# A Watermarking Protocol Based on Blockchain
## 6 Protocol Analysis
### Analysis
#### 6.2.2 \(\mathcal{B}\) is Corrupt  
Consider the execution of the proposed protocol when the involved parties are a corrupt buyer \(\mathcal{B}^{c}\) and an honest \(\mathcal{CP}\). Suppose that \(\mathcal{B}^{c}\) contacts \(\mathcal{CP}\) in order to buy the content \(X\). \(\mathcal{B}^{c}\) receives the confirmation message \(m_{4}\) from \(\mathcal{CP}\), which contains the following tokens: \(X_{d}\), \(T_{X}\), \(pk_{\mathcal{R},\mathcal{A}}^{X}\), \(\mathbb{S}_{\mathcal{R},\mathcal{A}}(pk_{\mathcal{R},\mathcal{A}}^{X},\mathbb{ E}_{pk_{\mathcal{R},\mathcal{A}}^{X}}(N))\), (see Table 2). **Lemma 3** (Basic Lemma). : _Under the basic assumptions reported in Section 6.1, if \(\mathcal{B}^{c}\) tries to complete the purchase transaction by employing a corrupt content identifier \(X_{d}^{c}\) in order to impair the piracy tracing mechanism implemented by \(\mathcal{CP}\), such a corruption is disclosed and the purchase transaction is aborted._  
Proof. : Suppose that \(\mathcal{B}^{c}\) wants to use a corrupt identifier \(X_{d}^{c}\) to conduct the purchase transaction. Under the assumptions reported in Section 6.1, such a goal can be achieved only if \(\mathcal{B}^{c}\) can obtain the generation of a node in the blockchain \(\mathcal{BC}\) which contains \(X_{d}^{c}\). This occurs only when \(\mathcal{BC}\) can certify consistency between the security tokens sent by \(\mathcal{CP}\) and \(\mathcal{B}^{c}\) in the messages \(m_{6}\) and \(m_{7}\) respectively (see Table 2). This also means that, if \(\mathcal{B}^{c}\) wishes to include the corrupt identifier \(X_{d}^{c}\) in the message \(m_{7}\), the buyer must ensure that the corresponding signature \(\mathbb{S}_{\mathcal{CP}}(X_{d},\ldots)\) is included in the message \(m_{6}\). However, it is worth noting that, under the assumptions reported in Section 6.1:  
1. \(\mathcal{B}^{c}\) cannot autonomously generate a valid and verifiable signature \(\mathbb{S}_{\mathcal{CP}}(\ldots)\) on corrupt tokens. 2. \(X_{d}\) is generated by \(\mathcal{CP}\) to unambiguously identify the content \(X\) requested by the buyer. Therefore, \(\mathcal{CP}\) uniquely accepts the content identifiers that it has generated during the initial phase of the protection protocol. No other identifiers can be accepted. 3. \(X_{d}\) is always sent by \(\mathcal{CP}\) to \(\mathcal{BC}\) in the message \(m_{6}\), together with the corresponding signature \(\mathbb{S}_{\mathcal{CP}}(\ldots)\). Therefore, if the content identifiers included in the messages \(m_{6}\) and \(m_{7}\) do not coincide or do not match with the signature \(\mathbb{S}_{\mathcal{CP}}(\ldots)\), \(\mathcal{BC}\) does not complete the purchase transaction. As a consequence, \(\mathcal{B}^{c}\) cannot employ arbitrary content identifiers in the protection protocol, but he/she can, at the most, exploit pairs (\(X_{d}\), \(\mathbb{S}_{\mathcal{CP}}(X_{d},\ldots)\)) generated by \(\mathcal{CP}\) in other previous, incomplete purchase transactions. In fact, such pairs must not be already included in nodes of the blockchain. Suppose that \(\mathcal{B}^{c}\) can get two distinct content identifiers \(Y_{d}\) and \(Z_{d}\), together with the corresponding signatures \(\mathbb{S}_{\mathcal{CP}}(Y_{d},\ldots)\) and \(\mathbb{S}_{\mathcal{CP}}(Z_{d},\ldots)\), from \(\mathcal{CP}\). The two identifiers refer to the content \(Y\) and \(Z\) distributed by \(\mathcal{CP}\). Suppose that \(\mathcal{B}^{c}\) starts a transaction with \(\mathcal{CP}\) to purchase \(X\). \(\mathcal{B}^{c}\) receives \(X_{d}\) and \(\mathbb{S}_{\mathcal{CP}}(X_{d},\ldots)\) from \(\mathcal{CP}\) in the message \(m_{4}\). This also means that \(\mathcal{BC}\) will receive \(X_{d}\) and \(\mathbb{S}_{\mathcal{CP}}(X_{d},\ldots)\) from \(\mathcal{CP}\) in the subsequent message \(m_{6}\), and this will prevent \(\mathcal{B}^{c}\) from using any other pair of content identifier and signature in the message \(m_{7}\).