Efficient certificate‐based aggregate signature scheme for vehicular <i>ad hoc</i> networks

IET NetworksVolume 9, Issue 6 p. 290-297 Special Issue: Intelligent Computing: a Promising Network Computing ParadigmFree Access Efficient certificate-based aggregate signature scheme for vehicular ad hoc networks Jian-Neng Chen, Jian-Neng Chen Key Laboratory of Data Science and Intelligence Application, Zhangzhou, 363000 People's Republic of China Lab of Granular Computing, Minnan Normal University, Zhangzhou, 363000 People's Republic of ChinaSearch for more papers by this authorZhen-Jie Huang, Zhen-Jie Huang Key Laboratory of Data Science and Intelligence Application, Zhangzhou, 363000 People's Republic of China Lab of Granular Computing, Minnan Normal University, Zhangzhou, 363000 People's Republic of ChinaSearch for more papers by this authorYu-Ping Zhou, Yu-Ping Zhou Key Laboratory of Data Science and Intelligence Application, Zhangzhou, 363000 People's Republic of China Lab of Granular Computing, Minnan Normal University, Zhangzhou, 363000 People's Republic of ChinaSearch for more papers by this authorFu-Min Zou, Fu-Min Zou Fujian Key Laboratory of Automotive Electronics and Electric Drive, Fuzhou, 350008 People's Republic of China Fujian Provincial Key Laboratory of Big Data Mining and Applications, Fujian University of Technology, No. 3, Xueyuan Road, University Town, Minhou, People's Republic of China National Demonstration Center for Experimental Electronic Information and Electrical Technology Education, Fujian University of Technology, Fuzhou, 350008 People's Republic of ChinaSearch for more papers by this authorChien-Ming Chen, Chien-Ming Chen College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao, 266590 People's Republic of ChinaSearch for more papers by this authorJimmy Ming-Tai Wu, Jimmy Ming-Tai Wu College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao, 266590 People's Republic of ChinaSearch for more papers by this authorTsu-Yang Wu, Corresponding Author Tsu-Yang Wu wutsuyang@gmail.com orcid.org/0000-0001-8970-2452 College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao, 266590 People's Republic of ChinaSearch for more papers by this author Jian-Neng Chen, Jian-Neng Chen Key Laboratory of Data Science and Intelligence Application, Zhangzhou, 363000 People's Republic of China Lab of Granular Computing, Minnan Normal University, Zhangzhou, 363000 People's Republic of ChinaSearch for more papers by this authorZhen-Jie Huang, Zhen-Jie Huang Key Laboratory of Data Science and Intelligence Application, Zhangzhou, 363000 People's Republic of China Lab of Granular Computing, Minnan Normal University, Zhangzhou, 363000 People's Republic of ChinaSearch for more papers by this authorYu-Ping Zhou, Yu-Ping Zhou Key Laboratory of Data Science and Intelligence Application, Zhangzhou, 363000 People's Republic of China Lab of Granular Computing, Minnan Normal University, Zhangzhou, 363000 People's Republic of ChinaSearch for more papers by this authorFu-Min Zou, Fu-Min Zou Fujian Key Laboratory of Automotive Electronics and Electric Drive, Fuzhou, 350008 People's Republic of China Fujian Provincial Key Laboratory of Big Data Mining and Applications, Fujian University of Technology, No. 3, Xueyuan Road, University Town, Minhou, People's Republic of China National Demonstration Center for Experimental Electronic Information and Electrical Technology Education, Fujian University of Technology, Fuzhou, 350008 People's Republic of ChinaSearch for more papers by this authorChien-Ming Chen, Chien-Ming Chen College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao, 266590 People's Republic of ChinaSearch for more papers by this authorJimmy Ming-Tai Wu, Jimmy Ming-Tai Wu College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao, 266590 People's Republic of ChinaSearch for more papers by this authorTsu-Yang Wu, Corresponding Author Tsu-Yang Wu wutsuyang@gmail.com orcid.org/0000-0001-8970-2452 College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao, 266590 People's Republic