Efficient Lattice-Based Signcryption in Standard Model

Abstract

Signcryption is a cryptographic primitive that can perform digital signature and public encryption simultaneously at a significantly reduced cost. This advantage makes it highly useful in many applications. However, most existing signcryption schemes are seriously challenged by the booming of quantum computations. As an interesting stepping stone in the post-quantum cryptographic community, two lattice-based signcryption schemes were proposed recently. But both of them were merely proved to be secure in the random oracle models. Therefore, the main contribution of this paper is to propose a new lattice-based signcryption scheme that can be proved to be secure in the standard model.

1. Introduction

In many situations, we need to simultaneously realize confidentiality, integrity, authentication, and non-repudiation. There are generally two approaches to accomplish this task: the signature-then-encryption approach and signcryption proposed by Zheng [1]. Compared with the former, signcryption can perform both signature and encryption simultaneously at a lower cost. Hence, the signcryption scheme is more appropriate in many environments such as smart cards, mobile communications, and electronic commerce. Up to date, many efficient signcryption schemes [2–6] have been designed based on various assumptions in number theory. However, the cryptography based on number theory has been seriously challenged due to the booming of quantum computation. Under this situation, many researchers make efforts to probe new cryptosystems based on new security fundamentals, such as quantum cryptography [7–9], chaos cryptography [10, 11], DNA cryptography [12], and so forth. However, as far as we know, there is no efficient signcryption schemes based on these new fundamentals. Therefore, we have to pay our attention to another new upsurging branch of modern cryptography—post-quantum cryptography, including lattice-based cryptography, code-based cryptography, hash-based cryptography, and multivariate cryptography [13].

Recently, Li et al. [14] (LMK12) and Wang et al. [15] (WHW12) have succeeded in designing signcryption schemes based on lattice. Lattice-based cryptography has been regarded as the most attractive option for resisting quantum attacks. Meanwhile, it has many important advantages. Firstly, the security of lattice-based cryptography is based on worst-case hardness of lattice problems, while the previous cryptography constructed on number theory is based on average-case hardness. Secondly, the main operations in a lattice-based cryptographic scheme are addition and multiplications over a moderate modulus (say not larger than1024). Thus, taking a long-term look, lattice-based cryptosystems can be performed extremely rapid, compared to the currently used cryptosystems (such as RSA) in which the exponentiations over a huge modulus (say not less than2¹⁰²⁴) are always involved.

However, both of Li et al.’s scheme and Wang et al.’s scheme are merely proved to be secure in the random oracle model. After the publication of Canetti’s critical statement on provable security reduction based on random oracles (ROMs) [16], it is always an interesting practice to design/prove cryptographic schemes that are not based on ROMs. In this paper, we construct a lattice-based signcryption scheme and present its security reductions without using ROMs. Our original ideas can be formulated as follows. The lattice generated by [17] has advantages in small trapdoor and small public key, but its public key encryption scheme can only achieve CCA1 security. The challenger cannot reply the decryption queries for the ciphertext with the first tuple𝝁identical to the first tuple𝝁₀in the challenge ciphertext in phase two. Moreover, the ciphertext of [17] is malleable. One of the typical methods for transforming an encryption scheme from CCA1 to CCA2 is to make use of a one time strongly unforgeable signature to ensure the nonmalleability of ciphertexts. However, this method will increase the ciphertext length and encryption/decryption time. We set𝝁to be the hash value𝐻(𝑟,𝝈),where𝑟is a random number but𝝈is the signature generated in the signcryption process. The domain of𝝁is big enough such that the probability that the first tuple in the ciphertext generated normally is equal to𝝁₀is negligible. Hence, the challenger can reply the decryption queries in phase two. Further, we use CCA security of the symmetric encryption and collision resistance of hash function𝐻to prevent the malleability of ciphertext. In the proving process, the hash function𝐻can be replaced with a chameleon hash function𝐻_𝑐, so the challenger can generate𝝁₀to form challenge ciphertext. If there exists an adversary who can forge a valid ciphertext, he/she can find a collision of𝐻_𝑐. The probability for the above event is negligible according to [18], so our signcryption scheme can achieve CCA2 security. The strong unforgeability of the signcryption can be obtained by the strong unforgeability of the original signature. In summary, the proposed scheme is(i)indistinguishable against inner adaptively chosen ciphertext attacks (IND-CCA2) under the learning with errors (LWE) assumption in the standard model,(ii)strongly unforgeable against inner adaptively chosen message attacks (SUF-CMA) under small integer solution (SIS) assumption in the standard model.

Here, the term “inner” means that in the IND-CCA2 (resp., SUF-CMA) game, the sender (resp., receiver) who possesses the signing (resp., decryption) key is allowed to launch the corresponding attacks. Apparently, an “inner” attacker is much stronger than outer ones. Thus, the inner security of our proposal also implies its outer security. In addition, our scheme has the advantages both in computational cost and in public/private keys size. That is, our main contribution can be summarized in Table 1. In order to make the trapdoors to be consistent, we construct a chameleon hash function by using the new trapdoor technique of [17], that may be of independent interest. In fact, our chameleon hash function is similar with the one in [19]. Although the chameleon hash function in [19] can be used in our scheme, it will lead to use two different kinds trapdoors technique and reduce efficiency.

Table 1 

Performance comparison.

The rest of this paper is organized as follows. In Section 2, the necessary preliminaries on lattice-based cryptographic assumptions and algorithms are introduced. In Section 3, the security models of signcryption, including the IND-CCA2 game and SUF-CMA game, are reviewed. In Section 4, the main contribution, that is, the proposed lattice-based signcryption scheme is presented in detail, followed by the proof on its consistency. The security proofs are given in Section 5 and the performance comparisons are given in Section 6. Finally, the concluding remarks are given in Section 7.

2. Preliminaries

Throughout this paper, we denote the set of integers byℤ, residue classmod𝑞byℤ_𝑞, the real numbers byℝ,and real interval[0,1)by𝕋. The expressionℤ^𝑛(resp.ℤ^𝑛_𝑞,ℝ^𝑛) denotes vectors space onℤ(resp.ℤ_𝑞,ℝ) in which every vector has𝑛elements. Similarly, the expressionℤ^𝑛×𝑚(resp.ℤ_𝑞^𝑛×𝑚,ℝ^𝑛×𝑚) denotes matrice space onℤ(resp.ℤ_𝑞,ℝ) in which every matrix has𝑛rows and𝑚columns. We denote the set{1,2,…,𝑘}by[𝑘], for an integer𝑘>0. The symbol “∣” denotes strings concatenation operators and “‖” denotes matrice concatenation operators. The vectors are denoted by lower-case and bold letters (e.g.,𝐱), matrices by upper-case and bold letters (e.g.,𝐀), and the Gram-Schmidt orthogonalization of𝐀by𝐀. The order for a matrix’s column vectors can be interchangeable. The function𝑠₁(⋅)denotes the largest singular value of a matrix. For a given distribution𝝌over space𝒫, we use𝐬←_$𝝌(𝒫)to denote that𝑠is picked at random from the space𝒫according to the distribution𝝌. If the sampling space𝒫is specified from the context, we also simply use𝐬∈𝝌or𝐬←_$𝝌to denote the same meaning. Also, we use𝐬←_$𝑈(𝑃)to denote that𝑠is picked at random from the space𝒫according to the uniform distribution.

2.1. Lattice and Gaussian Distribution

Definition 1 (Lattice). An𝑛-dimensional latticeΛis a discrete additive subgroup ofℝ^𝑚(𝑚≥𝑛). Formally, let𝐁={𝐛_𝟏,𝐛_𝟐,…,𝐛_𝐧}be𝑛linearly independent vectors. The lattice generated by𝐁is Λ=ℒ(𝐁)=𝐁𝐱=Σ^𝑛_𝑖=1𝑥_𝑖𝐛_𝐢∣𝐱∈ℤ^𝑛, (1) where𝐁is called a basis forΛ. In many cryptographic applications, a particular family which is called𝑞-ary integer lattices is frequently used. For positive integers𝑛,𝑚(=𝑛) and𝑞and matrix𝐀∈ℤ_𝑞^𝑛×𝑚, the𝑞-ary lattices are defined by Λ^⟂(𝐀)=𝐳∈ℤ^𝑚,Λ𝐀∶𝐀𝐳=𝟎mod𝑞_𝐭=𝐳∈ℤ^𝑚∶∃𝐬∈ℤ^𝑛_𝑞s.t.𝐳=𝐀^𝐭𝐬mod𝑞. (2)

For integers𝑛>0and𝑞>2, some probability distribution𝝌overℤ_𝑞and a vector𝐬∈ℤ^𝑛_𝑞,𝐀_𝐬,𝝌is defined as the distribution of(𝐚,𝐚^𝐭𝐬+𝐱)onℤ^𝑛_𝑞×ℤ_𝑞, where𝐚and𝐱are chosen uniformly fromℤ^𝑛_𝑞and𝝌, respectively.

Definition 2 (Learning with Errors (LWE) [23]). For an integer𝑞=𝑞(𝑛)and a distribution𝝌onℤ_𝑞, the target of learning with errorsLWE_𝑞,𝝌is to distinguish with nonnegligible probability between the distribution𝐀_𝐬,𝝌and the uniform distribution onℤ^𝑛_𝑞×ℤ_𝑞by accessing the oracle for the given distribution, where𝐬←_$𝑈(ℤ^𝑛_𝑞).

For𝛼∈ℝ⁺,Ψ_𝛼is defined as the distribution on𝕋of a normal variable with mean0and standard deviation𝛼/√2𝜋, reduced modulo1. When normal variable𝑥obeys distributionΨ_𝛼,Ψ_𝛼is the discretized normal distribution onℤ_𝑞of random variable⌊𝑞⋅𝑥⌉mod𝑞, where⌊⌉denotes rounding.

Proposition 3 (hardness of LWE [23]). Let𝛼=𝛼(𝑛)∈(0,1)and𝑞=𝑞(𝑛)be a prime to satisfy𝛼𝑞>2√𝑛. If there is an efficient (possibly quantumn) algorithm that can solveLWE_𝑞,Ψ𝛼, then there is an efficient quantum algorithm for approximating𝑆𝐼𝑉𝑃_𝛾within𝑂(𝑛/𝛼)factors (referring to [24] for its hardness) in the worst case.

Definition 4 (Small Integer Solution (SIS) [18]). Given an integer𝑞, a real𝛽>0and a matrix𝐀∈ℤ_𝑞^𝑛×𝑚, the goal ofSIS_𝑞,𝛽is to find a nonzero integer vector𝐳∈ℤ^𝑚to satisfy𝐀𝐳=𝟎mod𝑞and‖𝐳‖≤𝛽.

Proposition 5 (hardness of SIS Theorem 5.16 [18]). For any polybounded𝑚,𝛽=𝑝𝑜𝑙𝑦(𝑛),and for any prime𝑞≥𝛽⋅𝜔(𝑛log𝑛), the average-case problem𝑆𝐼𝑆_𝑞,𝛽is as hard as approximating the SIVP problem (among others) in the worst case to within certain𝛾=𝛽⋅𝑂(√𝑛)factors.

Definition 6 (Gaussian measure [18]). Given any vector𝐜,𝐱, and real𝑠>0, let 𝜌_𝑠,𝐜(𝐱)=𝑒^{−𝜋‖(𝐱−𝐜)/𝑠‖2} (3) be a Gaussian function around𝐜with parameter𝑠. Its total measure is∫_{𝐱∈ℝ𝑛}𝜌_𝑠,𝐜(𝐱)𝑑𝐱=𝑠^𝑛. The probability density function of the corresponding continuous Gaussian distribution is defined as ∀𝐱∈ℝ^𝑛,𝐷_𝑠,𝐜(𝐱)=𝜌_𝑠,𝐜(𝐱)𝑠^𝑛. (4) When𝐜=𝟎, it is always omitted.

Definition 7 (discrete Gaussian distribution [18]). For any vector𝐜, real𝑠>0, and latticeΛ, the distribution ∀𝐱∈Λ,𝐷_Λ,𝑠,𝐜(𝐱)=𝐷_𝑠,𝐜(𝐱)𝐷_𝑠,𝐜(Λ)=𝜌_𝑠,𝐜(𝐱)𝜌_𝑠,𝐜(Λ) (5) is called discrete Gaussian distribution overΛ.

Proposition 8 (Claim 5.3 [23]). Let𝐾>1be a constant, and let𝑚>𝐾𝑛log𝑞be an integer. The columns of a uniformly random𝐀∈ℤ_𝑞^𝑛×𝑚generate all ofℤ^𝑛_𝑞, except with2^−Ω(𝑛)probability.

