# A Secure and Fair Joint E-Lottery Protocol

Authors: Chin-Ling Chen; Yuan-Hao Liao; Woei-Jiunn Tsaur
Journal: The Scientific World Journal
 (2014)

---

## Abstract

The attractive huge prize causes people to adore lotteries. Due to the very small probability of winning prizes, the players can enhance their probability of winning by using the method of joint purchase. In spite of many lottery schemes having been proposed, most e-lottery schemes focus on the players’ privacy or computation overhead rather than support a joint purchase protocol on the Internet. In this paper, we use the multisignature and verifiable random function to construct a secure and fair joint e-lottery scheme. The players can check the lottery integrity, and the winning numbers can be verified publicly.


---

## Body

## 1. Introduction

Gambling has the property of nonpredictability and attractive prizes. Players have the chance to obtain a huge prize but of course they cannot predict who the winner will be. Hence, gambling is very fascinating for many people, and the lottery is one kind of popular gambling [1–3]. The players must select their favorite numbers and pay money to purchase lottery tickets. After the deadline of the purchasing phase, the lottery organization (LO) randomly generates the winning numbers. If no one wins the lottery, the prize money will accumulate for the next round. The attractive huge prizes are an extremely powerful factor causing people to purchase lottery tickets and the main reason remains popular among players.In past years, many lottery schemes were proposed. In 2006, Chow et al. [4] proposed practical electronic lotteries with an offline trusted third party (TTP); their scheme can satisfy all of the identified requirements without the presence of TTP for generating the winning numbers; the result of this generation is publicly verifiable.Next, Lee and Chang [5] proposed an electronic t-out-of-n lottery on the Internet in 2009. The scheme is based on the Chinese Remainder Theorem that allows lottery players to simultaneously select t out of n numbers in a ticket without iterative selection. The drawback of this scheme is that the computation overhead of players in purchasing lotteries is too heavy.In the same year, Lee et al. [6] proposed noniterative privacy preservation for online lotteries. This scheme not only allows players to choose t-out-of-n numbers in lotteries without iterative selection but also preserves the privacy of players’ choices. Nevertheless, the computation overhead in purchasing lotteries is still heavy for the player who accesses the Internet with mobile or wireless devices.In an overview of the above schemes, we find that the majority of the schemes focus on the players’ privacy or computation overhead but cannot support a joint purchase protocol on the Internet.Due to the probability of winning prize being very small [7], the players can employ two strategies of purchase to enhance the probability of winning prizes as follows.(i)
The player invites other players to collect more cash, and then the player purchases the sequential numbers to increase the probability of obtaining a prize.
(ii)
The player pays a small amount of money to purchase the lotteries in cooperation with other players.To the best of our knowledge, there exist only two websites, called “e-Lottery Syndicates” [8] and “Myleto” [9], which provide a trading platform (TP) for purchases and a proxy purchase service. The difference between the above websites is that the former provides individual purchases while the latter provides joint purchases. Since our scheme focuses on joint purchases, we chose “Myleto” to discuss joint purchases.The process for joint purchase in “Myleto” enables the players to bet their favorite numbers by using the “Myleto,” and then “Myleto” counts the preferred numbers of players to generate the popular numbers after the deadline of purchase phase. Then, “Myleto” takes the popular numbers to purchase the lottery for the trusted lottery organization (LO). Finally, LO generates the winning numbers and publishes them on the bulletin board. Then “Myleto” distributes the different prizes to the winning players according to the numbers they bet.Even if the solution for the joint purchase lottery exists, according to our observations some drawbacks remain.(1)
From the user’s viewpoint, the risks are as follows:
(i)
if the joint purchase players win the first prize, the person receiving the award has a chance to abscond with the funds;
(ii)
the player’s lottery purchase evidence depends on the picture at the time of purchase and the credit card transaction receipt. However, the former lacks credibility because it is easy to fake, and the latter lacks immediacy since the credit card transaction receipt adopts a monthly settlement;
(iii)
if the player’s purchase information is lost or the TP refuses to give out the prize, the player cannot proffer strong evidence to prove the winner is himself/herself.
(2)
From the TP’s viewpoint, the risk is as follows:
(i)
if a malicious player forges a picture and a credit card transaction receipt to claim the prize, the TP will find it hard to recognize whether the prize claim evidence is true or false.At present, we have seen that the current TP of joint purchase exhibits some drawbacks, so determining how to implement a fair and secure joint purchase e-lottery protocol is still an open issue.Hence, we propose a fair and secure joint e-lottery protocol to guarantee the rights and interests of the players and TP. Simultaneously, our proposed protocol also supports individual purchases.The proposed scheme must be able to achieve the following requirements [4–6] such that the proposed scheme can be applied in actual practice.(1)
Public Verification. All the valid lottery tickets and the winning numbers must be verified via a verifiable random function.
(2)
Fairness. No one can predict the winning result before the winning numbers are published.
(3)
Security. No one can forge a winning lottery or impersonate a lottery winner to claim the prize.
(4)
Correctness. The players can verify the public information of the bulletin board by themselves.
(5)
Anonymity. Including lottery agents, no one can identify the participants by the lottery ticket.
(6)
Convenience. The legitimate players should be able to purchase lottery via Internet.
(7)
Without Preregistration. Players need not register at any lottery agent or drawing center in advance, as registration in advance is unnecessary; this requirement should conform to an electronic lottery to make it more realistic.
(8)
No Online Trusted Third Party (TTP). An electronic lottery is said to be impractical if the security of the entire mechanism depends on an online trusted third party.
(9)
Participants’ Legality. The scenario of the joint e-lottery scheme should ensure the participants’ legality via a multisignature.
(10)
Support Joint and Individual E-Lottery Service. The protocol must support joint and individual e-lottery service, respectively.The remainder of this paper is organized to describe and analyze our joint e-lottery scheme as follows. Section2 introduces related cryptographic techniques used in our scheme. Section 3 presents our proposed protocol, and the security requirements are analyzed in Section 4. Our conclusions are presented in the final section.


## 2. Preliminaries

In this section, we introduce three cryptographic techniques used in our scheme: a verifiable random function, an identity-based signature scheme, and an efficient identity-based RSA multisignature scheme.


### 2.1. Verifiable Random Function

A verifiable random function (VRF) was first proposed by Micali et al. [10]. Essentially, it is a pseudorandom function [11] providing noninteractively verifiable proof of the output’s correctness. Therefore, the above properties of VRF are suitable for our scheme.On the basis of the notation in [12], a set of functions F
(
·
)
(
·
)
:
{
0,1
}
k
→
{
0,1
}
l
(
k
) is a verifiable function; suppose there exist polynomial-time algorithms Gen
(
·
)
,
Eval
(
·
,
·
)
,
Prove
(
⋯
)
,
Verify
(
·
,
·
,
·
,
·
) such that(1)
Gen
(
k
)  is a probabilistic algorithm to generate a secret key SK that is generated by a random function and the corresponding public key PK that enables public verification;
(2)
Eval
(
SK
,
x
)  is an algorithm that computes the VRF’s output y
=
F
SK
(
x
);
(3)
Prove
(
SK
,
x
) is an algorithm that computes the proof π that y
=
F
SK
(
x
);
(4)
Verify
(
PK
,
x
,
y
,
π
)  is an algorithm that verifies y
=
F
SK
(
x
);
(5)
the VRF should satisfy the following properties.
(6)
uniqueness:(1)
Verify
(
PK
,
x
,
y
1
,
π
1
)
=
Verify
(
PK
,
x
,
y
2
,
π
2
)
,
where y
1
=
y
2;
(7)
computability:Eval
(
SK
,
x
)
=
F
SK
(
x
) is efficiently computable;
(8)
provability:(
y
,
π
)
=
(
Eval
(
SK
,
x
), Prove (SK, x)) and Verify
(
PK
,
x
,
y
,
π
);
(9)
pseudorandomness: the probability that an attacker can input any bit ofF
SK
(
x
) for x his/her choice is negligible even if she/he has seen the values of many F
SK
(
x
′
) given x
′
≠
x.


### 2.2. Review of Shamir’s Identity-Based Signature Scheme

In 1985, in order to simplify the public key authentication problem, Shamir [13] first offered the concept of an identity-based (ID-based) cryptosystem. In this system, each signer needs to register with a private key generator (PKG) and identify himself/herself before accessing the network resource. Once the registration is completed, the PKG will use the signer’s identity to generate the secret key. The signer’s identity may include the signer’s name, email, and address. The advantage of this scheme is that there is no need for a public key directory in the system. The communicating parties only need to know the “identity” of his/her communication partner and the public key of the PKG is able to verify the signature or send an encrypted message.We first introduce the notations used to explain how Shamir’s scheme was constructed:(
p
X
,
q
X
): a pair of large prime numbers;
N
X: a large number, where N
X
=
p
X
·
q
X, φ
(
N
X
)
=
(
p
X
-
1
)
(
q
X
-
1
), and φ
(
·
) is Euler’s totient function;
(
e
X
,
d
X
): X’s public and private key, respectively, where e
X
d
X
=
1
mod
⁡
φ
(
N
X
);
H
(
·
): a one way hash function;
m: a message;
A
?
_
_
B: comparing whether or not A is equal to B.


#### 2.2.1. Private Key Generator (PKG) Keys

The private key generator (PKG) chooses its public and private key pair as follows.Step 1.
Run the probabilistic polynomial algorithmK
RSA to generate two random large primes, p
PKG and q
PKG.Step 2.
Choose a random public keye
PKG such that g
c
d
(
e
PKG
,
ϕ
(
N
PKG
)
)
=
1 and compute the private key d
PKG
=
e
PKG
-
1
mod
⁡
ϕ
(
N
PKG
).


#### 2.2.2. Signer Secret Key Generation

In this algorithm, the signer gets a copy of his/her secret key from the PKG through a two-step process.Step 1.
A signer submits his/her identity to the PKG.Step 2.
The PKG uses its private keyd
PKG to sign the signer’s identity i by generating the secret key g such that g
=
i
d
PKG
mod
⁡
N
PKG.


