# A Blind Signature-Aided Privacy-Preserving Power Request Scheme for Smart Grid

Authors: Weijian Zhang; Zhimin Guo; Nuannuan Li; Mingyan Li; Qing Fan; Min Luo
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Smart grid is an emerging power system capable of providing appropriate electricity generation and distribution adjustments in the two-way communication mode. However, privacy preservation is a critical issue in the power request system since malicious adversaries could obtain users’ daily schedule through power transmission channel. Blind signature is an effective method of hiding users’ private information. In this paper, we propose an untraceable blind signature scheme under the reputable modification digital signature algorithm (MDSA). Moreover, we put forward an improved credential-based power request system architecture integrated with the proposed blind signature. In addition, we prove our blind signature’s blindness and unforgeability under the assumption of Elliptic Curve Discrete Logarithm Problem (ECDLP). Meanwhile, we analyze privacy preservation, unforgeability, untraceability, and verifiability of the proposed scheme. Computational cost analysis demonstrates that our scheme has better efficiency compared with other two blind signatures.


---

## Body

## 1. Introduction

The concept of “Intelligrid” is first proposed by the American Electric Power Research Institute in 2001 [1], and exploration of smart grid is becoming more and more popular. Since the notion of industry 4.0 is put forward, operation and management of smart grid are optimized through connection of various facilities, equipment, and devices [2]. Smart grid is regarded as the next-generation power grid infrastructure capable of promoting secure and effective electricity transmission from power operators to electric appliance. Power operation and management in smart grid are upgraded by integrating advanced bidirectional communications and widespread computing capabilities for efficient control, distribution, reliability, and safety [3]. Smart grid not only eliminates barriers between users and power producers but also ensures continuous electricity supply for users due to intelligently monitoring electricity consumption behaviour of users to realize suitable adjustments in the amount of power deployment [4].In general, a smart grid network is roughly comprised of three layers: control center, substations, and smart appliances (i.e., smart meters) [5]. Figure 1 depicts a simplified architecture of the smart grid network. As a kind of physical carrier, smart meters are installed in each electricity appliance system and users could send power request to substation with the help of smart meters. Moreover, smart meters will push appliance information to substations periodically. Substations could collect users’ real-time demand and forward it to the control center via the Supervisory Control and Data Acquisition (SCADA) system [6, 7]. Then, the power control center will make further power deployment analysis and distribute proper electricity amount to substations as various requirements. Finally, users could obtain the required electricity through substations.Figure 1
Model of the smart grid.It should be noted that the major differences between traditional power network and smart grid are that smart meters bearing users’ application information communicate with substations via wired or wireless networks. Specifically, one of the main information is the users’ real-time electricity consumption and demands. Due to the power request which has the potential of leaking users’ daily schedule, which is private, we devote to the privacy and security issues of electricity request communication. Furthermore, power demands are not only related to users’ privacy directly but also related to the charging policy and fairness. How to take effective measures to guarantee genuineness of power demand sources and the user’s privacy is a significant issue. The former problem could be solved by identity authentication, and the latter needs privacy preservation techniques to be settled [8].The digital signature is an important cryptographic protocol for ensuring the authenticity and the integrity of messages [9–11]. The blind signature is a special digital signature, which is an effective method for user’s privacy preservation. The pioneer of blind signature conception is from Chaum et al.’s research [12], in which they established a user’s privacy-preserved electric payment system based on blind signature. The blind digital signature generation process contains two parties: a signer S and a user U. On receiving a blind signature request from a user U, the signer S generates a random element and sends it to U. Then, the user utilizes received element and produced blind factors to blind the original message m. The blinded message denoted by m~ is sent to S. Actually, S signs m~ as a secure signature scheme. Finally, U unblinded signature values from S to obtain the ultimate blind signature. In the above process, S cannot recognize the real signing message even if he saves all the signature scripts that he has signed. The unmatchability between output of blind signature and signer’s signature scripts is viewed as untraceability.Amounts of blind signature schemes have been proposed [13–19], but they cannot hold untraceability, where the signer S can find a match between his signature scripts and blind signature outputs. Thus, S can distinguish the original message he has signed and privacy of user could not be ensured. In this paper, we improved Bütün and Demirer’s scheme and proposed a secure blind signature. Based on the advanced blind signature, we put forward a power request system model. Contributions of this paper are as follows:
(i)
We put forward an improved blind signature-aided power request privacy preservation system model, in which smart meters (i.e., users) could send power request, a blindly signed credential with a certain amount, to substations, and the control center cannot identify the real user identity through blind signature verification(ii)
We analyze Bütün and Demirer’s scheme and point out its weakness, that is a malicious signer could find a match message between his signing scripts and user’s blind signature outputs(iii)
We propose a secure blind signature scheme under the reputable MDSA digital signature. What is more, blindness and unforgeability of our proposed blind signature are proved under difficulty assumption of ECDLP


### 1.1. Organizations of This Paper

Some works related to blind signature and smart grid privacy preservation are described in Section2. Section 3 are preliminaries of this paper, which introduces our proposed system model, fundamental knowledge, definition of blind signature, and security model of blind signature. In Section 4, we review Bütün and Demirer’s scheme. Then, we point out the linkability attack on the reviewed scheme in Section 5, that is, a signer can find an original message he has signed. In Section 6, we proposed our improved blind signature with untraceability. In Section 7, we prove our scheme’s blindness and unforgeability and analyze properties of privacy preservation, unforgeability, untraceability, and verifiability. Section 8 gives comparisons of security properties and computational costs with Bütün and Demirer’s scheme [13] and Verma and Singh’s scheme [16].


## 1.1. Organizations of This Paper

Some works related to blind signature and smart grid privacy preservation are described in Section2. Section 3 are preliminaries of this paper, which introduces our proposed system model, fundamental knowledge, definition of blind signature, and security model of blind signature. In Section 4, we review Bütün and Demirer’s scheme. Then, we point out the linkability attack on the reviewed scheme in Section 5, that is, a signer can find an original message he has signed. In Section 6, we proposed our improved blind signature with untraceability. In Section 7, we prove our scheme’s blindness and unforgeability and analyze properties of privacy preservation, unforgeability, untraceability, and verifiability. Section 8 gives comparisons of security properties and computational costs with Bütün and Demirer’s scheme [13] and Verma and Singh’s scheme [16].