Proposition 9. Let𝐁be a basis ofΛ^⟂(𝐀), where𝐀∈ℤ_𝑞^𝑛×𝑚and the columns of𝐀generateℤ^𝑛_𝑞. Let𝑠≥‖𝐁‖𝜔(log𝑛).(1)(Theorem 3.1 [20]) Let 𝐱←𝐷_ℤ^𝑚_,𝑠; the distribution of 𝐲=𝐀𝐱∈ℤ^𝑛_𝑞is 𝑛𝑒𝑔𝑙(𝑛)-far from the uniform distribution over ℤ^𝑛_𝑞, and the conditional distribution of 𝐱given 𝐲is 𝐷_Λ^⟂_{𝐲(𝐴),𝑠}. (2)(Lemma 4.4 [18]) 𝑃𝑟_{𝐱∼𝐷Λ,𝑠,𝐯}{‖𝐱−𝐯‖>𝑠√𝑛}≤((1+𝜖)/(1−𝜖))⋅2^−𝑛.

According to nonasymptotic theory of random matrices [25], we have the following lemma.

Proposition 10 (Lemma 2.9 [17]). For any𝛿-sub-Gaussian with parameter𝑠random matrix𝐀∈ℝ^𝑛×𝑚and any real𝑡>0, there is a constant𝑘>0, such that𝑠₁(𝐀)≤𝑘𝑠⋅(√𝑚+√𝑛+𝑡)with at least probability1−2^𝛿𝑒^−𝜋𝑡2.

2.2. Universal Hashes and Chameleon Hashes

In general, we hope a hash function used in cryptographic schemes to be collision resistant. But in our construction, we need further assumptions on involved hashes. One is universal property and another is the so-called Chameleon property.

Definition 11 (universal hash functions [26]). We say that a family of hash functionsℋ={ℎ∶𝒳→𝒴}is universal if for every distinct pair𝑥,𝑥^′∈𝒳,Pr_ℎ←ℋ[ℎ(𝑥)=ℎ(𝑥^′)]=1/|𝒴|holds.

In addition, a kind of specifical hash named chameleon hash introduced by Krawczyk and Rabin [27] is used in our work. The chameleon hash functions have the following four properties: (1) efficient forward computation, (2) standard collision-resistance property, (3) uniformity property, and (4) chameleon property. We will construct a chameleon hash family based on the lattice-trapdoor technique given in [17] and prove it has the above properties in Section 4.1; hence we do not describe these properties here in detail.

2.3. Related Algorithms for Inverting and Sampling

Micciancio and Peikert [17] proposed new, simpler, easy-to-implement and more efficient methods to generate and utilize “strong trapdoors” in cryptographic lattices. These methods include specialized algorithms for inverting LWE, which are important for encryption and signature.

Firstly, we introduce the related matrices. Let𝐠^𝐭=[1,2,4,…,2^𝑘−1]∈ℤ_𝑞^1×𝑘,𝑘∈ℕ. Define matrix𝐒_𝐤as 𝐒_𝐤=2𝑞₀−12𝑞₁−1⋱⋮⋱2𝑞_𝑘−2−1𝑞_𝑘−1∈ℤ^𝑘×𝑘. (6) The matrix𝐒_𝐤can be easily constructed in the following two cases: (1) when𝑞is a power of 2, let𝑘=⌈log𝑞⌉,𝑞_𝑖=0for0≤𝑖≤𝑘−2,and𝑞_𝑘−1=2; (2) when𝑞is not a power of 2,𝑞_𝑖is the𝑖th bit of𝑞. In the former,‖𝐒_𝐤‖=2and in the latter‖𝐒_𝐤‖<√3by Lemma 4.3 of [17]. It can be verified that𝐒_𝐤is a basis forΛ^⟂(𝐠^𝐭).

Let𝑔_𝐆(𝐬,𝐞)=𝑠⋅𝐠^𝐭+𝐞^𝐭mod𝑞. Given𝐛∈ℤ^𝑘−1mod𝑞there exist efficient algorithms to find𝑠∈ℤ_𝑞and𝐞∈ℤ^𝑘such that𝐛^𝐭=𝑔_𝐆(𝐬,𝐞), when𝐞∈[−𝑞/4,𝑞/4)^𝑘=𝒫_1/2(𝑞⋅𝐒_𝐤^−𝐭). There are two cases for𝑞:𝑞is a power of2or not. In the former case, Algorithm 1 can finish this task.

Input:   Vector 𝐛∈ℤ𝑘, where 𝐛𝐭=[𝑏0,…,𝑏𝑘−1]. Output:   Scalar 𝑠∈ℤ𝑞 and a vector 𝐞∈ℤ𝑘. (1)  𝑠←0; (2)  for 𝑗=𝑘−1; 𝑘≥0; step −1  do (3)   if  (𝑏𝒾−2𝒾⋅𝑠)∈[−𝑞/4,𝑞/4)mod𝑞  then (4)   𝑡=0; (5)   else (6)   𝑡=1; (7)   end if (8)   𝑠=𝑠+𝑡⋅2𝑘−1−𝑗; (9)   𝑒𝒾=𝑏𝒾−2𝒾⋅𝑠∈[−𝑞/4,𝑞/4); (10)  end for (11)  Output 𝑠∈ℤ𝑞 and 𝐞=(𝑒0,…,𝑒𝑘−1)∈[−𝑞/4,𝑞/4)𝑘⊂ℤ𝑘.

Algorithm 1 

InvertG(b).

In the latter case, the above algorithm can work, but the interval for error vector𝐞needs to be changed into[−𝑞/2√3,𝑞/2√3)^𝑘=𝒫_1/2(𝑞⋅𝐒_𝐤^−𝐭). For convenience, the algorithm for the latter case is also called InvertG.

The primitive vector𝐠^𝐭and the corresponding latticeΛ(𝐠^𝐭)basis𝐒_𝐤can be used to construct parity-check matrix𝐆and matrix𝐒as follows. It follows that𝐆is a primitive matrix, and𝐒is a basis for latticeΛ^⟂(𝐆): 𝐆=⋯𝐠^𝐭⋯⋯𝐠^𝐭⋯⋱⋯𝐠^𝐭⋯∈ℤ_𝑞^{𝑛×𝑛𝑘},𝐒𝐒=^𝐤𝐒_𝐤⋱𝐒_𝐤∈ℤ_𝑞^{𝑛𝑘×𝑛𝑘}. (7)

Definition 12. Given matrices𝐀∈ℤ_𝑞^𝑛×𝑚and𝐓∈ℤ^𝑚0_𝑞^×𝑘𝑛and invertible matrix𝐌∈ℤ_𝑞^𝑛×𝑛for positive integers𝑛,𝑚,𝑚₀,𝑘, if𝐀^𝐓_𝐈=𝐌𝐆and‖𝐓‖is small enough,𝐓is called a𝐆-trapdoor of𝐀corresponding to𝐌.

Given a function𝑔_𝐆(𝐬,̂𝐞̂)=𝐬^𝐭̂𝐆+𝐞̂^𝐭mod𝑞with suitably small𝐞̂∈ℤ^𝑛𝑘, an efficient oracle𝒪(𝐛∈ℤ_𝑞^𝑛𝑘)for inverting𝑔_𝐆(𝐬,̂𝐞̂)can be achieved by calling Algorithm 1 for𝑛times.

Given an LWE instance𝐛^𝐭=𝑔_𝐀(𝐬,𝐞)=𝐬^𝐭𝐀+𝐞^𝐭mod𝑞with suitably small𝐞∈ℤ^𝑚and the𝐆-trapdoor𝐓with corresponding matrix𝐌, Algorithm 2 can recover𝐬and𝐞.

Input:   Parity-check matrix A ∈ ℤ𝑞𝑛×𝑚;    G-trapdoor T ∈ ℤ𝑚0×𝑘𝑛 of A and corresponding invertible tag 𝐌𝐈 ∈ ℤ𝑞𝑛×𝑛;   Vector 𝐛𝐭 = 𝑔𝐀 (s, e) for suitably small e  ∈ ℤ𝑚. Output:   Vectors s and e. (1) Compute 𝐛𝐭 = 𝐛𝐭 𝐓𝐈; (2) Obtain (𝐬̂, 𝐞̂) by calling 𝒪(𝐛); (3) Returns s = 𝐌𝐈−𝐭𝐬̂ and e = b −  𝐀𝐭 s.

Algorithm 2 

Invert𝒪 (T, A, b, 𝐌_𝐈).

Finally, we recall the algorithms, denoted by SampleD and due to Peikert [28], for sampling from Gaussian distribution with short basis.

The mechanism of [17] for generating a trapdoor is different from that of [29]. As a result, it uses a new algorithm but also named SampleD to sample from a discrete Gaussian overΛ^⟂_𝑢(𝐀)in [17], in which Algorithm 3 is called. It is used in signature and delegation. For distinction, let us call it SampleDG. The reader can refer to Theorem 5.5 of [17] for the correctness (Algorithm 4).

Input:   Offline phase: Basis 𝐁 of a 𝑞-ary integer Λ=𝐿(𝐁); rounding parameter 𝑟=𝜔(log𝑛);   positive definite covariance matrix Σ≥𝑟2⋅(4𝐁𝐁𝐭+𝐈);   Online phase: a vector 𝑐∈ℤ𝑛; Output:   Vector 𝐯∈  Λ +𝐜 drawn from a distribution within 𝑛𝑒𝑔𝑙(𝑛) statistical distance of 𝐷√Λ+𝑐,Σ;   Offline phase: (1) Compute 𝐙=𝑞⋅𝐁−𝟏∈ℤ𝑛×𝑛; (2) Let    𝚺𝟏= 2𝑟2⋅𝐁𝐁𝐭, let 𝚺𝟐= 𝚺− 𝚺𝟏≥ 𝑟2⋅(2𝐁𝐁𝐭)+𝐈, and compute some M𝐁𝟏=𝚺𝟐−𝑟2; (3) Choose𝐲 from 𝐷ℤ𝑛,Σ2 by letting 𝐲←𝐁𝟏⋅𝐷1𝑟;     Online phase: (4) Return 𝑥←𝐙(𝐜−𝐲)/𝑞𝑟.

Algorithm 3 

SampleD(B, 𝑐, 𝑟, 𝚺).

Input:   Offline phase:    (i) Trapdoor matrix 𝐓∈𝑍𝑚0𝑞×𝑤;    (ii) Partial parity-check matrix 𝐀𝟎∈ℤ𝑛×𝑚0𝑞;    (iii) Positive definite 𝐓𝐈𝚺≥(2+𝚺𝐆)[𝐓𝐭‖𝐈], for example, any 𝚺=𝑠2≥(𝑠1(𝐓)2+1)(𝑠1(𝚺𝐆)+2).   Online phase:    (i) Invertible tag 𝐌𝐈∈ℤ𝑞𝑛×𝑚 defining 𝐀=[𝐀𝟎‖𝐌𝐈𝐆−𝐀𝟎𝐓];    (ii) Syndrome 𝐲∈ℤ𝑛𝑞. Output:   A vector 𝐱, which is statistically close to 𝐷√Λ(𝟏/𝐲)(𝐀),𝑟𝚺.   Offline phase: (1) Compute 𝚺𝐩𝐓𝐈=𝚺−𝚺𝐆[𝐓𝐭𝐓𝐈‖𝐈]≥𝟐[𝐓𝐭‖𝐈], choose vector 𝐩←𝐷ℤ𝑚,𝑟𝚺𝐩; (2) Parse 𝐏𝐏=𝟏𝐏𝟐 where 𝐩𝟏∈ℤ𝑚0, 𝐩𝟐∈ℤ𝑤. Compute 𝐰𝟎=𝐀𝟎(𝐩𝟏−𝐓𝐩𝟐)∈ℤ𝑛𝑞 and 𝐰=𝐆𝐏𝟐∈ℤ𝑛𝑞;     Online phase: (3) Compute 𝐯←𝐌𝐈−𝟏(𝐲−𝐰𝟎)−𝐰=𝐌𝐈−𝟏(𝐲−𝐀𝐩)∈ℤ𝑛𝑞; (4) Choose 𝐳←𝐷Λ(𝟏/𝐕)(𝐆),𝑟𝚺𝐆 by calling SampleD(𝐒𝐤,𝐯,𝑟,𝚺𝐆) see Algorithm 3; (5) Return 𝐓𝐈𝐱=𝐩+𝐳.

Algorithm 4 

SampleDG(T, 𝐀_𝟎, 𝐌_𝐈, y, 𝑠).

3. Signcryption: Primitive and Security Models

Signcryption was invented in 1996 but was first disclosed to the public at CRYPTO 1997 [1]. Signcryption is a public key cryptographic method that achieves unforgeability and confidentiality simultaneously with significantly smaller overhead than that required by “digital signature followed by public key encryption.” It does this by signing and encrypting a message in a single step, fulfilling a cryptographer’s dream to “kill two birds with one stone” [1, 3]. Signcryption techniques are now a global standard for data protection [30].

