## 5 Analyses
### Security Proof  
In this section now, we will provide security proof for the proposed ECLAS scheme for VANETs. We assume the security model for CLAS schemes where there are two types of adversaries, which are _Type 1 Adversary_ and _Type 2 Adversary_ as demonstrated in the security model for CLAS scheme. Theorem 5.1: _Under the assumption that ECDL in \(G\) is intractable, then the proposed scheme \((\epsilon,t,q_{c},q_{s},q_{h})\), is secure against adversary 1 in random oracle model, where \(q_{c},q_{s},q_{h}\) are the Create, Sign and Hash queries respectively which the adversary is allowed to make._Proof. : Suppose there is a probabilistic polynomial time adversary \(\mathcal{A}_{1}\), we construct an algorithm \(\mathcal{F}\) that solves the ECDL problem by utilizing \(\mathcal{A}_{1}\). Assume that \(\mathcal{F}\) is given an ECDL problem instance, \((P,Q)\) to compute \(x\in\mathcal{Z}_{q}^{*}\) so that \(Q=xP\). Thus, \(\mathcal{F}\) chooses a challenging identity \(ID^{*}\) for the identity \(ID\) to answer any random queries from \(\mathcal{A}_{1}\) as follows:  
* **Set-up (\(ID\)) Query**: The challenger \(\mathcal{F}\) selects its random numbers \(\alpha^{*}\) and \(\beta^{*}\) as its master keys and has a corresponding public key as \(P_{pub}^{*}=\alpha^{*}P\) and \(T_{pub}^{*}=\beta^{*}P\) then sends the system parameters \(\{P,p,q,E,G,H_{2},H_{3},P_{pub}^{*},T_{pub}^{*}\}\) to \(\mathcal{A}_{1}\). * **Create (\(ID\)) Query**: \(\mathcal{F}\) stores the hash list \(L_{C}\) of the tuple \((ID,Q_{ID_{i}},\
u pk_{i},psk_{i},sk_{i},h_{2})\). Whenever an adversary \(\mathcal{A}_{1}\) makes a query for \(ID\), and if the \(ID\) is contained in \(L_{C}\), then \(\mathcal{F}\) returns \((ID,Q_{ID_{i}},\
u pk_{i},psk_{i},sk_{i},h_{2})\) to \(\mathcal{A}_{1}\). Then \(\mathcal{F}\), execute the oracle as follows. if \(ID=ID^{*}\), \(\mathcal{F}\) randomly chooses the values \(a,b,c\in\mathcal{Z}_{q}^{*}\) and sets \(Q_{ID}=a.P_{pub}^{*}+b.P\), \(vpk_{i}=c.P\), \(psk_{i}=b\), \(sk_{i}=c\), \(h_{2}=H_{2}(ID||Q_{ID})\gets amodq\), then \(\mathcal{F}\) adds \((ID,Q_{ID},h_{2})\) to the list \(L_{H_{2}}\) and returns \((ID,Q_{ID_{i}},\
u pk_{i},psk_{i},sk_{i},h_{2})\) to \(\mathcal{A}_{1}\). as the equation \(psk_{i}.P=Q_{ID}+h_{2}.P_{pub}^{*}\), thereby implying that the partial private key is valid. * \(H_{2}\) **Query**: Whenever an \(H_{2}\) query with \((ID,Q_{ID})\) is made, and \(ID\) is already in the hash list \(L_{H_{2}}\), then \(\mathcal{F}\) reply with a corresponding \(h_{2}\). On the other hand, \(\mathcal{F}\) runs Create(\(ID\)) to obtain \(h_{2}\) and then sends \(h_{2}\) to \(\mathcal{A}_{1}\). * **Partial-Private-Key-Extract (\(ID\)) Query**: If \(ID^{*}=ID\), then \(\mathcal{F}\) aborts the game. Otherwise, \(\mathcal{F}\) looks in the hash list \(L_{C}\), if \(ID\) is found in the list, then \(\mathcal{F}\) returns \(psk_{i}\) to \(\mathcal{A}_{1}\). If \(ID\) is not in the list \(L_{C}\), \(\mathcal{F}\) executes Create(\(ID\)) query to obtain \(psk_{i}\) and sends it to \(\mathcal{A}_{1}\). * **Public-Key (\(ID\)) Query**: Upon receiving the query on \(ID\), when \(ID\) is already in the list \(L_{C}\), \(\mathcal{F}\) replies with \(pk=(Q_{ID},\
u pk_{i})\). On the other hand, \(\mathcal{F}\) executes Create(\(ID\)) query to obtain \((Q_{ID},\
u pk_{i})\) and sends it to \(\mathcal{A}_{1}\). * **Public-Key-replacement (\(ID\), \(pk^{\prime}\)) Query**: \(\mathcal{F}\) stores the hash list \(L_{R}\) of tuple \((ID,d_{i},Q_{ID},\)\(sk_{i},\
u pk_{i})\). When \(\mathcal{A}_{1}\) executes the query with \((ID,pk^{\prime})\), where \(Q_{ID}^{\prime}=d^{\prime}.P\), \(\
u pk_{i}^{\prime}=x_{i}^{\prime}.P\) and \(pkt=(Q_{ID}^{\prime},\
u pk_{i}^{\prime})\), then \(\mathcal{F}\) sets \(Q_{ID}=Q_{ID}^{\prime}\), \(\
u pk_{i}=\
u pk_{i}^{\prime}\), \(psk_{i}=\perp\) and \(x_{i}=x_{i}^{\prime}\). Then the challenger \(\mathcal{F}\), updates the list \(L_{R}\) to be \((ID,d_{i}^{\prime},Q_{ID}^{\prime},\
u pk_{i}^{\prime},x_{i}^{\prime})\).