#### 2.2.3. Message Signing

To sign a messagem, the signer with the secret key g and the corresponding public key e
PKG of the PKG signs a message m by generating a signature pair σ
=
(
T
,
S
) as follows.Step 1.
Select a random numberr and compute
(2)
T
=
r
e
PKG
mod
⁡
N
PKG
.Step 2.
For the same random numberr, compute
(3)
S
=
g
·
r
H
(
T
,
m
)
mod
⁡
N
PKG
.
σ
=
(
T
,
S
) is the complete signature of the message m.


#### 2.2.4. Message Verification

The identity-based signatureσ
=
(
T
,
S
) of a signer with identity i is valid if and only if the following equality holds:
(4)
S
e
=
i
·
T
H
(
T
,
m
)
mod
⁡
N
PKG
.


### 2.3. Review of Harn’s Efficient Identity-Based RSA Multisignatures Scheme

In the 2008, Harn and Ren [14] first proposed a digital signature of a message generated by multiple signers with multiple private keys based on Shamir’s identity-based signature (IBS) scheme. This was a first efficient identity-based RSA multisignatures scheme with both fixed length and verification time. Harn and Ren’s scheme is secure against forgeries under chosen-message attack, against multisigner collusion attack, and adaptive chosen-identity attack.


#### 2.3.1. Private Key Generator (PKG) Keys

The PKG chooses its public and private key pairs as follows.Step 1.
Runs the probabilistic polynomial algorithmK
RSA to generate two random large primes, p
PKG and q
PKG.Step 2.
Choose a random public keye
PKG such that g
c
d
(
e
PKG
,
ϕ
(
N
PKG
)
)
=
1 and compute the private key d
PKG
=
e
PKG
-
1
mod
⁡
ϕ
(
N
PKG
).


#### 2.3.2. Signer Secret Key Generation

In this algorithm, the signer gets a copy of his/her secret key from the PKG through a two-step process.Step 1.
A signer submits his/her identity to the PKG.Step 2.
The PKG uses its private keyd
PKG to sign the message digest of the identity to generate the secret key g
j, such that g
j
=
i
j
d
PKG
mod
⁡
N
PKG. No one will be able to distinguish between the identity and its message digest i
j.


#### 2.3.3. Message Signing

To generate an identity-based multisignature, each signer carries out the followings steps.Step 1.
Choose a random integerr
j and compute t
j
=
r
j
e
PKG
mod
⁡
N
PKG.Step 2.
Broadcastt
j to other signers.Step 3.
Upon receiving oft
j
,
j
=
1,2
,
…
,
l. each signer computes
(5)
T
=
∏
j
=
1
l
t
j
mod
⁡
N
PKG
s
j
=
g
j
·
r
j
H
(
T
,
m
)
mod
⁡
N
PKG
.Step 4.
Broadcasts
j to all signers.Step 5.
After receiving oft
j
,
j
=
1,2
,
…
,
l. the multisignatures component S can be computed as
(6)
S
=
∏
j
=
1
l
s
j
mod
⁡
N
PKG
.
The multisignature for message m is σ
=
(
T
,
S
).


#### 2.3.4. Multisignature Verification

To verify a multisignatureσ
=
(
T
,
S
) of a message m of signers whose identities are i
1
,
i
2
,
…
,
i
l, anyone can verify the correctness as follows:
(7)
S
e
PKG
?
_
_
(
i
1
,
i
2
,
…
,
i
l
)
·
T
H
(
T
,
m
)
mod
⁡
N
PKG
.


## 2.1. Verifiable Random Function

A verifiable random function (VRF) was first proposed by Micali et al. [10]. Essentially, it is a pseudorandom function [11] providing noninteractively verifiable proof of the output’s correctness. Therefore, the above properties of VRF are suitable for our scheme.On the basis of the notation in [12], a set of functions F
(
·
)
(
·
)
:
{
0,1
}
k
→
{
0,1
}
l
(
k
) is a verifiable function; suppose there exist polynomial-time algorithms Gen
(
·
)
,
Eval
(
·
,
·
)
,
Prove
(
⋯
)
,
Verify
(
·
,
·
,
·
,
·
) such that(1)
Gen
(
k
)  is a probabilistic algorithm to generate a secret key SK that is generated by a random function and the corresponding public key PK that enables public verification;
(2)
Eval
(
SK
,
x
)  is an algorithm that computes the VRF’s output y
=
F
SK
(
x
);
(3)
Prove
(
SK
,
x
) is an algorithm that computes the proof π that y
=
F
SK
(
x
);
(4)
Verify
(
PK
,
x
,
y
,
π
)  is an algorithm that verifies y
=
F
SK
(
x
);
(5)
the VRF should satisfy the following properties.
(6)
uniqueness:(1)
Verify
(
PK
,
x
,
y
1
,
π
1
)
=
Verify
(
PK
,
x
,
y
2
,
π
2
)
,
where y
1
=
y
2;
(7)
computability:Eval
(
SK
,
x
)
=
F
SK
(
x
) is efficiently computable;
(8)
provability:(
y
,
π
)
=
(
Eval
(
SK
,
x
), Prove (SK, x)) and Verify
(
PK
,
x
,
y
,
π
);
(9)
pseudorandomness: the probability that an attacker can input any bit ofF
SK
(
x
) for x his/her choice is negligible even if she/he has seen the values of many F
SK
(
x
′
) given x
′
≠
x.


## 2.2. Review of Shamir’s Identity-Based Signature Scheme

In 1985, in order to simplify the public key authentication problem, Shamir [13] first offered the concept of an identity-based (ID-based) cryptosystem. In this system, each signer needs to register with a private key generator (PKG) and identify himself/herself before accessing the network resource. Once the registration is completed, the PKG will use the signer’s identity to generate the secret key. The signer’s identity may include the signer’s name, email, and address. The advantage of this scheme is that there is no need for a public key directory in the system. The communicating parties only need to know the “identity” of his/her communication partner and the public key of the PKG is able to verify the signature or send an encrypted message.We first introduce the notations used to explain how Shamir’s scheme was constructed:(
p
X
,
q
X
): a pair of large prime numbers;
N
X: a large number, where N
X
=
p
X
·
q
X, φ
(
N
X
)
=
(
p
X
-
1
)
(
q
X
-
1
), and φ
(
·
) is Euler’s totient function;
(
e
X
,
d
X
): X’s public and private key, respectively, where e
X
d
X
=
1
mod
⁡
φ
(
N
X
);
H
(
·
): a one way hash function;
m: a message;
A
?
_
_
B: comparing whether or not A is equal to B.


### 2.2.1. Private Key Generator (PKG) Keys

The private key generator (PKG) chooses its public and private key pair as follows.Step 1.
Run the probabilistic polynomial algorithmK
RSA to generate two random large primes, p
PKG and q
PKG.Step 2.
Choose a random public keye
PKG such that g
c
d
(
e
PKG
,
ϕ
(
N
PKG
)
)
=
1 and compute the private key d
PKG
=
e
PKG
-
1
mod
⁡
ϕ
(
N
PKG
).


### 2.2.2. Signer Secret Key Generation

In this algorithm, the signer gets a copy of his/her secret key from the PKG through a two-step process.Step 1.
A signer submits his/her identity to the PKG.Step 2.
The PKG uses its private keyd
PKG to sign the signer’s identity i by generating the secret key g such that g
=
i
d
PKG
mod
⁡
N
PKG.


### 2.2.3. Message Signing

To sign a messagem, the signer with the secret key g and the corresponding public key e
PKG of the PKG signs a message m by generating a signature pair σ
=
(
T
,
S
) as follows.Step 1.
Select a random numberr and compute
(2)
T
=
r
e
PKG
mod
⁡
N
PKG
.Step 2.
For the same random numberr, compute
(3)
S
=
g
·
r
H
(
T
,
m
)
mod
⁡
N
PKG
.
σ
=
(
T
,
S
) is the complete signature of the message m.


### 2.2.4. Message Verification

The identity-based signatureσ
=
(
T
,
S
) of a signer with identity i is valid if and only if the following equality holds:
(4)
S
e
=
i
·
T
H
(
T
,
m
)
mod
⁡
N
PKG
.


## 2.2.1. Private Key Generator (PKG) Keys

The private key generator (PKG) chooses its public and private key pair as follows.Step 1.
Run the probabilistic polynomial algorithmK
RSA to generate two random large primes, p
PKG and q
PKG.Step 2.
Choose a random public keye
PKG such that g
c
d
(
e
PKG
,
ϕ
(
N
PKG
)
)
=
1 and compute the private key d
PKG
=
e
PKG
-
1
mod
⁡
ϕ
(
N
PKG
).


## 2.2.2. Signer Secret Key Generation

In this algorithm, the signer gets a copy of his/her secret key from the PKG through a two-step process.Step 1.
A signer submits his/her identity to the PKG.Step 2.
The PKG uses its private keyd
PKG to sign the signer’s identity i by generating the secret key g such that g
=
i
d
PKG
mod
⁡
N
PKG.


## 2.2.3. Message Signing

To sign a messagem, the signer with the secret key g and the corresponding public key e
PKG of the PKG signs a message m by generating a signature pair σ
=
(
T
,
S
) as follows.Step 1.
Select a random numberr and compute
(2)
T
=
r
e
PKG
mod
⁡
N
PKG
.Step 2.
For the same random numberr, compute
(3)
S
=
g
·
r
H
(
T
,
m
)
mod
⁡
N
PKG
.
σ
=
(
T
,
S
) is the complete signature of the message m.


## 2.2.4. Message Verification

The identity-based signatureσ
=
(
T
,
S
) of a signer with identity i is valid if and only if the following equality holds:
(4)
S
e
=
i
·
T
H
(
T
,
m
)
mod
⁡
N
PKG
.


## 2.3. Review of Harn’s Efficient Identity-Based RSA Multisignatures Scheme

In the 2008, Harn and Ren [14] first proposed a digital signature of a message generated by multiple signers with multiple private keys based on Shamir’s identity-based signature (IBS) scheme. This was a first efficient identity-based RSA multisignatures scheme with both fixed length and verification time. Harn and Ren’s scheme is secure against forgeries under chosen-message attack, against multisigner collusion attack, and adaptive chosen-identity attack.


