Abstract:By combining the two notations of ring signature and authenticated encryption to- gether, we introduce a new type of authenticated encryption signature, called ring authenticated encryp- tion, which has the following properties: signer-ambiguity, signer-verifiability, recipient-designation, semantic-security, verification-convertibility, verification-dependence and recipient-ambiguity. We also give a variant that does not hold the property of recipient-ambiguity but can make a verifier know to whom a signature is sent when he checks its validity. Horster et al. (7) first proposed an authenticated en- cryption scheme modified from Nyberg-Ruepple's mes- sage signature (12), which aimed to achieve the purpose that the signature can only be verified by some specified recipients while keeping the message secret from the public. Compared with the straightforward approach employing the encryption and the signature schemes for a message, respectively, authenticated schemes require smaller bandwidth of communications to achieve pri- vacy, integrity and anthentication of information. How- ever, Horster et al.'s authenticated encryption scheme has a weakness that no one except the specified recip- ient can be convinced of the signer's signature, so it cannot make the recipient prove the dishonesty of the signer to any verifier without releasing his secret if the signer wants to repudiate his signature. To protect the recipient in case that the signer would repudiate his signature, Araki et al. (2) proposed a convertible lim- ited verifier scheme to enable the recipient to convert the signature to an ordinary one so that any verifier can verify its validity. But it needs the cooperation of the signer when the recipient converts the signature, which is obviously a weakness under the situation that the signer is unwilling to cooperate. To overcome this weakness, Wu et al. (15) proposed another convert- ible authenticated encryption scheme. During which, the recipient can easily produce the ordinary signature without the cooperation of the signer, and he can re- veal the converted signature and then any verifier can prove the dishonesty of the signer, if the signer wants to repudiate his signature. Recently, Huang et al. (8) showed that the scheme of Wu et al. does not consider that once an intruder knows the message then he can also easily convert a signature into an ordinary one,

Efficient Secret Authenticatable Anonymous Signcryption Scheme with Identity Privacy

An Efficient Identity-Based Ring Signcryption Scheme without Random Oracles

An Efficient Signcryption Scheme with Key Privacy and Its Extension to Ring Signcryption*

An Efficient Signcryption Scheme With Key Privacy

Fully Anonymous Identity-Based Broadcast Signcryption with Public Verification

Efficient Anonymous Certificate-Based Multi- Message and Multi-Receiver Signcryption Scheme for Healthcare Internet of Things.

An Efficient Delegation-Based Anonymous Authentication Protocol

Analysis and improvement of a signcryption scheme with key privacy

2 The Definition and Security Models of Signcryption with Key Privacy

Anonymous Signature Schemes

Assertions Signcryption Scheme in Decentralized Autonomous Trust Environments

Ring Authenticated Encryption: A New Type of Authenticated Encryption

Security Flaw of an ECC-based Signcryption Scheme with Anonymity.

A Provably Secure Ring Signature Scheme in Certificateless Cryptography

Schnorr Ring Signature Scheme with Designated Verifiability

Identity-Based Signcryption from Lattices

An Efficient Certificateless Anonymous Signcryption Scheme for WBAN

Identity-Based Proxy Signcryption Schemes

Provable Secure Identity Based Generalized Signcryption Scheme

Identity-based Authenticated Encryption with Identity Confidentiality

The Ring Authenticated Encryption Scheme - How to Provide A Clue Wisely