of ChinaSearch for more papers by this author First published: 13 October 2020 https://doi.org/10.1049/iet-net.2020.0019Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract As vehicle speed is fast and on board units' (OBUs) computing power, storage space, bandwidth and other resources are very limited, the efficiency of message transmission in vehicular ad hoc network is of great concern. Certificate-based aggregate signature scheme provides a way to combine numerous signatures into one short signature. The authors propose a certificate-based aggregate signature scheme for vehicular ad hoc networks. In this study, the authors prove that the proposed scheme is secure against forgery attack in the random oracle model and under the computational Diffie–Hellman problem. It is efficient and suitable for vehicular ad hoc networks. 1 Introduction A vehicular ad hoc network (VANET) is a kind of mobile wireless ad hoc network [1 ]. A complete VANET includes authority center, roadside units (RSUs) and on board units (OBUs). Nowadays, it has become one of the key technologies for smart traffic. In accordance with the dedicated short-range communication (DSRC [2 ]) protocol, each vehicle in the vehicle network must broadcast traffic information to other vehicles and RSU, and receive service messages sent by the RSU every 100–300 ms. The calculation and communication costs are very large. As the vehicle network is an open network, the vehicle speed is fast and computing power, storage space and bandwidth are very limited, it is very important to improve the efficiency of signature and verification on the basis of ensuring the communication security. To ensure the integrity, authenticity and real-time of messages is the research focus of vehicle ad hoc network. In addition, the privacy of users in vehicle ad hoc network needs to be protected. In general, the owner of sensitive information does not want to be maliciously analysed and tracked. However, in the event of a traffic accident or a car owner's crime, Road and Transport Authority need to have information about the relevant vehicle. Digital signature can provide integrity, authenticity and unforgeability of messages [3 –8 ]. Aggregate signature provides a way to transmit and verify multiple signatures [9 ]. In the aggregate signature scheme, n different messages are signed by n different signers, and then the n signature results are integrated into one aggregate signature. The verification of multiple signatures can be completed at one time, which greatly reduces the communication overhead and the storage space caused by the verification process. Hence, it has good real-time performance. Therefore, using aggregate signature in vehicle ad hoc network can greatly reduce the computation cost and improve the communication efficiency. In Eurocrypto 2003, Boneh et al. [10 ] came up with the concept of aggregate signature. Since then, authors have proposed a number of identity-based and certificateless aggregate signature schemes [11, 12 ]. In addition some of them are used to improve the transmission efficiency and security of various attribute networks [13 –15 ]. In 2009, Liu et al. [16 ] first gave the concept of certificate-based aggregate signature (CBAS) and constructed a certificate-based sequential aggregation signature scheme, but the signature scheme was inefficient. In the 2015, Horng et al. [17 ] proposed a certificateless aggregate signature for VANETs, which can achieve conditional privacy preservation. The signatures were aggregated by the RSUs, so the efficiency of the aggregator was not considered carefully in the scheme. Some recent studies try to construct aggregate signatures with special properties [18, 19 ]. In the study, we introduced an efficient CBAS scheme for VANETs, which have many nodes and the network topology changes rapidly. In our signature scheme, the vehicle generates a pseudonym through RSU, and communicates with surrounding vehicles using pseudonym. If necessary, the real identity of the vehicle owner can be tracked