The primitive of signcryption provides confidentiality of the message against all entities except the intended receiver and meanwhile it provides the authenticity of the sender (i.e., the signer) for the intended receiver. It is clear that the authenticity embedded in the signcryption primitive is unidirectional, instead of bidirectional. In particular, if an intended receiver can forge a signature on behalf of some signer, he/she can plant some false evidence against the signer and then encrypt the signature for himself/herself. By doing so, the singer is incriminated. Therefore, in considering the security of signcryption, we should take into account the orthogonal combination of two kinds of attackers (i.e., inner attackers and outer attackers) and two protection goals (i.e., unforgeability and confidentiality). In 2005, Dent [31, 32] gave comprehensive elaborations on the inner security and outer security of signcryption. With the purpose of providing a handy consult for the security reduction given latter, we give a review on the security models of signcryption from LMK12 [14], in which we merely formulated the security models against inner attacker because in general an inner attacker is much stronger than an outer ones.

Definition 13 (signcryption). A signcryption scheme consists of the following four algorithms.(i)𝐒𝐞𝐭𝐮𝐩(1^𝑛): this is an initialization algorithm that should be executed only once by any honest user in the system. It takes as input the security parameter1^𝑛and outputs the public parameters𝒫_𝑝that are shared by all users in the system.(ii)𝐊𝐞𝐲𝐆𝐞𝐧(1^𝑛,𝒫_𝑝): this is a key generation algorithm that should be executed by each user only once. It takes as inputs the security parameter1^𝑛as well as the public parameters𝒫_𝑝and outputs the public/private key pair(𝑃𝐾,𝑆𝐾)where𝑃𝐾will be published publicly while𝑆𝐾will be kept known only to the user himself/herself. (In sequel, let us assume that the sender’s public/private key pair is(𝑃𝐾_𝑠,𝑆𝐾_𝑠), while the receiver’s is(𝑃𝐾_𝑟,𝑆𝐾_𝑟).)(iii)𝐒i𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐮,𝑃𝐾_𝑟,𝑃𝐾_𝑠,𝑆𝐾_𝑠): this is a signcryption algorithm that should be executed by a senders whenever he/she wants to send a message to someone. It takes as inputs a message𝐮, the intended receiver’s public key𝑃𝐾_𝑟,and the sender’s public/private key pair(𝑃𝐾_𝑠,𝑆𝐾_𝑠)and outputs a signcryption ciphertext𝐂.(iv)𝐔𝐧𝐬𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐂,𝑃𝐾_𝑟,𝑆𝐾_𝑟,𝑃𝐾_𝑠): this is a unsigncryption algorithm that should be executed by a receiver. It takes as inputs a signcryption ciphertext𝐜and the receiver’s public/private key pair(𝑃𝐾_𝑟,𝑆𝐾_𝑟), as well as the sender’s public key𝑃𝐾_𝑠, and outputs a plaintext𝐮or⟂.

Definition 14 (consistency of signcryption). We say that a signcryption scheme defined above is consistent if the following probability 𝒫Pr^𝑝⟵𝐒𝐞𝐭𝐮𝐩1^𝑛;𝑃𝐾_𝑟,𝑆𝐾_𝑟⟵𝐊𝐞𝐲𝐆𝐞𝐧1^𝑛,𝒫_𝑝;𝑃𝐾_𝑠,𝑆𝐾_𝑠⟵𝐊𝐞𝐲𝐆𝐞𝐧1^𝑛,𝒫_𝑝;𝐂⟵𝐒𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭𝐮,𝑃𝐾_𝑟,𝑃𝐾_𝑠,𝑆𝐾_𝑠;𝐮^′⟵𝐔𝐧𝐬𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭𝐂,𝑆𝐾_𝑟,𝑃𝐾_𝑠∶𝐮^′(𝑛)=𝐮=1−𝜖 (8) is exponentially close to 1; that is,𝜖(𝑛)is negligible with respect to𝑛.

To capture the confidentiality of a signcryption defined above, we need to introduce a game, denoted by Game IND-CCA2, between a challenger𝒞and an adversary𝒜as follows.

Game IND-CCA2(i)Initial:𝒞runs𝐒𝐞𝐭𝐮𝐩(1^𝑘)algorithm to produce public parameter𝒫_𝑝and then generates his/her own public/private keys(𝑃𝐾^∗_𝑟,𝑆𝐾^∗_𝑟)by running𝐊𝐞𝐲𝐆𝐞𝐧(1^𝑛,𝒫_𝑝)algorithm. Finally,𝒞gives𝑃𝐾^∗_𝑟and𝒫_𝑝to𝒜.(ii)Phase??1:𝒜can perform polynomially bounded unsigncryption queries in an adaptive manner and𝒞responds accordingly. More precisely,𝒜’s query is specified by a triple(𝐂,𝑃𝐾_𝑠)and𝒞’s responds with the corresponding plaintext𝐮if𝐂is a valid signcryption ciphertext with respect to the receiver’s public key𝑃𝐾^∗_𝑟and sender’s public key𝑃𝐾_𝑠or⟂otherwise.(iii)Challenge:𝒜chooses two equal length plaintexts𝐮₀,𝐮₁and sends(𝐮₀,𝐮₁,𝑃𝐾^∗_𝑠,𝑆𝐾^∗_𝑠)to𝒞, and𝒞tosses a fair coin𝑏∈{0,1}and sets𝐂^∗←𝐒𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐮_𝑏,𝑃𝐾^∗_𝑟,𝑃𝐾^∗_𝑠,𝑆𝐾^∗_𝑠). Finally,𝒞sends𝒜the challenged signcryption ciphertext𝐂^∗.(iv)Phase??2: phase 1 is repeated with the restriction that𝒜is not allowed to ask unsigncryption query on triple(𝐂^∗,𝑃𝐾^∗_𝑠).(v)Guess:𝒜outputs a bit𝑏^′as his/her guessing on𝑏.

Then, the advantage of𝒜to win Game IND-CCA2 is defined asAdv(𝒜)=|Pr[𝑏=𝑏^′]−(1/2)|.

Definition 15 (confidentiality of signcryption). A signcryption scheme is said to be indistinguishable against inner chosen ciphertext attacks (IND-CCA2), if there is no probabilistic polynomial time adversary that can win Game IND-CCA2 with nonnegligible advantage.

To capture the (strong) unforgeability of a signcryption defined above, we need to introduce another game, denoted by Game SUF-CMA, between a challenger𝒞and a forgeryℱas follows.

Game SUF-CMA(i)Initial:𝒞runs𝐒𝐞𝐭𝐮𝐩(1^𝑘)algorithm to produce public parameter𝒫_𝑝and then generates his/her own public/private keys(𝑃𝐾^∗_𝑠,𝑆𝐾^∗_𝑠)by running𝐊𝐞𝐲𝐆𝐞𝐧(1^𝑛,𝒫_𝑝)algorithm. Finally,𝒞gives𝑃𝐾^∗_𝑠and𝒫_𝑝toℱ.(ii)Singcrypt query:ℱcan perform polynomially bounded signcryption queries in an adaptive manner. More precisely,ℱ’s query is specified by a pair(𝐮,𝑃𝐾_𝑟)and𝒞’s responds with𝐂←𝐒𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐮,𝑃𝐾_𝑟,𝑃𝐾^∗_𝑠,𝑆𝐾^∗_𝑠). (Here,𝑃𝐾_𝑟is the intended receiver’s public key and the corresponding private key𝑆𝐾_𝑟is known toℱ. Furthermore,ℱis allowed to either obtain(𝑃𝐾_𝑟,𝑆𝐾_𝑟)by calling the algorithm𝐊𝐞𝐲𝐆𝐞𝐧(1^𝑛,𝒫_𝑝)or pick them randomly.)(iii)Forgery:ℱoutputs a tuple(𝐮^∗,𝐂^∗,𝑃𝐾^∗_𝑟,𝑆𝐾^∗_𝑟)with the restriction that𝒞never responds toℱwith𝐂^∗for answeringℱ’s signcryption query on(𝐮^∗,𝑃𝐾^∗_𝑟).

Then, the advantage ofℱto win Game SUF-CMA is defined as Adv(ℱ)=Pr𝐮^∗=𝐔𝐧𝐬𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭𝐂^∗,𝑃𝐾^∗_𝑟,𝑆𝐾^∗_𝑟,𝑃𝐾^∗_𝑠. (9)

Definition 16 (strong unforgeability of signcryption). A signcryption scheme is said to be strongly unforgeable against inner adaptively chosen message attacks (SUF-CMA), if no probabilistic polynomial time adversary can win Game SUF-CMA with nonnegligible advantage.

4. Proposed Lattice-Based Signcryption Scheme

In this section, we firstly present a chameleon hash function based on the lattice-trapdoor technique given in [17]. Next, based on the signature scheme and the encryption scheme given in [17], we propose a signcryption scheme. Finally, we prove the consistency of the proposed scheme. Note that, the matrices𝐆,𝐒,𝐒_𝐤used in this section are as in Section 2.3.

4.1. Building Block: Lattice-Based Chameleon Hash Functions

According to [33, 34], we know that by using a chameleon hash function, one can transfer an SUF-SMA secure signature scheme to an SUF-CMA secure one. To guarantee the consistency of the proposed scheme, we need to construct a chameleon hash function based on lattice-based trapdoors of given in [17]. In fact, it is a analogue to the scheme based on the trapdoors given in [29].

Let𝑛≥1,𝑞≥2,𝑚₀=𝑂(𝑛log𝑞), and𝑘=𝑂(log𝑞)be integers. Let integer𝑙>0be message length. For matrices𝐍^(𝟎)∈ℤ_𝑞^𝑛×𝑙,𝐍^(𝐳)∈ℤ^𝑛×𝑚0_𝑞, and𝐓∼𝐷^{𝑚0×𝑛𝑘}_{ℤ,𝜔(log𝑛)}and invertible matrix𝐌∈ℤ_𝑞^𝑛×𝑛construct𝐍^(𝟏)=[𝐍^(𝐳)‖𝐍^(𝐲)]=[𝐍^(𝐳)‖−𝐍^(𝐳)𝐓+𝐌𝐆]∈ℤ_𝑞^𝑛×𝑚and𝐍=[𝐍^(𝟎)‖𝐍^(𝟏)]. Let𝑠be a Gaussian parameter satisfying𝑠≈√5𝑠₁(𝐓)𝜔(log𝑛)suggested by [17]. Define a message spaceℳ={0,1}^𝑙and random spaceℛ=𝐷_ℤ^𝑚_,𝑠(then, for𝐫∈ℛ,‖𝐫‖≤𝑠√𝑚holds with overwhelming probability according to Proposition 9 items (2)) and𝒴∈𝕫^𝑛_𝑞. For𝐮∈ℳand𝐫∈ℛ, using matrix𝐍define hash function𝐻_𝐍∶ℳ×ℛ→𝒴as 𝐻_𝐍(𝐮,𝐫)=𝐍^(𝟎)𝐮+𝐍^(𝟏)𝐫. (10)

Lemma 17. The familyℋ={𝐻_𝐍}(under the uniform distribution overℋ) is a family of chameleon hash functions, assuming the hardness of𝑆𝐼𝑆_𝑞,𝛽for𝛽²=𝑙+4𝑠²𝑚.

Proof. It is enough to prove the hash familyℋ={𝐻_𝐍}has the four properties described in Section 2.2.
For efficient forward computation. Clearly, given a message𝐮∈ℳand𝐫∈ℛ, each𝐻_𝐍(𝐮,𝐫)is efficiently computable.
For collision-resistance property. Assuming that it is easy to find a collision[𝐮‖𝐫]≠[𝐮^′‖𝐫^′]∈ℳ×ℛfor𝐻_𝐍, then𝐱=[𝐮−𝐮^′‖𝐫−𝐫^′]≠𝟎is a solution for𝐍𝐱=𝟎, and according to the triangle inequality, we have that‖𝐱‖²≤𝑙+4𝑠²𝑚. It implies that𝐱is also a solution for the instance𝐍ofSIS_𝑞,𝛽. This contradicts the hardness ofSIS_𝑞,𝛽for𝛽=√𝑙+4𝑠²𝑚. Therefore, the hash family is collision-resistant.
For uniformity property, we first show the matrix𝐍is uniform. The matrix𝐍^(𝐳)is uniform, so𝐍^(𝐳)𝐓is also uniform when𝐓∼𝐷^{𝑚0×𝑛𝑘}_{ℤ,𝜔(log𝑛)}isnegl(𝑛)-far from uniform (cf. Section 6.2 of [17]). On the other hand, the matrix𝐌𝐆is fixed when𝐌is fixed. Consequently, the matrix𝐍^(𝟏)isnegl(𝑛)-far from uniform. On the other hand,𝐍^(𝟎)is uniform; hence𝐍isnegl(𝑛)-far from uniform. It is clear that given any𝑚∈ℳand𝐫←𝐷_ℤ^𝑚_,𝑠and each matrix𝐍generated as above, the distribution of𝐻_𝐍(𝑚,𝑟)is negligible far from the uniform distribution overℋ×𝒴by Proposition 9 items (1).
For chameleon property. Given𝐮,𝐮^′∈ℳand𝐫∈ℛ, one with𝐆-trapdoor𝐓can easily find𝐫^′∈ℛsatisfying𝐻_𝐍(𝐮,𝐫)=𝐻_𝐍(𝐮^′,𝐫^′)as follows: compute𝐲=𝐻_𝐍(𝐮,𝐫)−𝐍^(𝟎)𝐮^′, and then sample preimage𝐫^′=SampleDG(𝐓,𝐍^(𝐳),𝐌,𝐲,𝑠).

