Some New Constructions of Authentication Codes with Arbitration and Multi-Receiver from Singular Symplectic Geometry

Abstract

A new construction of authentication codes with arbitration and multireceiver from singular symplectic geometry over finite fields is given. The parameters are computed. Assuming that the encoding rules are chosen according to a uniform probability distribution, the probabilities of success for different types of deception are also computed.

1. Introduction

Let 𝑆,𝐸_𝑇,𝐸_𝑅, and 𝑀 be four nonempty finite sets, and let 𝑓∶𝑆×𝐸_𝑇→𝑀 and 𝑔∶𝑀×𝐸_𝑅→𝑆∪{reject}be two maps. The six-tuple (𝑆,𝐸_𝑇,𝐸_𝑅,𝑀,𝑓,𝑔) is called an authentication code with arbitration (𝐴²-code) if(1)the maps 𝑓 and 𝑔 are surjective;(2)for any 𝑚∈𝑀 and 𝑒_𝑇∈𝐸_𝑇, if there is a 𝑠∈𝑆, satisfying 𝑓(𝑠,𝑒_𝑇)=𝑚, then such an 𝑠 is uniquely determined by the given 𝑚 and 𝑒_𝑇;(3)𝑝(𝑒_𝑇,𝑒_𝑅)≠0 and 𝑓(𝑠,𝑒_𝑇)=𝑚 implies 𝑔(𝑚,𝑒_𝑅)=𝑠, otherwise, 𝑔(𝑚,𝑒_𝑅)={reject}.

𝑆,𝐸_𝑇,𝐸_𝑅, and 𝑀 are called the set of source states, the set of transmitter’s encoding rules, the set of receiver’s decoding rules, and the set of messages, respectively; 𝑓 and 𝑔 are called the encoding map and decoding map, respectively. The cardinals |𝑆|,|𝐸_𝑇|,|𝐸_𝑅|, and |𝑀| are called the size parameters of the code.

In [1], Simmons introduced the 𝐴²-code model to solve the transmitter and the receiver’s distrust problem. In [2–4], some Cartesian authentication codes were constructed from symplectic and unitary geometry; in [5–7], authentication codes with arbitration based on symplectic and pseudosymplectic geometry were constructed.

The following notations will be fixed throughout this paper: 𝑝 is a fixed prime. 𝐹_𝑞 is a field with 𝑞 elements. 𝑉=𝐹_𝑞^(2𝜈+𝑙) is a singular symplectic space over 𝐹_𝑞 with index 𝜈. 𝑒_𝑖(1≤𝑖≤2𝜈+𝑙) is row vector in 𝑉 whose 𝑖th coordinate is 1 and all other coordinates are 0. Denote by 𝐸 the 𝑙-dimensional subspace of 𝑉 generated by 𝑒_2𝜈+1,𝑒_2𝜈+2,…,𝑒_2𝜈+𝑙. 𝐾_𝑙 denotes the matrix0𝐼^(𝜈)0−𝐼^(𝜈)00000^(𝑙). (1.1) For more concepts and notations used in this paper, refer to [8].

