# An Identity-Based Anti-Quantum Privacy-Preserving Blind Authentication in Wireless Sensor Networks
## 4 Analyzing the Security and Performances
### Correctness, Blindness and One-More Unforgeability
: _If \(\Gamma\) is able to generate a legal signature with \(\eta\) in \(t\), after at most \(\tau_{1}\), \(\tau_{2}\), \(\tau_{3}\), \(\tau_{4}\) times queries respectively to \(H\) hash, Extract, \(H^{{}^{\prime}}\) hash, and signature oracles. Then \(R\)-\(SIS_{q,1,2,\beta}^{\kappa}\) can be solved by \(\Theta\) with probability at least \(\eta^{{}^{\prime}}=(1-2^{-\omega(logN)})\eta\) in time \(t^{{}^{\prime}}=t+\tau_{1}^{\tau_{2}}(\tau_{1}\delta_{1}+\tau_{2}\delta_{2})+ \tau_{3}^{\tau_{4}}(\tau_{3}\delta_{3}+\ \tau_{4}\delta_{4})\)._  
Proof. : Assuming an adversary \(\Gamma\) is able to produce an IDBS signature with \(\eta\), we can construct \(\Theta\), this algorithm can obtain the solution of R-\(SIS\) on the NTRU lattice. The followings are the simulated interactive environment. ST: \(\Theta\) selects \(h\in R_{q}^{\times}\), \(H,H^{{}^{\prime}}\) at random. Then \(\Theta\) computes and sends the public parameters \(paras=\{h,H,H^{{}^{\prime}},\epsilon,q,s\}\) to the \(\Gamma\). H oracle Queries: \(\[PERSON]\) will maintains a list \(L_{h}\), in the beginning, the list is null. Once receiving an \(id_{i}\), \(\[PERSON]\) will inquire \(L_{h}\). If there exists a corresponding hash value \(t_{i}\), \(\[PERSON]\) will return \(t_{i}\). Otherwise \(\[PERSON]\) will return a random value. After that, \(\[PERSON]\) will save \(id_{i}\), \(t_{i}\) in \(L_{h}\). H\({}^{\prime}\) oracle Queries: \(\[PERSON]\) maintains a list \(L_{h}^{{}^{\prime}}\), in the beginning, the list is null. Once receiving \(m_{i}\), \(\Lambda_{i}=y_{1_{i}}+hy_{2_{i}}+h\gamma_{i}+\alpha_{i}-\alpha_{i}H(id_{i})\), we assume \(\Theta\) has already quite H oracle and gotten an entry \(id_{i},t_{i}\). Then \(\Theta\) will quite \(L_{h}^{{}^{\prime}}\). If there already exists a corresponding hash value \(e_{i}\), \(\Theta\) will return \(e_{i}\). Otherwise, \(\Theta\) will return a random value. After that, \(\Theta\) will save \(m_{i}\), \(\Lambda_{i},y_{1_{i}},y_{2_{i}},\gamma_{i},\alpha_{i},id_{i},e_{i},t_{i}\) to \(L_{h}^{{}^{\prime}}\). EX Oracle Queries: \(\Theta\) maintains a list \(L_{id}\), in the beginning, the list is null. Once receiving an identity \(id_{i}\), \(\Theta\) will inquire \(H\) oracle. If there does not exist a corresponding hash value in \(L_{id}\), \(\Theta\) will randomly selects a \(t_{i}\) and return it. Otherwise, return the corresponding \(t_{i}\). After that, \(\Theta\) can get a \(sk_{id_{i}}=(s_{1_{i}},s_{2_{i}})\), \(\Theta\) returns \(sk_{id_{i}}\) to \(\Gamma\) as the private key related with \(id_{i}\) and saves the tuple \((id_{i},t_{i},sk_{id_{i}})\) in \(L_{id}\). SG Oracle Queries: \(\Gamma\) queries the signing oracle for \((m_{i},id_{i})\). \(\[PERSON]\) checks if \(id_{i}\) is already queried for \(H\), \(H^{{}^{\prime}}\) or extraction oracles. If it is, \(\Theta\) can get an entry \((id_{i},t_{i},sk_{id_{i}})\) from \(L_{id}\). Else \(\Theta\) simulates the extraction oracle and obtain a new secret key. Then \(\Theta\) executes the BS protocol to obtain a valid signature \((m_{i},id_{i},e_{i},\zeta_{1_{i}},\zeta_{2_{i}})\) and stores the value \((m_{i},id_{i},e_{i},\zeta_{1_{i}},\zeta_{2_{i}})\) in the list \(L_{S}\). Output: Finally, \(\Gamma\) firstly outputs a forged signature \((e_{i},\zeta_{1_{i}},\zeta_{2_{i}},m_{i},id_{i})\). \(\Theta\) rewinds \(\Gamma_{i}\) to the point where it queries \(H^{{}^{\prime}}\) for \((m_{i},id_{i})\) and obtains another signature \((e_{i}^{{}^{\prime}},\zeta_{1_{i}^{\prime}}^{{}^{\prime}},\zeta_{2_{i}}^{{}^{ \prime}},m_{i},id_{i})\). Therefore, \(\Theta\) can solve R-\(SIS_{q,1,2,\beta}^{\kappa}\) problem over the NTRU lattice. \(\Theta\) obtains \(sk_{id_{i}}\) and \(e_{i}^{{}^{\prime}},y_{1_{i}},y_{2_{i}},\alpha_{i},\gamma_{i}\) from the \(L_{S}\). \(\Theta\) computes \(\zeta_{1_{i}}=y_{1_{i}}+s_{1_{i}}*e_{i}^{*}+\alpha_{i},\zeta_{2_{i}}=y_{2_{i}}+ s_{2_{i}}*e_{i}^{*}+\gamma_{i}\), and \(\zeta_{1_{i}}+\zeta_{2_{i}}*h-H(id_{i})e_{i}\).