Lemma 18. The above chameleon hash family is universal; for every distinct𝐮,𝐮^′∈ℳand distinct𝐫,𝐫^′∈ℛ,𝑃𝑟_{𝐻𝐍←ℋ}[𝐻_𝐍(𝐮,𝐫)=𝐻_𝐍(𝐮^′,𝐫^′)]=𝑞^−𝑛.

Proof. Assuming that𝐻_𝐍(𝐮,𝐫)=𝐻_𝐍(𝐮^′,𝐫^′), it follows that𝐍⁽¹⁾𝐫^′=𝐻_𝐍(𝐮,𝐫)−𝐍⁽⁰⁾𝐮^′. When𝐮,𝐫,𝐮^′is fixed, the vector𝐳=𝐻_𝐍(𝐮,𝐫)−𝐍⁽⁰⁾𝐮^′is a fixed element inℤ^𝑛_𝑞.
The matrix𝐍⁽¹⁾is uniform as described above. For𝑚₀=𝑂(𝑛log𝑞),𝑚=𝑚₀+𝑛𝑘≥2𝑛log𝑞, the columns of𝐍^(𝟏)∈ℤ_𝑞^𝑛×𝑚generateℤ^𝑛_𝑞with overwhelming probability by Proposition 8. In addition,𝑠≥‖𝐒‖𝜔(log𝑛)and𝐫^′∼𝐷_ℤ^𝑚_,𝑠, where𝐒is as in Section 2.3.
It follows that𝐍^(𝟏)𝐫^′is uniform overℤ^𝑛_𝑞(up to negligible statistical distance) by Proposition 9 items (1). Consequently,Pr[𝐍^(𝟏)𝐫^′=𝐳]=𝑞^−𝑛. In other words,Pr_{𝐻𝐍←ℋ}[𝐻_𝐍(𝐮,𝐫)=𝐻_𝐍(𝐮^′,𝐫^′)]=𝑞^−𝑛.

4.2. Signcryption Scheme

In [17], Micciancio and Peikert gave a special collector (MP collector) that maps elements from a certain ringℜinto matrices𝐇∈ℤ_𝑞^𝑛×𝑛as required by their trapdoor construction. Let us call it MP Collector and denote it byħ∶ℜ→ℤ_𝑞^𝑛×𝑛. Given a monic degree-𝑛irreducible polynomial𝑓(𝑥)=𝑥^𝑛+𝑓_𝑛−1𝑥^𝑛−1+⋯+𝑓₀∈ℤ[𝑥], a ring can be defined asℜ=ℤ[𝑥]/(𝑓(𝑥))and the elements ofℜcan be represented as vectors inℤ^𝑛relative to the standard basis of monomials1,𝑥,…,𝑥^𝑛−1. Now, given a ring element𝑎(𝑥)=𝑎₀+𝑎₁𝑥+⋯+𝑎_𝑛−1𝑥^𝑛−1∈ℜ,ħ(𝐚)can be constructed as follows: 𝐡^(𝟎)=𝑎₀,𝑎₁,…,𝑎_𝑛−1,𝐡^(𝐢)=0,ℎ₀^(𝑖−1),…,ℎ^(𝑖−1)_𝑛−2−ℎ^(𝑖−1)_𝑛−2𝑓₀,𝑓₁,…,𝑓_𝑛−1, (11) for0≤𝑖<𝑛, where𝐡^(𝐢)is the𝑖th column ofħ(𝐚). Clearly,ħhas the following properties. Firstly,ħis a ring homomorphism, namely,ħ(𝐱_𝟏)−ħ(𝐱_𝟐)=ħ(𝐱_𝟏−𝐱_𝟐)for𝐱_𝟏,𝐱_𝟐∈ℜ. Secondly, multiplication by a ring element𝐚∈ℜcan be represented by the matrixħ(𝐚); furthermore, the product coefficients vector equals∑^𝑛−1_𝑖=0𝑏_𝑖𝐡_𝐚^(𝐢), where𝐡_𝐚^(𝐢)is the𝑖th column ofħ(𝐚)and𝑏_𝑖is the𝑖th coefficient of ring element. Thirdly,ħ(𝐱)∈𝐺𝐿_𝑛(𝑞)if and only if𝐱is a unit ofℜ, where𝐺𝐿_𝑛(𝑞)is a group composed of the invertible elements inℤ_𝑞^𝑛×𝑛. Finally, the ringℜhas “units difference” property, namely, for any𝐱_𝐢,𝐱_𝐣∈ℜ^∗(ℜ^∗denotes the units set inℜ),𝐱_𝐢−𝐱_𝐣∈ℜ^∗.

Our signcryption scheme consists of the following four algorithms. Note that we also adopt a symmetrical encryption schemeΠ=(𝒦,ℰ,𝒟)(with keyspace𝒦, encryption algorithmℰ,and decryption algorithm𝒟) in our construction.(i)𝐒𝐞𝐭𝐮𝐩(1^𝑛): Suppose the security parameter is1^𝑛. Then, the the public parameters𝒫_𝑝for the system can be specified as follows.(1)𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘}is the matrix as defined in Section 2.3, where𝑞=𝑝^𝑒=poly(𝑛)is a prime power and is large enough (cf. [17]).(2)𝑘=𝑂(log𝑞)=𝑂(log𝑛).(3)𝑚₀=𝑂(𝑛𝑘),𝑚=𝑚₀+𝑛𝑘,𝑚₁=𝑚₀+2𝑛𝑘,and suitable𝑙>0.(4)𝛼∈(0,1)is an LWE error rate, such that1/𝛼=𝑂(𝑛𝑘)⋅𝜔(log𝑛).(5)𝑠^′≥√5⋅𝜔(log𝑛).(6)A monic degree-𝑛irreducible polynomial𝑓(𝑥)=𝑥^𝑛+𝑓_𝑛−1𝑥^𝑛−1+⋯+𝑓₀∈ℤ_𝑝[𝑥]and a ring defined asℜ=ℤ_𝑞[𝑥]/(𝑓(𝑥)).(7)4 hash functions:(a)𝐻₀∶{0,1}^∗×ℤ_𝑞^𝑛×𝑚→{0,1}^𝜆is a collision-resistant hash function, where𝜆<𝑛(𝑝−1);(b)𝐻₁∶ℤ^𝑚1_𝑞→{0,1}^𝑙is a universal hash function;(c)𝐻_𝐅∶{0,1}^𝑙×ℤ^𝑚_𝑞→ℜ^∗is chosen from a universal family, where𝐅is a matrix inℤ_𝑞^{𝑛×(𝑙+𝑚)}. More precisely,𝐅=[𝐅^(𝟎)‖𝐅^(𝟏)]∈ℤ_𝑞^𝑛×𝑙×ℤ_𝑞^𝑛×𝑚, and𝐅^(𝟎)(resp.,𝐅^(𝟏)) has the same distribution with𝐍^(𝟎)(resp.,𝐍^(𝟏)) described in Section 4.1 (note that the elements inℜcan be represented by vectors inℤ^𝑛_𝑞);(d)𝐻₂∶{0,1}^𝑛𝑘×ℤ^𝑚_2𝑞→{0,1}^{𝑛⋅𝑘′}is a universal hash function with suitably specified𝑘^′.(8)An ordered matrix set𝔅={𝐁⁽⁰⁾,…,𝐁^(𝜆)}where𝐁^(𝑖)←_$𝑈(ℤ_𝑞^{𝑛×𝑛𝑘})for0≤𝑖≤𝜆.(9)𝑠_𝑠=𝑂(√𝜆𝑛𝑘)𝜔(log𝑛)²is the Gaussian parameter for signature.(10)An arbitary basis𝐐∈ℤ^{𝑛𝑘×𝑛𝑘}forΛ=Λ(𝐆^𝐭).(11)MP Collectorħ∶𝕽→ℤ_𝑞^𝑛×𝑛.(ii)𝐊𝐞𝐲𝐆𝐞𝐧(1^𝑛,𝒫_𝑝): any user can generate his/her public key𝑃𝐾and private key𝑆𝐾as follows.(a)Sample𝐀^(𝟎)←_$ℤ^𝑛×𝑚0_𝑞and𝐓←_$𝐷^{𝑚0×𝑛𝑘}_{ℤ,𝜔(log𝑛)};(b)Evaluate𝐀^(𝟏)=−𝐀^(𝟎)𝐓;(c)Let𝑃𝐾≜𝐀=[𝐀^(𝟎)‖𝐀^(𝟏)]∈ℤ_𝑞^𝑛×𝑚and𝑆𝐾≜𝐓.(iii)𝐒𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐮,𝐴_𝑟,𝐴_𝑠,𝑇_𝑠): a sender with public/private key pair(𝐀_𝐬,𝐓_𝐬)can send a signcryption ciphertext𝐜on some message𝐮to a receiver with public key𝐀_𝐫as follows.(1)Sign message𝐮to obtain(𝝈,𝐫_𝟏), as follows.(a)Compute𝐡=𝐻₀(𝐮,𝐀_𝐫),𝐀^′=𝐁^(𝟎)+∑_{𝑖∈[𝜆]}𝐡_𝑖𝐁^(𝐢)and then build 𝐀_𝐬^(𝐡)=𝐀_𝐬‖𝐀^′∈ℤ^𝑛×𝑚1, (12)?where𝐡=(ℎ₁,…,ℎ_𝜆)∈{0,1}^𝜆is the binary representation of𝐡.(b)Construct chameleon hash function according to the method in Section 4.1. Concretely, replace𝐍^(𝟏),𝐍^(𝟎),𝐌with𝐀_𝐬, arbitrary𝑙columns of𝐀^′,𝐈∈ℤ_𝑞^𝑛×𝑛, respectively. The others are invariant. The hash function is denoted as𝐻_𝐀𝐬^(𝐡).(c)Sample𝐫_𝟏←_$𝐷_ℤ^𝑛𝑘_,𝑠𝑠.(d)Compute𝐡_𝐫=𝐻_𝐀𝐬^(𝐡)(𝐡,𝐫_𝟏).(e)Sample𝐲←_$𝐷_ℤ^𝑛𝑘_,𝑠𝑠and compute𝐲^′=𝐡_𝐫−𝐀^′𝐲.(f)Sample𝝈_𝐨𝐫←SampleDG(𝐓_𝐬,𝐀_𝐬^(𝟎),𝐈,𝐲^′,𝑠_𝑠), where𝐈∈ℤ^𝑛×𝑛is identity matrix.(g)Let𝝈=(𝝈_𝐨𝐫,𝐲).(2)Parse𝝈=(𝝈_𝟏,𝝈_𝟐)such that𝝈_𝟏∈{0,1}^𝑛𝑘and denote the remainder as𝝈_𝟐.(3)Compute𝐰=𝐻₁(𝝈).(4)Encrypt𝝈_𝟏as follows.(a)Sample𝐞_𝟎←_$𝐷^𝑚0_ℤ,𝛼𝑞and evaluate𝑠_𝑟=‖𝐞_𝟎‖²+𝑚₀(𝛼𝑞)²⋅𝜔(log𝑛).(b)Sample𝐞_𝟏←_$𝐷^𝑛𝑘_ℤ,𝑠𝑟, and let𝐞=(𝐞_𝟎,𝐞_𝟏).(c)Sample𝐫_𝟐←_$𝐷_ℤ^𝑛𝑘_,𝑠′, then compute𝝁=𝐻_𝐅(𝐰,𝐫_𝟐),and construct𝐀_𝐫^(𝝁)=[𝐀_𝐫^(𝟎)‖𝐀_𝐫^(𝟏)+ħ(𝝁)𝐆].(d)Encode𝝈_𝟏as𝝈^′_𝟏=encode(𝝈_𝟏)=𝐐𝝈_𝟏∈ℤ^𝑛𝑘.(e)Choose a vector𝐬←_$ℤ^𝑛_𝑞uniformly and let 𝐛^𝐭=2𝐬^𝐭𝐀_𝐫^(𝝁)mod𝑞+𝐞^𝐭+𝟎,𝝈^′_𝟏^𝑡mod2𝑞. (13)(5)Encrypt𝐮as follows.(a)Let𝑘^′=𝐻₂(𝝈_𝟏,𝐛)∈𝒦.(b)Let𝐜=ℰ_𝑘′(𝐮∣𝝈_𝟐∣𝐫_𝟏∣𝐫_𝟐).(6)Output the signcryption ciphertext(𝝁,𝐛,𝐜).(iv)𝐔𝐧𝐬𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐂,𝐴_𝑟,𝑇_𝑟,𝐴_𝑠): upon receiving a signcryption ciphertext(𝝁,𝐛,𝐜)from a sender with the public key𝐀_𝐬, the receiver with the private key𝐓_𝐫performs the following steps.(1)Decrypt(𝝁,𝐛)to achieve𝝈₁as follows.(a)If𝝁=𝟎, output⟂and then abort; otherwise continue.(b)Call𝐈𝐧𝐯𝐞𝐫𝐭^𝒪(𝐓_𝐫,𝐀_𝐫^(𝝁),𝐛,ħ(𝝁))to obtain(𝐳̃,𝐞̃), where𝐳̃∈ℤ^𝑛_𝑞and𝐞̃=(𝐞_𝟎,𝐞_𝟏)∈ℤ^𝑚0×ℤ^𝑛𝑘.(c)If‖𝐞_𝟎‖≥𝛼𝑞√𝑚₀or‖𝐞_𝟏‖≥𝛼𝑞2𝑚₀𝑛𝑘⋅𝜔(log𝑛)output⟂and abort; otherwise continue.(d)Let𝐯=𝐛−𝐞̃mod2𝑞and then parse𝐯as(𝐯_𝟏,𝐯_𝟐)∈ℤ^𝑚0_2𝑞×ℤ^𝑛𝑘_2𝑞.(e)If𝐯_𝟏∉2Λ((𝐀^𝟎_𝐫)^𝐭), output⟂and abort; otherwise, continue.(f)Let𝝈_𝟏=𝐐⁻¹(𝐯^𝐭𝐓𝐫_𝐈mod2𝑞).(2)Decrypt𝐜as follows.(a)Compute𝑘^′=𝐻₂(𝝈_𝟏,𝐛)∈𝒦.(b)Compute𝐮|𝝈_𝟐|𝐫_𝟏|𝐫_𝟐=𝒟_𝑘′(𝐜).(3)Check the integrity of ciphertext as follows.(a)Obtain𝝈by composing𝝈_𝟏,𝝈_𝟐, and then compute𝐰=𝐻₁(𝝈).(b)If𝝁≠𝐻_𝐅(𝐰,𝐫_𝟐)output⟂and abort; otherwise, continue.(c)If‖𝐫_𝟐‖≥𝑠^′√𝑚output⟂and abort; otherwise, continue.(4)Verifying the sender’s authenticity as follows.(a)Compute𝐡=𝐻₀(𝐮,𝐀_𝐫)and then build𝐀_𝐬^(𝐡)=[𝐀_𝐬‖𝐁^(𝟎)+∑_{𝑖∈[𝜆]}𝐡_𝐢𝐁^(𝐢)], where𝐡=(𝐡₁,…,𝐡_𝜆)∈{0,1}^𝜆is the binary representation of𝐡.(b)If𝝈>𝑠_𝑠√𝑚₁output⟂and abort; otherwise, continue.(c)Compute𝐡_̃𝐫=𝐻_{𝐀𝐬(𝐡)}(𝐡,𝐫_𝟏).(d)If𝐀⁽_𝐬^𝐡)𝝈=𝐡_̃𝐫then output𝐮; otherwise, output⟂.