## 2. Related Works

Since the advent of “smart grid” concept, a flow of smart grid surveys has sprung up [3, 20–26]. Fang et al. explore three major systems and gave the future expectations for smart grid [20]. This paper has an important reference value for the following smart grid survey. Alshehri gives further research for smart grid and studied multiperiod demand response management [21]. Wen et al. [25] and Makhadmenh et al. [26], respectively, conducted researches on smart meters and smart homes. However, some sensitive information of users may leak through the two-way communication channel. Therefore, privacy preservation is especially significant.Si et al. analyze the existing privacy problems and enumerate some solutions from a global perspective for smart grid [27]. Mahmood et al. propose an elliptic curve-based authentication to provide communication security between customers and substations [28]. Blind signature is an effective way of hiding users’ sensitive information and first proposed by Camenisch et al. [29]. Blind signature could guarantee anonymity of participants. Tseng put forward a specific privacy-preserving communication protocol utilizing the restrictive partially blind signature [30]. Sarde and Banerjee propose an incentive-based demand response privacy-preserving scheme for the smart grid [14]. Yang et al. make an attempt to identify the privacy-preserving issues and put forward a reward architecture for V2G networks [31]. Yu et al. propose a power request scheme to satisfy the security requirements [32]. Han and Xiao give a thorough and deep survey on the privacy preservation for smart grid and point out that the blind signature is a universal method for users’ security issues [33], but they do not give a detailed blind signature based privacy preservation scheme.In conclusion, the above papers have great effects on the smart grid privacy preservation research. But they either give a general description or lack of a comprehensive blind signature scheme. In this paper, we proposed an integrated blind signature-aided privacy-preserving power request scheme for smart grid.


## 3. Preliminaries

In this section, we introduce the system model, fundamental knowledge, definition of blind signature, and security model of blind signature.


### 3.1. The System Model

In this subsection, we propose an improved system model of Cheung et al.’s architecture [34]. A smart grid network can be simplified into a hierarchical structure consisting of three basic layer-control centers, substations, and smart meters. It can be shown that they have different characteristics.
(i)
A control center (CC) is at the top level and maintained by the power operator. It can be a single server inside the power plant or be distributed servers at different locations responsible for parameter generation, entity registration, and issuing credentials for smart meters. In this paper, we assume that the control center is trusted(ii)
Substations (SS) are at the middle of the structure and fixed in a particular geographic location as it contains expensive electric devices. They could communicate with users directly(iii)
Smart meters (SM) are at the lowest level and installed in the power application positions such as users’ homes. They could send power requests to the control centerIn our system construction, the main idea is that the control center makes good use of the proposed blind signature scheme to sign credentials for users. In this case, identities of users cannot be recognized when he or she sends a request to the control center, while the user’s identity can be validly verified due to only legal user could have requested control center for blind signatures.The workflow of the system model is shown in Figure2 [5]. In the system setup phase, the control center (CC) generates a pair of public and private keys and assigns a unique identifier IDSM for each smart meter (SM) to be registered. In the smart meter registration phase, the CC first authenticates the SM’s identity and decides to accept or reject this SM. Then, each user submits the blinded credential information to the CC. Each credential consists of a unique identity CID, issuance date T, a substation identifier IDSS, and a value of power amount v that a credential holder could request. Then, the CC generates a blind signature for the credential and sends it to SM. Eventually, the SM unblinds the signature and obtains a signed credential. In the power requesting phase, smart meters of a user request for more power when it finds the electric appliances cannot be satisfied. The SM chooses a signed credential of required value and transmits it to the SS with identity IDSS noted in the credential. Then, SS sends the signature credential to CC. If the signature is valid and the credential’s identity CID is not in the credential revocation list, CC distributes proper power as the credential to the SS. Meanwhile, CC adds CID in the credential revocation list. Finally, the SM receives required power amount.Figure 2
System architecture.In the above process, the control center cannot recognize the real user identity through blind signature. Therefore, the power consumption information is not disclosed to CC. In the next subsection, we will introduce blind signatures related to knowledge.


### 3.2. Fundamental Knowledge

#### 3.2.1. Elliptic Curve

Given a large primep and the finite field Fp, the elliptic curve equation is defined by EFp:y2=x3+ax+bmodp, where a,b∈Fp. All points satisfying the elliptic curve equation together with a point at infinity O are composed of an Abelian group. Order of the group is denoted by n.Elliptic Curve Discrete Logarithm Problem (ECDLP). Suppose that G is a generator on EFp and Q is a possible point on the elliptic curve, it is difficult to find an x∈Zn∗ such that the equation Q=x·G holds.


#### 3.2.2. The Modification Digital Signature Algorithm (MDSA)

As cited, the MDSA is mainly composed of three phases as follows: key generation, signing, and verifying.(i)
Key Generation. The signer randomly chooses an x∈Zn as the private key and computes Q=x·G as the public key(ii)
Signing. The user selects a random number k∈Zn and computes R=k·G=x1,y1. x1modn is denoted by r. Then, he calculates e=Hm and s=ke+xrmodn. The signature output is s,R(iii)
Verifying. Upon receiving m,s,R, the verifier first computes e=Hm and extracts r=x1modn. Then, he verifies the equation s·G=HmR+r·Q. If it is the case, s,R is a valid signature


### 3.3. Definition of Blind Signature

A complete blind signature is composed of setup phase, key generation phase, blind signature phase, and verification phase [29]. Specifically, the blind signature phase consists of two probabilistic polynomial-time (PPT) interactive algorithms in the respective party of signer S and user U.
(i)
Setup Phaseparams⟵Setupλ. On inputting a security parameter λ for expected security level, a series of public parameters are output in this phase(ii)
Key Generation Phasepk,sk⟵Genλ. This is a probabilistic polynomial-time (PPT) algorithm. Taking the security parameter λ as input, outputting a public and private key pk,sk(iii)
Blind Signature Phase. This phase includes two interactive PPT algorithms Signerpk,sk and Userpk,m(a)
complete or uncomplete⟵Signerpk,sk. Upon inputting a public key pk and the corresponding secret key sk generated by Gen·, the signer S outputs complete or uncomplete through blind signature interactive process(b)
σm or fail⟵Userpk,nonce,m. Upon inputting a common public key pk of S, selected blind factors nonce, and the message m to be signed, the user U selects the demanded blind outputs fail or σm through blind signature interactive process(iv)
Verification Phaseacceptorreject⟵Verifypk,m,σm. This is a deterministic polynomial-time algorithm. On inputting public key pk, message m, and the signature σm, it always outputs accept with the condition that both signer S and user U follows the blind signature and S outputs complete, U outputs complete


### 3.4. Security Model of Blind Signature

We refer to Okamoto who proposed a security model for blind signatures and consider the following two properties: blindness and unforgeability [35].


