{ "id": "ep5as04g3p", "slug": "signcryption", "title": "Signcryption", "updated": "2026-10-15", "topic_path": [ { "id": "technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/topics/technology" }, { "id": "technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing" }, { "id": "technology.computing.networks", "label": "Networks and security", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.networks" }, { "id": "technology.computing.networks.alpha-mo-to-z", "label": "Titles Mo to Z", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.networks.alpha-mo-to-z" } ], "geo": [ { "id": "geo.nongeo.t1946.technology.computing.networks", "label": "Non-geographic · 1946 to 2000: Networks and security", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing.networks", "path": [ { "id": "geo.nongeo", "label": "Non-geographic", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo" }, { "id": "geo.nongeo.t1946", "label": "Non-geographic · 1946 to 2000", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946" }, { "id": "geo.nongeo.t1946.technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology" }, { "id": "geo.nongeo.t1946.technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing" }, { "id": "geo.nongeo.t1946.technology.computing.networks", "label": "Networks and security", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing.networks" } ] } ], "excerpt": "Signcryption is a public-key cryptographic method that performs digital signature and encryption in a single logical step, introduced by Yuliang Zheng in 1997 and cheaper than signing and encrypting separately.", "snippet": "Signcryption is a public-key cryptographic method that performs digital signature and encryption in a single logical step, introduced by Yuliang Zheng in 1997 and cheaper than signing and encrypting separately.", "node": "technology.computing.networks.alpha-mo-to-z", "markdown": "# Signcryption\n\nSigncryption is a public-key cryptographic method that performs digital signature and encryption on a message in a single logical step, providing confidentiality, integrity, and authentication at a cost lower than signing and then encrypting separately.[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) A sender produces a signcrypted text from a message; the recipient, holding the appropriate private key, recovers the message unambiguously and verifies who sent it and that it was not altered en route.[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) • [2](https://link.springer.com/book/10.1007/978-3-540-89411-7) The primitive was introduced by Yuliang Zheng in 1997.[3](https://www.mdpi.com/2078-2489/8/2/58)\n\n| Key fact | Value |\n|---|---|\n| Security goals in one pass | Confidentiality, unforgeability, authentication; non-repudiation optional[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) • [4](https://cs.nyu.edu/%7Edodis/ps/signcrypt-survey.pdf) |\n| Dominant computation | Approximately one exponentiation in the underlying subgroup, shared between signature and encryption[5](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf) |\n| Communication saving (Zheng's parameters) | \\|KH()\\| + \\|q\\| bits versus \\|hash()\\| + \\|q\\| + \\|p\\| bits; 70.3% saving with 72-, 144-, and 512-bit parameters[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) |\n| Computation saving (1536-bit moduli) | 58% less computation time and 85% less message expansion than discrete-log signature-then-encryption[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) |\n| Elliptic-curve setting | 58% saving in computational cost and 40% in communication cost versus signature-then-encryption[6](https://www.sciencedirect.com/science/article/abs/pii/S0020019098001677) |\n| Formal security proof | About ten years after introduction, by Baek, Steinfeld, and Zheng[7](https://crypto.ethz.ch/publications/files/BBM18.pdf) |\n| Standardization | An ISO/IEC standard defines signcryption mechanisms with data confidentiality and data integrity objectives[8](https://www.en-standard.eu/publicdoc/iec_previews/90781.pdf) |\n\n## How it works\n\nThe efficiency gain comes from sharing one exponentiation between the signature and the encryption. In a discrete-log setting, both a Schnorr-type signature and an ElGamal-type encryption would normally each require the sender to compute a fresh modular exponentiation of a random value. Signcryption computes that random value once and reuses it in both roles: the same exponent generates the symmetric encryption key and the signature challenge. The result is that the dominant computational cost in both signcryption and unsigncryption is approximately a single exponentiation in the underlying subgroup, at least twice as efficient as a generic composition of discrete-log-based signature and encryption schemes.