## 7 Safety Analysis
This means that under the condition that \((Gen,Sig,Ver)\) is a secure digital signature scheme and \(h\) is a non-collision hash function, the message hash chain verification cannot guarantee the authenticity and non-repudiation of the message sequence, which message sequence between the message \(p_{\alpha}\) and the message \(p_{\beta}\) that can be successfully verified by \((Gen,Sig,Ver)\). Then there is an attacker who uses algorithm \(ATTCK\) to forge the \((MHC,Gen,Sig,Ver)\) scheme, and obtains the signature sequence \(S^{(1)},S^{(2)},\ldots,S^{(k)}\) transmitted by the victim and the message hash chain node value sequence \(HC^{(1)},HC^{(2)},\ldots,HC^{(k)}\) according to the victim's \(dk\), where \(S^{(t)}=s_{1}^{(t)},s_{2}^{(t)},\ldots,s_{m}^{(t)}\), \(HC^{(t)}=HC_{1}^{(t)},HC_{2}^{(t)},\ldots,HC_{n}^{(t)},m,n\in N^{*}\) and \(m<n\). Then the scheme can output a valid signature sequence and message hash chain node sequence:  
\[S^{*}=s_{1}^{*},s_{2}^{*},\ldots,s_{r}^{*},\forall x\in\{1,2,\ldots,j\},\]  
\[S^{*}\
otin S^{(x)}andS^{*}\
eq S^{(x)},\]  
\[HC^{*}=HC_{1}^{*},HC_{2}^{*},\ldots,HC_{1}^{*},\forall y\in\{1,2,\ldots,j\},\]  
\[HC^{*}\
otin HC^{(y)},\]  
Specifically, algorithm \(ATTCK\) uses \(Gen\) to generate a pair of \((ek_{ATTCK},dk_{ATTCK})\), and then uses \(MHC\) to construct the message hash chain nodes \(HC_{1}^{*},HC_{2}^{*},\ldots,HC_{l}^{*}\) of all message sequences \(m_{1},m_{2},\ldots,m_{l}\). Finally, encapsulate them into the message sequence \(p_{1},p_{2},\ldots,p_{l}\) of the message hash chain, and sign \(p_{1},p_{2},\ldots,p_{l}\) with \(ek_{ATTCK}\). The final output of algorithm \(ATTCK\) is \(S^{*}\
otin S^{(x)}\) and \(HC^{*}\
otin HC^{(y)}\). According to the assumptions, the signed and verified messages satisfy \(Sig(ek,p_{\zeta},p_{\eta})\)\(=s_{\zeta},s_{\eta}\) and \(Ver(dk,s_{\zeta},s_{\eta})\)\(=1\), \(1<\zeta<\eta<r\). For \(\forall\delta\), \(\zeta<\delta<\eta\), \(p_{\delta}\) only uses the message hash chain verification instead of the digital signature verification. Although the attacker cannot forge \(ek\) in \(s_{\zeta}=Sig(ek,p_{\zeta})\), it can forge \(p_{\zeta}\) as \(p_{\zeta}^{*}=(m_{\zeta},HC_{\zeta}^{*})\). From \(p_{\zeta}=(m_{\zeta},HC_{\zeta})=(m_{\zeta},H(h(m_{\zeta})||HC_{\zeta-1}))\), the following two situations will inevitably occur. 1. \(HC_{\delta}^{*}=HC_{\delta}=HC_{\delta}^{\prime}\). Obviously if \(HC_{\delta}^{*}=h(h(m_{\delta})||HC_{\delta-1}^{*})=h(h(m_{\delta})||HC_{ \delta-1}^{\prime})\), where \(h\) is a non-collision hash function, then \(HC_{\delta-1}^{*}=HC_{\delta-1}^{\prime}\) is obtained. Next, algorithm \(ATTCK\) can output the message hash chain sequence \[HC^{*}=HC_{\delta}^{*},HC_{\delta+1}^{*},\ldots,HC_{\eta}^{*}\]  
and finally get \(s_{\eta}^{*}=Sig(ek_{ATTCK},HC_{\eta}^{*})\). If there should be \(Ver(dk,s_{\eta})=1\), but \(Ver(dk,s_{\eta}^{*})=1\), it means that algorithm \(ATTCK\) can forge \((Gen,Sig,Ver)\) digital sig nature scheme. However, it obviously contradicts the assumption that \((Gen,Sig,Ver)\) is a secure digital signature scheme. 2. \(HC^{*}_{\delta}\
eq HC_{\delta}=HC^{*}_{\delta}\). Knowing that \(HC^{*}_{\delta}=h(h(m_{\delta})||HC^{*}_{\delta-1})\), there must be \(HC^{*}_{\delta-1}\
eq HC_{\delta-1}=HC^{*}_{\delta-1}\) that can recursively get \(HC^{*}_{\delta+1}\
eq HC_{\zeta+1}=HC^{*}_{\zeta+1}\). For the message hash chains and digital signatures at both sides of the transmission corresponding to \(m_{\zeta}\), they satisfy the relational expressions \(HC_{\zeta}=HC^{*}_{\zeta}\) and \(Ver(dk,s_{\zeta})=1\). If \(HC^{*}_{\zeta+1}=h(h(m_{\zeta+1})||HC^{*}_{\zeta})\
eq HC_{\zeta+1}\), then the receiver can use the message hash chain to verify the authenticity and non-repudiation of \(p_{\zeta+1}\), and then use the message hash chain to verify the authenticity and non-repudiation of \(p_{\delta}\) in a recursive way, which contradicts the null hypothesis. In summary, the null hypothesis does not hold.