On the Security of Joint Signature and Encryption

By Jee Hea An, Yevgeniy Dodis, Tal Rabin. International Conference on the Theory and Application of Cryptographic Techniques, 2002

619 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/833f7d86cfe525413c80fe9973ca0ae9a0bbe68d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Improved Identity-Based Signcryption (2005, methodology): “It is possible to combine encryption schemes and signature schemes, using methods such as those described in [1], to obtain private and authenticated communications.”
Efficient and Provably-Secure Identity-Based Signatures and Signcryption from Bilinear Maps (2005, background): “In both of these definitions, we consider insider attacks [1].”
Identity-Based Signcryption (2002, methodology): “It is possible to combine encryption schemes and signature schemes, using methods such as those described in [2], to obtain private and authenticated communications.”
Security Proofs for Identity-Based Identification and Signature Schemes (2008, background): “The notion of strong unforgeability [2,3,46] (referred to as non-malleability in [46]) would be sufficient for our purposes, but unfortunately the SS schemes in question do not satisfy it.”
Practical Verifiable Encryption and Decryption of Discrete Logarithms (2003, background): “( u,e,v ) is an encryption of some message m with label L , then so is ( u,e, v ). This particular type of malleability [ ADR02 , Sho01] is in fact rather “benign,” and would be acceptable in most applications.”
Unidirectional Chosen-Ciphertext Secure Proxy Re-Encryption (2008, background): “For this reason, we need to tolerate a harmless form of malleability (akin to those accepted as reasonable in [2], [20], and [43]) of ciphertexts at level 1.”
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm (2000, unknown): “An, Dodis, and Rabin [2] analyze generic-composition-based signcryption.”
Certificate-Based Encryption and the Certificate Revocation Problem (2003, background): “We remark, however, that gCCA2 security [2] may be considered preferable, because CCA2 security would technically require Bob to confirm that rPi = Ui for every i, even when k ¿ m.”
Deterministic and Efficiently Searchable Encryption (2007, result): “RSA-DOAEP. Although RSA-DOAEP as a stand-alone is demonstrably PRIV-CCA insecure, when properly combined in an “encrypt-then-sign” fashion with a secure digital signature scheme it achieves CCA security in the natural “outsider security” model analogous to that in [ 5 ].”
Relaxing Chosen-Ciphertext Security (2003, background): “In particular, we establish the relationship between RCCA security and the relaxation of CCA security presented in [19, 24, 1].”
Short Signatures Without Random Oracles and the SDH Assumption in Bilinear Groups (2008, background): “We consider a slightly stronger notion of security, called strong existential unforgeability [1], which is defined using the following game between a challenger and an adversary A:”
Multipurpose Identity-Based Signcryption (A Swiss Army Knife for Identity-Based Cryptography) (2003, methodology): “2, instead of the usual notion of ciphertext unforgeability as studied in the signcryption model of [1].”
Formal Proofs for the Security of Signcryption (2002, background): “We also prove the unforgeability of signcryption in a strong sense, namely existential unforgeability against adaptive chosen message attack.”
Public Key Broadcast Encryption for Stateless Receivers (2002, background): “Even though it seems hard to extend the Subset-Cover framework to achieve CCA2-security, it is possible to achieve a slightly relaxed (but essentially as useful) notion of gCCA2-security recently proposed by [20, 1].”