### 2.3.1. Private Key Generator (PKG) Keys

The PKG chooses its public and private key pairs as follows.Step 1.
Runs the probabilistic polynomial algorithmK
RSA to generate two random large primes, p
PKG and q
PKG.Step 2.
Choose a random public keye
PKG such that g
c
d
(
e
PKG
,
ϕ
(
N
PKG
)
)
=
1 and compute the private key d
PKG
=
e
PKG
-
1
mod
⁡
ϕ
(
N
PKG
).


### 2.3.2. Signer Secret Key Generation

In this algorithm, the signer gets a copy of his/her secret key from the PKG through a two-step process.Step 1.
A signer submits his/her identity to the PKG.Step 2.
The PKG uses its private keyd
PKG to sign the message digest of the identity to generate the secret key g
j, such that g
j
=
i
j
d
PKG
mod
⁡
N
PKG. No one will be able to distinguish between the identity and its message digest i
j.


### 2.3.3. Message Signing

To generate an identity-based multisignature, each signer carries out the followings steps.Step 1.
Choose a random integerr
j and compute t
j
=
r
j
e
PKG
mod
⁡
N
PKG.Step 2.
Broadcastt
j to other signers.Step 3.
Upon receiving oft
j
,
j
=
1,2
,
…
,
l. each signer computes
(5)
T
=
∏
j
=
1
l
t
j
mod
⁡
N
PKG
s
j
=
g
j
·
r
j
H
(
T
,
m
)
mod
⁡
N
PKG
.Step 4.
Broadcasts
j to all signers.Step 5.
After receiving oft
j
,
j
=
1,2
,
…
,
l. the multisignatures component S can be computed as
(6)
S
=
∏
j
=
1
l
s
j
mod
⁡
N
PKG
.
The multisignature for message m is σ
=
(
T
,
S
).


### 2.3.4. Multisignature Verification

To verify a multisignatureσ
=
(
T
,
S
) of a message m of signers whose identities are i
1
,
i
2
,
…
,
i
l, anyone can verify the correctness as follows:
(7)
S
e
PKG
?
_
_
(
i
1
,
i
2
,
…
,
i
l
)
·
T
H
(
T
,
m
)
mod
⁡
N
PKG
.


## 2.3.1. Private Key Generator (PKG) Keys

The PKG chooses its public and private key pairs as follows.Step 1.
Runs the probabilistic polynomial algorithmK
RSA to generate two random large primes, p
PKG and q
PKG.Step 2.
Choose a random public keye
PKG such that g
c
d
(
e
PKG
,
ϕ
(
N
PKG
)
)
=
1 and compute the private key d
PKG
=
e
PKG
-
1
mod
⁡
ϕ
(
N
PKG
).


## 2.3.2. Signer Secret Key Generation

In this algorithm, the signer gets a copy of his/her secret key from the PKG through a two-step process.Step 1.
A signer submits his/her identity to the PKG.Step 2.
The PKG uses its private keyd
PKG to sign the message digest of the identity to generate the secret key g
j, such that g
j
=
i
j
d
PKG
mod
⁡
N
PKG. No one will be able to distinguish between the identity and its message digest i
j.


## 2.3.3. Message Signing

To generate an identity-based multisignature, each signer carries out the followings steps.Step 1.
Choose a random integerr
j and compute t
j
=
r
j
e
PKG
mod
⁡
N
PKG.Step 2.
Broadcastt
j to other signers.Step 3.
Upon receiving oft
j
,
j
=
1,2
,
…
,
l. each signer computes
(5)
T
=
∏
j
=
1
l
t
j
mod
⁡
N
PKG
s
j
=
g
j
·
r
j
H
(
T
,
m
)
mod
⁡
N
PKG
.Step 4.
Broadcasts
j to all signers.Step 5.
After receiving oft
j
,
j
=
1,2
,
…
,
l. the multisignatures component S can be computed as
(6)
S
=
∏
j
=
1
l
s
j
mod
⁡
N
PKG
.
The multisignature for message m is σ
=
(
T
,
S
).


## 2.3.4. Multisignature Verification

To verify a multisignatureσ
=
(
T
,
S
) of a message m of signers whose identities are i
1
,
i
2
,
…
,
i
l, anyone can verify the correctness as follows:
(7)
S
e
PKG
?
_
_
(
i
1
,
i
2
,
…
,
i
l
)
·
T
H
(
T
,
m
)
mod
⁡
N
PKG
.


## 3. The Proposed Joint E-Lottery Protocol

The structure of our scheme is illustrated in Figure1.Figure 1
The structure of our scheme.There are four participants involved in the proposed e-lottery scheme.(1)
Private Key Generator (PKG). The off-line trusted third party which generates private keys to all participants.
(2)
Player (P). The player is a participator in the lottery gamble.
(3)
TradingPlatform (TP). The trading platform is a website to provide players for joining the e-lottery game.
(4)
Lottery Originator (LO). The LO issues the lotteries, generates the winning numbers to sell lotteries to gain revenue, and gives out the prizes.Step 1.
P, TP, LO↔ PKG: all participants must register to PKG to acquire their private key with his/her pseudoidentity.Step 2.
P↔ TP: the players bet their favorite numbers to the TP.Step 3.
TP→LO: the TP gathers the statistics on the betting numbers to generate the majority of popular numbers and then purchases the popular numbers with the LO.Step 4.
LO→P: the LO issues lotteries to the players.Step 5.
P↔ LO: after the winning numbers are announced, the winning players use their winning lotteries and private keys to claim the prizes won.The following notations are used in our protocol:number
j: the favorite numbers of the jth player;
chain
j: the published hash chain set of the valid random seed β
j generated by player, which is involved in generating the winning number, where chain0 is the initial vector; the chain
0
=
0, chain
1
=
H
(
chain
0
,
β
1
), chain
2
=
H
(
chain
1
,
β
2
), and chain
j
=
H
(
chain
j
-
1
,
β
j
);
C
i: the ith ciphertext;
σ
m: the identity-based signature of message m;
m
req: the request message;
i
j: the message digest of the jth player’s identity;
PL: the purchased list, wherePL
=
(
i
j
,
β
j
);
H
(
·
): one way hash function [15];
r
X: the random number is selected by X;
β
j: the hash value, where β
j
=
H
(
r
X
);
K
X
-
Y: the session key between the X and Y which is constructed by IETF [16, 17];
E
(
K
X
-
Y
,
(
m
)
): an encryption function which uses the session key K
X
-
Y to encrypt the message m;
D
(
K
X
-
Y
,
(
C
)
): a decryption function which uses the session key K
X
-
Y to decrypt the ciphertext C.


### 3.1. Constructing the Session Key Model

Diffie and Hellman proposed a key agreement protocol [18] in 1978. The RFC 2631 was drawn up for the key agreement protocol in 1999 by the IETF. Therefore, we use the RFC 2631 protocol to construct the session keys. The session keys are used in our protocol with three situations. First, when the purchase is individual, the player must share the session key to protect his/her favorite numbers. Second, the TP and LO are jointed to sign the multisignature; they must share a common secret key to encrypt the signature. Third, the LO issues the lotteries to players, and the winning players send the claim prize message to the LO; they must also share a session key to encrypt or decrypt the messages.


### 3.2. The Initialization Phase

In this phase, the PKG performs the keys generating function to generate the public and private keys. On the other hand, the LO performs the VRF to generate the related functions and then publishes it.Step 1.
The PKG selects a random numberk and then performs Gen
(
k
) to generate the public e
PKG and private d
PKG.Step 2.
The LO performs the VRF to generate the related functions that includeEval
(
·
,
·
)
,
Prove
(
·
,
·
), and Verify
(
·
,
·
,
·
).


### 3.3. The Registration Phase

In this phase, all of the roles submit their identities to the PKG to become legal participants. Notably, the players must submit their identities (including the players’ name, email, and addresses) and a random number to PKG and then PKG signs the message digest of the identity by itsd
PKG and d
PKG.The PKG computes the participants’ private keys with itsd
PKG as in the following equations:
(8)
d
j
=
i
j
d
PKG
mod
⁡
N
PKG
for
j
=
1,2
,
…
,
n
.
d
TP
=
ID
TP
d
PKG
mod
⁡
N
PKG
,
d
LO
=
ID
LO
d
PKG
mod
⁡
N
PKG
.After that, the PKG publishes IDTP and IDLO on the bulletin board.


