We consider the following scheme for signcryption, i.e. combined encryption and signing of a message.

The setting is a cyclic group $G$ of prime order $q$ with generator $g$ . Each user has a private key $x\in\mathbb{Z}_{q}$ and a public key $X=g^{x}$ . The system also uses a hash function $H$ and a secret key encryption method $E$ ; $E_{K}$ denotes encryption and $D_{K}$ decryption with key $K$ .

Assume that Alice has private key $x_{A}$ and public key $X_{A}$ and that Bob similarly has keys $x_{B}$ and $X_{B}$ . To encrypt and sign message $m$ for Bob, Alice does the following:

Choose a random integer $z<q$ .
Compute $K=X_{B}^{z}$ .
Compute $c=E_{K}(m)$ .
Compute $r=H(m||X_{A}||X_{B}||K)$ .
If $r+x_{A}=0\in\mathbb{Z}_{q}$ then start again, choosing a new $z$ , otherwise compute $s=z\cdot(r+x_{A})^{-1}\in\mathbb{Z}_{q}^{*}$ .
The signcrypted message is $(c,r,s)$ .

On receipt of $(c,r,s)$ , Bob does the following:

Compute $K=(X_{A}\cdot g^{r})^{s\cdot x_{B}}$ .
Compute $m=D_{K}(c)$ .
If $H(m||X_{A}||X_{B}||K)=r$ , then $m$ is accepted as the message signed by Alice; otherwise the message is rejected.

Motivate in detail why a correctly signcrypted message by Alice will be correctly decrypted and verified by Bob.