Introduction

INFORMATICA

Informatica

1822-88440868-4952

0868-4952

Vilnius University

INFOR597

10.15388/25-INFOR597

Research Article

Leakage-Resilient Public Key Signcryption with Equality Test and Its Application

Tsai

Tung-Tso

tttsai@mail.ntou.edu.tw

T.-T. Tsai is currently an assistant professor in the Department of Computer Science and Engineering, National Taiwan Ocean University, Taiwan. His research interests include applied cryptography, pairing-based cryptography and leakage-resilient cryptography. He received the PhD degree from the Department of Mathematics, National Changhua University of Education, Taiwan, in 2014, under the supervision of professor Yuh-Min Tseng.

Department of Computer Science and Engineering, National Taiwan Ocean University, Keelung 202, Taiwan

2025

2852025

3624294522202452025

2025

Open access article under the CC BY license.

A public key signcryption with equality test (PKSCET) scheme is a public key signcryption (PKSC) scheme with the property of equality test. However, all the existing PKSCET schemes are vulnerable to a new kind of security threats, called side-channel attacks, which could potentially lead to the unauthorized disclosure of sensitive information or even the compromise of secret keys, undermining the overall confidentiality and integrity of the system. Therefore, this study aims to propose the first leakage-resilient PKSCET (LR-PKSCET) scheme that achieves resistance to side-channel attacks. Moreover, the proposed LR-PKSCET scheme is demonstrated to possess four security properties, namely, leakage resilience, indistinguishability, one-wayness, and existential unforgeability. Based on the proposed LR-PKSCET scheme, an anti-scam system (application) is presented to mitigate the ongoing occurrence of a myriad of scam cases.

Key words leakage-resilient side-channel attacks equality test signcryption

This research was partially supported by National Science and Technology Council, Taiwan, under contract no. NSTC112-2634-F-027-001-MBK.

1 Introduction

In recent years, as data has significantly grown, there is an increasing inclination among people to store data in cloud servers. Cloud computing (Sun, 2020; Alouffi et al., 2021), viewed as an efficient way of data storage and processing, is gradually becoming an indispensable infrastructure in various industry applications. However, data transmitting and storing in the cloud have also raised security concerns about data confidentiality. Therefore, to enhance the demand for data privacy protection is a significant issue. To ensure the security of data transmission in the cloud, encryption technology has become an essential topic in order to prevent unauthorized individuals from accessing sensitive information. Public key encryption (Lee et al., 2019; Deverajan et al., 2021; Zhou et al., 2021) is a well-known technique employed to ensure data confidentiality.

Since data in a cloud environment is encrypted for confidentiality, it becomes a challenge to find a specific data in cloud effectively. To address this issue, the concept of public key encryption with keyword search (PKEKS) (Boneh et al., 2004) has been proposed to achieve an effective search functionality for encrypted data. However, a PKEKS scheme has a limitation in the sense that it can only search for ciphertexts encrypted under identical receiver (entity) with the same public key. To overcome this limitation, the concept of public key encryption with equality test (PKEET) (Yang et al., 2010) has been introduced. A PKEET scheme allows users to perform comparative searches on ciphertexts encrypted under different public keys without revealing sensitive data.

Recently, a new type of attack has been actively discussed, known as side-channel attacks (Kubota et al., 2021; Ngo et al., 2021). A side-channel attack refers to a situation that attackers do not attempt to directly break the cryptographic algorithm in a security system, but exploit side-channel information, such as power consumption or timing, to gain access to critical system information. For example, as shown in Fig. 1, a user employs her/his secret key SK to perform the decryption algorithm by inputting the ciphertext CT at the device. Upon the completion of the decryption, the plaintext M is obtained. During the decryption process, an attacker could launch side-channel attacks to obtain crucial partial information about the user’s secret key SK. By doing so, the attacker can acquire partial information of the user’s secret key in every decryption process. After several rounds, the attacker may potentially reconstruct the complete sensitive data or the user’s secret key SK by analysing these side-channel signals.

Fig. 1

Recover complete secret key SK by side-channel attacks.

It is worth noting that a cryptographic mechanism known as leakage-resilient public key encryption (LR-PKE) (Akavia et al., 2009) has indeed been studied and published. It can withstand such side-channel attacks mentioned above. However, this mechanism’s application in diverse cloud computing environments remains constrained due to the absence of the property of equality test of ciphertext. Furthermore, to ensure the authenticity and integrity of information is also an important issue. Simultaneously, the development of cryptographic mechanisms that can efficiently merge digital signature and encryption has emerged as a pivotal topic in this field. In light of these challenges, this paper endeavours to propose a novel scheme, called leakage-resilient public key signcryption with equality test (LR-PKSCET), which not only offers robust security against side-channel attacks but also seamlessly integrates the processes of digital signing and encryption. In light of the increasing incidence of fraudulent activities, we will leverage the proposed LR-PKSCET as the foundation for developing an anti-scam system application. Our specific contributions include the following.

–

The framework and security notions of LR-PKSCET: We establish the framework of LR-PKSCET that includes six distinct algorithms, and present the associated security notions of LR-PKSCET. The security notions encompass leakage resilience, indistinguishability, one-wayness, and existential unforgeability.

–

A concrete LR-PKSCET scheme: Under the framework of LR-PKSCET, we propose a concrete LR-PKSCET scheme that meets the defined security notions.

–

Security analysis: By using hash function properties and discrete logarithm problem, we provide a rigorous security proof of the proposed scheme under the associated security notions.

–

Comparison with other schemes: Compared to existing schemes, our proposed LR-PKSCET scheme distinguishes itself as the first to withstand side-channel attacks.

–

LR-PKSCET’s application: We extend the applicability of the proposed scheme to anti-scam systems that aims to mitigate the ongoing occurrence of a myriad of scam cases.

The remaining sections of this paper include the following parts. Section 2 introduces related work. Preliminaries are given in Section 3. Section 4 shows the LR-PKSCET framework and its associated security definitions. The concrete LR-PKSCET scheme is presented in Section 5. Formal proofs of ensuring the security of the LR-PKSCET scheme are given in Section 6. Performance analysis is carried out in Section 7. Section 8 introduces an application. Lastly, Section 9 offers the concluding remarks.

2 Related Work

The concept of the PKEET scheme was first introduced by Yang et al. (2010) as an extension of the existing public key encryption with keyword search (Boneh et al., 2004). The primary goal of their research was to enable the comparison of encrypted data, or ciphertexts, generated under different public keys. Based on the Yang et al.’s work (2010), a significant amount of related research on PKEET has been continuously conducted and published. Tang (2011) designed a PKEET scheme with a proxy, where the proxy can obtain tokens from different users and use them to perform equality test of associated ciphertexts. Based on this authorization concept, Tang (2012a) introduced a PKEET scheme that incorporated user-specified authorization. Subsequently, Tang (2012b) further extended the PKEET scheme (Tang, 2012a) to offer the support for fine-grained authorization. Huang et al. (2014) introduced a novel PKEET scheme which enables the comparison of ciphertexts without requiring decryption. As a result, their scheme achieves the verification of equivalence among ciphertexts encrypted using the PKEET scheme. Building on this foundation, Huang et al. (2015) expanded Huang et al.’s scheme (2014) to propose a public key encryption with authorized equality test that allowed authorized proxy to perform equality test on selected ciphertexts. This enhancement augmented the versatility and functionality of the PKEET scheme. Another significant advancement in this field was made by Ma et al. (2015). They introduced a PKEET scheme with four distinct authorization policies, thereby increasing the adaptability of PKEET. However, these proposed PKEET schemes were all shown to be secure only under the random oracle model. To overcome this limitation, Lee et al. (2020) presented a generic construction of a PKEET scheme in the standard model which provides enhanced security guarantees. Additionally, for the lattice-based cryptography, Duong et al. (2019) introduced a PKEET scheme in the standard model which was built on lattice concepts from an identity-based encryption scheme (Agrawal et al., 2010). On the other hand, to simultaneously ensure the confidentiality, authenticity, and integrity of messages, Le et al. (2021) proposed a lattice-based signcryption with equality test in the standard model.

