A New Construction of Multisender Authentication Codes from Polynomials over Finite Fields

Abstract

Multisender authentication codes allow a group of senders to construct an authenticated message for a receiver such that the receiver can verify the authenticity of the received message. In this paper, we construct one multisender authentication code from polynomials over finite fields. Some parameters and the probabilities of deceptions of this code are also computed.

1. Introduction

Multisender authentication code was firstly constructed by Gilbert et al. [1] in 1974. Multisender authentication system refers to who a group of senders, cooperatively send a message to a receiver; then the receiver should be able to ascertain that the message is authentic. About this case, many scholars and researchers had made great contributions to multisender authentication codes, such as [2–6].

In the actual computer network communications, multisender authentication codes include sequential model and simultaneous model. Sequential model is that each sender uses his own encoding rules to encode a source state orderly, the last sender sends the encoded message to the receiver, and the receiver receives the message and verifies whether the message is legal or not. Simultaneous model is that all senders use their own encoding rules to encode a source state, and each sender sends the encoded message to the synthesizer, respectively; then the synthesizer forms an authenticated message and verifies whether the message is legal or not. In this paper, we will adopt the second model.

In a simultaneous model, there are four participants: a group of senders 𝑈={𝑈₁,𝑈₂,…,𝑈_𝑛}, the key distribution center, he is responsible for the key distribution to senders and receiver, including solving the disputes between them, a receiver 𝑅, and a synthesizer, where he only runs the trusted synthesis algorithm. The code works as follows: each sender and receiver has their own Cartesian authentication code, respectively. Let (𝑆,𝐸_𝑖,𝑇_𝑖;𝑓_𝑖)(𝑖=1,2,…,𝑛) be the senders’ Cartesian authentication code, (𝑆,𝐸_𝑅,𝑇;𝑔) be the receiver’s Cartesian authentication code, ℎ∶𝑇₁×𝑇₂×⋯×𝑇_𝑛→𝑇 be the synthesis algorithm, and 𝜋_𝑖∶𝐸→𝐸_𝑖 be a subkey generation algorithm, where 𝐸 is the key set of the key distribution center. When authenticating a message, the senders and the receiver should comply with the protocol. The key distribution center randomly selects an encoding rule 𝑒∈𝐸 and sends 𝑒_𝑖=𝜋_𝑖(𝑒) to the 𝑖th sender 𝑈_𝑖(𝑖=1,2,…,𝑛), secretly; then he calculates 𝑒_𝑅 by 𝑒 according to an effective algorithm and secretly sends 𝑒_𝑅 to the receiver 𝑅. If the senders would like to send a source state 𝑠 to the receiver 𝑅, 𝑈_𝑖 computes 𝑡_𝑖=𝑓_𝑖(𝑠,𝑒_𝑖)(𝑖=1,2,…,𝑛) and sends 𝑚_𝑖=(𝑠,𝑡_𝑖)(𝑖=1,2,…,𝑛) to the synthesizer through an open channel. The synthesizer receives the message 𝑚_𝑖=(𝑠,𝑡_𝑖)(𝑖=1,2,…,𝑛) and calculates 𝑡=ℎ(𝑡₁,𝑡₂,…,𝑡_𝑛) by the synthesis algorithm ℎ and then sends message 𝑚=(𝑠,𝑡) to the receiver; he checks the authenticity by verifying whether 𝑡=𝑔(𝑠,𝑒_𝑅) or not. If the equality holds, the message is authentic and is accepted. Otherwise, the message is rejected.

We assume that the key distribution center is credible, and though he know the senders’ and receiver’s encoding rules, he will not participate in any communication activities. When transmitters and receiver are disputing, the key distribution center settles it. At the same time, we assume that the system follows the Kerckhoff principle in which, except the actual used keys, the other information of the whole system is public.

In a multisender authentication system, we assume that the whole senders are cooperative to form a valid message; that is, all senders as a whole and receiver are reliable. But there are some malicious senders who together cheat the receiver; the part of senders and receiver are not credible, and they can take impersonation attack and substitution attack. In the whole system, we assume that {𝑈₁,𝑈₂,…,𝑈_𝑛} are senders, 𝑅 is a receiver, 𝐸_𝑖 is the encoding rules set of the sender 𝑈_𝑖, and 𝐸_𝑅 is the decoding rules set of the receiver 𝑅. If the source state space 𝑆 and the key space 𝐸_𝑅 of receiver 𝑅 are according to a uniform distribution, then the message space 𝑀 and the tag space 𝑇 are determined by the probability distribution of 𝑆 and 𝐸_𝑅. 𝐿={𝑖₁,𝑖₂,…,𝑖_𝑙}⊂{1,2,…,𝑛}, 𝑙<𝑛, 𝑈_𝐿={𝑈_𝑖1,𝑈_𝑖2,…,𝑈_𝑖𝑙}, 𝐸_𝐿={𝐸_𝑈𝑖1,𝐸_𝑈𝑖2,…,𝐸_𝑈𝑖𝑙}. Now consider that let us consider the attacks from malicious groups of senders. Here, there are two kinds of attack.