#### 3.4.1. Blindness

The blindness of blind signature is depicted by the following game between an adversarial signerS∗ and a simulator B which controls two honest users U0,U1.
(i)
An adversaryS∗ inputs the security parameter λ to obtain the public key pk and two ordered messages denoted by m0,m1. Then, m0,m1 are transmitted to the simulator B(ii)
B randomly chooses a bit b∈0,1 to reorder the two messages mb,m1−b and, respectively, distributes mb and m1−b to U0 and U1 as secret information. Then, U0U1 selects proper blind factors nonce and inputs corresponding message mbm1−b and pk to run Userpk,nonce,m algorithm(iii)
S∗ engages in these two parallel interactive blind signatures separately with U0,U1(iv)
IfU0,U1, respectively, outputs valid blind signatures mb,σmbandm1−b,σm1−b, send the two signatures to S∗ in random order. Otherwise, output ⊥(v)
Finally,S∗ outputs a guess bit b′∈0,1We define(1)AdvBSblind=2·Prb′=b−1,whereAdvBSblind is the advantage of adversary S∗ breaking the blindness property.Definition 1(blindness property).
A blind signature protocol is recognized to bet,ε-blind if no PPT adversary S∗ breaks the blindness property in time at most t, and AdvBSblind is at least ε.


#### 3.4.2. Unforgeability

The unforgeability of blind signature is described by the following game between an honest signerS and a malicious user U∗.
(i)
Genλ is run to obtain public and private keys pk,sk. Then, pk is sent to U∗ and sk is secretly held by S(ii)
U∗ adaptively engages in polynomially parallel interactive blind signatures by Userpk,m algorithm with S executing Signerpk,sk algorithm(iii)
Letl denote the number of executions among U∗ and S, where S outputs complete(iv)
U∗ wins the game if he outputs l∗ valid signature m1,σm1,⋯,ml∗,σml∗ such that they are different signatures for l∗ different messages and l∗lWe defineAdvBSunforge is the probability that U∗ wins the above game. Then, we give the definition of blind signature unforgeability.Definition 2(unforgeability).
A blind signature ist,qS,ε-unforgeable if there does not exist PPT adversary U∗ win the above game, where t is the most time, qS is the most times U∗ motivates the blind signature, and ε is the least AdvBSunforge.Notations used in this paper are explained in Table1.Table 1
Notations.
NotationsDescriptionpA large prime numberFpA finite field with the orderpa,bCoefficients defining the elliptic curveGA generator pointnThe prime order of generatorGZn∗Nonzero integers not larger thannH·One-way hash functionSThe signerUThe user asking for blind signaturedPrivate key ofSQPublic key ofS, where Q=d·GmThe original message to be signedm~The blinded messagesDigital signature forms~Blind signatureR,R~Points on the elliptic curverx-coordinate of point Rr~x-coordinate of point R~α,βThe blind factorskThe random integer number


## 3.1. The System Model

In this subsection, we propose an improved system model of Cheung et al.’s architecture [34]. A smart grid network can be simplified into a hierarchical structure consisting of three basic layer-control centers, substations, and smart meters. It can be shown that they have different characteristics.
(i)
A control center (CC) is at the top level and maintained by the power operator. It can be a single server inside the power plant or be distributed servers at different locations responsible for parameter generation, entity registration, and issuing credentials for smart meters. In this paper, we assume that the control center is trusted(ii)
Substations (SS) are at the middle of the structure and fixed in a particular geographic location as it contains expensive electric devices. They could communicate with users directly(iii)
Smart meters (SM) are at the lowest level and installed in the power application positions such as users’ homes. They could send power requests to the control centerIn our system construction, the main idea is that the control center makes good use of the proposed blind signature scheme to sign credentials for users. In this case, identities of users cannot be recognized when he or she sends a request to the control center, while the user’s identity can be validly verified due to only legal user could have requested control center for blind signatures.The workflow of the system model is shown in Figure2 [5]. In the system setup phase, the control center (CC) generates a pair of public and private keys and assigns a unique identifier IDSM for each smart meter (SM) to be registered. In the smart meter registration phase, the CC first authenticates the SM’s identity and decides to accept or reject this SM. Then, each user submits the blinded credential information to the CC. Each credential consists of a unique identity CID, issuance date T, a substation identifier IDSS, and a value of power amount v that a credential holder could request. Then, the CC generates a blind signature for the credential and sends it to SM. Eventually, the SM unblinds the signature and obtains a signed credential. In the power requesting phase, smart meters of a user request for more power when it finds the electric appliances cannot be satisfied. The SM chooses a signed credential of required value and transmits it to the SS with identity IDSS noted in the credential. Then, SS sends the signature credential to CC. If the signature is valid and the credential’s identity CID is not in the credential revocation list, CC distributes proper power as the credential to the SS. Meanwhile, CC adds CID in the credential revocation list. Finally, the SM receives required power amount.Figure 2
System architecture.In the above process, the control center cannot recognize the real user identity through blind signature. Therefore, the power consumption information is not disclosed to CC. In the next subsection, we will introduce blind signatures related to knowledge.


## 3.2. Fundamental Knowledge

### 3.2.1. Elliptic Curve

Given a large primep and the finite field Fp, the elliptic curve equation is defined by EFp:y2=x3+ax+bmodp, where a,b∈Fp. All points satisfying the elliptic curve equation together with a point at infinity O are composed of an Abelian group. Order of the group is denoted by n.Elliptic Curve Discrete Logarithm Problem (ECDLP). Suppose that G is a generator on EFp and Q is a possible point on the elliptic curve, it is difficult to find an x∈Zn∗ such that the equation Q=x·G holds.