In the real-world scenarios of public key systems, the significance of secret keys is widely acknowledged. However, it is worth noting that the secret keys are often stored in the devices, making them susceptible to potential side-channel attacks (Kubota et al., 2021; Ngo et al., 2021). To avoid the scenario that secret keys can be computed when facing such attacks, the leakage-resilient cryptography (Dziembowski and Pietrzak, 2008; Faust et al., 2010) has emerged as a crucial topic. The core ambition of leakage-resilient cryptography was the formulation of algorithms with the capability to effectively counteract side-channel attacks. For data confidentiality, Akavia et al. (2009) introduced a leakage-resilient public key encryption (LR-PKE) scheme that effectively safeguards sensitive information even in the presence of potential side-channel threats. Subsequently, several studies (Naor and Segev, 2009, 2012; Li et al., 2013) related to LR-PKE have also been published to enhance both security and efficiency. However, the aforementioned LR-PKE schemes are specifically designed to provide security only in a bounded leakage model. To overcome this limitation, Kiltz and Pietrzak (2010) proposed the first LR-PKE scheme to provide security in continuous leakage models. Furthermore, Galindo et al. (2016) also presented a LR-PKE that drew inspiration from ElGamal and offered security in the continuous leakage model. For addressing the issue of ensuring the security of public key encryption when the randomness of ciphertexts becomes non-uniform due to faulty implementations or adversarial actions, Huang et al. (2022) introduced the concept of leakage-resilient hedged public-key encryption that offered a heightened level of comprehensive security. On the other hand, Tseng et al. (2022) introduced a leakage-resilient signcryption to achieve the objectives of message confidentiality, authenticity, and integrity.

3 Preliminaries 3.1 Bilinear Map

This section outlines the properties of a bilinear map, which serves as the fundamental basis for the proposed LR-PKSCET scheme discussed in this paper. We choose two multiplicative cyclic groups, denoted by G and G T , both of a prime order q. Let g be a generator of G. A bilinear map e ˆ: G × G → G T satisfies the following properties. (1)

Bilinear property: For any a , b ∈ Z q ∗ , e ˆ ( g a , g b ) = e ˆ ( g , g ) a b .

(2)

Non-degenerate property: e ˆ ( g , g ) ≠ 1.

(3)

Computable property: The computation of e ˆ ( A , B ) is efficient for any given A , B ∈ G.

3.2 Generic Bilinear Group Model

The generic bilinear group (GBG) model, introduced by Boneh et al. (2005), is served as a security analysis technique for cryptographic schemes. This model is used in the security game of a cryptographic scheme where an adversary and a challenger interact with each other. Initially, the challenger creates the bilinear parameters G, G T , q, g, e ˆ defined above. During the adversary’s operations in the bilinear parameters, the adversary can request three types of queries from the challenger. The three types of queries consist of the multiplicative query Q G of G, the multiplicative query Q G T of G T , and the bilinear pairing query Q e ˆ of e ˆ. Additionally, the challenger establishes two injective random mappings, and , to encode all the elements of G and G T into distinct bit strings. These mappings must satisfy the conditions and . The behaviours of the three associated queries Q G , Q G T , and Q e ˆ , for m and n in Z q ∗ , are defined as follows: –

Q G ( F 1 ( m ) , F 1 ( n ) ) → F 1 ( m + n mod q ).

–

Q G T ( F 2 ( m ) , F 2 ( n ) ) → F 2 ( m + n mod q ).

–

Q e ˆ ( F 1 ( m ) , F 1 ( n ) ) → F 1 ( m · n mod q ).

3.3 Security Assumptions and Entropy

To establish the security of the LR-PKSCET scheme, we depend on the computational complexity of the discrete logarithm problem (DL) and the properties of hash functions (HF). More precisely, our security analysis is based on the following two related assumptions.

–

DL assumption: The DL problem aims to find the unknown value x ∈ Z q ∗ from a given g x . If there exists a probabilistic polynomial-time (PPT) adversary, the probability of this adversary successfully determining x ∈ Z q ∗ is considered negligible.

–

HF assumption: Given a hash function HF, which possesses collision-resistant and one-way properties, the probability of a PPT adversary successfully finding two values Y 1 , Y 2 . such that HF ( Y 1 ) = HF ( Y 2 ), is considered negligible.

To assess the probability of successfully obtaining a secret key through side-channel attacks, we utilize entropy concept to measure the probability of successful reconstruction. In the following, we introduce two types of min-entropies for conducting this analysis.

–

The min-entropy of a finite random variable M is denoted by

H ∞ ( M ) = − log 2 ( max m Pr [ M = m ] ).

–

The average conditional min-entropy of a finite random variable M under a condition X is denoted by H ˜ ∞ ( M | X ) = − log 2 ( X [ max m Pr [ M = m | X ] ] ).

To measure entropy, there are two cases to be considered: one with a single secret key and the other with multiple secret keys. For these two cases, we will refer to the results of Dodis et al. (2008) (Lemma 1) and Galindo and Virek (2013) (Lemma 2), respectively. Lemma 1.

Consider a single secret key M and let Φ represent the maximum length of the bit strings that might be leaked from the secret key M. We define f : M → { 0 , 1 } Φ as the leakage function. In this context, we obtain H ˜ ∞ ( M | f ( M ) ) ≧ H ∞ ( M ) − Φ.

Lemma 2.

Consider n multiple secret keys, denoted as M 1 , M 2 , … , M n . Let F ∈ Z q [ M 1 , M 2 , … , M n ] be a polynomial with degree at most d. For each i = 1 , 2 , … , n, let P D i be a probability distribution of M i = m i such that H ∞ ( P D i ) ≧ log q − Φ, where 0 ≦ Φ ≦ log q. If m i ← P D i Z q are independent, the inequality Pr [ F ( M 1 = m 1 , M 2 = m 2 , … , M n = m n ) = 0 ] ≦ ( d / q ) 2 Φ holds. If Φ < log q ( 1 − ε ), Pr [ F ( M 1 = m 1 , M 2 = m 2 , … , M n = m n ) = 0 ] is negligible, where ε is a positive decimal.

4 Framework and Security Notions for LR-PKSCET Fig. 2

The framework of LR-PKSCET.

We illustrate the framework of our LR-PKSCET scheme in Fig. 2, which includes a cloud server and two entities (also works more than two member entities). The two member entities ME ζ and ME η can respectively generate their own entity secret keys denoted by ( ESK ζ I , ESK ζ I I ) and ( ESK η I , ESK η I I ) and entity public keys denoted by ( EPK ζ I , EPK ζ I I ) and ( EPK η I , EPK η I I ). The entity ME ζ utilizes her/his entity secret keys ( ESK ζ I , ESK ζ I I ) along with the entity public keys ( EPK η I , EPK η I I ) of the entity ME η to perform the process of signing and encryption on the message msg using the Signcryption algorithm. The output ciphertext CT η will be sent to the entity ME η . Upon receiving CT η , the entity ME η can utilize her/his entity secret keys ( ESK η I , ESK η I I ) along with the entity public keys ( EPK ζ I , EPK ζ I I ) of the entity ME ζ to perform a decryption and verification process using the Unsigncryption algorithm. The process above allows the entity ME ζ to obtain the message msg. On the other hand, the entities ME ζ and ME η can respectively transmit their ciphertexts CT ζ , CT η , and trapdoors TD ζ , TD η to the cloud server. The cloud server is capable of testing whether the two ciphertexts contain the same plaintext.

4.1 Framework for LR-PKSCET

In this subsection, we provide a formal definition of the proposed scheme’s framework, which is defined according to the frameworks of PKSCET (Le et al., 2021) and LR-PKSC (Tseng et al., 2022). To facilitate understanding of the formal definition, a symbol table is provided in Table 1.

Table 1

Symbols.

Symbol	Meaning
DE	The designated entity of the system
λ	The security parameter
SP	The system parameters
ESK I	The first entity secret key
ESK I I	The second entity secret key
EPK I	The first entity public key
EPK I I	The second entity public key
ESK S , i − 1 I	The first entity secret key of sender in the i − 1th round
ESK S , i − 1 I I	The second entity secret key of sender in the i − 1th round
ESK R , j − 1 I	The first entity secret key of receiver in the j − 1th round
ESK R , j − 1 I I	The second entity secret key of receiver in the j − 1th round
ESK k − 1 I I	The second entity secret key in the k − 1th round
TD	The trapdoor
msg	The message
CT	The ciphertext

Definition 1.

An LR-PKSCET scheme is composed of six algorithms, namely, Initialization, EntityKeyGen, Signcryption, Unsigncryption, Authorization, and Test as follows. –

Initialization: The designated entity D E of this scheme (system) is responsible for executing the algorithm with a security parameter λ and outputs the system parameters SP.

–

EntityKeyGen: By executing the algorithm with the system parameters SP, the member entity ME generates two entity secret keys ESK I , ESK I I and two entity public keys EPK I , EPK I I .

–

Signcryption: By executing the algorithm in the i th round with the system parameters SP, two entity secret keys ESK S , i − 1 I , ESK S , i − 1 I I (the i − 1 th round) of the member entity ME S , identified as the sender, a message msg, and two entity public keys EPK R I , EPK R I I of the member entity ME R , identified as the receiver, the sender ME S generates a ciphertext CT.

–

Unsigncryption: By executing the algorithm in the j th round with the system parameters SP, two entity secret keys ESK R , j − 1 I , ESK R , j − 1 I I (the j − 1 th round) of a member entity ME R identified as the receiver, a ciphertext CT, and two entity public keys EPK S I , EPK S I I of a member entity ME S identified as the sender, the sender ME S generates a message msg.