through certificate authority (CA) and RSU, which protects the privacy of the vehicle users and has traceability. In the signature scheme we proposed, with the increase of message signed, the length of final signature remains the same, and the computation cost does not increase much. It greatly improves the efficiency of data transmission and signature's verification. We make the performance comparisons, which show that our CBAS scheme is efficient in calculation costs. We provide formal security proofs to show our CBAS scheme is secure against forgery attacks for single and aggregate signatures under the computational Diffie–Hellman problem (CDHP). Our CBAS provides the advantages of both aggregate signatures and certificate-based cryptography and is suitable for VANETs. The rest of this study is organised as follows. The system model, Framework and security model of CBAS schemes for VANETs is defined in Section 2. The next section, introduces the CBAS scheme. In Section 4, a detailed security proof of the proposed scheme based on the computational Diffie–Hellman (CDH) assumption is described. In Section 5, the CBAS scheme from the perspective of communication and computational cost is analysed and Section 6 draws conclusions. 2 System model A VANETs system consists of three parts: control center and CA, RSUs and OBU. A typical system model is shown in Fig. 1. Fig 1Open in figure viewerPowerPoint System model In a VANETs environment, control center and CA play as a trusted authority. CA has a lot of storage space and strong computing power. When the system is initialised, it issues a certificate for each OBU. Then it provides traffic management and communicates with RSUs. In the event of a crime or traffic accident, it must be possible to trace or reveal the true identity of the malicious vehicle. The RSU is a wireless communication device installed on the roadside. It uses DSRC protocol to manage the communication between RSUs within its communication range. In a VANETs system, RSU has limited storage, computing power and play as verifiers. RSU acts like a wireless LAN access points, and can provide communication with the CA. Vehicles installed with OBUs, which has limited computing power, storage space, bandwidth, play as signers and aggregator. Every vehicle has its own real identity, pseudonym, certificate, private key and public key. They use its private key and certificate to sign the messages and then forward to its neighbouring RSU. Vehicles share information and obtain various services through communication between OBU and OBU or OBU and RSU [20 ]. Our system model focuses on protecting data integrity and owner privacy while reducing bandwidth and storage costs of VANETs. 2.1 Prilimilary Let G 1 and G 2 be two additive cyclic groups with large prime order q. G 1 is a subgroup of abelian group E (FP ) and G 2 is a subgroup of finite field Fp. Bilinear pair e is a map defined by e : G 1 × G →G 2, which satisfies the following three properties: (i) Bilinear : for P, Q ∈G 1 and a, b ∈Zq *, e (aP, bQ ) = e (P, Q )ab. (ii) Non-degenerate : for an identity 1G 1 ∈G 1, e (1G 1, 1G 1 ) is also an identity of G 2. (iii) Computable : there are several efficient algorithms for computing e (P, Q ),where P, Q ∈G 1. For details about bilinear pairings, readers can refer to [21 –26 ] for a full description. 2.2 Definition of CBAS for VANETs A CBAS for VANET consists of following eight algorithms (Fig. 2 ). Fig 2Open in figure viewerPowerPoint CBAS for VANET consisting of eight algorithms 2.3 Security model of CBAS for VANETs Here, we define single signature's security model according to document [27 ]. There exit two types of adversaries called A I and A II in our scheme. The security of our CBAS scheme against a public key replace attack is defined between A I and a challenger C, in the Game 1 described below. Setup: C generates public parameters 'param' and CA's private/public key pair. Meanwhile, C initialises empty lists LP, LK, LC, LH1, LH2, LH3 and LS. Then, C returns CA's public key PKCA and