### 3.4. The Players Bet for Lottery Numbers Phase

In this phase, the players can bet their favorite numbers via the TP and then the TP publishes the purchase information on the bulletin board. When this phase is finished, the TP will send bulletin board information to the LO. According to the received information, the LO publishes the winning numbers. Moreover, players, TP, and LO can use the published bulletin board information to check whether or not the following three information items are correct.(1)
The players’ purchased lotteries are included in the hash chain.
(2)
The players’ bet numbers are valid or not.
(3)
The players are legal or not.The individual purchase is also included in the hash chain and the purchased information (including identity information, hash chain value, and hash value of the random number) is also published on the bulletin board, except for the selected favorite numbers.The players bet for lottery numbers phase is illustrated in Figure2, and the bulletin board information is illustrated in Table 1.Table 1
The information of bulletin board.
Initial condition
chain
0
=
0
chai
n
1
=
H
(
chai
n
0
,
β
1
)
chai
n
2
=
H
(
chai
n
1
,
β
2
)
⋮
chai
n
j
=
H
(
chai
n
j
-
1
,
β
j
)
Identity information
Hash chain value
Hash value of the random numberr
P
j
Selected favorite number
(
i
1
,
σ
i
1
)
chai
n
1
β
1
number
1
(
i
2
,
σ
i
2
)
chai
n
2
β
2
number
2
⋮
⋮
⋮
⋮
(
i
j
,
σ
i
j
)
chain
j
β
j
number
jFigure 2
Overview of the players bet for lottery number phase.If anyone questions the players’ legality then they can use the signature of the players’ identity of the bulletin board to verify the legality of the players by(9)
s
P
j
e
PKG
?
_
_
i
j
·
t
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
.Step 1.
If the purchase is individual then the player must compute session keyK
P
j
-TP (refer to Section 3.1), using it to protect the individual’s favorite number number
j as follows:
(10)
C
1
=
E
(
K
P
j
-TP
,
(
number
j
)
)
.
The individual and joint purchases are both required to process (11)–(15).Then, thejth player selects a random number r
P
jto compute
(11)
β
j
=
H
(
r
P
j
)
,
t
P
j
=
r
P
j
e
PKG
mod
⁡
N
PKG
.
The P
j uses his/her private key d
j to compute
(12)
s
P
j
=
d
j
·
r
P
j
H
(
t
P
j
,
i
j
,
number
j
,
β
j
)
mod
⁡
N
PKG
.
Here, we denote the signature as follows:
(13)
σ
i
j
,
number
j
,
β
j
=
(
s
P
j
,
t
P
j
)
.
Finally, the P
j uses his/her private key d
j to sign his/her identity i
j as follows:
(14)
s
P
j
=
d
j
·
r
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
.
We denote the signature as follows:
(15)
σ
i
j
=
(
s
P
j
,
t
P
j
)
.
The difference between the multisignature σ
i
j and σ
i
j
,
number
j
,
β
j is that the former is published on the bulletin board and all participants can use it to verify the player’s legality, while the latter is used to achieve the message nonrepudiation for the TP.Afterward, if the purchase is individual then the request messagem
req, signature σ
i
j
,
number
j
,
β
j, and related parameters (
i
j
,
C
1
,
β
j
) are sent to the TP.If the purchase is joint, the request messagem
req, signature σ
i
j
,
number
j
,
β
j, and related parameters (
i
j
,
number
j
,
β
j
) are sent to the TP.Step 2.
After receiving the message, if it comes from individual purchase then the TP must decrypt the ciphertextC
1 to obtain number
j and then the following procedures are processed for individual and joint purchases.
First, the TP checks the validity of signature as follows:(16)
s
P
j
e
PKG
?
_
_
i
j
·
t
P
j
H
(
t
P
j
,
i
j
,
number
j
,
β
j
)
mod
⁡
N
PKG
.
The TP links β
j into the hash chain as follows:
(17)
chain
j
=
H
(
chain
j
-
1
,
β
j
)
.
Next, the TP selects a random number r
TP to compute
(18)
t
TP
=
r
TP
e
PKG
mod
⁡
N
PKG
s
TP
=
d
TP
·
r
TP
H
(
t
TP
,
m
req
)
mod
⁡
N
PKG
.
Here, we denote the signature of m
req as follows:
(19)
σ
m
req
=
(
s
TP
,
t
TP
)
.
Finally, TP sends signature (
σ
m
req
,
m
req
) to the P
j.Step 3.
After receiving(
σ
m
req
,
m
req
), P
j checks the validity of signature as follows:
(20)
s
TP
e
PKG
?
_
_
ID
TP
·
t
TP
H
(
t
TP
,
m
req
)
mod
⁡
N
PKG
.
If the signature is invalid, then the P
j terminates the transaction.


### 3.5. The Purchase Phase

After the purchase deadline, the TP gathers the statistics on numbers to generate the popular numbers. Subsequently, the TP sends the purchase message that includes purchase list and the partial signature to the LO. Note that the lottery’s numbers of individual purchase are determined by individual buyers rather than through counting by TP; individual purchase is the same as joint purchase.(1)
The individual purchase is included in the purchase list.
(2)
The TP also computes the partial signature for individual purchase.The overview of the purchase phase is illustrated in Figure3.Figure 3
Overview of the purchase phase.Step 1.
After the purchase deadline, the TP counts the preferred numbers of all of the players to generate the popular numbers Num; then the TP selects a random numberr
TP to compute the partial signature t
TP and s
TP as follows:
(21)
t
TP
=
r
TP
e
PKG
mod
⁡
N
PKG
s
TP
=
d
TP
·
r
TP
H
(
t
TP
,
Num
)
mod
⁡
N
PKG
.
Here, we denote the signature of Num as follows:
(22)
σ
Num
=
(
s
TP
,
t
TP
)
.
Finally, the TP sends the request message m
req, signature σ
Num, and the popular numbers Num to the LO.Step 2.
Before receiving the message(
m
req
,
σ
Num
,
Num
), the LO checks the signature validity as follows:
(23)
s
TP
e
PKG
?
_
_
ID
TP
·
t
TP
H
(
t
TP
,
Num
)
mod
⁡
N
PKG
.
Subsequently, the LO selects random number r
LO to compute
(24)
t
LO
=
r
LO
e
PKG
mod
⁡
N
PKG
.
LO uses the partial signature of the TP and LO to compute T as follows:
(25)
T
=
t
TP
·
t
LO
mod
⁡
N
PKG
.
The TP and LO construct the session key K
TP-LO and then encrypt the partial signature as follows:
(26)
C
2
=
E
(
K
TP-LO
,
(
T
)
)
.
The LO uses the private key d
LO to compute the partial signature of C
2 as follows:
(27)
s
LO
=
d
LO
·
r
LO
H
(
t
LO
,
C
2
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
2 as
(28)
σ
C
2
=
(
s
LO
,
t
LO
)
.
Finally, the LO sends (
m
req
,
σ
C
2
,
C
2
) to TP.Step 3.
After receiving(
σ
C
3
,
m
req
), the TP checks the validity of signature as follows:
(29)
s
LO
e
PKG
?
_
_
ID
LO
·
t
LO
H
(
t
LO
,
C
2
)
mod
⁡
N
PKG
.
The TP uses the session key K
TP-LO to decrypt the cipher text as follows:
(30)
T
=
D
(
K
TP-LO
,
(
C
2
)
)
.
According to the purchased list PL, the TP uses its private key d
TP to compute the partial multisignatures w
j
TPof the player’s lottery as in (31) as follows:
(31)
w
j
TP
=
d
TP
·
r
TP
H
(
T
,
β
j
,
Num
)
mod
⁡
N
PKG
,
for
j
=
1,2
,
…
,
n
.
To protect the message, the TP uses the session key K
TP-LO to encrypt parameters (
w
1
TP
,
w
2
TP
,
…
,
w
j
TP
,
PL
) as follows:
(32)
C
3
=
E
(
K
TP-LO
,
(
w
1
TP
,
w
2
TP
,
…
,
w
j
TP
,
PL
)
)
.
The TP uses its private key d
TP to compute the partial signature of C
3 as
(33)
s
TP
=
d
TP
·
r
TP
H
(
t
TP
,
C
3
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
3 as follows:
(34)
σ
C
3
=
(
s
TP
,
t
TP
)
.
Afterward, the TP sends the request message m
req, signature σ
C
3
,and cipher message C
3 to the LO.Step 4.
Once receiving the message(
m
req
,
σ
3
,
C
3
), the LO checks the signature validity as follows:
(35)
s
TP
e
PKG
?
_
_
ID
TP
·
t
TP
H
(
t
TP
,
C
3
)
mod
⁡
N
PKG
.
The LO uses its private key d
LO to decrypt the cipher text as follows:
(36)
(
w
1
TP
,
w
2
TP
,
…
,
w
j
TP
,
PL
)
=
D
(
K
TP-LO
,
(
C
3
)
)
.
According to the purchase list PL, the LO uses its private key d
LO to compute the partial multisignatures w
j
LOof all players as follows:
(37)
w
j
LO
=
d
LO
·
r
LO
H
(
T
,
β
j
,
Num
)
mod
⁡
N
PKG
,
for
j
=
1,2
,
…
,
n
and then LO uses the partial multisignatures of w
j
TPand w
j
LOto compute
(38)
W
j
=
w
j
TP
·
w
j
LO
mod
⁡
N
PKG
,
for
j
=
1,2
,
…
,
n
.
We denote the lottery lottery
j as
(39)
lottery
j
=
(
W
j
,
T
)
,
for
j
=
1,2
,
…
,
n
.


### 3.6. The Lottery Issue Phase

Upon receiving the purchase message, the LO issues the lotteries to all players (including the joint purchase and individual purchase) and then the players can apply the multisignature to verify the validity of the lottery. The lottery issue phase is illustrated in Figure4.Figure 4
Overview of the lottery issue phase.Step 1.
The LO andP
j construct the session key K
LO-
P
j and then encrypt the lottery
j as follows:
(40)
C
4
=
E
(
K
LO-
P
j
,
(
lottery
j
)
)
.
Next, the LO selects random number r
LO to compute
(41)
t
LO
=
r
LO
e
PKG
mod
⁡
N
PKG
and uses its private key d
LO to compute the partial signature as follows:
(42)
s
LO
=
d
LO
·
r
LO
H
(
t
LO
,
C
4
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
4 as follows:
(43)
σ
C
4
=
(
s
LO
,
t
LO
)
.
Afterward, the LO sends the request message m
req, signature σ
C
4, and ciphertext C
4 to P
j.Step 2.
When receiving the message(
m
req
,
σ
4
,
C
4
), P
j checks the validity of signature as follows:
(44)
s
LO
e
PKG
?
_
_
ID
LO
·
t
LO
H
(
t
LO
,
C
4
)
mod
⁡
N
PKG
and then uses the session key K
LO-
P
j to decrypt ciphertext C
4 as follows:
(45)
lottery
j
=
D
(
K
LO-
P
j
,
(
C
4
)
)
.
Finally, P
j checks the validity of signature as follows:
(46)
W
j
e
PKG
?
_
_
(
ID
TP
,
ID
LO
)
·
T
H
(
T
,
β
j
,
Num
)
mod
⁡
N
PKG
.


### 3.7. The Winning Numbers Generation and Verification Phase

After the lottery purchase deadline, the LO uses the function of winning numbers generation with the value of final hash chain to generate the winning numbers and then publishes it on the bulletin board. The overview of the winning numbers generation and verification phase is illustrated in Figure5.Figure 5
Overview of the winning numbers generation and verification phase.Simultaneously, if the players question whether or not the LO is honest, they can use the public verification function to verify the correctness of the winning numbers.Step 1.
The LO uses its private keyd
LO and the value of final hash chain chain
n to calculate
(47)
WinNum
=
Eval
(
d
LO
,
chain
n
)
π
=
Prove
(
d
LO
,
chain
n
)
.
Finally, the LO publishes the WinNum and π on the bulletin board.Step 2.
After the winning numbers are published, any player can checkthecorrectness of the winning numbers via the public verification function as follows:(48)
Verify
(
ID
LO
,
WinNum
,
chain
n
,
π
)
?
_
_
1
.


