# A Watermarking Protocol Based on Blockchain
## 6 Protocol Analysis
### Analysis
#### 6.2.1 \(\mathcal{CP}\) is Corrupt
Therefore, if \(\mathcal{CP}^{c}\) encrypts the watermark to be inserted into \(X\) using the corrupt key \(pk^{X^{c}}_{\mathcal{RA}}\), it ends up generating the content \(\overline{\mathbb{E}}_{pk^{X^{c}}_{\mathcal{RA}}}(X))\). However, \(\mathcal{B}\) will employ the secret key \(sk^{X}_{\mathcal{RA}}\) to decrypt the received content \(\overline{\mathbb{E}}_{pk^{X^{c}}_{\mathcal{RA}}}(X))\) according to the Expression (3), thus generating a protected content containing an unknown and unpredictable watermark. In fact, this just damages \(\mathcal{CP}^{c}\), which ends up releasing a piece of content including a watermark that cannot be linked to any buyer. 3. If \(\mathcal{CP}^{c}\) receives the key \(pk^{X}_{\mathcal{RA}}\) from \(\mathcal{RA}\) in the message \(m_{3}\) and forwards the corrupt key \(pk^{X^{c}}_{\mathcal{RA}}\) to \(\mathcal{B}\) in the message \(m_{4}\), the key exchange is always disclosed by \(\mathcal{BC}\) unless \(\mathcal{CP}^{c}\) generates a valid signature \(\mathbb{S}_{\mathcal{RA}}(pk^{X^{c}}_{\mathcal{RA}},\ldots)\), which, as reported above, is impossible. This is because \(\mathcal{BC}\) comparesthe tokens received in the messages \(m_{6}\) and \(m_{7}\), and generates a new node in the blockchain only if the tokens turn out to be consistent. 4. For the same reason reported at the previous point, if \(\mathcal{CP}^{c}\) receives the encrypted nonce \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)\) from \(\mathcal{RA}\) in the message \(m_{3}\) and forwards the corrupt nonce \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N^{c})\) to \(\mathcal{BC}\) in the message \(m_{6}\), the nonce exchange is always disclosed by \(\mathcal{BC}\) unless \(\mathcal{CP}^{c}\) generates a valid signature \(\mathbb{S}_{\mathcal{RA}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X} _{\mathcal{R},\mathcal{A}}}(N^{c}))\), which, as reported above, is impossible. Therefore, suppose that \(\mathcal{B}\) starts a purchase transaction and that \(\mathcal{CP}^{c}\) receives the message \(m_{3}\) containing \(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}} (N)\), and \(\mathbb{S}_{\mathcal{RA}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X} _{\mathcal{R},\mathcal{A}}}(N))\) (see Table 2). Suppose also that \(\mathcal{CP}^{c}\) inserts a corrupt watermark \(W^{c}=W_{\mathcal{CP}}||N^{c}\) into the content \(X\), thus creating the protected copy \(\bar{X}^{c}\), and suppose that \(\bar{X}^{c}\) is found in the market. \(\mathcal{CP}^{c}\) starts the identification and arbitration protocol by extracting the watermark \(W^{c}\) from \(\bar{X}^{c}\) and by sending to \(\mathcal{J}\) all the tokens existing in its databases and associated to \(W^{c}\), according to what is reported in Section 5.2. Suppose that \(\mathcal{CP}^{c}\) wants to cheat \(\mathcal{J}\) in order to accuse a buyer of illegal content distribution. To achieve such a goal, \(\mathcal{CP}^{c}\) has to send, among the others, the following corrupt tokens \(pk^{X}_{\mathcal{R},\mathcal{A}}\), \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N^{c})\), \(\mathbb{S}_{\mathcal{RA}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X} _{\mathcal{R},\mathcal{A}}}(N^{c}))\), \(E_{pk_{\mathcal{R},\mathcal{A}}}(B_{id},pk^{X}_{\mathcal{R},\mathcal{A}}, \mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N^{c}))\) to \(\mathcal{J}\) (see Table 3), which have to be all coherent with \(N^{c}\).