# An Identity-Based Anti-Quantum Privacy-Preserving Blind Authentication in Wireless Sensor Networks
## 3 Proposed IDBS-NTRU Scheme
### IDBS-NTRU Scheme  
In this section, we propose our IDBS scheme \(\varepsilon=(ST_{\varepsilon},EX_{\varepsilon},SG_{\varepsilon},\,VF_{ \varepsilon})\). Let \(\mathcal{U}\), \(\mathcal{S}\), \(\mathcal{V}\) be a user, a signer, and a verifier respectively, \(N\) and \(id\) be security parameter and user's identity respectively, \(\tilde{\Omega}(. )\) and \(Poly(N)\) be the asymptotic lower bound and \(N\)'s polynomial function respectively [13]. 1. \(ST_{\varepsilon}(1^{N})\) outputs \((params=(q,\varepsilon,s),mk=(sk,pk))\), in which \(q=Poly(N)\), \(\varepsilon\in(0,\frac{\ln N}{\ln q})\), and \(s=\tilde{\Omega}(N^{\frac{3}{2}}\sigma)\). If \(N>2\), then \(\sigma=N\sqrt{(\ln(8 Nq)}q^{\frac{1}{2}+\varepsilon}\), \(q^{1/2-\varepsilon}=\tilde{\Omega}(n^{\frac{7}{2}})\). If \(N=2\), then \(\sigma=\sqrt{N\ln(8 Nq)}q^{\frac{1}{2}+\varepsilon}\), \(q^{\frac{1}{2}-\varepsilon}=\tilde{\Omega}(N^{3})\). \(mk\) is generated as follows [13]: The algorithm samples \(f,g\) from \(\mathbf{D}_{Z^{N},s}\), which satisfy \(f,g\)_mod_\(q\
otin\mathbf{R}_{q}^{\times}\). Meanwhile, \(||f||,||g||\leq\sigma\sqrt{N}\) and \(<f,g>\in R\). Then the algorithm computes \(F_{1},G_{1}\in R\), which satisfy \(fG_{1}-gF_{1}=1\). We compute \(F_{q}=qF_{1},G_{q}=qG_{1}\), and then obtain \((F,G)\) by using babai algorithm in [11], which satisfies \((F,G)=(F_{q},G_{q})-k(f,g)\), \(k\in R\). If \(||(F,G)||\leq N\sigma\), then outputs \(\text{sk}=\mathbf{D}\)=\(\left( \begin{array}{cc}C(f)&C(g)\\ C(F)&C(G)\end{array} \right)\) and \(pk=h=gf^{-1}\in\mathbf{R}_{q}^{\times}\). 2. \(EX_{\varepsilon}(params,id,sk)\) computes \(t\gets H(id)\), and \(sk_{id}=(s_{1},s_{2})\leftarrow[(t,0)-Gausssian(sk,\sigma,(t,0))]\), in which \(s_{1}+s_{2}*h=t\). Then the algorithm outputs \(sk_{id}\) to user _[_13_]. 3. \(SG_{\varepsilon}\): Let \(m\in\{0,1\}^{*}\) be the plaintext, \(\mathcal{U}\) randomly selects \(\mathbf{y}_{1},\mathbf{y}_{2},\mathbf{\alpha},\mathbf{\gamma}\in\mathbf{D}_{Z^{N},s}\), then \(\mathcal{U}\) executes BS protocol in Figure 3. \[ \begin{array}{ll}\dfrac{\mathcal{S}(sk_{id})}{blind:}&\mathcal{U}(id,m,h) \\ &\dfrac{\mathbf{y}_{1},\mathbf{y}_{2},\mathbf{\alpha},\mathbf{\gamma}\in D_{Z^{N},s}}{\mathbf{e}=H^ {{}^{\prime}}(\mathbf{y}_{1}+h\mathbf{y}_{2}+h\mathbf{\gamma}+\mathbf{\alpha}-\mathbf{\alpha}H(id ),m)}\\ &\dfrac{\mathbf{e}^{*},\mathbf{y}_{1},\mathbf{y}_{2}}{\mathbf{\epsilon}\leftarrow}\\ Sign:&\begin{array}{l}\mathbf{\zeta}_{1}^{*}=\mathbf{y}_{1}+s_{1}\mathbf{e}^{*}\\ \mathbf{\zeta}_{2}^{*}=\mathbf{y}_{2}+s_{2}\mathbf{e}^{*}\\ \end{array}\\ &\dfrac{\mathbf{\zeta}_{1}^{*},\mathbf{\zeta}_{2}^{*}}{\mathbf{\zeta}_{1}^{*}\mathbf{\zeta}_{ 2}^{*}}\\ unblind:&\begin{array}{l}\mathbf{\zeta}_{1}=\mathbf{\zeta}_{1}^{*}+\mathbf{\alpha}\\ \mathbf{\zeta}_{2}=\mathbf{\zeta}_{2}^{*}+\mathbf{\gamma}\\ \mathbf{Signature\ tuple\ (m,\mathbf{e},\mathbf{\zeta}_{1},\mathbf{\zeta}_{2},id)\) \\ \end{array}}\\ unblind:&\begin{array}{l}\mathbf{\zeta}_{1}=\mathbf{\zeta}_{1}^{*}+\mathbf{\alpha}\\ \mathbf{\zeta}_{2}=\mathbf{\zeta}_{2}^{*}+\mathbf{\gamma}\\ \mathbf{Signature\ tuple\ (m,\mathbf{e},\mathbf{\zeta}_{1},\mathbf{\zeta}_{2},id)\) \\ \end{array}}\\ unblind:&\begin{array}{l}\mathbf{\zeta}_{1}=\mathbf{\zeta}_{1}^{*}+\mathbf{\alpha}\\ \mathbf{\zeta}_{2}=\mathbf{\zeta}_{2}^{*}+\mathbf{\gamma}\\ \mathbf{Signature\ tuple\ (m,\mathbf{e},\mathbf{\zeta}_{1},\mathbf{\zeta}_{2},id)\) \\ \end{array}}\\ \hline\end{array} \]
* \(\mathcal{U}\) computes \[\mathbf{e}=H^{{}^{\prime}}(\mathbf{y}_{1}+h\mathbf{y}_{2}+h\mathbf{\gamma}+\mathbf{\alpha}-\mathbf{ \alpha}H(id)),m)\] (1) and \[\mathbf{e}^{*}=\mathbf{e}-\mathbf{\alpha}\] (2) then \(\mathcal{U}\) sends \(e^{*}\) to \(\mathcal{S}\). Figure 3: Proposed IDBS-NTRU protocol. * \(\mathcal{S}\) computes Equations (3) and (4), then sends \(\mathcal{\zeta}_{1}^{*},\mathcal{\zeta}_{2}^{*}\) to \(\mathcal{U}\).