# An Identity-Based Anti-Quantum Privacy-Preserving Blind Authentication in Wireless Sensor Networks
## 2 Preliminaries
### Idbs  
An IDBS scheme consists of four algorithms(\(ST_{\epsilon},EX_{\epsilon},SG_{\epsilon},VF_{\epsilon}\)), \(\mathcal{U}\), \(\mathcal{S}\), and \(\mathcal{V}\) are denoted as user, signer, and verifier respectively. Master key, master public key, and master private key are severally written as \(mk\), \(mpk\), and \(msk\). System parameters are denoted as \(params\), \(n\) is the security parameter. The definition is described as follows.  
* \(ST_{\epsilon}(1^{n})\): after inputting \(n\), this algorithm outputs \(params\) and \(mk\), which contains \(mpk\) and \(msk\).
* \(EX_{\epsilon}(params,msk,id)\): after inputting \(params\), \(msk\), \(id\), this algorithm outputs private key \(sk_{id}\) related to \(id\).  
* \(SG_{\varepsilon}(id,m,sk_{id})\): \(\mathcal{U}\) interacts with \(\mathcal{S}\) as follows: 1. \(\mathcal{U}\) blinds the message \(m\) to \(m^{{}^{\prime}}\) by using blind factor, then sends \(m^{{}^{\prime}}\) to \(\mathcal{S}\). 2. \(\mathcal{S}\) signs on \(m^{{}^{\prime}}\) and sends the signature \(\sigma^{{}^{\prime}}\) to \(\mathcal{U}\). 3. \(\mathcal{U}\) unblinds \(\sigma^{{}^{\prime}}\) and gets \(\sigma\). The signature tuple is \((m,\sigma)\).
* \(VF_{\varepsilon}(params,id,m,\sigma)\): this algorithm returns true if \(\sigma\) is valid, otherwise returns false.  
Before introducing the security properties of IDBS, we define some notations firstly. \(\Gamma\) is denoted as an adversary, \(U\) is normalicious users, \(m\) is the plaintext message, \(c,n\) are denoted as a constant and a big integer respectively, \(\eta\) is a negligible probability, \(t\) is the time.  
IDBS should achieve two properties, which are defined as follows [30; 31]:  
_Blindness_[32]: \(\Gamma\) chooses two messages \(m_{0},m_{1}\), then a random bit \(i\) is selected, \(m_{0},m_{1}\) are randomly denoted as \(m_{i},m_{1-i}\), \(m_{i},m_{1-i}\) are the inputs of two honest users respectively. \(\Gamma\) plays the Experiment 1 with these two users, \(\sigma_{i},\sigma_{1-i}\) are the outputs of them respectively. \(\sigma_{i},\sigma_{1-i}\) are dispatched to \(\Gamma\), after that, \(\Gamma\) will output a bit \(p\in\{0,1\}\). Finally, the probability of \(p=i\) is denoted as \(|Pr[p=i]-1/2|<\eta(n)\). i.e., if no \(\Gamma\) can win the Experiment 1 at the minimum with \(\eta\) in \(t\), then it satisfies blindness.  
_One-more unforgeability_[4]: after \(\Gamma\) interacts with a nonmalicious signer for \(l\) times, he tries to forge the \(l+1\) valid signature with \(\eta\). The game is defined in Experiment 2. i.e., if \(\Gamma\) cannot win the Experiment 2 with \(\eta\) at most \(\tau_{1},\tau_{2},\tau_{3}\) times respectively for extraction, hash, and signature oracles in \(t\), then the scheme satisfies one-more unforgeability.  
```
\(i\in_{\mathcal{S}}\{0,1\}\) \((params,msk)\gets ST(1^{n})\) \(sk_{id}\gets EX(params,id,msk)\) \((m_{0},m_{1},state_{find})\leftarrow\mathcal{S}^{*}(find,sk_{id},id)\) \(state_{issue}\leftarrow_{\mathcal{S}}\mathcal{S}^{*,\mathcal{U}(id,m_{i})^{ *}>,\mathcal{U}(id,m_{i-i})^{*}>}(issue,state_{find})\) \(\delta_{i}\), \(\delta_{1-i}\) are respectively \(\mathcal{U}(id,m_{i}),\mathcal{U}(id,m_{1-i})\)'s outputs if\(\delta_{0}\
eq fail\) and \(\delta_{1}\
eq fail\)then \(p\leftarrow_{\mathcal{S}}\mathcal{S}^{*}(guess,\delta_{0},\delta_{1},state_{ issue})\) else \(p\leftarrow_{\mathcal{S}}\mathcal{S}^{*}(guess,fail,fail,state_{issue})\) endif  return true iff \(p=i\)
```  
**Experiment 2**\(Expt_{\mathcal{U}^{\prime}}^{\mathit{off}}(n)\).  
```
\((params,msk)\gets ST(1^{n})\) \(sk_{id}\gets EX(params,id,msk)\) \(\{(m_{1},s_{1}),...,(m_{k},s_{k})\}\leftarrow_{\mathcal{S}}\mathcal{U}^{ \mathit{sh}(\cdot),<S(sk_{id}),>^{m}}(id)\) \(l\) is the successful interaction number between \(\mathcal{U}^{*}\) and signer return true iff \(m_{i}\
eq m_{j}\) for \(1\leq i<j\leq k\) and \(VF(m_{i},s_{i},id)=1\) and \(l+1=k\)
```  
**Algorithm 2**\(Expt_{\mathcal{U}^{\prime}}^{\mathit{off}}(n)\).