# A Practical and Efficient Node Blind SignCryption Scheme for the IoT Device Network
## 4 Functionality Comparisons and Security Analysis
### Efficiency Comparisons
#### 4.5.4 Indistinguishable-Chosen Cipher-Text Attack (Ind-CCA for Short)  
In this proposed scheme, we continue to define the chosen cipher-text attack security of our SC approach. There also exists an attacker \(\mathcal{A}\), whose goal is to distinguish the cipher-text of our sign-cryption scheme. First, we assume that there is a simulator \(\mathcal{A}\) to control the environment situational parameters including key pairs, security parameters, and hash length. After setting up, \(\mathcal{S}\) defines the experiment in which \(\mathcal{A}\) can make a query as follows. * Phase 1: In this phase, the attacker \(\mathcal{A}\) could make the encryption/decryption query on the chosen message \(m\). If \(\mathcal{A}\) makes the encryption query on the \(m\) of the IoT device \(i\), where \(i=1\sim l\), then \(\mathcal{S}\) inputs the \(m\) into \(C_{i,1}=E_{pk_{i}}(\gamma_{i})\), \(C_{i,2}=m\oplus H_{1}(\gamma_{i})\) and \(C_{i,3}=H_{1}(C_{1},C_{2},\gamma_{i},m)\), where \(i=1\sim l\). Here, \(\mathcal{S}\) will preserve these parameters into the encryption oracle list \(\mathcal{E}_{i}\) entry. On the other hand, \(\mathcal{A}\) asks the decryption query on the cipher-text (\(C_{i,1},C_{i,2},C_{i,3}\)), \(\mathcal{S}\) will check if there are any parameters matching this cipher-text in the \(\mathcal{E}_{i}\) entry. If the answer is yes, \(\mathcal{S}\) forwards the original message back to \(\mathcal{A}\) and keeps this query in the decryption oracle \(\mathcal{D}_{i}\) entry. * Challenge: In this phase, if \(\mathcal{A}\) chooses a target IoT device \(j^{*}\) and a message pair (\(M_{0}^{*}\), \(M_{1}^{*}\)), where \(M_{0}^{*}\) and \(M_{1}^{*}\) are never asked the encryption query and decryption query before, \(j^{*}\
eq i\) and \(i=1\sim l\). In this time, \(\mathcal{S}\) will toss the coin flip \(b\) and inputs the \(M_{b}^{*}\) into the encryption oracle \(E_{pk_{i}^{*}}(\cdot)\). Finally, \(\mathcal{S}\) returns the target cipher-text (\(C_{1,j^{*}},C_{2,j^{*}},C_{3,j^{*}}\)) to \(\mathcal{A}\). When \(\mathcal{A}\) has received this target cipher-text, it still can make the decryption query on other cipher-texts except (\(C_{1,j^{*}},C_{2,j^{*}},C_{3,j^{*}}\)). In the following, we model above the actions as game simulation steps that we played with the attacker \(\mathcal{A}\). \[ \begin{array}{l}\mathit{Exp}_{\mathcal{A},\mathcal{S}C}^{Ind-CCA-b}(\theta )\\ \textbf{Phase 1}\\ i\in\{1,\ldots,l\},M_{i}\longleftarrow\mathcal{A}^{E_{pk_{i}}(\cdot, \theta),D_{pk_{i}}(\cdot,\theta),H_{1}(\cdot)}\\ \gamma_{i}\longleftarrow\{0,1\}^{*}\\ C_{1,i}\longleftarrow E_{pk_{i}}(\gamma_{i})\\ C_{2,i}\longleftarrow M_{i}\oplus H_{1}(\gamma_{i})\\ C_{3,i}\longleftarrow H_{1}(C_{1,i},C_{2,i},\gamma_{i},M_{i})\\ \textbf{Challenge Phase}\\ b\in\{0,1\},j^{*}\
eq i,(M_{b}^{*},M_{1-b}^{*})\longleftarrow\mathcal{A}\\ M_{b,j^{*}}\longleftarrow\mathcal{S}\\ C_{1,j^{*}}\longleftarrow E_{pk_{i}}(\gamma_{j^{*}})\\ C_{2,j^{*}}\longleftarrow M_{i}\oplus H_{1}(\gamma_{j^{*}})\\ C_{3,j^{*}}\longleftarrow H_{1}(C_{1,j^{*}},C_{2,j^{*}},\gamma_{i^{*}},M_{b, j^{*}})\\ b^{\prime}\longleftarrow\mathcal{A}^{(E_{pk_{i}}(\cdot,\theta),D_{pk_{i^{*}}}( \cdot,\theta),\tau,\tau^{-1})}(C_{1,j^{*}},C_{2,j^{*}},C_{3,j^{*}},M_{b}^{*},\\ M_{1-b}^{*})\end{array} \]The advantage ok function of the adversary \(\mathcal{A}\) where it is defined as \(Adv_{\mathcal{A},SC}^{Ind-CCA}(\theta)=|Pr[Exp_{\mathcal{A},SC}^{Ind-CCA-1}(\theta)= 1]-Pr[Exp_{\mathcal{A},SC}^{Ind-CCA-0}(\theta)=1]|<\epsilon^{\prime}\). We defined that our sign-cryption SC scheme can withstand Ind-CCA attacks if there exists no such attacker \(\mathcal{A}\) that could guess the cipher-text during above experiment \(Exp\) with non-negligible probability than \(\epsilon^{\prime}\), i.e.,  
\[Adv_{\mathcal{A},SC}^{Ind-CCA}(\theta,t)<\frac{1+\epsilon^{\prime}}{2\cdot q_{ e}\cdot q_{d}},\]  
where at most \(t\) time bound, at most \(q_{e}\) times encryption query, at most \(q_{d}\) times decryption query under the \(\theta\) security parameter.