## 3 Results
### Impossibility of Forgeries  
In proxy signature scheme, the impossibility of forgery involves that the original signer [PERSON] and the verifier [PERSON] cannot forge the proxy signer [PERSON]'s signature. In case [PERSON] is dishonest and he expects to counterfeit [PERSON]'s signature based on the original messages \(|\varphi\rangle_{M^{\prime}}\) held in his hand, he needs to obtain the random sequence \(S\) to accomplish the package and the key \(K_{AT}\) to carry out the signature, where \(S\) is randomly chosen by [PERSON] and \(K_{AT}\) is produced via QKD system with perfect security. Thus, [PERSON] has no ability to forge the signature successfully in the manner of obtaining the keys including \(S\). Take a step back, if [PERSON] produces a random sequence \(S^{\prime}\) with the same \(n\)-length of \(S\), the successful possibility is only \(\frac{1}{2^{n}}\) because the probability for each bit is \(\frac{1}{2}\), which can be easily simulated via Matlab and shown in Figure 6, where \(P_{n}\) represents the successful probability for creating the same sequence as \(S\). It can be seen that \(P_{n}\) shows an exponential decline and approaches to zero rapidly as \(n\) increases. Furthermore, even if [PERSON] happens to get the correct sequence \(S\) (as we know it has very low probability), \(K_{AT}\) is still unknown for [PERSON], which is the crucial element for the creation of the signature \(|S_{A}\rangle\). Hence [PERSON] cannot execute a successful forgery of [PERSON]'s signature. Figure 6: Successful probability \(P_{n}\) for forging the random binary sequence \(S\) as a function of the length \(n\) of the sequence \(S\). In case [PERSON] is dishonest and he attempts to counterfeit the signature \(|S_{A}\rangle=E^{\prime}_{K_{AT}}(|\varphi\rangle_{M^{\prime\prime}})\), for this purpose, [PERSON] needs to obtain [PERSON]'s secret key \(K_{AT}\) produced by QKD system. According to the public quantum states including \(|S_{A}\rangle\) and \(|\phi_{T}\rangle\) separately received from [PERSON] and [PERSON], he cannot acquire any information about \(K_{AT}\). Consequently, [PERSON] cannot forge [PERSON]'s signature \(|S_{A}\rangle\) by the method of obtaining \(K_{AT}\). In the QOTP-based quantum signature schemes [35; 52], there exists one method for [PERSON] to implement the forgery by the following manner. As the communication receiver, [PERSON] is assumed to hold a valid message-signature pair \((|\varphi\rangle,|S\rangle)\). Then [PERSON] can perform the same unitary operators \(U_{l}\) on each qubit in \(|\varphi^{\prime}\rangle\) and the corresponding qubits in \(|S^{\prime}\rangle\) owing to the encryption manner of qubit by qubit in QOTP algorithm, and he may achieve a new valid message-signature pair without the need for \(K_{AT}\). Based on this, [PERSON] can select his favorable message to perform the forgery attack and claim that it is completed by [PERSON]. In this scenario, when [PERSON] deliberately declares a dispute and lets [PERSON] judge, [PERSON] will stand on the side of [PERSON]. As for this attack strategy, two aspects should be stated. On one hand, [PERSON] cannot choose the preferred message for his own in that the original message \(|\varphi\rangle_{M^{\prime}}\) exists in the form of ciphertext \(|\varphi\rangle_{M^{\prime\prime}}\) via random sequence \(S\). On the other hand, we employ an improved QOTP by introducing assistant CNOT operations to generate the signature, which makes it difficult to find the correct qubit position and modify it due to the correlations among qubits in the signature. In the worse case, we assume that [PERSON] obtains the correct sequence \(S\) by some method. If [PERSON] attempts to modify the qubit \(|\varphi_{j}\rangle_{M^{\prime}}\) at some certain position in \(|\varphi\rangle_{M^{\prime}}\) to forge a valid proxy signature, he can recover \(|\varphi\rangle_{M^{\prime}}\) based on \(S\) and determine the position of \(|\varphi_{j}\rangle_{M^{\prime}}\).