The opponent’s impersonation attack to receiver: 𝑈_𝐿, after receiving their secret keys, encode a message and send it to the receiver. 𝑈_𝐿 are successful if the receiver accepts it as legitimate message. Denote by 𝑃_𝐼 the largest probability of some opponent’s successful impersonation attack to receiver; it can be expressed as 𝑃_𝐼=max_𝑚∈𝑀𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚𝐸_𝑅. (1)

The opponent’s substitution attack to the receiver: 𝑈_𝐿 replace 𝑚 with another message 𝑚^′, after they observe a legitimate message 𝑚. 𝑈_𝐿 are successful if the receiver accepts it as legitimate message; it can be expressed as 𝑃_𝑆=max_𝑚∈𝑀max_{𝑚′≠𝑚∈𝑀}𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚,𝑚^′𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅.⊂𝑚 (2)

There might be 𝑙 malicious senders who together cheat the receiver; that is, the part of senders and the receiver are not credible, and they can take impersonation attack. Let 𝐿={𝑖₁,𝑖₂,…,𝑖_𝑙}⊂{1,2,…,𝑛}, 𝑙<𝑛 and 𝐸_𝐿={𝐸_𝑈𝑖1,𝐸_𝑈𝑖2,…,𝐸_𝑈𝑖𝑙}. Assume that 𝑈_𝐿={𝑈_𝑖1,𝑈_𝑖2,…,𝑈_𝑖𝑙}, after receiving their secret keys, send a message 𝑚 to the receiver 𝑅; 𝑈_𝐿 are successful if the receiver accepts it as legitimate message. Denote by 𝑃_𝑈(𝐿) the maximum probability of success of the impersonation attack to the receiver. It can be expressed as 𝑃_𝑈(𝐿)=max_{𝑒𝐿∈𝐸𝐿}max_{𝑒𝐿∈𝑒𝑈}max_𝑚∈𝑀𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚,𝑝𝑒_𝑅,𝑒_𝑃≠0𝑒_𝑅∈𝐸_𝑅∣𝑝𝑒_𝑅,𝑒_𝑃.≠0 (3)Notes. 𝑝(𝑒_𝑅,𝑒_𝑃)≠0 implies that any information 𝑠 encoded by 𝑒_𝑇 can be authenticated by 𝑒_𝑅.

In [2], Desmedt et al. gave two constructions for MRA-codes based on polynomials and finite geometries, respectively. To construct multisender or multireceiver authentication by polynomials over finite fields, many researchers have done much work, for example, [7–9]. There are other constructions of multisender authentication codes that are given in [3–6]. The construction of authentication codes is combinational design in its nature. We know that the polynomial over finite fields can provide a better algebra structure and is easy to count. In this paper, we construct one multisender authentication code from the polynomial over finite fields. Some parameters and the probabilities of deceptions of this code are also computed. We realize the generalization and the application of the similar idea and method of the paper [7–9].

2. Some Results about Finite Field

Let 𝐹_𝑞 be the finite field with 𝑞 elements, where 𝑞 is a power of a prime 𝑝 and 𝐹 is a field containing 𝐹_𝑞; denote by 𝐹^∗_𝑞 be the nonzero elements set of 𝐹_𝑞. In this paper, we will use the following conclusions over finite fields.

Conclusion 1. A generator 𝛼 of 𝐹^∗_𝑞 is called a primitive element of 𝐹_𝑞.

Conclusion 2. Let 𝛼∈𝐹_𝑞; if some polynomials contain 𝛼 as their root and their leading coefficient are 1 over 𝐹_𝑞, then the polynomial having least degree among all such polynomials is called a minimal polynomial over 𝐹_𝑞.

Conclusion 3. Let |𝐹|=𝑞^𝑛, then 𝐹 is an 𝑛-dimensional vector space over 𝐹_𝑞. Let 𝛼 be a primitive element of 𝐹_𝑞 and 𝑔(𝑥) the minimal polynomial about 𝛼 over 𝐹_𝑞; then dim𝑔(𝑥)=𝑛 and 1,𝛼,𝛼²,…,𝛼^𝑛−1 is a basis of 𝐹. Furthermore, 1,𝛼,𝛼²,…,𝛼^𝑛−1 is linear independent, and it is equal to 𝛼,𝛼²,…,𝛼^𝑛−1,𝛼^𝑛 (𝛼 is a primitive element, 𝛼≠0) is also linear independent; moreover, 𝛼^𝑝,𝛼^𝑝2,…,𝛼^𝑝𝑛−1,𝛼^𝑝𝑛 is also linear independent.

