## 5 Analyses
### Security Proof
* \(H_{3}(ID)\) **Query**: \(\mathcal{F}\) keeps the hash list \(L_{H_{3}}\) of the tuple \((m,ID,R,\
u pk_{i},t,h_{3})\) and if the \(ID\) queries are not in the list, \(\mathcal{F}\) replies with \(h_{3}\). Otherwise, it selects a random number \(h_{3}\) such that \(h_{3}=H_{3}(m||ID||vpk_{i}||R||t)\) then add it to the list \(L_{H_{3}}\) and returns \(h_{3}\) to \(\mathcal{A}_{1}\)
* **Sign (\(ID,m\)) Query**: \(\mathcal{A}_{1}\) makes a sign query on \((ID,m)\), once \(ID\) is on the list \(L_{R}\), \(\mathcal{F}\) chooses random numbers \(a,b,c\in\mathcal{Z}_{q}^{*}\), and sets \(s=a,R=P,h_{3}=H_{3}(m||ID||vpk_{i}||R||t)\)\(\leftarrow(a-b-c)modq\) and then inserts \((m,ID,R,\
u pk_{i},t,h_{3})\) to the list \(L_{H_{3}}\). The resultant signature is \((R,s)\), and if \(ID\) is not in the list \(L_{R}\), then \(\mathcal{F}\) acts according to scheme's procedure. As a result, \(\mathcal{A}_{1}\) produces a forged signature \(\sigma=(R,s_{\{1\}})\) on the message \((ID,m)\) which passes verification process. If \(ID\
eq ID^{*}\), \(\mathcal{F}\) aborts the process. \(\mathcal{F}\) keeps on challenging \(\mathcal{A}_{1}\) up until it responds to the \(H_{3}\) query. \(\mathcal{A}_{1}\) will be prompted to generate another valid signature \(\sigma=(R,s_{\{2\}})\) by using the same \(R\). Thus we have:  
\[s_{\{i\}}.P=h_{3\{i\}}.R+\
u pk_{i}+Q_{ID}+h_{2}.P_{pub}^{*}, \tag{11}\]  
where \(i=1,2\). By solving the two linear equations we obtain the value of \(r\) by  
\[\frac{s_{2}-s_{1}}{h_{\{2\}}-h_{\{1\}}}, \tag{12}\]  
similarly, with continuous querying, \(H_{2}\) will allow computation of \(x\). **Probabilistic Analysis**: The simulation of Create(\(ID\)) queries fails when the random oracle assignment \(H_{2}(ID||Q_{ID})\) causes inconsistency with the probability of at most \(\frac{q_{h}}{q}\). The probability of successful simulation of \(q_{c}\) times is at least \((1-\frac{q_{h}}{q})^{q_{c}}\geq 1-(\frac{q_{h}q_{c}}{q})\). Similarly, the simulation is \(q_{h}\) successful with the probability of at least \((1-\frac{q_{h}}{q})^{q_{h}}\geq(1-\frac{q_{h}^{2}}{q})\) and \(ID=ID^{*}\) with the probability of \(\frac{1}{q_{c}}\). Thus, in overall the probability of successful simulation is  
\[(1-\frac{q_{h}q_{c}}{q})(1-\frac{q_{h}^{2}}{q})(\frac{1}{q_{c}})e. \tag{13}\]  
Under the assumption that ECDL in \(G\) is intractable, then the proposed scheme \((\epsilon,t,q_{c},q_{s},q_{h})\), is secure against adversary 2 in random oracle model, where \(q_{c},q_{s},q_{h}\) are the **Create**, **Sign** and **Hash** queries respectively which the adversary is allowed to make. Proof. : Suppose there is a probabilistic polynomial time adversary \(\mathcal{A}_{2}\), we construct an algorithm \(\mathcal{F}\) that solves the ECDL problem by utilizing \(\mathcal{A}_{2}\). Assume that \(\mathcal{F}\) is given a ECCDH problem instance, \((P,Q)\) to compute \(x,y\in Z_{q}^{*}\) so that \(Q=xyP\). Thus, \(\mathcal{F}\) chooses an challenging identity \(ID^{*}\) for the identity \(ID\) to answer any random queries from \(\mathcal{A}_{2}\) as follows:  
* **Set-up (\(ID\)) Query**: The challenger \(\mathcal{F}\) selects its random numbers \(\alpha^{*}\) and \(\beta^{*}\) as its master keys and has a corresponding public key as \(P_{pub}^{*}=\alpha^{*}P\) and \(T_{pub}^{*}=\beta^{*}P\) then sends the system parameters \(\{P,p,q,E,G,H_{2},H_{3},P_{pub}^{*},T_{pub}^{*}\}\) to \(\mathcal{A}_{2}\). * **Create (\(ID\)) Query**: \(\mathcal{F}\) stores the hash list \(L_{C}\) of the tuple \((ID,Q_{ID},\mathit{vpk}_{i},\mathit{psk}_{i},\mathit{sk}_{i},\mathit{h}_{2})\). Whenever an adversary \(\mathcal{A}_{2}\) makes a query for \(ID\), and if the \(ID\) is contained in \(L_{C}\), then \(\mathcal{F}\) returns \((ID,Q_{ID},\mathit{vpk}_{i},\mathit{psk}_{i},\mathit{sk}_{i},\mathit{h}_{2})\) to \(\mathcal{A}_{2}\). If \(ID=ID^{*}\), \(\mathcal{F}\) randomly selects \(a,b\in Z_{q}^{*}\) and computes \(Q_{ID}=aP\), \(\mathit{vpk}_{i}=Q\), \(\mathit{h}_{2}=H_{2}(ID||Q_{ID})\gets b\), \(\mathit{psk}_{i}=a+x\mathit{h}_{2}\), \(\mathit{sk}_{i}=\bot\).