[5](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf)\n\nA generic signcryption scheme SCR consists of five algorithms (GC, GKA, GKB, SC, USC): common parameter generation, sender key-pair generation, receiver key-pair generation, signcryption, and unsigncryption.[5](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf) Security is defined by two properties: indistinguishability against adaptive chosen-ciphertext attacks (confidentiality) and unforgeability against chosen-message attacks, in a multi-user setting.[9](https://eprint.iacr.org/2013/230.pdf) An, Dodis, and Rabin distinguished two adversary models: an outsider must compromise communication between two honest users whose keys he does not know, while insider security protects a user even against a malicious partner, so that without a user's key no one can forge signcryptexts from that user to any recipient, even knowing the recipient's secret key.[10](https://iacr.org/archive/eurocrypt2002/23320080/adr.pdf) Insider security is stronger but is not always wanted: applications that support message repudiation typically do not want it.[4](https://cs.nyu.edu/%7Edodis/ps/signcrypt-survey.pdf) Libert and Quisquater additionally formalized ciphertext anonymity (key privacy) and the notion of key invisibility, which implies ciphertext anonymity when ciphertexts are uniformly distributed for random recipients' public keys.[9](https://eprint.iacr.org/2013/230.pdf)\n\nZheng's original analysis quantified the savings against Schnorr-signature-then-ElGamal-encryption: communication overhead falls from \\( |\\mathrm{hash}()| + |q| + |p| \\) bits to \\( |\\mathrm{KH}()| + |q| \\) bits, a saving of \\( |p| \\) bits, which is 70.3% when \\( |\\mathrm{KH}()| = |\\mathrm{hash}()| = 72 \\), \\( |q| = 144 \\), and \\( |p| = 512 \\); the saving grows with the size of \\( p \\).[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) With 1536-bit public moduli, signcryption costs 58% less in computation time and 85% less in message expansion than discrete-log-based signature-then-encryption.[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) On elliptic curves, the corresponding savings are 58% in computational cost and 40% in communication cost.[6](https://www.sciencedirect.com/science/article/abs/pii/S0020019098001677)\n\n## How it is done\n\nIn Zheng's SCS scheme, the sender Alice signcrypts a message m for Bob as follows.[11](https://cpb-us-w2.wpmucdn.com/sites.uab.edu/dist/5/110/files/2020/02/yz-sc-p1363a-98-3parts-Copy-2.pdf)\n\n1. Pick x uniformly at random from [1, ..., q − 1] and compute k = hash(y_B^x mod p), where y_B is Bob's public key; split k into k1 and k2 of appropriate length.\n2. Set \\( r = \\mathrm{KH}_{k_2}(m, \\mathrm{bind\\_info}) \\), where bind_info contains data identifying Bob, such as his public key or public-key certificate, and may also contain Alice's public key.\n3. Compute s = x/(r + x_A) mod q if SDSS1 is used, or s = x/(1 + x_A · r) mod q if SDSS2 is used, with x_A Alice's private key.\n4. Encrypt the message: \\( c = E_{k_1}(m) \\).\n5. Send the signcrypted text (c, r, s) to Bob.\n\nUnsigncryption reverses the process: Bob recomputes \\( \\omega = (y_A g^{r})^{s} \\) from Alice's public key \\( y_A \\), derives \\( K = \\omega^{x_B} \\) with his private key \\( x_B \\), recovers the symmetric key, and verifies that \\( H(m, y_A, y_B, K) = r \\).[5](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf) For multiple recipients, the variants SCS1M and SCS2M reduce the sender's modular exponentiations from \\( 2t + 1 \\) to \\( t \\) (a saving of more than 50%) and each recipient's from 2.17 to 1.17 on average, assuming Shamir's trick for evaluating products of exponentials.