In an authentication system that permits arbitration, the model includes four attendance: the transmitter, the receiver, the opponent, and the arbiter and includes five attacks.(1)The opponent’s impersonation attack: the largest probability of an opponent’s successful impersonation attack is 𝑃_𝐼. Then,𝑃_𝐼=max_𝑚∈𝑀𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚𝐸_𝑅. (1.2)(2)The opponent’s substitution attack: the largest probability of an opponent’s successful substitution attack is 𝑃_𝑆. Then,𝑃_𝑆=max_𝑚∈𝑀max_{𝑚≠𝑚′∈𝑀}𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚,𝑒_𝑅⊂𝑚^′𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚. (1.3)(3)The transmitter’s impersonation attack: the largest probability of a transmitter’s successful impersonation attack is 𝑃_𝑇. Then,𝑃_𝑇=max_{𝑒𝑇∈𝐸𝑇}max_{𝑚∈𝑀,𝑒𝑇∉𝑚}𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑚,𝑝𝑒_𝑅,𝑒_𝑇≠0𝑒_𝑅∈𝐸_𝑅∣𝑝𝑒_𝑅,𝑒_𝑇≠0. (1.4)(4)The receiver’s impersonation attack: the largest probability of a receiver’s successful impersonation attack is 𝑃_𝑅0. Then,𝑃_𝑅0=max_{𝑒𝑅∈𝐸𝑅}max_𝑚∈𝑀𝑒_𝑇∈𝐸_𝑇∣𝑒_𝑇⊂𝑚,𝑝𝑒_𝑅,𝑒_𝑇≠0𝑒_𝑇∈𝐸_𝑇∣𝑝𝑒_𝑅,𝑒_𝑇≠0. (1.5)(5)The receiver’s substitution attack: the largest probability of a receiver’s successful substitution attack is 𝑃_𝑅1. Then,𝑃_𝑅1=max_{𝑒𝑅∈𝐸𝑅,𝑚∈𝑀}max_{𝑚′∈𝑀}𝑒_𝑇∈𝐸_𝑇∣𝑒_𝑇⊂𝑚,𝑚^′,𝑝𝑒_𝑅,𝑒_𝑇≠0𝑒_𝑇∈𝐸_𝑇∣𝑝𝑒_𝑅,𝑒_𝑇≠0. (1.6)

Notes
𝑝(𝑒_𝑅,𝑒_𝑇)≠0 implies that any source 𝑠 encoded by 𝑒_𝑇 can be authenticated by 𝑒_𝑅.

2. The First Construction

In this section, we will construct an authentication code with arbitration from singular symplectic geometry over finite fields.

Assume that 2𝑠≤2𝑠₀<𝑚₀≤𝜈+𝑚₀, 𝑚₀<2𝜈−1 and 1≤𝑘<𝑙. Let 𝑃 be a subspace ⟨𝑣₁,𝑣₂,𝑒_2𝜈+1⟩ of type (3,0,1) in 𝐹_𝑞^(2𝜈+1), and let 𝑃₀ be a fixed subspace of type (𝑚₀+𝑙,𝑠₀,𝑙) which contains 𝑃 and orthogonal to 𝑣₂, but not orthogonal to 𝑣₁.

Our authentication code is a six-tuple𝑆,𝐸_𝑇,𝐸_𝑅,𝑀;𝑓,𝑔, (2.1) where the set of source states𝑆=𝑠∣𝑠isasubspaceoftype(2𝑠+1+𝑘,𝑠,𝑘),𝑝⊂𝑠⊂𝑃₀, (2.2) the set of transmitter’s encoding rules:𝐸_𝑇=𝑒_𝑇∣𝑒_𝑇isasubspaceoftype(5,2,1),𝑒_𝑇∩𝑃₀=𝑃, (2.3) the set of receiver’s decoding rules:𝐸_𝑅=𝑒_𝑅∣𝑒_𝑅isasubspaceoftype(2,1,0),𝑒_𝑅∩𝑃₀=𝑣₂, (2.4) the set of messages:()𝑣𝑀=𝑚∣𝑚isasubspaceoftype2𝑠+3+𝑘,𝑠+1,𝑘,𝑃⊂𝑚,₂∉𝑚^⟂,𝑚∩𝑃₀isasubspaceoftype(2𝑠+1+𝑘,𝑠,𝑘), (2.5) the encoding function:𝑓∶𝑆×𝐸_𝑇⟶𝑀,𝑠,𝑒_𝑇⟼𝑚=𝑠+𝑒_𝑇 (2.6) and the decoding function: 𝑔∶𝑀×𝐸_𝑅→𝑆∪{reject},𝑚,𝑒_𝑅⟼𝑠if𝑒_𝑅⊂𝑚,where𝑠=𝑚∩𝑃₀,rejectif𝑒_𝑅⊄𝑚. (2.7)

Assuming that the transmitter’s encoding rules and the receiver’s decoding rules are chosen according to a uniform probability distribution, we can prove that the construction given above results in an 𝐴²-code.

