Signcryption with Non-interactive Non-repudiation

Signcryption [35] is a public key primitive that achieves the functionality of both an encryption scheme and a signature scheme simultaneously. It does this more efficiently than a composition of public key encryption and public key signature. We present a model of security for signcryption schemes that offer non-interactive nonrepudiation. This is non-repudiation in which the judge settling a repudiation dispute does not have to get involved in an interactive zero-knowledge proof. Our model applies to many existing schemes in the literature [5, 23, 30]. We explain why the scheme proposed in [5] is insecure under any definition of privacy based on the idea of indistinguishable encryptions [21]. We describe a modified scheme to overcome the problem. Proofs of security are given for the scheme in the random oracle model [11].