INFORMATICA Informatica 1822-88440868-49520868-4952 Vilnius University INFOR506 10.15388/22-INFOR506 Research Article Fully Continuous Leakage-Resilient Certificate-Based Signcryption Scheme for Mobile Communications TsengYuh-Minymtseng@cc.ncue.edu.tw1∗ TsaiTung-Tso2 HuangSen-Shan1 Department of Mathematics, National Changhua University of Education, Changhua 500, Taiwan Department of Computer Science and Engineering, National Taiwan Ocean University, Keelung 202, Taiwan Corresponding author. 20231912202234119922292022122022 © 2023 Vilnius University2023 Open access article under the CC BY license.

Due to the popularity of mobile communication, many computing devices are exposed to remote environments without physical protection so that these devices easily suffer from leakage attacks (e.g., side-channel attacks). Under such leakage attacks, when a computing device performs some cryptographic algorithm, an adversary may acquire partial bits of secret keys participated in this cryptographic algorithm. To resist leakage attacks, researchers offer leakage-resilient cryptography as a solution. A signcryption scheme combines signing and encrypting processes to simultaneously provide both authentication and confidentiality, which is an important cryptographic primitive. Indeed, many leakage-resilient signcryption schemes under various public key system (PKS) settings were proposed. Unfortunately, these schemes still have two shortcomings, namely, bounded leakage resilience and conditionally continuous leakage resilience. In this paper, a “fully” continuous leakage-resilient certificate-based signcryption (FCLR-CBSC) scheme is proposed. Security analysis is formally proved to show that our scheme possesses both authentication and confidentiality against two types of adversaries in the certificate-based PKS setting. Performance analysis and simulation experience show that our scheme is suited to run on both a PC and a mobile device.

 leakage attacks signcryption certificate-based public key system leakage resilience Introduction

In the traditional public key system (PKS) setting (Rivest et al., 1978), a public-key infrastructure (PKI) needs to be established to create and manage each member’s certificate, which is used to validate the member’s public key. To lighten the PKI establishment cost, Boneh and Franklin (2001) presented a practical identity-based PKS (ID-PKS) setting with bilinear pairings, in which a member’s identity is regarded as the member’s public key and no certificate is needed. However, the ID-PKS setting suffers from a constitutional key escrow problem. In 2003, the certificateless PKS (CL-PKS) (Al-Riyami and Paterson, 2003) and the certificate-based PKS (CB-PKS) (Gentry, 2003) settings were constructed respectively to clear up the key escrow problem. Afterwards, the research of various cryptographic mechanisms under the CB-PKS and the CL-PKS settings have been thoroughly studied.

Typically, the security of these cryptographic mechanisms under these PKS settings mentioned above is dependent on the security of secret keys participated in these cryptographic mechanisms, and so these secret keys must be entirely concealed to adversaries. However, due to the popularity of mobile communication, many computing devices are exposed to remote environments without physical protection so that these devices easily suffer from leakage attacks (e.g. side-channel attacks) (Kocher et al., 1999; Brumley and Boneh, 2005; Biham et al., 2008). By leakage attacks, when a computing device performs some cryptographic algorithm, an adversary may acquire partial bits of secret keys participated in this algorithm. To resist such leakage attacks, researchers offer leakage-resilient cryptography as a solution. In the past, numerous leakage-resilient signature (LRS) schemes (Galindo and Virek, 2013; Wu et al., 2019; Tseng et al., 2020; Wu et al., 2020b), leakage-resilient encryption (LRE) schemes (Kiltz and Pietrzak, 2010; Galindo et al., 2016; Wu et al., 2018, 2020a; Tseng et al., 2022), and leakage-resilient authenticated key agreement protocols (Tseng et al., 2021; Peng et al., 2021; Tsai et al., 2022) under various PKS settings have been published in the literature.

For reducing communication and computation costs, a signcryption scheme (Zheng, 1997) combines signing and encrypting processes in a mechanism to simultaneously provide both authentication and confidentiality, which is an important cryptographic primitive. In the past, some signcryption schemes under various PKS settings have been proposed that include PKI-based signcryption (PKI-SC) schemes (Ullah et al., 2020; Ali et al., 2020), certificateless signcryption (CLSC) schemes (Khan et al., 2020; Wu et al., 2022) and certificate-based signcryption (CBSC) schemes (Ullah et al., 2019; Hussain et al., 2020). Nevertheless, these signcryption schemes mentioned above are unable to resist leakage attacks. Indeed, several leakage-resilient (LR) signcryption schemes under the CL-PKS and the CB-PKS settings have been proposed. However, these LR signcryption schemes still have two shortcomings, that is, bounded leakage resilience and conditionally continuous leakage resilience, which will be discussed later. Hence, in this paper, we aim to propose a “fully” continuous leakage-resilient certificate-based signcryption (FCLR-CBSC) scheme to remove the shortcomings of the previously proposed schemes.

Related Work

Here, let’s introduce two types of leakage attack models, that is, bounded and continuous (i.e. unbounded). The bounded leakage attack model has an impractical property that entire leaked bits of a secret key are bounded in a fractional proportion of the secret key during the usage life of an LR algorithm (Alwen et al., 2009; Katz and Vaikuntanathan, 2009). In such a case, when the leaked bit number of the secret key exceeds the proportion, the secret key can no longer be used. Contrarily, the continuous leakage attack model allows adversaries to continuously obtain a secret key’s partial bits in each usage of the secret key during the usage life of the associated LR algorithm. Therefore, an LR cryptographic scheme against continuous leakage attacks has the unbounded leakage property and is more suitable for real practical environments (Kiltz and Pietrzak, 2010; Galindo and Virek, 2013).

As mentioned earlier, several LR signcryption schemes under the CL-PKS and the CB-PKS settings have been proposed to remove the key escrow problem. Here, let’s review these LR certificateless signcryption (LR-CLSC) (Zhou et al., 2016; Yang et al., 2019) and LR certificate-based signcryption (LR-CBSC) (Zhou et al., 2021) schemes. Zhou et al. (2016) adopted a non-interactive zero-knowledge mechanism to propose an LR-CLSC scheme. As we know, the usage of the non-interactive zero-knowledge mechanism is very time-consuming so that Zhou et al.’s scheme is unsuitable for mobile devices. Subsequently, Yang et al. (2019) presented an improvement on Zhou et al.’s scheme to remove the usage of the non-interactive zero-knowledge mechanism to achieve better performance. However, both schemes (Zhou et al., 2016; Yang et al., 2019) are only secure against bounded leakage attacks and cannot resist the attacks of adversaries with continuous leakage abilities.

To achieve continuous leakage-resilient property, Zhou et al. (2021) first presented a bounded LR-CBSC scheme and adopted the secret key update method proposed by Dodis et al. (2010) to obtain a “conditionally” continuous LR-CBSC (CCLR-CBSC) scheme. That is, by Dodis et al.’s secret key update method, a continuous version is constructed from the associated bounded LR cryptographic scheme. However, Kiltz and Pietrzak (2010) have previously shown that Dodis et al.’s secret key update method has a shortcoming in the sense that the key update process itself does not allow adversaries to leak any bits of the secret key even if the secret key actually participates in the computation of the key update method. Therefore, Zhou et al.’s scheme only possesses the “conditionally” continuous leakage-resilient property.

 Contributions

As mentioned earlier, the LR-CLSC schemes in Zhou et al. (2016), Yang et al. (2019) are only secure against bounded leakage attacks and the CCLR-CBSC scheme in Zhou et al. (2021) only possesses the “conditionally” continuous leakage-resilient property. In this paper, a “fully” CLR-CBSC (FCLR-CBSC) scheme is proposed. In our FCLR-CBSC scheme, there are two roles, namely, a trusted certificate authority (CA) and members. A member ID m sets the associated member secret key MSK m . The CA uses its own secret key CSK to compute the member’s certificate CTF m using the member ID m ’s identity information and public key, and returns it back to the member ID m . By combining the adversary models of both the LR certificate-based signature (LR-CBS) scheme (Wu et al., 2019) and the LR certificate-based encryption (LR-CBE) scheme (Wu et al., 2020a), we define the adversary model of the FCLR-CBSC scheme. In this adversary model, there are two types of adversaries that include an uncertified member and the honest-but-curious CA.

Comparisons between the related schemes and our scheme.

Scheme Zhou et al.’s LR-CLSC scheme (2016) Yang et al.’s LR-CLSC scheme (2019) Zhou et al.’s CCLR-CBSC scheme (2021) Our proposed FCLR-CBSC scheme
PKS setting CL-PKS CL-PKS CB-PKS CB-PKS
Leakage of a member’s secret key Allowed Allowed Allowed Allowed
Leakage of the system’s secret key Not allowed Not allowed Allowed Allowed
Leakage model Bounded Bounded Conditionally continuous Fully continuous

To realize the “fully” continuous leakage-resilient property, our scheme adopts the key update method proposed by Kiltz and Pietrzak (2010) to update the member ID m ’s secret key MSK m and certificate CTF m participated in both the signcryption and the unsigncryption algorithms, and the CA’s secret key CSK participated in the certificate generation algorithm. In the process of the key update method, these secret keys or certificates are allowed to be leaked by an adversary so that our scheme has the fully continuous leakage-resilient property. Table 1 lists the comparisons between the LR-CLSC schemes in Zhou et al. (2016), Yang et al. (2019), the CCLR-CBSC scheme in Zhou et al. (2021) and our FCLR-CBSC scheme in terms of PKS setting, leakage of a member’s secret key, leakage of the system’s secret key and leakage model. It is obvious that only our scheme achieves the fully continuous leakage-resilient property and tolerates the leakages of both the system’s secret key and a member’s secret key. Finally, we employ the security proving method of the generic bilinear group (GBG) model (Boneh et al., 2005) to show that our scheme possesses both authentication and confidentiality against two types of adversaries in the CB-PKS setting. Also, performance analysis and simulation experience demonstrate that our scheme is suited to run on both a PC and a mobile device.

 Paper Structure

The remainder of this paper comprises six parts. Four preliminaries are introduced in Section 2. We define a new framework and security model of FCLR-CBSC schemes in Section 3. In Section 4, our FCLR-CBSC scheme is demonstrated. The security analysis of our scheme is given in Section 5. Performance analysis and conclusions are given in Sections 6 and 7, respectively.