Lemma 2.1. The six-tuple (𝑆,𝐸_𝑇,𝐸_𝑅,𝑀,𝑓,𝑔) is an authentication code with arbitration; that is (1)𝑠+𝑒_𝑇=𝑚∈𝑀, for all 𝑠∈𝑆 and 𝑒_𝑇∈𝐸_𝑇;(2)for any 𝑚∈𝑀, 𝑠=𝑚∩𝑃₀ is uniquely information source contained in 𝑚 and there is 𝑒_𝑇∈𝐸_𝑇, such that 𝑚=𝑠+𝑒_𝑇.

Proof. (1) Let 𝑠 be a source state, that is, a subspace 𝑄 of type (2𝑠+1+𝑘,𝑠,𝑘) containing 𝑝 and contained in 𝑝₀. Write 𝐸_𝑘,𝑄 as 𝐸_𝑘=𝑒_2𝑣+1𝑒_2𝑣+𝑖22⋮_{𝑣+𝑖𝑘}𝑄,Q=⁰𝑣₁𝑣₂𝐸_𝑘, (2.8) which satisfies QK_𝑙Q^T=0−𝐼^(𝑠−1)𝐼^(𝑠−1)001000.−1𝑠−1𝑠−1111𝑘 (2.9)
Let 𝑒_𝑇 be a transmitter’s rule, that is, a subspace 𝑅 of type (5,2,1) containing 𝑃 and 𝑅∩𝑃₀=𝑃. So, there exists 𝑢₁,𝑢₂∈𝑅, such that 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩ andQK_𝑙Q^T=0−𝐼^(𝑠−1)𝐼^(𝑠−1)000∗∗10000000∗1000∗01000−1.−1−1𝑠−1𝑠−111111𝑘 (2.10) Therefore, 𝑀=𝑄+⟨𝑢₁,𝑢₂⟩ is a subspace of type (2𝑠+3+𝑘,𝑠+1,𝑘) which contains 𝑃 and 𝑀∩𝑃₀=𝑄 is a subspace of type (2𝑠+1+𝑘,𝑠,𝑘), and is not orthogonal to 𝑣₂, hence a message.
(2) Now, let m be a message; that is, 𝑚 is a subspace 𝑀 of type (2𝑠+3+𝑘,𝑠+1,𝑘) which contains 𝑃 and intersects 𝑃₀ at a subspace of type (2𝑠+1+𝑘,𝑠,𝑘), and is not orthogonal to 𝑣₂. By definition, 𝑃₀ contains ⟨𝑣₁,𝑣₂,𝑒_2𝜈+1⟩, so 𝑃⊂𝑀∩𝑃₀=𝑄, so 𝑄 is a source state. Since 𝑀≠𝑃₀, there exists 𝑢₁,𝑢₂∈𝑀 but 𝑢₁,𝑢₂∉𝑃₀ such that 𝑀=𝑄+⟨𝑢₁,𝑢₂⟩. We have to show that there exists 𝑢₁,𝑢₂∈𝑀 such that 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩ is a subspace of type (5,2,1), hence a transmitter’s encoding rule.
Assume that 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩ has been set; if 𝑅 is a subspace of type (5,2,1), then we are done. So, suppose that 𝑅 is not a subspace of type (5,2,1). Since 𝑣₂∈𝑄^⟂ and 𝑣₂∉𝑀^⟂, we must have that 𝑣₂𝐾_𝑙𝑢^𝑇₁≠0 or 𝑣₂𝐾_𝑙𝑢^𝑇₂≠0. Without loss of generality, let 𝑣₂𝐾_𝑙𝑢^𝑇₂=1. If we also have 𝑣₂𝐾_𝑙𝑢^𝑇₁=1, replacing 𝑢₁ by 𝑢₁−𝑢₂, we get 𝑣₂𝐾_𝑙𝑢^𝑇₂=1 and 𝑣₂𝐾_𝑙𝑢^𝑇₁=0. Since 𝑅 is not a subspace of type (5,2,1), certainly 𝑣₁𝐾_𝑙𝑢^𝑇₁=0. Note that 𝑄 is a subspace of type (2𝑠+1+𝑘,𝑠,𝑘), 𝑣₁∉𝑄^⟂, so there exists a vector 𝑤∈𝑄 such that 𝑣₁𝐾_𝑙𝑤^𝑇=1. Replacing 𝑢₁ by 𝑤+𝑢₁, we have 𝑣₁𝐾_𝑙𝑢^𝑇₁=1, 𝑣₂𝐾_𝑙𝑢^𝑇₁=0(𝑣₂∈𝑄^⟂). Then, 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩ is a subspace of type (5,2,1), and 𝑀=𝑄+𝑅, hence 𝑅 is a transmitter's encoding rule.
If there is another source state 𝑄^′ such that 𝑀=𝑄^′+𝑅^′, we have that 𝑄^′⊂𝑀∩𝑃₀=𝑄. by 𝑄^′⊂𝑀,𝑄^′⊂𝑃₀. Since dim𝑄^′=dim𝑄=2𝑠+1+𝑘, so 𝑄^′=𝑄. This implies that the source state 𝑄 is uniquely determined by 𝑀.