Conclusion 4. Consider (𝑥₁+𝑥₂+⋯+𝑥_𝑛)^𝑚=(𝑥₁)^𝑚+(𝑥₂)^𝑚+⋯+(𝑥_𝑛)^𝑚, where 𝑥_𝑖∈𝐹_𝑞,(1≤𝑖≤𝑛) and 𝑚 is a nonnegative power of character 𝑝 of 𝐹_𝑞.

Conclusion 5. Let 𝑚≤𝑛. Then, the number of 𝑚×𝑛 matrices of rank 𝑚 over 𝐹_𝑞 is 𝑞^{𝑚(𝑚−1)/2}∏^𝑛_{𝑖=𝑛−𝑚+1}(𝑞^𝑖−1).

More results about finite fields can be found in [10–12].

3. Construction

Let the polynomial 𝑝_𝑗(𝑥)=𝑎_𝑗1𝑥^𝑝𝑛+𝑎_𝑗2𝑥^{𝑝(𝑛−1)}+⋯+𝑎_𝑗𝑛𝑥^𝑝(1≤𝑗≤𝑘), where the coefficient 𝑎_𝑖𝑙∈𝐹_𝑞, (1≤𝑙≤𝑛), and these vectors by the composition of their coefficient are linearly independent. The set of source states 𝑆=𝐹_𝑞; the set of 𝑖th transmitter’s encoding rules 𝐸_𝑈𝑖={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}(1≤𝑖≤𝑛); the set of receiver’s encoding rules 𝐸_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}; the set of 𝑖th transmitter’s tags 𝑇_𝑖={𝑡_𝑖∣𝑡_𝑖∈𝐹_𝑞}(1≤𝑖≤𝑛); the set of receiver’s tags 𝑇={𝑡∣𝑡∈𝐹_𝑞}.

Define the encoding map 𝑓_𝑖∶𝑆×𝐸_𝑈𝑖→𝑇_𝑖, 𝑓_𝑖(𝑠,𝑒_𝑈𝑖)=𝑠𝑝₁(𝑥_𝑖)+𝑠²𝑝₂(𝑥_𝑖)+⋯+𝑠^𝑘𝑝_𝑘(𝑥_𝑖), 1≤𝑖≤𝑛.

 The decoding map 𝑓∶𝑆×𝐸_𝑅→𝑇, 𝑓(𝑠,𝑒_𝑅)=𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼).

 The synthesizing map ℎ∶𝑇₁×𝑇₂×⋯×𝑇_𝑛→𝑇, ℎ(𝑡₁,𝑡₂,…,𝑡_𝑛)=𝑡₁+𝑡₂+⋯+𝑡_𝑛.

 The code works as follows.

Assume that 𝑞 is larger than, or equal to, the number of the possible message and 𝑛≤𝑞.

3.1. Key Distribution

The key distribution center randomly generates 𝑘(𝑘≤𝑛) polynomials 𝑝₁(𝑥),𝑝₂(𝑥),…,𝑝_𝑘(𝑥), where 𝑝_𝑗(𝑥)=𝑎_𝑗1𝑥^𝑝𝑛+𝑎_𝑗2𝑥^{𝑝(𝑛−1)}+⋯+𝑎_𝑗𝑛𝑥^𝑝(1≤𝑗≤𝑘), and make these vectors by composed of their coefficient is linearly independent, it is equivalent to the column vectors of the matrix 𝑎₁₁𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛 is linearly independent. He selects 𝑛 distinct nonzero elements 𝑥₁,𝑥₂,…,𝑥_𝑛∈𝐹_𝑞 again and makes 𝑥_𝑖(1≤𝑖≤𝑛) secret; then he sends privately 𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖) to the sender 𝑈_𝑖(1≤𝑖≤𝑛). The key distribution center also randomly chooses a primitive element 𝛼 of 𝐹_𝑞 satisfying 𝑥₁+𝑥₂+⋯+𝑥_𝑛=𝛼 and sends 𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼) to the receiver 𝑅.

3.2. Broadcast

If the senders want to send a source state 𝑠∈𝑆 to the receiver 𝑅, the sender 𝑈_𝑖 calculates 𝑡_𝑖=𝑓_𝑖(𝑠,𝑒_𝑈𝑖)=𝐴_𝑠(𝑥_𝑖)=𝑠𝑝₁(𝑥_𝑖)+𝑠²𝑝₂(𝑥_𝑖)+⋯+𝑠^𝑘𝑝_𝑘(𝑥_𝑖), 1≤𝑖≤𝑛 and then sends 𝐴_𝑠(𝑥_𝑖)=𝑡_𝑖 to the synthesizer.