 Preliminaries Bilinear Pairing Set

Let { g 1 , g 2 , G 1 , G 2 , p , e ˆ } be a bilinear pairing set. The reader can refer to Boneh and Franklin (2001) for the parameter selections of the bilinear pairing set. g 1 and g 2 are, respectively, generators of the multiplicative groups G 1 and G 2 with the same prime order p. The bilinear pairing function e ˆ : G 1 × G 1 → G 2 satisfies three properties as presented below:

Bilinear property: e ˆ ( g 1 x , g 1 y ) = e ˆ ( g 1 , g 1 ) x y , for any x , y ∈ Z p ∗ .

Non-degenerate property: e ˆ ( g 1 , g 1 ) = g 2 ≠ 1.

Computable property: e ˆ ( X , Y ) can be effectively computed for any X , Y ∈ G 1 .

Security Assumptions

Our proposed FCLR-CBSC scheme is based on two security assumptions as presented below:

Strong-collision-resistant hash (SCRH) assumption: Let a hash function H : { 0 , 1 } ∗ → { 0 , 1 } l , l is a large integer, be strong-collision-resistant. Namely, it is difficult to get two different strings S 1 , S 2 ∈ { 0 , 1 } ∗ such that H ( S 1 ) = H ( S 2 ).

Discrete logarithm (DL) assumption: In the bilinear pairing set { g 1 , g 2 , G 1 , G 2 , p , e ˆ } presented earlier, it is difficult to compute x ∈ Z p ∗ for given g 1 x ∈ G 1 or g 2 x ∈ G 2 .

Generic Bilinear Group Model

The generic bilinear group (GBG) model (Boneh et al., 2005) is a security proving technique of cryptographic schemes. This GBG model is combined into the security game of a cryptographic scheme. In the security game played by an adversary and a challenger, the challenger first creates a bilinear pairing set { g 1 , g 2 , G 1 , G 2 , p , e ˆ }. When the adversary performs operations in the bilinear pairing set, it must request the associated queries to the challenger that include the multiplicative query Q 1 of G 1 , the multiplicative query Q 2 of G 2 and the bilinear pairing query Q e ˆ . Additionally, the challenger sets two injective random mappings to respectively encode every element of G 1 and G 2 to a distinct bit string, namely, ζ 1 : Z p ∗ → Ψ G 1 and ζ 2 : Z p ∗ → Ψ G 2 that satisfy Ψ G 1 ∩ Ψ G 2 = ∅ and | Ψ G 1 | = | Ψ G 2 | = p. The behaviours of three associated queries Q 1 , Q 2 and Q e ˆ , for x , y ∈ Z p ∗ , are defined as follows:

Q 1 ( ζ 1 ( x ) , ζ 1 ( y ) ) → ζ 1 ( x + y mod p ).

Q 2 ( ζ 2 ( x ) , ζ 2 ( y ) ) → ζ 2 ( x + y mod p ).

Q e ˆ ( ζ 1 ( x ) , ζ 1 ( y ) ) → ζ 2 ( x · y mod p ).

 Note that ζ 1 ( 1 ) and ζ 2 ( 1 ) equal g 1 and g 2 , respectively. Finally, the adversary would answer the DL problem on G 1 / G 2 if it found any collision on G 1 / G 2 after finishing the security game.

 Entropy Evaluation of Secret Keys

Later, we will employ the entropy evaluation of secret keys with partial leakage to establish the security theorems of the proposed scheme. Here, we first introduce two previous consequences. In 2008, Dodis et al. (2008) presented a result (Lemma 1 below) about the entropy evaluation of a secret key K under the leakage function F ( K ), where F : K → { 0 , 1 } ω and ω is the leakage bit size. Moreover, Galindo and Virek (2013) discussed the entropy evaluation of multiple secret keys to obtain the other result (Lemma 2 below).

Let K be a secret key and F : K → { 0 , 1 } ω be its associated leakage function, where ω is the leakage bit size. Under the leakage function F, we have H ˜ ∞ ( K | F ( K ) ) ≧ H ∞ ( K ) − ω, where H ∞ and H ˜ ∞ denote the min-entropy and the average conditional min-entropy, respectively.

Let K 1 , K 2 , … , K n be multiple secret keys participated in a computation formula. Let M V P ∈ Z p [ K 1 , K 2 , … , K n ] denote a multiple-variable polynomial that has the degree d. Assume that PD i denotes the probability distribution of K i = k i ← Z p under a leakage function F i with the leakage bit size ω. Thus, we have H ∞ ( PD i ) ≧ log p − ω, for i = 1 , 2 , … , n. When all PD i are mutually independent, we have Pr [ MVP ( K 1 = k 1 , K 2 = k 2 , … , K n = k n ) = 0 ] ≦ ( d / p ) 2 ω , which is negligible if ω < ( 1 − ε ) log p, where ε is a positive fraction.

 Notations, Framework and Adversary Model

An FCLR-CBSC scheme composes of two roles, namely, a trusted certificate authority (CA) and members. A member ID m (a sender ID s or a receiver ID r ) first sets the member’s secret key MSK m and first public key MPK m , and transmits ( ID m , MPK m ) to the CA. The CA uses a secret key CSK to compute and return the member’s certificate CTF m and second public key UPK m to the member ID m via a secure channel. By taking as input a message msg and the public key pair ( MPK r , UPK r ) of the receiver ID r , the sender ID s uses her/his certificate and secret key to compute a ciphertext CT and send ( ID s , CT) to the receiver ID r . By taking as input a ciphertext CT and the public key pair ( MPK s , UPK s ) of the sender ID s , the receiver ID r returns msg if CT is “Valid”; otherwise returns “Invalid”. The system model of the FCLR-CBSC scheme is depicted in Fig. 1.

The system model of an FCLR-CBSC scheme.

To achieve fully continuous leakage-resilient property (Kiltz and Pietrzak, 2010; Galindo and Virek, 2013), every secret key or certificate in the system is partitioned into two parts, which must be updated before being participated in each computation round. Assume that the CA’s secret key CSK is initially partitioned into the beginning secret key pair ( CSK 1 , 0 , CSK 2 , 0 ). Additionally, let the CA’s current secret key pair be ( CSK 1 , i − 1 , CSK 2 , i − 1 ), which must be updated to ( CSK 1 , i , CSK 2 , i ) when it participates in the i-th invocation of the certificate generation algorithm. Note that we have CSK = CSK 1 , 0 · CSK 2 , 0 = ⋯ = CSK 1 , i − 1 · CSK 2 , i − 1 = CSK 1 , i · CSK 2 , i . For the same reason, the member ID m ’s secret key MSK m and certificate CTF m are initially partitioned into the beginning secret key pair ( MSK m , 1 , 0 , MSK m , 2 , 0 ) and the certificate pair ( CTF m , 1 , 0 , CTF m , 2 , 0 ), respectively. Let the member ID m ’s current secret key and certificate pairs be, respectively, ( CTF m , 1 , j − 1 , CTF m , 2 , j − 1 ) and ( MSK m , 1 , j − 1 , MSK m , 2 , j − 1 ), which must be updated to ( CTF m , 1 , j , CTF m , 2 , j ) and ( MSK m , 1 , j , MSK m , 2 , j ) when they participate in the j-th invocation of the signcryption or unsigncryption algorithm. Note that we have MSK m = MSK m , 1 , 0 · MSK m , 2 , 0 = ⋯ = MSK m , 1 , j − 1 · MSK m , 2 , j − 1 = MSK m , 1 , j · MSK m , 2 , j and CTF m = CTF m , 1 , 0 · CTF m , 2 , 0 = ⋯ = CTF m , 1 , j − 1 · CTF m , 2 , j − 1 = CTF m , 1 , j · CTF m , 2 , j .

In the following, we first present some symbols and notations used in the proposed FCLR-CBSC scheme. Subsequently, a new framework and adversary model of FCLR-CBSC schemes are defined.

Symbols and Notations

For reference, the symbols and notations used in the proposed scheme are summarized in Table 2.

Symbols and notations.

Symbols/notations Meanings
PPS a public parameter set
CPK the CA’s public key
CSK the CA’s secret key
( CSK 1 , 0 , CSK 2 , 0 ) the CA’s beginning secret key pair
( CSK 1 , i , CSK 2 , i ) the CA’s i-th secret key pair
ID m the identity of a member (a sender ID s or a receiver ID r )
( MPK m , UPK m ) the public key pair of ID m
MSK m the certificate of ID m
( MSK m , 1 , 0 , MSK m , 2 , 0 ) the beginning secret key pair of ID m
( MSK m , 1 , j , MSK m , 2 , j ) the j-th secret key pair of ID m
CTF m the certificate of ID m
( CTF m , 1 , 0 , CTF m , 2 , 0 ) the beginning certificate pair of ID m
( CTF m , 1 , j , CTF m , 2 , j ) the j-th certificate pair of ID m
H ( ) a hash function
SKE ( ) / SKD ( ) symmetric-key encryption/decryption functions
ID s the identity of a sender (it is also a member)
ID r the identity of a receiver (it is also a member)
msg a message
CT a ciphertext
Framework

Based on the frameworks of both the LR-CBS (Wu et al., 2019) and the LR-CBE (Wu et al., 2020a) schemes, a new framework of FCLR-CBSC schemes is defined as follows.

An FCLR-CBSC scheme comprises five algorithms as presented below:

Initialization: The CA runs this algorithm to compute the CA’s secret key CSK and system public key CPK while generating and publishing a public parameter set PPS. Additionally, the CA also partitions CSK to set the beginning secret key pair ( CSK 1 , 0 , CSK 2 , 0 ).

Member secret key generation: A member ID m (a sender ID s or a receiver ID r ) runs this algorithm to compute her/his secret key MSK m and first public key MPK m . Additionally, the member ID m partitions MSK m to set the beginning secret key pair ( MSK m , 1 , 0 , MSK m , 2 , 0 ). Finally, the member ID m sends ( ID m , MPK m ) to the CA.