4.3. Consistency and Unsigncryption Error

Theorem 19 (consistency). The above signcryption scheme can unsigncrypt correctly with1−2^−Ω(𝑛)probability.

Proof. We analyze the procedure along the unsigncryption algorithm, when a valid ciphertext𝐜_𝐩=(𝝁,𝐛,𝐜)is input to the unsigncryption.
Firstly, we demonstrate that the correct𝝈_𝟏can be obtained with overwhelming probability in step (1) of unsigncryption.(i)Firstly, let us prove that after calling(𝐳̃,𝐞̃)←Invert^𝒪(𝐓_𝐫,𝐀_𝐫^(𝝁),𝐛,ħ(𝝁)), the probability of𝐞̃=𝐞is overwhelming, where𝐞is the vector used in Signcrypt algorithm. At first, we need to show that this calling can work; that is,𝐓_𝐫is a𝐆-trapdoor for𝐀_𝐫^(𝝁). For convenience, let𝐑_𝐈=^𝐓𝐫_𝐈. Because𝐐is a basis ofΛ(𝐆^𝐭), there must exist a matrix𝐐^′∈ℤ_𝑞^{𝑛×𝑛𝑘}such that𝐐=𝐆^𝑡𝐐^′. As a result, 𝐛^𝐭mod𝑞=𝐛^𝐭𝐑_𝐈=2𝐬^𝐭𝐀_𝐫^(𝝁)mod𝑞+𝐞^𝐭+𝟎,𝝈^′𝐑_𝐈=2𝐬^𝐭𝐀_𝐫^(𝟎)‖−𝐀_𝐫^(𝟎)𝐓_𝐬(𝝁)𝐆+𝐞+ħmod𝑞_𝟎,𝐞_𝟏^𝑡+𝟎,𝐐𝝈_𝟏^𝑡𝐑_𝐈=2𝐬^𝐭ħ(𝝁)𝐆mod𝑞+𝐞^𝐭_𝟎𝐓_𝐬+𝐞^𝐭_𝟏+𝐆^𝑡𝐐^′𝝈_𝟏^𝑡=2𝐬^𝐭+𝝈^𝐭_𝟏𝐐^′ħ(𝝁)⁻¹ħ(𝝁)𝐆+𝐞^𝐭_𝟎𝐓_𝐫+𝐞^𝐭_𝟏. (14)?Clearly, the𝐛^𝐭is the form of𝑔_𝐆(𝐬,̂𝐞̂)for some(𝐬,̂𝐞̂); namely,𝐓_𝐫is a𝐆-trapdoor for𝐀_𝐫^(𝝁). As a result, a vector𝐞̃∈ℤ_𝑚can be returned. We next demonstrate the probability that the probability for𝐞̃=𝐞is overwhelming by callingInvert^𝒪(Algorithm 2). Clearly, if the𝒪(𝐛)in𝐈𝐧𝐯𝐞𝐫𝐭^𝒪can return desired value,𝐈𝐧𝐯𝐞𝐫𝐭^𝒪can obtain desired𝐞. The oracle𝒪(𝐛)is realized by calling InvertG (Algorithm 1); consequently, it only needs to prove the constraint condition is satisfied, that is, the error vector𝐞^𝐭_𝟎𝐓_𝐫+𝐞^𝐭_𝟏∈𝒫_1/2(𝑞⋅𝐒_𝐤^−𝐭), referring to Section 2.3 for the definition of𝐒_𝐤. Because𝐞_𝟎∼𝐷^𝑚0_ℤ,𝛼𝑞,𝐞_𝟏∼𝐷^𝑛𝑘_ℤ,𝑠𝑟for𝑠_𝑟=‖𝐞_𝟎‖²+𝑚₀(𝛼𝑞)²⋅𝜔(log𝑛), it follows that‖𝐞_𝟎‖<𝛼𝑞√𝑚₀and‖𝐞_𝟏‖<𝛼𝑞2𝑚₀𝑛𝑘𝜔(log𝑛)except with probability2^−Ω(𝑛)by Proposition 9 items (2). When the parameters are set as in Setup and the sender’s public/private keys are produced as in KeyGen, it follows that the maximum singular value for𝐓_𝐫satisfies𝑠₁(𝐓_𝐫)≤𝑂(√𝑛𝑘)⋅𝜔(log𝑛)except probability2^−Ω(𝑛)according to Proposition 10. Let𝐞=(𝐞_𝟎,𝐞_𝟏); it follows that‖𝐞^𝐭𝐑_𝐈‖≤‖𝐞^𝐭_𝟎𝐓_𝐫‖+‖𝐞^𝐭_𝟏‖<𝛼𝑞⋅𝑂(𝑛𝑘)⋅𝜔(log𝑛)<𝑂(𝑞)∈𝒫_1/2(𝑞⋅𝐒_𝐤^−𝐭)except probability2^−Ω(𝑛), because1/𝛼=𝑂(𝑛𝑘)⋅𝜔(log𝑛)is large enough.(ii)Secondly, when the correct𝐞is obtained, the test in step (c) can be passed and the analysis is included in the above proof.(iii)Thirdly, in step (e), for𝐯=(𝐯_𝟎,𝐯_𝟏)=𝐛−𝐞mod2𝑞, it follows that𝐯_𝟎∈2Λ(𝐀^𝐭_𝟎)as desired.(iv)Finally, in step (f),𝐯^𝐭𝐑_𝐈=2(𝐬^𝐭ħ(𝝁)𝐆mod𝑞)+(𝐐𝝈_𝟏)^𝑡mod2𝑞; as a result,𝐯^𝐭𝐑_𝐈and(𝐐𝝈_𝟏)^𝑡are in the identical coset, so the decryption can obtain𝝈_𝟏exactly.
Next, after obtaining correct𝝈_𝟏and𝐛via step (1), we get the correct key used for symmetrical encryption, so we can obtain correct(𝝁,𝝈_𝟐,𝐫_𝟏,𝐫_𝟐)in step (2), and the verification for hash values in step (3) can be passed.
Finally, let us analyze step (4). Specifically, we prove that the signature verification can be passed with overwhelming probability. By now, we have got correct(𝝈,𝐫_𝟏)that is a signature for𝐮, and we only need to prove that it is valid. First, we evaluate the probability for𝝈≤𝑠_𝑠√𝑚₁.𝝈=^𝝈𝐨𝐫_𝐲, where𝝈_𝐨𝐫is obtained by calling the algorithm SampleDG. It is known by SampleDG that𝐀_𝐬^(𝟎)𝝈_𝐨𝐫=𝐲^′and‖𝝈_𝐨𝐫‖≤𝑠_𝑠√𝑚with probability1−2^−Ω(𝑛)by Proposition 9 items (2). On the other hand,𝐲≤𝑠_𝑠√𝑛𝑘with probability1−2^−Ω(𝑛)by the same lemma. Therefore,𝝈≤𝑠_𝑠√𝑚₁with probability1−2^−Ω(𝑛). Second, 𝐀_𝐬^(𝐡)𝝈=𝐴_𝑠‖𝐴^′𝝈_𝐨𝐫𝐲=𝐲^′+𝐀^′𝐲=𝐡_𝐫=𝐻_𝐀𝐬^(𝐡)𝐻₀𝐮,𝐀_𝐫,𝐫. (15) Consequently, the signature is valid with probability1−2^−Ω(𝑛).

5. Security Proofs

Before giving the proofs on the confidentiality and unforgeability of the proposed scheme, we need at first to prove the following lemma.

Lemma 20. For a given unit𝝁^∗∈ℜ=ℤ_𝑞[𝑥]/(𝑓(𝑥)), if𝐮←_${0,1}^∗,𝐫_𝟐←_$𝐷_ℤ^𝑚_,𝑠′, and(𝝈,𝐫₁)is a signature obtained in step (1) of the Signcrypt algorithm, then the probability for𝐻_𝐅(𝐻₁(𝝈),𝐫_𝟐)=𝝁^∗is negligible. More precisely,𝑃𝑟[𝐻_𝐅(𝐻₁(𝝈),𝐫_𝟐)=𝝁^∗∣𝐮←_${0,1}^∗]=Ω(𝑞^−𝑛).