–

Authorization: By executing the algorithm in the k th round with the system parameters SP and the entity secret key ESK k − 1 I I (the k − 1 th round) of a member entity ME, the member entity ME generates a trapdoor TD.

–

Test: By executing the algorithm with the system parameters SP, the ciphertext-trapdoor pair ( CT ζ , TD ζ ) of a member entity ME ζ and the ciphertext-trapdoor pair ( CT η , TD η ) of a member entity ME η , the cloud server CS generates 1 or 0.

4.2 Security Notions for LR-PKSCET

By the technique introduced in Galindo and Virek (2013), we initiate six unique leakage functions: LF S C , i A , LF S C , i B , LF USC , j A , LF USC , j B , LF Auth , k A and LF Auth , k B . Specifically, LF S C , i A and LF S C , i B are utilized to extract leaked information of ESK S I and ESK S I I , denoted as ESK S I = ( ESK S , i , A I , ESK S , i , B I ) and ESK S I I = ( ESK S , i , A I I , ESK S , i , B I I ) which are used in the Signcryption algorithm during the i th round. Similarly, LF USC , j A and LF USC , j B are applied to extract leaked information of ESK R I and ESK R I I , denoted as ESK R I = ( ESK R , j , A I , ESK R , j , B I ) and ESK R I I = ( ESK R , j , A I I , ESK R , j , B I I ) which are used in the Unsigncryption algorithm during the j th round. The last two leakage functions LF Auth , k A and LF Auth , k B are utilized to extract leaked information of ESK R I I , denoted as ESK R I I = ( ESK R , k , A I I , ESK R , k , B I I ) which is used in the Authorization algorithm during the k th round. Let Φ represent the maximum length of the bit strings that might be leaked from the secret keys. As a result, the size of | LF S C , i A |, | LF S C , i B |, | LF USC , j A |, | LF USC , j B |, | LF Auth , k A |, and | LF Auth , k B | are all bounded by Φ, where the notation | · | signifies the length of a bit string. Also, for convenience we will adopt the following six symbols:

–

Λ L F S C , i A = LF S C , i A ( ESK S , i , A I , ESK S , i , A I I );

–

Λ L F S C , i B = LF S C , i B ( ESK S , i , B I , ESK S , i , B I I );

–

Λ L F USC , j A = LF USC , j A ( ESK R , j , A I , ESK R , j , A I I );

–

Λ L F USC , j B = LF USC , j B ( ESK R , j , B I , ESK R , j , B I I );

–

Λ L F Auth , k A = LF Auth , k A ( ESK R , k , A I I );

–

Λ L F Auth , k B = LF Auth , k B ( ESK R , k , B I I ).

Next, we define indistinguishable security, one-way security, and existential unforgeability to serve as the security notion that can withstand adversaries with the capabilities of side-channel attacks. Definition 2.

If the advantage of an adversary A I to break a LR-PKSCET scheme in the following security game under side-channel and chosen-ciphertext attacks is negligible, we say that the scheme has leakage resilience and indistinguishable security. –

Setup: The challenger CH is responsible for executing the Initialization algorithm with a security parameter λ and outputs the system parameters SP which will be made public.

–

Phase 1: The adversary A I has the capability to make various adaptive queries as follows.

✓

EntityKeyGen query: A I sends a query containing member entity’s information ME. Subsequently, CH processes the EntityKeyGen algorithm to acquire two entity secret keys ESK I , ESK I I and two entity public keys EPK I , EPK I I , and returns them back to A I .

✓

Signcryption query: A I sends a query containing two entity secret keys ESK S , i I , ESK S , i I I of a member entity ME S identified as the sender, a message msg, and two entity public keys EPK R I , EPK R I I of a member entity ME R identified as the receiver. Subsequently, CH processes the Signcryption algorithm to acquire a ciphertext CT, and returns it back to A I .

✓

Signcryption leak query: A I sends a query containing an index i, and two leaked functions LF S C , i A and LF S C , i B . Subsequently, CH returns two leaked information Λ L F S C , i A and Λ L F S C , i B back to A I .

✓

Unsigncryption query: A I sends a query containing two entity secret keys ESK R , j I , ESK R , j I I of a member entity ME R identified as the receiver, a ciphertext CT, and two entity public keys EPK S I , EPK S I I of a member entity ME R identified as the sender. Subsequently, CH processes the Unsigncryption algorithm to acquire a message msg, and returns it back to A I .

✓

Unsigncryption leak query: A I sends a query containing an index j, and two leaked functions LF USC , j A and LF USC , j B . Subsequently, CH returns two sets of leaked information Λ LF USC , j A and Λ L F USC , j B back to A I .

✓

Authorization query: A I sends a query containing the entity secret key ESK k I I of a member entity ME. Subsequently, CH processes the Authorization algorithm to acquire a trapdoor TD, and returns it back to A I .

✓

Authorization leak query: A I sends a query containing an index k, and two leaked functions LF Auth , k A and LF Auth , k B . Subsequently, CH returns two sets of leaked information Λ L F Auth , k A and Λ L F Auth , k B back to A I .

–

Challenge: A I chooses a specific member entity ME R ∗ , and provides two target plaintexts, msg 0 and msg 1 , to CH. Subsequently, CH chooses a random bit b ∈ { 0 , 1 } and utilizes the Signcryption algorithm in the i th round with the corresponding parameters msg b ∗ , EPK R I , EPK R I I , ESK S , i I and ESK S , i I I to generate the target ciphertext CT ∗ . Then, CH sends ciphertext CT ∗ to A I . One restriction is that ME R ∗ is not allowed to appear in the EntityKeyGen queries.

–

Phase 2: The adversary A I can make further queries as in the Phase 1 except that the selected target, namely ME R ∗ , msg b ∗ , ESK S , i I and ESK S , i I I are not allowed to appear in the EntityKeyGen, the Unsigncryption and the Authorization queries.

–

Guess phase: A I produces the value b ′ and succeeds in the game if b ′ is equal to b. The advantage of winning the game is represented by Adv ( A I ) = | Pr [ b ′ = b ] − 1 / 2 |.

Definition 3.

If the advantage of an adversary A I I to break a LR-PKSCET scheme in the following game under side-channel and chosen-ciphertext attacks is negligible, we say that the scheme has leakage resilience and one-way security. –

Setup: This stage is the same as that in Definition 2.

–

Phase 1: This stage is the same as that in Definition 2.

–

Challenge: A I I chooses a specific member entity ME R ∗ to CH. Subsequently, CH chooses a random message msg ∗ and utilizes the Signcryption algorithm with msg ∗ , EPK R I , EPK R I I , ESK S , i I and ESK S , i I I to generate the target ciphertext CT ∗ . Then, CH sends ciphertext CT ∗ to A I I . One restriction is that ME R ∗ is not allowed to appear in the EntityKeyGen and the Authorization queries.

–

Phase 2: The adversary A I I can make further queries as in the Phase 1 except that the selected target, namely ME R ∗ , msg ∗ , ESK S , i I and ESK S , i I I are not allowed to appear in the EntityKeyGen and the Unsigncryption queries.

–

Guess phase: A I I produces the message msg ′ and succeeds in the game if msg ′ is equal to msg ∗ . The advantage of winning the game is represented by Adv ( A I I ) = | Pr [ msg ′ = msg ∗ ] |.

Definition 4.

If the advantage of an adversary A III to break a LR-PKSCET scheme in the following game under side-channel and chosen-message attacks is negligible, we say that the scheme has leakage resilience and existential unforgeability. –

Setup: This stage is the same as that in Definition 2.

–

Phase 1: This stage is the same as that in Definition 2.

–

Forgery: The adversary A III successfully forges a ciphertext CT ∗ = ( ME S ∗ , ME R ∗ , U ∗ , V ∗ , R ∗ , S ∗ , σ ∗ ) for a message M ∗ , and we declare A III as the winner of this game if the following conditions are satisfied.

✓

The Unsigncryption algorithm is capable of generating the message M ∗ .

✓

The Signcryption queries are not allowed to query the message M ∗ , ME S ∗ or ME R ∗ .

✓

The EntityKeyGen queries are not allowed to query the member entity ME S ∗ .

5 The Proposed LR-PKSCET Scheme

In this section, we show a leakage-resilient public key signcryption with equality test (LR-PKSCET) scheme that includes the following six algorithms. –

Initialization: The designated entity DE of this scheme (system) is responsible for executing the algorithm with a security parameter λ and outputs the system parameters SP by the following steps.

✓

Follow the guidelines provided in Section 3 to generate the bilinear parameters G, G T , q, e ˆ, g.