Certificate generation: Assume that the CA’s current secret key pair is ( CSK 1 , i − 1 , CSK 2 , i − 1 ). The CA first obtains a new current secret key pair ( CSK 1 , i , CSK 2 , i ) by updating ( CSK 1 , i − 1 , CSK 2 , i − 1 ). Upon receiving ( ID m , MPK m ) from the member ID m , the CA creates and returns the certificate CTF m and second public key UPK m to the member ID m . Upon receiving ( CTF m , UPK m ), the member ID m sets her/his beginning certificate pair ( CTF m , 1 , 0 , CTF m , 2 , 0 ) and public key pair ( MPK m , UPK m ).

Signcryption: Assume that the sender ID s ’s current certificate and secret key pairs are, respectively, ( CTF s , 1 , j − 1 , CTF s , 2 , j − 1 ) and ( MSK s , 1 , j − 1 , MSK s , 2 , j − 1 ). The sender ID s first obtains a new current certificate pair ( CTF s , 1 , j , CTF s , 2 , j ) and secret key pair ( MSK s , 1 , j , MSK s , 2 , j ) by updating ( CTF s , 1 , j − 1 , CTF s , 2 , j − 1 ) and ( MSK s , 1 , j − 1 , MSK s , 2 , j − 1 ), respectively. By taking as input a message msg and the public key pair ( MPK r , UPK r ) of the receiver ID r , the sender ID s runs this algorithm to return a ciphertext CT.

Unsigncryption: Assume that the receiver ID r ’s current certificate and secret key pairs are, respectively, ( CTF r , 1 , k − 1 , CTF r , 2 , k − 1 ) and ( MSK r , 1 , k − 1 , MSK r , 2 , k − 1 ). The receiver ID r first obtains a new current certificate pair ( CTF r , 1 , k , CTF r , 2 , k ) and secret key pair ( MSK r , 1 , k , MSK r , 2 , k ) by updating ( CTF r , 1 , k − 1 , CTF r , 2 , k − 1 ) and ( MSK r , 1 , k − 1 , MSK r , 2 , k − 1 ), respectively. By taking as input a ciphertext CT and the public key pair ( MPK s , UPK s ) of the sender ID s , the receiver ID r returns msg if CT is “Valid”; otherwise returns “Invalid”.

Adversary Model

Here, six continuous leakage functions f CA , i , h CA , i , f SC , j , h SC , j , f US , k and h US , k are used to simulate the leakage abilities of adversaries. In the i-th invocation of the Certificate generation algorithm, an adversary could obtain partial bits of the CA’s current secret key pair ( CSK 1 , i , CSK 2 , i ) by f CA , i and h CA , i . In the j-th invocation of the Signcryption algorithm, an adversary could obtain partial bits of the sender ID s ’s current certificate pair ( CTF s , 1 , j , CTF s , 2 , j ) and secret key pair ( MSK s , 1 , j , MSK s , 2 , j ) by f SC , j and h SC , j . In the k-th invocation of the Unsigncryption algorithm, an adversary could obtain partial bits of the receiver ID r ’s current certificate pair ( CTF r , 1 , k , CTF r , 2 , k ) and secret key pair ( MSK r , 1 , k , MSK r , 2 , k ) by f US , k and h US , k . Let ω be the maximal leakage bit length for each leakage function. Let Δ f CA , i , Δ h CA , i , Δ f SC , j , Δ h SC , j , Δ f US , k and Δ h US , k , respectively, denote their outputs of the six leakage functions. Therefore, we have | Δ f CA , i |, | Δ h CA , i |, | Δ f SC , j |, | Δ h SC , j |, | Δ f US , k |, | Δ h US , k | ≦ ω and their inputs/outputs are presented as follows:

Δ f CA , i = f CA , i ( CSK 1 , i ).

Δ h CA , i = h CA , i ( CSK 2 , i ).

Δ f SC , j = f SC , j ( CTF s , 1 , j , MSK s , 1 , j ).

Δ h SC , j = h SC , j ( CTF s , 2 , j , MSK s , 2 , j ).

Δ f US , k = f US , k ( CTF r , 1 , k , MSK r , 1 , k ).

Δ h US , k = h US , k ( CTF r , 2 , k , MSK r , 2 , k ).

 Based on the adversary models of both the LR-CBS (Wu et al., 2019) and the LR-CBE (Wu et al., 2020a) schemes, we define a new adversary model of FCLR-CBSC schemes. In the new adversary model, there are two types of adversaries ( A I and A II ) as presented below:

A I : A I simulates an “uncertified member” who can set any member ID m ’s secret key MSK m and first public key MPK m , but can obtain neither ID m ’s certificate CTF m nor second public key UPK m . Indeed, A I can get partial bits of the CA’s current secret key pair ( CSK 1 , i , CSK 2 , i ) in the i-th invocation of the Certificate generation algorithm. Also, A I could obtain partial bits of the sender ID s ’s current certificate pair ( CTF s , 1 , j , CTF s , 2 , j ) in the j-th invocation of the Signcryption algorithm. In the k-th invocation of the Unsigncryption algorithm, A I could obtain partial bits of the receiver ID r ’s current certificate pair ( CTF r , 1 , k , CTF r , 2 , k ).

A II : A II simulates an “honest-but-curious CA” who has the CA’s secret key CSK and produces any member ID m ’s certificate CTF m and second public key UPK m , but A II can obtain neither the member ID m ’s secret key MSK m nor first public key MPK m . Also, A II could obtain partial bits of the sender ID s ’s current secret key pair ( MSK s , 1 , j , MSK s , 2 , j ) in the j-th invocation of the Signcryption algorithm. In the k-th invocation of the Unsigncryption algorithm, A II could obtain partial bits of the receiver ID r ’s current secret key pair ( MSK r , 1 , k , MSK r , 2 , k ).

 An FCLR-CBSC scheme must possess two security properties, namely, authentication of signing process and confidentiality of encrypting process, that are modelled by two security games as defined below. (<inline-formula id="j_infor506_ineq_291"><alternatives><mml:math> <mml:msub> <mml:mrow> <mml:mi mathvariant="bold">G</mml:mi> </mml:mrow> <mml:mrow> <mml:mi mathvariant="bold">auth</mml:mi> </mml:mrow> </mml:msub></mml:math><tex-math><![CDATA[${\mathbf{G}_{\mathbf{auth}}}$]]></tex-math></alternatives></inline-formula>)<italic>.</italic>

The authentication property is modelled by the security game G auth that is played by an adversary A ( A I or A II ) and a challenger B. We say that an FCLR-CBSC scheme has existential unforgeability against both continuous leakage and adaptive chosen-message attacks (EXUF-CLRACMA) if no probabilistic polynomial time (PPT) adversary A has a non-negligible advantage to win the following game G auth .

Setup. The challenger B runs the Initialization algorithm in Definition 1 to get the CA’s secret key CSK and public key CPK while generating and publishing a public parameter set PPS. Also, B partitions CSK to set the beginning secret key pair ( CSK 1 , 0 , CSK 2 , 0 ). Additionally, if A is of type A II , B sends CSK to A II .

Queries. A may adaptively request the following queries to B at most η times.

Member key generation query ( ID m ): B produces and returns the member ID m ’s secret key MSK m and first public key MPK m .

Member secret key query ( ID m ): B returns the member ID m ’s secret key MSK m .

Certificate generation query ( ID m , MPK m ): B returns the member ID m ’s certificate CTF m and second public key UPK m .

Certificate generation leak query (i, f CA , i , h CA , i ): A may request this query only once. B returns Δ f CA , i = f CA , i ( CSK 1 , i ) and Δ h CA , i = h CA , i ( CSK 2 , i ).

Public key retrieve query ( ID m ): B returns the member ID m ’s public key pair ( MPK m , UPK m ).

Public key replace query ( ID m , ( MPK m ′ , UPK m ′ )): B records the replacement.

Signcryption query ( msg, ID s , ID r ): The sender ID s first obtains a new current certificate pair ( CTF s , 1 , j , CTF s , 2 , j ) and secret key pair ( MSK s , 1 , j , MSK s , 2 , j ) by updating ( CTF s , 1 , j − 1 , CTF s , 2 , j − 1 ) and ( MSK s , 1 , j − 1 , MSK s , 2 , j − 1 ), respectively. B returns a ciphertext CT.

Signcryption leak query ( ID s , j, f SC , j , h SC , j ): A may request this query only once. B returns Δ f SC , j = f SC , j ( CTF s , 1 , j , MSK s , 1 , j ) and Δ h SC , j = h SC , j ( CTF s , 2 , j , MSK s , 2 , j ).

Unsigncryption query ( CT, ID r ): The receiver ID r first obtains a new current certificate pair ( CTF r , 1 , k , CTF r , 2 , k ) and secret key pair ( MSK r , 1 , k , MSK r , 2 , k ) by updating ( CTF r , 1 , k − 1 , CTF r , 2 , k − 1 ) and ( MSK r , 1 , k − 1 , MSK r , 2 , k − 1 ), respectively. B returns the message msg.

Unsigncryption leak query ( ID r , k, f US , k , h US , k ): A may request this query only once. B returns Δ f US , k = f US , k ( CTF r , 1 , k , MSK r , 1 , k ) and Δ h US , k = h US , k ( CTF r , 2 , k , MSK r , 2 , k ).

Forgery. A creates a tuple ( msg ′ , CT ′ = ( σ ′ , C ′ , U ′ , ID s ′ , ID r ′ )). It is said that A wins G auth if the following four conditions hold.

For ( msg ′ , CT ′ = ( σ ′ , C ′ , U ′ , ID s ′ , ID r ′ ) ), the Unsigncryption algorithm returns “Valid”.

The Signcryption query ( msg ′ , ID s ′ , ID r ′ ) has never been requested.

If A is of type A I , the Certificate generation query ( ID s ′ , MPK s ′ ) has never been requested.

If A is of type A II , neither the Member secret key query ( ID s ′ ), nor the Public key replace query ( ID s ′ , ( MPK s ′ , UPK s ′ ) ) have never been requested.