Proof. We first evaluate the number of units in the above ringℜ. As defined in [17], the monic degree-𝑛polynomial𝑓(𝑥)=𝑥^𝑛+𝑓_𝑛−1𝑥^𝑛−1+⋯+𝑓₀∈ℤ[𝑥]is irreducible modulo every prime𝑝dividing𝑞. Because𝑓(𝑥)is irreducible,(𝑓(𝑥))is maximum ideal andℤ_𝑝[𝑥]/(𝑓(𝑥))is a field according to Chinese remainder theorem. An element𝑎∈ℜis a unit if and only if it is nonzero modulo any prime𝑝dividing𝑞. Assume that𝑞has prime factors𝑝₁,𝑝₂,…,𝑝_𝑡. The amount of elements which are zero modulo prime factor𝑝_𝑖is𝑞/𝑝_𝑖+1. By inclusion-exclusion principle, the amount of units inℜis 𝑞^𝑛−𝑞𝑝₁+1^𝑛+𝑞𝑝₂+1^𝑛𝑞+⋯+𝑝_𝑡+1^𝑛+𝑞𝑝₁𝑝₂+1^𝑛+𝑞𝑝₁𝑝₃+1^𝑛𝑞+⋯+𝑝_𝑡−1𝑝_𝑡+1^𝑛+⋯+(−1)^𝑡𝑞𝑝₁𝑝₂⋯𝑝_𝑡+1^𝑛≈𝑞^𝑛−𝑞𝑝₁^𝑛+𝑞𝑝₂^𝑛𝑞+⋯+𝑝_𝑡^𝑛+𝑞𝑝₁𝑝₂^𝑛+𝑞𝑝₁𝑝₃^𝑛𝑞+⋯+𝑝_𝑡−1𝑝_𝑡^𝑛+⋯+(−1)^𝑡𝑞𝑝₁𝑝₂⋯𝑝_𝑡^𝑛=𝑞^𝑛−𝑞^𝑛𝑝^𝑛₁+𝑞^𝑛𝑝^𝑛₂𝑞+⋯+^𝑛𝑝^𝑛_𝑡+𝑞^𝑛𝑝^𝑛₁𝑝^𝑛₂+𝑞^𝑛𝑝^𝑛₁𝑝^𝑛₃𝑞+⋯+^𝑛𝑝^𝑛_𝑡−1𝑝^𝑛_𝑡()+⋯+−1^𝑡𝑞^𝑛𝑝^𝑛₁𝑝^𝑛₂⋯𝑝^𝑛_𝑡=𝑞^𝑛11−𝑝^𝑛₁11−𝑝^𝑛₂⋯11−𝑝^𝑛_𝑡=𝑂𝑞^𝑛, (16)(17)(18) where the approximating from (17) to (18) is implied by that𝑞is large enough. In the proposed scheme,𝑞=𝑝^𝑒and𝑞^𝑛−(𝑞/𝑝+1)^𝑛≈𝑞^𝑛−(𝑞/𝑝)^𝑛=𝑞^𝑛(1−1/𝑝^𝑛). On the other hand, the hash functions𝐻₁and𝐻_𝐅are both universal. Based on the above two reasons, this lemma holds.

Theorem 21 (confidentiality). The proposed signcryption is indistinguishable against inner adaptively chosen ciphertext attack (IND-CCA2) assuming the decision-LWE_𝑞,𝛼′problem (for𝛼^′=𝛼/3≥2√𝑛/𝑞) is intractable.

Proof. At first, let us define the following game sequence between a challenger𝒞and an adversary𝒜.(i)The game𝐺₀is exactly the IND-CCA2 attack with the system as described in Section 3.(ii)In game𝐺₁, the challenger change the way to construct the receiver’s public key𝐀_𝐫and the way to answer unsigncryption queries. The receiver’s public key𝐀_𝐫is produced as follows. At the start of the game, choose𝐀_𝐫^(𝟎),𝐓_𝐫as in game𝐺₀and let𝐓=𝐓_𝐫, next choose𝝁_𝟎←ℜ, and then construct𝐀_𝐫=[𝐀_𝐫^(𝟎)‖−𝐀_𝐫^(𝟎)𝐓−ħ(𝝁_𝟎)𝐆]. The challenger gives the adversary𝐀_𝐫as the sender’s public key. Whenever𝒜invokes a unsigncryption query on(𝐜^′,𝐀_𝐬,𝐓_𝐬)=((𝝁,𝐛,𝐜),𝐀_𝐬,𝐓_𝐬),𝒞responds as normal except that in step (1) of Unsigncrypt algorithm, the decryption for(𝝁,𝐛)is changed as follows.(1)Decrypt(𝝁,𝐛)to achieve𝝈₁as follows.(a')If𝝁=𝟎or𝝁=𝝁_𝟎, output⟂and then abort; otherwise continue.(b')Call𝐈𝐧𝐯𝐞𝐫𝐭^𝒪(𝐓_𝐫,𝐀_𝐫^(𝝁),𝐛,ħ(𝝁−𝝁₀))to obtain(𝐳̃,𝐞̃), where𝐳̃∈ℤ^𝑛_𝑞and𝐞̃=(𝐞_𝟎,𝐞_𝟏)∈ℤ^𝑚0×ℤ^𝑛𝑘.(c)If‖𝐞_𝟎‖≥𝛼𝑞√𝑚₀or‖𝐞_𝟏‖≥𝛼𝑞2𝑚₀𝑛𝑘⋅𝜔(log𝑛)output⟂and abort; otherwise continue.(d)Let𝐯=𝐛−𝐞̃mod2𝑞and then parse𝐯as(𝐯_𝟏,𝐯_𝟐)∈ℤ^𝑚0_2𝑞×ℤ^𝑛𝑘_2𝑞.(e)If𝐯_𝟏∉2Λ((𝐀^𝟎_𝐫)^𝐭), output⟂and abort; otherwise, continue.(f^′)Let𝝈_𝟏=𝐐⁻¹(𝐯^𝐭𝐓_𝐈mod2𝑞)where𝐓is an arbitrary solution of𝐀_𝐫^(𝟎)𝐓=𝐀_𝟎𝐓−ħ(𝝁₀)𝐆.(ii)In game𝐺₂, the challenger only changes hash function𝐻_𝐅and the method to produce challenge ciphertext(𝝁^∗,𝐛^∗,𝐜^∗)as follows. The change for hash function𝐻_𝐅is as follows. The challenger replaces the hash function𝐻_𝐅with a chameleon hash function𝐻_𝐄without revealing the trapdoor, where the matrix𝐄=[𝐄^(𝟎)‖𝐄^(𝟏)]∈ℤ_𝑞^𝑛×𝑙×ℤ_𝑞^𝑛×𝑚and𝐄^(𝟎)(resp.,𝐄^(𝟏)) has the same distribution with𝐅^(𝟎)(resp.,𝐅^(𝟏)). The challenge ciphertext is produced as follows. The adversary provides two equal length messages𝐮_𝟎,𝐮_𝟏and the sender’s public/private keys𝐀^∗_𝐬,𝐓^∗_𝐬. The challenger tosses a fair coin𝑟_𝑐∈{0,1}, and then signcrypts𝐮_𝐫𝐜with a slightly change. The challenger signs𝐮_𝐫𝐜normally to obtain(𝝈,𝐫_𝟏), next chooses𝝁^∗=𝝁_𝟎, and then chooses𝐫_𝟐such that𝝁^∗=𝐻_𝐄(𝐻₁(𝝈),𝐫_𝟐)(𝒞can do this since he/she knows the trapdoor of the chameleon hash𝐻_𝐄). The subsequent signcryption operation is the same as𝐺₁.(iii)In game𝐺₃, the challenger continues to change the how the challenge ciphertext(𝝁^∗,𝐛^∗,𝐜^∗)is created. Concretely, only the way to produce𝐛^∗is changed as follows. The challenger normally chooses𝐬←_$ℤ^𝑛_𝑞,𝐞_𝟎←𝐷_ℤ^𝑚_0,𝛼𝑞and let𝐛^𝐭_𝟎=2(𝐬^𝐭𝐀_𝐫^(𝟎)mod𝑞)+𝐞^𝐭_𝟎mod2𝑞. Next, choose𝐞̂←_$𝐷_{ℤ𝑛𝑘√,𝛼𝑞𝑚𝜔(log𝑛)}and let𝐛^𝐭_𝟏=−𝐛^𝐭_𝟎𝐓_𝐫+𝐞̂^𝐭+(𝐐𝝈_𝟏)^𝑡mod2𝑞. Let(𝐛^∗)^𝐭=(𝐛^𝐭_𝟎,𝐛^𝐭_𝟏). All the others are same as in game𝐺₂.(iv)In game𝐺₄, the challenger continues to change the challenge ciphertext. The challenger chooses𝐛_𝟎←_$ℤ^𝑚0_2𝑞uniformly. All the others are identical to𝐺₃.
Then, this theorem is implied by the indistinguishability between two successive games𝐺_𝑖and𝐺_𝑖+1(𝑖=0,1,2,3) that are presented in Lemmas 22, 23, 24, and 25, respectively.

Lemma 22. The adversary’s views in game𝐺₀and game𝐺₁are statistically indistinguishable. Meanwhile,𝐺₁can unsigncrypt correctly (with overwhelming probability).

Proof. We first prove the indistinguishability for public key. Given𝝁_𝟎∈ℜ^∗,𝐹(𝝁_𝟎)∈𝐺𝐿_𝑛(𝑞)is a fixed matrix. On the other hand,𝐀_𝐫^(𝟎)𝐓_𝐫isnegl(𝑛)-uniform by leftover hash lemma. Therefore,𝐀_𝐫^(𝟎)𝐓_𝐫−ħ(𝝁_𝟎)𝐆isnegl(𝑛)-uniform. Consequently, the value of𝝁_𝟎is statistically hidden from the adversary and the distribution of public key in𝐺₀and𝐺₁is statistically indistinguishable.
Next, we illustrate the challenger𝒞in the game𝐺₁can unsigncrypt correctly and𝒞’s unsigncryption behavior in𝐺₀and𝐺₁is indistinguishable from the view of the adversary𝒜. When the ciphertext queried is not valid, both games will abort. Therefore, we only need to analyze the case for a valid ciphertext. In the unsigncryption process of game𝐺₁, only the decryption for𝝁,𝐛(i.e., public key decryption process) is changed. Therefore, it is enough to prove the correctness of public key decryption. At first, if𝝁=𝟎, both games will output⟂. Otherwise, there are two cases for𝝁:𝝁≠𝝁_𝟎or not.
We firstly analyze the former. In this case, both games callInvert^𝒪to obtain(𝐳,𝐞)such that𝐛^𝐭=𝐳^𝐭𝐀_𝐫^(𝝁)+𝐞^𝐭mod𝑞(refer to Section 4.3). In game𝐺₁, 𝐀_𝐫^(𝝁)=𝐀_𝐫^(𝟎)‖−𝐀_𝐫^(𝟎)𝐓−ħ𝝁_𝟎(𝝁)𝐆=𝐀𝐆+ħ_𝐫(𝟎)‖−𝐀_𝐫^(𝟎)𝐓+ħ𝝁−𝝁_𝟎𝐆. (19) Clearly, conditioned on𝝁≠𝝁_𝟎,ħ(𝝁−𝝁_𝟎)∈ℤ_𝑞^𝑛×𝑛is invertible according to the “unit differences” onℜ, which is necessary for callingInvert^𝒪. It also follows that𝐓is the𝐆-trapdoor for𝐀_𝐫^(𝝁)corresponding to invertible tagħ(𝝁−𝝁_𝟎). Therefore, the challenger needs to replace𝐌_𝐈=ħ(𝝁)with𝐌_𝐈=ħ(𝝁−𝝁_𝟎)when callingInvert^𝒪. In step (c), if there is𝐞obtained from step (b') that satisfies the constraint condition, it follows that𝐞^𝐭𝐓_𝐈∈𝒫_1/2(𝑞⋅𝐒_𝐤^−𝐭)in both games, where𝐒_𝐤has been defined in Section 2.3. Therefore, this𝐞can be obtained by callingInvert^𝒪in both games; otherwise, if there is no such an𝐞, both games will output⟂. In step (e), if𝐯_𝟏∉2Λ((𝐀_𝐫^(𝟎))^𝐭), both games output⟂; otherwise, there exist𝐬∈𝐙^𝑛_𝑞and𝝈^′_𝟏∈ℤ^𝑛𝑘_2𝑞such that 𝐯^𝐭=𝐛^𝐭−𝐞^𝐭=2𝐬^𝐭𝐀_𝐫^(𝝁)mod𝑞+𝟎,𝝈^′_𝟏^𝑡mod2𝑞. (20) In step (f) of game𝐺₀,𝒞computes 𝐐^−𝟏𝐯^𝐭𝐓𝐈mod2𝑞=𝐐^−𝟏2𝐬^𝐭ħ(𝝁)𝐆mod𝑞+𝝈^′_𝟏^𝐭mod2𝑞, (21) while in step (f') of game𝐺₁,𝒞does as follows: first, find any𝐓such that𝐀_𝐫^(𝟎)𝐓=−𝐀_𝐫^(𝟎)𝐓−ħ(𝝁_𝟎)𝐆, and then, compute 𝐐^−𝟏𝐯^𝐭𝐓𝐈mod2𝑞=𝐐^−𝟏2𝐬^𝐭ħ(𝝁)𝐆mod𝑞+𝝈^′_𝟏^𝐭mod2𝑞. (22) Clearly,𝐯^𝐭𝐓𝐫_𝐈in𝐺₀,𝐯^𝐭𝐓_𝐈in𝐺₁,and𝝈^′_𝟏^𝑡are in the same cosetΛ(𝐆^𝐭)/2Λ(𝐆^𝐭);therefore𝐺₀and𝐺₁can both decrypt the desired value.
We next discuss the latter case; that is,𝝁=𝝁_𝟎. In this case, game𝐺₁cannot unsigncrypt becauseħ(𝝁−𝝁_𝟎)is not invertible, but since𝝁₀is unknown to the adversary in𝐺₁, the probability for𝝁=𝝁_𝟎is negligible according to Lemma 20. Based on the above analysis, the games𝐺₀and𝐺₁are indistinguishable.

