On the Security of Joint Signature and Encryption

  • Authors:
  • Jee Hea An;Yevgeniy Dodis;Tal Rabin

  • Affiliations:
  • -;-;-

  • Venue:
  • EUROCRYPT '02 Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques: Advances in Cryptology
  • Year:
  • 2002

Quantified Score

Hi-index 0.00

Visualization

Abstract

We formally study the notion of a joint signature and encryption in the public-key setting. We refer to this primitive as signcryption, adapting the terminology of [35]. We present two definitions for the security of signcryption depending on whether the adversary is an outsider or a legal user of the system. We then examine generic sequential composition methods of building signcryption from a signature and encryption scheme. Contrary to what recent results in the symmetric setting [5, 22] might lead one to expect, we show that classical "encryptthen-sign" (驴tS) and "sign-then-encrypt" (St驴) methods are both secure composition methods in the public-key setting.We also present a new composition method which we call "commit-thenencrypt-and-sign" (Ct驴&S). Unlike the generic sequential composition methods, Ct驴&S applies the expensive signature and encryption operations in parallel, which could imply a gain in efficiency over the StE and EtS schemes. We also show that the new Ct驴&S method elegantly combines with the recent "hash-sign-switch" technique of [30], leading to efficient on-line/off-line signcryption.Finally and of independent interest, we discuss the definitional inadequacy of the standard notion of chosen ciphertext (CCA2) security. We suggest a natural and very slight relaxation of CCA2-security, which we call generalized CCA2-security (gCCA2). We show that gCCA2-security suffices for all known uses of CCA2-secure encryption, while no longer suffering fromthe definitional shortcomings of the latter.