### 3.8. The Claim Prize Phase

After the winning numbers are published, the winner ofjth player can submit his/her winning lottery and the random number to claim the prize. Simultaneously, the LO publishes the winning lotteries, random number of winning player selected, and identity digest of winners on the bulletin board. If the other players suspect the legality of winning lottery, they can use the public verification function to verify it. The overview of the claim prize phase is illustrated in Figure 6.Figure 6
Overview of the claim prize phase.Step 1.
TheP
j and LO construct the session key K
LO-
P
j. In order to claim the prize, the winning player presents the important evidences (
i
j
,
r
P
j
,
β
j
,
lottery
j
) to prove his/her identity and then uses the session key K
LO-
P
j to encrypt that evidence as follows:
(49)
C
5
=
E
(
K
LO-
P
j
,
(
i
j
,
r
P
j
,
β
j
,
lottery
j
)
)
.
Next, the P
j computes as
(50)
t
P
j
=
r
P
j
e
PKG
mod
⁡
N
PKG
and uses its private key d
j to compute the partial signature as follows:
(51)
s
P
j
=
d
j
·
r
P
j
H
(
t
P
j
,
C
5
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
5 as follows:
(52)
σ
C
5
=
(
s
P
j
,
t
P
j
)
.
Afterward, P
j sends the request message m
req, signature σ
C
5, and ciphertext C
5 to LO.Step 2.
Once receiving message(
m
req
,
σ
5
,
C
5
), the LO checks the signature validity as follows:
(53)
s
P
j
e
PKG
?
_
_
ID
P
j
·
t
P
j
H
(
t
P
j
,
C
5
)
mod
⁡
N
PKG
and then uses the session key K
LO-
P
j to decrypt the cipher message C
5 as follows:
(54)
(
i
j
,
r
P
j
,
β
j
,
lottery
j
)
=
D
(
K
LO-
P
j
,
(
C
5
)
)
.
If (53) holds, and then computes β
j
′ as follows
(55)
β
j
′
=
H
(
r
P
j
)
.
Finally, the LO uses the multisignature to verify the correctness of winning lottery as
(56)
W
j
e
PKG
?
_
_
(
ID
TP
,
ID
LO
)
·
T
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
.


## 3.1. Constructing the Session Key Model

Diffie and Hellman proposed a key agreement protocol [18] in 1978. The RFC 2631 was drawn up for the key agreement protocol in 1999 by the IETF. Therefore, we use the RFC 2631 protocol to construct the session keys. The session keys are used in our protocol with three situations. First, when the purchase is individual, the player must share the session key to protect his/her favorite numbers. Second, the TP and LO are jointed to sign the multisignature; they must share a common secret key to encrypt the signature. Third, the LO issues the lotteries to players, and the winning players send the claim prize message to the LO; they must also share a session key to encrypt or decrypt the messages.


## 3.2. The Initialization Phase

In this phase, the PKG performs the keys generating function to generate the public and private keys. On the other hand, the LO performs the VRF to generate the related functions and then publishes it.Step 1.
The PKG selects a random numberk and then performs Gen
(
k
) to generate the public e
PKG and private d
PKG.Step 2.
The LO performs the VRF to generate the related functions that includeEval
(
·
,
·
)
,
Prove
(
·
,
·
), and Verify
(
·
,
·
,
·
).


## 3.3. The Registration Phase

In this phase, all of the roles submit their identities to the PKG to become legal participants. Notably, the players must submit their identities (including the players’ name, email, and addresses) and a random number to PKG and then PKG signs the message digest of the identity by itsd
PKG and d
PKG.The PKG computes the participants’ private keys with itsd
PKG as in the following equations:
(8)
d
j
=
i
j
d
PKG
mod
⁡
N
PKG
for
j
=
1,2
,
…
,
n
.
d
TP
=
ID
TP
d
PKG
mod
⁡
N
PKG
,
d
LO
=
ID
LO
d
PKG
mod
⁡
N
PKG
.After that, the PKG publishes IDTP and IDLO on the bulletin board.


## 3.4. The Players Bet for Lottery Numbers Phase

In this phase, the players can bet their favorite numbers via the TP and then the TP publishes the purchase information on the bulletin board. When this phase is finished, the TP will send bulletin board information to the LO. According to the received information, the LO publishes the winning numbers. Moreover, players, TP, and LO can use the published bulletin board information to check whether or not the following three information items are correct.(1)
The players’ purchased lotteries are included in the hash chain.
(2)
The players’ bet numbers are valid or not.
(3)
The players are legal or not.The individual purchase is also included in the hash chain and the purchased information (including identity information, hash chain value, and hash value of the random number) is also published on the bulletin board, except for the selected favorite numbers.The players bet for lottery numbers phase is illustrated in Figure2, and the bulletin board information is illustrated in Table 1.Table 1
The information of bulletin board.
Initial condition
chain
0
=
0
chai
n
1
=
H
(
chai
n
0
,
β
1
)
chai
n
2
=
H
(
chai
n
1
,
β
2
)
⋮
chai
n
j
=
H
(
chai
n
j
-
1
,
β
j
)
Identity information
Hash chain value
Hash value of the random numberr
P
j
Selected favorite number
(
i
1
,
σ
i
1
)
chai
n
1
β
1
number
1
(
i
2
,
σ
i
2
)
chai
n
2
β
2
number
2
⋮
⋮
⋮
⋮
(
i
j
,
σ
i
j
)
chain
j
β
j
number
jFigure 2
Overview of the players bet for lottery number phase.If anyone questions the players’ legality then they can use the signature of the players’ identity of the bulletin board to verify the legality of the players by(9)
s
P
j
e
PKG
?
_
_
i
j
·
t
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
.Step 1.
If the purchase is individual then the player must compute session keyK
P
j
-TP (refer to Section 3.1), using it to protect the individual’s favorite number number
j as follows:
(10)
C
1
=
E
(
K
P
j
-TP
,
(
number
j
)
)
.
The individual and joint purchases are both required to process (11)–(15).Then, thejth player selects a random number r
P
jto compute
(11)
β
j
=
H
(
r
P
j
)
,
t
P
j
=
r
P
j
e
PKG
mod
⁡
N
PKG
.
The P
j uses his/her private key d
j to compute
(12)
s
P
j
=
d
j
·
r
P
j
H
(
t
P
j
,
i
j
,
number
j
,
β
j
)
mod
⁡
N
PKG
.
Here, we denote the signature as follows:
(13)
σ
i
j
,
number
j
,
β
j
=
(
s
P
j
,
t
P
j
)
.
Finally, the P
j uses his/her private key d
j to sign his/her identity i
j as follows:
(14)
s
P
j
=
d
j
·
r
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
.
We denote the signature as follows:
(15)
σ
i
j
=
(
s
P
j
,
t
P
j
)
.
The difference between the multisignature σ
i
j and σ
i
j
,
number
j
,
β
j is that the former is published on the bulletin board and all participants can use it to verify the player’s legality, while the latter is used to achieve the message nonrepudiation for the TP.Afterward, if the purchase is individual then the request messagem
req, signature σ
i
j
,
number
j
,
β
j, and related parameters (
i
j
,
C
1
,
β
j
) are sent to the TP.If the purchase is joint, the request messagem
req, signature σ
i
j
,
number
j
,
β
j, and related parameters (
i
j
,
number
j
,
β
j
) are sent to the TP.Step 2.
After receiving the message, if it comes from individual purchase then the TP must decrypt the ciphertextC
1 to obtain number
j and then the following procedures are processed for individual and joint purchases.
First, the TP checks the validity of signature as follows:(16)
s
P
j
e
PKG
?
_
_
i
j
·
t
P
j
H
(
t
P
j
,
i
j
,
number
j
,
β
j
)
mod
⁡
N
PKG
.
The TP links β
j into the hash chain as follows:
(17)
chain
j
=
H
(
chain
j
-
1
,
β
j
)
.
Next, the TP selects a random number r
TP to compute
(18)
t
TP
=
r
TP
e
PKG
mod
⁡
N
PKG
s
TP
=
d
TP
·
r
TP
H
(
t
TP
,
m
req
)
mod
⁡
N
PKG
.
Here, we denote the signature of m
req as follows:
(19)
σ
m
req
=
(
s
TP
,
t
TP
)
.
Finally, TP sends signature (
σ
m
req
,
m
req
) to the P
j.Step 3.
After receiving(
σ
m
req
,
m
req
), P
j checks the validity of signature as follows:
(20)
s
TP
e
PKG
?
_
_
ID
TP
·
t
TP
H
(
t
TP
,
m
req
)
mod
⁡
N
PKG
.
If the signature is invalid, then the P
j terminates the transaction.


