A RSA and Discrete Logarithm Based Signature and Encryption 42

Secure and authenticated message delivery/storage is one of the major aims of computer and communication security research. The current standard method to achieve this aim is \(digital) signature followed by encryption". In this paper, we address a question on the cost of secure and authenticated message delivery/storage, namely, whether it is possible to transport/store messages of varying length in a secure and authenticated way with an expense less than that required by \signature followed by encryption". This question has apparently never been addressed in the literature since the invention of public key cryptography. We then present a positive answer to the question. In particular, we discover a new cryptographic primitive termed as \signcryption" which simultaneously ful lls both the functions of digital signature and public key encryption in a logically single step, and with a cost signi cantly smaller than that required by \signature followed by encryption". For typical security parameters for high level security applications (size of public moduli = 1536 bits), signcryption costs 58% (50%, respectively) less in computation time and 85% (91%, respectively) less in message expansion than does \signature followed by encryption" based on the discrete logarithm problem (factorization problem, respectively). The saving in cost brought to society by this new technology is potentially huge, especially in the emerging era of electronic commerce in which the assurance of secure and authenticated transactions and communications is a key to its success as well as public acceptance.