3.3. Synthesis

After the synthesizer receives 𝑡₁,𝑡₂,…,𝑡_𝑛, he calculates ℎ(𝑡₁,𝑡₂,…,𝑡_𝑛)=𝑡₁+𝑡₂+⋯+𝑡_𝑛 and then sends 𝑚=(𝑠,𝑡) to the receiver 𝑅.

3.4. Verification

When the receiver 𝑅 receives 𝑚=(𝑠,𝑡), he calculates 𝑡^′=𝑔(𝑠,𝑒_𝑅)=𝐴_𝑠(𝛼)=𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼). If 𝑡=𝑡^′, he accepts 𝑡; otherwise, he rejects it.

Next, we will show that the above construction is a well defined multisender authentication code with arbitration.

Lemma 1. Let 𝐶_𝑖=(𝑆,𝐸_𝑃𝑖,𝑇_𝑖,𝑓_𝑖); then the code is an A-code, 1≤𝑖≤𝑛.

Proof. (1) For any 𝑒_𝑈𝑖∈𝐸_𝑈𝑖,𝑠∈𝑆, because 𝐸_𝑈𝑖={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}, so 𝑡_𝑖=𝑠𝑝₁(𝑥_𝑖)+𝑠²𝑝₂(𝑥_𝑖)+⋯+𝑠^𝑘𝑝_𝑘(𝑥_𝑖)∈𝑇_𝑖=𝐹_𝑞. Conversely, for any 𝑡_𝑖∈𝑇_𝑖, choose 𝑒_𝑈𝑖={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}, where 𝑝_𝑗(𝑥)=𝑎_𝑗1𝑥^𝑝𝑛+𝑎_𝑗2𝑥^{𝑝(𝑛−1)}+⋯+𝑎_𝑗𝑛𝑥^𝑝(1≤𝑗≤𝑘), and let 𝑡_𝑖=𝑓_𝑖(𝑠,𝑒_𝑈𝑖)=𝑠𝑝₁(𝑥_𝑖)+𝑠²𝑝₂(𝑥_𝑖)+⋯+𝑠^𝑘𝑝_𝑘(𝑥_𝑖); it is equivalent to 𝑥^𝑝𝑛_𝑖,𝑥^𝑝𝑛−1_𝑖,…,𝑥^𝑝_𝑖𝑎₁₁𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛𝑠𝑠²⋮𝑠^𝑘=𝑡_𝑖. (4) It follows that 𝑥^𝑝𝑛₁𝑥^𝑝𝑛−1₁⋯𝑥^𝑝₁𝑥^𝑝𝑛₂𝑥^𝑝𝑛−1₂⋯𝑥^𝑝₂𝑥⋮⋮⋮⋮_𝑝𝑛𝑛𝑥^𝑝𝑛−1_𝑛⋯𝑥^𝑝_𝑛×𝑎₁₁𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛𝑠𝑠²⋮𝑠^𝑘=𝑡₁𝑡₂⋮𝑡_𝑛. (5) Denote 𝑎𝐴=¹¹𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛,𝑥𝑋=^𝑝𝑛1𝑥^𝑝𝑛−1₁⋯𝑥^𝑝₁𝑥^𝑝𝑛₂𝑥^𝑝𝑛−1₂⋯𝑥^𝑝₂𝑥⋮⋮⋮⋮_𝑝𝑛𝑛𝑥^𝑝𝑛−1_𝑛⋯𝑥^𝑝_𝑛,𝑠𝑠𝑆=²⋮𝑠^𝑘𝑡,𝑡=¹𝑡₂⋮𝑡_𝑛. (6) The above linear equation is equivalent to 𝑋𝐴𝑆=𝑡, because the column vectors of 𝐴 are linearly independent, 𝑋 is equivalent to a Vandermonde matrix, and 𝑋 is inverse; therefore, the above linear equation has a unique solution, so 𝑠 is only defined; that is, 𝑓_𝑖(1≤𝑖≤𝑛) is a surjection.
(2) If 𝑠^′∈𝑆 is another source state satisfying 𝑠𝑝₁(𝑥_𝑖)+𝑠²𝑝₂(𝑥_𝑖)+⋯+𝑠^𝑘𝑝_𝑘(𝑥_𝑖)=𝑠^′𝑝₁(𝑥_𝑖)+𝑠^′2𝑝₂(𝑥_𝑖)+⋯+𝑠^′𝑘𝑝_𝑘(𝑥_𝑖)=𝑡_𝑖, and it is equivalent to (𝑠−𝑠^′)𝑝₁(𝑥_𝑖)+(𝑠²−𝑠^′2)𝑝₂(𝑥_𝑖)+⋯+(𝑠^𝑘−𝑠^′𝑘)𝑝_𝑘(𝑥_𝑖)=0, then 𝑥^𝑝𝑛_𝑖,𝑥^𝑝𝑛−1_𝑖,…,𝑥^𝑝_𝑖×𝑎₁₁𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛𝑠−𝑠^′𝑠²−𝑠^′2⋮𝑠^𝑘−𝑠^′𝑘=0. (7) Thus 𝑥^𝑝𝑛₁𝑥^𝑝𝑛−1₁⋯𝑥^𝑝₁𝑥^𝑝𝑛₂𝑥^𝑝𝑛−1₂⋯𝑥^𝑝₂𝑥⋮⋮⋮⋮_𝑝𝑛𝑛𝑥^𝑝𝑛−1_𝑛⋯𝑥^𝑝_𝑛×𝑎₁₁𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛𝑠−𝑠^′𝑠²−𝑠^′2⋮𝑠^𝑘−𝑠^′𝑘=00⋮0. (8) Similar to (1), we know that the homogeneous linear equation 𝑋𝐴𝑆=0 has a unique solution; that is, there is only zero solution, so 𝑠=𝑠^′. So, 𝑠 is the unique source state determined by 𝑒_𝑈𝑖 and 𝑡_𝑖; thus, 𝐶_𝑖(1≤𝑖≤𝑛) is an A-code.