(<inline-formula id="j_infor506_ineq_374"><alternatives><mml:math> <mml:msub> <mml:mrow> <mml:mi mathvariant="bold">G</mml:mi> </mml:mrow> <mml:mrow> <mml:mi mathvariant="bold">conf</mml:mi> </mml:mrow> </mml:msub></mml:math><tex-math><![CDATA[${\mathbf{G}_{\mathbf{conf}}}$]]></tex-math></alternatives></inline-formula>)<italic>.</italic>

The confidentiality property is modelled by the security game G conf that is played by an adversary A ( A I or A II ) and a challenger B. We say that an FCLR-CBSC scheme has indistinguishability of encryptions against both continuous leakage and chosen-ciphertext attacks (INDEN-CLCCA) if no PPT adversary A has a non-negligible advantage to win the following game G conf .

Setup. It is identical to the Setup in Definition 2.

Queries. It is identical to the Queries in Definition 2.

Challenge. A sends a receiver’s identity ID r ′ and a message pair ( msg 0 ′ , msg 1 ′ ) to B. Then B randomly chooses a bit b ′ ∈ { 0 , 1 } and runs the Signcryption algorithm with ( msg b ′ , ID s , ID r ′ ) to create and return a ciphertext CT = ( σ , C , U , ID s , ID r ′ ) to A. Additionally, the following two conditions must hold.

If A is of type A I , the Certificate generation query ( ID r ′ , MPK r ′ ) has never been requested.

If A is of type A II , neither the Member secret key query ( ID r ′ ), nor the Public key replace query ( ID r ′ , ( MPK r ′ , UPK r ′ )) have been requested.

Guess. A returns a bit b ∈ { 0 , 1 }. If b = b ′ , we say that A wins G conf and its advantage is defined as Adv A = | Pr [ b = b ′ ] − 1 / 2 |.

The Proposed FCLR-CBSC Scheme

By the framework defined in Section 3, a fully continuous leakage-resilient certificate-based signcryption (FCLR-CBSC) scheme is proposed below that comprises five algorithms.

Initialization: The CA first create a bilinear pairing set { g 1 , g 2 , G 1 , G 2 , p , e ˆ } described in Section 2. By running the following procedure, the CA computes her/his secret key CSK and public key CPK while generating and publishing a public parameter set PPS.

Choose a random value s ∈ Z p ∗ , and compute the CA’s secret key CSK = g 1 s and public key CPK = e ˆ ( CSK , g 1 ).

Choose a random value t ∈ Z p ∗ , and set the CA’s beginning secret key pair ( CSK 1 , 0 , CSK 2 , 0 ) = ( CSK · g 1 − t , g 1 t ), where CSK = CSK 1 , 0 · CSK 2 , 0 and the public key CPK is kept unchanged.

Choose four random values w , x , y , z ∈ Z p ∗ , and compute W = g 1 w , X = g 1 x , Y = g 1 y and Z = g 1 z .

Pick symmetric-key encryption and decryption functions, denoted by SKE and SKD.

Pick a hash function H: { 0 , 1 } ∗ × G 1 → { 0 , 1 } l , where l is a large integer.

Publish PPS = { g 1 , g 2 , G 1 , G 2 , p , e ˆ , CPK , W , X , Y , Z , SKE , SKD , H }.

Member secret key generation: A member ID m (a sender ID s or a receiver ID r ) first chooses a random value a ∈ Z p ∗ , and computes the member’s secret key MSK m = g 1 a and first public key MPK m = e ˆ ( MSK m , g 1 ). The member chooses a random value b ∈ Z p ∗ and computes the member ID m ’s beginning secret key pair ( MSK m , 1 , 0 , MSK m , 2 , 0 ) = ( MSK m · g 1 − b , g 1 b ), where MSK m = MSK m , 1 , 0 · MSK m , 2 , 0 . Meanwhile, the member ID m sends ( ID m , MPK m ) to the CA.

Certificate generation: Assume that the CA’s current secret key pair is ( CSK 1 , i − 1 , CSK 2 , i − 1 ). Upon receiving ( ID m , MPK m ) from the member ID m , the CA runs the following procedure.

Choose a random value u ∈ Z p ∗ , and update the CA’s current secret key pair as ( CSK 1 , i , CSK 2 , i ) = ( CSK 1 , i − 1 · g 1 − u , CSK 2 , i − 1 · g 1 u ), where CSK = CSK 1 , i · CSK 2 , i = CSK 1 , i − 1 · CSK 2 , i − 1 and the public key CPK is kept unchanged.

Choose a random value v ∈ Z p ∗ , compute the member ID m ’s second public key UPK m = g 1 v and set the member ID m ’s public key pair ( MPK m , UPK m ).

Set α = ID m | | MPK m | | UPK m , and compute a temporary value TV m = CSK 1 , i · ( W · X α ) v and the member ID m ’s certificate CTF m = CSK 2 , i · TV m .

Return CTF m to the member ID m via a secure channel.

 Upon receiving CTF m , the member ID m chooses a random value c ∈ Z p ∗ and sets her/his beginning certificate pair ( CTF m , 1 , 0 , CTF m , 2 , 0 ) = ( CTF m · g 1 − c , g 1 c ).

Signcryption: Assume that the sender ID s ’s current certificate and secret key pairs are, respectively, ( CTF s , 1 , j − 1 , CTF s , 2 , j − 1 ) and ( MSK s , 1 , j − 1 , MSK s , 2 , j − 1 ). The sender ID s would like to signcrypt a message msg to the receiver ID r with public key pair ( MPK r , UPK r ) by running the following procedure.

Choose a random value d ∈ Z p ∗ , and update the two pairs above as ( CTF s , 1 , j , CTF s , 2 , j ) = ( CTF s , 1 , j − 1 · g 1 d , CTF s , 2 , j − 1 · g 1 − d ) and ( MSK s , 1 , j , MSK s , 2 , j ) = ( MSK s , 1 , j − 1 · g 1 d , MSK s , 2 , j − 1 · g 1 − d ), where CTF s = CTF s , 1 , j · CTF s , 2 , j = CTF s , 1 , j − 1 · CTF s , 2 , j − 1 and MSK s = MSK s , 1 , j · MSK s , 2 , j = MSK s , 1 , j − 1 · MSK s , 2 , j − 1 . Note that the member ID s ’s public key pair ( MPK s , UPK s ) is kept unchanged.

Set α = ID r | | MPK r | | UPK r , select a random value β ∈ Z p ∗ , and compute U = g 1 β , K 1 = ( MPK r ) β and K 2 = ( CPK · e ˆ ( UPK r , W · X α ) ) β .

Set an encryption key K = K 1 ⊕ K 2 , and compute C = SKE K ( msg ) and δ = H ( msg , C , U , ID s , ID r ).

Compute a temporary value TV S = CTF s , 1 , j · MSK s , 1 , j · ( Y · Z δ ) β .

Compute a signature σ = CTF s , 2 , j · MSK s , 2 , j · TV S .

Produce a ciphertext CT = ( σ , C , U , ID s , ID r ).

Unsigncryption: Assume that the receiver ID r ’s current certificate and secret key pairs are, respectively, ( CTF r , 1 , k − 1 , CTF r , 2 , k − 1 ) and ( MSK r , 1 , k − 1 , MSK r , 2 , k − 1 ). Given CT = ( σ , C , U , ID s , ID r ), the receiver ID r unsigncrypts CT to obtain the message msg and verify the signature σ by running the following procedure.

Choose a random value f ∈ Z p ∗ , and update the two pairs above as ( CTF r , 1 , k , CTF r , 2 , k ) = ( CTF r , 1 , k − 1 · g 1 f , CTF r , 2 , k − 1 · g 1 − f ) and ( MSK r , 1 , k , MSK r , 2 , k ) = ( MSK r , 1 , k − 1 · g 1 f , MSK r , 2 , k − 1 · g 1 − f ), where CTF r = CTF r , 1 , k · CTF r , 2 , k = CTF r , 1 , k − 1 · CTF r , 2 , k − 1 and MSK r = MSK r , 1 , k · MSK r , 2 , k = MSK r , 1 , k − 1 · MSK r , 2 , k − 1 . Note that the member ID r ’s public key pair ( MPK r , UPK r ) is kept unchanged.

Compute two temporary values TV K 1 = e ˆ ( U , MSK r , 1 , k ) and TV K 2 = e ˆ ( U , CTF r , 1 , k ).

Compute K 1 ′ = TV K 1 · e ˆ ( U , MSK r , 2 , k ) and K 2 ′ = TV K 2 · e ˆ ( U , CTF r , 2 , k ).

Set K ′ = K 1 ′ ⊕ K 2 ′ , and decrypt the message m s g = S K D K ′ ( C ).

Compute δ = H ( msg , C , U , ID s , ID r ), and set α = ID r | | MPK r | | UPK r .

Verify the equality e ˆ ( g 1 , σ ) = CPK · MPK s · e ˆ ( UPK s , W · X α ) · e ˆ ( U , Y · Z δ ). If the equality holds, return msg and “Valid”; otherwise return “Invalid”.

 We can arrive at K ′ = K 1 ′ ⊕ K 2 ′ = K 1 ⊕ K 2 = K and e ˆ ( g 1 , σ ) = CPK · MPK s · e ˆ ( UPK s , W · X α ) · e ˆ ( U , Y · Z δ ) by the following equalities.

K 1 ′ = TV K 1 · e ˆ ( U , MSK r , 2 , k ) = e ˆ ( U , MSK r , 1 , k ) · e ˆ ( U , MSK r , 2 , k ) = e ˆ ( U , MSK r , 1 , k · MSK r , 2 , k ) = e ˆ ( U , MSK r ) = e ˆ ( g 1 β , MSK r ) = e ˆ ( MSK r , g 1 ) β = ( MPK r ) β = K 1 .