Let 𝑛₁ denote the number of subspaces of type (2𝑠+1+𝑘,𝑠,𝑘) contained in ⟨𝑣₂⟩^⟂ and containing 𝑃, 𝑛₂, the number of subspaces of type (𝑚₀+𝑙,𝑠₀,𝑙) contained in ⟨𝑣₂⟩^⟂ and containing a fixed subspace of type (2𝑠+1+𝑘,𝑠,𝑘) as above, and 𝑛₃, the number of subspaces of type (𝑚₀+𝑙,𝑠₀,𝑙) contained in ⟨𝑣₂⟩^⟂ and containing 𝑃 and not contained in ⟨𝑣₁⟩^⟂.

Lemma 2.2. One has 𝑛₁=𝑞^{2(𝜈−𝑠−1)}⋅𝑞^{(2𝑠−1)(𝑙−𝑘)}(2()((),𝑛⋅𝑁𝑠−1,𝑠−1;2𝜈−2))⋅𝑁𝑘−1,𝑙−1₂=𝑁𝑚₀−(2𝑠+1),𝑠₀(),𝑛−𝑠;2𝜈−𝑠−1₃=𝑞^{2(𝜈−𝑠−1)}⋅𝑞^{(2𝜈−𝑚0−1)}⋅𝑁𝑚₀−3,𝑠₀−1;2(𝜈−2). (2.11)

