Abstract:By combining the two notations of ring signature and authenticated encryption to- gether, we introduce a new type of authenticated encryption signature, called ring authenticated encryp- tion, which has the following properties: signer-ambiguity, signer-verifiability, recipient-designation, semantic-security, verification-convertibility, verification-dependence and recipient-ambiguity. We also give a variant that does not hold the property of recipient-ambiguity but can make a verifier know to whom a signature is sent when he checks its validity. Horster et al. (7) first proposed an authenticated en- cryption scheme modified from Nyberg-Ruepple's mes- sage signature (12), which aimed to achieve the purpose that the signature can only be verified by some specified recipients while keeping the message secret from the public. Compared with the straightforward approach employing the encryption and the signature schemes for a message, respectively, authenticated schemes require smaller bandwidth of communications to achieve pri- vacy, integrity and anthentication of information. How- ever, Horster et al.'s authenticated encryption scheme has a weakness that no one except the specified recip- ient can be convinced of the signer's signature, so it cannot make the recipient prove the dishonesty of the signer to any verifier without releasing his secret if the signer wants to repudiate his signature. To protect the recipient in case that the signer would repudiate his signature, Araki et al. (2) proposed a convertible lim- ited verifier scheme to enable the recipient to convert the signature to an ordinary one so that any verifier can verify its validity. But it needs the cooperation of the signer when the recipient converts the signature, which is obviously a weakness under the situation that the signer is unwilling to cooperate. To overcome this weakness, Wu et al. (15) proposed another convert- ible authenticated encryption scheme. During which, the recipient can easily produce the ordinary signature without the cooperation of the signer, and he can re- veal the converted signature and then any verifier can prove the dishonesty of the signer, if the signer wants to repudiate his signature. Recently, Huang et al. (8) showed that the scheme of Wu et al. does not consider that once an intruder knows the message then he can also easily convert a signature into an ordinary one,

Analysis and Improvement of Authenticatable Ring Signcryption Scheme.

Efficient Secret Authenticatable Anonymous Signcryption Scheme with Identity Privacy

An Efficient Identity-Based Ring Signcryption Scheme without Random Oracles

An Efficient Signcryption Scheme with Key Privacy and Its Extension to Ring Signcryption*

A Provably Secure Ring Signature Scheme in Certificateless Cryptography

Improvement of Provably Secure Self-Certified Proxy Convertible Authenticated Encryption Scheme

Analysis and improvement of a signcryption scheme with key privacy

Ring Authenticated Encryption: A New Type of Authenticated Encryption

An Improved Lattice-Based Ring Signature with Unclaimable Anonymity in the Standard Model

Schnorr Ring Signature Scheme with Designated Verifiability

Cryptanalysis and Improvement of an Efficient ID-based Certificateless Signature Scheme

An Efficient Signcryption Scheme With Key Privacy

Security Flaw of an ECC-based Signcryption Scheme with Anonymity.

ID-Based Ring Signature against Continual Side Channel Attack

2 The Definition and Security Models of Signcryption with Key Privacy

The Ring Authenticated Encryption Scheme - How to Provide A Clue Wisely

Identity-Concealed Authenticated Encryption from Ring Learning with Errors

Lattice-based deniable ring signatures

Provable Secure Identity Based Generalized Signcryption Scheme

An Advanced Quantum-Resistant Signature Scheme for Cloud Based on Eisenstein Ring

Anti-Quantum Lattice-Based Ring Signature Scheme and Applications in VANETs