K 2 ′ = TV K 2 · e ˆ ( U , CTF r , 2 , k ) = e ˆ ( U , CTF r , 1 , k ) · e ˆ ( U , CTF r , 2 , k ) = e ˆ ( U , CTF r , 1 , k · CTF r , 2 , k ) = e ˆ ( U , CTF r ) = e ˆ ( g 1 β , CSK · ( W · X α ) v ) = e ˆ ( g 1 , CSK · ( W · X α ) v ) β = e ˆ ( g 1 , CSK ) · e ˆ ( g 1 , ( W · X α ) v ) β = ( CPK · e ˆ ( g 1 v , ( W · X α ) ) β = ( CPK · e ˆ ( UPK r , W · X α ) ) β = K 2 .

e ˆ ( g 1 , σ ) = e ˆ ( g 1 , CTF s , 2 , j · MSK s , 2 , j · TV S ) = e ˆ ( g 1 , CTF s , 2 , j · MSK s , 2 , j · CTF s , 1 , j · MSK s , 1 , j · ( Y · Z δ ) β ) = e ˆ ( g 1 , CTF s , 1 , j · CTF s , 2 , j · MSK s , 1 , j · MSK s , 2 , j · ( Y · Z δ ) β ) = e ˆ ( g 1 , CTF s · MSK s · ( Y · Z δ ) β ) = e ˆ ( g 1 , CSK · ( W · X α ) v · MSK s · ( Y · Z δ ) β ) = e ˆ ( g 1 , CSK ) · e ˆ ( g 1 , ( W · X α ) v ) · e ˆ ( g 1 , MSK s ) · e ˆ ( g 1 , ( Y · Z δ ) β ) = CPK · e ˆ ( g 1 v , ( W · X α ) ) · MPK s · e ˆ ( g 1 β , ( Y · Z δ ) ) = CPK · MPK s · e ˆ ( UPK s , W · X α ) · e ˆ ( U , Y · Z δ ).

Security Analysis

An FCLR-CBSC scheme must possess two security properties, namely, authentication of signing process and confidentiality of encrypting process, that are modelled by two security games G auth and G conf defined in Section 3.3. Both games are played by an adversary A ( A I or A II ) and a challenger B. Theorems 1 and 2 below show that our FCLR-CBSC scheme is EXUF-CLRACMA-secure against A I and A II in G auth , respectively. Also, Theorems 3 and 4 show that the FCLR-CBSC scheme is INDEN-CLCCA-secure against A I and A II in G conf , respectively.

Under the SCRH and DL assumptions in the GBG model, our FCLR-CBSC scheme is EXUF-CLRACMA-secure against A I in G auth .

A I and B play G auth that comprises three phases as presented below.

Setup. B runs the Initialization algorithm of the FCLR-CBSC scheme to create the CA’s secret key CSK and public key CPK while setting the public parameter set PPS = { g 1 , g 2 , G 1 , G 2 , p , e ˆ , CPK , W , X , Y , Z , SKE , SKD , H }. B also establishes six lists L 1 , L 2 , L MS , L MC , L SC and L H as defined below.

L 1 is used to record all elements ( Θ G 1 , a , b , c , Ψ G 1 , a , b , c ) of G 1 , where Θ G 1 , a , b , c and Ψ G 1 , a , b , c denote a multivariate polynomial and its associated bit string, respectively. The indices a, b, c mean the query-type a, b-th query and c-th element, respectively. Initially, six elements ( Θ g 1 , Ψ G 1 , s , 0 , 1 ), ( Θ CSK, Ψ G 1 , s , 0 , 2 ), ( Θ W, Ψ G 1 , s , 0 , 3 ), ( Θ X, Ψ G 1 , s , 0 , 4 ), ( Θ Y, Ψ G 1 , s , 0 , 5 ) and ( Θ Z, Ψ G 1 , s , 0 , 6 ) are put in L 1 .

L 2 is used to record all elements ( Θ G 2 , a , b , c , Ψ G 2 , a , b , c ) of G 2 , where Θ G 2 , a , b , c and Ψ G 2 , a , b , c denote a multivariate polynomial and the associated bit string, respectively. The indices a, b, c have the identical meanings as in L 1 . Initially, two elements ( Θ g 2 , Ψ G 2 , s , 0 , 1 ) and ( Θ CPK, Ψ G 2 , s , 0 , 2 ) are put in L 2 .

 Note that A I can apply the following two rules to make converting between a bit string Ψ G 1 , a , b , c / Ψ G 2 , a , b , c and a multivariate polynomial Θ G 1 , a , b , c / Θ G 2 , a , b , c .

Converting-1 ( Θ G 1 , a , b , c / Θ G 2 , a , b , c ): B returns Ψ G 1 , a , b , c / Ψ G 2 , a , b , c if Θ G 1 , a , b , c / Θ G 2 , a , b , c is found in L 1 / L 2 . Otherwise, B chooses a distinct bit string Ψ G 1 , a , b , c / Ψ G 2 , a , b , c and puts ( Θ G 1 , a , b , c , Ψ G 1 , a , b , c ) / ( Θ G 2 , a , b , c , Ψ G 2 , a , b , c ) in L 1 / L 2 .

Converting-2 ( Ψ G 1 , a , b , c / Ψ G 2 , a , b , c ): B returns Θ G 1 , a , b , c / Θ G 2 , a , b , c if Ψ G 1 , a , b , c / Ψ G 2 , a , b , c is found in L 1 / L 2 . Otherwise, B terminates the game.

L MS is used to record a member ID m ’s secret key MSK m and her/his first public key MPK m by ( ID m , Θ MSK m , Θ MPK m , replace), for m = 1 , … , n. Initially, B sets replace = 0 to indicate that the member’s public key has never been replaced by the adversary.

L MC is used to record a member ID m ’s certificate CTF m and her/his second public key UPK m by ( ID m , Θ CTF m , Θ UPK m , replace), for m = 1 , … , n. Also, B sets replace = 0.

L SC is used to record the content of running the Signcryption algorithm by ( ID s , ID r , msg , Θ U , Θ K 1 , Θ K 2 , Θ σ , C , Θ δ ).

L H is used to record the input/output of the hash function H by ( msg | | C | | Ψ U | | ID s | | ID r , Ψ δ ).

Query: A I may issue the following queries to B at most η times.

Q 1 query ( Ψ G 1 , q , k , r , Ψ G 1 , q , k , s , ORER ): For the k-th Q 1 , B runs the following procedure.

Convert ( Ψ G 1 , q , k , r , Ψ G 1 , q , k , s ) to ( Θ G 1 , q , k , r , Θ G 1 , q , k , s ) in L 1 .

Set Θ G 1 , q , k , t = Θ G 1 , q , k , r + Θ G 1 , q , k , s if ORER = “×”, and Θ G 1 , q , k , t = Θ G 1 , q , k , r − Θ G 1 , q , k , s if ORER = “/”.

Convert Θ G 1 , q , k , t in L 1 to return Ψ G 1 , q , k , t .

Q 2 query ( Ψ G 2 , q , k , r , Ψ G 2 , q , k , s , ORER): For the k-th Q 2 , B runs the following procedure.

Convert ( Ψ G 2 , q , k , r , Ψ G 2 , q , k , s ) to ( Θ G 2 , q , k , r , Θ G 2 , q , k , s ) in L 2 .

Set Θ G 2 , q , k , t = Θ G 2 , q , k , r + Θ G 2 , q , k , s if ORER = “ × ″ , and Θ G 2 , q , k , t = Θ G 2 , q , k , r − Θ G 2 , q , k , s if ORER = “/”.

Convert Θ G 2 , q , k , t in L 2 to return Ψ G 2 , q , k , t .

Q e ˆ query ( Ψ G 1 , q , k , r , Ψ G 1 , q , k , s ): For the k-th Q e ˆ , B runs the following procedure.

Convert ( Ψ G 1 , q , k , r , Ψ G 1 , q , k , s ) to ( Θ G 1 , q , k , r , Θ G 1 , q , k , s ) in L 1 .

Set Θ G 2 , q , k , t = Θ G 1 , q , k , r · Θ G 1 , q , k , s .

Convert Θ G 2 , q , k , t in L 2 to return Ψ G 2 , q , k , t .

Member key generation query ( ID m ): B produces the member ID m ’s secret key Θ MSK m and first public key Θ MPK m . B then puts ( ID m , Θ MSK m , Θ MPK m , 0) in L MS . Also, B converts ( Θ MSK m , Θ MPK m ) in L 1 to return ( Ψ MSK m , Ψ MPK m ).

Member secret key query ( ID m ): If ( ID m , Θ MSK m , Θ MPK m , 0) in L MS is found, B converts Θ MSK m in L 1 to return Ψ MSK m . Otherwise, B issues the Member key generation query ( ID m ) to return Ψ MSK m .

Certificate generation query ( ID m , Ψ MPK m ): Assume that the CA has the i-th secret key pair ( Θ CSK 1 , i , Θ CSK 2 , i ). B runs the following procedure.

Pick a new variate Θ UPK m in G 1 as the second public key of the member ID m .

Pick a new variate Θ α in G 1 and put ( Θ α, Ψ α = ID m | | Ψ MPK m | | Ψ UPK m ) in L 1 .

Set Θ CTF m = Θ CSK + ( Θ W + Θ X · Θ α ) · Θ UPK m and put ( ID m , Θ CTF m , Θ UPK m , 0) in L MC .

Convert ( Θ CTF m , Θ UPK m ) in L 1 to return ( Ψ CTF m , Ψ UPK m ).

Certificate generation leak query (i, f CA , i , h CA , i ): A I can issue this query only once for the CA’s i-th secret key pair ( Θ CSK 1 , i , Θ CSK 2 , i ). B returns Δ f CA , i = f CA , i ( Θ CSK 1 , i ) and Δ h CA , i = h CA , i ( Θ CSK 2 , i ).

Public key retrieve query ( ID m ): B finds ID m ’s public key pair ( Θ MPK m , Θ UPK m ) by searching ( ID m , Θ MSK m , Θ MPK m , 0) in L MS and ( ID m , Θ CTF m , Θ UPK m , 0) in L MC . B converts ( Θ MPK m , Θ UPK m ) in L 1 to return ( Ψ MPK m , Ψ UPK m ).

Public key replace query ( ID m , ( Ψ MPK m ′ , Ψ UPK m ′ )): B converts ( Ψ MPK m ′ , Ψ UPK m ′ ) to ( Θ MPK m ′ , Θ UPK m ′ ). B modifies ( ID m , − , Θ MPK m ′ , 1 ) in L MS and ( ID m , − , Θ UPK m ′ , 1 ) in L MC .

Signcryption query ( msg, ID s , ID r ): Assume that the sender ID s has the j-th certificate pair ( Θ CTF s , 1 , j , Θ CTF s , 2 , j ) and secret key pair ( Θ MSK s , 1 , j , Θ MSK s , 2 , j ). B runs the following procedure.