Lemma 23. The adversary’s views in game𝐺₂and game𝐺₁are statistically indistinguishable.

Proof. At first, because the matrices used for constructing hash functions𝐻_𝐄and𝐻_𝐅have identical distribution, the games𝐺₂and𝐺₁are statistically indistinguishable when the hash function is replaced. Although the way for producing the challenge ciphertext(𝝁^∗,𝑏^∗,𝑐^∗)in𝐺₂is changed, the adversary cannot distinguish𝝁^∗=𝝁₀from𝝁^∗=𝐻_𝐄(𝐰,𝐫_𝟐)without knowing𝝁₀,𝑤,𝑟₂in advance, considering that𝐻_𝐄is universal and𝝁₀is random selected.

Lemma 24. The adversary’s views in game𝐺₃and game𝐺₂are statistically indistinguishable.

Proof. The key idea of this lemma’s proof is similar to a section in Theorem 6.3 of [17]. The change of challenge ciphertext in𝐺₃is only at the public encryption section, more precisely, only the component𝐛=(𝐛_𝟎,𝐛_𝟏)∈ℤ^𝑚0_2𝑞×ℤ^𝑛𝑘_2𝑞as described above. The distribution of𝐛_𝟎in both games is identical. With respect to𝐛_𝟏, in game𝐺₂, 𝐛^𝐭_𝟏=2−𝐬^𝐭𝐀_𝐫^(𝟎)𝐓_𝐫mod𝑞+𝐞^𝐭_𝟏+𝐐𝝈_𝟏^𝑡mod2𝑞, (23) where𝐞_𝟏∼𝐷_ℤ^𝑚_0,𝑠, for𝑠=‖𝐞_𝟎‖²+𝑚₀(𝛼𝑞)²𝜔(log𝑛). In game𝐺₃, 𝐛^𝐭_𝟏=−𝐛^𝐭_𝟎𝐓_𝐫+𝐞̂^𝐭+𝐐𝝈_𝟏^𝑡mod2𝑞=2−𝐬^𝐭𝐀_𝐫^(𝟎)𝐓_𝐫mod𝑞+𝐞^𝐭_𝟎𝐓_𝐫+𝐞̂^𝐭+𝐐𝝈_𝟏^𝑡mod2𝑞. (24) It only needs to prove that the statistical distance between𝐞^𝐭_𝟎𝐓_𝐫+𝐞̂^𝐭and𝐞^𝐭_𝟏is negligible. Express𝐓_𝐫as(𝐭_𝟏,𝐭_𝟐,…,𝐭_𝐧𝐤)∈ℤ^{𝑚0×𝑛𝑘}, where𝐭_𝐢∼𝐷_{ℤ𝑛𝑘,𝜔(log𝑛)}. On the other hand𝐞̂∼𝐷_{√ℤ,𝛼𝑞𝑚𝜔(log𝑛)}. It follows that for fixed𝐞_𝟎,⟨𝐞_𝟎,𝐭_𝐢⟩+𝐞̂_𝐢isnegl(𝑛)-far from𝐷_ℤ,𝑠1for𝑠²₁=(‖𝐞_𝟎‖²+𝑚₀(𝛼𝑞)²)𝜔(log𝑛)²according to Corollary 3.10 of [23] and Theorem 3.1 of [28]. In other words,𝐛_𝟏in𝐺₃has distributionnegl(𝑛)-far from𝐛_𝟏in𝐺₂. Consequently, the challenge ciphertext(𝝁^∗,𝐛^∗,𝐜^∗)in both games𝐺₃and𝐺₂is statistically indistinguishable.

Lemma 25. The adversary’s views in game𝐺₄and game𝐺₃are computationally indistinguishable and the adversary’s advantage in𝐺₄is negligible, assuming that the decision-𝐿𝑊𝐸_𝑞,𝛼′problem (for𝛼^′=𝛼/3≥2√𝑛/𝑞) is intractable.

Proof. The idea of this lemma’s proof is similar to a section in Theorem 6.3 of [17]. In order to show the indistinguishability, a method to discretize LWE is needed. Concretely,𝐀_𝐬,𝜶′is a LWE instance overℤ^𝑛_𝑞×𝕋. The𝑂_𝑠samples (for𝐬∈ℤ^𝑛_𝑞)(𝜶,𝑏=⟨𝐬,𝜶⟩/𝑞+𝑒mod1)can be transformed to(𝜶,2⟨𝐬,𝜶⟩mod𝑞+𝐞^′mod2𝑞)∈ℤ^𝑛_𝑞×ℤ_2𝑞by mapping𝑏↦2𝑞𝑏+𝐷_{ℤ−2𝑞𝑏,𝑠}, for𝑒^′←𝐷_ℤ,𝛼𝑞and𝑠²=(𝛼𝑞)²−(2𝛼^′𝑞)²≥4𝑛≥𝜂_𝜖(ℤ)²according to Theorem 3.1 of [28]. Clearly, by the above mapping, the uniform instance𝑂_$overℤ^𝑛_𝑞×𝕋is mapped to the uniform distribution overℤ^𝑛_𝑞×ℤ_2𝑞.
In game𝐺₃,(𝐀_𝐫^(𝟎),𝐛_𝟎)is in fact an instance of𝑂_𝑠. In game𝐺₄,(𝐀_𝐫^(𝟎),𝐛_𝟎)is an uniform random instance𝑂_$overℤ^𝑛×𝑚0_𝑞×ℤ^𝑛_2𝑞. Because LWE is pseudorandom, the above discretized distribution is also pseudorandom under the constraint condition for𝛼^′=𝛼/3≥2√𝑛/𝑞. Therefore, under discretized LWE assumption, the games𝐺₄and𝐺₃are computationally indistinguishable.
Next, we analyze the adversary’s advantage in the game𝐺₄. According to leftover hash lemma,(𝐀_𝐫^(𝟎),𝐛_𝟎,𝐀_𝟎𝐓_𝐫,𝐛_𝟎𝐓_𝐫)isnegl(𝑛)-uniform, when choosing𝐓_𝐫as in𝐺₄. Therefore, the challenge ciphertext has at mostnegl(𝑛)-far distribution when encrypting any different messages. Consequently, the adversary’s advantage in𝐺₄is negligible.

Theorem 26 (unforgeability). In standard model, the proposed signcryption is strongly unforgeable against inner adaptively chosen message attacks (SUF-CMA) assuming that𝑆𝐼𝑆_𝑞,𝛽for large enough𝛽=𝑂(𝜆(𝑛𝑘)^3/2)⋅𝜔(log𝑛)³is hard.

Proof. We prove it by contradiction. If an adversaryℱcan forge a signcryption in the proposed scheme, then the simulator can forge a signature of the above SUF-CMA signature scheme used in the proposed scheme.
Initial:𝒞gets public parameter𝒫_𝑝and his/her public/private keys(𝐴^∗_𝑠,𝑇^∗_𝑠)by running successively the algorithms Setup and KeyGen and then𝒞gives𝐴^∗_𝑠and𝒫_𝑝toℱ.
Singcrypt query: in this phase, the adversaryℱcan perform polynomially bounded signcryption queries as follows. Whenℱsubmits a message (𝐮and a intended receiver’s public key𝐀_𝐫) for querying. (For convenience, we denote the intended receiver’s private key by𝐓_𝐫).𝒞gets a signcryption value by𝐜^′←𝐒𝐢𝐠𝐧𝐜𝐫𝐲𝐩𝐭(𝐮,𝐀_𝐫,𝐀^∗_𝐬,𝐒𝐊^∗_𝐬)and gives𝐜^′toℱ.
Forgery:ℱoutputs a receivers public/private keys(𝐀^∗_𝐫,𝐓^∗_𝐫)and a fresh ciphertext𝑐^∗=(𝐮,𝐛,𝐜)under the sender’s public key𝐀^∗_𝐬and the receiver’s private key𝐓^∗_𝐫. Because𝑐^∗is a valid ciphertext,𝒞does what follows.(1)Decrypt(𝐮,𝐛)with𝐓^∗_𝐫to obtain𝝈_𝟏.(2)Decrypt𝐜with𝐻₂(𝝈_𝟏,𝑏)to obtain(𝐮∣𝝈_𝟐∣𝐫_𝟏∣𝐫_𝟐).(3)Combine𝝈_𝟏and𝝈_𝟐to obtain𝝈.
In the proposed scheme, we use the signature scheme of [17]. However the syndrome𝐲in the signature scheme is replaced by a chameleon hash value of the message𝐮and some random𝐫. For convenience, the signature scheme involving a chameleon hash function is calledMP_𝑐signature scheme. The signature scheme of [17] is SUF-SMA in the standard model assuming the hardness ofSIS_𝑞,𝛽for large enough𝛽=𝑂(𝜆(𝑛𝑘)^3/2)⋅𝜔(log𝑛)³;therefore theMP_𝑐signature scheme is SUF-CMA in the standard model according to [33, Lemma 2.3] or [34, Lemma 2.1].
Because𝑐^∗is a valid ciphertext,(𝝈,𝐫_𝟏)is a validMP_𝑐signature on message𝐮. Now, we have got a contradiction. Consequently, the proposed signcryption scheme is also SUF-CMA assuming the hardness ofSIS_𝑞,𝛽for𝛽=𝑂(𝜆(𝑛𝑘)^3/2)⋅𝜔(log𝑛)³.

6. Performance Analysis and Simulations

This section compares the ciphertext length, computational cost, key size, and so forth in the proposed scheme with that in the normal signature-then-encryption diagram and the existing signcryption schemes based on lattice.

The dimension of public keys𝐀∈ℤ_𝑞^𝑛×𝑚need to be declared firstly. Assuming that the security parameter𝑛is the same in LMK12 [14], WHW12 [15], and ours. In LMK12 [14] and WHW12 [15], the public/private keys for signature and encryption are all generated by the approach in [29], and the dimension𝑚meets𝑚^′=6𝑛log𝑞. In our scheme, the trapdoor generation algorithm is the approach proposed in [17]. In order to meet the conditions: statistically close to uniform and computationally pseudorandom, let dimension𝑚=2𝑛log𝑞for public key inℤ_𝑞^𝑛×𝑚. For convenience, the modulo𝑞is assumed to be same in the three schemes, although the𝑞in our scheme might be smaller than that in LMK12 [14] and WHW12 [15]. It needs to be illustrated that the signature scheme used in ours is that proposed in [17]. The matrix used in it is inℤ^𝑛×𝑚1, where𝑚₁=𝑚+𝑛𝑘for𝑘=log𝑞.

6.1. Comparison with Signature-Then-Encryption Diagram

First, we compare on ciphertext length. When we send an𝑙^′-bit length message, the normal signature-then-encryption diagram uses [17] to sign, and the signature length is approximately𝑚₁log𝑞bits. It uses [17] to encrypt the plaintext, and the ciphertext length is 𝑙^′(𝑛𝑘)𝑛log𝑞+𝑚log2𝑞≈2𝑙^′log𝑞, (25) but this can only achieve CCA1 security. Aiming to achieve CCA2 security, a good candidate is to produce one time signature (OTS) for the ciphertext. For efficiency, it can achieve this target to sign for the hash value of ciphertext. The signature length of OTS is also𝑚₁log𝑞. In this way, the total sum of bits is about 𝑚₁𝑙log𝑞+^′(𝑛𝑘)𝑛log𝑞+𝑚log𝑞+𝑚₁log𝑞≈6𝑛log²𝑞+2𝑙^′log𝑞. (26) In our scheme, the form of ciphertext is(𝝁,𝐛,𝐜). In a ciphertext,𝐜is the ciphertext for(𝐮∣𝝈_𝟐∣𝐫_𝟏∣𝐫_𝟐)with a symmetric encryption scheme whose plaintext and ciphertext are of equal length. The length for𝝁,𝐛,𝝈_𝟐is (ablout)𝑛log𝑞,𝑚log2𝑞, and𝑚₁log𝑞, respectively. In the following discussion, we assume that the bits need for representing a variable nearly equals to its min-entropy. Because𝐫_𝟏←_$𝐷_ℤ^𝑛𝑘_,𝑠𝑠(see Section 4.2), its min-entropy is about𝑛𝑘by Proposition 9 items (2). As a result, the length of𝐫_𝟏is about𝑛𝑘bits. In a similar way, the length of𝐫_𝟐is about𝑛𝑘. Consequently, the ciphertext length of our scheme is about 𝑙^′++𝑛log𝑞+𝑚log2𝑞𝑛log𝑞+𝑚₁log𝑞−𝑛𝑘+𝑛𝑘+𝑛𝑘≈5𝑛log²𝑞+𝑙^′. (27) The ciphertext length of ours is shorter than that of the signature-then-encryption diagram. Furthermore, the longer the length of the plaintext is, the larger our advantage is.

