# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 6 Scheme Analysis and Proof
### Security Proof
If \(EID_{i}=EID_{t}\), \(C\) randomly selects \(\Omega\in\{0,1\}\) and performs the following steps:
* \(C\) retrieves \(EID_{i}^{*}\)'s public key \(PK_{i}^{*}\) from \(L_{uk}\). * Sets \(U_{i}^{*}=b_{i}P\), where \(bP\) is an instance of the CDH problem. * Computes \(T_{i}^{*}=b(X_{j}+G_{j}+h_{j,2}P_{pub})\), where \(h_{j,2}=(EID_{j},X_{j},G_{j},P_{pub})\). * Randomly selects \(r_{1},h_{i,3},h_{i,4}\in Z_{q}^{*}\) and computes \(C_{i,1}^{*}=g^{v_{\Omega}}r_{1}^{n}\) mod \(n^{2}\) and \(C_{i,2}^{*}=v_{\Omega}\oplus h_{j,2}\). * \(C\) obtains private keys \(x_{i}^{*},d_{i}^{*}\) via private key queries and computes \(S_{i}^{*}=u_{i}+h_{i,3}x_{i}^{*}+h_{i,4}d_{i}^{*}\). * \(C\) sends \(\sigma^{*}=\{U_{i}^{*},S_{i}^{*},C_{i,1}^{*},C_{i,2}^{*}\}\) to \(A_{I}\). Phase II. As same in Phase I, \(A_{I}\) asks a series of questions that continue to interact with Challenger C, but \(A_{I}\) cannot issue private key queries for \(EID_{j}\), nor can it issue unsigncrypption queries on \(\sigma^{*}\). 4. Guessing Phase: If \(A_{I}\) can break the IND-CLSC-CCA2-G1 security of the scheme, it must have queried \(H_{3}\) for the tuple \((U^{*},T^{*},X_{j}^{*},G_{j}^{*})\). If \(A_{I}\) outputs a valid \(T_{i}^{*}\), the challenger C extracts the solution to the CDH problem \(sbP=(T_{i}-u_{i}X_{j}-u_{i}G_{j})/h_{j,2}\), where \(T_{i}=u_{i}(X_{j}+G_{j}+h_{j,2}P_{pub})=b(X_{j}+G_{j}+h_{j,2}sP)\) and \(P_{pub}=sP\). \(\Box\)  
Lemma 3: _Under the ROM, if an adversary \(A_{II}\) has a non-negligible advantage \(\epsilon\) against the security of the proposed scheme under IND-CLSC-CCA2-G2 game, then there exists a challenger C that can solve the CDH hard problem in probabilistic polynomial time._  
Proof: Suppose that an adversary \(A_{II}\) could break the IND-CLSC-CCA2-G2 security of proposed CLSC_SAT scheme. Assume that C is a solver for the CDH problem. Given a CDH problem instance \((P,aP,bP)\), compute \(abP\) through interaction with \(A_{II}\). The challenger C selects an identity \(EID_{t}\) as the challenge identity and maintains the same lists \(L_{1},L_{2},L_{3},L_{4},L_{u},L_{psk},L_{uk},L_{sc}\) as in GAME1. All lists are initially empty. The interaction between \(A_{II}\) and \(C\) proceeds as follows. 1. Initialization Phase: The challenger C runs the initialization algorithm and sends \(PP=\{G,q,P,P_{pub},M_{pub},H,H_{1},H_{2},H_{3},H_{4}\}\)\(H_{1},H_{2},H_{3},H_{4}\}\) and the master key \(s\) to the adversary \(A_{II}\), computing \(P_{pub}=sP\). 2. Query Phase: Phase I. \(A_{II}\) performs the following polynomial queries. User Creation: The challenger C maintains an initially empty list \(L_{u}\). When \(A_{II}\) queries an identity \(EID_{i}\), [PERSON] first checks whether \(EID_{i}\) exists in \(L_{u}\). If it exists, [PERSON] returns the public key \(PK_{i}\) of \(EID_{i}\) to \(A_{II}\). If \(EID_{i}\) does not exist, C randomly selects \(g_{i},h_{i,1}\in Z_{q}^{*}\), computes \(G_{i}=g_{i}P\), \(d_{i}=g_{i}+h_{i,1}s\) mod \(q\) and sets \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). If \(EID_{i}\
eq EID_{t}\), C randomly selects \(x_{i}\in Z_{q}^{*}\), computes \(X_{i}=x_{i}P\) and \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). If \(EID_{i}=EID_{t}\), C sets \(x_{i}=\bot\), \(X_{i}=x_{i}P\). Finally, [PERSON] sends the public key \(PK_{i}\) to \(A_{II}\) and appends \((EID_{i},G_{i},X_{i},d_{i},x_{i})\) to \(L_{u}\). * \(H_{1},H_{2},H_{3},H_{4}\): Same as Lemma 2. * Partial Private Key Query: [PERSON] maintains a list \(L_{psk}=(EID_{i},G_{i},d_{i})\). When \(A_{II}\) queries with identity \(EID_{i}\), if \(EID_{i}=EID_{t}\), [PERSON] terminates the simulation. Otherwise, [PERSON] searches for the corresponding \((G_{i},d_{i})\) in the list \(L_{psk}\). If it exists, [PERSON] returns \((G_{i},d_{i})\) to \(A_{II}\). If it does not exist, [PERSON] randomly selects \(g_{i}\in Z_{q}^{*}\), computes \(G_{i}=g_{i}P\), \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\) and \(d_{i}=g_{i}+h_{i,1}{\rm mod}q\). [PERSON] then sends \((G_{i},d_{i})\) to \(A_{II}\) and saves \((EID_{i},G_{i},d_{i})\) in the \(L_{psk}\) list.