✓

Pick two random values x , y ∈ Z q ∗ , and then compute X = g x and Y = g y .

✓

Select five hash functions, namely, HF 1 : G T → G, HF 2 : G × G × G T → { 0 , 1 } m + n , HF 3 : { 0 , 1 } m → G, HF 4 : { 0 , 1 } m + n → Z q ∗ , HF 5 : { 0 , 1 } ∗ × { 0 , 1 } m + n × { 0 , 1 } m × G × G × G → { 0 , 1 } t , where m, n and t represent fixed lengths.

✓

Define the system parameters S P = { G , G T , q , e ˆ , g , X , Y , HF 1 , HF 2 , HF 3 , HF 4 , HF 5 }.

–

EntityKeyGen: By executing the algorithm with the system parameters SP, the member entity ME generates two entity secret keys ESK I , ESK I I and two entity public keys EPK I , EPK I I using the following steps. ✓

Choose two random values α , β ∈ Z q ∗ , and then compute ESK I = g α and ESK I I = g β .

✓

Utilize ESK I and ESK I I to establish EPK I = e ˆ ( g , g α ) and EPK I I = e ˆ ( g , g β ), respectively.

Next, the member entity ME

chooses two random renewed values, a and b, to calculate the initial entity secret keys ESK 0 I = ( ESK 0 , A I , ESK 0 , B I ) = ( ESK I · g a , g − a )

and ESK 0 I I = ( ESK 0 , A I I , ESK 0 , B I I ) = ( ESK I I · g b , g − b )

–

✓

Pick two random values h ∈ { 0 , 1 } n and v ∈ Z q ∗ , and compute U = g u and V = g v , where u = HF 4 ( msg , h ).

✓

Compute R = HF 2 ( ( EPK R I ) v , U , V ) ⊕ ( msg | | h ) and S = HF 1 ( ( EPK R I I ) v ) · HF 3 ( msg ) u .

✓

Choose a random values c ∈ Z q ∗ which are used to update the entity secret keys.

✓

Compute two entity secret keys ESK S , i I = ( ESK S , i , A I , ESK S , i , B I ) = ( ESK S , i − 1 , A I · g c , ESK S , i − 1 , B I · g − c ) and ESK S , i I I = ( ESK S , i , A I I , ESK S , i , B I I ) = ( ESK S , i − 1 , A I I · g c , ESK S , i − 1 , B I I · g − c ).

✓

Compute δ = HF 5 ( ME S , ME R , U , V , R , S , msg ), and then set T S I = ESK S , i , A I · ( X · Y δ ) u and T S I I = ESK S , i , A I I · ( X · Y δ ) v .

✓

Generate a signature σ = ESK S , i , B I · T S I · ESK S , i , B I I · T S I I .

✓

Set a ciphertext C T = ( ME S , ME R , U , V , R , S , σ ).

–

Unsigncryption: By executing the algorithm in the j th round with the system parameters SP, two entity secret keys ESK R , j − 1 I , ESK R , j − 1 I I (the j − 1 th round) of the member entity ME R , identified as the receiver, a ciphertext CT, and two entity public keys EPK S I , EPK S I I of the member entity ME S , identified as the sender, the sender ME S generates a message msg ′ by the following steps.

✓

Choose a random values d ∈ Z q ∗ which are used to update the entity secret keys.

✓

Compute two entity secret keys ESK R , j I = ( ESK R , j , A I , ESK R , j , B I ) = ( ESK R , j − 1 , A I · g d , ESK R , j − 1 , B I · g − d ) and ESK R , j I I = ( ESK R , j , A I I , ESK R , j , B I I ) = ( ESK R , j − 1 , A I I · g d , ESK R , j − 1 , B I I · g − d ).

✓

Set TU I = e ˆ ( ESK R , j , A I , V ) and TU I I = e ˆ ( ESK R , j , A I I , V ).

✓

Compute R ⊕ HF 2 ( TU I · e ˆ ( ESK R , j , B I , V ) , U , V ) to obtain msg ′ and h ′ .

✓

Set u ′ = HF 4 ( msg ′ , h ′ ). If the two equations U = g u ′ and S = HF 1 ( TU I I · e ˆ ( ESK R , j , B I I , V ) ) · HF 3 ( msg ′ ) u ′ hold, compute δ ′ = HF 5 ( ME S , ME R , U , V , R , S , msg ′ ). Otherwise, return the result “failure”.

✓

If e ˆ ( g , σ ) = EPK I · EPK I I · e ˆ ( U · V , X · Y δ ′ ) holds, return the message msg ′ . Otherwise, return the result “failure”.

–

Authorization: By executing the algorithm in the k th round with the system parameters SP and the entity secret key ESK S , k − 1 I I (the k − 1 th round) of a member entity ME, the member entity ME generates a trapdoor TD using the following steps.

✓

Choose a random value e ∈ Z q ∗ , and update the entity secret key ESK k I I = ( ESK k , A I I , ESK k , B I I ) = ( ESK k − 1 , A I I · g e , ESK k − 1 , B I I · g − e ).

✓

Set T T = ESK k , A I I , and compute T D = T T · ESK k , B I I .

–

Test: By executing the algorithm with the system parameters SP, the ciphertext-trapdoor pair ( CT ζ , TD ζ ) of the member entity ME ζ and the ciphertext-trapdoor pair ( CT η , TD η ) of the member entity ME η , the cloud server CS generates 1 or 0 by the following steps.

✓

Compute R ζ = S ζ / HF 1 ( e ˆ ( TD ζ , V ζ ) and R η = S η / HF 1 ( e ˆ ( TD η , V η ).

✓

If the equation e ˆ ( R η , U ζ ) = e ˆ ( R ζ , U η ) holds, output 1. Otherwise, output 0.

The following describes how to obtain the message msg

and verify the signature σ in the Unsigncryption algorithm. R ⊕ HF 2 ( TU I · e ˆ ( ESK R , j , B I , V ) , U , V ) = HF 2 ( ( EPK R I ) v , U , V ) ⊕ ( msg ‖ h ) ⊕ HF 2 ( e ˆ ( ESK R , j , A I , V ) · e ˆ ( ESK R , j , B I , V ) , U , V ) = ( msg ‖ h ) ⊕ HF 2 ( ( EPK R I ) v , U , V ) ⊕ HF 2 ( e ˆ ( ESK R I , V ) , U , V ) = ( msg ‖ h ) ⊕ HF 2 ( e ˆ ( g , g α ) v , U , V ) ⊕ HF 2 ( e ˆ ( g α , g v ) , U , V ) = ( msg ‖ h ) ⊕ HF 2 ( e ˆ ( g , g ) α v , U , V ) ⊕ HF 2 ( e ˆ ( g , g ) α v , U , V ) = ( msg ‖ h ) ,

e ˆ ( g , σ ) = e ˆ ( g , ESK S , i , B I · T S I · ESK S , i , B I I · T S I I ) = e ˆ ( g , ESK S , i , B I · ESK S , i , A I · ( X · Y δ ) u · ESK S , i , B I I · ESK S , i , A I I · ( X · Y δ ) v ) = e ˆ ( g , ESK S I · ( X · Y δ ) u · ESK S I I · ( X · Y δ ) v ) = e ˆ ( g , g α · ( X · Y δ ) u · g β · ( X · Y δ ) v ) = e ˆ ( g , g α ) · e ˆ ( g , g β ) · e ˆ ( g , ( X · Y δ ) u ) · e ˆ ( g , ( X · Y δ ) v ) = EPK I · EPK I I · e ˆ ( g u , ( X · Y δ ) ) · e ˆ ( g v , ( X · Y δ ) ) = EPK I · EPK I I · e ˆ ( U , ( X · Y δ ) ) · e ˆ ( V , ( X · Y δ ) ) = EPK I · EPK I I · e ˆ ( U · V , X · Y δ ) .

