# A Watermarking Protocol Based on Blockchain
## 6 Protocol Analysis
### Analysis
#### 6.2.1 \(\mathcal{CP}\) is Corrupt  
Consider the execution of the proposed protocol when a corrupt party \(\mathcal{CP}^{c}\) and an honest \(\mathcal{B}\) are involved. \(\mathcal{B}\) chooses the content \(X\) and communicates the wish to buy it to \(\mathcal{CP}^{c}\). \(\mathcal{CP}^{c}\) interacts with \(\mathcal{RA}\) and obtains \(pk^{X}_{\mathcal{RA}}\) and \(\mathbb{E}_{pk^{X}_{\mathcal{RA}}}(N)\). During this preliminary phase, no corrupting actions may occur. **Lemma 1** (Basic Lemma). : _Under the basic assumptions reported in Section 6.1, if \(\mathcal{CP}^{c}\) tries to embed a corrupt watermark \(W^{c}\) into \(X\) in order to accuse an innocent buyer of illegal content distribution, such a corruption is disclosed by running the identification and arbitration protocol._  
Proof. : Since the watermark \(W\) is composed of \(N\) and \(W_{\mathcal{CP}}\) (see Expression (1)), \(\mathcal{CP}^{c}\) can embed a corrupt watermark into \(X\) only if it can corrupt the part \(N\) of \(W\). Therefore, consider the case in which \(\mathcal{CP}^{c}\) wants to embed a corrupt \(N^{c}\) into the content \(X\) purchased by \(\mathcal{B}\). To achieve such a goal, \(\mathcal{CP}^{c}\) has to be able to:  
1. embedd the watermark \(W^{c}=W_{\mathcal{CP}}||N^{c}\) into the content \(X\) directly in the encrypted domain, according to the Expressions (1) and (2);
2. obtain the generation of a node in the blockchain \(\mathcal{BC}\), which occurs only if \(\mathcal{BC}\) can certify consistency between the security tokens sent in the messages \(m_{6}\) and \(m_{7}\) by \(\mathcal{CP}^{c}\) and \(\mathcal{B}\) respectively (see Table 2). The former condition is needed because \(\mathcal{B}\) obtains the final and protected version of the purchased content \(\bar{X}\) by decrypting the content \(\overline{\mathbb{E}}_{pk^{X}_{\mathcal{RA}}}(X)\) with the secret key received by \(\mathcal{RA}\) in the message \(m_{10}\) (see Table 2), according to the Expression (3). This also means that, if \(\mathcal{CP}^{c}\) wants to use a corrupt key \(pk^{X^{c}}_{\mathcal{RA}}\) to encrypt the nonce \(N^{c}\), it has also to control the corresponding secret key sent by \(\mathcal{RA}\) to \(\mathcal{B}\) in the message \(m_{10}\), which has to necessarily become \(sk^{X^{c}}_{\mathcal{RA}}\). The latter condition implies that \(\mathcal{CP}^{c}\) can obtain or generate a valid and verifiable signature \(\mathbb{S}_{\mathcal{RA}}(pk^{X}_{\mathcal{RA}^{c}},\mathbb{E}_{pk^{X}_{ \mathcal{RA}}}(N^{c}))\) on the corrupt token \(\mathbb{E}_{pk^{X}_{\mathcal{RA}}}(N^{c})\). Furthermore, if \(\mathcal{CP}^{c}\) decides to also employ a corrupt key \(pk^{X^{c}}_{\mathcal{RA}}\) to encrypt \(N^{c}\), then the corrupt signature to obtain or generate becomes \(\mathbb{S}_{\mathcal{RA}}(pk^{X^{c}}_{\mathcal{RA}^{c}},\mathbb{E}_{pk^{X}_{ \mathcal{RA}}}(N^{c}))\). In this regard, it is worth noting that, under the assumptions reported in Section 6.1, \(\mathcal{CP}^{c}\) cannot generate a valid signature \(\mathbb{S}_{\mathcal{RA}}(\ldots)\) on corrupt tokens. This means that \(\mathcal{CP}^{c}\) cannot choose an arbitrary nonce \(N^{c}\) or key pair \((pk^{X^{c}}_{\mathcal{RA}^{c}}sk^{X^{c}}_{\mathcal{RA}})\) to conduct a purchase transaction, but it could only attempt to reuse tokens generated by \(\mathcal{RA}\) in previous purchase transactions. However, the following considerations have to be taken into account:  
1. When a key pair \((pk^{X}_{\mathcal{RA}}\),\(sk^{X}_{\mathcal{RA}})\) and an encrypted nonce \(\mathbb{E}_{pk^{X}_{\mathcal{RA}}}(N)\) are employed in a valid purchase transaction, they are included and published in a node of \(\mathcal{BC}\), and can no longer be re-used, as reported in Section 5.1. 2. Once the public key \(pk^{X}_{\mathcal{RA}}\) has been chosen and sent to \(\mathcal{B}\) in the message \(m_{4}\), it can no longer be corrupted by \(\mathcal{CP}^{c}\), since it has to correspond to the secret key \(sk^{X}_{\mathcal{RA}}\) released by \(\mathcal{RA}\) in the message \(m_{10}\).