Proof. (1) Computation of 𝑛₁.
By the transitivity of 𝑆𝑝_2𝑣+𝑙(𝐹_𝑞) on the set of subspaces of the same type, we can assume that 𝑣₁𝑣₂=10010000000000.11𝑣−211𝑣−2𝑙 (2.12)
Let 𝑄 be a subspace of type (2𝑠+1+𝑘,𝑠,𝑘) contained in ⟨𝑣₂⟩^⟂ and containing 𝑃. There exists a 𝑢∈𝑄 such that 𝑣₁𝐾_𝑙𝑢^𝑇=1. We may assume that 𝑢=(0,0,𝑅₁,1,0,𝑅₂,0,0,𝑅₃). So, 𝑄 has a matrix representation of the form10000001000000𝑅Q=¹𝑄₁0000100000000000𝑅₂𝑄₂0000001000000𝐼^(𝑘−1)00𝑅₃𝑄₃00111111𝑣−211𝑣−21𝑘−1𝑙−𝑘2𝑠−2𝑘−1. (2.13)
It is easy to verify that 𝑄₁,𝑄₂ is a subspace of type (2(𝑠−1),𝑠−1) in the 2(𝑣−2)-dimensional symplectic space. The number of this kind of subspace is denoted by 𝑁(2(𝑠−1),𝑠−1;2(𝜈−2)), 𝑄₃ arbitrarily. Furthermore, we may take (𝑄₁,𝑄₂,𝑄₃) as𝐼^(𝑠−1)0000𝐼^(𝑠−1)0000𝑠−1𝑏𝑠−1𝑏𝑙−𝑘 (2.14) to compute 𝑛₁, where 𝑏=(𝜈−2)−(𝑠−1). Since 𝑄 has a matrix representation of the form 10000000100000000𝑄=𝐼^(𝑠−1)00000𝑎₄0000001000000000000000𝐼^(𝑠−1)0000𝑏₄00000000010000000𝐼^(𝑘−1)00𝑐₃0000,11𝑎𝑏11𝑎𝑏1𝑘−1𝑙−𝑘 (2.15) where 𝑎=𝑠−1and𝑏=𝜈−𝑠−1, we have that 𝑛₁=𝑞^{2(𝜈−𝑠−1)}⋅𝑞^{(2𝑠−1)(𝑙−𝑘)}⋅𝑁(2(𝑠−1),𝑠−1;2(𝜈−2))⋅𝑁(𝑘−1,𝑙−1). (2.16)(2) Computation of 𝑛₂.
Let U be a subspaces of type (𝑚₀+𝑙,𝑠₀,𝑙) contained in ⟨𝑣₂⟩^⟂ and containing a fixed subspace of type (2𝑠+1+𝑘,𝑠,𝑘) which contains 𝑃, similar to (1), we may assume that 𝑈 has a matrix representation of the form10000000100000000𝑈=𝐼^(𝑠−1)00000000𝑃₁0001000000000000000𝐼^(𝑠−1)0000000𝑃₂0000000𝐼^(𝑙),11𝑎𝑏11𝑎𝑏𝑙 (2.17) where 𝑎=𝑠−1,𝑏=𝜈−𝑠−1, so (𝑃₁,𝑃₂) is a subspace of type (𝑚₀−(2𝑠+1),𝑠₀−𝑠) in the 2(𝑣−𝑠−1)-dimensional symplectic space. We have that 𝑛₂=𝑁𝑚₀−(2𝑠+1),𝑠₀−𝑠;2(𝜈−𝑠−1). (2.18)(3) Computation of 𝑛₃.
By the same method as that of (1) and (2), let 𝑈₀ be a subspaces of type (𝑚₀+𝑙,𝑠₀,𝑙) contained in ⟨𝑣₂⟩^⟂, containing 𝑃 and not contained in ⟨𝑣₁⟩^⟂. We may assume that the subspace has a matrix representation of the form𝑈₀=100000100000𝐴₁𝑄₁0001000000000𝐴₂𝑄₂00000𝐼^(𝑙).11𝑣−211𝑣−2𝑙 (2.19)
So, the number of the subspaces (𝑄₁,𝑄₂) is denoted by 𝑁(𝑚₀−3,𝑠₀−1;2(𝜈−2)). Then, by the transitivity of 𝑆𝑝_2𝜈+𝑙(𝐹_𝑞) on the set of subspaces of the same type, we can assume that𝑈₀=10000000100000000𝐼^(𝑠0−1)00000000𝐼^(𝑎)000𝑎₅0000001000000000000000𝐼^(𝑠0−1)0000𝑏₄000000𝑏₅0000000000𝐼^(𝑙),11𝑐𝑎𝑏11𝑐𝑎𝑏𝑙 (2.20) where 𝑐=𝑠₀−1,𝑎=𝑚₀−2𝑠₀−1,𝑏=𝜈−𝑚₀+𝑠₀,𝑎₅,𝑏₄,𝑏₅ arbitrarily. We may get 𝑛₃=𝑞^{2(𝜈−𝑠−1)}⋅𝑞^{(2𝜈−𝑚0−1)}⋅𝑁𝑚₀−3,𝑠₀−1;2(𝜈−2). (2.21)

Lemma 2.3. The number of the source states is |𝑆|=𝑞^{(𝑚0−2𝑠−1)+(2𝑠−1)(𝑙−𝑘)}⋅𝑁(2(𝑠−1),𝑠−1;2(𝜈−2))⋅𝑁𝑚₀−(2𝑠+1),𝑠₀−𝑠;2(𝜈−𝑠−1)⋅𝑁(𝑘−1,𝑙−1)𝑁𝑚₀−3,𝑠₀().−1;2𝜈−2 (2.22)

Proof. Since |𝑆| is the number of subspaces of type (2𝑠+1+𝑘,𝑠,𝑘) contained in 𝑃₀ and containing 𝑃, we have |𝑆|⋅𝑛₃=𝑛₁⋅𝑛₂.

