# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 6 Scheme Analysis and Proof
### Security Proof
* Private Key Query: Same as GAME1. * Public Key Query: [PERSON] maintains a list \(L_{uk}=(EID_{i},G_{i},d_{i},x_{i},X_{i})\). When \(A_{II}\) executes t query with identity \(EID_{i}\), C searches the list for the corresponding \((G_{i},X_{i})\). If finds, C returns \((G_{i},X_{i})\) to \(A_{II}\). Otherwise, if \(EID_{i}=EID_{i}^{*}\), C randomly selects \(g_{i},h_{i,1}\in Z_{q}^{*}\), computes \(G_{i}=g_{i}P\), \(X_{i}=xP\), and sets \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). Then sends \((G_{i},X_{i})\) to \(A_{II}\). And stores \((EID_{i},G_{i},X_{i},d_{i},\bot)\) in \(L_{u}\), stores \((EID_{i},G_{i},P_{pub},h_{i,1})\) in \(L_{1}\). If \(EID_{i}\
eq EID_{t}\), C randomly selects \(g_{i},h_{i,1},x_{i}\in Z_{q}^{*}\), computes \(X_{i}=x_{i}P\), \(G_{i}=g_{i}P\) and sets \(h_{i,1}=H_{1}(EID_{i},G_{i},P_{pub})\). Then sends \((G_{i},X_{i})\) to \(A_{II}\). And stores \((EID_{i},G_{i},X_{i},d_{i},x_{i})\) in \(L_{u}\), stores \((EID_{i},G_{i}^{\prime},d_{i},\bot,X_{i}^{\prime})\). * Public Key Replacement Query: When \(A_{II}\) queries with \((EID_{i},PK_{i}^{\prime})\), if \(EID_{i}=EID_{t}\), \(C\) terminates the simulation. Otherwise, C finds \(L_{uk}=(EID_{i},G_{i},d_{i},x_{i},X_{i})\) and replaces it with \((EID_{i},G_{i}^{\prime},d_{i},\bot,X_{i}^{\prime})\). \(\bullet\) Signcryption Query: Same as Lemma 2. \(\bullet\) Unsigncryption Query: Same as Lemma 2. \(\bullet\) Challenge Phase: Same as Lemma 2. Phase II. As same in Phase I, \(A_{II}\) asks a series of questions that continue to interact with Challenger \(C\), but \(A_{II}\) cannot issue a private key query for the receiver \(EID_{j}\), nor can it issue unsigncryption queries on \(\sigma^{*}\). Guess Phase: If \(A_{II}\) can break the IND-CLSC-CCA2-G2 security of the scheme, it must have queried \(H_{3}\) for the tuple \((U^{*},T^{*},X^{*}_{j},G^{*}_{j})\). If \(A_{I}\) outputs a valid \(T^{*}_{i}\), the challenger \(C\) extracts the solution to the CDH problem \(x_{j}bP=T_{i}-u_{i}d_{j}P\), where \(T_{i}=U_{i}(x_{j}+d_{j})=U_{i}(b+d_{j})=bx_{j}P+U_{i}d_{j}\). \(\square\)  
(2) Unforgeability  
**Theorem 2**. : _Under the ROM, if the Elliptic Curve Discrete Logarithm Problem (ECDLP) is hard to solve in polynomial time, then the proposed CLSC_SAT model is unforgeable against adaptive chosen message attacks for both Type I and Type II adversaries._  
Theorem 2 is proven through Lemmas 4 and 5. **Lemma 4**. : _Under the ROM, if an adversary \(A_{I}\) has a non-negligible advantage \(\epsilon\) against the security of the proposed scheme under EUF--CLSC--CMA-G3 game. Then there exists a challenger \(C\) that can solve the ECDLP hard problem in probabilistic polynomial time._  
Proof. : Suppose that an adversary \(A_{I}\) could break the EUF--CLSC--CMA-G3 security of proposed CLSC_SAT scheme. Assume that \(C\) is a solver for the ECDLP problem. Given a ECDLP problem instance \(P,Q=sP\), compute \(s\) through interaction with \(A_{I}\). 1. Initialization Phase: Same as Lemma 2. 2. Query Phase: Same as Lemma 2. 3. Forgery Phase: \(A_{I}\) outputs a forged signature message \(\sigma^{*}=\{U^{*}_{i},S^{*}_{i},C^{*}_{i,1},C^{*}_{i,2}\}\). If \(EID^{*}_{i}\
eq EID_{I}\), then \(C\) terminates the simulation. Otherwise, \(C\) recovers \(h^{*}_{i,1},h^{*}_{i,3},h^{*}_{i,4}\) from \(L_{1},L_{3},L_{4}\) respectively, computes \(S^{*}_{i}P=U^{*}_{i}+h^{*}_{i,3}X^{*}_{i}+h^{*}_{i,4}(G^{*}_{i}+h^{*}_{i,1}P_ {pub})\). According to the forking lemma [20], within PPT, \(A_{I}\) choose another \(h^{*}_{i,4}\) and can obtain another valid signature \(\sigma^{\prime*}=\{U^{*}_{i},S^{*}_{i},C^{*}_{i,1},C^{*}_{i,2}\}\), computes \(S^{*}_{i}P=(G^{*}_{i}+h^{*}_{i,1}P_{pub})h^{*}_{i,4}+h^{*}_{i,3}X^{*}_{i}+U^{*}_ {i}\). Subtracting the two equations yields \((S^{*}_{i}-S^{*}_{i})P=(h^{*}_{i,4}-h^{*}_{i,4})(G^{*}_{i}+h^{*}_{i,1}P_{pub})= (h^{*}_{i,4}-h^{*}_{i,4})(g^{*}_{i}+h^{*}_{i,1}s)P\). Thus, \(s=((S^{*}_{i}-S^{*}_{i})(h^{*}_{i,4}-h^{*}_{i,4}))^{-1}-g^{*}_{i})/h^{*}_{i,1}\), and \(C\) outputs \(s\) as the solution to the given ECDLP instance. \(\square\)  
**Lemma 5**.