# DCAGS-IoT: Dynamic Cross-Domain Authentication Scheme Using Group Signature in IoT
## 4 Analysis of Proposed Protocol
### Security Analysis  
(1)Correctness analysis  
Specifically, for an honest user, when they sign a message on behalf of the group, they are required to be able to prove possession of a valid tuple \(\mathbb{E}\). The verify algorithm accepts \(\Pi\mathbf{gs}\) with probability 1. Regarding the correctness of the open algorithm, please note  
\[ \begin{array}{ll}\mathbf{c_{1,1}-c_{1,2}\cdot s_{1}}&=\mathbf{b_{1}\cdot g_{1 }+e_{1,2}+\lfloor q/4\rfloor\cdot rdec(p)-(a\cdot g_{1}+e_{1,1})\cdot s_{1}}\\ &=(a\cdot s_{1}+e_{1})\cdot g_{1}+e_{1,2}+\lfloor q/4\rfloor\cdot rdec(p)-(a \cdot g_{1}+e_{1,1})\cdot s_{1}\\ &=\mathbf{e_{1}\cdot g_{1}+e_{1,2}-e_{1,1}\cdot s_{1}+\lfloor q/4\rfloor \cdot rdec(p)}\end{array} \]  
Among them \(\|\mathbf{e_{1}}\|_{\infty}\leq\mathbf{B},\|\mathbf{s_{1}}\|_{\infty}\leq \mathbf{B},\|\mathbf{g_{1}}\|_{\infty}\leq\mathbf{B},\|\mathbf{e_{1,1}}\|_{ \infty}\leq\mathbf{B},\|\mathbf{e_{1,2}}\|_{\infty}\leq\mathbf{B}\). For \(\mathbf{B}=\widetilde{\mathcal{O}}\big{(}\mathbf{n^{5/4}}\big{)}\) and \(\mathbf{q}=\widetilde{\mathcal{O}}\big{(}\mathbf{n^{4}}\big{)}\),  
Therefore,  
\[\|\mathbf{e_{1}\cdot g_{1}+e_{1,2}-e_{1,1}\cdot s_{1}}\|_{\infty}\leq 2 \mathbf{n}\cdot\mathbf{B^{2}+B}=\widetilde{\mathcal{O}}\Big{(}\mathbf{n^{3} }\big{)}\leq\Big{\lceil}\frac{\mathbf{q}}{\mathbf{10}}\Big{\rceil}=\widetilde {\mathcal{O}}\Big{(}\mathbf{n^{4}}\Big{)}\]  
In the case of probability 1, the open algorithm recovers rdec(p) and outputs the actual signer p. Therefore, the GM can identify the signer of the signature, thus guaranteeing the correctness of the open algorithm. When the TM correctly restores rdec(p) and p, it also has a valid tuple (s1, e1, y) that satisfies the condition in (1). Then, \(\Pi\)open is generated according to the perfect completeness of the demonstration system, and the TM will accept the open result output by the GM, so the correctness of the judge algorithm is established. (2)Security analysis  
Theorem 1: _Under the random oracle model, under the assumptions of RLWE and RSIS, it is proven that the proposed dynamic cross-domain authentication scheme based on group signature satisfies traceability._  
_In the random oracle model, the proof of the theorem relies on the following facts:_  
1. _The zero-knowledge parameters used are simulation-sound._
2. _For a correctly generated user key pair_ \((\mathbf{x},\mathbf{p})\)_, it is impossible to find_ \(\mathbf{x}^{\prime}\in\mathbf{R_{q}^{m}}\) _so that_ \(\|\mathbf{x}^{\prime}\|_{\infty}\leq\mathbf{1},\mathbf{x}^{\prime}\
eq\mathbf{x}\) _and_ \(\mathbf{B}\cdot\mathbf{x}^{\prime}=\mathbf{p}\)_._  
Proof of Theorem 1.: The proof of the theorem is proved by the lemma given below. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Signature Size** & \
\begin{tabular}{c} **Group Public** \\ **Key Size** \\ \end{tabular} &
\begin{tabular}{c} **Signer’s Private** \\ **Key Size** \\ \end{tabular} & **Functional** \\ \hline
[30] & \(\widetilde{\mathcal{O}}(\lambda\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda^{2}+\lambda\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda\cdot\ell)\) & Static \\
[31] & \(\widetilde{\mathcal{O}}(\lambda\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda^{2}\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda)\) & Partial dynamics \\
[32] & \(\widetilde{\mathcal{O}}(\lambda\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda^{2}\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda)\) & Dynamics \\
[33] & \(\widetilde{\mathcal{O}}(\lambda\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda^{2}+\lambda\cdot\ell)\) & \(\widetilde{\mathcal{O}}(\lambda)+\ell\) & — \\ Ours & \(\widetilde{\mathcal{O}}(\lambda)\) & \(\widetilde{\mathcal{O}}(\lambda)\) & \(\widetilde{\mathcal{O}}(\lambda)\) & Dynamics \\ \hline \hline \end{tabular}
\end{table} 
Table 3: A comparative analysis with the other group signature schemes. **Lemma 1**. : _Assumptions \(\mathbf{RSIS}_{\mathbf{n},\overline{\mathbf{m}},\mathbf{q},\mathcal{O}(\mathbf{n}^{2})}^{\infty}\) problems are hard to solve.