[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf)\n\n## Origin\n\nYuliang Zheng introduced signcryption in 1997 in the paper \"Digital Signcryption or How to Achieve Cost(Signature & Encryption) << Cost(Signature) + Cost(Encryption)\", together with the SCS1, SCS2, and multiple-recipient SCS1M/SCS2M schemes.[3](https://www.mdpi.com/2078-2489/8/2/58) • [1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) In 1998 he submitted the schemes, with the related SDSS1/SDSS2 shortened digital signatures and compact key-agreement schemes, to the IEEE P1363a standards process.[11](https://cpb-us-w2.wpmucdn.com/sites.uab.edu/dist/5/110/files/2020/02/yz-sc-p1363a-98-3parts-Copy-2.pdf) Zheng provided no formal security proof, as no security model was available at the time; Baek, Steinfeld, and Zheng later formalized a model and proved the original scheme secure in it.[12](https://www.degruyterbrill.com/document/doi/10.1515/jmc-2015-0060/html) That proof, published roughly a decade after introduction, shows multi-user outsider confidentiality under the Gap Diffie–Hellman assumption (hard mathematical problem underpinning the scheme's security proof) and multi-user insider unforgeability under a Gap version of the [discrete logarithm](https://www.edgepedia.org/discrete-logarithm) problem, both in the random oracle model.[5](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf) • [7](https://crypto.ethz.ch/publications/files/BBM18.pdf) An, Dodis, and Rabin's 2002 insider/outsider definitions became the de facto standard security setting for modern public-key signcryption schemes.[10](https://iacr.org/archive/eurocrypt2002/23320080/adr.pdf) • [9](https://eprint.iacr.org/2013/230.pdf)\n\n## Variants\n\nA survey classification groups signcryption schemes into six categories: attribute-based, identity-based, PKI-based, certificateless, certificate-based, and heterogeneous signcryption.[13](https://www.mdpi.com/1424-8220/22/3/1072) Identity-based (ID-based) signcryption from bilinear pairings was given with a security model covering privacy and unforgeability; Libert and Quisquater then showed that scheme does not provide semantic security because the signature is visible in the ciphertext, and built ID-based schemes in which forward security and public verifiability are mutually exclusive.[3](https://www.mdpi.com/2078-2489/8/2/58) ID-based signcryption with both public verifiability and forward security has been constructed, and Boyen proposed one adding ciphertext unlinkability and anonymity.[3](https://www.mdpi.com/2078-2489/8/2/58) Multi-receiver ID-based signcryption and ID-based broadcast signcryption are variants of ID-based signcryption.[3](https://www.mdpi.com/2078-2489/8/2/58) Certificateless signcryption in the standard model was proposed by Zhenhua Liu, Yupu Hu, Xiangsong Zhang, and Hua Ma in 2009;[14](https://doi.org/10.1016/j.ins.2009.10.011) Weng et al. showed that Liu et al.'s scheme is neither semantically secure against chosen-ciphertext attacks nor existentially unforgeable against chosen-message attacks.[3](https://www.mdpi.com/2078-2489/8/2/58) A ring signcryption approach for wireless body area networks uses an attribute-based cryptosystem resting on bilinear-pairing assumptions.[13](https://www.mdpi.com/1424-8220/22/3/1072) Broader surveys also list hybrid, KEM-DEM-based, verifiable, functional, and key-invisible variants.[7](https://crypto.ethz.ch/publications/files/BBM18.pdf)\n\nPost-quantum variants have followed. Lattice-based signcryption schemes achieve IND-CCA2 and eUF-CMA security, and can be provable in the standard model using an efficient trapdoor.[15](https://www.jucs.org/jucs_25_3/an_identity_based_signcryption/jucs_25_03_0282_0293_wang.pdf) Isogeny-based post-quantum signcryption has also been proposed, enabling a party to simultaneously perform the functions of digital signature and encryption.[16](https://www.sciencedirect.com/science/article/pii/S2214212622001387) The PQES scheme defines ciphertext, keys, and core operations over scalar integers modulo n, avoiding high-dimensional lattices or ring-based constructions to reduce overhead on constrained devices; its security rests on relatively new assumptions that the authors state may benefit from further cryptanalytic scrutiny, and it does not yet support broadcast or multi-recipient encryption.