Certificateless Hybrid Signcryption

Abstract

Abstract. Signcryption is a cryptographic primitive that fulfills both the functions of digital signature and public key encryption simultaneously, at a cost significantly lower than that required by the traditional signature-then-encryption approach. In this paper, we address a question whether it is possible to construct a hybrid signcryption scheme in the certificateless setting. This question seems to have never been addressed in the literature. We answer the question positively in this paper. In particular, we extend the concept of signcryption tag-KEM to the certificateless setting. We show how to construct a certificateless signcryption scheme using certificateless signcryption tag-KEM. We also give an example of certificateless signcryption tag-KEM.

On the RCCA Security of Hybrid Signcryption for Internet of Things

“…Tag-SKEM.Enc ( , * ) = * (19) In the end, the adversary A 2 submits the challenger cipher * = ( * , * ) to adversary A.…”

“…At 2004, Dent [15] proposed a formal composition model for hybrid signcryption, and this model covers Zheng's scheme [2]. Later, Bjorstad et al [18] proposed an improve signcryption scheme with tag-KEMs, Li et al [19] proposed a certificateless hybrid signcryption scheme, and Zhou [20] proposed an improved certificateless hybrid signcryption scheme. Due to the usage of a symmetric encryption scheme to overcome the weakness and restricted message space of traditional asymmetric encryption schemes, these hybrid signcryption schemes can make the length of message independent of the security of the overall signcryption scheme.…”

Cryptanalysis of a signcryption scheme with fast online signing and short signcryptext

“…In Crypto'97, Zheng [1] introduced the notion of signcryption, which can be viewed as the functional combination of encryption and signature, and its efficiency is higher than the separate signing and encrypting. Since then, a number of signcryption schemes have been proposed, e.g., [2][3][4][5][6][7][8][9][10], including some variants for different settings, e.g., identity-based signcryption [11][12][13][14], certificateless signcryption [15][16][17].…”

On security of a certificateless signcryption scheme

“…Unfortunately, as shown in [16,18], all the above schemes [4,21,3] have security flaws. Li et al commented on the certificateless hybrid signcryption in [12]. The security of the above mentioned schemes are proven in the random oracle model which can only be considered as a heuristic argument [7].…”

“…Therefore, the key escrow problem in ID-PKC is eliminated. Many certificateless cryptosystems have been proposed, including encryption schemes [1,10,24,25], signature schemes [1,11,28,29], key agreement protocols [1,31], threshold cryptosystems [8,14,23,26], and signcryption schemes [3,4,5,12,13,21,22]. As the adversary models in CLC are more complex, the security proofs in CLC are more challenging.…”