### 3.2.2. The Modification Digital Signature Algorithm (MDSA)

As cited, the MDSA is mainly composed of three phases as follows: key generation, signing, and verifying.(i)
Key Generation. The signer randomly chooses an x∈Zn as the private key and computes Q=x·G as the public key(ii)
Signing. The user selects a random number k∈Zn and computes R=k·G=x1,y1. x1modn is denoted by r. Then, he calculates e=Hm and s=ke+xrmodn. The signature output is s,R(iii)
Verifying. Upon receiving m,s,R, the verifier first computes e=Hm and extracts r=x1modn. Then, he verifies the equation s·G=HmR+r·Q. If it is the case, s,R is a valid signature


## 3.2.1. Elliptic Curve

Given a large primep and the finite field Fp, the elliptic curve equation is defined by EFp:y2=x3+ax+bmodp, where a,b∈Fp. All points satisfying the elliptic curve equation together with a point at infinity O are composed of an Abelian group. Order of the group is denoted by n.Elliptic Curve Discrete Logarithm Problem (ECDLP). Suppose that G is a generator on EFp and Q is a possible point on the elliptic curve, it is difficult to find an x∈Zn∗ such that the equation Q=x·G holds.


## 3.2.2. The Modification Digital Signature Algorithm (MDSA)

As cited, the MDSA is mainly composed of three phases as follows: key generation, signing, and verifying.(i)
Key Generation. The signer randomly chooses an x∈Zn as the private key and computes Q=x·G as the public key(ii)
Signing. The user selects a random number k∈Zn and computes R=k·G=x1,y1. x1modn is denoted by r. Then, he calculates e=Hm and s=ke+xrmodn. The signature output is s,R(iii)
Verifying. Upon receiving m,s,R, the verifier first computes e=Hm and extracts r=x1modn. Then, he verifies the equation s·G=HmR+r·Q. If it is the case, s,R is a valid signature


## 3.3. Definition of Blind Signature

A complete blind signature is composed of setup phase, key generation phase, blind signature phase, and verification phase [29]. Specifically, the blind signature phase consists of two probabilistic polynomial-time (PPT) interactive algorithms in the respective party of signer S and user U.
(i)
Setup Phaseparams⟵Setupλ. On inputting a security parameter λ for expected security level, a series of public parameters are output in this phase(ii)
Key Generation Phasepk,sk⟵Genλ. This is a probabilistic polynomial-time (PPT) algorithm. Taking the security parameter λ as input, outputting a public and private key pk,sk(iii)
Blind Signature Phase. This phase includes two interactive PPT algorithms Signerpk,sk and Userpk,m(a)
complete or uncomplete⟵Signerpk,sk. Upon inputting a public key pk and the corresponding secret key sk generated by Gen·, the signer S outputs complete or uncomplete through blind signature interactive process(b)
σm or fail⟵Userpk,nonce,m. Upon inputting a common public key pk of S, selected blind factors nonce, and the message m to be signed, the user U selects the demanded blind outputs fail or σm through blind signature interactive process(iv)
Verification Phaseacceptorreject⟵Verifypk,m,σm. This is a deterministic polynomial-time algorithm. On inputting public key pk, message m, and the signature σm, it always outputs accept with the condition that both signer S and user U follows the blind signature and S outputs complete, U outputs complete


## 3.4. Security Model of Blind Signature

We refer to Okamoto who proposed a security model for blind signatures and consider the following two properties: blindness and unforgeability [35].


### 3.4.1. Blindness

The blindness of blind signature is depicted by the following game between an adversarial signerS∗ and a simulator B which controls two honest users U0,U1.
(i)
An adversaryS∗ inputs the security parameter λ to obtain the public key pk and two ordered messages denoted by m0,m1. Then, m0,m1 are transmitted to the simulator B(ii)
B randomly chooses a bit b∈0,1 to reorder the two messages mb,m1−b and, respectively, distributes mb and m1−b to U0 and U1 as secret information. Then, U0U1 selects proper blind factors nonce and inputs corresponding message mbm1−b and pk to run Userpk,nonce,m algorithm(iii)
S∗ engages in these two parallel interactive blind signatures separately with U0,U1(iv)
IfU0,U1, respectively, outputs valid blind signatures mb,σmbandm1−b,σm1−b, send the two signatures to S∗ in random order. Otherwise, output ⊥(v)
Finally,S∗ outputs a guess bit b′∈0,1We define(1)AdvBSblind=2·Prb′=b−1,whereAdvBSblind is the advantage of adversary S∗ breaking the blindness property.Definition 1(blindness property).
A blind signature protocol is recognized to bet,ε-blind if no PPT adversary S∗ breaks the blindness property in time at most t, and AdvBSblind is at least ε.


### 3.4.2. Unforgeability

The unforgeability of blind signature is described by the following game between an honest signerS and a malicious user U∗.
(i)
Genλ is run to obtain public and private keys pk,sk. Then, pk is sent to U∗ and sk is secretly held by S(ii)
U∗ adaptively engages in polynomially parallel interactive blind signatures by Userpk,m algorithm with S executing Signerpk,sk algorithm(iii)
Letl denote the number of executions among U∗ and S, where S outputs complete(iv)
U∗ wins the game if he outputs l∗ valid signature m1,σm1,⋯,ml∗,σml∗ such that they are different signatures for l∗ different messages and l∗lWe defineAdvBSunforge is the probability that U∗ wins the above game. Then, we give the definition of blind signature unforgeability.Definition 2(unforgeability).
A blind signature ist,qS,ε-unforgeable if there does not exist PPT adversary U∗ win the above game, where t is the most time, qS is the most times U∗ motivates the blind signature, and ε is the least AdvBSunforge.Notations used in this paper are explained in Table1.Table 1
Notations.
NotationsDescriptionpA large prime numberFpA finite field with the orderpa,bCoefficients defining the elliptic curveGA generator pointnThe prime order of generatorGZn∗Nonzero integers not larger thannH·One-way hash functionSThe signerUThe user asking for blind signaturedPrivate key ofSQPublic key ofS, where Q=d·GmThe original message to be signedm~The blinded messagesDigital signature forms~Blind signatureR,R~Points on the elliptic curverx-coordinate of point Rr~x-coordinate of point R~α,βThe blind factorskThe random integer number


## 3.4.1. Blindness

The blindness of blind signature is depicted by the following game between an adversarial signerS∗ and a simulator B which controls two honest users U0,U1.
(i)
An adversaryS∗ inputs the security parameter λ to obtain the public key pk and two ordered messages denoted by m0,m1. Then, m0,m1 are transmitted to the simulator B(ii)
B randomly chooses a bit b∈0,1 to reorder the two messages mb,m1−b and, respectively, distributes mb and m1−b to U0 and U1 as secret information. Then, U0U1 selects proper blind factors nonce and inputs corresponding message mbm1−b and pk to run Userpk,nonce,m algorithm(iii)
S∗ engages in these two parallel interactive blind signatures separately with U0,U1(iv)
IfU0,U1, respectively, outputs valid blind signatures mb,σmbandm1−b,σm1−b, send the two signatures to S∗ in random order. Otherwise, output ⊥(v)
Finally,S∗ outputs a guess bit b′∈0,1We define(1)AdvBSblind=2·Prb′=b−1,whereAdvBSblind is the advantage of adversary S∗ breaking the blindness property.Definition 1(blindness property).
A blind signature protocol is recognized to bet,ε-blind if no PPT adversary S∗ breaks the blindness property in time at most t, and AdvBSblind is at least ε.