Use ID r to find ( ID r , Θ MSK r , Θ MPK r , replace) in L MS and ( ID r , Θ CTF r , Θ UPK r , replace) in L MC , and convert ( Θ MPK r , Θ UPK r ) in L 1 to ( Ψ MPK r , Ψ UPK r ).

Set Ψ α = ID r | | Ψ MPK r | | Ψ UPK r and convert Ψ α in L 1 to Θ α.

Choose a new variate Θ U in G 1 , and set Θ K 1 = Θ MPK r · Θ U and Θ K 2 = ( Θ CPK + Θ UPK r · ( Θ W + Θ X · Θ α ) ) · Θ U.

Convert both Θ U and Θ K 1 in L 1 , and Θ K 2 in L 2 to obtain Ψ U, Ψ K 1 and Ψ K 2 .

Set Ψ K = Ψ K 1 ⊕ Ψ K 2 and C = SKE Ψ K ( msg ).

Choose a new variate Θ δ in G 1 , and set Ψ δ = H ( msg | | C | | Ψ U | | ID s | | ID r ), and put ( Θ δ, Ψ δ) in L 1 .

Set Θ α = Θ CTF s + Θ MSK s + ( Θ Y + Θ Z · Θ δ ) · Θ U and convert Θ δ in L 1 to Ψ σ.

Put ( ID s , ID r , msg , Θ U , Θ K 1 , Θ K 2 , Θ σ , C , Θ δ ) in L SC .

Return CT = ( Ψ σ , C , Ψ U , ID s , ID r ).

Signcryption leak query ( ID s , j, f SC , j , h SC , j ): A I can issue this query only once for the member ID s ’s j-th certificate pair ( Θ CTF s , 1 , j , Θ CTF s , 2 , j ) and secret key pair ( Θ MSK s , 1 , j , Θ MSK s , 2 , j ). B returns Δ f SC , j = f SC , j ( Θ CTF s , 1 , j , Θ MSK s , 1 , j ) and Δ h SC , j = h SC , j ( Θ CTF s , 2 , j , Θ MSK s , 2 , j ).

Unsigncryption query ( ID r , CT = ( Ψ σ , C , Ψ U , ID s , ID r )): Assume that the receiver ID r has the k-th certificate pair ( Θ CTF r , 1 , k , Θ CTF r , 2 , k ) and secret key pair ( Θ MSK r , 1 , k , Θ MSK r , 2 , k ). B runs the following procedure.

Use ID s to find ( ID s , Θ MSK s , Θ M P K s, replace) in L MS and ( ID s , Θ CTF s , Θ UPK s , replace) in L MC , and convert ( Θ MPK s , Θ UPK s ) in L 1 to ( Ψ MPK s , Ψ UPK s ).

Convert Ψ σ and Ψ U in L 1 to Θ σ and Θ U, respectively.

Set Θ K 1 = Θ U · Θ MSK r and Θ K 2 = Θ U · Θ CTF r .

Set Ψ δ = H ( msg | | C | | Ψ U | | ID s | | ID r ) and convert Ψ δ in L 1 to Θ δ.

Use ID s , ID r , Θ U, Θ K 1 , Θ K 2 , Θ σ, C and Θ δ to find ( ID s , ID r , msg , Θ U , Θ K 1 , Θ K 2 , Θ σ , C , Θ δ ) in L SC . If it is found, return msg and “Valid”.

Unsigncryption leak query ( ID r , k, f US , k , h US , k ): A I can issue this query only once for the member ID r ’s k-th certificate pair ( Θ CTF r , 1 , k , Θ CTF r , 2 , k ) and secret key pair ( Θ MSK r , 1 , k , Θ MSK r , 2 , k ). B returns Δ f US , k = f US , k ( Θ CTF r , 1 , k , Θ MSK r , 1 , k ) and Δ h US , k = h US , k ( Θ CTF r , 2 , k , Θ MSK r , 2 , k ).

Forgery. A I produces a pair ( msg ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ ) ). Note that the Signcryption query ( msg ′ , ID s ′ , ID r ′ ) and the Certificate generation query ( ID s ′ , MPK s ′ ) have never been requested. If the Unsigncryption algorithm with ( ID r ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ ) ) returns msg and “Valid”, we say that A I wins G auth .

As mentioned in Section 2.2, if an adversary found any collision of G 1 / G 2 , it would solve the discrete logarithm problem on G 1 / G 2 . In such a case, we first compute the sum amount of elements in L 1 and L 2 , termed as | L 1 | + | L 2 |. By counting the added elements in both the Setup and Query phases, we have the inequality | L 1 | + | L 2 | ≦ 6 η because A I can request different queries to B η times and at most 6 elements are increased in L 1 / L 2 after issuing a query. Additionally, for evaluating the entropy of secret keys with partial leakage, we must compute the maximal degrees of elements in L 1 and L 2 , in which L 1 and L 2 have the maximal degrees 3 and 6, respectively.

Subsequently, let us compute the advantage Adv A I − N that A I wins G auth without issuing leak queries. The advantage Adv A I − N comprises two probabilities as discussed below.

Let Pr [ Collision ] be the probability that A I finds a collision in L 1 or L 2 . Assume that there are r different variates in L 1 , which are denoted by r random values v i ∈ Z p ∗ for i = 1 , 2 , … , r. Let Θ G 1 , j and Θ G 1 , k be two distinct elements in L 1 and set Θ G 1 , l = Θ G 1 , j − Θ G 1 , k . If Θ G 1 , l ( v 1 , v 2 , … , v r ) = 0, there exists a collision in L 1 . Because L 1 has | L 1 | 2 pairs of ( Θ G 1 , j , Θ G 1 , k ) and the maximal polynomial degree is 3, the probability that A I finds a collision in L 1 is ( 3 / p ) | L 1 | 2 by Lemma 2. For the same reason, the probability that A I finds a collision in L 2 is ( 6 / p ) | L 2 | 2 . Because of | L 1 | + | L 2 | ≦ 6 η, we have the following inequality Pr [ Collision ] ≦ ( 3 / p ) | L 1 | 2 + ( 6 / p ) | L 2 | 2 ≦ ( 6 / p ) ( | L 0 | + | L 1 | ) 2 ≦ 216 η 2 / p.

Let Pr [ Forge ] be the probability that A I forges a valid pair ( msg ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ )). The valid pair satisfies e ˆ ( g 1 , σ ′ ) = CPK · MPK s ′ · e ˆ ( UPK s ′ , W · X α ) · e ˆ ( U ′ , Y · Z δ ) in the Unsigncryption algorithm, namely, Θ g 1 · Θ σ ′ = Θ CPK + Θ MPK s ′ + Θ UPK s ′ · ( Θ W + Θ X · Θ α ) + Θ U ′ · ( Θ Y + Θ Z · Θ δ ). Let Θ f = Θ g 1 · Θ σ ′ − Θ CPK + Θ MPK s ′ + Θ UPK s ′ · ( Θ W + Θ X · Θ α ) + Θ U ′ · ( Θ Y + Θ Z · Θ δ ). Since Θ f has degree 3, the probability of Θ f = 0 is 3 / p by Lemma 2 so that we have Pr [ Forge ] = 3 / p.

 By above, we have Adv A I − N = Pr [ Collision ] + Pr [ Forge ] ≦ 216 η 2 / p + 3 / p = O ( η 2 / p ) , which is negligible if η = poly ( log p ).

Here, we compute the advantage Adv A I that AI wins G auth when permitted to issue three types of leak queries, namely, Certificate generation leak query, Signcryption leak query and Unsigncryption leak query.

By the Certificate generation leak query (i, f CA , i , h CA , i ), A I gets partial bits of the CA’s i-th secret key pair ( Θ CSK 1 , i , Θ CSK 2 , i ), namely, Δ f CA , i = f CA , i ( Θ CSK 1 , i ) and Δ h CA , i = h CA , i ( Θ CSK 2 , i ) with | Δ f CA , i | , | Δ h CA , i | ≦ ω. According to the key update process (Kiltz and Pietrzak, 2010; Galindo and Virek, 2013), the CA’s i-th secret key pair satisfies the relations CSK = CSK 1 , 0 · CSK 2 , 0 = ⋯ = CSK 1 , i − 1 · CSK 2 , i − 1 = CSK 1 , i · CSK 2 , i . Meanwhile, the leakage bits of ( Θ CSK 1 , i − 1 , Θ CSK 2 , i − 1 ) and ( Θ CSK 1 , i , Θ CSK 2 , i ) are mutually independent, so that A I gets at most 2 ω bits of CSK.

By the Signcryption leak query ( ID s , j, f SC , j , h SC , j ), A I gets partial bits of the ID s ’s j-th certificate pair ( Θ CTF s , 1 , j , Θ CTF s , 2 , j ), namely, Δ f SC , j = f SC , j ( Θ CTF s , 1 , j ) and Δ h SC , j = h SC , j ( Θ CTF s , 2 , j ) with | Δ f SC , j | , | Δ h SC , j | ≦ ω. According to the key update procedure, the ID s ’s j-th certificate pair satisfies the relations CTF s = CTF s , 1 , 0 · CTF s , 2 , 0 = ⋯ = CTF s , 1 , j − 1 · CTF s , 2 , j − 1 = CTF s , 1 , j · CTF s , 2 , j . Thus, A I gets at most 2 ω bits of CTF s .

By the Unsigncryption leak query ( ID r , k, f US , k , h US , k ), A I gets partial bits of the ID r ’s k-th certificate pair ( Θ CTF r , 1 , k , Θ CTF r , 2 , k ), namely, Δ f US , k = f US , k ( Θ CTF r , 1 , k ) and Δ h US , k = h US , k ( Θ CTF r , 2 , k ) with | Δ f US , k |, | Δ h US , k | ≦ ω. According to the key update procedure, the ID r ’s k-th certificate pair satisfies the relations CTF r = CTF r , 1 , 0 · CTF r , 2 , 0 = ⋯ = CTF r , 1 , j − 1 · CTF r , 2 , j − 1 = CTF r , 1 , j · CTF r , 2 , j . Thus, A I gets at most 2 ω bits of CTF r .

 Due to the discussions above, we define three events as follows:

Let EVCSK indicate the event that A I obtains CSK by Δ f CA , i and Δ h CA , i . Meanwhile, EVCSK ‾ means EVCSK’s complement.

