# An Identity-Based Anti-Quantum Privacy-Preserving Blind Authentication in Wireless Sensor Networks
## 4 Analyzing the Security and Performances
### Correctness, Blindness and One-More Unforgeability  
**Theorem 2** (Correctness). : _The IDBS-NTRU scheme is correct._  
Proof. : Following our IDBS-NTRU scheme, we can get \[ \begin{split}& h*\xi_{2}+\xi_{1}-H(id)*e\\ &=h(\xi_{2}^{*}+\gamma)+\xi_{1}^{*}+\alpha-H(id)*e\\ &=h(y_{2}+s_{2}e^{*}+\gamma)+y_{1}+\alpha+s_{1}e^{*}-H(id)*e\\ &=y_{1}+hy_{2}+h\gamma+\alpha-\alpha H(id)\end{split}  \tag{9}\]  
Thus, \(H^{{}^{\prime}}(h*\xi_{2}+\xi_{1}-H(id)*e,m)=e\). By using Lemmas 2 and 3 in [13], the distributions of \(\xi_{1}^{*},\xi_{2}^{*}\) are close to \(D_{Z^{N},s^{\prime}}\), \(\alpha,\gamma\) are the vectors from \(D_{Z^{N},s}\). So the probability of \(||\xi_{1}||,||\xi_{2}||\leq 4s\sqrt{N}\) is at least \(1-2^{-N}\). Then we can get \(||(\xi_{1},\xi_{2})||\leq 4s\sqrt{2N}\). To prove IDBS-NTRU scheme's blindness, we introduce the statistical distance theorem, that is crucial to prove blindness property. **Theorem 3** (Statistical Distance Theorem). : _let random variable number \(P,Q\in\Omega\), in which \(\Omega\) is a finite domain. The statistical distance equation is presented as below [33]:_  
\[\Delta(P,Q)=1/2\sum_{\omega\in\Omega}|Pr[P=\omega]-Pr[Q=\omega]| \tag{10}\]  
When we prove IDBS-NTRU's blindness, the malicious \(\mathcal{S}^{*}\) will play the Experiment 1 with two trust users respectively. **Theorem 4** (Blindness). : _The IDBS-NTRU satisfies blindness._  
Proof. : A random bit \(i\leftarrow\{0,1\}\) is chosen, which is kept secret from \(\mathcal{S}^{*}\). Then \(\mathcal{S}^{*}\) chooses \(m_{0},m_{1}\), then \(\mathcal{S}^{*}\) interacts with two honest users as in Experiment 1. Following is the protocol:  
* \((pk,sk)\gets KG_{\epsilon}(1^{k})\)
* \(sk_{id}\gets EX(params,id,sk)\)
* Under finding mode, \(\mathcal{S}^{*}\) selects \(m_{0},m_{1}\gets\mathcal{S}^{*}(1^{k},id,sk_{id})\). * Under issuing mode, a random bit \(i\) is selected randomly, that cannot be obtained by \(\mathcal{S}^{*}\). Then \(m_{0},m_{1}\) are randomly denoted as \(m_{i},m_{1-i}\) respectively. \(\mathcal{S}^{*}\) concurrently interacts with \(\mathcal{U}(id,m_{i})\) and \(\mathcal{U}(id,m_{1-i})\). * If one user outputs \(\delta(m_{i})\), the other outputs \(\delta(m_{1-i})\), we will send a sequence \(<\delta(m_{i}),\delta(m_{1-i})>\) to \(\mathcal{S}^{*}\). * Under guessing mode, \(\mathcal{S}^{*}\) returns \(\tilde{i}\). As in Figure 3, the Interactive values do not depend on \(m\), so what we need to do is analyzing \(e^{*},y_{1},y_{2},\xi_{1}^{*},\xi_{2}^{*}\). For \(e^{*}\), the statistical-distance is defined as follows  
\[\Delta(e^{*}_{i},e^{*}_{1-i})=1/2\sum_{e^{*}\in D_{Z^{N},s}}|Pr(e^{*}_{i}=e^{ e^{*}})-Pr(e^{*}_{1-i}=e^{e^{*}})| \tag{11}\]  
For \(\alpha\) is a random vector from Discrete Gaussian distribution, we can get the follow equations \(Pr(e^{*}_{i}=e^{*^{\prime}})\) is close to \(1/2^{n}\), \(Pr(e^{*}_{1-i}=e^{*^{\prime}})\) is close to \(1/2^{n}\). Therefor, we can get \(\Delta(e^{*}_{i},e^{*}_{1-i})\) is close to \(0\). Similarly, we can get \(\Delta(y^{i}_{1},y^{1-i}_{1})\), \(\Delta(y^{i}_{2},y^{1-i}_{2})\), \(\Delta(\xi^{is}_{1},\xi^{1-is}_{1})\), and \(\Delta(\xi^{is}_{2},\xi^{1-is}_{2})\) are close to \(0\). Therefore, \(\mathcal{S}^{*}\) cannot recognize \(m\) from \(e^{*},y_{1},y_{2},\xi_{1},\xi_{2}\), i.e., \(\mathcal{S}^{*}\) wins the experiment with probability \(1/2+\eta(n)\). Therefore, we prove the theorem. Before proving the one-more unforgeability of IDBS-NTRU, we will define some notations as follows:Let \(\delta_{1},\delta_{2},\delta_{3},\delta_{4}\) be simulating the cost functions of \(H\) hash, extract oracle, \(H^{{}^{\prime}}\) hash, and signature oracles respectively. Let \(\eta,\eta^{{}^{\prime}}\) be non-negligible probability, and \(t\) be time respectively, \(\Theta\) be a polynomial time algorithm, and \(\Gamma\) be a polynomial time forger. **Theorem 5** (One-more Unforgeability).