3. Analysis of StE

StE consists, in case of confirmer signatures, in first signing the message, then encrypting the resulting signature. In case of signcryption, the encryption is conducted on both the message and the produced signature. The construction was first formally (The idea without proof was already known, for instance, it was mentioned in Damgård and Pedersen (New convertible undeniable signature schemes. In: Maurer UM (ed) Advances in cryptology - EUROCRYPT’96. LNCS, vol 1070. Springer, Heidelberg, pp 372–386, 1996).) described for confirmer signatures in Camenisch and Michels (Confirmer signature schemes secure against adaptative adversaries. In: Preneel B (ed) Advances in cryptology - EUROCRYPT 2000. LNCS, vol 1807. Springer, Heidelberg, pp 243–258, 2000), and it suffered the resort to concurrent zero-knowledge (ZK) proofs of general NP statements in the confirmation/denial protocol (i.e. proving knowledge of the decryption of a ciphertext, and that this decryption forms a valid signature on the given message). In this chapter, we analyze the exact security of StE; i.e. we specify the necessary and sufficient assumptions on the components that lead to secure constructions. We examine, on the way, the conjectured security of a celebrated confirmer signature derived from StE, which was left as open problem for more than a decade. Although the results are all stated for confirmer signatures, they can be straightforwardly extended to the signcryption case.