Signcryption scheme in multi-user setting without random oracles

Abstract

Since the notion of signcryption scheme was introduced by Zheng in 1997, many signcryption schemes were proposed. In 2002, An et al. introduced an insider and outsider security of signcryption scheme. Their insider security model was based on the so-called g-CCA2 security which was a relaxation of CCA2 security (adaptive chosen ciphertext attacks security). The g-CCA2 security means that an attacker is not allowed to query the "equivalent" challenged ciphertext (which is produced by the same challenged plaintext). Recently, many insider-secure signcryption schemes were proposed and provably insider-secure in the random oracles model based on the usual CCA2 security (not the g-CCA2 security), for example, Libert-Quisquater's signcryption schemes at PKC'2004 and SCN'2004 respectively, Yang et al.'s signcryption scheme at ISC'2005 and Ma's signcryption scheme at Inscrypt'2006. But, Tan showed that these signcryption schemes were not insider-secure against either adaptive chosen ciphertext attacks or forgery in two-user setting. In this paper, we proposed an insider-secure signcryption scheme based on encrypt-then-sign structure and it is provably insider-secure in a multi-user setting without random oracles based on the usual CCA2 security. The other advantage of the proposed signcryption scheme is that the ciphertext is publicly verifiable and corresponds to the unique plaintext. © 2008 Springer Berlin Heidelberg.