## Appendix A.1.2. Security Proof
**Case I** (\(Q^{\prime}>1\), Figure A6): First, the simulator chooses \(j\in[1,Q^{\prime}]\). Then, for \(i=1\) to \(Q^{\prime}\), the simulator chooses \(t_{i}\in Z_{q}\) and sends \(t_{i}\) to the attacker. Next, for \(i\in[1,Q^{\prime}]/\{j\}\), the simulator computes \(w_{B_{j}},\ d_{B_{i}}\), and \(a_{i}\) like in the proposed scheme. For user \(j\), the simulator chooses two random numbers \(r_{j}^{0},r_{j}^{1}\) and sets \(m_{0}=\left(d_{B_{j}},r_{j}^{0}\right)\), \(m_{1}=\left(d_{B_{j}},r_{j}^{1}\right)\). Then, the simulator sends \(m_{0},m_{1}\) to the IND-CCA2 game to invoke the challenge phase. After receiving the challenge ciphertext \(c^{*}\), the simulator sends \(a_{j}=c^{*}\) to the attacker. Then, the simulator sets \(r_{j}=r_{j}^{0}\) and computes \(sk\) and \(b_{i}\) for \(i\in[1,Q^{\prime}]\) as in the proposed scheme. Next, the simulator sends all \(b_{i}\) to the attacker. Finally, the simulator outputs \(sk_{0}=sk\), \(sk_{1}=r_{1}\oplus\ldots\oplus r_{j}^{1}\oplus\ldots r_{Q}\) to the attacker. After receiving \(sk_{0},\ sk_{1}\), the attacker outputs a bit \(\beta^{\prime}\) to the simulator. Then, the simulator outputs \(0\) if \(\beta^{\prime}=0\) to the IND-CCA2 game. Otherwise, the simulator outputs a random bit \(\beta\). Let \(\epsilon\) be the advantage that the attacker wins the game. If the IND-CCA2 game chooses \(m_{0}\), the simulator makes a correct guess with probability \(\epsilon\). If the IND-CCA2 game chooses \(m_{1}\), then the simulator makes a correct guess with probability \(\frac{1}{2}\). Therefore, the simulator's advantage in winning the IND-CCA2 game is \(\left|\left(\epsilon+\frac{1}{2}\right)-\frac{1}{2}\right|=\epsilon\), which is non-negligible. **Case II** (\(Q^{\prime}=1\), Figure A7): First, the simulator sends \(t_{i}\) to the attacker. Then, the simulator chooses \(r_{i}^{0},r_{i}^{1}\) and sets \(m_{0}=\left(d_{B_{j}},r_{j}^{0}\right)\), \(m_{1}=\left(d_{B_{j}},r_{j}^{1}\right)\). Next, the simulator sends \(m_{0},m_{1}\) to the IND-CCA2 game to invoke the challenge phase. After receiving the chllenge ciphertext \(c^{*}\), the simulator sends \(a_{j}=c^{*}\) to the attacker. Then, then simulator sends \(\left(r^{\prime},H\left(r_{i}^{0}\right)\right)\) to the encryption oracle of the IND-CCA2 game and receives the ciphertext \(c\). Next, the simulator sets \(b=c\) and sends \(b\) to the attacker. Finally, the simulator computes \(sk_{0}=r^{\prime}\oplus r_{i}^{0},\ sk_{1}=r^{\prime}\oplus r_{i}^{1}\), and sends \(sk_{0},sk_{1}\) to the attacker. After receiving \(sk_{0},\ sk_{1}\), the attacker outputs a bit \(\beta^{\prime}\) to the simulator. Then, the simulator outputs \(0\) if \(\beta^{\prime}=0\) to the IND-CCA2 game. Otherwise, the simulator outputs a random bit \(\beta\). Let \(\epsilon\) be the advantage that the attacker wins the game. If the IND-CCA2 game chooses \(m_{0}\), the simulator makes a correct guess with probability \(\epsilon\). If the IND-CCA2 game chooses \(m_{1}\), then the simulator makes a correct guess with probability \(\frac{1}{2}\). Therefore, the simulator's advantage in winning the IND-CCA2 game is \(\left|\left(\epsilon+\frac{1}{2}\right)-\frac{1}{2}\right|=\epsilon\), which is non-negligible. **Theorem A1. **_If the underlying symmetric encryption is secure against adaptive chosen ciphertext attacks (IND-CCA2) and the function Sample \(D\) achieves one-way-ness, then, according to Lemma A1, our authentication scheme is a secure group mutual authentication protocol. If the underlying symmetric encryption is secure against adaptive chosen ciphertext attacks (IND-CCA2), then, according to Lemma A2, our authentication scheme is a secure key exchange protocol._