Next, we present the equation derivation process used in the T e s t

algorithm. R ζ = S ζ / HF 1 ( e ˆ ( TD ζ , V ζ ) ) = HF 1 ( ( EPK ζ I I ) v ζ ) · HF 3 ( msg ζ ) u ζ / HF 1 ( e ˆ ( T T ζ · ESK k , B I I , g v ζ ) ) = HF 1 ( e ˆ ( g , g β ζ ) v ζ ) · HF 3 ( msg ζ ) u ζ / HF 1 ( e ˆ ( ESK ζ , k , A I I · ESK ζ , k , B I I , g v ζ ) ) = HF 1 ( e ˆ ( g v ζ , g β ζ ) ) · HF 3 ( msg ζ ) u ζ / HF 1 ( e ˆ ( ESK ζ I I , g v ζ ) ) = HF 1 ( e ˆ ( g v ζ , g β ζ ) ) · HF 3 ( msg ζ ) u ζ / HF 1 ( e ˆ ( g β ζ , g v ζ ) ) = HF 3 ( msg ζ ) u ζ ,

R η = S η / HF 1 ( e ˆ ( TD η , V η ) ) = HF 1 ( ( EPK η I I ) v η ) · HF 3 ( msg η ) u η / HF 1 ( e ˆ ( T T η · ESK η , k , B I I , g v η ) ) = HF 1 ( e ˆ ( g , g β η ) v η ) · HF 3 ( msg η ) u η / HF 1 ( e ˆ ( ESK η , k , A I I · ESK η , k , B I I , g v η ) ) = HF 1 ( e ˆ ( g v η , g β η ) ) · HF 3 ( msg η ) u η / HF 1 ( e ˆ ( ESK η I I , g v η ) ) = HF 1 ( e ˆ ( g v η , g β η ) ) · HF 3 ( msg η ) u η / HF 1 ( e ˆ ( g β η , g v η ) ) = HF 3 ( msg η ) u η ,

e ˆ ( R η , U ζ ) = e ˆ ( HF 3 ( msg η ) u η , g u ζ ) = e ˆ ( HF 3 ( msg η ) , g ) u η · u ζ , e ˆ ( R ζ , U η ) = e ˆ ( HF 3 ( msg ζ ) u ζ , g u η ) = e ˆ ( HF 3 ( msg ζ ) , g ) u ζ · u η .

6 Security Analysis

In this section, we will prove three theorems to establish the security of the proposed LR-PKSCET scheme in terms of indistinguishable security, one-way security and existential unforgeability, while ensuring that the proposed scheme possesses leakage resilience to withstand side-channel attacks. Theorem 1.

Under the assumptions of DL and HF, the proposed LR-PKSCET scheme possesses leakage resilience and indistinguishable security in the security game (Definition 2) using the GBG model.

Proof.

Let’s begin the security game with the interaction between a challenger CH and an adversary A I . –

Setup: The challenger CH utilizes a security parameter λ to execute the Initialization algorithm to generate the system parameters S P = { G, G T , q, e ˆ, g, X, Y, HF 1 , HF 2 , HF 3 , HF 4 , HF 5 }. Furthermore, CH creates eight lists L G, L G T , L HF 1 , L HF 2 , L HF 3 , L HF 4 , L HF 5 , L MEkeys as below.

✓

The list L G contains pairs of , where each element in G is represented by a multivariate polynomial , and its corresponding encoded bit-string is denoted by . Here, r, t, and v respectively represent the query type, the t-th query, and the v-th element in G. Initially, the challenger CH adds three pairs , and to the list L G.

✓

The list L G T contains pairs of , where each element in G T is represented by a multivariate polynomial , and its corresponding encoded bit-string is denoted by . Furthermore, the symbols r, t, and v have the same meanings as those in the list L G above.

Each element present in the lists L G and L G T is represented both as a multivariate polynomial and a bit-string. To facilitate the conversion between these representations, we introduce two conversion rules, namely Rule-1 and Rule-2. These rules illustrate the process of transforming a multivariate polynomial into its corresponding bit-string and vice versa.

•

Under Rule-1, when encountering the multivariate polynomial in the list L G / L G T , the procedure involves converting it to the corresponding bit-string , which will be the output. However, if the multivariate polynomial is not present in the list, a random bit-string related to is chosen. This newly selected string will be appended to the list L G / L G T , and then returned as the output.

•

Under Rule-2, when encountering the bit-string in the list L G / L G T , the procedure involves converting it to the corresponding multivariate polynomial , which will be the output. However, if the bit-string is not present in the list, a random polynomial related to is chosen. This newly selected polynomial will be appended to the list L G / L G T , and then returned as the output.

✓

The list L HF 1 contains pairs of , where and are the necessary information for the execution of HF 1 .

✓

The list L HF 2 contains pairs of , where and are the necessary information for the execution of HF 2 .

✓

The list L HF 3 contains pairs of , where msg and are the necessary information for the execution of HF 3 .

✓

The list L HF 4 contains pairs of , where msg | | h and are the necessary information for the execution of HF 4 .

✓

The list L HF 5 contains pairs of , where and are the necessary information for the execution of HF 5 .

✓

The list L MEkeys contains pairs of , where ME, and , respectively, are presented as the information of member entity, entity secret keys and entity public keys.

–

Phase 1: The adversary A I has the capability to make at most ψ 1 queries as follows.

✓

Q G query: By providing and A C T as inputs to this query, the execution of the following steps will produce a response denoted by .

•

Execute Rule-2 to transform into .

•

Compute if A C T = “multiplication” and – if A C T = “division”.

•

Execute Rule-1 to transform into .

✓

Q G T query: By providing , and A C T as inputs to this query, the execution of the following steps will produce a response denoted by .

•

Execute Rule-2 to transform into .

•

Compute if A C T = “multiplication” and if A C T = “division”.

•

Execute Rule-1 to transform into .

✓

Q e ˆ query: By providing and as inputs to this query, the execution of the following steps will produce a response denoted by .

•

Execute Rule-2 to transform into .

•

Compute .

•

Execute Rule-1 to transform into .

✓

EntityKeyGen query: By providing member entity’s information ME as inputs to this query, the challenger CH uses ME to search the list L MEkeys. Once the matching pair is located, CH transforms the pair into , respectively, and subsequently returns them to A I .

✓

Signcryption query: By inputting two entity secret keys ESK S , i I , ESK S , i I I of the member entity ME S , identified as the sender, a message msg, and two entity public keys EPK R I , EPK R I I of the member entity ME R , identified as the receiver, the execution of the following steps will produce a ciphertext CT.

•

Use ME S and ME R to find and in the list L MEkeys, respectively.

•

Choose the variate from the list L HF 4 by using msg | | h, where h is a random value.

•

Set and pick a random variate in G.

•

Choose the variate from the list L HF 2 by using .

•

Execute Rule-1 to transform into .

•

Compute , and execute Rule-2 to transform into .

•

Choose the variate from the list L HF 1 by using , and choose the variate from the list L HF 3 by using msg.

•

Set .

•

Choose the variate from the list L HF 5 by using .

•

Set .

•

Set .

✓

Signcryption leak query: By providing an index i, and two leaked functions LF S C , i A and LF S C , i B as inputs to this query, the challenger CH provides two sets of leaked information Λ L F S C , i A = LF S C , i A ( ESK S , i , A I , ESK S , i , A I I ) and Λ L F S C , i B = LF S C , i B ( ESK S , i , B I , ESK S , i , B I I ) back to A I .

✓

Unsigncryption query: By inputting two entity secret keys ESK R , j I , ESK R , j I I of the member entity ME R , identified as the receiver, a ciphertext CT message msg, and two entity public keys EPK S I , EPK S I I of the member entity ME S , identified as the sender, the execution of the following steps will produce a message msg.

•

Choose the variate from the list L HF 2 by using .

•

Execute Rule-1 to transform and into and .

•

Compute , and obtain msg ′ and h ′ .

•

Choose the variate from the list L HF 1 by using .

•

Choose the variate from the list L HF 3 by using msg ′ .

•

Choose the variate from the list L HF 4 by using msg ′ | | h ′ .

•

If both equations and hold, find from the list L HF 5 by using .

•

If holds, return the message msg ′ .

✓

Unsigncryption leak query: By providing an index j, and two leaked functions LF USC , j A and LF USC , j B as inputs to this query, the challenger CH provides two sets of leaked information Λ LF USC , j A = LF USC , j A ( ESK R , j , A I , ESK R , j , A I I ) and Λ L F USC , j B = LF USC , j B ( ESK R , j , B I , ESK R , j , B I I ) back to A I .

✓

Authorization query: By providing member entity’s information ME as inputs to this query, the challenger CH uses ME to search the list L MEkeys. Once the matching pair is located, CH transforms the pair into respectively. Then, CH sets , and subsequently returns it to A I .

✓

Authorization leak query: By providing an index k, and two leaked functions LF Auth , k A and LF Auth , k B as inputs to this query, the challenger CH provides two sets of leaked information Λ L F Auth , k A = LF Auth , k A ( ESK R , j , A I I ) and Λ L F Auth , k B = LF Auth , k B ( ESK R , j , B I I ) back to A I .

–

Challenger: A I chooses a specific member entity ME R ∗ , and provides two target plaintexts, msg 0 and msg 1 , to CH. Subsequently, CH chooses a random bit b ∈ { 0 , 1 } and utilizes the Signcryption algorithm with the corresponding parameters msg b ∗ , EPK R I , EPK R I I , ESK S , i I and ESK S , i I I to generate the target ciphertext CT ∗ . Then, CH sends the resulting ciphertext CT ∗ to A I .

–

Phase 2: The adversary A I can make further queries at most ψ 2 times as in the Phase 1 except that the selected target, namely ME R ∗ , msg b ∗ , ESK S , i I and ESK S , i I I , may not appear in the EntityKeyGen, the Unsigncryption and the Authorization queries.

