# A Practical and Efficient Node Blind SignCryption Scheme for the IoT Device Network
## Appendix A Proof of Theorem 1  
First, we define experiments of the above two security definitions and each attacker's ability, respectively. We will provide the proof of Lemma 1 and also define that there exists an attacker \(\mathcal{F}\) whose goal is to forge a signature in the proposed scheme. We also define a simulator \(\mathcal{S}\) that can control the experiment of the proposed scheme. On the other hand, \(\mathcal{S}\) is given a signing oracle \(Sig(\cdot)\), which can perform the same action as signature generation by the signer in our approach. \(\mathcal{S}\) also prepares all IoT device key pairs, including the receiver's one. Before beginning the experiment of digital signature, \(\mathcal{S}\) is given a hard RSA problem in \(n^{*}\) and its goal is to use the \(\mathcal{F}\)'s ability to factor this \(n^{*}\). During this time, \(\mathcal{S}\) will also prepare the symmetric encryption/decryption function for the \(\mathcal{F}\) encryption/decryption query. The query types are discussed below. * Encrypting query: \(\mathcal{F}\) can make an encrypting query on the chosen message \(m\), the target receiver \(i\) and the corresponding hash value \(H_{1}(r_{i}^{\prime})\). During this time, \(\mathcal{S}\) checks the \(H_{1}\) list record and determines the random number \(r_{i}^{\prime}\). If there is no hash record on the list, \(\mathcal{S}\) will generate the \((*,H_{1}(r_{i}^{\prime}),r_{i}^{\prime})\) entry for the random number \(r_{i}^{\prime}\) on the list. Then, \(\mathcal{S}\) generates the corresponding cipher-texts in the following: \[C_{1}^{\prime} =E_{pk_{i}}(r_{i}^{\prime})\] \[C_{2}^{\prime} =m\oplus H_{1}(r_{i}^{\prime})\] (1) \[C_{3}^{\prime} =H_{1}(C_{1}^{\prime},C_{2}^{\prime},r_{i}^{\prime},m).\] Then, \(\mathcal{S}\) forwards this cipher-text (\(C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime})\) back to \(\mathcal{F}\) to finish this Encryption query and records \((C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime})\) into the \(H_{1}\) list to be noted as \((C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime},H_{1}(r_{i}^{\prime}),r_{i}^{ \prime})\). * Decrypting query \(Dec(\cdot)\): When \(\mathcal{F}\) forwards a cipher-text (\(C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime}\)) to \(\mathcal{S}\), \(\mathcal{S}\) will search the \(H_{1}\) list to see if there is any entry in this list; if yes, \(\mathcal{S}\) uses the \(H_{1}(r_{i}^{\prime})\) to decrypt the cipher-text (\(C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime}\)). Finally, \(\mathcal{S}\) returns \(m\) back to \(\mathcal{F}\). * QR Signature query: When \(\mathcal{F}\) makes the signature query on the chosen message \(m\), \(\mathcal{S}\) will generate the following: \[C_{1}^{\prime} =E_{pk_{i}}(r_{i}^{\prime})\] \[C_{2}^{\prime} =m\oplus H_{1}(r_{i}^{\prime})\] \[C_{3}^{\prime} =H_{1}(C_{1}^{\prime},C_{2}^{\prime},r_{i}^{\prime},m)\] (2) \[{S_{R}^{\prime}}^{4} =C_{3}^{\prime}\] After generating the signature \(S_{R}^{\prime}\) and the corresponding cipher-text (\(C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime}\)), \(\mathcal{S}\) will check the signature list \(s_{1}\) to see if there is any entry inside; if no, \(\mathcal{S}\) preserves the signature \(S_{R}^{\prime}\) into the signature list and stores \((C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime},S_{R}^{\prime},H_{1}(r_{i}^{ \prime}),r_{i}^{\prime},m)\) in the \(s_{1}\) list. Then, \(\mathcal{S}\) transfers \(S_{R}^{\prime}\) back to \(\mathcal{F}\). \(\mathcal{F}\) can make the above signature query several times on the chosen message \(m\). If \(\mathcal{F}\) has made \(l\) times signature query on the message \(m\), \(\mathcal{F}\) can forge \(l+1\) signatures on the message \(m\).