Lemma 2. Let 𝐶=(𝑆,𝐸_𝑅,𝑇,𝑔); then the code is an A-code.

Proof. (1) For any 𝑠∈𝑆, 𝑒_𝑅∈𝐸_𝑅, from the definition of 𝑒_𝑅, we assume that 𝐸_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}, 𝑔(𝑠,𝑒_𝑅)=𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)∈𝑇=𝐹_𝑞; on the other hand, for any 𝑡∈𝑇, choose 𝑒_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}, 𝑔(𝑠,𝑒_𝑅)=𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)=𝑡; it is equivalent to 𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,⋯,𝛼^𝑝×𝑎₁₁𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛𝑠𝑠²⋮𝑠^𝑘𝑎=𝑡,𝐴=¹¹𝑎₂₁⋯𝑎_𝑘1𝑎₁₂𝑎₂₂⋯𝑎_𝑘2𝑎⋮⋮⋮⋮_1𝑛𝑎_2𝑛⋯𝑎_𝑘𝑛; (9) that is, (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^𝑠𝑠2_⋮𝑠𝑘=𝑡. From Conclusion 3, we know that (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝) is linearly independent and the column vectors of 𝐴 are also linearly independent; therefore, the above linear equation has unique solution, so 𝑠 is only defined; that is, 𝑔 is a surjection.
(2) If 𝑠^′ is another source state satisfying 𝑡=𝑔(𝑠^′,𝑒_𝑅), then 𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝𝐴𝑠^′𝑠^′2⋮𝑠^′𝑘=𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝𝐴𝑠𝑠²⋮𝑠^𝑘; (10) that is, (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^{𝑠′𝑠′2}_{⋮𝑠′𝑘}−^𝑠𝑠2_⋮𝑠𝑘=0. Similar to (1), we get that the homogeneous linear equation (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴(𝑆^′−𝑆)=0 has a unique solution; that is, there is only zero solution, so 𝑆=𝑆^′; that is, 𝑠=𝑠^′. So, 𝑠 is the unique source state determined by 𝑒_𝑅 and 𝑡; thus, 𝐶=(𝑆,𝐸_𝑅,𝑇,𝑔) is an A-code.
At the same time, for any valid 𝑚=(𝑠,𝑡), we have known that 𝛼=𝑥₁+𝑥₂+⋯+𝑥_𝑛, and it follows that 𝑡^′=𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)=𝑠𝑝₁(𝑥₁+𝑥₂+⋯+𝑥_𝑛)+𝑠²𝑝₂(𝑥₁+𝑥₂+⋯+𝑥_𝑛)+⋯+𝑠^𝑘𝑝_𝑘 (𝑥₁+𝑥₂+⋯+𝑥_𝑛). We also have known that 𝑝_𝑗(𝑥)=𝑎_𝑗1𝑥^𝑝𝑛+𝑎_𝑗2𝑥^{𝑝(𝑛−1)}+⋯+𝑎_𝑗𝑛𝑥^𝑝(1≤𝑗≤𝑘); from Conclusion 4, (𝑥₁+𝑥₂+⋯+𝑥_𝑛)^𝑝𝑚=(𝑥₁)^𝑝𝑚+(𝑥₂)^𝑝𝑚+⋯+(𝑥_𝑛)^𝑝𝑚, where 𝑚 is a nonnegative power of character 𝑝 of 𝐹_𝑞, and we get 𝑝_𝑗(𝑥₁+𝑥₂+⋯+𝑥_𝑛)=𝑝_𝑗(𝑥₁)+𝑝_𝑗(𝑥₂)+⋯+𝑝_𝑗(𝑥_𝑛); therefore, 𝑡^′=𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)=(𝑠𝑝₁(𝑥₁)+𝑠²𝑝₂(𝑥₁)+⋯+𝑠^𝑘𝑝_𝑘(𝑥₁))+(𝑠𝑝₁(𝑥₂)+𝑠²𝑝₂(𝑥₂𝑠)+⋯+_𝑘𝑝_𝑘(𝑥₂))+⋯+(𝑠𝑝₁(𝑥_𝑛)+𝑠²𝑝₂(𝑥_𝑛)+⋯+𝑠^𝑘𝑝_𝑘(𝑥_𝑛))=𝑡₁+𝑡₂+⋯+𝑡_𝑛=𝑡, and the receiver 𝑅 accepts 𝑚.

