## 5 Security Analysis
Since \(r\) and \(s\) are randomly selected from \(Z_{p}\), the distribution of the real signature \((\sigma_{1},\sigma_{2},T)\) and the simulated signature \((\sigma^{{}^{\prime}}_{1},\sigma^{{}^{\prime}}_{2},T^{{}^{\prime}})\) is computationally indistinguishable. Namely, it is infeasible to distinguish \(\sigma\) and \(\sigma^{{}^{\prime}}\) without knowing the private key of the signer, the designated verifier or the arbiter. Hence, the SDVS-USU scheme satisfies the non-transferable property. Theorem 3: _Our SDVS scheme is secure against the privacy of the signer's identity under the DBDH assumption._  
Proof of Theorem 3: Suppose there exists a PPT distinguisher \(\mathcal{D}\) who breaks the privacy of the signer's identity of the SDVS-USU scheme. Then, we can construct an algorithm \(\mathcal{B}\) to solve the DBDH problem. Given a random instance \((g,g^{a},g^{b},g^{c},Z)\) of the DBDH problem, where unknown \(a,b,c\in Z_{p}\) and \(Z\in G_{2}\), the \(\mathcal{B}\)'s goal is to determine if \(Z\) is equal to \(e(g,g)^{abc}\). * _Setup:_\(\mathcal{B}\) simulates the **Setup** algorithm by performing the following steps: 1. Choose \(n+2\) random integers \(z,y_{0},y_{1},...\), \(y_{n}\in Z_{p}\), and set \(v=g^{z}\), \(u_{0}=g^{y_{0}}\) and a vector \(\vec{u}=(u_{1},...,u_{n})\), where \(u_{j}=g^{y_{j}}\) for \(1\leq j\leq n\). 2. Select four random values \(k_{1},k_{2},k_{3},k_{4}\in Z_{p}\), and set the signer \(S_{0}\)'s public key \(pk_{S_{0}}=(pk_{S_{0},1},pk_{S_{0},2})=(g^{a},g^{b})\), the signer \(S_{1}\)'s public key \(pk_{S_{1}}=(pk_{S_{1},1},pk_{S_{1},2})=(g^{k_{1}},g^{k_{2}})\)the designated verifier's public key \(pk_{V}=(pk_{V,1},pk_{V,2})=(g^{c},g^{k_{3}})\) and the arbiter's public key \(pk_{A}=g^{k_{4}}\). Note that \(a\), \(b\) and \(c\) are unknown to \(\mathcal{B}\). 3. Set \(sk_{S_{0}\leftrightarrow V}=Z\) as the common secret key between \(S_{0}\) and \(V\), and \(sk_{S_{1}\leftrightarrow V}=e(g^{k_{1}},g^{c})^{k_{2}}\) as the common secret key between \(S_{1}\) and \(V\). 4. Pick two collision-resistant hash functions \(H_{1}:\{0,1\}^{*}\times G_{1}\to Z_{p}\) and \(H_{2}:\{0,1\}^{*}\times G_{1}\times G_{1}\to Z_{p}\). 5. Send the public parameters \(params=(G_{1},G_{2},p,\quad g,e,u_{0},v,\vec{u},H_{1},H_{2})\quad\text{and}\quad(pk_ {S_{0}},pk_{S_{1}},pk_{V},pk_{A})\) to \(\mathcal{D}\). For a message \(m=(m_{1},...,m_{n})\in\{0,1\}^{n}\), we also define a function \(L(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}\), and thus we have \(w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=g^{L(m)}\). 6. _Query phase_ 1: \(\mathcal{B}\) answers \(\mathcal{D}\)'s queries as follows. * _Signing queries_: When \(\mathcal{D}\) issues a signature query on a message \(m_{i}=(m_{i,1},...,m_{i,n})\in\{0,1\}^{n}\) and an index \(d_{i}\in\{0,1\}\), \(\mathcal{B}\) does the following. 1. Select a random integer \(r_{i}\in Z_{p}\), and compute \(\sigma_{i,2}=g^{r_{i}}\). 2. Pick a random element \(T_{i}\in G_{1}\), and compute \(w_{i}=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{i,j}}\) and \(h_{i}=H_{2}(m_{i},\sigma_{i,2},T_{i})\). 3. Compute \(\sigma_{i,1}=sk_{S_{d_{i}}\leftrightarrow V}\cdot e(w_{i}v^{h_{i}},g^{c})^{r_ {i}}\). 4. Return a signature \(\sigma_{i}=(\sigma_{i,1},\sigma_{i,2},T_{i})\) on \(m_{i}\) to \(\mathcal{D}\). * _Simulating queries_: \(\mathcal{B}\) responds to this query in the same way as in _Signing queries_. * _Verifying queries_: On receiving a signature \(\sigma_{i}=(\sigma_{i,1},\sigma_{i,2},T_{i})\) of a message \(m_{i}=(m_{i,1},...,m_{i,n})\in\{0,1\}^{n}\) and a value \(d_{i}\in\{0,1\}\), \(\mathcal{B}\) first calculates \(w_{i}=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{i,j}}\), \(h_{i}=H_{2}(m_{i},\sigma_{i,2},T_{i})\) and \(L(m_{i})\). Then, \(\mathcal{B}\) uses \(sk_{S_{d_{i}}\leftrightarrow V}\) to verify whether \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]8 If this equation holds, indicating \(\sigma_{i}\) is valid, \(\mathcal{B}\) sends 1 to \(\mathcal{D}\); otherwise, \(\mathcal{B}\) returns 0 to \(\mathcal{D}\).