–

Guess phase: A I produces the value b ′ and succeeds in the game if b ′ is equal to b. The advantage of winning the game is represented by Adv ( A I ) = | Pr[ b ′ = b ]– 1 / 2 |.

In the following, we explore the advantage that A I wins the security game. We discuss A I ’s advantage in two scenarios: (1) A I refrains from employing leak queries; (2) A I utilizes Signcryption leak query, Unsigncryption leak query and Authorization leak query. –

Scenario I: A I possesses Adv A I n l q ≦ | Pr [ Case 1 ] + Pr [ Case 2 ] − 1 / 2 | ≦ | 384 ( ψ 1 + ψ 2 ) 2 / q + 1 / 2 − 1 / 2 | = O ( ( ψ 1 + ψ 2 ) 2 / q ) in winning the security game, where Pr[Case 1] and Pr[Case 2] are described below.

✓

Pr[Case 1] refers to the probability of encountering a collision in either L G or L G T . Let’s focus on the collision probability within the list L G. Assume that we have j elements in L G, denoted by v i ∈ Z q ∗ for i ∈ [ 1 , j ], where j random values are considered. In the event of a collision, we observe – , where and represent any two polynomials from the list L G. This implies that and have the same value, which resembles a collision in a hash function. Therefore, if one could efficiently find such a collision, it would imply the ability to solve the discrete logarithm problem. Utilizing Lemma 2, we can evaluate the probability of a collision occurring within L G, estimated as ( 3 / q ) | L G | 2 , based on the fact that the maximum degree of a polynomial in L G is 3, as observed from the Signcryption query where the highest-degree term has degree 3. Similarly, the probability of a collision occurring within the list L G T is ( 6 / q ) | L G T | 2 . Thus, we have Pr [ Case 1 ] ≦ ( 3 / q ) | L G | 2 + ( 6 / q ) | L G T | 2 ≦ ( 6 / q ) ( | L G | + | L G T | ) 2 ≦ 384 ( ψ 1 + ψ 2 ) 2 / q due to the fact that | L G | + | L G T | ≦ 8 ( ψ 1 + ψ 2 ).

✓

Pr[Case 2] refers to the probability of encountering a correct guess b ′ = b and so Pr [ Case 2 ] ≦ 1 / 2.

–

Scenario II: A I possesses Adv A I l q ≦ O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ) + O ( ( ψ 1 + ψ 2 ) 2 / q ) = O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ) in successfully winning the security game by the following cases.

✓

A I issues the Signcryption leak query: Through this query, A I acquires Λ L F S C , i A and Λ L F S C , i B from two leaked functions LF S C , i A and LF S C , i B , where Λ L F S C , i A is defined as LF S C , i A ( ESK S , i , A I , ESK S , i , A I I ), and Λ L F S C , i B corresponds to LF S C , i B ( ESK S , i , B I , ESK S , i , B I I ). Here, ESK S I and ESK S I I can be obtained from the equations ESK S , 0 , A I · ESK S , 0 , B I = ESK S , 1 , A I · ESK S , 1 , B I = ⋯ = ESK S , i − 1 , A I · ESK S , i − 1 , B I = ESK S , i , A I · ESK S , i , B I , and ESK S , 0 , A I I · ESK S , 0 , B I I = ESK S , 1 , A I I · ESK S , 1 , B I I = ⋯ = ESK S , i − 1 , A I I · ESK S , i − 1 , B I I = ESK S , i , A I I · ESK S , i , B I I . By employing key update techniques in Galindo and Virek (2013) with the constraint that | Λ L F S C , i A | and | Λ L F S C , i B | are both less than Φ, the adversary A I ’s ability is restricted to acquiring a maximum of 2 Φ bits of ESK S I and ESK S I I .

✓

A I issues the Unsigncryption leak query: Through this query, A I acquires Λ LF USC , j A and Λ L F USC , j B from two leaked functions LF USC , j A and LF USC , j B , where Λ LF USC , j A is defined as LF USC , j A ( ESK R , j , A I , ESK R , j , A I I ), and Λ L F USC , j B corresponds to LF USC , j B ( ESK R , j , B I , ESK R , j , B I I ). Here, ESK R I and ESK R I I can be obtained from the equations ESK R , 0 , A I · ESK R , 0 , B I = ESK R , 1 , A I · ESK R , 1 , B I = ⋯ = ESK R , j − 1 , A I · ESK R , j − 1 , B I = ESK R , j , A I · ESK R , j , B I , and ESK R , 0 , A I I · ESK R , 0 , B I I = ESK R , 1 , A I I · ESK R , 1 , B I I = ⋯ = ESK R , j − 1 , A I I · ESK R , j − 1 , B I I = ESK R , j , A I I · ESK R , j , B I I . By employing key update techniques in Galindo and Virek (2013) with the constraint that | Λ LF USC , j A | and | Λ L F USC , j B | are both less than Φ, the adversary A I ’s ability is restricted to acquiring a maximum of 2 Φ bits of ESK R I and ESK R I I .

✓

A I issues the Authorization leak query: Through this query, A I acquires Λ L F Auth , k A and Λ L F Auth , k B from two leaked functions LF Auth , k A and LF Auth , k B , where Λ L F Auth , k A is defined as LF Auth , k A ( ESK R , j , A I I ), and Λ L F Auth , k B corresponds to LF USC , j B ( ESK R , j , B I I ). Here, ESK R I I can be obtained from the equation ESK R , 0 , A I I · ESK R , 0 , B I I = ESK R , 1 , A I I · ESK R , 1 , B I I = ⋯ = ESK R , k − 1 , A I I · ESK R , k − 1 , B I I = ESK R , k , A I I · ESK R , k , B I I . By employing key update techniques in Galindo and Virek (2013) with the constraint that | Λ L F Auth , k A | and | Λ L F Auth , k B | are both less than Φ, the adversary A I ’s ability is restricted to acquiring a maximum of 2 Φ bits of ESK R I I .

Based on the aforementioned discussions, three events are defined as follows: –

In the first event E ESK I , A I has the capability to derive ESK I from Λ L F S C , i A , Λ L F S C , i B , Λ LF USC , j A and Λ L F USC , j B . Furthermore, the complementary event of E ESK I is denoted as E ESK I ‾.

–

In the second event E ESK I I , A I has the capability to derive ESK I I from Λ L F S C , i A , Λ L F S C , i B , Λ LF USC , j A , Λ L F USC , j B , Λ L F Auth , k A and Λ L F Auth , k B . Furthermore, the complementary event of E ESK I I is denoted as E ESK I I ‾.

–

In the third event E C G, A I has a correct guess.

Considering these three events, we can compute the probability Pr[ A I ] of A I winning this game. P r [ A I ] = P r [ E C G ] = P r [ E C G ∧ ( E ESK I ∨ E ESK I I ) ] + P r [ E C G ∧ ( E ESK I ‾ ∧ E ESK I I ‾ ) ] ≦ P r [ E ESK I ∨ E ESK I I ] + P r [ E C G ∧ ( E ESK I ‾ ∧ E ESK I I ‾ ) ]

Because of Lemma 2, we obtain Pr [ E ESK I ∧ E ESK I I ] ≦ Adv A I n l q · 2 2 Φ ≦ O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ). Since Pr [ E C G ∧ ( E ESK I ‾ ∧ E ESK I I ‾ ) ] indicates the advantage of correct guess while having no knowledge of ESK I and ESK I I , we have Pr [ E C G ∧ ( E ESK I ‾ ∧ E ESK I I ‾ ) ] = Adv A I n l q = O ( ( ψ 1 + ψ 2 ) 2 / q ). Finally, we have Pr [ A I ] = Pr [ E C G ] ≦ O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ) + O ( ( ψ 1 + ψ 2 ) 2 / q ) = O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ). □

Theorem 2.

Under the assumptions of DL and HF, the proposed LR-PKSCET scheme possesses leakage resilience and one-way security in the security game (Definition 3) using the GBG model.

Proof.

Let’s begin the security game with the interaction between a challenger CH and an adversary A I I . –

Setup: This stage is the same as that in the proof of Theorem 1.

–

Phase 1: This stage is the same as that in the proof of Theorem 1.

–

Challenge: A I I chooses a specific member entity ME R ∗ to CH. Subsequently, CH chooses a random message msg ∗ and utilizes the Signcryption algorithm with the corresponding parameters msg ∗ , EPK R I , EPK R I I , ESK S I and ESK S I I to generate the target ciphertext CT ∗ . Then, CH sends CT ∗ to A I I .

–

Phase 2: The adversary A I I can make further queries at most ψ 2 times as in the Phase 1 except that the selected target, namely ME R ∗ , msg ∗ , ESK S , i I and ESK S , i I I , may not appear in the EntityKeyGen and the Unsigncryption queries.

