## 5 Analyses
### Security Proof
If \(ID=\
eq ID^{*}\), \(\mathcal{F}\), randomly selects \(a,b,c\in Z_{q}^{*}\) and computes \(Q_{ID}=a.P\), \(\mathit{vpk}_{i}=b.P\), \(h_{2}=H_{2}(ID||Q_{ID})\gets c\), \(\mathit{psk}_{i}=a+x\mathit{h}_{2}\), \(\mathit{sk}_{i}=b\). Then \(\mathcal{F}\), responds to the query with \((ID,Q_{ID},\mathit{vpk}_{i},\mathit{psk}_{i},\mathit{sk}_{i},\mathit{h}_{2})\) and then appends \((ID,Q_{ID},\mathit{h}_{2})\) to the hash list \(L_{H_{2}}\). * \(H_{2}\) **Query**: Whenever an adversary \(\mathcal{A}_{2}\) makes an \(H_{2}\) query with \((ID,Q_{ID})\), and \(ID\) is already in the hash list \(L_{H_{2}}\), then \(\mathcal{F}\) reply with a corresponding \(h_{2}\). On the other hand, \(\mathcal{F}\) runs Create(\(ID\)) to obtain \(h_{2}\) and then sends \(h_{2}\) to \(\mathcal{A}_{2}\). * **Partial-Private-Key-Extract (\(ID\)) Query**: Upon receipt of the query on \(ID\), \(\mathcal{F}\) verifies from the hash list \(L_{C}\), if \(ID\) is found to be in the hash list \(\mathcal{F}\) returns \(\mathit{psk}_{i}\) to \(\mathcal{A}_{2}\). If \(ID\) is not in the hash list, \(L_{C}\), \(\mathcal{F}\) executes Create(\(ID\)) query to obtain \(\mathit{psk}_{i}\) and sends it to \(\mathcal{A}_{2}\). * **Public-Key (\(ID\)) Query**: Upon receipt of query on \(ID\), when \(ID\) is already in the list \(L_{C}\), \(\mathcal{F}\) replies with \(\mathit{pk}=(Q_{ID},\mathit{vpk}_{i})\). On the other hand, \(\mathcal{F}\) executes Create(\(ID\)) query to obtain \((Q_{ID},\mathit{vpk}_{i})\) and sends it to \(\mathcal{A}_{2}\). * **Secret-Key-Extract (\(ID\)) Query**: On receipt of the queries from \(\mathcal{A}_{2}\), if \(ID=ID^{*}\), \(\mathcal{F}\) stops the simulation. While, if \(ID\) is already in the list \(L_{C}\), then \(\mathcal{F}\) reply with \(\mathit{sk}_{i}\). Whereas if, \(ID\) is not in the list \(L_{C}\), \(\mathcal{F}\) executes Create(\(ID\)) query to obtain \((ID,Q_{ID},\mathit{vpk}_{i},\mathit{psk}_{i},\mathit{sk}_{i},\mathit{h}_{2})\) and sends \(\mathit{sk}_{i}\) to \(\mathcal{A}_{2}\). * \(H_{3}(ID)\) **Query**: \(\mathcal{F}\) keeps the hash list \(L_{H_{3}}\) of the tuple \((m,ID,R,\mathit{vpk}_{i},t,h_{3})\) and if the \(ID\) queries are in the list, \(\mathcal{F}\) replies with \(h_{3}\). Otherwise, it selects a random number \(h_{3}\) such that \(h_{3}=H_{3}(m||ID||vpk_{i}||R||t)\) then add it to the list \(L_{H_{3}}\) and returns \(h_{3}\) to \(\mathcal{A}_{2}\)
* **Sign (\(ID,m\)) Query**: As \(\mathcal{A}_{2}\) makes a sign query on \((ID,m)\), once \(ID\
eq ID^{*}\), \(\mathcal{F}\) acts according to protocol flow. Otherwise, \(\mathcal{F}\) randomly chooses the values \(a,b,f\in Z_{q}^{*}\) and sets \(s=a\), \(h_{3}=H_{3}(m||ID||pvk_{i}||R||t)\gets f\), \(R=h_{3}^{-1}(bP_{pub}^{*}-Q)\), and returns the signature \((R,s)\). If the verification, \(s.P=h_{3}.R+Q_{ID}+\mathit{vpk}_{i}+\mathit{hpk}_{i}-B_{pub}^{*}\), holds then the signature is valid. As a result, \(\mathcal{A}_{2}\) produces a forged signature \(\sigma=(R,s_{\{2\}})\) on the message \((ID,m)\) which passes verification process. If \(ID\
eq ID^{*}\), \(\mathcal{F}\) aborts the process. \(\mathcal{F}\) keeps on challenging \(\mathcal{A}_{2}\) up until it responds to the \(H_{3}\) query. \(\mathcal{A}_{2}\) will be prompted to generate another valid signature \(\sigma=(R,s_{\{2\}})\) by using the same \(R\). Thus we have: \[s_{\{i\}}.P=h_{3\{i\}}.R+vpk_{i}+Q_{ID}+h_{2}.P_{pub}^{*},\] (14) \[s_{\{i\}}=h_{3\{i\}}.r+y+d_{i}+h_{2}.x,\] (15) where \(i=1,2\). By solving the two linear equations involving \(r\) and \(y\) as variables, we can derive the value of \(y\) as an output of ECDL problem.