# A Blockchain-Based Privacy-Preserving and Fair Data Transaction Model in IoT
## 5 Verifiable Encrypted Signature  
To facilitate fair transactions and safeguard both transaction parties' legitimate rights, this paper introduces a verifiable encrypted signature protocol. Traditional verifiable encrypted signature protocols assume a single and neutral arbitrator [39], but such an arbitrator may experience a single point of failure or cheating behavior. To address this issue, we merge the verifiable encrypted signature with the threshold signature, replacingthe traditional arbitrator with a committee. Every committee member holds a secret share \(s_{i}\), and any \(t\) members can reconstruct the arbitration private key. The verifiable encrypted signature protocol is detailed below:  
_Setup_: enter the security parameter \(\lambda\), choose two large primes of length \(\lambda/2\), and compute the product of these two large primes \(N\). Choose a random element in the group \(Z_{\Phi(N)}^{*}\), and compute the element \(s\) such that \(se=1\ mod\ \Phi(N)\). The system public key is (\(N\), \(e\)). The corresponding private key is (\(N\), \(s\)), according to Equation (2), \(s\) is divided into \(\mathbf{r}\) parts, held by \(r\) members of the arbitration committee. When arbitration is needed, any \(t\) members can use Equation (3) to reconstruct \(s\) and decrypt the corresponding verifiable encrypted signature.  
_KeyGen_: The data provider \(P_{s}\) randomly selects \(g_{1}Z_{\Phi(N)}^{*}\), and selects \(x_{s}\{0,1\}^{\lambda}\), calculates \(g=g_{1}{}^{2}\ mod\ N,y_{s}=g^{x_{s}}\ mod\ N\). The data consumer \(P_{c}\) selects the element \(x_{c}\in\{0,1\}^{\lambda}\) and computes \(y_{c}=g^{x_{c}}\ mod\ N\). The public key for \(P_{s}\) is \(y_{s}\), with a private key \(sk_{s}=x_{s}\). The public key for \(P_{c}\) is \(y_{c}\), with a private key \(sk_{c}=x_{c}\).  
_Sign_: outputs the transaction protocol \(Tx\), \(P_{c}\) computes a signature  
\[\sigma_{c}=H(Tx)^{s}\ mod\ N.\]  
_Verify_: taking as input the transaction agreement \(Tx\), signature \(\sigma_{c}\) and the system public key (\(N\), \(e\)). Verify whether the  
\[\sigma_{c}{}^{e}=H(Tx)^{s}\ mod\ N.\]  
If the equation holds, output 1, indicating that the signature \(\sigma_{c}\) is valid, otherwise output 0, indicating that the signature is invalid.  
_PreSign_: \(P_{c}\) select the element \(r\in\{0,1\}^{\lambda}\), and calculate \(y_{r}=g^{\prime}mod\ N\) and also calculate the secret factor \(u=y_{s}^{x_{c}}mod\ N\) and \(m^{\prime}=u^{e}H(Tx)mod\ N\). \(P_{s}\) Calculate the secret factor \(u^{\prime}=y_{v}^{x_{c}}mod\ N\), and verify whether \(m^{\prime}=u^{\prime e}H(Tx)mod\ N\).  
\(VESSign\): \(P_{c}\) selects an element \(t\) from the set \(t\in\{0,1\}^{\lambda}\) and calculates \(\sigma^{\prime}=m^{\prime 2s}y_{c}^{\prime}mod\ N\), \(y_{e}=y_{s}^{\prime}mod\ N\), \(y_{er}=y_{s}^{\prime}mod\ N\), \(y_{t}=g^{\prime}mod\ N\), \(y_{et}=y_{e}^{t}mod\ N\), \(c=H(m^{\prime},y_{er},y_{r},y_{e},g,y_{et},y_{t})\). \(P_{c}\) then computes \(z=t-rc\), and outputs the verifiable encrypted signature \(\sigma_{c}^{e}{}^{e}{}^{e}{}^{e}{}^{e  
transaction. The entire process is conducted locally, so this model can ensure the privacy and security of the data provider \(P_{i}\). \(\square\)