Second, we compare on the computational cost. We first compare on signcryption. The computational cost of the signature-then-encryption diagram mainly consists of the cost of signature and that of public key encryption. The cost of signature is two pre-image sampling by using Algorithm 4. The public key encryption needs roughly⌈𝑙^′/(𝑛𝑘)⌉times. The main computational cost of our scheme consists of the following: the cost of signature, the cost of public key encryption, and the cost of symmetrical encryption. Because the cost of symmetrical encryption (resp., decryption) is much smaller than the public key encryption (resp., decryption) and signature (resp., verification for signature), it can be ignored. The cost of signature is also a preimage sampling by using Algorithm 4. The public key encryption is one time. Clearly, the computational cost of Signcrypt is far less than that of the signature-then-encryption diagram. With the growth of plaintext length, the advantage in the total computational cost of our Signcrypt becomes larger.

Next, we compare on Unsigncrypt. Our public decryption and signature verification are both one time, while the signature-then-encryption diagram needs⌈𝑙^′/(𝑛𝑘)⌉times and two times, respectively. From the above analysis, the computational cost of Signcrypt and the ciphertext length are much lower those of than the signature-then-encryption diagram, in particular for long plaintext.

6.2. Comparison with the Schemes of LMK12 [14] and WHW12 [15]

Due to employing simpler, tighter, and more efficient trapdoors, our scheme inherits some advantages from the technique suggested by [17]. Now, let us compare the ciphertext length, computational cost, public key size, private key size, security model and security, and so forth among our scheme and the existing lattice-based signcryption schemes such as LMK12 [14] and WHW12 [15].

Firstly, we compare on ciphertext length. The ciphertext of WHW12 [15] is the form(𝐛_𝟏,𝐛_𝟐,…,𝐛_𝐥𝟎)where𝑙₀is big enough (say,𝑙₀≥80) such that2^−𝑙0is negligible. The length of𝐛_𝑖is𝑚^′log𝑞=6𝑛log²𝑞for𝑖∈[𝑙₀]. Consequently, the total length of ciphertext is𝑙^′+6𝑙₀𝑛log²𝑞. The ciphertext of LMK12 [14] is the form of(𝑐,𝑟,𝐮). The length of𝑟can be omitted since its length is much smaller than the length of𝑐or𝐮. The length of𝐮is𝑚^′log𝑞=6𝑛log²𝑞and the length of𝑐is equal to the length of plaintext. As a result, the ciphertext length of LMK12 [14] is about𝑙^′+6𝑛log²𝑞. Our ciphertext length is also𝑙^′+5𝑛log²𝑞(see Section 6.1).

Secondly, we compare the public parameter size. Since in WHW12 [15] scheme and our proposal, the public parameters include several matrices, while in LMK12 [14] scheme the public parameters just include some scales such as𝑛,𝑚^′,and𝑞, it is convenient to merely count the representation size for the involved matrices. The role of the parameter𝜆in the proposed scheme is the same as𝑙₀in WHW12 [15], and we replace it with𝑙₀for convenience. Then, the public parameter sizes of WHW12 [15] and ours are2(𝑙₀−1)𝑛𝑚^′log𝑞=12(𝑙₀−1)𝑛²log²𝑞and𝑙₀𝑛𝑚log𝑞=2𝑙₀𝑛²log²𝑞, respectively, while the public parameter size of LMK12 [14] can be neglected. Thirdly, we compare the public/private keys size, that is, the bits number needed for representing the keys. The public key size of WHW12 [15] is2𝑛𝑚^′log𝑞=12𝑛²log²𝑞, and the private key size is2𝑚^′2log𝑞=72𝑛²log³𝑞. The public key size of LMK12 [14] is𝑛𝑚log𝑞=6𝑛²log²𝑞and the private key size is𝑚^′2log𝑞=36𝑛²log³𝑞. The public key size of ours is𝑛𝑚log𝑞=2𝑛²log²𝑞, and the private key size is𝑚₀𝑛𝑘log𝑞=𝑚₀𝑛log²𝑞=𝑛²log³𝑞, where𝑚₀=𝑛log𝑞(see Section 4.2).

Finally, let us compare on computational cost. Without loss of generality, the cost of all hash calculation in WHW12 [15] and LMK12 [14] and general hashes𝐻₀,𝐻₁, and𝐻₂in our scheme are not considered. However, the hashes in our scheme with special structures, such as𝐻_𝐹and𝐻_𝐀𝐬^(𝐡), are taken into account. In detail, our analysis is given below.(i)First, we compare on the computational cost of Signcrypt. In WHW12 [15], the signature cost is one time preimage sampling (PIS) with complexityΩ(𝑛²log²𝑞)[17]; in addition, the cost of its public key encryption is𝑙₀𝑛𝑚^′=6𝑙₀𝑛²log𝑞multiplication operations overℤ_𝑞,6𝑙₀𝑛log𝑞addition operations overℤ_𝑞plus(𝑙₀−1)𝑚^′=6(𝑙₀−1)𝑛log𝑞discrete Gaussian samples (DGS); moreover, the cost of symmetric encryption is𝑡_ℰ. In LMK12 [14], the cost of its signature is also one time preimage sampling. However, his scheme used preimage obtained from signature as Gaussian error of public key encryption by utilizing the technique in [35] and need not discrete Gaussian sample. As a result, the cost of its public key encryption is𝑛𝑚^′=6𝑛²log𝑞multiplication operations overℤ_𝑞and6𝑛log𝑞addition operations overℤ_𝑞. In addition, his symmetric encryption realized by XOR operation and the corresponding cost can be neglected. In our scheme, the cost of the signature is one time preimage sampling by using Algorithm 4 with complexity𝑂(𝑛log𝑞)[17], and the cost of symmetric encryption is𝑡_ℰ. The cost of public key encryption is about8𝑛²log𝑞+𝑛²log²𝑞multiplications overℤ_𝑞plus𝑙₀/2⋅𝑛²log²𝑞additions overℤ_𝑞and7𝑛log𝑞DGS.(ii)Next, we compare on the computational cost of Unsigncrypt. In the three schemes, all algorithms Unsigncrypt involve the multiplications overℤ_𝑞, additions overℤ_𝑞,and symmetric decryption operations. The unsigncryption cost of WHW12 [15] is72𝑛²log²𝑞+(𝑙₀+6)𝑛²log𝑞multiplications overℤ_𝑞plus6𝑙₀𝑛log𝑞additions overℤ_𝑞. The unsigncryption cost of LMK12 [14] is72𝑛²log²𝑞+6𝑛²log𝑞multiplications overℤ_𝑞plus6𝑛log𝑞additions overℤ_𝑞. The cost of our unsigncryption is about9𝑛²log𝑞+3𝑛²log²𝑞multiplications overℤ_𝑞and𝑙₀/2⋅𝑛²log²𝑞additions overℤ_𝑞. The symmetric decryption in WHW12 [15] and ours is unspecified and in LMK12 [14] is XOR operation. Although the involved symmetric decryption is apparently more expensive than the involved XOR operation in LMK12 [14] scheme, the experiments show that this cost is very small.

To summarize, the above comparisons can be collected in Table 2. An overview of this table can also be abstracted in Table 1.

Table 2 

Performance comparison with WHW12 [15] and LMK12 [14].

6.3. Simulations

Our simulation environments are given below:(i)CPU: Intel(R) Core(TM) i7 860 @CPU 2.79?GHz;(ii)RAM: 8?G;(iii)OS: Win 7, 64 bit;(iv)programming platform: Visual Studio 2008.

We conduct 7 simulations with different parameter settings. These settings, given in Table 3, are suggested from [21], [22], and [17], respectively. In particular, under the suggestion of [17], to break a related lattice-based cryptosystem, one needs about2⁴⁶core-year computation time by using the state-of-the-art in lattice basis reduction [36, 37] on a 64-bit 1.86?GHz Xeon platform. Note that with the purpose to achieve the same security level, the lattice dimensions𝑛s are different by using different lattice generation techniques.

Table 3 

Parameter Settings.

Then, for each setting, we perform random signcryption and unsigncryption 100 times and then collect the average time cost for signcryption and unsigncryption. The results are given in Table 4 and illustrated in Figures 1 and 2. Note that in these figures, we adopt logarithmic coordinates with the purpose to give visible changes on those data that are different hugely.

Table 4 

Average signcryption/unsigncryption time (s).

Figure 1 

Average signcryption speed.

Figure 2 

Average unsigncryption speed.

From Tables 2, 4, 5, and 6 and Figures 1, 2, 3, 4, 5, and 6, we can see that our improvements are observably as follows.(i)Under the settings 1~6, the average signcryption time of our scheme increases slowly from 0.489?s to 3.476?s, about 3 times and 5~13 times faster than Li’s scheme and Wang’s scheme, respectively. Under these settings, the average unsigncryption time of our scheme increases slowly from 0.454?s to 3.48?s, about 3 times and 260 times faster than Li’s scheme and Wang’s scheme, respectively.(ii)Under the setting 7, the average signcryption time of our scheme is 9.309?s, about 580 times faster than Li’s scheme and Wang’s scheme. Under this setting, the average unsigncryption time of our scheme is 10.954?s, about 400 times and 33000 times faster than Li’ scheme and Wang’s scheme, respectively.

Table 5 

Average matrix computation cost in signcryption/unsigncryption (s).

Table 6 

Average sampling cost in signcryption.

Figure 3 

Average matrix computation cost in signcryption.

Figure 4 

Average matrix computation cost in unsigncryption.

Figure 5 

Average preimage sampling cost in signcryption.

Figure 6 

Average discrete gaussian sampling cost in signcryption (s).

To understand the above huge difference on the performance of our scheme, Li’s scheme, and Wang’s scheme, we would like to give the following further explanations. The time cost of signcryption is mainly occupied by three categories of computation:(1)matrix operations, including modular addition between matrices and modular multiplication among matrices and vectors,(2)preimage sampling,(3)discrete Gaussian sampling.

First, in our signcryption process, the time cost of matrix operations is mainly occupied in step 4(d) and 1(a) (see Section 4.2). Since step 1(a) is directly related to messages that are to be signcrypted, this is not an easy method to optimize this step; say by using precomputation. However, step 4(d) can be optimized since the matrix𝐐has nonzero entries merely in the main and the second diagonals. By utilizing this feature, we reduce the computation cost of step 4(d) from𝑛³log³𝑞multiplications to2𝑛log𝑞multiplications. The performance comparisons on average matrix computation cost in signcryption and unsigncryption are given in Table 5 and Figures 3 and 4, respectively. Second, both Li and Wang use the preimage sampling technique given in [20] and its complexity isΩ(𝑛²log²𝑞), while we use the preimage sampling technique given in [17], where the sample oracle is instantiated by the technique given in [28], and its complexity is reduced to𝒪(𝑛log𝑞). Third, our signcryption process needs to perform5𝑛log𝑞times Gaussian sampling, while Wang’s signcryption needs to perform in total6𝑙₀𝑛log𝑞times Gaussian sampling, where𝑙₀should enable2^−𝑙0to be negligible; say𝑙₀≥80. Note that Li’s signcryption reuses preimages as Gaussian error vectors and thus does not need further Gaussian sampling. The performance comparisons on average sampling cost, including the cost for preimage sampling and the cost for discrete Gaussian sampling, are collected in Table 6 and depicted in Figures 5 and 6. Note that in unsigncryption process, there is no sampling cost.

7. Conclusions

In this paper, we proposed a signcryption scheme in the standard model based on lattice hard problems. The scheme is proven to be indistinguishable against inner adaptively chosen ciphertext attacks under LWE assumption and strongly unforgeable against inner adaptively chosen message attacks under SIS assumption. Moreover, by using simpler, tighter, and more efficient trapdoors suggested by Micciancico and Perkeit, the cost of our scheme is much lower than existing lattice-based signcryption schemes. Another attractive problem is designing an efficient identity-based signcryption scheme in the standard model.

Acknowledgments

This work is partially supported by the National Natural Science Foundation of China (NSFC) (nos. 61370194, 61103198, 61121061, and 61070251), the NSFC A3 Foresight Program (no. 61161140320), and the JSPS A3 Foresight Program. The third author was also partially supported by JSPS KAKENHI Grant (no. 23500031).