From Lemmas 1 and 2, we know that such construction of multisender authentication codes is reasonable and there are 𝑛 senders in this system. Next, we compute the parameters of this code and the maximum probability of success in impersonation attack and substitution attack by the group of senders.

Theorem 3. Some parameters of this construction are |𝑆|=𝑞,|𝐸_𝑈𝑖|=[𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1)] ₁^𝑞−1=[𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1)](𝑞−1)(1≤𝑖≤𝑛),|𝑇_𝑖|=𝑞(1≤𝑖≤𝑛),|𝐸_𝑅|=[𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1)]𝜑(𝑞−1),|𝑇|=𝑞. Where 𝜑(𝑞−1) is the Euler  function of 𝑞−1, it represents the number of primitive element of 𝐹_𝑞 here.

Proof. For |𝑆|=𝑞, |𝑇_𝑖|=𝑞, and |𝑇|=𝑞, the results are straightforward. For 𝐸_𝑈𝑖, because 𝐸_𝑈𝑖={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}, where 𝑝_𝑗(𝑥)=𝑎_𝑗1𝑥^𝑝𝑛+𝑎_𝑗2𝑥^{𝑝(𝑛−1)}+⋯+𝑎_𝑗𝑛𝑥^𝑝(1≤𝑗≤𝑘), and these vectors by the composition of their coefficient are linearly independent, it is equivalent to the columns of 𝐴=^{𝑎11𝑎21⋯𝑎𝑘1𝑎12𝑎22⋯𝑎𝑘2}_{𝑎⋮⋮⋮⋮1𝑛𝑎2𝑛⋯𝑎𝑘𝑛} is linear independent. From Conclusion 5, we can conclude that the number of 𝐴 satisfying the condition is 𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1). On the other hand, the number of distinct nonzero elements 𝑥_𝑖(1≤𝑖≤𝑛) in 𝐹_𝑞 is ₁^𝑞−1=𝑞−1, so |𝐸_𝑈𝑖|=[𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1)](𝑞−1). For 𝐸_𝑅, 𝐸_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}. For 𝛼, from Conclusion 1, a generator of 𝐹^∗_𝑞 is called a primitive element of 𝐹_𝑞, |𝐹^∗_𝑞|=𝑞−1; by the theory of the group, we know that the number of generator of 𝐹^∗_𝑞 is 𝜑(𝑞−1); that is, the number of 𝛼 is 𝜑(𝑞−1). For 𝑝₁(𝑥),𝑝₂(𝑥),…,𝑝_𝑘(𝑥). From above, we have confirmed that the number of these polynomials is 𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1); therefore, |𝐸_𝑅|=[𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1)]𝜑(𝑞−1).

Lemma 4. For any 𝑚∈𝑀, the number of 𝑒_𝑅 contained 𝑚 is 𝜑(𝑞−1).

Proof. Let 𝑚=(𝑠,𝑡)∈𝑀, 𝑒_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}∈𝐸_𝑅. If 𝑒_𝑅⊂𝑚, then 𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)=𝑡⇔(𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^𝑠𝑠2_⋮𝑠𝑘=𝑡. For any 𝛼, suppose that there is another 𝐴^′ such that (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^′𝑠𝑠2_⋮𝑠𝑘=𝑡, then (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)(𝐴−𝐴^′)^𝑠𝑠2_⋮𝑠𝑘=0, because 𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝 is linearly independent, so (𝐴−𝐴^′)^𝑠𝑠2_⋮𝑠𝑘=0, but 𝑠𝑠²⋮𝑠^𝑘 is arbitrarily; therefore, 𝐴−𝐴^′=0; that is, 𝐴=𝐴^′, and it follows that 𝐴 is only determined by 𝛼. Therefore, as 𝛼∈𝐸_𝑅, for any given 𝑠 and 𝑡, the number of 𝑒_𝑅 contained in 𝑚 is 𝜑(𝑞−1).

Lemma 5. For any 𝑚=(𝑠,𝑡)∈𝑀 and 𝑚^′=(𝑠^′,𝑡^′)∈𝑀 with 𝑠≠𝑠^′, the number of 𝑒_𝑅 contained 𝑚 and 𝑚^′ is 1.