## 3.5. The Purchase Phase

After the purchase deadline, the TP gathers the statistics on numbers to generate the popular numbers. Subsequently, the TP sends the purchase message that includes purchase list and the partial signature to the LO. Note that the lottery’s numbers of individual purchase are determined by individual buyers rather than through counting by TP; individual purchase is the same as joint purchase.(1)
The individual purchase is included in the purchase list.
(2)
The TP also computes the partial signature for individual purchase.The overview of the purchase phase is illustrated in Figure3.Figure 3
Overview of the purchase phase.Step 1.
After the purchase deadline, the TP counts the preferred numbers of all of the players to generate the popular numbers Num; then the TP selects a random numberr
TP to compute the partial signature t
TP and s
TP as follows:
(21)
t
TP
=
r
TP
e
PKG
mod
⁡
N
PKG
s
TP
=
d
TP
·
r
TP
H
(
t
TP
,
Num
)
mod
⁡
N
PKG
.
Here, we denote the signature of Num as follows:
(22)
σ
Num
=
(
s
TP
,
t
TP
)
.
Finally, the TP sends the request message m
req, signature σ
Num, and the popular numbers Num to the LO.Step 2.
Before receiving the message(
m
req
,
σ
Num
,
Num
), the LO checks the signature validity as follows:
(23)
s
TP
e
PKG
?
_
_
ID
TP
·
t
TP
H
(
t
TP
,
Num
)
mod
⁡
N
PKG
.
Subsequently, the LO selects random number r
LO to compute
(24)
t
LO
=
r
LO
e
PKG
mod
⁡
N
PKG
.
LO uses the partial signature of the TP and LO to compute T as follows:
(25)
T
=
t
TP
·
t
LO
mod
⁡
N
PKG
.
The TP and LO construct the session key K
TP-LO and then encrypt the partial signature as follows:
(26)
C
2
=
E
(
K
TP-LO
,
(
T
)
)
.
The LO uses the private key d
LO to compute the partial signature of C
2 as follows:
(27)
s
LO
=
d
LO
·
r
LO
H
(
t
LO
,
C
2
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
2 as
(28)
σ
C
2
=
(
s
LO
,
t
LO
)
.
Finally, the LO sends (
m
req
,
σ
C
2
,
C
2
) to TP.Step 3.
After receiving(
σ
C
3
,
m
req
), the TP checks the validity of signature as follows:
(29)
s
LO
e
PKG
?
_
_
ID
LO
·
t
LO
H
(
t
LO
,
C
2
)
mod
⁡
N
PKG
.
The TP uses the session key K
TP-LO to decrypt the cipher text as follows:
(30)
T
=
D
(
K
TP-LO
,
(
C
2
)
)
.
According to the purchased list PL, the TP uses its private key d
TP to compute the partial multisignatures w
j
TPof the player’s lottery as in (31) as follows:
(31)
w
j
TP
=
d
TP
·
r
TP
H
(
T
,
β
j
,
Num
)
mod
⁡
N
PKG
,
for
j
=
1,2
,
…
,
n
.
To protect the message, the TP uses the session key K
TP-LO to encrypt parameters (
w
1
TP
,
w
2
TP
,
…
,
w
j
TP
,
PL
) as follows:
(32)
C
3
=
E
(
K
TP-LO
,
(
w
1
TP
,
w
2
TP
,
…
,
w
j
TP
,
PL
)
)
.
The TP uses its private key d
TP to compute the partial signature of C
3 as
(33)
s
TP
=
d
TP
·
r
TP
H
(
t
TP
,
C
3
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
3 as follows:
(34)
σ
C
3
=
(
s
TP
,
t
TP
)
.
Afterward, the TP sends the request message m
req, signature σ
C
3
,and cipher message C
3 to the LO.Step 4.
Once receiving the message(
m
req
,
σ
3
,
C
3
), the LO checks the signature validity as follows:
(35)
s
TP
e
PKG
?
_
_
ID
TP
·
t
TP
H
(
t
TP
,
C
3
)
mod
⁡
N
PKG
.
The LO uses its private key d
LO to decrypt the cipher text as follows:
(36)
(
w
1
TP
,
w
2
TP
,
…
,
w
j
TP
,
PL
)
=
D
(
K
TP-LO
,
(
C
3
)
)
.
According to the purchase list PL, the LO uses its private key d
LO to compute the partial multisignatures w
j
LOof all players as follows:
(37)
w
j
LO
=
d
LO
·
r
LO
H
(
T
,
β
j
,
Num
)
mod
⁡
N
PKG
,
for
j
=
1,2
,
…
,
n
and then LO uses the partial multisignatures of w
j
TPand w
j
LOto compute
(38)
W
j
=
w
j
TP
·
w
j
LO
mod
⁡
N
PKG
,
for
j
=
1,2
,
…
,
n
.
We denote the lottery lottery
j as
(39)
lottery
j
=
(
W
j
,
T
)
,
for
j
=
1,2
,
…
,
n
.


## 3.6. The Lottery Issue Phase

Upon receiving the purchase message, the LO issues the lotteries to all players (including the joint purchase and individual purchase) and then the players can apply the multisignature to verify the validity of the lottery. The lottery issue phase is illustrated in Figure4.Figure 4
Overview of the lottery issue phase.Step 1.
The LO andP
j construct the session key K
LO-
P
j and then encrypt the lottery
j as follows:
(40)
C
4
=
E
(
K
LO-
P
j
,
(
lottery
j
)
)
.
Next, the LO selects random number r
LO to compute
(41)
t
LO
=
r
LO
e
PKG
mod
⁡
N
PKG
and uses its private key d
LO to compute the partial signature as follows:
(42)
s
LO
=
d
LO
·
r
LO
H
(
t
LO
,
C
4
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
4 as follows:
(43)
σ
C
4
=
(
s
LO
,
t
LO
)
.
Afterward, the LO sends the request message m
req, signature σ
C
4, and ciphertext C
4 to P
j.Step 2.
When receiving the message(
m
req
,
σ
4
,
C
4
), P
j checks the validity of signature as follows:
(44)
s
LO
e
PKG
?
_
_
ID
LO
·
t
LO
H
(
t
LO
,
C
4
)
mod
⁡
N
PKG
and then uses the session key K
LO-
P
j to decrypt ciphertext C
4 as follows:
(45)
lottery
j
=
D
(
K
LO-
P
j
,
(
C
4
)
)
.
Finally, P
j checks the validity of signature as follows:
(46)
W
j
e
PKG
?
_
_
(
ID
TP
,
ID
LO
)
·
T
H
(
T
,
β
j
,
Num
)
mod
⁡
N
PKG
.


## 3.7. The Winning Numbers Generation and Verification Phase

After the lottery purchase deadline, the LO uses the function of winning numbers generation with the value of final hash chain to generate the winning numbers and then publishes it on the bulletin board. The overview of the winning numbers generation and verification phase is illustrated in Figure5.Figure 5
Overview of the winning numbers generation and verification phase.Simultaneously, if the players question whether or not the LO is honest, they can use the public verification function to verify the correctness of the winning numbers.Step 1.
The LO uses its private keyd
LO and the value of final hash chain chain
n to calculate
(47)
WinNum
=
Eval
(
d
LO
,
chain
n
)
π
=
Prove
(
d
LO
,
chain
n
)
.
Finally, the LO publishes the WinNum and π on the bulletin board.Step 2.
After the winning numbers are published, any player can checkthecorrectness of the winning numbers via the public verification function as follows:(48)
Verify
(
ID
LO
,
WinNum
,
chain
n
,
π
)
?
_
_
1
.


## 3.8. The Claim Prize Phase

After the winning numbers are published, the winner ofjth player can submit his/her winning lottery and the random number to claim the prize. Simultaneously, the LO publishes the winning lotteries, random number of winning player selected, and identity digest of winners on the bulletin board. If the other players suspect the legality of winning lottery, they can use the public verification function to verify it. The overview of the claim prize phase is illustrated in Figure 6.Figure 6
Overview of the claim prize phase.Step 1.
TheP
j and LO construct the session key K
LO-
P
j. In order to claim the prize, the winning player presents the important evidences (
i
j
,
r
P
j
,
β
j
,
lottery
j
) to prove his/her identity and then uses the session key K
LO-
P
j to encrypt that evidence as follows:
(49)
C
5
=
E
(
K
LO-
P
j
,
(
i
j
,
r
P
j
,
β
j
,
lottery
j
)
)
.
Next, the P
j computes as
(50)
t
P
j
=
r
P
j
e
PKG
mod
⁡
N
PKG
and uses its private key d
j to compute the partial signature as follows:
(51)
s
P
j
=
d
j
·
r
P
j
H
(
t
P
j
,
C
5
)
mod
⁡
N
PKG
.
Here, we denote the signature of C
5 as follows:
(52)
σ
C
5
=
(
s
P
j
,
t
P
j
)
.
Afterward, P
j sends the request message m
req, signature σ
C
5, and ciphertext C
5 to LO.Step 2.
Once receiving message(
m
req
,
σ
5
,
C
5
), the LO checks the signature validity as follows:
(53)
s
P
j
e
PKG
?
_
_
ID
P
j
·
t
P
j
H
(
t
P
j
,
C
5
)
mod
⁡
N
PKG
and then uses the session key K
LO-
P
j to decrypt the cipher message C
5 as follows:
(54)
(
i
j
,
r
P
j
,
β
j
,
lottery
j
)
=
D
(
K
LO-
P
j
,
(
C
5
)
)
.
If (53) holds, and then computes β
j
′ as follows
(55)
β
j
′
=
H
(
r
P
j
)
.
Finally, the LO uses the multisignature to verify the correctness of winning lottery as
(56)
W
j
e
PKG
?
_
_
(
ID
TP
,
ID
LO
)
·
T
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
.


## 4. Analysis

Here, we use many kinds of scenarios to analyze the proposed joint electronic lottery scheme and to verify whether or not it achieves the requirements. In order to simplify the explanation, suppose there exists an intruderEve in the network system and she is capable of eavesdropping communications between the TP, LO, and players.


