Relations among Privacy Notions for Signcryption and Key Invisible “Sign-then-Encrypt”

Abstract

Signcryption simultaneously offers authentication through unforgeability and confidentiality through indistinguishability against chosen ciphertext attacks by combining the functionality of digital signatures and public-key encryption into a single operation. Libert and Quisquater (PKC 2004) extended this set of basic requirements with the notions of ciphertext anonymity (or key privacy) and key invisibility to protect the identities of signcryption users and were able to prove that key invisibility implies ciphertext anonymity by imposing certain conditions on the underlying signcryption scheme. This paper revisits the relationship amongst privacy notions for signcryption. We prove that key invisibility implies ciphertext anonymity without any additional restrictions. More surprisingly, we prove that key invisibility also implies indistinguishability against chosen ciphertext attacks. This places key invisibility on the top of privacy hierarchy for public-key signcryption schemes.On the constructive side, we show that general "sign-then-encrypt" approach offers key invisibility if the underlying encryption scheme satisfies two existing security notions, indistinguishable against adaptive chosen ciphertext attacks and indistinguishability of keys against adaptive chosen ciphertext attacks. By this method we obtain the first key invisible signcryption construction in the standard model. Abstract. Signcryption simultaneously offers authentication through unforgeability and confidentiality through indistinguishability against chosen ciphertext attacks by combining the functionality of digital signatures and public-key encryption into a single operation. Libert and Quisquater (PKC 2004) extended this set of basic requirements with the notions of ciphertext anonymity (or key privacy) and key invisibility to protect the identities of signcryption users and were able to prove that key invisibility implies ciphertext anonymity by imposing certain conditions on the underlying signcryption scheme. This paper revisits the relationship amongst privacy notions for signcryption. We prove that key invisibility implies ciphertext anonymity without any additional restrictions. More surprisingly, we prove that key invisibility also implies indistinguishability against chosen ciphertext attacks. This places key invisibility on the top of privacy hierarchy for public-key signcryption schemes.On the constructive side, we show that general "sign-then-encrypt" approach offers key invisibility if the underlying encryption scheme satisfies two existing security notions, indistinguishable against adaptive chosen ciphertext attacks and indistinguishability of keys against adaptive chosen ciphertext attacks. By this method we obtain the first key invisible signcryption construction in the standard model.

Improving Signal's Sealed Sender

“…More formally, we assume that the system has a sealed sender encryption scheme Π ssenc . While Signal does not give a proof of security for the scheme it uses, for our constructions we will assume that Π ssenc is a signcryption scheme that satisfies ciphertext anonymity [35] and adopt the notation presented in [51] for its algorithms 6 . We say a sealed sender encryption scheme Π ssenc is a set of three algorithms:…”

“…• SSEnc(m, sk s , pk r ) → c takes in a message m, the sender's secret key sk s and the receiver's public key pk r , and outputs a ciphertext c • SSDecVer(sk r , c) → {(m, pk s ), ⊥} takes in the receiver's private key sk r and a ciphertext c and either outputs a message m,and the public key of the sender pk s , or returns the error symbol ⊥. (Note that this actually constitutes decryption followed by verification in the notation of [51], returning ⊥ when either step fails. )…”

“…Formal security definitions are given in [51]. In short, the scheme satisfies (1) message indistinguishability, (2) unforgeability, and (3) ciphertext anonymity, meaning the ciphertext reveals nothing about the sender or receiver.…”

SCARS: Simplified cryptographic algorithm for RFID systems

“…Signcryption was proposed for the asymmetric key algorithm [15] [16], which replaced a traditional encrypt and sign practice by integrating message signatures (similar to MD) as a part of an encryption process. Zheng et al's [15] work on the signcryption scheme is based on the theory that a combined computational cost of a signature (using hashing) and encryption will be less than their individual costs.…”

An Elliptic Curve Signcryption Scheme and Its Application

“…Since the signcryption scheme was put forward in 1997, there have been several specific schemes based on different difficult assumptions ( [1,[4][5][6]). In addition to the basic security objectives, some new features are introduced in the study of signcryption schemes, such as identity-based signcryption scheme ( [6][7][8][9][10][11]), hybrid signcryption scheme [12], key encapsulation mechanism (KEM) and data encapsulation mechanism (DEM-)-based signcryption scheme [13], certificateless signcryption scheme [14], verifiable signcryption scheme [10], attributebased signcryption scheme ( [15,16]), functional signcryption scheme [17], or key invisible signcryption scheme [18].…”