. However, the exponentiation in the target group GT takes moretime than the exponentiation in the group G because of the fact that it is computed in a field much bigger than the field in which G is defined. In usual implementations of pairing, one exponentiation in GT costs about equal to four exponentiations in G [31] . Considering that the overheads of hash operations and arithmetic operations in Z * p are very small compared to the expensive pairing and exponentiation operations, we ignore these costs in thetime analysis.
Computationtime of the compared schemes on MICA2 sensors
PPT Slide
Lager Image
Computationtime of the compared schemes on MICA2 sensors
From the comparison in Table 2 , we can conclude that our scheme enjoys obvious advantage in the computationtime and is more suitable to be employed in the computation-limited environments.
6. Conclusion
In this paper, we presented a new certificate-based signcryption scheme and proved its security under the gap Diffie-Hellman assumption and the gap discrete logarithm assumption. As our proposed scheme does not require any costly pairing operation, it is more efficient than the previous certificate-based signcryption schemes which have to be based on the bilinear pairings. However, a limitation of our scheme is that its security can only be achieved in the random oracle model. So, it would be interesting to construct paring-free certificate-based signcryption in the standard model.
BIO
Yang Lu received the Ph.D. degree from PLA University of Science and Technology in 2009. He has been working in HoHai University from 2003. Currently, he is an Assistant Professor in College of Computer and Information Engineering. He has published more than 30 papers in international conferences and journals. His research interest includes information security and cryptography.
Jiguo Li received the Ph.D. degree from Harbin Institute of Technology in 2003. He has been working in HoHai University from 2003. Currently, he is a Professor in College of Computer and Information Engineering. His major research interests include information security and cryptography, network security, wireless security and trusted computing etc. He has published more than 70 scientific papers and two books. He has served as a PC member of several international conferences and the reviewer of some international journals and conferences.
References
Shamir A. 1984 “Identity-based cryptosystems and signature schemes” in Proc. of Advances in Cryptology - Crypto 1984 August 19-22 Article (CrossRef Link). 47 - 53
Al-Riyami S. S. , Paterson K. G. 2003 “Certificateless public key cryptography” in Proc. of Advances in Cryptology - Asiacrypt 2003 November 30-December 4 Article (CrossRef Link). 452 - 473
Gentry C. 2003 “Certificate-based encryption and the certificate revocation problem” in Proc. of Advances in Cryptology - Eurocrypt 2003 May 4-8 Article (CrossRef Link). 272 - 293
Sur C. , Jung C. D. , Rhee K. H. 2007 “Multi-receiver certificate-based encryption and application to public key broadcast encryption” in Proc. of 2007 ECSIS Symposium on Bio-inspired, Learning, and Intelligent Systems for Security August 9-10 Article (CrossRef Link). 35 - 40
Galindo D. , Morillo P. , Ràfols C. 2008 “Improved certificate-based encryption in the standard model” Journal of Systems and Software Article (CrossRef Link). 81 (7) 1218 - 1226    DOI : 10.1016/j.jss.2007.09.009
Liu J. K. , Zhou J. 2008 “Efficient certificate-based encryption in the standard model” in Proc. of 6th Int. Conf. on Security and Cryptography for Networks September 10-12 Article (CrossRef Link). 144 - 155
Lu Y. , Li J. , Xiao J. 2009 “Constructing efficient certificate-based encryption with paring” Journal of Computers Article (CrossRef Link). 4 (1) 19 - 26    DOI : 10.4304/jcp.4.1.19-26
Shao Z. 2011 “Enhanced certificate-based encryption from pairings” Computers and Electrical Engineering Article (CrossRef Link). 37 (2) 136 - 146    DOI : 10.1016/j.compeleceng.2011.01.007
Lu Y. , Li J. 2013 “Constructing pairing-free certificate-based encryption” International Journal of Innovative Computing, Information and Control Article (CrossRef Link). 9 (11) 4509 - 4518
Yao J. , Li J. , Zhang Y. 2013 “Certificate-based encryption scheme without pairing” KSII Transactions on Internet and Information Systems Article (CrossRef Link). 7 (6) 1480 - 1491    DOI : 10.3837/tiis.2013.06.008