param to A I. Queries. A I is allowed to adaptively make queries to the challenger C as follows: (a) KeyGenquery : when a query with identity IDi received, C checks the list LK first. If IDi has existed in LK, C returns PKi. Otherwise, C runs the KeyGen algorithm for IDi to generate IDi 's private/public key pair (SKi, PKi ). Then, C sends PKi to A I and adds (IDi, SKi, PKi ) into LK. (b) CertGen query: when a query with identity IDi received, C checks the list LC first. If IDi has existed in LC, C returns Certi from LC. Otherwise, C searches LK with IDi and runs the CertGen algorithm to generate IDi 's certificate Certi. Then, C sends Certi to A I and adds (IDi, PKi, Certi ) into LC. (c) Hash query: on receiving this query, C returns a random value as hash value to AI . (d) Corrupt query: when a query with identity IDi received, C checks the list LK first. If IDi has existed in LK, C returns SKi. Otherwise, C runs algorithm KeyGen for IDi to generate private, public keys (SKi, PKi ). Then, C returns SKi to AI and adds (IDi, SKi, PKi ) into LK. (e) Pseudonym query: when a query with (IDi, PKRSU i ) received, C checks the list LP first. If (Psi, IDi, PKRSU i ) has existed in LP, C returns Psi. Otherwise, C searches the list LH1 for Qi and runs the PseudonymGen algorithm for (ri, Qi ) to generate a pseudonym Psi = (N1i, n2i ). Then, C sends Psi to A I and adds (IDi, ri, Psi, PKRSU i ) into LP. (f) Sign query: when a query with (mi, Psi, PKRSU i, PKi ) received, C checks the list LS first. If (mi, Psi, PK RSU i ) has existed in LS, C returns (mi, σi ). Otherwise, C runs the Sign algorithm for (mi, Psi, PKRSU i ) to generate a signature ρi = (mi, σi ). Then, C sends ρi to AI and adds (Psi, PKRSU i, mi, σi ) into LS. Replacing public key request: A I can request the replacement of IDi 's public key PKi with a value selected by A I in LK. Note that A I can make this request, repeatedly. Forgery: A I outputs a signature tuple (IDi *, Psi *, mi *,σi *, PKRSU i *, PKi *) If the following conditions satisfied, A I wins Game 1: (i) The responds of the verify algorithm on (mi *, σi *, PKRSU i *, PKi *, PKC ) is true. (ii) IDi * cannot be queried by CertGen, and the corrupt queries. (iii) (Psi *, mi *, PKRSU i *) cannot be queried by the sign query. The advantage of A I wins Game 1 is defined by . Definition 1.A CBAS scheme for VANETs is secure against a public key replace attack for single signature, if the advantage is negligible for adversary A I. The security of our CBAS scheme for single signature against the certifier is defined by the Game 2 between A II and challenger C. Setup: The challenger C runs the setup algorithm to generate CA's private/public key pair (sk, pk) and public parameters 'param'. Meanwhile, C initialises lists LP, LK, LC, LH1, LH2, LH3 and LS which are empty at the beginning. Then, C returns (pk, sk, param) to A II. Queries: A II is allowed to make following queries to the challenger C adaptively. (i) KeyGenquery: when a query with (mi, Psi, PKRSU i, PKi ) received, C checks the list LK first. If IDi has existed in LK, C returns PKi. Otherwise, C runs the algorithm KeyGen for IDi to generate IDi 's private/public keys (SKi, PKi ). Then, C sends PKi to A II and adds (IDi, SKi, PKi ) into LK. (ii) Hash query: when a query with message m received, C chooses a random value as hash value and returns it to A II. (iii) Corrupt query: when a query with identity IDi received, C checks the list LK first. If IDi has existed in LK, C returns SKi. Otherwise, C runs the algorithm KeyGen for IDi to generate IDi 's private/public keys (SKi, PKi ). Then, C returns SKi to A II and adds (IDi, SKi, PKi ) into LK (iv) Pseudonym query: when a query with (IDi, PKRSU i ) received, C checks the list LP first. If (Psi, IDi ) has existed in LP, C returns Psi. Otherwise, C searches the list LH1 for Qi and runs the PseudonymGen algorithm for (ri, Qi ) to generate a pseudonym Psi = (N 1i, n 2i ). Then, C sends Psi to A II and adds (IDi, ri, Psi, PKRSU i ) into LP. (v) Sign query: when a query with (mi, Psi, PKi, PKRSU