一种有效的可转换的认证加密方案

针对一般的认证加密方案存在着当签名者否认签名时，接收者不能使任何验证者证实签名者的诚实性等问题，提出了一种有效的解决方案。该方案与已有的认证加密方案和传统的签名-加密方案相比具有低计算复杂度和低通信代价。并且在该方案中，如果签名者否认自己的签名，接收者在不需签名者的合作下就可将认证加密方案转换为一般签名方案。更重要的是在不暴露消息明文的情况下，任何验证者都可验证签名的有效性。

Most previous authenticated encryption schemes have a problem that the recipient can not prove the dishonesty to any verifier if the signer denies his signatures. An efficient solving scheme has been presented in this paper. The new scheme requires less computational costs and lower communication than other previous convertible authenticated encryption schemes and the conventional signature-then-encryption approaches. In the proposed scheme, if the signer repudiates the signature, the recipient can convert this signature into an ordinary one without the cooperation of the signer. Furthermore, the message is not disclosed to any verifier during verification.