[17](https://pmc.ncbi.nlm.nih.gov/articles/PMC12349534/)\n\n## Applications\n\nZheng described the schemes as compact and particularly suitable for smart-card applications, with envisaged uses in digital cash payment systems, EDI, and personal health cards.[1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) Because of its lower cost, signcryption is considered far more appropriate than sign-then-encrypt for resource-constrained scenarios such as wireless body area networks, where onboard energy and CPU capability are limited.[13](https://www.mdpi.com/1424-8220/22/3/1072) Empirical work on resource-constrained IoT devices likewise recommends signcryption when performance is paramount, since it runs faster while using fewer resources.[18](https://essay.utwente.nl/fileshare/file/91781/Molenaar_BA_EEMCS.pdf)\n\n## Limitations and alternatives\n\nNon-repudiation is an optional feature: some schemes support it, others do not, and others explicitly avoid it, for example when confidential information should not be provable by the recipient to third parties.[4](https://cs.nyu.edu/%7Edodis/ps/signcrypt-survey.pdf) Where it is needed, a protocol with a third party, such as a zero-knowledge proof of signcryptext validity that does not compromise the receiver's secret key, can supply it.[5](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf) Identity-based variants suffer key escrow because a trusted authority holds users' keys, certificateless solutions are hampered by the distribution of partial keys, and certificate-based cryptography is unsuitable for large numbers of users.[13](https://www.mdpi.com/1424-8220/22/3/1072) Reviews also report a trade-off between the security attributes a scheme provides (confidentiality, unforgeability, integrity, authentication, [non-repudiation](https://www.edgepedia.org/non-repudiation), forward secrecy, public verifiability) and its computational cost, with some schemes missing required attributes.[19](https://www.enggjournals.com/ijet/docs/IJET17-09-02-173.pdf)\n\nThe nearest alternatives are the generic compositions. An, Dodis, and Rabin analyzed Encrypt-then-Sign (EtS), Sign-then-Encrypt (StE), and Commit-then-Encrypt-and-Sign (CtE&S); StE preserves UF-CMA and IND-CCA security in insider models, EtS preserves sUF-CMA and IND-gCCA, and CtE&S preserves only the weaker UF-CMA and IND-gCCA but runs fastest because its encryption and signature modules execute in parallel.[10](https://iacr.org/archive/eurocrypt2002/23320080/adr.pdf) • [12](https://www.degruyterbrill.com/document/doi/10.1515/jmc-2015-0060/html) On the practical side, an implementation survey notes there are no implementations of signcryption in standard cryptographic libraries, recommending ECC-based signcryption or sign-then-encrypt for constrained devices.[18](https://essay.utwente.nl/fileshare/file/91781/Molenaar_BA_EEMCS.pdf) That same implementation found signcryption has higher communication overhead than sign-then-encrypt, because it transmits the symmetrically encrypted message plus two large integers while sign-then-encrypt transmits only two integers; this contrasts with Zheng's original analysis, which reported a communication saving.[18](https://essay.utwente.nl/fileshare/file/91781/Molenaar_BA_EEMCS.pdf) • [1](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf) An ISO/IEC standard does define signcryption mechanisms as ways of processing a data string with the security objectives of data confidentiality and data integrity, referencing ISO/IEC 11770-1 and ISO/IEC 9594.