## 5 Security Analysis
**Correctness:** We show that \(\sigma_{i}=(\sigma_{i,1},\sigma_{i,2},T_{i})\) is a valid signature on \(m_{i}\) as follows:  
\[\sigma_{i,2} =(g^{a})^{\frac{-1}{F(m_{i})}}g^{r_{i}}=g^{r_{i}-\frac{a}{F(m_{i})} }=g^{b_{i}},\] \[h_{i} =H_{2}(m_{i},\sigma_{i,2},T_{i}),\] \[\sigma_{i,1} =e((g^{a})^{-\frac{-f(m_{i})-2h_{i}}{F(m_{i})}}(w_{i}v^{h_{i}})^{ r_{i}},pk_{V,1})\] \[=e((g^{ab})(g^{-ab})(g^{a})^{\frac{-f(m_{i})-2h_{i}}{F(m_{i})}}(w _{i}v^{h_{i}})^{r_{i}},g^{c})\] \[=e(g^{ab}(g^{bF(m_{i})}g^{l(m_{i})}g^{2h_{i}})^{\frac{-a}{F(m_{i}) }}(w_{i}v^{h_{i}})^{r_{i}},g^{c})\] \[=e(g^{ab}(w_{i}v^{h_{i}})^{\frac{-a}{F(m_{i})}}(w_{i}v^{h_{i}})^{ r_{i}},g^{c})\] \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]0 \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]1 \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]2 \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]3
* _Simulating queries:_ \(\mathcal{C}\) responds to this kind of query in the same way as in _Signing queries_. * _Verifying queries:_ \(\mathcal{F}\) requests a verification query on a signature \(\sigma_{i}=(\sigma_{i,1},\sigma_{i,2},T_{i})\) on a message \(m_{i}=(m_{i,1},...,m_{i,n})\in\{0,1\}^{n}\). If \(F(m_{i})=0\bmod l\), \(\mathcal{C}\) aborts. Otherwise, \(\mathcal{C}\) finds \((m_{i},r_{i})\) in Table \(T_{r}\) and extracts \(r_{i}\) from \(T_{r}\). Then, \(\mathcal{C}\) computes \(h_{i}=H_{2}(m_{i},\sigma_{i,2},T_{i})\), \(F(m_{i})\) and \(J(m_{i})\), and checks whether \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]4 If this equation holds, \(\mathcal{C}\) returns \(1\) to \(\mathcal{F}\); otherwise, \(\mathcal{C}\) returns \(0\) to \(\mathcal{F}\). * _Output:_ \(\mathcal{F}\) outputs a forged signature \(\sigma^{*}=(\sigma^{*}_{1},\sigma^{*}_{2},T^{*})\) on a message \(m^{*}=(m^{*}_{1},...,m^{*}_{n})\in\{0,1\}^{n}\). If \(F(m^{*})\
eq 0\bmod p\), \(\mathcal{C}\) aborts. Otherwise, \(\mathcal{C}\) calculates \(w^{*}=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m^{*}_{j}}\) and \(h^{*}=H_{2}(m^{*},\sigma^{*}_{2},T^{*})\), and outputs \(e(g,g)^{abc}\) as follows: \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]5 \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]6 \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]7 \[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]8 Here, we discuss the probability of \(\mathcal{C}\) successfully solving the BDH problem instance. If \(\mathcal{C}\) does not abort in the above simulation, then the following conditions must hold: \(\bullet\)\(E_{i}\): \(F(m_{i})\
eq 0\bmod l\) during the _Signing_, _Simulating_ and _Verifying_ queries. \(\bullet\)\(E^{*}\): \(F(m^{*})=0\bmod p\) in the forgery phase. Hence, the probability that \(\mathcal{C}\) completes the whole simulation is \(\Pr[E_{i}\cap E^{*}]\). According to [PERSON] proof [21], we have  
\[J(m)=y_{0}+\sum\limits_{j=1}^{n}y_{j}m_{j}.\]9 \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]0 \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]1 \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]2 \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]3 \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]4 \[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]5  
Therefore, if \(\mathcal{F}\) breaks the strong unforgeability of the SDVS-USU scheme with probability \(\varepsilon\), then \(\mathcal{C}\) can solve the BDH problem with probability at least \(\frac{\varepsilon}{8(n+1)(q_{S}+q_{Sim}+q_{V})}\). Theorem 2: _The SDVS-USU scheme is non-transferable._  
Proof of Theorem 2: The form of the original signature \(\sigma\) for a message \(m\) is  
\[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]6  
and the form of the simulated signature \(\sigma^{{}^{\prime}}\) on \(m\) is  
\[w=u_{0}\prod\limits_{j=1}^{n}u_{j}^{m_{j}}=(g^{b})^{F(m)}g^{I(m)}.\]7  
The randomness of \((\sigma_{1},\sigma_{2},T)\) is determined by the random value \(r\in Z_{p}\), and the randomness of \((\sigma^{{}^{\prime}}_{1},\sigma^{{}^{\prime}}_{2},T^{{}^{\prime}})\) depends on the random value \(s\in Z_{p}\).