Signcryption KEM/tag-KEM, revisited

We revisit the problem of basing signcryption (SC) (tag) key encapsulation mechanism (KEM) on standard assumptions and standard model and present direct constructions of SC-KEM/tag-KEM, which satisfy confidentiality and unforgeability with respect to adversarially chosen keys where the adversary is given more advantageous attack environment than existing models in the literature; are based on the standard decisional bilinear Diffie-Hellman and computational Diffie-Hellman assumptions without random oracle; do not use strongly unforgeable signature schemes as building blocks; and provide comparable performance to existing SC-KEM/tag-KEM schemes. Both constructions do not require the knowledge about the recipient's private keys to verify the validity of the ciphertexts and thus can be used in applications where a ciphertext needs to be validated by any third party that only knows the public key of the sender as in usual signature scheme.