# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 6 Scheme Analysis and Proof
### Security Proof  
Suppose a probabilistic polynomial-time (PPT) adversary can perform \(q_{i}\) queries to \(H_{i}\) (for i = 1,2,3,4), \(q_{psk}\) partial private key queries, \(q_{l}\) private key queries, and \(q_{s}\) signature queries. (1) Confidentiality  
The proof of confidentiality is based on the Computational Diffie-Hellman (CDH) problem. Under the Random Oracle Model (ROM), if the Computational Diffie-Hellman (CDH) problem is intractable within polynomial time, then the proposed CLSC_SAT model is indistinguishable against Type I and Type II adversaries. Theorem 1 is proven through Lemmas 2 and 3. Under the ROM, if an adversary \(A_{I}\) has a non-negligible advantage \(\varepsilon\) against the security of the proposed scheme under IND-CLSC-CCA2-G1 game, then there exists a challenger \(C\) that can solve the CDH hard problem in probabilistic polynomial time. Proof. : Suppose that an adversary \(A_{I}\) could break the IND-CLSC-CCA2-G1 security of proposed CLSC_SAT scheme. Assume that \(C\) is a solver for the CDH problem. Given a CDH problem instance \((P,aP,bP)\), compute \(abP\) through interaction with \(A_{I}\). The challenger \(C\) selects an identity \(EID_{t}\) as the challenge identity and maintains the lists: \(L_{1},L_{2},L_{3},L_{4}\) record queries and responses for hash functions \(H_{i}(i=1,2,3,4)\). \(L_{u}\) records user creation list. \(L_{psk}\) records partial private key queries. \(L_{nk}\) records private key queries. \(L_{sc}\) records signcryption queries. All lists are initially empty. The interaction between \(A_{I}\) and \(C\) proceeds as follows. 1. Initialization Phase: \(C\) runs the initialization algorithm and sends the system public parameters \(PP=\{G,q,P,P_{pub},M_{pub},H,H_{1},H_{2},H_{3},H_{4}\}\) to \(A_{I}\). \(C\) computes \(P_{pub}=sP\) and secretly stores the master private key \(s\). 2. Query Phase: Phase I. \(A_{I}\) performs the following polynomial queries. User Creation: The challenger \(C\) maintains an initially empty list \(L_{u}\). When \(A_{I}\) queries an identity \(EID_{i}\), \(C\) first checks whether \(EID_{i}\) exists in \(L_{u}\). If it exists, \(C\) returns the public key \(PK_{i}\) of \(EID_{i}\) to \(A_{I}\). If \(EID_{i}\) does not exist and \(EID_{i}=EID_{t}\), \(C\) randomly selects \(g_{i},x_{i},h_{i,1}\in Z_{q}^{*}\), computes \(G_{i}=g_{i}P\), \(X_{i}=x_{i}P\), and \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\), while \(d_{i}=\bot\). If \(EID_{i}\
eq EID_{t}\), \(C\) randomly selects \(d_{i},x_{i},h_{i,1}\in Z_{q}^{*}\), computes \(G_{i}=d_{i}P-h_{i,1}P_{pub}\), \(X_{i}=x_{i}P\), and \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). Finally, \(C\) sends the public key \(PK_{i}\) to \(A_{I}\) and appends \((EID_{i},G_{i},X_{i},d_{i},x_{i})\) to \(L_{u}\). * \(H_{1}\) Query: \(A_{I}\) queries with identity \(EID_{i}\) for \((EID_{i},G_{i},P_{pub})\). \(C\) checks the \(L_{1}\) list. If \((EID_{i},G_{i},P_{pub})\) is in \(L_{1}\), \(C\) sends it to \(A_{I}\). Otherwise, \(C\) randomly selects \(h_{i,1}\in Z_{q}^{*}\), returns it to \(A_{I}\), and saves \((EID_{i},G_{i},P_{pub},h_{i,1})\) in the \(L_{1}\) list. * \(H_{2}\) Query: \(A_{I}\) queries with identity \(EID_{i}\) for \((EID_{i},X_{i},G_{i},P_{pub})\). \(C\) checks the \(L_{2}\) list. If \((EID_{i},X_{i},G_{i},P_{pub})\) is in \(L_{2}\), \(C\) sends it to \(A_{I}\). Otherwise, \(C\) randomly selects \(h_{i,2}\in Z_{q}^{*}\), returns it to \(A_{I}\), and saves \((EID_{i},X_{i},G_{i},P_{pub})\) in the \(L_{2}\) list. \(H_{3}\) Query: \(A_{I}\) queries with identity \(EID_{i}\) for \((U_{i},T_{i},X_{i},G_{i})\). \(C\) checks the \(L_{3}\) list. If \((U_{i},T_{i},X_{i},G_{i})\) is in \(L_{3}\), \(C\) sends it to \(A_{I}\). Otherwise, \(C\) randomly selects \(h_{i,3}\in Z_{q}^{*}\), returns it to \(A_{I}\), and saves \((U_{i},T_{i},X_{i},G_{i},h_{i,3})\) in the \(L_{3}\) list. \(H_{4}\) Query: \(A_{I}\) queries with identity \(EID_{i}\) for \((EID_{i},C_{i},X_{i},U_{i},t_{i})\). \(C\) checks the \(L_{4}\) list. If \((EID_{i},C_{i},X_{i},U_{i},t_{i})\) is in \(L_{4}\), \(C\) sends it to \(A_{I}\).