Constructing strong identity-based designated verifier signatures with self-unverifiability

An identity-based strong designated verifier signature scheme provides restricted verifiability only for a verifier designated by a signer and proper privacy for the signer. In this paper, we show that strong designated verifier signature schemes do not satisfy the self-unverifiability requirement in the sense that not only exposure of the verifier's secret key but also of the signer's secret key enables an attacker to verify signatures, which should have been the exclusive right of the verifier. We also present a generic method to construct a strong identitybased designated verifier signature scheme with selfunverifiability from identity-based key encapsulation and identity-based key sharing schemes. We prove that a scheme constructed from our method achieves unforgeability, non-transferability, and self-unverifiability if the two underlying components are secure. To show the advantage of our method, we present an example that outputs short signatures and we analyze its performance.