# A Redactable Blockchain Scheme Supporting Quantum-Resistance and Trapdoor Updates
## 3 Hierarchical Identity-Based Chameleon Hash with Revocable Subkey
### Syntax of HIBCH-RS
The experiment \(Expt^{RCF}_{\mathcal{A},HIBCH-RS}\) is described as follows: \(\text{Run}\leavevmode\
obreak\ P\text{,}\leavevmode\
obreak\ MK\leftarrow Setup(1^{n},q)\), \(\mathcal{Q}_{Forge}\)\(\coloneqq\)\(\emptyset\)\(\text{Run}\leavevmode\
obreak\ \mathbf{A}_{\mathbf{S}_{id_{i}}^{\prime}}\), \(\mathbf{S}_{id_{i}}\)\(\leftarrow\)\(SlaveKey\Big{(}1^{n},q,\mathbf{id_{i}}\Big{)}\) ; \(\text{Run}\leavevmode\
obreak\ \mathbf{F_{id_{i}}},\mathbf{R_{id_{i}}},\mathbf{E_{id_{i}}} \leftarrow\)\(\text{DelKey}\Big{(}\mathbf{A}_{\mathbf{S}_{id_{i}}^{\prime}},\mathbf{S}_{id_{i}^{\prime}}, \mathbf{id_{i}}\Big{)}\) ; \(\text{Define}\leavevmode\
obreak\ key_{id_{i}}:=\mathbf{F_{id_{i}}},\mathbf{R_{id_{i}}}, \mathbf{E_{id_{i}}}\); \(\text{Run}\leavevmode\
obreak\ \Big{(}\mathbf{h^{*}},\mathbf{r^{*}},\mathbf{M^{*}},\mathbf{r^{*}}, \mathbf{r^{*}},(str,\mathbf{ver})\Big{)}\leftarrow\mathcal{A}^{\mathcal{Q}_{Forge}( \cdot)}\Big{(}key_{id_{i}}\Big{)}\) ; \(\text{Define}\leavevmode\
obreak\ Hash_{M}\)\(\coloneqq\)\((\mathbf{h},\mathbf{r},M)\), \(Hash_{M^{*}}\)\(\coloneqq\)\(\Big{(}\mathbf{h^{*}},\mathbf{r^{*}},\mathbf{M^{*}}\Big{)}\); If \(\mathbf{r^{*}}\
eq\bot\), \(Check^{CH}_{PP,key_{id_{i}}}(Hash_{M},Hash_{M^{*}})=1\) and \(\Big{(}\mathbf{h^{*}},\mathbf{M^{*}},(str,\mathbf{ver})\Big{)}\
otin\mathcal{Q}_{Forge}\): return 1; otherwise: return 0. The \(\mathcal{Q}_{Forge}\) is defined as follows: \(\text{If}\leavevmode\
obreak\ Check^{V\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\! \!\!\!\!\!\!\! * \(Update(1^{n},q,\mathbf{RL})\): If the key is found to be exposed or an illegitimate edit request, then the algorithm is executed to update the key for the edit member. The parent node updates a reversible tag \(\mathbf{H^{\prime}_{\mathbf{\ell}}}\) by the algorithm of [32] 6.1. Then, the slave key pair is updated to \(\mathbf{S^{\prime}_{id_{\mathbf{\ell}}}}\) and \(\mathbf{A^{\prime}_{\mathbf{s}_{\mathbf{id_{\mathbf{\ell}}}}}}=\left[\overline{A}_{\mathbf{s}_{id_{ \mathbf{\ell}}}}\left|\mathbf{H^{\prime}_{\mathbf{\ell}}}\mathbf{G}-\overline{A}_{\mathbf{s}_{id_{ \mathbf{\ell}}}}\cdot\overline{A}_{\mathbf{s}_{id_{\mathbf{\ell}}}}\right|modq\right.\) and the ID of the revoked key is appended to \(\mathbf{RL}=\left\{\mathbf{id_{\mathbf{\ell}}},\ldots,\mathbf{id_{\mathbf{j}}},\mathbf{id_{\mathbf{\ell}}} \right\}\), so \(\mathbf{RL}^{\prime}=\left\{\mathbf{id_{\mathbf{\ell}}},\ldots,\mathbf{id_{\mathbf{j}}},\mathbf{id_{ \mathbf{\ell}}}\right\}\). The algorithm outputs new tag \(\mathbf{H^{\prime}_{\mathbf{\ell}}}\) and \(\mathbf{RL}^{\prime}\) to generate a new key for the user. * \(CH(\mathbf{A},\mathbf{M},\mathbf{E})\): Input public parameter \(PP=(\mathbf{A},\mathbf{E})\) and message \(M\), compute chameleon hash and verification pair. If a transaction is identified as public-modifiable, then we use \(PP\) to calculate the hash value. Let \(\mathbf{c}=H_{M}(M)\) where \(H_{M}:\{0,1\}^{*}\rightarrow\{0,1\}^{\overline{m}}\), sample \(\mathbf{r}\leftarrow_{R}D_{2\overline{m},\sigma}\), compute the chameleon hash of message \(M\) as: \(\mathbf{h}=\mathbf{Ar}+\mathbf{E}^{T}\mathbf{c}\mathbf{\ }mod\ q\); \(str=\bot\), \(\mathbf{ver}=\bot\). If a transaction is identified as belonging to an individual, then we give editing rights to the individual. Suppose this transaction belongs to \(\mathbf{id_{\mathbf{\ell}}}\), then \(\mathbf{id_{\mathbf{\ell}}}\) calculates an extra verification pair and fills them into the block. In other words, select randomly \(\mathbf{u_{id_{\bm