### 4.1. Public Verification

All the valid lotteries and the winning numbers must be verified via a verifiable random function.Scenario 1. Suppose that any player suspects the correctness of winning numbers.Proof.
The one suspecting can use (48) to verify the correctness of the winning numbers by (48).Scenario 2. Suppose that any player suspects the correctness of winning lotteries.Proof.
The one suspecting can use the related parameters (including random number of the winning player selectedr
P
j, the winning numbers WinNum, and the winning lottery (
W
j
,
T
)) and (56) to verify the correctness of winning lotteries. The verification equation is as in (56), where β
j
′
=
H
(
r
P
j
).
The derivation of the verification is shown as follows:(57)
(
ID
TP
·
ID
LO
)
·
T
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
=
(
d
TP
e
PKG
·
d
LO
e
PKG
)
·
(
t
TP
·
t
LO
)
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
=
(
d
TP
e
PKG
·
d
LO
e
PKG
)
·
(
r
TP
e
PKG
·
r
LO
e
PKG
)
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
=
(
d
TP
e
PKG
·
d
LO
e
PKG
)
·
(
r
TP
e
PKG
·
H
(
T
,
β
j
′
,
WinNum
)
00000000000000
·
r
LO
e
PKG
·
H
(
T
,
β
j
′
,
WinNum
)
)
mod
⁡
N
PKG
=
(
(
d
TP
·
d
LO
)
·
(
r
TP
H
(
T
,
β
j
′
,
WinNum
)
hhhhhhhhhhhhhhh
·
r
LO
H
(
T
,
β
j
′
,
WinNum
)
)
)
e
PKG
mod
⁡
N
PKG
=
(
(
d
TP
·
r
TP
H
(
T
,
β
j
′
,
WinNum
)
)
hhhhh
·
(
d
LO
·
r
LO
H
(
T
,
β
j
′
,
WinNum
)
)
)
e
PKG
mod
⁡
N
PKG
=
(
w
j
TP
·
w
j
LO
)
e
PKG
mod
⁡
N
PKG
=
W
j
e
PKG
mod
⁡
N
PKG
.
Because the multisignature of the winning numbers is valid, the winning lottery is correct.


### 4.2. Fairness

No one can predict the winning result before the LO publishes the winning numbers.Scenario 3. If a player wants to predict or bias the winning result, he or she will fail.Proof.
Since each purchasing behavior is random and occasional, the final value of hash chainchain
n is contributed by all of the lotteries. Hence, no one can learn the final value of the hash chain chain
n.


### 4.3. Security

No one can forge winning lotteries or impersonate lottery winners to claim their prize.Scenario 4. IfEve tries to forge a winning lottery to claim the prize, she will fail.Proof.
In reviewing the purchase phase, the TP and LO used their private keysd
TP and d
LO to sign the lotteries. On the other hand, ifEve wants to fake the winning lottery, she must forge their private keys, respectively. In fact, she must solve the factorization problem in RSA cryptosystems [19].Scenario 5. IfEve tries to forge a winning player, she will fail.Proof.
In the prize claim phase, the lottery winner must submit his/her digesti
j, random number r
P
j and β
j (where β
j
=
H
(
r
P
j
)) to proof his/her identity. IfEve uses the fake random number r
P
j
′ to claim the prize, then LO can perceive the attempt via the following equation:
(58)
β
j
?
_
_
H
(
r
P
j
′
)
.On the other hand, ifEve wants to impersonate a winning player, she must find the r
P
j. In fact, based on the secure one way hash function, it is computationally infeasible to obtain r
P
j from β
j.


### 4.4. Correctness

The players can verify the public information via the bulletin board by themselves.Scenario 6. The one suspecting questions(1)
the correctness of the player who bet numbersnumber
j,
(2)
the correctness of the value of final hash chainchain
n,
(3)
the correctness of popular numbers Num.Proof.
The one suspecting can use the published bulletin board information to verify thenumber
j, Num, and chain
n as(1)
the players can check whether the bet numbers are equal to the public informationnumber
j;
(2)
they can recalculate all bet numbers of players to determine whether the popular numbers Num is equal to the recalculated value;
(3)
finally, the players can verify the validity of the value of final hash chainchain
n by using the public function hash chain as follows:
(59)
Initial
condition
chain
0
=
0
chain
1
=
H
(
chain
0
,
β
1
)
chain
2
=
H
(
chain
1
,
β
2
)
000000
⋮
chain
n
=
H
(
chain
n
-
1
,
β
n
)
,where n is the number of the sold lottery tickets so far.


### 4.5. Anonymity

Including the TP and LO, no one can identify the player from the lottery.Scenario 7. IfEve tries to distinguish between messages digest i
j and real identity of player, she will fail.Proof.
In the registration phase, the players submit their personal information to the PKG and then PKG generates a message digest with personal information asi
j
=
H (players’ personal information).
The message digest is a well-known cryptographic assumption: the secure one way hash function has properties such that given a messagem, it is easy to compute H
(
m
). On the other hand, it is computationally infeasible to obtain m from H
(
m
). And given H
(
m
), it is infeasible to find m
′ to let H
(
m
)
=
H
(
m
′
). HenceEve cannot find the real identity of the player from i
j.


### 4.6. Convenience

Players are able to purchase lottery tickets if they can access the Internet. Clearly, the proposed joint e-lottery mechanism can achieve this requirement as indicated in the players betting for lottery numbers phase.


### 4.7. Without Preregistration

Players need not register at any lottery organizations in advance. In our scheme, the players need not register at any lottery organizations except for the PKG. In fact, if the players want to join other ID-based applications, the players still need to register to PKG for any PKI applications.


### 4.8. No Online Trusted Third Party

The proposed joint e-lottery mechanism does not require an online TTP.In our scheme, no online TTP is used to participate in all of the transaction scenarios. Therefore, this requirement is completed in our scheme.


### 4.9. Participants’ Legality

The scenario of the proposed joint e-lottery mechanism should ensure participants’ legality.Scenario 8. Suppose that players suspect the legality of the TP and LO.Proof.
In the lottery issuing phase, upon the players receiving lotteries from the LO, players can use the multisignature of lotteries to confirm the legality of TP and LO by (46).
If the equation holds, the participants’ legality can be authenticated.
That is, only the legitimate private key is able to sign the valid signature. From another viewpoint, the PKG uses its private keyd
PKG to generate d
LO in the registration phase; if anyone attempts to forge d
LO he/she must solve the RSA public-key cryptosystem to acquire the private keyd
PKG. In fact, it is an integer factorization problem [19].Scenario 9. Suppose that the players, TP, or LO suspect the legality of player.Proof.
Anyonesuspecting can authenticate the player’s legality by verifying the signatureσ
i
j
=
(
s
P
j
,
t
P
j
) by (9).
If the equation holds, thejth player’s legality can be authenticated; the derivation of the verification is shown as follows:
(60)
i
j
·
t
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
d
j
e
PKG
·
t
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
d
j
e
PKG
·
(
r
P
j
e
PKG
)
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
(
d
j
·
r
P
j
)
e
PKG
·
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
s
P
j
e
PKG
mod
⁡
N
PKG
.From the above derivation of the verification, only the legitimate private keyd
j is able to sign the valid signature. On the other hand, the player is only able to sign the valid signature if he/she registers with the PKG as a legal participant and acquires the private key d
j.


### 4.10. Support Joint and Individual E-Lottery Service

The protocol can support joint and individual e-lottery service, respectively. In our proposed scheme, we propose two purchase models to satisfy the requirements. Hence, two purchase models have the same rights and protections making our proposed scheme more practical and attractive.


### 4.11. Discussions

Our scheme focuses on proposing a secure and fair joint e-lottery, despite requiring more communication, more data transfer, and a higher computational complexity. We compare the functional properties between related works and ours in Table2.Table 2
Comparisons between related works and ours.
Chow et al.’s [4]
Lee and Chang’s [5]
Lee et al.’s [6]
Ours
Security
Yes
Yes
Yes
Yes
Correctness
Yes
Yes
Yes
Yes
Anonymity
Yes
Yes
Yes
Yes
Random generation
Yes
Yes
Yes
Yes
Public verification
Yes
Yes
Yes
Yes
Fairness
Yes
Yes
Yes
Yes
Convenience
Yes
Yes
Yes
Yes
No online trusted third party
Yes
Yes
Yes
Yes
No pre-registration required
Yes
Yes
Yes
Yes
Participants legality
No
No
No
Yes
Support joint and individual e-lottery service
Support individual only
Support individual only
Support individual only
YesTable2 shows that our scheme achieves the two new functional properties in comparison with related works [4–6]: participant’s legality and supporting joint and individual e-lottery service.In addition, we compare mechanisms with the existed lottery websites [8, 9] and ours in Table 3. Basically, [8, 9] only support a lottery agent. So, the player should register with the TP; this differs from ours.Table 3
Comparisons with the existing e-lottery websites.
E-Lottery Syndicates [8]
Myleto [9]
Ours
Support joint and individual e-lottery service
Support individual only
Support joint only
Support joint and individual
Player should register with the TP
Yes
Yes
No
Allows players to verify legality of lottery agent
Absence of verification  mechanisms
Absence of verification mechanisms
Adopts ID-based multi-signature
Allows players and lottery agent to verify the legality of other players
Absence of verification  mechanisms
Absence of verification mechanisms
Adopts ID-based signature
The lottery agent refuses to give out the prize
No remedial measures
No remedial measures
Players hold the TP’s signature to arbitral request
If a malicious player forges a picture to claim prize
Not easy to identify the legal lottery
Not easy to identify the legal lottery
Prompt identification by digital signature
Non-repudiation evidence
Depend on the scanned copy of the lottery shown on the screen
Depend on the scanned copy of the lottery shown on the screen
PKI digital signatureTable3 shows that our scheme adopted the ID-based multisignature to verify the legality of all participants while existing lottery websites lack effective mechanisms to achieve this requirement. On the other hand, the existing websites do not have remedial measures to prevent malicious behaviors by the lottery agent or players; for instance, the lottery agent refuses to give out the prize, a malicious player forges a picture to claim a prize, or the purchased lottery of a player is lost when the lottery agent’s database crashes. Our scheme uses the ID-based multisignature to provide nonrepudiation evidence to prevent the above situations.