–

Guess phase: A I I produces the message msg ′ and wins the game if msg ′ is the same as msg. The advantage of winning the game is represented by Adv ( A I I ) = | Pr [ msg ′ = msg ] |.

In the following, we explore the advantage that A I I wins in the security game. We discuss A I I ’s advantage in two scenarios: (1) A I I refrains from employing leak queries; (2) A I I utilizes Signcryption leak query and Unsigncryption leak query. –

Scenario I: A I I possesses Adv A I I n l q ≦ | Pr [ Case 1 ] + Pr [ Case 2 ] | ≦ | 384 ( ψ 1 + ψ 2 ) 2 / q + 2 / q | = O ( ( ψ 1 + ψ 2 ) 2 / q ) in winning the security game, where Pr[Case 1] and Pr[Case 2] are described below.

✓

Pr[Case 1] refers to the probability of encountering a collision in either L G or L G T . We can obtain Pr [ Case 1 ] ≦ 384 ( ψ 1 + ψ 2 ) 2 / q using a proof similar to that in the proof of Theorem 1.

✓

Pr[Case 2] refers to the probability of encountering a correct output msg ′ = msg. Certainly, A I I will be provided with a target ciphertext CT ∗ = ( ME S ∗ , ME R ∗ , U ∗ , V ∗ , R ∗ , S ∗ , σ ∗ ), and A I I will utilize the Unsigncryption algorithm to derive the message msg ′ . Notably, the message msg ′ is computed using the expression R ∗ ⊕ HF 2 ( e ˆ ( ESK R I , V ∗ ) , U ∗ , V ∗ ). Let’s denote . The polynomial exhibits a maximum degree of 2. By Lemma 2, the probability Pr [ Case 2 ] ≦ 2 / q can be achieved.

–

Scenario II: By employing a similar approach to the proof of Theorem 1, we have that A I I possesses Adv A I I l q ≦ O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ) + O ( ( ψ 1 + ψ 2 ) 2 / q ) = O ( ( ψ 1 + ψ 2 ) 2 / q · 2 2 Φ ) in winning the security game.

□

Theorem 3.

Under the assumptions of DL and HF, the proposed LR-PKSCET scheme possesses leakage resilience and existential unforgeability in the security game (Definition 4) using the GBG model.

Proof.

Let’s begin the security game with the interaction between a challenger CH and an adversary A III . –

Setup: This stage is the same as that in the proof of Theorem 1.

–

Phase 1: This stage is the same as that in the proof of Theorem 1.

–

Forgery: The adversary A III successfully forges a ciphertext CT ∗ = ( ME S ∗ , ME R ∗ , U ∗ , V ∗ , R ∗ , S ∗ , σ ∗ ) for a message msg ∗ , and we declare A III as the winner of this game if the following conditions are satisfied.

✓

The Unsigncryption algorithm is capable of generating the message msg ∗ .

✓

The Signcryption queries do not include the message msg ∗ , and that also do not contain the two member entities ME S ∗ and ME R ∗ .

✓

The EntityKeyGen queries do not include the member entity ME S ∗ .

In the following, we explore the advantage that A III wins the security game. We discuss A III ’s advantage in two scenarios: (1) A III refrains from employing leak queries; (2) A III utilizes Signcryption leak query, Unsigncryption leak query and Authorization leak query. –

Scenario I: A III possesses Adv A III n l q ≦ | Pr [ Case 1 ] + Pr [ Case 2 ] | ≦ | 384 ψ 1 2 / q + 3 / q | = O ( ψ 1 2 / q ) in winning the security game, where Pr[Case 1] and Pr[Case 2] are described below.

✓

Pr[Case 2] refers to the probability of forging a valid pair ( msg ∗ , CT ∗ = ( ME S ∗ , ME R ∗ , U ∗ , V ∗ , R ∗ , S ∗ , σ ∗ ) ). The valid pair satisfies in the Unsigncryption algorithm. Let’s denote – . The polynomial exhibits a maximum degree of 3. By Lemma 2, the probability Pr[Case 2] ≦ 3 / q can be achieved.

–

Scenario II: By employing a similar approach to the proof of Theorem 1, we have that A III possesses Adv A III l q ≦ O ( ψ 1 2 / q · 2 2 Φ ) + O ( ψ 1 2 / q ) = O ( ψ 1 2 / q · 2 2 Φ ) in winning the security game.

□

7 Comparisons

We compare the proposed LR-PKSCET scheme with the existing PKEET scheme (Ma et al., 2015), PKSCET scheme (Le et al., 2021), LR-PKE scheme (Galindo et al., 2016), and LR-PKSC scheme (Tseng et al., 2022). Table 2 summarizes these comparisons on three properties: possession of signature and encryption, permission of secret keys leakage, and with the property of equality test. Firstly, let’s consider the PKEET scheme (Ma et al., 2015), which focuses on the equality test functionality, but falls short in the other two properties. On the other hand, the PKSCET scheme (Le et al., 2021) possesses the property of performing both signature and encryption, along with the desirable equality test functionality. Unfortunately, it does not allow secret keys leakage. Conversely, the LR-PKE scheme (Galindo et al., 2016) addresses the issue of secret keys leakage, but does so without possessing both signature and encryption capabilities or the equality test functionality. In contrast, the LR-PKSC scheme (Tseng et al., 2022) combines the advantage of possessing both signature and encryption capabilities along with the ability to allow secret keys leakage. However, it falls short in providing the equality test functionality. In conclusion, the proposed LR-PKSCET emerges as a versatile solution that includes all three properties – having signature and encryption capabilities, permission of secret key leakage, and with the equality test functionality.

Table 2

Comparison of our LR-PKSCET with existing PKEET, PKSCET, LR-PKE and LR-PKSC.

Schemes	Possession of signature and encryption	Permission of secret keys leakage	With the property of equality test
Ma et al.’s PKEET scheme (2015)	No	No	Yes
Le et al.’s PKSCET scheme (2021)	Yes	No	Yes
Galindo et al.’s LR-PKE scheme (2016)	No	Yes	No
Tseng et al.’s LR-PKSC scheme (2022)	Yes	Yes	No
Our LR-PKSCET scheme	Yes	Yes	Yes

Next, we introduce a pair of symbols aimed at evaluating the computational effort of the algorithms of our LR-PKSCET scheme:

•

C E b p : This symbol denotes the computational effort required for performing a bilinear pairing operation e ˆ : G × G → G T .

•

C E e x p : This symbol denotes the computational effort required for performing exponentiation of the group G or G T .

We derive the pertinent result from simulations (Xiong and Qin, 2015) to obtain an approximate 20 ms for C E b p and 7 ms for C E e x p . These simulations are conducted under a computer environment of an Intel Core i7 CPU with 1.80 GHz. The input of simulations encompasses a finite field denoted as F q , along with the groups G and G T . Here, q denotes a prime number with 512 bits, and it concurrently serves as the order of the two groups G and G T . The simulations involve a mobile device environment that employs an Intel 624-MHz PXA270 CPU. We obtain C E b p and C E e x p to be approximately 96 ms and 31 ms, respectively. For a more comprehensive understanding, Table 3 presents an overview of the computational effort of our LR-PKSCET scheme linked to distinct algorithmic processes, including Initialization, EntityKeyGen, Signcryption, Unsigncryption, Authorization and Test on a mobile device MD and a PC.

Table 3

Computational cost of our LR-PKSCET.

Algorithms	Computational effort	Running time on a MD	Running time on a PC
Initialization	2 C E e x p	62 ms	14 ms
EntityKeyGen	2 C E b p + 6 C E e x p	378 ms	82 ms
Signcryption	10 C E e x p	310 ms	70 ms
Unsigncryption	5 C E b p + 5 C E e x p	635 ms	135 ms
Authorization	2 C E e x p	62 ms	14 ms
Test	4 C E b p	384 ms	80 ms

Fig. 3

Building an anti-scam system based on the proposed LR-PKSCET scheme.

8 Application

As mentioned in Section 1, our LR-PKSCET scheme can be applied to anti-scam systems. As depicted in Fig. 3, we present a situation that exemplifies the utilization of the LR-PKSCET scheme to counteract telephone scams. The scenario encompasses four key roles: anti-scam centre, interlocutor, user, and cloud server. Now, we provide a breakdown of the responsibilities and functions associated with each role within the presented scenario.

✓

The anti-scam centre ( ASC ) continuously collects keywords related to telephone scams and subjects these keywords to a signcryption process (by using Signcryption algorithm). Also, the ASC employs its own secret key to perform Authorization algorithm to generate a trapdoor TD A C S . Subsequently, the ASC transmits the generated ciphertexts and the trapdoor TD A C S to the cloud server through public and secure channels, respectively.

