# DCAGS-IoT: Dynamic Cross-Domain Authentication Scheme Using Group Signature in IoT
## 4 Analysis of Proposed Protocol
### Security Analysis
A simple calculation shows that there is a probability \(\mathbf{1}-\left(\frac{\pi}{2}\right)^{\kappa}\), proof that for each \(\mathbf{j}\in\{\mathbf{1},\mathbf{2},\ldots,\kappa\}\), there is \(\left\{\mathbf{CH}_{\mathbf{0}^{*},\mathbf{j}^{\prime}}^{(\mathbf{1})}, \mathbf{CH}_{\mathbf{0}^{*},\mathbf{j}^{\prime}}^{(\mathbf{3})},\mathbf{CH}_{ \mathbf{0}^{*},\mathbf{j}}^{(\mathbf{3})}\right\}=\{\mathbf{1},\mathbf{2}, \mathbf{3}\}\). Therefore, for all challenges \(\mathbf{1},\mathbf{2},\mathbf{3}\) w.r.t. the same \(\mathbf{CMT}_{i}^{*}\), there are three valid responses \(\mathbf{RSP}_{\mathbf{0}^{*},\mathbf{j}^{\prime}}^{(\mathbf{1})},\mathbf{RSP}_{ \mathbf{0}^{*},\mathbf{j}^{\prime}}^{(\mathbf{2})},\mathbf{RSP}_{\mathbf{0}^{* },\mathbf{j}}^{(\mathbf{3})}\). \(\mathcal{B}\) is able to extract witnesses due to \(\mathbf{COM}\) being computationally binding  
\[\mathbf{t}^{*}\in\mathcal{T}_{\mathbf{d}};\mathbf{r}^{*}\in\mathbf{R}_{\mathbf{ q}}^{\overline{\mathbf{m}}};\mathbf{v}^{*}\in\mathbf{R}_{\mathbf{q}}^{ \overline{\mathbf{m}}+\mathbf{k}};\mathbf{p}^{*}\in\mathbf{R}_{\mathbf{q}}^{\ell},\]  
make \(\|\mathbf{r}^{*}\|_{\infty}\leq\beta\), \(\|\mathbf{v}^{*}\|_{\infty}\leq\beta\), \(\|\mathbf{p}^{*}\|Case (ii), if \(\mathbf{c}_{1}^{*}\) is decrypted as \(\mathbf{p}^{\prime}\) and \(\mathbf{p}^{\prime}\in\mathbf{R_{q}}\) makes \(\boldsymbol{\tau}\big{(}\mathbf{p}^{\prime}\big{)}=\mathbf{H}\cdot\boldsymbol{ \tau}(\mathbf{p}^{\prime}\big{)}\in\mathbb{Z}_{\mathbf{q}}^{\mathbf{n}}\), \(\mathbf{p}^{\prime}\) is in the registry and \(\mathbf{\Pi}_{\text{open}}^{*}\) is not accepted by the judge algorithm. From decryption, we know that \(\mathbf{p}^{*}\) will be decrypted by the correctness of our encryption scheme. Hence, the middle open result is \(\mathbf{p}^{*}=\mathbf{p}^{*}\). On the other hand, we think \(\mathbf{rdec}(\mathbf{p}^{\prime})\
eq\mathbf{p}^{*}=\mathbf{p}^{*}\). Otherwise, \(\mathbf{dec}(\mathbf{p}^{\prime})=\mathbf{p}^{*}\), \(\mathcal{B}\) has a valid proof to generate \(\mathbf{\Pi}_{\text{open}}^{*}\). Due to the perfect completeness generated by the underlying argument system, it will be accepted by the judge algorithm with probability 1. This is contradictory, so we obtain \(\mathbf{rdec}(\mathbf{p}^{\prime})\
eq\mathbf{p}^{*}=\mathbf{p}^{*}\). Recall that in the join algorithm, the issuer only generates signatures on \(\mathbf{rdec}(\mathbf{p}^{\prime})\). Therefore, only the signatures on \(\mathbf{rdec}(\mathbf{p}^{\prime})\) are queried, so \((\mathbf{p}^{*},\mathbf{t}^{*},\mathbf{r}^{*},\mathbf{v}^{*})\) is a valid forgery of the signature scheme. Therefore, the unforgeability \(\frac{1}{2}\cdot\big{(}\boldsymbol{e}-\boldsymbol{3}^{-\kappa}\big{)}\big{(} \mathbf{1}-\big{(}\frac{7}{2}\big{)}^{\kappa}\big{)}\) of the signature scheme is broken at least with a non-negligible probability, and the proof is complete. Discussion and limitation. This paper used blockchain distributed ledger storage to achieve cross domain authentication between trust domains and can be applied to the distributed power grid management scenarios for production consumers mentioned in [34] such as mutual authentication between different communities. However, traditional blockchain technology requires miners' nodes to have strong computing power and sufficient storage space to ensure the consensus and tamper resistance of transaction ledgers across the entire network, which limits resource constrained devices (such as power grid nodes) from joining the blockchain. Therefore, our future work is to utilize lightweight blockchain technology to achieve cross domain authentication.