## 4.1. Public Verification

All the valid lotteries and the winning numbers must be verified via a verifiable random function.Scenario 1. Suppose that any player suspects the correctness of winning numbers.Proof.
The one suspecting can use (48) to verify the correctness of the winning numbers by (48).Scenario 2. Suppose that any player suspects the correctness of winning lotteries.Proof.
The one suspecting can use the related parameters (including random number of the winning player selectedr
P
j, the winning numbers WinNum, and the winning lottery (
W
j
,
T
)) and (56) to verify the correctness of winning lotteries. The verification equation is as in (56), where β
j
′
=
H
(
r
P
j
).
The derivation of the verification is shown as follows:(57)
(
ID
TP
·
ID
LO
)
·
T
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
=
(
d
TP
e
PKG
·
d
LO
e
PKG
)
·
(
t
TP
·
t
LO
)
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
=
(
d
TP
e
PKG
·
d
LO
e
PKG
)
·
(
r
TP
e
PKG
·
r
LO
e
PKG
)
H
(
T
,
β
j
′
,
WinNum
)
mod
⁡
N
PKG
=
(
d
TP
e
PKG
·
d
LO
e
PKG
)
·
(
r
TP
e
PKG
·
H
(
T
,
β
j
′
,
WinNum
)
00000000000000
·
r
LO
e
PKG
·
H
(
T
,
β
j
′
,
WinNum
)
)
mod
⁡
N
PKG
=
(
(
d
TP
·
d
LO
)
·
(
r
TP
H
(
T
,
β
j
′
,
WinNum
)
hhhhhhhhhhhhhhh
·
r
LO
H
(
T
,
β
j
′
,
WinNum
)
)
)
e
PKG
mod
⁡
N
PKG
=
(
(
d
TP
·
r
TP
H
(
T
,
β
j
′
,
WinNum
)
)
hhhhh
·
(
d
LO
·
r
LO
H
(
T
,
β
j
′
,
WinNum
)
)
)
e
PKG
mod
⁡
N
PKG
=
(
w
j
TP
·
w
j
LO
)
e
PKG
mod
⁡
N
PKG
=
W
j
e
PKG
mod
⁡
N
PKG
.
Because the multisignature of the winning numbers is valid, the winning lottery is correct.


## 4.2. Fairness

No one can predict the winning result before the LO publishes the winning numbers.Scenario 3. If a player wants to predict or bias the winning result, he or she will fail.Proof.
Since each purchasing behavior is random and occasional, the final value of hash chainchain
n is contributed by all of the lotteries. Hence, no one can learn the final value of the hash chain chain
n.


## 4.3. Security

No one can forge winning lotteries or impersonate lottery winners to claim their prize.Scenario 4. IfEve tries to forge a winning lottery to claim the prize, she will fail.Proof.
In reviewing the purchase phase, the TP and LO used their private keysd
TP and d
LO to sign the lotteries. On the other hand, ifEve wants to fake the winning lottery, she must forge their private keys, respectively. In fact, she must solve the factorization problem in RSA cryptosystems [19].Scenario 5. IfEve tries to forge a winning player, she will fail.Proof.
In the prize claim phase, the lottery winner must submit his/her digesti
j, random number r
P
j and β
j (where β
j
=
H
(
r
P
j
)) to proof his/her identity. IfEve uses the fake random number r
P
j
′ to claim the prize, then LO can perceive the attempt via the following equation:
(58)
β
j
?
_
_
H
(
r
P
j
′
)
.On the other hand, ifEve wants to impersonate a winning player, she must find the r
P
j. In fact, based on the secure one way hash function, it is computationally infeasible to obtain r
P
j from β
j.


## 4.4. Correctness

The players can verify the public information via the bulletin board by themselves.Scenario 6. The one suspecting questions(1)
the correctness of the player who bet numbersnumber
j,
(2)
the correctness of the value of final hash chainchain
n,
(3)
the correctness of popular numbers Num.Proof.
The one suspecting can use the published bulletin board information to verify thenumber
j, Num, and chain
n as(1)
the players can check whether the bet numbers are equal to the public informationnumber
j;
(2)
they can recalculate all bet numbers of players to determine whether the popular numbers Num is equal to the recalculated value;
(3)
finally, the players can verify the validity of the value of final hash chainchain
n by using the public function hash chain as follows:
(59)
Initial
condition
chain
0
=
0
chain
1
=
H
(
chain
0
,
β
1
)
chain
2
=
H
(
chain
1
,
β
2
)
000000
⋮
chain
n
=
H
(
chain
n
-
1
,
β
n
)
,where n is the number of the sold lottery tickets so far.


## 4.5. Anonymity

Including the TP and LO, no one can identify the player from the lottery.Scenario 7. IfEve tries to distinguish between messages digest i
j and real identity of player, she will fail.Proof.
In the registration phase, the players submit their personal information to the PKG and then PKG generates a message digest with personal information asi
j
=
H (players’ personal information).
The message digest is a well-known cryptographic assumption: the secure one way hash function has properties such that given a messagem, it is easy to compute H
(
m
). On the other hand, it is computationally infeasible to obtain m from H
(
m
). And given H
(
m
), it is infeasible to find m
′ to let H
(
m
)
=
H
(
m
′
). HenceEve cannot find the real identity of the player from i
j.


## 4.6. Convenience

Players are able to purchase lottery tickets if they can access the Internet. Clearly, the proposed joint e-lottery mechanism can achieve this requirement as indicated in the players betting for lottery numbers phase.


## 4.7. Without Preregistration

Players need not register at any lottery organizations in advance. In our scheme, the players need not register at any lottery organizations except for the PKG. In fact, if the players want to join other ID-based applications, the players still need to register to PKG for any PKI applications.


## 4.8. No Online Trusted Third Party

The proposed joint e-lottery mechanism does not require an online TTP.In our scheme, no online TTP is used to participate in all of the transaction scenarios. Therefore, this requirement is completed in our scheme.


## 4.9. Participants’ Legality

The scenario of the proposed joint e-lottery mechanism should ensure participants’ legality.Scenario 8. Suppose that players suspect the legality of the TP and LO.Proof.
In the lottery issuing phase, upon the players receiving lotteries from the LO, players can use the multisignature of lotteries to confirm the legality of TP and LO by (46).
If the equation holds, the participants’ legality can be authenticated.
That is, only the legitimate private key is able to sign the valid signature. From another viewpoint, the PKG uses its private keyd
PKG to generate d
LO in the registration phase; if anyone attempts to forge d
LO he/she must solve the RSA public-key cryptosystem to acquire the private keyd
PKG. In fact, it is an integer factorization problem [19].Scenario 9. Suppose that the players, TP, or LO suspect the legality of player.Proof.
Anyonesuspecting can authenticate the player’s legality by verifying the signatureσ
i
j
=
(
s
P
j
,
t
P
j
) by (9).
If the equation holds, thejth player’s legality can be authenticated; the derivation of the verification is shown as follows:
(60)
i
j
·
t
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
d
j
e
PKG
·
t
P
j
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
d
j
e
PKG
·
(
r
P
j
e
PKG
)
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
(
d
j
·
r
P
j
)
e
PKG
·
H
(
t
P
j
,
i
j
)
mod
⁡
N
PKG
=
s
P
j
e
PKG
mod
⁡
N
PKG
.From the above derivation of the verification, only the legitimate private keyd
j is able to sign the valid signature. On the other hand, the player is only able to sign the valid signature if he/she registers with the PKG as a legal participant and acquires the private key d
j.


## 4.10. Support Joint and Individual E-Lottery Service

The protocol can support joint and individual e-lottery service, respectively. In our proposed scheme, we propose two purchase models to satisfy the requirements. Hence, two purchase models have the same rights and protections making our proposed scheme more practical and attractive.


## 4.11. Discussions

Our scheme focuses on proposing a secure and fair joint e-lottery, despite requiring more communication, more data transfer, and a higher computational complexity. We compare the functional properties between related works and ours in Table2.Table 2
Comparisons between related works and ours.
Chow et al.’s [4]
Lee and Chang’s [5]
Lee et al.’s [6]
Ours
Security
Yes
Yes
Yes
Yes
Correctness
Yes
Yes
Yes
Yes
Anonymity
Yes
Yes
Yes
Yes
Random generation
Yes
Yes
Yes
Yes
Public verification
Yes
Yes
Yes
Yes
Fairness
Yes
Yes
Yes
Yes
Convenience
Yes
Yes
Yes
Yes
No online trusted third party
Yes
Yes
Yes
Yes
No pre-registration required
Yes
Yes
Yes
Yes
Participants legality
No
No
No
Yes
Support joint and individual e-lottery service
Support individual only
Support individual only
Support individual only
YesTable2 shows that our scheme achieves the two new functional properties in comparison with related works [4–6]: participant’s legality and supporting joint and individual e-lottery service.In addition, we compare mechanisms with the existed lottery websites [8, 9] and ours in Table 3. Basically, [8, 9] only support a lottery agent. So, the player should register with the TP; this differs from ours.Table 3
Comparisons with the existing e-lottery websites.
E-Lottery Syndicates [8]
Myleto [9]
Ours
Support joint and individual e-lottery service
Support individual only
Support joint only
Support joint and individual
Player should register with the TP
Yes
Yes
No
Allows players to verify legality of lottery agent
Absence of verification  mechanisms
Absence of verification mechanisms
Adopts ID-based multi-signature
Allows players and lottery agent to verify the legality of other players
Absence of verification  mechanisms
Absence of verification mechanisms
Adopts ID-based signature
The lottery agent refuses to give out the prize
No remedial measures
No remedial measures
Players hold the TP’s signature to arbitral request
If a malicious player forges a picture to claim prize
Not easy to identify the legal lottery
Not easy to identify the legal lottery
Prompt identification by digital signature
Non-repudiation evidence
Depend on the scanned copy of the lottery shown on the screen
Depend on the scanned copy of the lottery shown on the screen
PKI digital signatureTable3 shows that our scheme adopted the ID-based multisignature to verify the legality of all participants while existing lottery websites lack effective mechanisms to achieve this requirement. On the other hand, the existing websites do not have remedial measures to prevent malicious behaviors by the lottery agent or players; for instance, the lottery agent refuses to give out the prize, a malicious player forges a picture to claim a prize, or the purchased lottery of a player is lost when the lottery agent’s database crashes. Our scheme uses the ID-based multisignature to provide nonrepudiation evidence to prevent the above situations.


## 5. Conclusions

In this paper, we present a novel joint e-lottery protocol using the multisignature and verifiable random function. Having been proved, the new mechanism can achieve the requirements of general electronic lotteries. The players can increase the probability of winning prizes by using the proposed secure and fair joint e-lottery scheme. Notably, anyone can verify the correctness of winning lotteries and participants’ legality simultaneously by verifying the multisignature; this functionality increases the convenience and security when a new participant joins the system. In the future, we are going to integrate the cash flow concept into our system.



---

*Source: 139435-2014-05-04.xml*