✓

The interlocutor could potentially be a scammer, who initiates a call to the user with the intention of orchestrating a fraudulent scheme over the phone.

✓

The user is vulnerable to potential scammers. When an interlocutor’s call is received, the mobile application automatically transforms the spoken content into text. Relevant keywords are extracted from this transcribed text, and then these keywords will also be subjected to the signcryption procedure. On the other hand, the user also employs its own secret key to generate a trapdoor TD U . Subsequently, the user transmits the generated ciphertexts and the trapdoor TD U to the cloud server through public and secure channels, respectively.

✓

The cloud server ( CS ) is responsible for performing equality tests of ciphertexts using the Test algorithm, which determines whether two ciphertexts contain the same plaintext. During this test process, the CS remains unaware of the actual plaintext content. Upon detecting a specific number of matches, the CS will promptly dispatch a warning message to the user. This message serves to alert the user that the ongoing conversation could be linked to a scam activity. As a result, the user may be able to avoid this scam activity.

According to the scenario described above, the proposed LR-PKSCET scheme demonstrates a collaborative approach to counter telephone scams effectively. The synergy among the ASC, interlocutor, user, and CS displays the potential to enhance security measures in the realm of telecommunication.

9 Conclusions and Future Work

In this paper, we have presented a novel solution to the critical challenge of enhancing the security of PKSCET against side-channel attacks. Our proposed leakage-resilient public key signcryption with equality test (LR-PKSCET) scheme not only successfully combines the benefits of public key signcryption and equality test properties but also offers robust resistance against side-channel attacks. Through rigorous analysis and security proofs, we have demonstrated that the LR-PKSCET scheme achieves several essential security attributes, including leakage resilience, indistinguishability, one-wayness, and existential unforgeability. By incorporating the proposed LR-PKSCET scheme into an anti-scam system, we offer a practical application that addresses a pressing societal concern. The integration of our scheme into such a system has the potential to significantly reduce the frequency and impact of scam cases, thereby safeguarding users from financial and personal losses. While our proposed scheme is based on classical bilinear pairing and achieves indistinguishable chosen-ciphertext attacks (IND-CCA) security, we recognize the increasing importance of post-quantum cryptography (PQC). Although some research efforts have been made in designing PQC-based public key signcryption with equality test (PKSCET), these schemes still lack the functionality to side-channel attacks. As part of our future work, we aim to design a PQC-based LR-PKSCET scheme that maintains IND-CCA security and addresses the challenges posed by the quantum era.

References

Agrawal, S., Boneh, D., Boyen, X. (2010). Efficient lattice (h)ibe in the standard model. In: LNCS, Vol. 6110. EUROCRYPT’10, pp. 553–572.

Akavia, A., Goldwasser, S., Vaikuntanathan, V. (2009). Simultaneous hardcore bits and cryptography against memory attacks. In: TCC’09, LNCS, Vol. 5444. pp. 474–495.

Alouffi, B., Hasnain, M., Alharbi, A., Alosaimi, W., Alyami, H., Ayaz, M. (2021). A systematic literature review on cloud computing security: Threats and mitigation strategies. IEEE Access, 9, 57792–57807.

Boneh, D., Crescenz, G.D., Ostrovsky, R., Persiano, G. (2004). Public key encryption with keyword search. In: EUROCRYPT’04, LNCS, Vol. 3027. pp. 506–522.

Boneh, D., Boyen, X., Goh, E.J. (2005). Hierarchical identity-based encryption with constant size ciphertext. In: EUROCRYPT’05, LNCS, Vol. 3494. pp. 440–456.

Deverajan, G.G., Muthukumaran, V., Hsu, C.-H., Karuppiah, M., Chung, Y.-C., Chen, Y.-H. (2021). Public key encryption with equality test for industrial Internet of Things system in cloud computing. Transactions on Emerging Telecommunications Technologies, 4, e4202.

Dodis, Y., Ostrovsky, R., Reyzin, L., Smith, A. (2008). Fuzzy extractors: How to generate strong keys from biometrics and other noisy data. SIAM Journal on Computing, 38(1), 97–139.

Duong, D.H., Fukushima, K., Kiyomoto, S., Roy, P.S., Susilo, W. (2019). A lattice-based public key encryption with equality test in standard model. In: ACISP’19, LNCS, Vol. 11547. pp. 138–155.

Dziembowski, S., Pietrzak, K. (2008). Leakage-resilient cryptography. In: FOCS’08, 293–302.

Faust, S., Kiltz, E., Pietrzak, K., Rothblum, G. (2010). Leakage-resilient signatures. In: TCC’10, LNCS, Vol. 5978. pp. 343–360.

Galindo, D., Grobschadl, J., Liu, Z., Vadnala, P.K., Vivek, S. (2016). Implementation of a leakage-resilient ElGamal key encapsulation mechanism. Journal of Cryptographic Engineering, 6(3), 229–238.

Galindo, D., Virek, S. (2013). A practical leakage-resilient signature scheme in the generic group model. In: SAC’13, LNCS, Vol. 7707. pp. 50–65.

Huang, K., Tso, R., Chen, Y.-C., Li, W., Sun, H. (2014). A new public key encryption with equality test. In: NSS’15, LNCS, Vol. 8792. pp. 550–557.

Huang, K., Tso, R., Chen, Y.-C., Rahman, S.M.M., Almogren, A., Alamri, A. (2015). PKE-AET: Public key encryption with authorized equality test. The Computer Journal, 58(10), 2686–2697.

Huang, M., Yang, B., Zhou, Y., Hu, X. (2022). Continual leakage-resilient hedged public-key encryption. The Computer Journal, 65(6), 1574–1585.

Kiltz, E., Pietrzak, K. (2010). Leakage resilient elgamal encryption. In: ASIACRYPT’10, LNCS, Vol. 6477, pp. 595–612.

Kubota, T., Yoshida, K., Shiozaki, M., Fujino, T. (2021). Deep learning side-channel attack against hardware implementations of AES. Microprocessors and Microsystems, 87, 103383.

Le, H.Q., Duong, D.H., Roy, P.S., Susilo, W., Fukushima, K., Kiyomoto, S. (2021). Lattice-based signcryption with equality test in standard model. Computer Standards & Interfaces, 76, 103515.

Lee, H.T., Ling, S., Seo, J.H., Wang, H. (2019). Public key encryption with equality test from generic assumptions in the random oracle model. Information Sciences, 500, 15–33.

Lee, H.T., Ling, S., Seo, J.H., Wang, H., Youn, T. (2020). Public key encryption with equality test in the standard model. Information Sciences, 516, 89–108.

Li, S., Zhang, F., Sun, Y., Shen, L. (2013). Efficient leakage-resilient public key encryption from DDH assumption. Cluster Computing, 16(4), 797–806.

Ma, S., Huang, Q., Zhang, M., Yang, B. (2015). Efficient public key encryption with equality test supporting flexible authorization. IEEE Transactions on Information Forensics and Security, 10(3), 458–470.

Naor, M., Segev, G. (2009). Public-key cryptosystems resilient to key leakage. In: CRYPTO’09, LNCS, Vol. 5677. pp. 18–35.

Naor, M., Segev, G. (2012). Public-key cryptosystems resilient to key leakage. SIAM Journal on Computing, 41(4), 772–814.

Ngo, K., Dubrova, E., Guo, Q., Johansson, T. (2021). A side-channel attack on a masked ind-CCA secure saber kem implementation. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2021(4), 676–707.

Sun, P. (2020). Security and privacy protection in cloud computing: Discussions and challenges. Journal of Network and Computer Applications, 160, 102642.

Tang, Q. (2011). Towards public key encryption scheme supporting equality test with fine-grained authorization. In: ACISP’11, LNCS, Vol. 6812, pp. 389–406.

Tang, Q. (2012a). Public key encryption supporting plaintext equality test and user-specified authorization. Security and Communication Networks, 5(12), 1351–1362.

Tang, Q. (2012b). Public key encryption schemes supporting equality test with authorisation of different granularity. International Journal of Applied Cryptography, 2(4), 304–321.

Tseng, Y.M., Tsai, T.T., Huang, S.S. (2022). Practical leakage-resilient signcryption scheme suitable for mobile environments. In: IEEE GCCE’22, pp. 383–384.

Xiong, H., Qin, Z. (2015). Revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks. IEEE Transactions on Information Forensics and Security, 10(7), 1442–1455.

Yang, G., Tan, C.H., Huang, Q., Wong, D.S. (2010). Probabilistic public key encryption with equality test. In: CT-RSA’10, LNCS, Vol. 5985. pp. 119–131.

Zhou, Y., Hu, Z., Li, F. (2021). Searchable public-key encryption with cryptographic reverse firewalls for cloud storage. IEEE Transactions on Cloud Computing, 11(1), 383–396.