# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 6 Scheme Analysis and Proof
### Security Proof
Otherwise, \(C\) randomly selects \(h_{i,4}\in Z_{q}^{*}\), returns it to \(A_{I}\), and saves \((EID_{i},C_{i},X_{i},U_{i},t_{i},t_{i},t_{i})\) in the \(L_{4}\) list. * Partial Private Key Query: \(C\) maintains a list \(L_{psk}=(EID_{i},G_{i},d_{i})\). When \(A_{I}\) queries with identity \(EID_{i}\), if \(EID_{i}=EID_{i}\), \(C\) terminates the simulation. Otherwise, \(C\) searches for the corresponding \((G_{i},d_{i})\) in the list \(L_{uk}\). If it exists, \(C\) returns \((G_{i},d_{i})\) to \(A_{I}\). If it does not exist, \(C\) randomly selects \(g_{i}\in Z_{q}^{*}\), computes \(G_{i}=g_{i}P\), \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\), and \(d_{i}P=G_{i}+h_{i,1}P_{pub}\). \(C\) then sends \((G_{i},d_{i})\) to \(A_{I}\) and saves \((EID_{i},G_{i},d_{i})\) in the \(L_{psk}\) list. * Private Key Query: \(C\) maintains a list \(L_{psk}=(EID_{i},G_{i},d_{i},x_{i},X_{i})\). When \(A_{I}\) queries with identity \(EID_{i}\), \(C\) searches for the corresponding \((x_{i},d_{i})\) in the \(L_{uk}\). If it exists, \(C\) returns \((x_{i},d_{i})\) to \(A_{I}\). If it does not exist, \(C\) randomly selects \(x_{i}\in Z_{q}^{*}\), computes \(X_{i}=x_{i}P\), performs a partial private key query, saves \((G_{i},d_{i})\) in \(L_{uk}\), and sends \((x_{i},d_{i})\) to \(A_{I}\). * Public Key Query: \(C\) maintains a list \(L_{uk}=(EID_{i},G_{i},d_{i},x_{i},X_{i})\). When \(A_{I}\) queries with identity \(EID_{i}\), \(C\) searches for the corresponding \((G_{i},X_{i})\) in the \(L_{psk}\). If it exists, \(C\) returns \((G_{i},X_{i})\) to \(A_{I}\). If it does not exist, \(C\) performs a partial private key query, saves \((G_{i},d_{i})\) in \(L_{uk}\), and sends \((G_{i},X_{i})\) to \(A_{I}\). * Public Key Replacement Query: When \(A_{I}\) queries with \((EID_{i},PK_{i}^{\prime})\), if \(EID_{i}=EID_{t}\), \(C\) terminates the simulation. Otherwise, \(C\) finds \(L_{uk}=(EID_{i},G_{i},d_{i},x_{i},X_{i})\) and replaces it with \((EID_{i},G_{i}^{\prime},\bot,\bot,X_{i}^{\prime})\). * Signcryption Query: When\(A_{I}\) queries with \((EID_{i},v_{0},EID_{j})\) for signcryption, if \(EID_{i}=EID_{t}\), \(C\) retrieves \((EID_{i},G_{i},P_{pub},h_{i,1})\) and \((EID_{i},G_{i},X_{i},d_{i},x_{i})\) from \(L_{1}\) and \(L_{u}\), where \(x_{i}=\bot\). \(C\) chooses \(u_{i},h_{i,3},h_{i,4},r_{1}\in Z_{q}^{*}\), sets \(S_{i}=u_{i}\) and computes \(U_{i}=S_{i}P-(h_{i,3}X_{i}+h_{i,4}(G_{i}+h_{i,1}P_{pub}))\), \(C_{i,1}=g^{v_{0}}r_{1}^{n}\) mod \(n^{2}\), \(C_{i,2}=v_{0}\oplus h_{i,3}\). Then returns \(\sigma_{i}=\{U_{i},S_{i},C_{i,1},C_{i,2}\}\) to \(A_{I}\). If \(EID_{i}\
eq EID_{t}\), \(C\) retrieves \(h_{i,2},h_{i,3},h_{i,4}\) from \(L_{2},L_{3},L_{4}\) respectively, and obtains \((G_{j},X_{j}),(x_{i},d_{i})\) from \(L_{uk}\). \(C\) randomly selects \(u_{i},r_{1}\in Z_{q}^{*}\), computes \(U_{i}=u_{i}P\), \(C_{i,1}=g^{v_{0}}r_{1}^{n}\) mod \(n^{2}\), \(C_{i,2}=v_{0}\oplus h_{i,3}\), \(T_{i}=u_{i}(X_{j}+G_{j}+h_{j,2}P_{pub})\) and \(S_{i}=x_{i}h_{i,3}+d_{i}h_{i,4}+u_{i}\). \(C\) generates the signature \(\sigma_{i}=\{U_{i},S_{i},C_{i,1},C_{i,2}\}\) and returns \(\sigma_{i}\) to \(A_{I}\). * Unsigncryption Query: When the adversary \(A_{I}\) issues an unsigncryption query for \((EID_{i},\sigma_{i},EID_{j})\). If \(EID_{i}=EID_{t}\), \(C\) retrieves the tuples \((EID_{i},G_{i},X_{i},d_{i},x_{i})\) from \(L_{u}\) and \((EID_{j},X_{j},G_{j},P_{pub},h_{j,2})\) from \(L_{2}\). \(C\) verifies the signature and computes \(v_{0}=C_{i,2}\oplus h_{i,3}\). Then sends \(v_{0}\) to \(A_{I}\). If \(EID_{i}\
eq EID_{t}\), \(C\) executes the actual unsigncryption algorithm. Then \(C\) decrypts the ciphertext and returns \(v_{0}\) to \(A_{I}\). * Challenge Phase: \(A_{I}\) selects two transaction messages \(v_{0},v_{1}\) of equal length and a pair of identities \((EID_{i},EID_{j})\), where \(EID_{i}\) is the sender identity and \(EID_{j}\) is the receiver identity. If \(EID_{i}\
eq EID_{t}\), \(C\) aborts the game.