## 3.4.2. Unforgeability

The unforgeability of blind signature is described by the following game between an honest signerS and a malicious user U∗.
(i)
Genλ is run to obtain public and private keys pk,sk. Then, pk is sent to U∗ and sk is secretly held by S(ii)
U∗ adaptively engages in polynomially parallel interactive blind signatures by Userpk,m algorithm with S executing Signerpk,sk algorithm(iii)
Letl denote the number of executions among U∗ and S, where S outputs complete(iv)
U∗ wins the game if he outputs l∗ valid signature m1,σm1,⋯,ml∗,σml∗ such that they are different signatures for l∗ different messages and l∗lWe defineAdvBSunforge is the probability that U∗ wins the above game. Then, we give the definition of blind signature unforgeability.Definition 2(unforgeability).
A blind signature ist,qS,ε-unforgeable if there does not exist PPT adversary U∗ win the above game, where t is the most time, qS is the most times U∗ motivates the blind signature, and ε is the least AdvBSunforge.Notations used in this paper are explained in Table1.Table 1
Notations.
NotationsDescriptionpA large prime numberFpA finite field with the orderpa,bCoefficients defining the elliptic curveGA generator pointnThe prime order of generatorGZn∗Nonzero integers not larger thannH·One-way hash functionSThe signerUThe user asking for blind signaturedPrivate key ofSQPublic key ofS, where Q=d·GmThe original message to be signedm~The blinded messagesDigital signature forms~Blind signatureR,R~Points on the elliptic curverx-coordinate of point Rr~x-coordinate of point R~α,βThe blind factorskThe random integer number


## 4. Review of Bütün and Demirer’s Scheme

In this section, Bütün and Demirer’s scheme [13] will be briefly reviewed. Their scheme comprises the following five phases, including initialization, blinding, signing, unblinding, and verifying. Each phase of Bütün and Demirer’s scheme is presented in the following subsection.
(i)
Initialization Phase. The elliptic curve parameters are params=p,Fp,a,b,G,n, where Fp is a finite field defined by the big prime number p; a,b defines the elliptic curve EFp:y2=x3+ax+bmodp; G is a base point on EFp with the order nThe signer randomly selects an integerd∈Zn∗ as the secret key and calculates Q=d·G as the public key. For each blind signature request from a user, the signer chooses a random number k∈Zn∗ and computes the point R~=kG=x1′,y1′ and r~=x1′modn. If r~=0, the signer reselects the nonce k; otherwise, he transmits R~ to the user.
(ii)
Blinding Phase. Upon receiving R~, the user first extracts r~ from R~ and chooses two blind factors α,β∈Zn∗. Then, he calculates R=αR~+βG=x1,y1,r=x1modn and blinds message m through m~=αHmr~r−1modn. Finally, the user transmits the blinded message m~ to the signer(iii)
Signing Phase. On receiving the blinded message, the signer uses his private key d to sign tildem. He computes s~=dr~+km~modn and sends s~ to the user(iv)
Unblinding Phase. On receiving s~, U verifies whether s~ is in the range of Zn∗. If it holds, the signature is unblinded as follows:(2)s=s~rr~−1+βHmmodn.Eventually,U outputs the digital signature s,R on message m(v)
Verifying Phase. On receiving s,R, the verifier, respectively, calculates f1=s·Gmodn and f2=r·Q+Hm·R. Then, he verifies the equation f1=f2. If the equation holds, s,R is a valid signature of the message m; otherwise, the signature is invalidCorrectness. The correctness can be verified by the following equations:
(3)s=s~rr~−1+βHmmodn=dr~+km~rr~−1+βHmmodn=dr+km~rr~−1+βHmmodn=dr+kαHmr~r−1rr~−1+βHmmodn=dr+αkHm+βHmmodn,f1=s·G=dr+αkHm+βHm·G=rd·G+Hmα·R~+β·G=r·Q+Hm·R=f2.


## 5. Attack on Bütün and Demirer’s Scheme

In this section, we show a malicious signerM can find a link between the blind signature s′ and the original message m. Suppose that the signer saves all the transcripts k,R~′,m′~,s~′ of his signatures. Using the unblinded signature m,R,s, M can match a blinded signature he has signed to an original message m. Detailed procedures are as follows:
(i)
Extractingr=x1modn,r~′=x1′modn from R=x1,y1,R~′=x1′,y1′(ii)
Calculatingm′~rr~′−1 denoted as α′Hm′(iii)
Calculatings−s~′rr~′−1 denoted as β′Hm′(iv)
Using the private keyd to verify whether the following equation dr+kα′Hm′+β′Hm′=s holds(4)dr+kα′Hm′+β′Hm′=sIf equation (4) holds, M is able to find the linkage between the blind signature and his signed blind message m; otherwise, going through all transcripts k,R′,m′,s′ and repeating the above process. This shows Bütün and Demirer’s scheme is insecure, because there is absence of untraceability. The next section is our improvement of Bütün and Demirer’s scheme.


## 6. Our Proposed Scheme

In this section, an untraceable blind signature scheme is completely described. Our blind signature scheme comprises four phases: setup phase, key generation phase, blind signing phase, and verification phase.


### 6.1. Setup Phase

On inputting the security parameterλ to reach the expected security magnitude, the elliptic curve parameters are output as params=p,Fp,a,b,G,n, where p is a large prime that specifies the finite field Fp; a,b∈Fp defines the elliptic curve EFp:y2=x3+ax+bmodp; G is a base point on EFp, and n is the prime order of G.


### 6.2. Key Generation Phase

The private and public key of the signerS is generated by the following steps: First, generating a random nonce d from Zn∗. Second, calculating the elliptic curve point Q=d·G=xQ,yQ. Finally, S keeps the private key d secret and the public key Q published.