Kang B. G. , Park J. H. , Hahn S. G. 2004 “A certificate-based signature scheme” in Proc. of Topics in Cryptology - CT-RSA 2004 February 23-27 Article (CrossRef Link). 99 - 111
Au M. H. , Liu J. K. , Susilo W. , Yuen T. H. 2007 “Certificate based (linkable) ring signature” in Proc. of 3rd Information Security Practice and Experience Conference May 7-9 Article (CrossRef Link). 79 - 92
Li J. , Huang X. , Mu Y. , Susilo W. , Wu Q. 2007 “Certificate-based signature: security model and efficient construction” in Proc. of 4th European PKI Workshop Theory and Practice June 28-30 Article (CrossRef Link). 110 - 125
Li J. , Huang X. , Mu Y. , Susilo W. , Wu Q. 2010 “Constructions of certificate-based signature secure against key replacement attacks” Journal of Computer Security Article (CrossRef Link). 18 (3) 421 - 449
Liu J. K. , Baek J. , Susilo W. , Zhou J. 2008 “Certificate based signature schemes without pairings or random oracles” in Proc. of 11th Information Security conference September 15-18 Article (CrossRef Link). 285 - 297
Wu W. , Mu Y. , Susilo W. , Huang X. 2009 “Certificate-based signatures, revisited” Journal of Universal Computer Science Article (CrossRef Link). 15 (8) 1659 - 1684
Zheng Y. 1997 “Digital signcryption or how to achieve cost (signature & encryption) << cost (signature) + cost (encryption)” in Proc. of Advances in Cryptology - Crypto 1997 August 17-21 Article (CrossRef Link). 165 - 179
Li F. , Xin X. , Hu Y. 2008 “Efficient certificate-based signcryption scheme from bilinear pairings” International Journal of Computers and Applications Article (CrossRef Link). 30 (2) 129 - 133
Chen L. , Malone-Lee J. 2005 “Improved identity-based signcryption” in Proc. of 8th Int. Workshop on Theory and Practice in Public Key Cryptography January 23-26 Article (CrossRef Link). 362 - 379
Luo M. , Wen Y. , Zhao H. 2008 “A certificate-based signcryption scheme” in Proc. of 2008 Int. Conf. on Computer Science and Information Technology August 29 - September 2 Article (CrossRef Link). 17 - 23
Bellare M. , Rogaway P. 1993 “Random oracles are practical: a paradigm for designing efficient protocols” in Proc. of 1st ACM Conf. on Communications and Computer Security November 3-5 Article (CrossRef Link). 62 - 73
Li J. , Huang X. , Hon M. , Zhang Y. 2012 “Certificate-based signcryption with enhanced security features” Computers & Mathematics with Applications Article (CrossRef Link). 64 (6) 1587 - 1601    DOI : 10.1016/j.camwa.2012.01.006
Schnorr C. P. 1989 “Efficient identifications and signatures for smart cards” in Proc. of Advances in Cryptology - Crypto 1989 August 20-24 Article (CrossRef Link). 239 - 252
Schnorr C. P. 1991 “Efficient signature generation by smart cards” Journal of Cryptology Article (CrossRef Link). 4 (3) 161 - 174    DOI : 10.1007/BF00196725
Fujisaki E. , Okamoto T. 1999 “How to enhance the security of public-key encryption at minimum cost” in Proc. of 2nd Int. Workshop on Theory and Practice in Public Key Cryptography March 1-3 Article (CrossRef Link). 53 - 68
Okamoto T. , Pointcheval D. 2001 “The gap-problems: a new class of problems for the security of cryptographic schemes” in Proc. of 4th Int. Workshop on Theory and Practice in Public Key Cryptography February 13-15 Article (CrossRef Link). 104 - 118
Baek J. , Steinfeld R. , Zheng Y. 2007 “Formal proofs for the security of signcryption” Journal of Cryptology Article (CrossRef Link). 20 (2) 203 - 235    DOI : 10.1007/s00145-007-0211-0
Pointcheval D. , Stern J. 2000 “Security arguments for digital signatures and blind signatures” Journal of Cryptology Article (CrossRef Link). 13 (3) 361 - 396    DOI : 10.1007/s001450010003
Oliveira L. B. , Aranha D. F. , Gouvêa C. P. L. , Scott M. , Câmara D. F. , López J. , Dahab R. 2011 “TinyPBC: Pairings for authenticated identity-based non-interactive key distribution in sensor networks” Computer Communications Article (CrossRef Link). 34 (3) 485 - 493    DOI : 10.1016/j.comcom.2010.05.013
Aranha D. F. , Dahab R. , López J. , Oliveira L. B. 2010 “Efficient implementation of elliptic curve cryptography in wireless sensors” Advances in Mathematics of Communications Article (CrossRef Link). 4 (2) 169 - 187    DOI : 10.3934/amc.2010.4.169
Chen L. , Morrissey P. , Smart N. P. 2008 “Pairings in trusted computing” in Proc. of 2nd International Conference on Pairing-based Cryptography September 1-3 Article (CrossRef Link). 1 - 17