i ) received, C checks the list LS first. If (mi, Psi, PKi, PKRSU i ) has existed in LS, C returns (mi, σi ). Otherwise, C runs the Sign algorithm for (mi, Psi, PKi, PKRSU i ) to generate a signature ρi = (mi, σi ). Then, C sends ρi to A II and adds (mi, Psi, PKRSU i, σi ) into LS. Forgery: A II outputs a signature tuple (IDi *, Psi *, mi *, σi *, PKRSU i *, PKi *). We say that if the following conditions satisfied, A II wins Game 2 (i) The responds of the verify algorithm on (Psi *, mi *, σi *, PKRSU i *, PKi *) is true. (ii) IDi * cannot be queried by KeyGen and the corrupt queries. (iii) (Psi *, mi *, PKRSU i *) cannot be queried by the sign query. The advantage of A II wins Game 2 is defined by . Definition 2.A CBAS scheme is secure against the certifier for single signature, if the advantage is negligible for adversary A II. Here, we define our security model for aggregate signature. The security of our CBAS scheme for aggregate signature against a public key replace attack is defined by Game 3 between A I and challenger C. A I wants to forge a valid aggregate signature under PK1, PK2, …, PKn without the corresponding certificate certi *, where 1 ≤ i ≤ n. Setup: C runs the algorithm Setup to generate CA's private/public keys and parameters 'param'. Meanwhile, C initialises empty lists LH1, LH2, LH3 and LS. Then, A I is provided with param and PK 1, without loss of generality. Note that PK 1 is the target user's public key. Queries. A I is allowed to make queries to the challenger C adaptively. (i). Hash query: on receiving query with message mi, C returns a random value as hash value to A I. (ii). Sign query: when a query with (mi, Psi, PKi, PKRSU i ) received, C checks the list LS first. If (mi, Psi, PKi, PKRSU i ) has existed in LS, C returns σi. Otherwise, C runs the algorithm Sign to generate a signature σi. Then, C sends it to A I and adds (Psi, PKi, PKRSU i, mi, σi ) into LS. Forgery: Finally, A I outputs k − 1 additional public keys PK2, …, PKk, k distinct messages m 1, m 2, …, mk and a corresponding aggregate signature σ * under PK1, PK2, …, PKk, where k ≤ n. We say that if the following conditions satisfied, A I wins Game 3: (i) The responds of the aggregate verify algorithm on (mi, Psi, PKi, PKRSU i, σ *) is true, where 1 ≤ i ≤ n. (ii) PK1 must be included in the set of PKi. (iii) (m 1, Ps 1 ) must not be queried by Sign query. The advantage of A I wins Game 3 is defined by . Definition 3.A CBAS scheme is secure against existential forgery for aggregate signature, if the advantage is negligible for adversary A I. The security of our CBAS scheme for aggregate signature against the certifier is defined by the following Game 4 between A II and a challenger C. Note that the goal of adversary A II who has the system master key is to forge a valid aggregate signature under public key PK1, PK2, …, PKn. Setup: the challenger C runs the setup algorithm to generate CA's private/public key pair and parameters 'param'. Meanwhile, C initialises lists LP, LK, LH1, LH2, LH3 and LS which are initially empty. Then, C returns (sk, param, PK1 ) to A II, where PK 1 is the target public key. Queries. A II is allowed to make queries to the challenger C adaptively. (i). KeyGenquery: when a query with identity IDi received, C checks the list LK first. If IDi has existed in LK, C returns PKi. Otherwise, C runs the algorithm KeyGen for IDi to generate IDi 's private/public keys (SKi, PKi ). Then, C sends PKi to A II and adds (IDi, SKi, PKi ) into LK. (ii). Pseudonym query: when a query with (IDi, PKRSU i ) received, C checks the list LP first. If (Psi, IDi ) has existed in LP, C returns Psi. Otherwise, C searches the list LH1 for Qi and runs the algorithm PseudonymGen for (ri, Qi ) to generate a pseudonym Psi = (N 1i, n 2i ). Then, C sends Psi to A II and adds (IDi, ri, Psi, PKRSU i ) into LP. (iii). Hash query: when a query with message mi received, C chooses a random value as hash value to A II. (iv). Sign query: when a query with (mi, Psi, PKi, PKRSU i ) received, C checks the list LS first. If (mi, Psi, PKi, PKRSU i ) has existed in LS, C returns σi. Otherwise, C runs the Sign algorithm and generate signature σi. Then, C sends it to A II and adds (mi, Psi, PKi, PKRSU i σi ) into LS. Forgery: finally, A II outputs an aggregate signature σ * on message mi, under public keys PKi, where 1 ≤ i ≤ n. If the following conditions are satisfied, A II wins Game 4: (i) The responds of the aggregate verify algorithm on (mi, Psi, PKi, PKRSU i, σ *) is true. (ii) PKi must be included in the Lk, where 1 ≤ i ≤ n. (iii) (m 1, Ps 1, PK1 ) cannot be queried by the sign query. The advantage of A II wins Game 4 is defined by . Definition 4.A CBAS scheme is secure against the certifier for aggregate signature, if the advantage is negligible, for adversary A II. 3 Proposed CBAS scheme for VANETs In our scheme, three roles are involved which are OBU, CA, RSU. Note that RSU plays as a verifier, OBU plays as signer. We assume that there are n OBUs in our system and one of them plays as aggregator. Our scheme is described as follows: Setup: CA executes the algorithm setup to create keys and parameters. (i). A bilinear pairing e is chosen mentioned above. (ii). Selecting CA's private key s ∈R Zq *, a generator P in G 1 and computing the corresponding public key PKCA = s ·P. (iii). Selecting RSU's private key ai ∈R Zq *, a generator P in G 1 and computing public key PKRSU i = ai ·P, for 1 ≤ i ≤ n. (iv). Three hash functions are chosen, H 1 :{0,1}*→G 1, H 2 :{0,1}*→Zq * and H 3 :{0,1}*→G 1. Finally, the public parameters, param, is defined as {G 1, G 2, H 1, H 2, H 3, e, q, P }. KeyGen: CA generates eachOBUi 's private/public key pair as follows: (i) Selecting x ∈R Zq * as OBUi 's private key and computing x·P as OBUi 's public key. (ii) For each OBU i for i = 1, 2, …, n, selecting xi ∈R Zq * as OBUi 's private key and computing PKi = xi ·P as OBUi 's public key. CertGen: each OBUi submits its public key PKi and identity IDi to CA over an authentic channel. Upon receiving the request, CA computes Qi = H 1 (PKi ‖IDi ) and returns the corresponding certificate Certi = s ·Qi, where IDi denotes the identity of OBUi PseudonymGen: after the RSUi receives the identity information Qi = H1 (PKi ‖IDi ) sent by the OBUi, it first randomly selects ri ∈R Zq *, then calculates N1i = ri ·Qi, hi = H 2 (PKRSU i ‖N 1i ) and n 2i = ri hi, and finally sends the pseudonym Psi = (N 1i, n 2i ) to the OBUi and saves the record in the pseudonym registration table(N 1i, n 2i, Qi, ri, PKRSU i ). Sign: to sign a message mi, OBUi computes hi = H 2 (PKRSU i ‖N 1i ), Ti = H 3 (mi ‖PKi ) and σi = n 2i ·Certi + xi ·Ti. Finally, (mi, σi ) is broadcast to the nearby vehicles. Verify: to verify a signature tuple (mi, σi ) on messages mi, any verifier can verify it by the equation Aggregate: when an aggregator receives n signature tuples (mi, σi ) from OBUi, it computes . Here, (σ, mi ) is an aggregate signature. AggVerify: to verify an aggregate signature σ with identities IDi, on messages mi, the RSUi computes Ti = H 3 (mi ||PKi ) and verifies If the equation holds, (σ, mi ) is accepted, otherwise, reject. 4 Scheme analysis 4.1 Correctness of aggregate verification Here, we provide the correctness of our scheme 4.2 Unforgeability for signature Our scheme is based on the hardness of CDHP. Here, we provide definition and assumptions. Definition 5 (CDHP).Given (P, aP, bP ), where a, b ∈Zq *, compute abP ∈G 1. Definition 6 (CDHP assumption).No polynomial time adversary can solve this problem with an advantage which is not negligible. Theorem 1.Assume that there is an adversary A I can forge a valid single signature with an advantage which is non-negligible. Then, there must be a challenger C can solve the CDHP with an advantage which is not negligible. Proof.Challenger C interacts with A I as described below: Setup : C performs the algorithm setup to generate param = (G 1, G 2, e, q, P, H 1, H 2, H 3 ) and sets CA's public key PKCA = aP. Meanwhile, C initialises lists LP, LK, LC, LH 1, LH 2 and LS which are initially empty. Then, C returns CA's public