Proof. Assume that 𝑒_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}∈𝐸_𝑅. If 𝑒_𝑅⊂𝑚 and 𝑒_𝑅⊂𝑚^′, then 𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)=𝑡⇔(𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^𝑠𝑠2_⋮𝑠𝑘=𝑡, 𝑠^′𝑝₁(𝛼)+𝑠^′2𝑝₂(𝛼)+⋯+𝑠^′𝑘𝑝_𝑘(𝛼)=𝑡⇔(𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^{𝑠′𝑠′2}_{⋮𝑠′𝑘}=𝑡. It is equivalent to (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴^{𝑠−𝑠′𝑠2−𝑠′2}_{⋮𝑠𝑘−𝑠′𝑘}=𝑡−𝑡^′ because 𝑠≠𝑠^′, so 𝑡≠𝑡^′; otherwise, we assume that 𝑡=𝑡^′ and since 𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝 and the column vectors of 𝐴 both are linearly independent, it forces that 𝑠=𝑠^′; this is a contradiction. Therefore, we get 𝑡−𝑡^′−1𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝𝐴𝑠−𝑠^′𝑠²−𝑠^′2⋮𝑠^𝑘−𝑠^′𝑘=1, (∗) since 𝑡,𝑡^′ is given, (𝑡−𝑡^′)⁻¹ is unique, by equation (∗), for any given 𝑠,𝑠^′ and 𝑡,𝑡^′, we obtain that (𝛼^𝑝𝑛,𝛼^𝑝𝑛−1,…,𝛼^𝑝)𝐴 is only determined; thus, the number of 𝑒_𝑅 contained 𝑚 and 𝑚^′ is 1.

Lemma 6. For any fixed 𝑒_𝑈={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}(1≤𝑖≤𝑛) containing a given 𝑒_𝐿, then the number of 𝑒_𝑅 which is incidence with 𝑒_𝑈 is 𝜑(𝑞−1).

Proof. For any fixed 𝑒_𝑈={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}(1≤𝑖≤𝑛) containing a given 𝑒_𝐿, we assume that 𝑝_𝑗(𝑥_𝑖)=𝑎_𝑗1𝑥^𝑝𝑛_𝑖+𝑎_𝑗2𝑥^{𝑝(𝑛−1)}_𝑖+⋯+𝑎_𝑗𝑛𝑥^𝑝_𝑖(1≤𝑗≤𝑘,1≤𝑖≤𝑛), 𝑒_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}. From the definitions of 𝑒_𝑅 and 𝑒_𝑈 and Conclusion 4, we can conclude that 𝑒_𝑅 is incidence with 𝑒_𝑈 if and only if 𝑥₁+𝑥₂+⋯+𝑥_𝑛=𝛼. For any 𝛼, since Rank(1,1,…,1)=Rank(1,1,…,1,𝛼)=1<𝑛, so the equation 𝑥₁+𝑥₂+⋯+𝑥_𝑛=𝛼 always has a solution. From the proof of Theorem 3, we know the number of 𝑒_𝑅 which is incident with 𝑒_𝑈 (i.e., the number of all 𝐸_𝑅) is [𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}(𝑞^𝑖−1)]𝜑(𝑞−1).

Lemma 7. For any fixed 𝑒_𝑈={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}(1≤𝑖≤𝑛) containing a given 𝑒_𝐿 and 𝑚=(𝑠,𝑡), the number of 𝑒_𝑅 which is incidence with 𝑒_𝑈 and contained in 𝑚 is 1.