[8](https://www.en-standard.eu/publicdoc/iec_previews/90781.pdf)\n\n## References\n\n1. [Signcryption and Its Applications in Efficient Public Key Solutions (ISW '97), with excerpts from the journal/CRYPTO'97 versions of the same work](https://bpb-us-w2.wpmucdn.com/sites.uab.edu/dist/a/68/files/2020/01/isw97sc.pdf)\n2. [Practical Signcryption (Springer edited volume)](https://link.springer.com/book/10.1007/978-3-540-89411-7)\n3. [A Novel Identity-Based Signcryption Scheme in the Standard Model (Information, MDPI)](https://www.mdpi.com/2078-2489/8/2/58)\n4. [Signcryption (Short Survey)](https://cs.nyu.edu/%7Edodis/ps/signcrypt-survey.pdf)\n5. [Design of Provable Secure Signcryption Schemes (Baek, Steinfeld, Zheng, Designs, Codes and Cryptography)](https://link.springer.com/content/pdf/10.1007/s00145-007-0211-0.pdf)\n6. [How to construct efficient signcryption schemes on elliptic curves (Information Processing Letters, Elsevier)](https://www.sciencedirect.com/science/article/abs/pii/S0020019098001677)\n7. [A Constructive Perspective on Signcryption Security (full version, SCN 2018)](https://crypto.ethz.ch/publications/files/BBM18.pdf)\n8. [ISO/IEC standard preview (signcryption mechanisms)](https://www.en-standard.eu/publicdoc/iec_previews/90781.pdf)\n9. [Relations among Privacy Notions for Signcryption and Key Invisible 'Sign-then-Encrypt'](https://eprint.iacr.org/2013/230.pdf)\n10. [On the Security of Joint Signature and Encryption (An, Dodis, Rabin, EUROCRYPT 2002)](https://iacr.org/archive/eurocrypt2002/23320080/adr.pdf)\n11. [Shortened Digital Signature, Signcryption and Compact and Unforgeable Key Agreement Schemes (IEEE P1363a contribution, 1998)](https://cpb-us-w2.wpmucdn.com/sites.uab.edu/dist/5/110/files/2020/02/yz-sc-p1363a-98-3parts-Copy-2.pdf)\n12. [On the security of joint signature and encryption revisited (Journal of Mathematical Cryptology, De Gruyter)](https://www.degruyterbrill.com/document/doi/10.1515/jmc-2015-0060/html)\n13. [A Comprehensive Survey on Signcryption Security Mechanisms in Wireless Body Area Networks (Sensors, MDPI, 2022)](https://www.mdpi.com/1424-8220/22/3/1072)\n14. [Zhenhua Liu and colleagues (2009). Certificateless signcryption scheme in the standard model. Information Sciences.](https://doi.org/10.1016/j.ins.2009.10.011)\n15. [An Identity-Based Signcryption on Lattice without Trapdoor (JUCS, 2019)](https://www.jucs.org/jucs_25_3/an_identity_based_signcryption/jucs_25_03_0282_0293_wang.pdf)\n16. [A post-quantum signcryption scheme using isogeny based cryptography](https://www.sciencedirect.com/science/article/pii/S2214212622001387)\n17. [A Post-Quantum Public-Key Signcryption Scheme over Scalar Integers Based on a Modified LWE Structure (PQES, 2025)](https://pmc.ncbi.nlm.nih.gov/articles/PMC12349534/)\n18. [Real-world performance analysis of signcryption and sign-then-encrypt schemes for resource-constrained IoT devices (UT Twente thesis)](https://essay.utwente.nl/fileshare/file/91781/Molenaar_BA_EEMCS.pdf)\n19. [Performance Comparison of Signcryption Schemes – A Step towards Designing Lightweight Cryptographic Mechanism (IJET)](https://www.enggjournals.com/ijet/docs/IJET17-09-02-173.pdf)\n\n---\n*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Networks and security › Titles Mo to Z*\n\n*Initially written Sep 29, 2026 · Edited: Oct 15, 2026*\n\n*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*\n\nLicense: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license\n", "same_as": [], "url": "https://www.edgepedia.org/signcryption", "markdown_url": "https://www.edgepedia.org/signcryption.md", "license": { "name": "Edgepedia Community License 1.0", "url": "https://www.edgepedia.org/edgepedia/license", "summary": "Free with credit, commercial use included. AI training is open to everyone. For other uses, organizations over USD 100M in revenue or 100M monthly users license separately.", "spdx": "LicenseRef-Edgepedia-Community-1.0" }, "credit": "\"Signcryption\", Edgepedia (EdgeChat), https://www.edgepedia.org/signcryption. Edgepedia Community License 1.0.", "credit_md": "\"[Signcryption](https://www.edgepedia.org/signcryption)\", Edgepedia (EdgeChat), [https://www.edgepedia.org/signcryption](https://www.edgepedia.org/signcryption). [Edgepedia Community License 1.0](https://www.edgepedia.org/edgepedia/license).", "credit_html": "\"Signcryption\", Edgepedia (EdgeChat), https://www.edgepedia.org/signcryption. Edgepedia Community License 1.0.", "speakable": "Signcryption is a public-key cryptographic method that performs digital signature and encryption in a single logical step, introduced by Yuliang Zheng in 1997 and cheaper than signing and encrypting separately." }