Heterogeneous multi-receiver signcryption scheme Y. L i
et al.
same prime order q, and G
1
is generated by P. A bilinear
map e : G
1
G
1
! G
2
needs to satisfy the following
conditions:
(1) Bilinearity: e(aP
1
, bP
2
)=e(P
1
, P
2
)
ab
for 8P
1
, P
2
2
G
1
and 8a, b 2 Z
q
.
(2) Non-degeneracy: There exists P, Q 2 G
1
, such that
e(P, Q) ¤ 1.
(3) Computability: e(P
1
, P
2
) can be computed for
8P
1
, P
2
2 G
1
.
Definition 1 (Bilinear Diffie–Hellman (BDH) problem).
Given hP, aP, bP, cPi with unknown a, b, c 2 Z
q
, compute
e(P, P)
abc
. The probability of Succ
BDH
B
that any probabilis-
tic polynomial time (PPT)
B solves the BDH problem is
defined as
Succ
BDH
B
= Pr[e(P, P)
abc
B(P, aP, bP, cP)].
The BDH assumption is that for any PPT algorithm
B, Succ
BDH
B
is negligible.
Definition 2 (Computational Diffie–Hellman (CDH) prob-
lem). Given hP, aP, bPi with unknown a, b 2 Z
q
, com-
pute abP. The probability of Succ
CDH
B
that any PPT
algorithm B solves the CDH problem is defined as
Succ
CDH
B
= Pr[abP B(P, aP, bP)].
The CDH assumption is that for any PPT algorithm
B, Succ
CDH
B
is negligible.
Definition 3 (Modified Decisional Bilinear Diffie–Hell-
man (DBDH-M) problem). Given hP, aP, bP, Ti with
unknown a, b, c 2 Z
q
, decide whether T = a
2
b holds.
The probability of Succ
DBDH-M
B
that any PPT algorithm B
solves the DBDH-M problem is defined as
Succ
DBDH-M
B
=| Pr
h
1 B
P, aP, bP, a
2
P
i
–
Pr[1
B(P, aP, bP, T)] | .
The DBDH-M assumption is that for any PPT algorithm
B, Succ
DBDH-M
B
is negligible.
3. CLC! IBC MULTI-RECEIVER
SIGNCRYPTION
To keep it simple, in this paper, CLC ! IBC indi-
cates that the sender in the CLC transmits a message to
n receivers in the IBC. In this section, we give the for-
mal definition and security models for CLC ! IBC
multi-receiver signcryption scheme.
3.1. Definition for CLC! IBC multi-receiver
signcryption scheme
Definition 3. A CLC! IBC multi-receiver signcryption
scheme is made up of the following five algorithms:
Setup: Taken a security parameter k as input, the
KGC and PKG generate its own master keys and
system parameter paramas, respectively.
CLC-KG: This algorithm generates the private key
for CLC users. Inputting the partial private key D
s
generated by KGC and a secret value x
s
, it returns sk
s
as the private key of the user.
IBC-KG: This algorithm generates the private key
for IBC users. Inputting a user’s identity ID
i
, PKG
computes the corresponding private key S
i
.
Signcrypt: Given a sender’s identity ID
s
, n receivers’
identities L ={ID
1
, ID
2
, , ID
n
} and a message m,
the sender runs the signcryption algorithm to output
a ciphertext .
De-signcrypt: Given a sender’s identity ID
s
, the pri-
vate key S
i
of a receiver and a ciphertext , the
receiver computes De – signcrypt( , S
i
, ID
s
) and out-
puts the plaintext m, or the symbol ?.
3.2. Security models for CLC ! IBC
multi-receiver signcryption scheme
The confidentiality and the unforgeability are required for
a signcryption scheme. The confidentiality is IND-CCA2;
the unforgeability is EUF-CMA. Two types of adversaries
are considered for unforgeability: Type-I adversary mod-
els, a common user, and Type-II adversary models, a
malicious KGC. In addition, our scheme can achieve the
receiver anonymity; it means that each user only knows
if she/he is a true receiver of a ciphertext, whereas she/he
cannot judge if other users are true receivers or not. We
adopt [26] to define the security model that is named
ANON-sID-CCA. The notion of ANON-sID-CCA refers
to [26] for more details. The security models of confiden-
tiality and unforgeability are defined as follows.
3.2.1. Confidentiality.
Definition 4. A CLC! IBC multi-receiver signcryption
scheme is said to be the IND-CCA2 property if no PPT
adversary A has a non-negligible advantage in the follow-
ing game:
Setup: The challenger
B first runs the Setup algorithm.
It sends public parameters params to A, while the mas-
ter keys are kept secret. When B receives params, B
outputs target identities L
=
˚
ID
1
, ID
2
, , ID
n
.
Phase 1: A can ask several kinds of queries:
Key extraction query: When A asks a key
extraction query corresponding to an identity
ID
j
, B executes the IBC-KG algorithm to compute
the private key S
j
.
4576
Security Comm. Networks
2016; 9:4574–4584 © 2016 John Wiley & Sons, Ltd.
DOI: 10.1002/sec