### 6.3. Blind Signing Phase

As shown in Figure3, the user and the signer execute the following steps to generate a signature.
(i)
For each blind signature request, a random integerk is generated by S and the elliptic curve point R~ is computed as follows:(5)R~=k·G=x1′,y1′,r~=x1′modn.Figure 3
The proposed scheme.Moreover, the signer checksr~≠0. If the inequation holds, S transmits the elliptic curve point R~ to the user U; otherwise, S reselects k and repeats (5) to fulfill r~≠0(ii)
Upon receivingR~, U performs the following operations to obtain the blinded message m~. Firstly, extracting r~=x1′modn from R~. Secondly, randomly selecting two factors α,β∈Zn∗ and computes R=α+βHm−1R~+α−1r~−1+αβG=x1,y1. Thirdly, extracting r=x1modn from R. Finally, calculating m~=αHm+βr−1r~modn to blind the original message. Having executed the above steps, U sends the blinded message m~ to S(iii)
Upon receivingm~, S first extracts r~=x1′modn from R~. Then, he uses private key d and selects a random nonce k to compute the blind signature s~=dr~+km~modn. Finally, S transmits the blinded signature s~ to U(iv)
On receivings~, U verifies whether s~∈Zn∗ satisfies. If it holds, the signature is unblinded as follows:(6)s=s~r+α−1Hmr~−1+αβHmmodn.Eventually,U outputs the digital signature s,R on message m


### 6.4. Verification Phase

Any verifier can verify the validity of the signatures,R. First, using the public parameter G and signature s to compute g1=s·Gmodn; second, extracting r=x1modn from R=x1,y1; third, using the signer’s public key Q and signature value R to calculate g2=r·Q+Hm·R; finally, verifying whether the equation g1=g2 holds. If the equation holds, s,R is a valid signature of message m; otherwise, the signature is invalid.Correctness. The correctness can be verified by the following equations:
(7)s=s~r+α−1Hmr~−1+αβHmmodn=dr~+km~r+α−1Hmr~−1+αβHmmodn=dr+km~rr~−1+α−1Hmr~−1+αβHmmodn=dr+Hmα+βHm−1k+Hmα−1r~−1+αβmodn,g1=s·G=rd·G+Hmα+βHm−1R~+α−1r~−1+αβ·G=r·Q+Hm·R=g2.


## 6.1. Setup Phase

On inputting the security parameterλ to reach the expected security magnitude, the elliptic curve parameters are output as params=p,Fp,a,b,G,n, where p is a large prime that specifies the finite field Fp; a,b∈Fp defines the elliptic curve EFp:y2=x3+ax+bmodp; G is a base point on EFp, and n is the prime order of G.


## 6.2. Key Generation Phase

The private and public key of the signerS is generated by the following steps: First, generating a random nonce d from Zn∗. Second, calculating the elliptic curve point Q=d·G=xQ,yQ. Finally, S keeps the private key d secret and the public key Q published.


## 6.3. Blind Signing Phase

As shown in Figure3, the user and the signer execute the following steps to generate a signature.
(i)
For each blind signature request, a random integerk is generated by S and the elliptic curve point R~ is computed as follows:(5)R~=k·G=x1′,y1′,r~=x1′modn.Figure 3
The proposed scheme.Moreover, the signer checksr~≠0. If the inequation holds, S transmits the elliptic curve point R~ to the user U; otherwise, S reselects k and repeats (5) to fulfill r~≠0(ii)
Upon receivingR~, U performs the following operations to obtain the blinded message m~. Firstly, extracting r~=x1′modn from R~. Secondly, randomly selecting two factors α,β∈Zn∗ and computes R=α+βHm−1R~+α−1r~−1+αβG=x1,y1. Thirdly, extracting r=x1modn from R. Finally, calculating m~=αHm+βr−1r~modn to blind the original message. Having executed the above steps, U sends the blinded message m~ to S(iii)
Upon receivingm~, S first extracts r~=x1′modn from R~. Then, he uses private key d and selects a random nonce k to compute the blind signature s~=dr~+km~modn. Finally, S transmits the blinded signature s~ to U(iv)
On receivings~, U verifies whether s~∈Zn∗ satisfies. If it holds, the signature is unblinded as follows:(6)s=s~r+α−1Hmr~−1+αβHmmodn.Eventually,U outputs the digital signature s,R on message m


## 6.4. Verification Phase

Any verifier can verify the validity of the signatures,R. First, using the public parameter G and signature s to compute g1=s·Gmodn; second, extracting r=x1modn from R=x1,y1; third, using the signer’s public key Q and signature value R to calculate g2=r·Q+Hm·R; finally, verifying whether the equation g1=g2 holds. If the equation holds, s,R is a valid signature of message m; otherwise, the signature is invalid.Correctness. The correctness can be verified by the following equations:
(7)s=s~r+α−1Hmr~−1+αβHmmodn=dr~+km~r+α−1Hmr~−1+αβHmmodn=dr+km~rr~−1+α−1Hmr~−1+αβHmmodn=dr+Hmα+βHm−1k+Hmα−1r~−1+αβmodn,g1=s·G=rd·G+Hmα+βHm−1R~+α−1r~−1+αβ·G=r·Q+Hm·R=g2.


## 7. Security

In this section, we give the formal security proof of our blind signature scheme’s blindness property and unforgeability.