Proof. For any 𝑠∈𝑆,𝑒_𝑅∈𝐸_𝑅, we assume that 𝑒_𝑅={𝑝₁(𝛼),𝑝₂(𝛼),…,𝑝_𝑘(𝛼), where 𝛼 is a primitive element of 𝐹_𝑞}. Similar to Lemma 6, for any fixed 𝑒_𝑈={𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖),𝑥_𝑖∈𝐹^∗_𝑞}, (1≤𝑖≤𝑛) containing a given 𝑒_𝐿, we have known that 𝑒_𝑅 is incident with 𝑒_𝑈 if and only if 𝑥₁+𝑥₂+⋯+𝑥_𝑛=𝛼. (11) Again, with 𝑒_𝑅⊂𝑚, we can get 𝑠𝑝₁(𝛼)+𝑠²𝑝₂(𝛼)+⋯+𝑠^𝑘𝑝_𝑘(𝛼)=𝑡. (12) By (11) and (12) and the property of 𝑝_𝑗(𝑥)(1≤𝑗≤𝑘), we have the following conclusion: 𝑠𝑝₁^𝑛_𝑖=1𝑥_𝑖+𝑠²𝑝₂^𝑛_𝑖=1𝑥_𝑖+⋯+𝑠^𝑘𝑝_𝑘^𝑛_𝑖=1𝑥_𝑖=𝑡⟺𝑝∑₁^𝑛_𝑖=1𝑥_𝑖,𝑝∑₂^𝑛_𝑖=1𝑥_𝑖,…,𝑝∑_𝑘^𝑛_𝑖=1𝑥_𝑖×𝑠𝑠²⋮𝑠^𝑘=𝑡⟺∑^𝑛_𝑖=1𝑝₁𝑥_𝑖,∑^𝑛_𝑖=1𝑝₂𝑥_𝑖,…,∑^𝑛_𝑖=1𝑝_𝑘𝑥_𝑖𝑠𝑠²⋮𝑠^𝑘=𝑡⟺∑^𝑛_𝑖=1𝑥_𝑖^𝑛,∑^𝑛_𝑖=1𝑥_𝑖^𝑛−1,…,∑^𝑛_𝑖=1𝑥_𝑖𝐴𝑠𝑠²⋮𝑠^𝑘=𝑡⟺∑^𝑛_𝑖=1𝑝₁𝑥_𝑖,∑^𝑛_𝑖=1𝑝₂𝑥_𝑖,…,∑^𝑛_𝑖=1𝑝_𝑘𝑥_𝑖−∑^𝑛_𝑖=1𝑥_𝑖^𝑛,∑^𝑛_𝑖=1𝑥_𝑖^𝑛−1,…,∑^𝑛_𝑖=1𝑥_𝑖𝐴×𝑠𝑠²⋮𝑠^𝑘=0, (13) because 𝑠 is any given. Similar to the proof of Lemma 4, we can get (∑^𝑛_𝑖=1𝑝₁(𝑥_𝑖),∑^𝑛_𝑖=1𝑝₂(𝑥_𝑖),…,∑^𝑛_𝑖=1𝑝_𝑘(𝑥_𝑖))−((∑^𝑛_𝑖=1𝑥_𝑖)^𝑛,(∑^𝑛_𝑖=1𝑥_𝑖)^𝑛−1,…,(∑^𝑛_𝑖=1𝑥_𝑖))𝐴=0; that is, ((∑^𝑛_𝑖=1𝑥_𝑖)^𝑛,(∑^𝑛_𝑖=1𝑥_𝑖)^𝑛−1,…,(∑^𝑛_𝑖=1𝑥_𝑖)) 𝐴=(∑^𝑛_𝑖=1𝑝₁(𝑥_𝑖),∑^𝑛_𝑖=1𝑝₂(𝑥_𝑖),…,∑^𝑛_𝑖=1𝑝_𝑘(𝑥_𝑖)), but 𝑝₁(𝑥_𝑖),𝑝₂(𝑥_𝑖),…,𝑝_𝑘(𝑥_𝑖) and 𝑥_𝑖(1≤𝑖≤𝑛) also are fixed; thus, 𝛼 and 𝐴are only determined, so the number of 𝑒_𝑅 which is incident with 𝑒_𝑈 and contained in 𝑚 is 1.

Theorem 8. In the constructed multisender authentication codes, if the senders’ encoding rules and the receiver’s decoding rules are chosen according to a uniform probability distribution, then the largest probabilities of success for different types of deceptions, respectively, are 𝑃_𝐼=1𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}𝑞^𝑖,𝑃−1_𝑆=1𝜑,𝑃𝑞−1_𝑈(𝐿)=1𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}𝑞^𝑖𝜑.−1𝑞−1 (14)

Proof. By Theorem 3 and Lemma 4, we get 𝑃_𝐼=max_𝑚∈𝑀𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚𝐸_𝑅=𝜑𝑞−1𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}𝑞^𝑖𝜑=1−1𝑞−1𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}𝑞^𝑖.−1 (15)
By Lemmas 4 and 5, we get 𝑃_𝑆=max_𝑚∈𝑀max_{𝑚′≠𝑚∈𝑀}𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚,𝑚^′𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅=1⊂𝑚𝜑.𝑞−1 (16)
By Lemmas 6 and 7, we get 𝑃_𝑈(𝐿)=max_{𝑒𝐿∈𝐸𝐿}max_{𝑒𝐿∈𝑒𝑈}max_𝑚∈𝑀𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚,𝑝𝑒_𝑅,𝑒_𝑃≠0𝑒_𝑅∈𝐸_𝑅∣𝑝𝑒_𝑅,𝑒_𝑃=1≠0𝑞^{𝑘(𝑘−1)/2}∏^𝑛_{𝑖=𝑛−𝑘+1}𝑞^𝑖𝜑.−1𝑞−1 (17)

Acknowledgments

This paper is supported by the NSF of China (61179026) and the Fundamental Research of the Central Universities of China Civil Aviation University of Science special (ZXH2012k003).