# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 5 Concrete Scheme
### Specific Transaction Process
Transaction user randomly selects \(e_{i}\in Z_{q}^{*}\). 2. Calculate \(EID_{i,1}=e_{i}P\). 3. Calculate \(a_{i}=e_{i}M_{pub}\oplus RID_{i}\). 4. Send \(\{\alpha_{i},EID_{i,1}\}\) to MR.  
5. MR calculates  
\(RID_{i}=\alpha_{i}+rEID_{i,1}\) and \(EID_{i,2}=RID_{i}\oplus H(rEID_{i,1}||EID_{i,1}||M_{pub}||VM_{i})\). 6. Generate anonymous address of transaction user \(addr_{i}=EID_{i}=\{EID_{i,1},EID_{i,2}\}\). 7. Send \((EID_{i})\) to KGC. 8. MR Creates the user anonymous identity tracing table EIDList. **Algorithm 2**. User registration and anonymous identity address generation algorithm. (3) \(CreateRey(PP)\to(PK_{R}=(n,g),SK_{R}=\lambda)\): Algorithm 3 is invoked by the regulatory authority. The authority randomly selects two large primes \(p_{1}\) and \(q_{1}\), computes \(N=p_{1}\cdot q_{1}\), and \(\lambda=lcm(p_{1}-1,q_{1}-1)\). A parameter \(g\) is chosen from \(g\in Z_{p_{2}}^{*}\), where \(Z_{p_{2}}^{*}\) is defined as the multiplicative group of integers modulo \(n^{2}\) (see Section 3.2 for details). The parameter \(g\) must satisfy \(\gcd(L(g^{\lambda}\bmod N^{2}),N)=1\), where the function \(L(x)\) is defined in Section 3.2. The regulatory authority generates the regulatory public key \(PK_{R}=(n,g)\) and the regulatory private key \(SK_{R}=\lambda\), and publishes \(PK_{R}\). Input: PP  
Output: \(PK_{R}\), \(SK_{R}\)  
1. The regulator chooses two large prime numbers \(p_{1}\) and \(q_{1}\). 2. Calculate \(N=p_{1}\cdot q_{1}\). 3. Calculate \(\lambda=lcm(p_{1}-1,q_{1}-1)\). 4. Choose the parameter g from \(Z_{q_{1}}^{*}\) so that it satisfies \(\gcd(L(g^{\lambda}\bmod N^{2}),N)=1\). 5. Generate the supervisory public key \(PK_{R}=(n,g)\) and the supervisory private key \(SK_{R}=\lambda\). 6. Disclose the public key of supervision \(PK_{R}\). (4) \(SetPartialKey(EID_{i})\rightarrow(PK_{G}=G_{i},SK_{G}=d_{i})\): Algorithm 4 is invoked by the KGC. The KGC randomly selects \(g_{i}\in Z_{q}^{*}\), computes \(G_{i}=g_{i}P\), and calculates the transaction user's partial private key \(d_{i}=g_{i}+h_{i,1}s\), where \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). Subsequently, the KGC sends \((G_{i},d_{i})\) and \(EID_{i}\) to the user through a secure channel. The KGC generates partial key pairs \((G_{A},d_{A})\) and \((G_{B},d_{B})\) for [PERSON] and [PERSON], respectively. (5) \(SetKey(EID_{i},(PK_{G},SK_{G}))\rightarrow(PK_{i}=(G_{i},X_{i}),SK_{i}=(x_{i},d_{i}))\): Algorithm 5 is invoked by [PERSON] and [PERSON] separately. First, the user receives \((G_{i},d_{i})\), computes \(h_{i,1}^{\prime}=H_{1}(EID_{i},G_{i},P_{pub})\), and checks whether the equation \(d_{i}P=G_{i}+h_{i,1}Ppub\) holds. If it holds, the user accepts \(d_{i}\); otherwise, the user requests a new partial private key from the KGC. Subsequently, the user randomly selects \(x_{i}\in Z_{q}^{*}\), computes \(X_{i}=x_{i}P\), and generates the complete key pair. [PERSON] and [PERSON], following the above method, select \(x_{A}\in Z_{q}^{*}\) and \(x_{B}\in Z_{q}^{*}\) respectively, compute \(X_{A}=x_{A}P\) and \(X_{B}=x_{B}P\), and obtain their complete key pairs: \((PK_{A}=(G_{A},X_{A}),SK_{A}=(x_{A},d_{A}))\), \((PK_{B}=(G_{B},X_{B}),SK_{B}=(x_{B},d_{B}))\). Input: PP, \((G_{i},d_{i})\)  
Output: \((X_{i},x_{i})\), \((PK_{i},SK_{i})\)  
1. Calculate \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). 2. Calculate \(d_{i}P=G_{i}+h_{i,1}P_{pub}\). 3. User randomly selects \(x_{i}\in Z_{q}^{*}\). 4. Calculate \(X_{i}=x_{i}P\). 5. Generate \((X_{i},x_{i})\). 6. Generate \((PK_{i},SK_{i})\). **Algorithm 5. ** User key generation algorithm. (6) \(CreateTx(EID_{i_{1}},PK_{i_{1}},SK_{i_{1}},v_{0},EID_{i_{2}},PK_{i_{2}},PK_{R}) \to tx_{send}\): Algorithm 6 is invoked by [PERSON].