Let EVCTF indicate the event that A I gets CTF m (i.e. CTF s or CTF r ) by Δ f SC , j , Δ h SC , j , Δ f US , k and Δ h US , k . Meanwhile, EVCTF ‾ means EVCTF’s complement.

Let ESFV indicate the event that A I successfully forges a valid pair ( msg ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ ) ).

 Hence, Adv A I has the inequality Adv A I = Pr [ ESFV ] = Pr [ ESFV ∧ ( EVCSK ∨ EVCTF ) ] + Pr [ ESFV ∧ ( EVCSK ‾ ∧ EVCTF ‾ ) ] ≦ Pr [ ( EVCSK ∨ EVCTF ) ] + Pr [ ESFV ∧ ( EVSSK ‾ ∧ EVUDID ‾ ) ] .

By the Certificate generation leak query, A I gets 2 ω bits of CSK. Also, by the Signcryption leak query or Unsigncryption leak query, A I gets 2 ω bits of CTF m (i.e. CTF s or CTF r ). By Lemma 2, we have Pr [ ( EVCSK ∨ EVCTF ) ] ≦ Adv A I − N · 2 2 ω ≦ O ( ( η 2 / p ) · 2 2 ω ) because of Adv A I − N = O ( η 2 / p ). Since Pr [ ESFV ∧ ( EVSSK ‾ ∧ EVUDID ‾ ) ] denotes that A I gets no information of both CSK and CTF m , we have Pr [ ESFV ∧ ( EVSSK ‾ ∧ EVUDID ‾ ) ] = Adv A I − N = O ( η 2 / p ). Therefore, Adv A I ≦ Pr [ ( EVCSK ∨ EVCTF ) ] + Pr [ ESFV ∧ ( EVSSK ‾ ∧ EVUDID ‾ ) ] ≦ O ( ( η 2 / p ) · 2 2 ω ) + O ( η 2 / p ) = O ( ( η 2 / p ) · 2 2 ω ) . Finally, Adv A I is negligible if ω = poly ( log p ), by Lemma 2.  □

Under the SCRH and DL assumptions in the GBG model, our FCLR-CBSC scheme is EXUF-CLRACMA-secure against A II in G auth .

A II and B play G auth that comprises three phases as presented below.

Setup. It is identical to the Setup in Theorem 1. Because the adversary is of A II , B sends Ψ CSK to A II .

Queries. It is identical to the Queries in Theorem 1. Additionally, since A II possesses the CA’s secret key CSK, so that it can create any member ID m ’s certificate CTF m and second public key UPK m . Thus, A II has no need to request the Certificate generation query and Certificate generation leak query.

Forgery. A II produces a pair ( msg ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ ) ). Note that the Signcryption query ( msg ′ , ID s ′ , ID r ′ ), the Member secret key query ( ID m ) and the Public key replace query ( ID m , ( Ψ MPK m ′ , Ψ UPK m ′ )) have never been requested. If the Unsigncryption algorithm with ( ID r ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ ) ) returns msg and “Valid”, we say that A I wins G auth .

 Here, let’s compute the advantage Adv AII − N that A II wins G auth without issuing leak queries. By Pr [ Collision ] and Pr [ Forge ] defined in Theorem 1, we have Adv AII − N = Pr [ Collision ] + Pr [ Forge ] ≦ 216 η 2 / p + 3 / p = O ( η 2 / p ) , which is negligible if η = poly ( log p ). Next, we compute the advantage Adv AII that A II wins G auth when permitted to issue two types of leak queries, namely, Signcryption leak query and Unsigncryption leak query.

By the Signcryption leak query ( ID s , j, f SC , j , h SC , j ), A II gets partial bits of the ID s ’s j-th secret key pair ( MSK s , 1 , j , MSK s , 2 , j ), namely, Δ f SC , j = f SC , j ( MSK s , 1 , j ) and Δ h SC , j = h SC , j ( MSK s , 2 , j ) with | Δ f SC , j |, | Δ h SC , j | ≦ ω. According to the key update procedure, the ID s ’s j-th secret key pair satisfies the relations MSK s = MSK s , 1 , 0 · MSK s , 2 , 0 = ⋯ = MSK s , 1 , j − 1 · MSK s , 2 , j − 1 = MSK s , 1 , j · MSK s , 2 , j . Thus, A II gets at most 2 ω bits of MSK s .

By the Unsigncryption leak query ( ID r , k, f US , k , h US , k ), A II gets partial bits of the ID r ’s k-th secret key pair ( MSK r , 1 , k , MSK r , 2 , k ), namely, Δ f US , k = f US , k ( MSK r , 1 , k ) and Δ h US , k = h US , k ( MSK r , 2 , k ) with | Δ f US , k |, | Δ h US , k | ≦ ω. According to the key update procedure, the ID r ’s k-th secret key pair satisfies the relations MSK r = MSK r , 1 , 0 · MSK r , 2 , 0 = ⋯ = MSK r , 1 , j − 1 · MSK r , 2 , j − 1 = MSK r , 1 , j · MSK r , 2 , j . Thus, A II gets at most 2 ω bits of MSK r .

 Due to the discussions above, we define two events as follows:

Let EVMSK indicate the event that A II obtains MSK m (i.e. MSK s or MSK r ) by Δ f SC , j , Δ h SC , j , Δ f US , k and Δ h US , k . Meanwhile, EVMSK ‾ denotes EVMSK’s complement.

Let ESFV indicate the event that A II successfully forges a valid tuple ( msg ′ , CT ′ = ( Ψ σ ′ , C ′ , Ψ U ′ , ID s ′ , ID r ′ ) ).

 Hence, Adv AII has the inequality Adv AII = Pr [ ESFV ] = Pr [ ESFV ∧ EVMSK ] + Pr [ ESFV ∧ EVMSK ‾ ] ≦ Pr [ EVMSK ] + Pr [ ESFV ∧ EVMSK ‾ ] . By the Signcryption leak query or Unsigncryption leak query, A II gets 2 ω bits of MSK m (i.e. MSK s or MSK r ). By Lemma 2, we have Pr [ EVMSK ] ≦ Adv AII − N · 2 2 ω ≦ O ( ( η 2 / p ) · 2 2 ω ). Since Pr [ ESFV ∧ EVMSK ‾ ] denotes that A II gets no information of MSK m , we have Pr [ ESFV ∧ EVMSK ‾ ] = Adv AII − N = O ( η 2 / p ). Therefore, Adv AII ≦ Pr [ EVMSK ] + Pr [ ESFV ∧ EVMSK ‾ ] ≦ O ( ( η 2 / p ) · 2 2 ω ) + O ( η 2 / p ) = O ( ( η 2 / p ) · 2 2 ω ) . Finally, Adv AII is negligible if ω = poly ( log p ), by Lemma 2.  □

Under the SCRH and DL assumptions in the GBG model, our FCLR-CBSC scheme is INDEN-CLCCA-secure against A I in G conf .

A I and B play G conf that comprises four phases as presented below:

Setup. It is identical to the Setup in Theorem 1.

Queries. It is identical to the Queries in Theorem 1.

Challenge. A I sends a receiver’s identity ID r ′ and a message pair ( msg 0 ′ , msg 1 ′ ) to B. Note that the Certificate generation query ( ID r ′ , MPK r ′ ) has never been requested. B randomly chooses a bit b ′ ∈ { 0 , 1 } and runs the Signcryption algorithm with ( msg b ′ , ID s , ID r ′ ) to produce and return a ciphertext CT = ( σ , C , U , ID s , ID r ′ ) to A I .

Guess. A I returns a bit b ∈ { 0 , 1 }. We say that A I wins G conf if b = b ′ . The advantage Adv A I is defined as | Pr [ b = b ′ ] − 1 / 2 |.

 Let us compute the advantage Adv A I − N that A I wins G conf without issuing leak queries. The advantage Adv A I − N comprises two probabilities as discussed below:

Let Pr [ Collision ] be the probability that A I finds a collision in L 1 or L 2 , which is the same with the probability Pr [ Collision ] in Theorem 1. Thus, we have the inequality Pr [ Collision ] ≦ 216 η 2 / p.

Let Pr [ Guess ] be the probability that A I with no useful information outputs a correct bit b. Thus, we have Pr [ Guess ] = P r [ b = b ′ ] = 1 / 2.

 Hence, we have the following inequality. Adv A I − N = | Pr [ b = b ′ ] − 1 / 2 | = | Pr [ Collision ] + Pr [ Guess ] − 1 / 2 | ≦ 216 η 2 / p = O ( η 2 / p ) . Here, let’s compute the advantage Adv A I that A I wins G conf when permitted to issue three types of leak queries, namely, Certificate generation leak query, Signcryption leak query and Unsigncryption leak query. As in the proof of Theorem 1, by the Certificate generation leak query, A I gets 2 ω bits of CSK. Also, by the Signcryption leak query or the Unsigncryption leak query, A I gets 2 ω bits of CTF m (i.e. CTF s or CTF r ). By Lemma 2, we have Adv A I ≦ Adv A I − N · 2 2 ω ≦ O ( ( η 2 / p ) · 2 2 ω ), which is negligible if ω = poly ( log p ).  □

Under the SCRH and DL assumptions in the GBG model, our FCLR-CBSC scheme is INDEN-CLCCA-secure against A II in G conf .

A II and B play G conf that comprises four phases as presented below:

Setup. It is identical to the Setup in Theorem 2.

Queries. It is identical to the Queries in Theorem 2.

Challenge. A II sends a receiver’s identity ID r ′ and a message pair ( msg 0 ′ , msg 1 ′ ) to B. Note that neither the Member secret key query ( ID r ′ ) nor the Public key replace query ( ID r ′ , ( MPK r ′ , UPK r ′ )) has been requested. B randomly chooses a bit b ′ ∈ { 0 , 1 } and runs the Signcryption algorithm with ( msg b ′ , ID s , ID r ′ ) to produce and return a ciphertext CT = ( σ , C , U , ID s , ID r ′ ) to A II .

Guess. A II returns a bit b ∈ { 0 , 1 }. We say that A II wins G conf if b = b ′ . The advantage Adv AII is defined as | Pr [ b = b ′ ] − 1 / 2 |.

