## 4 The SDVS-USU Scheme
Compute \(\sigma_{1}^{{}^{\prime}}=e(pk_{S,1},pk_{S,2})^{k_{V_{1}}e}(ww^{h^{\prime}}, \sigma_{2}^{{}^{\prime}})^{k_{V,1}}\). 4. Output a simulated signature \(\sigma^{{}^{\prime}}=(\sigma_{1}^{{}^{\prime}},\sigma_{2}^{{}^{\prime}},T^{ \prime})\) on \(m\). Correctness: If \(\sigma=(\sigma_{1},\sigma_{2},T)\) is correctly produced by the \(\mathbf{Sign}\) algorithm, then we have  
\[\sigma_{1} =e(g^{k_{S,1}k_{S,2}}(ww^{h})^{r},pk_{V,1})\] \[=e(g^{k_{S,1}k_{S,2}},g^{k_{V,1}})e((ww^{h})^{r},g^{k_{V,1}})\] \[=e(g^{k_{S,1}},g^{k_{S,2}})^{k_{V_{2}}e}(ww^{h},g^{r})^{k_{V,1}}\] \[=e(pk_{S,1},pk_{S,2})^{k_{V_{1}}e}(ww^{h},\sigma_{2})^{k_{V_{1}}}.\]  
The above equation indicates that the signature \(\sigma\) of message \(m\) generated by the signer using the private key \(sk_{S}\) can be verified by the signature verification algorithm \(\mathbf{Verify}\). That is, \(\sigma\) is a legal signature. If \(\sigma^{{}^{\prime}}=(\sigma_{1}^{{}^{\prime}},\sigma_{2}^{{}^{\prime}},T^{ \prime})\) is correctly produced by the \(\mathbf{Sim}\) algorithm, then we have  
\[\sigma_{1}^{{}^{\prime}}=e(pk_{S,1},pk_{S,2})^{k_{V_{1}}e}(ww^{h^{\prime}}, \sigma_{2}^{{}^{\prime}})^{k_{V_{1}}}.\]  
It shows that the simulated signature \(\sigma^{{}^{\prime}}\) produced by the designated verifier using its private key \(sk_{V}\) can also be verified by the signature verification algorithm \(\mathbf{Verify}\). Therefore, the SDVS-USU scheme satisfies correctness. Compared with the previous similar schemes, the novelty of the SDVS-USU scheme is as follows:  
* In the \(\mathbf{Sign}\) algorithm, \(h=H_{2}(m,\sigma_{2},T)\) is embedded in a part \(\sigma_{1}=e(g^{k_{S,1}k_{S,2}}(ww^{h})^{r},pk_{V,1})\) of a signature \(\sigma=(\sigma_{1},\sigma_{2},T)\). Since the hash function \(H_{2}\) is collision-resistant, any modification of \(m\), \(\sigma_{2}\) and \(T\) will make \(\sigma\) fail the signature verification equation. In other words, an attacker cannot generate a legitimate signature for a previously signed message if the attacker does not know the private key of the signer or the designated verifier. Hence, the SDVS-USU scheme possesses strong unforgeability. * The value \(T=(pk_{A})^{k_{S,1}k_{S,2}H_{1}(m,\sigma_{2})}\) contains the arbiter's public key \(pk_{A}\), the signer's private key \(sk_{S}=(sk_{S,1},sk_{S,2})\) and the hash value \(H_{1}(m,\sigma_{2})\), which shows that only the arbiter can use its own private key \(sk_{A}\) and \(T\) to identify the real generator in a signature. In addition, \(H_{1}\) and \(H_{2}\) are two collision-resistant hash functions, and \(T\) is a part of \(h=H_{2}(m,\sigma_{2},T)\) and the signature \(\sigma=(\sigma_{1},\sigma_{2},T)\). Therefore, any modification of the value \(T\) will result in the failure of the validation of the signature \(\sigma\). That is, the SDVS-USU scheme provides undeniability. * The [PERSON] scheme [28] is malleable and satisfies existential unforgeability in the standard model. The proposed SDVS scheme is based on [PERSON] scheme [28], but the SDVS-USU scheme is no-malleable and strongly unforgeable in the standard model. Therefore, the SDVS-USU scheme is different from [PERSON] scheme [28] in terms of design and security proof.