### 7.1. Security Proof

According to the security model of blindness in Section3.4, the blindness is to guarantee that an adversarial signer S∗ cannot distinguish signatures from two different messages. We will show that our scheme’s signature values are independent from the view of S∗.Theorem 3(blindness property).
Our proposed blind signature keeps blindness property.Proof.
For any public key outputQ from the malicious signer S∗, k,m~ is perfectly independent from m,α,β in the blind signature process in the view of S∗. On the one hand, the k is a completely random number chosen from Zn∗. On the other hand, m~=αHm+βr−1r~modn, where r~ is the x-coordinate of R~=k·G. Due to the randomness of k, m~ is independent of m,α,β.☐Next, we will prove that the signaturem,s,R is independent from the view of S∗. Since s=s~r+α−1Hmr~−1+αβHmmodn and m,α,β cannot be obtained from k,m~, s is perfectly independent. Moreover, R=α+βHm−1R~+α−1r~−1G+αβG and α,β is not related to k,m~. Therefore, the signature values m,s,R are independent in the view of S∗.Above all, our blind signature scheme keeps perfectly blindness property.Theorem 4(unforgeability).
If the ECDLP assumption holds, our proposed blind signature is existential unforgeability against chosen-message attacks (EU-CMA).Proof.
Suppose thatA is an adversary delegated for a malicious user that forges the proposed blind signature scheme, there exists a challenger C that can break unforgeability of the MDSA. Then, it is contradictory to the ECDLP assumption.☐In this proof,Signerpk,sk algorithm is modelled as a signing oracle and forging process of the proposed blind signature is depicted as follows.
(i)
C runs the Genλ to generate a pair of public and private keys Q=x·G,sk=x. Then, B sends Q to A as the public key(ii)
C executes signing oracle following the proposed blind signature, that is, the signing oracle outputs R~ and s~ with the corresponding m~ from A(iii)
A could adaptively request l times C to sign different m~ as the proposed interactive blind signature(iv)
IfA outputs l∗ different signatures Σ=m1,s1,R1,⋯,ml∗,sl∗,Rl∗,l∗l, there exists one signature mf,sf,Rf∈Σ forged by A. In addition, A cannot obtain the secret key x through R~,s~ due to R~ is unrelated to x and the private key cannot be recovered by the equation s~=xr~+km~modn with k unknown to AMoreover, the signatures,R is a variant of MDSA since s=s~r+α−1Hmr~−1+αβHmmodn=xr+Hmα+βHm−1+α−1r~−1+αβ=xr+Hmz where z=α+βHm−1+α−1r~−1+αβ and the signature is verified by the equation s·G=r·Q+Hm·R. Therefore, unforgeability of the proposed blind signature is reduced to the security of MDSA. Under the difficulty assumption of ECDLP, MDSA is existential unforgeability.


### 7.2. Security Analysis

According to references, we analyze identity privacy preservation, unforgeability, untraceability, and verifiability of the proposed scheme.(i)
Privacy Preservation. We have proven blindness of our proposed blind signature in 7.1. Therefore, nobody including the control center and substations could recognize the real identity of users when they request for more power. Thus, identity and electricity consumption privacy of users could be protected(ii)
Unforgeability. As shown in 7.1, the proposed blind signature scheme is existential unforgeability. Thereby, any users (i.e., smart meters) cannot unforge blind signatures for credentials with desired values(iii)
Untraceability. Suppose that a control center attempts to find linkage among the credential he signed and signature. For this, he could preserve all the transcripts k,m~,s~. Even after the blind signature m,s,R is made public by the user, the control center is still unable to find the blind factors α,β. Moreover, k,m~,s~ and m,s,R are independent of each other. Above all, it is impossible for the control center to link the signature m,s,R with corresponding transcript k,m~,s~(iv)
Verifiability. The correctness of proposed blind signature insures that the control center can verify validity of credentials by checking equation s·G=r·Q+Hm·R


## 7.1. Security Proof

According to the security model of blindness in Section3.4, the blindness is to guarantee that an adversarial signer S∗ cannot distinguish signatures from two different messages. We will show that our scheme’s signature values are independent from the view of S∗.Theorem 3(blindness property).
Our proposed blind signature keeps blindness property.Proof.
For any public key outputQ from the malicious signer S∗, k,m~ is perfectly independent from m,α,β in the blind signature process in the view of S∗. On the one hand, the k is a completely random number chosen from Zn∗. On the other hand, m~=αHm+βr−1r~modn, where r~ is the x-coordinate of R~=k·G. Due to the randomness of k, m~ is independent of m,α,β.☐Next, we will prove that the signaturem,s,R is independent from the view of S∗. Since s=s~r+α−1Hmr~−1+αβHmmodn and m,α,β cannot be obtained from k,m~, s is perfectly independent. Moreover, R=α+βHm−1R~+α−1r~−1G+αβG and α,β is not related to k,m~. Therefore, the signature values m,s,R are independent in the view of S∗.Above all, our blind signature scheme keeps perfectly blindness property.Theorem 4(unforgeability).
If the ECDLP assumption holds, our proposed blind signature is existential unforgeability against chosen-message attacks (EU-CMA).Proof.
Suppose thatA is an adversary delegated for a malicious user that forges the proposed blind signature scheme, there exists a challenger C that can break unforgeability of the MDSA. Then, it is contradictory to the ECDLP assumption.☐In this proof,Signerpk,sk algorithm is modelled as a signing oracle and forging process of the proposed blind signature is depicted as follows.
(i)
C runs the Genλ to generate a pair of public and private keys Q=x·G,sk=x. Then, B sends Q to A as the public key(ii)
C executes signing oracle following the proposed blind signature, that is, the signing oracle outputs R~ and s~ with the corresponding m~ from A(iii)
A could adaptively request l times C to sign different m~ as the proposed interactive blind signature(iv)
IfA outputs l∗ different signatures Σ=m1,s1,R1,⋯,ml∗,sl∗,Rl∗,l∗l, there exists one signature mf,sf,Rf∈Σ forged by A. In addition, A cannot obtain the secret key x through R~,s~ due to R~ is unrelated to x and the private key cannot be recovered by the equation s~=xr~+km~modn with k unknown to AMoreover, the signatures,R is a variant of MDSA since s=s~r+α−1Hmr~−1+αβHmmodn=xr+Hmα+βHm−1+α−1r~−1+αβ=xr+Hmz where z=α+βHm−1+α−1r~−1+αβ and the signature is verified by the equation s·G=r·Q+Hm·R. Therefore, unforgeability of the proposed blind signature is reduced to the security of MDSA. Under the difficulty assumption of ECDLP, MDSA is existential unforgeability.


