# A Practical and Efficient Node Blind SignCryption Scheme for the IoT Device Network
## Appendix A Proof of Theorem 1
Then, we can have the probability of adversary \(\mathcal{F}\) \[Adv_{\mathcal{F},Sig(\cdot),Enc(\cdot),Dec(\cdot)}^{Unf}(\theta,t)\leq\frac{1 }{2^{l}\cdot q_{s}\cdot q_{e}\cdot q_{d}}\cdot\varepsilon,\] (3) where there is at most \(q_{s}\) times signature query, at most \(q_{e}\) times encryption query, and at most \(q_{d}\) times decryption query in the polynomial \(t\) time bound under security parameter \(\theta\). Second, we present the proof of Lemma 2 as follows. We assumed that there exists an attacker \(\mathcal{A}\) whose goal is to distinguish a cipher-text (\(C_{1},C_{2},C_{3}\)) from a given message tuple \((M_{0},M_{1})\) with non-negligible probability. Before simulating the experiment, we model a simulator \(\mathcal{S}\), which is given a RSA hard problem \(n^{*}\) and its goal is to factor \(n^{*}\) and find the prime factor of \(n^{*}\). During this time, \(\mathcal{S}\) also generates all key pairs of IoT devices includingthe base gateway \(BS\) and the receiver \(R\). When everything is ready, the \(\mathcal{S}\) also allows \(\mathcal{A}\) to send query types in the following. * Cipher-text query on \(Enc(\cdot)\): In this simulation, \(\mathcal{A}\) can also launch a cipher-text query with an input the message \(m\), the target receiver \(i\), and the corresponding hash value \(H_{1}(r_{i})\) to \(\mathcal{S}\). When receiving this query, \(\mathcal{S}\) checks the \(H_{1}\) list records and finds out if there exists a random number \(r_{i}\) and other related records before. If there is no hash record on the list, \(\mathcal{S}\) will generate a new entry \((*,H_{1}(r_{i}),r_{i})\) for the random number \(r_{i}\) on the list. Then, \(\mathcal{S}\) performs the following steps: \[ \begin{split} C_{1}&=E_{pk_{i}}(r_{i})\\ C_{2}&=m\oplus H_{1}(r_{i})\\ C_{3}&=H_{1}(C_{1},C_{2},r_{i},m)\end{split} \] (10) Subsequently, \(\mathcal{S}\) sends this cipher-text (\(C_{1},C_{2},C_{3}\)) back to \(\mathcal{A}\) and stores \((C_{1},C_{2},C_{3})\) into the \(H_{1}\) list to be noted as \((C_{1},C_{2},C_{3},H_{1}(r_{i}),r_{i})\). * Plain-text query on \(Dec(\cdot)\): When \(\mathcal{A}\) makes a plain-text query on \(\mathcal{S}\) with an cipher-text (\(C_{1},C_{2},C_{3}\)), \(\mathcal{S}\) will search the \(H_{1}\) list first to see if there is any entry inside or not; if yes, \(\mathcal{S}\) uses the \(H_{1}(r_{i})\) to decrypt the cipher-text (\(C_{1},C_{2},C_{3}\)) and returns \(m\) back to \(\mathcal{A}\). * Signing query: When \(\mathcal{A}\) makes an QR signature signing query on the chosen ciphertext (\(C_{1},C_{2},C_{3}\)), \(\mathcal{S}\) will calculate the following equations: \[ \begin{split} C_{1}&=E_{pk_{i}}(r_{i})\\ C_{2}&=m\oplus H_{1}(r_{i})\\ C_{3}&=H_{1}(C_{1},C_{2},r_{i},m)\\ S_{R}^{4}&=C_{3}\end{split} \] (11)  
After performing the above training, we defined it as the Phase 1 training phase of the experiment in the above definition. In the next phase, the \(\mathcal{A}\) can send a target message tuple (\(M_{0}^{*},M_{1}^{*}\)) and forward it to \(\mathcal{S}\). In this time, \(\mathcal{S}\) will choose one of them by a coin toss on \(b\). Then, \(\mathcal{S}\) performs signing steps as follows:  
\[ \begin{split} C_{1}^{*}&=E_{pk_{i}}(r_{i}^{*})\\ C_{2}^{*}&=M_{b}^{*}\oplus H_{1}(r_{i}^{*})\\ C_{3}^{*}&=H_{1}(C_{1}^{*},C_{2}^{*},r_{i}^{*},M_{ b}^{*})\\ S_{R}^{4*}&=C_{3}^{*}\end{split}  \tag{12}\]  
After generating the above cipher-text (\(C_{1}^{*},C_{2}^{*},C_{3}^{*},S_{R}^{4*}\)), \(\mathcal{S}\) returns it back to the \(\mathcal{A}\). During this time, \(\mathcal{A}\) can make the decryption query except on the target cipher-text (\(C_{1}^{*},C_{2}^{*},C_{3}^{*},S_{R}^{4*}\)).