# Quantum Dual Signature with Coherent States Based on Chained Phase-Controlled Operations
## 2 Methods
### Quantum Dual Signature Scheme
#### 2.3.3 Verification Phase  
The verification phase requires [PERSON] ([PERSON]) to verify the signature of order message (payment message) and judge whether the signature \(|S\rangle_{O}\) (\(|S\rangle_{P}\)) is valid. The detailed steps are as displayed follows. 1. Once receiving [PERSON]'s signature, [PERSON] randomly chooses \(n_{a}\) (\(n_{a}<x+y\)) states from it and records the numbers. Simultaneously, [PERSON] and [PERSON] negotiate the correspondence between signatures and binary bits. For example, they use 00, 01, 10 and 11 to stand for \(|\alpha\rangle\), \(|i\alpha\rangle\), \(|-\alpha\rangle\) and \(|-i\alpha\rangle\), respectively. 2. [PERSON] sends numbers and corresponding bits of the chosen states to [PERSON]. [PERSON] judges whether the signatures are right based on the correspondence between signatures and binary bits. If \(\epsilon_{forgery}^{B}<\epsilon_{B}\), subsequent steps continue. Otherwise the protocol is terminated. \(\epsilon_{forgery}^{B}\) represents the probability of mistakes between the recovered signatures and the original signatures, and \(\epsilon_{B}\) represents the error threshold. 3. [PERSON] decodes \(|S\rangle_{D}\) and derives \(|M\rangle_{OP}\). Then [PERSON] divides \(|M\rangle_{OP}\) into two parts with length \(x\) and \(y\) respectively. Thus, [PERSON] obtains \(|S\rangle_{O}\) and \(|S\rangle_{P}\). * [PERSON] encodes \(|M\rangle_{O}^{{}^{\prime}}\) and derives \(|S\rangle_{O}^{\prime}=E_{K_{AB(N)}}(|M\rangle_{O}^{{}^{\prime}})\) with CPCO based on secret key \(K_{AB(x)}\). * [PERSON] verifies whether \(|S\rangle_{O}^{\prime}\) is matched to \(|S\rangle_{O}\). Then he obtains the parameter \[V_{B}= \begin{cases}1,&|S\rangle_{O}^{\prime}=|S\rangle_{O},\\ 0,&|S\rangle_{O}^{\prime}\
eq|S\rangle_{O}.\end{cases} \] (8) If \(V_{B}\) is equal to 0, [PERSON] rejects the quantum dual signature directly; otherwise, [PERSON] encrypts \(|S\rangle_{P}\) with the key \(K_{BT}\) and acquires \[|M\rangle_{T}=E_{K_{AB}}(|S\rangle_{P}).\] (9) Then he sends \(|M\rangle_{T}\) to [PERSON]. Here we need to emphasize that the business [PERSON] needs to validate the identity of the customer [PERSON] and the details of order before the bank [PERSON] verifies the signature of payment message. This is the reason the payment message is forwarded to [PERSON] by [PERSON]. * [PERSON] decrypts \(|M\rangle_{T}\) with \(K_{AT}\) and obtains \(|S\rangle_{P}\). * [PERSON] randomly selects \(m_{a}\) states from \(|S\rangle_{P}\) and records their numbers. [PERSON] and [PERSON] negotiate the correspondence between signatures and \(m_{a}\)-length binary bits. [PERSON] transmits numbers and corresponding bits of the chosen states to [PERSON]. [PERSON] judges whether the signatures are right and acquires the error probability \(\varepsilon_{forgery}^{T}\). If \(\varepsilon_{forgery}^{T}<\varepsilon_{T}\), next steps continue, otherwise the protocol is stopped, where \(\varepsilon_{forgery}^{T}\) represents the error probability of signatures of payment messages, and \(\varepsilon_{T}\) represents the error threshold. * [PERSON] computes \(|S\rangle_{P}^{\prime}=E_{K_{AT}}(|M\rangle_{P}^{{}^{\prime}})\) and judges whether \(|S\rangle_{P}^{\prime}=|S\rangle_{P}\) to determine the parameter \[V_{T}= \begin{cases}1,&|S\rangle_{P}^{\prime}=|S\rangle_{P},\\ 0,&|S\rangle_{P}^{\prime}\
eq|S\rangle_{P}.\end{cases} \] (10) Next [PERSON] sends the result \(V_{T}\) to [PERSON]. * [PERSON] can draw a conclusion that [PERSON]'s signatures are valid if \(V_{B}=V_{T}=1\). In this situation, [PERSON] can require [PERSON] to inform the key \(K_{RO}\). * [PERSON] receives [PERSON]'s demand which means the successful verification of \(|S\rangle_{O}\) and \(|S\rangle_{P}\). Then [PERSON] informs [PERSON] ([PERSON]) the key \(K_{RO}\) (\(K_{RP}\)). * [PERSON] recovers \(M_{O}\) from \(|M\rangle_{O}^{{}^{\prime}}\) on the basis of principles which are negotiated between them in advance. In detail, the principles of recovering messages are \[m_{O}^{s}=