## 7.2. Security Analysis

According to references, we analyze identity privacy preservation, unforgeability, untraceability, and verifiability of the proposed scheme.(i)
Privacy Preservation. We have proven blindness of our proposed blind signature in 7.1. Therefore, nobody including the control center and substations could recognize the real identity of users when they request for more power. Thus, identity and electricity consumption privacy of users could be protected(ii)
Unforgeability. As shown in 7.1, the proposed blind signature scheme is existential unforgeability. Thereby, any users (i.e., smart meters) cannot unforge blind signatures for credentials with desired values(iii)
Untraceability. Suppose that a control center attempts to find linkage among the credential he signed and signature. For this, he could preserve all the transcripts k,m~,s~. Even after the blind signature m,s,R is made public by the user, the control center is still unable to find the blind factors α,β. Moreover, k,m~,s~ and m,s,R are independent of each other. Above all, it is impossible for the control center to link the signature m,s,R with corresponding transcript k,m~,s~(iv)
Verifiability. The correctness of proposed blind signature insures that the control center can verify validity of credentials by checking equation s·G=r·Q+Hm·R


## 8. Performance Analysis

In this section, we compare the proposed scheme with Bütün and Demirer’s [13], Verma and Singh’s [16], Chaudhry et al.’s [36], and Mahmood et al.’s [37] in terms of security properties, computational cost, and communication cost. The results are listed in Tables 2 and 3 separately.Table 2
Comparison of security properties.
PropertiesSchemesOurs[13][16][36][37]Correctness✓✓✓✓✓Verifiability✓✓✓✓✓Impersonality resistance✓✓✓✓✓Privileged insider resistance✓✓✓✓×Privacy preservation✓×✓✓✓Unforgeability✓✓✓✓✓Untraceability✓×✓✓✓Unlinkability proof✓×✓××Table 3
Performance comparisons.
ProtocolComputation costCommunication cost (bit)Ours3Tpm+4Tmi=6.663ms1024Ref. [13]3Tpm+2Tmi=6.579ms1024Ref. [16]2TH+3Tpm+1Tmi=17.523ms1280Ref. [36]5Tpm=10.825ms2368Ref. [37]9Tpm=19.485ms3136


### 8.1. Security Properties

As we have analyzed in this paper, Bütün and Demirer’s scheme [13] cannot resist that a malicious signer traces the original message he has signed, which means there is no untraceability in Bütün and Demirer’s scheme. Furthermore, traceability provides opportunities for adversaries to recognize users’ daily schedule and privacy preservation does not hold. In addition, [36] does not provide unlinkability proof and [37] does not have privileged insider resistance and unlinkability proof.


### 8.2. Performance Analysis

#### 8.2.1. Computational Cost

In this subsection, we mainly consider the more time-consuming operations hash-to-pointTH, point multiplication Tpm, and modular inversion Tmi and adopt the executing time in [38] as shown in Table 4. It can be seen that the proposed scheme requires 3 point multiplication operations and 4 modular inversions, i.e., 6.663 ms, which is only slightly larger than that of [13] and smaller than the other three schemes’ computational cost.Table 4
Running time of basic operations (ms).
NotationsDescriptionRunning timeTHHash-to-point5.493TpmPoint multiplication2.165TmiModular inversion0.042


#### 8.2.2. Communication Cost

We set the size of point onEFp is 512 bits, size of n is 256 bits, output size of general hash function is 256 bits, and size of timestamp is 32 bits. Then, we have the communication cost comparison in Table 3. We can see that our scheme and Ref. [13] have the least communication cost, i.e., 1024 bits than the other three literatures. Therefore, our scheme needs the least communicational bandwidth.Above all, the proposed scheme has better security properties than Bütün and Demirer’s [13] although performing two more modular inversions and has better computational costs with the same security properties of Verma et al.’s scheme.


## 8.1. Security Properties

As we have analyzed in this paper, Bütün and Demirer’s scheme [13] cannot resist that a malicious signer traces the original message he has signed, which means there is no untraceability in Bütün and Demirer’s scheme. Furthermore, traceability provides opportunities for adversaries to recognize users’ daily schedule and privacy preservation does not hold. In addition, [36] does not provide unlinkability proof and [37] does not have privileged insider resistance and unlinkability proof.


## 8.2. Performance Analysis

### 8.2.1. Computational Cost

In this subsection, we mainly consider the more time-consuming operations hash-to-pointTH, point multiplication Tpm, and modular inversion Tmi and adopt the executing time in [38] as shown in Table 4. It can be seen that the proposed scheme requires 3 point multiplication operations and 4 modular inversions, i.e., 6.663 ms, which is only slightly larger than that of [13] and smaller than the other three schemes’ computational cost.Table 4
Running time of basic operations (ms).
NotationsDescriptionRunning timeTHHash-to-point5.493TpmPoint multiplication2.165TmiModular inversion0.042


### 8.2.2. Communication Cost

We set the size of point onEFp is 512 bits, size of n is 256 bits, output size of general hash function is 256 bits, and size of timestamp is 32 bits. Then, we have the communication cost comparison in Table 3. We can see that our scheme and Ref. [13] have the least communication cost, i.e., 1024 bits than the other three literatures. Therefore, our scheme needs the least communicational bandwidth.Above all, the proposed scheme has better security properties than Bütün and Demirer’s [13] although performing two more modular inversions and has better computational costs with the same security properties of Verma et al.’s scheme.


## 8.2.1. Computational Cost

In this subsection, we mainly consider the more time-consuming operations hash-to-pointTH, point multiplication Tpm, and modular inversion Tmi and adopt the executing time in [38] as shown in Table 4. It can be seen that the proposed scheme requires 3 point multiplication operations and 4 modular inversions, i.e., 6.663 ms, which is only slightly larger than that of [13] and smaller than the other three schemes’ computational cost.Table 4
Running time of basic operations (ms).
NotationsDescriptionRunning timeTHHash-to-point5.493TpmPoint multiplication2.165TmiModular inversion0.042


## 8.2.2. Communication Cost

We set the size of point onEFp is 512 bits, size of n is 256 bits, output size of general hash function is 256 bits, and size of timestamp is 32 bits. Then, we have the communication cost comparison in Table 3. We can see that our scheme and Ref. [13] have the least communication cost, i.e., 1024 bits than the other three literatures. Therefore, our scheme needs the least communicational bandwidth.Above all, the proposed scheme has better security properties than Bütün and Demirer’s [13] although performing two more modular inversions and has better computational costs with the same security properties of Verma et al.’s scheme.


## 9. Conclusion

Our scheme provided values of theory and application to some extent. On the one hand, the proposed untraceable blind signature is constructed under the noted MDSA algorithm and proof of which gave theoretical insurance of blindness and unforgeability. On the other hand, we put forward a new credential-based privacy-preserving power request model for smart grid. In this system model, the user’s daily schedule could not leak outside with the help of blind signature since blinded factors hide the real signed message for the signer and verifiers cannot identify the real sources of messages. Moreover, it was shown that this scheme has better security or computational costs compared with other blind signatures under the same background or cryptographic infrastructure.



---

*Source: 9988170-2021-07-01.xml*