key PKCA and param to A I. Queries. A I is allowed to make queries to the challenger C adaptively. (a) KeyGen query: when a query with identity IDi received, C first checks the list LK. If IDi has existed in LK, C returns PKi. Otherwise, C runs the KeyGen algorithm to generate IDi 's private/ public key pair (SKi, PKi ) = (xi, xi P ). Then, C sends PKi to A I and adds (IDi, SKi, PKi ) into LK. (b) CertGen query: when a query with identity IDi received, C checks the list LC first. If IDi has existed in LC, C returns Certi from LC. Otherwise, C searches LK with IDi, if the public key has been replaced, C aborts. Otherwise, C searches LH 1 with (IDi, PKi ). If it does not appear in the list, C can add (IDi, PKi, coini, ti, Qi ) on the list LH 1 as the same way in H 1 queries. Otherwise, C chooses a random number coini ∈{0,1}, for Pr[coini = 1] = δ, where δ = 1/(qc + qs ), qc is the maximum number A I makes to the CertGen query, and qs is the maximum number A I makes to the sign query, then C generates IDi 's certificate as follows. (i) If coini = 1, C aborts. (ii) If coini = 0, C computes Certi = ti PKCA, and returns it to A I. (c) H 1 query: when a query with (PKi ‖IDi ) received, C checks the list LH1 first. If (PKi ‖IDi ) appears in a tuple (IDi, PKi, coini, qi, Qi ) on the list, C returns Qi as hash value to A I, Otherwise, (i) If coini = 1, C sets Qi = bP and adds (IDi, PKi, coini, ⊥, Qi ) on the list LH1. (ii) If coini = 0, C chooses a random number , and calculates Qi = qi P. It then adds (IDi, PKi, coini, qi, Qi ) on the list LH1. In either case, C returns Qi to the adversary A I. (d) H 2 query: when a query with (Psi, PKRSU i ) received, C checks the list LH 2 first. If N 1i appears in the list, C outputs hi = H 2 (PK RSU i ‖N 1i ) as answer to A I, otherwise, C returns a random value to A I, and adds (Psi, PKRSU i, hi ) on the list LH 2. (e) H 3 query: when a query with (mi ||PKi ) received, C checks the list LH 3 first. If (mi ||PKi ) appears in the list, C outputs Ti = H 3 (mi ||PKi ) to A I, otherwise, C returns a random value to A I, and adds (mi, PKi, Ti ) on the list LH 3. (f) Pseudonym query: when a query with (IDi, PKi, PKRSU i ) received, C checks the list LP first. If (Psi, IDi, PKi ) has existed in LP, C returns Psi. Otherwise, C searches the list LH 1 for (IDi, PKi ) to obtain Qi and then runs the PseudonymGen algorithm for (ri, Qi ) to generate a pseudonym Psi = ( N 1i, n 2i ). Then, C sends Psi to A I, and adds (IDi, ri, Psi, PKRSU i ) into LP. (g) Corrupt query: when a query with identity IDi received, C checks the list LK first. If IDi has existed in LK, C returns SKi. Otherwise, C runs the KeyGen algorithm for IDi to generate IDi 's private/public key pair (SKi, PKi ). Then, C returns SKi to AI and adds (IDi, SKi, PKi ) into LK. If the public key has been replaced, C returns ⊥. (h) Sign query: when a query with (mi, Psi, PKi, PKRSU i ) received, C checks the list LS first. If (mi, Psi, PKi, PKRSU i ) has existed in LS, C returns σi. Otherwise, C checks list LK to find the original secret key xi. If the corresponding public key has been replaced, C returns⊥. Otherwise, it finds the tuple (IDi, PKi, coini, qi, Qi ) in the list LH 1. (i) If coini = 1, C aborts. (ii) If coini = 0, C checks list LH 1 to obtain (qi, Qi ), and calculates Certi = qi PKCA, and then checks list LH 2 to obtain (Psi, PKRSU i, hi ). If it does not appear in the list, C will add (Psi, PKRSU i, hi ) in list LH 2 as responds to H 2 queries. Finally, C runs the Sign algorithm for (mi, Psi, PKi, PKRSU i ) to generate a signature σi = n 2 i ·Certi + xi ·Ti. Then, C sends σi to A I and adds (mi, Psi, PKi, PKRSU i, σi ) into LS. Replacing public key request: when a query with (IDi, PK′i ) received, C replaces (IDi, SKi, PKi ) with (IDi, ⊥, PK′i ) into LK. Forgery: finally, A I outputs a signature tuple (mi *, IDi *, σi *, PKi *) □ Assume that an adversary A I forge a valid signature σi *. Then, applying forking Lemma [28 ], with a non-negligible advantage, another signature σ ′i can be forged in the same rand