## 6 Comparison  
The SDVS-USU scheme is compared with other SDVS schemes [14; 18; 20] in terms of performance and security properties. In Tables 1 and 2, the **Size**, **Sign** and **Verify** columns represent the size of a signature, and the computational cost of signature generation and signature verification, respectively. The \(SU\) column shows whether the scheme is strongly unforgeable. The \(PSI\) column indicates whether the scheme has the PSI property. The _Udeniability_ column shows whether the scheme is undeniable. The \(SM\) column indicates whether the scheme is secure in the standard model. Let \(p\) and \(q\) be two primes such that \(p=2q+1\). Since the computational cost of some cryptographic operations such as modular multiplication, hash function or inverse is relatively small after being optimized by various technologies [34], we consider only the computationally expensive bilinear pairing and exponentiation operations in Table 1. We use the symbol \(P\) to denote one paring operation. \(E_{1}\), \(E_{2}\) and \(E_{p}\) denote one exponentiation operation in \(G_{1}\), \(G_{2}\) and \(Z_{p}\), respectively. \(|G_{1}|\), \(|G_{2}|\), \(|p|\) and \(|q|\) represent the length of an element in \(G_{1}\), \(G_{2}\), \(Z_{p}\) and \(Z_{q}\), respectively. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Scheme** & **Size** & **Sign** & **Verify** \\ \hline Scheme I in [7] & \(4|q|+|p|\) & \(5E_{p}\) & \(8E_{p}\) \\ Scheme II in [7] & \(3|q|+|p|\) & \(8E_{p}\) & \(9E_{p}\) \\ [PERSON] et al. [11] & \(|G_{1}|+|G_{2}|\) & \(2E_{1}+P\) & \(E_{2}+P\) \\ Scheme I in [13] & \(|p|+4|G_{1}|\) & \(6E_{1}\) & \(3E_{1}+2P\) \\ Scheme II in [13] & \(|p|+3|G_{1}|\) & \(5E_{1}\) & \(2E_{1}+2P\) \\ Our scheme & \(2|G_{1}|+|G_{2}|\) & \(4E_{1}+P\) & \(E_{1}+E_{2}+P\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of performance. As can be seen in Tables 1 and 2, two SDVS schemes of [PERSON] et al. [14] outperform other schemes in both signature length and computational overhead, but their two schemes are not proven to be secure in the standard model. For the length of signature, the SDVS-USU scheme has one more element in \(G_{1}\) than [PERSON] et al. 's scheme [18] but is superior to [PERSON] et al. 's two schemes [20]. The SDVS-USU scheme is able to perform some pre-computation, such as \(g^{k_{5},k_{5}z}\) in the signature generation phase and \(e(pk_{5,1},pk_{5,2})^{k_{V,1}}\) in the verification phase. Thus, the SDVS-USU scheme has comparable computation complexity with other schemes [18; 20]. However, [PERSON] et al. 's scheme [18] does not have strong unforgeability and the PSI property. Moreover, none of [PERSON] et al. 's scheme [18] and [PERSON] et al. 's [20] schemes holds the undeniable property. The SDVS-USU scheme has strong unforgeability and the PSI property in the standard model. Moreover, it achieves undeniability. Therefore, the SDVS-USU scheme has stronger security. We carried out simulation experiments to evaluate the performance of the SDVS-USU scheme. The experimental environment was a laptop with Intel Core i7-6500 [EMAIL_ADDRESS] GHz and 8 GB memory. All simulation programs running on Microsoft Windows 10 operating system were based on PBC-0.47-VC library. Figure 1 illustrates that the signature size of the SDVS-USU scheme, [PERSON] et al. 's scheme [18] and [PERSON] et al. 's two schemes [20] is 384 bits, 256 bits, 532 bits and 404 bits, respectively. Hence, the SDVS-USU scheme has shorter signature length. As shown in Figure 2, the length of the signer's private key in the SDVS-USU scheme is 40 bits, which is the same as that of [PERSON] et al. 's scheme [18] but larger than that of [PERSON] et al. 's two schemes [20]. Moreover, the length of the designated verifier's private key in the SDVS-USU scheme is 40 bits, which is larger than that of [PERSON] et al. 's scheme [18] but smaller than that of [PERSON] et al. 's two schemes [20].