 Here, let’s compute Adv AII − N that A II wins G conf without request leak queries. By using Pr [ Collision ] and Pr[Guess] in the proof of Theorem 3, we get Adv AII − N = Pr [ Collision ] + Pr [ Guess ] ≦ 216 η 2 / p + 3 / p = O ( η 2 / p ) that is negligible if η = poly ( log p ). Subsequently, let us compute the advantage Adv AII that A II wins G conf when permitted to issue two types of leak queries, namely, Signcryption leak query and Unsigncryption leak query. As in the proof of Theorem 2, A II gets 2 ω bits of MSK m (i.e. MSK s or MSK r ). By Lemma 2, we obtain Adv AII ≦ Adv AII − N · 2 2 ω ≦ O ( ( η 2 / p ) · 2 2 ω ) that is negligible if ω = poly ( log p ).  □

 Performance Comparisons

Here, let’s evaluate the computation time of our FCLR-CBSC scheme in terms of Initialization, Member secret key generation, Certificate generation, Signcryption and Unsigncryption algorithms. By the simulation results in Xiong and Qin (2015), the notations (i.e. T b p f and T e x p ) for two time-consuming computations and their running time are presented in Table 3. Additionally, the running time of the multiplication in G 1 or G 2 is negligible since it is more slighter than T b p f and T e x p . The simulation results in Xiong and Qin (2015) are evaluated under a PC with an Intel 1.80-GHz i7 CPU and a mobile device with an Intel 624-MHz PXA270 CPU. Meanwhile, the order p of both G 1 and G 2 is a 512-bit prime security level. The computation costs and the running time of five algorithms in our FCLR-CBSC scheme are listed in Table 4. By Table 4, it is obvious that our scheme performs efficiently on both a PC and a mobile device.

Notationsand running time of two time-consuming operations.

Operations Notations Running time on a PC Running time on a mobile device
Bilinear pairing function e ˆ T b p f ≈20 ms ≈96 ms
Exponentiation in G 1 or G 2 T e x p ≈7 ms ≈31 ms

Computation costs and running time of five algorithms.

Algorithms Computation costs Running time on a PC Running time on a mobile device
Initialization T b p f + 7 T e x p 69 ms 313 ms
Member secret key generation T b p f + 3 T e x p 41 ms 189 ms
Certificate generation 7 T e x p 49 ms 217 ms
Signcryption T b p f + 8 T e x p 76 ms 344 ms
Unsigncryption 7 T b p f + 4 T e x p 168 ms 796 ms
Conclusions

A practical FCLR-CBSC scheme was proposed in the paper. As compared with the previously proposed LR-CLSC and CLR-CBSC schemes, our scheme possesses the fully continuous leakage-resilient property. In our scheme, by the key update method participated in the Certificate generation, Signcryption and Unsigncryption algorithms of our scheme, respectively, an adversary is permitted to obtain partial bits of the CA’s secret key, and a sender/receiver’s certificate and secret key. Based on the SCRH and DL assumptions in the GBG model, four security theorems were formally shown that our scheme is EXUF-CLRACMA-secure and INDEN-CLCCA-secure against two types of adversaries ( A I and A II ) in the CB-PKS setting so that our scheme possesses both authentication of and confidentiality. Finally, performance analysis demonstrated that our scheme is performs efficiently on both a PC and a mobile device.

 References Ali, I., Lawrence, T., Omala, A., Li, F. (2020). An efficient hybrid signcryption scheme with conditional privacy-preservation for heterogeneous vehicular communication in VANETs. IEEE Transactions on Vehicular Technology, 69(10), 11266–11280. Al-Riyami, S., Paterson, K. (2003). Certificateless public key cryptography. In: ASIACRYPT’03, LNCS, Vol. 2894, pp. 452–473. Alwen, J., Dodis, Y., Wichs, D. (2009). Leakage-resilient public-key cryptography in the bounded-retrieval model. In: Crypto’09, LNCS, Vol. 5677, pp. 36–54. Biham, E., Carmeli, Y., Shamir, A. (2008). Bug attacks. In: Crypto’08, LNCS, Vol. 5157, pp. 221–240. Boneh, D., Franklin, M. (2001). Identity-based encryption from the Weil pairing. In: Crypto’01, LNCS, Vol. 2139, pp. 213–229. Boneh, D., Boyen, X., Goh, E. (2005). Hierarchical identity-based encryption with constant size ciphertext. In: Eurocrypt’05, LNCS, Vol. 3494, pp. 440–456. Brumley, D., Boneh, D. (2005). Remote timing attacks are practical. Computer Networks, 48(5), 701–716. Dodis, Y., Ostrovsky, R., Reyzin, L., Smith, A. (2008). Fuzzy extractors: how to generate strong keys from biometrics and other noisy data. SIAM Journal on Computing, 38(1), 97–139. Dodis, Y., Haralambiev, K., Lopez-Alt, A., Wichs, D. (2010). Cryptography resilient to continual memory leakage. In: 51st Annual IEEE Symposium on Foundations of Computer Science, pp. 501–510. Galindo, D., Virek, S. (2013). A practical leakage-resilient signature scheme in the generic group model. In: SAC’12, LNCS, Vol. 7707, pp. 50–65. Galindo, D., Grobschadl, J., Liu, Z., Vadnala, P., Vivek, S. (2016). Implementation of a leakage-resilient ElGamal key encapsulation mechanism. Journal of Cryptographic Engineering, 6(3), 229–238. Gentry, C. (2003). Certificate-based encryption and the certificate revocation problem. In: EUROCRYPT’03, LNCS, Vol. 2656, pp. 272–293. Hussain, S., Ullah, I., Khattak, H., Adnan, M., Kumari, S., Ullah, S., Khan, M., Khattak, S. (2020). A lightweight and formally secure certificate based signcryption with proxy re-encryption (CBSRE) for internet of things enabled smart grid. IEEE Access, 8, 93230–93248. Katz, J., Vaikuntanathan, V. (2009). Signature schemes with bounded leakage resilience. In: Asiacrypt’09, LNCS, Vol. 5912, pp. 703–720. Khan, M., Ullah, I., Nisar, S., Noor, F., Qureshi, I., Khanzada, F., Amin, N. (2020). An efficient and provably secure certificateless key-encapsulated signcryption scheme for flying ad-hoc network. IEEE Access, 8, 36807–36828. Kiltz, E., Pietrzak, K. (2010). Leakage resilient Elgamal encryption. In: Asiacrypt’10, LNCS, Vol. 6477, pp. 595–612. Kocher, P., Jaffe, J., Jun, B. (1999). Differential power analysis. In: Crypto’99, LNCS, Vol. 1666, pp. 388–397. Peng, A.-L., Tseng, Y.-M., Huang, S.-S. (2021). An efficient leakage-resilient authenticated key exchange protocol suitable for IoT devices. IEEE Systems Journal, 15(4), 5343–5354. Rivest, R., Shamir, A., Adleman, L. (1978). A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2), 120–126. Tsai, T.-T., Huang, S.-S., Tseng, Y.-M., Chuang, Y.-H., Hung, Y.-H. (2022). Leakage-resilient certificate-based authenticated key exchange protocol. IEEE Open Journal of the Computer Society, 3, 137–148. Tseng, Y.-M., Wu, J.-D., Huang, S.-S., Tsai, T.-T. (2020). Leakage-resilient outsourced revocable certificateless signature with a cloud revocation server. Information Technology and Control, 49(4), 464–481. Tseng, Y.-M., Chen, J.-L., Huang, S.-S. (2021). A lightweight leakage-resilient identity-based mutual authentication and key exchange protocol for resource-limited devices. Computer Networks, 196, 108246. Tseng, Y.-M., Huang, S.-S., Tsai, T.-T., Chuang, Y.-H., Hung, Y.-H. (2022). Leakage-resilient revocable certificateless encryption with an outsourced revocation authority. Informatica, 33(1), 151–179. Ullah, I., Alomari, A., Amin, N., Khan, M., Khattak, H. (2019). An energy efficient and formally secured certificate-based signcryption for wireless body area networks with the internet of things. Electronics, 8(10), 1171. Ullah, S., Li, X., Lan, Z. (2020). A novel trusted third party based signcryption scheme. Multimedia Tools and Applications, 79, 22749–22769. Wu, Y., Gong, B., Zhang, Y. (2022). An improved efficient certificateless hybrid signcryption scheme for internet of things. Wireless Communications and Mobile Computing, 2022, 6945004. Wu, J.-D., Tseng, Y.-M., Huang, S.-S., Chou, W.-C. (2018). Leakage-resilient certificateless key encapsulation scheme. Informatica, 29(1), 125–155. Wu, J.-D., Tseng, Y.-M., Huang, S.-S., Tsai, T.-T. (2019). Leakage-resilient certificate-based signature resistant to side-channel attacks. IEEE Access, 7(1), 19041–19053. Wu, J.-D., Tseng, Y.-M., Huang, S.-S., Tsai, T.-T. (2020a). Leakage-resilient certificate-based key encapsulation scheme resistant to continual leakage. IEEE Open Journal of the Computer Society, 1, 131–144. Wu, J.-D., Tseng, Y.-M., Huang, S.-S., Tsai, T.-T. (2020b). Leakage-resilient revocable identity-based signature with cloud revocation authority. Informatica, 31(3), 597–620. Xiong, H., Qin, Z. (2015). Revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks. IEEE Transactions on Information Forensics and Security, 10(7), 1442–1455. Yang, Q., Zhou, Y., Yu, Y. (2019). Leakage-resilient certificateless signcryption scheme. In: GLOBECOM Workshops, pp. 1–6. Zheng, Y. (1997). Digital signcryption or how to achieve cost (signature & encryption) cost (signature)+ cost (encryption). In: Annual International Cryptology Conference, LNCS, Vol. 1294, pp. 165–179. Zhou, Y., Yang, B., Zhang, W. (2016). Provably secure and efficient leakage-resilient certificateless signcryption scheme without bilinear pairing. Discrete Applied Mathematics, 204, 185–202. Zhou, Y., Xu, Y., Qiao, Z., Yang, B., Zhang, M. (2021). Continuous leakage-resilient certificate-based signcryption scheme and application in cloud computing. Theoretical Computer Science, 860, 1–22.