Lemma 2.4. The number of the encoding rules of transmitter is 𝐸_𝑇=𝑞^{(𝑚0−3)+2(𝜈−2)+2(𝑙−1)}⋅𝑞^{2𝜈−𝑚0−1}−1. (2.23)

Proof. Since |𝐸_𝑇| is the number of subspaces of type (5,2,1) contained in 𝑃₀ and containing 𝑃, let 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩, where 𝑣₁𝐾_𝑙𝑢^𝑇₁=1,𝑣₂𝐾_𝑙𝑢^𝑇₂=1, and ⟨𝑣₁,𝑢₁⟩⟂⟨𝑣₂,𝑢₂⟩. By the transitivity of 𝑆𝑝_2𝜈+1(𝐹_𝑞) on the set of subspaces of the same type, we can assume that 𝑣₁=(),𝑣1,0,0,0,0,0,0,0,0,0,0,0₂=(),𝑒0,1,0,0,0,0,0,0,0,0,0,0_2𝜈+1=(),𝑃0,0,0,0,0,0,0,0,0,0,1,0₀=10000000100000000𝐼^(𝑠0−1)00000000𝐼^(𝑎)00000000001000000000000000𝐼^(𝑠0−1)0000000000000000000000𝐼^(𝑙),11𝑐𝑎𝑏11𝑐𝑎𝑏𝑙 (2.24) where 𝑐=𝑠₀−1,𝑎=𝑚₀−2𝑠₀−1,and𝑏=𝜈−𝑚₀+𝑠₀. Therefore, 𝑢₁ and 𝑢₂ have the respective forms: 𝑢₁=0,0,𝑎₃,𝑎₄,𝑎₅,1,0,𝑏₃,𝑏₄,𝑏₅,0,𝑓₂,𝑢₂=0,0,𝑐₃,𝑐₄,𝑐₅,0,1,𝑑₃,𝑑₄,𝑑₅,0,𝑔₂. (2.25) Note that 𝑢₂∉𝑃₀ and dim(𝑅∩𝑝₀)=3, so the vector 𝑢₁ cannot lie in 𝑃₀. Then, 𝑎₅,𝑏₄,𝑏₅ cannot equal zero at the same time. Thus, the number of 𝑢₁ is 𝑞^{(𝑚0−3)+(𝑙−1)}(𝑞^{2𝜈−𝑚0−1}−1) and that for 𝑢₂ is 𝑞^{2(𝜈−2)+(𝑙−1)}; we may get 𝐸_𝑇=𝑞^{(𝑚0−3)+2(𝜈−2)+2(𝑙−1)}⋅𝑞^{2𝜈−𝑚0−1}−1. (2.26)

Lemma 2.5. The number of the encoding rules of receiver is 𝐸_𝑅=𝑞^2𝜈−2⋅𝑞^𝑙. (2.27)

Proof. |𝐸_𝑅| is the number of type (2,1,0) intersecting 𝑃₀ at ⟨𝑣₂⟩. Let 𝐻=⟨𝑣₂,𝑢⟩, where 𝑣₂𝐾_𝑙𝑢^𝑇=1. Following the notion of Lemma 2.4, hence 𝑢 has the form 𝑢=𝑎₁,0,𝑎₃,𝑎₄,𝑎₅,𝑏₁,1,𝑏₃,𝑏₄,𝑏₅,𝑐₁. (2.28) Clearly, 𝑢∉𝑃₀. The number of 𝑢 is 𝑞^2𝜈−2⋅𝑞^𝑙, that is, 𝐸_𝑅=𝑞^2𝜈−2⋅𝑞^𝑙. (2.29)

Lemma 2.6. For any 𝑚∈𝑀, let the number of 𝑒_𝑇 and 𝑒_𝑅 contained in 𝑚 be 𝑎 and 𝑏, respectively. Then, 𝑎=𝑞^{4𝑠−3+2(𝑘−1)}⋅𝑞−1,𝑏=𝑞^2𝑠+1⋅𝑞^𝑘. (2.30)

Proof. Let 𝑀 be a message, and 𝑄=𝑀∩𝑃₀, then 𝑄 is a source state contained in 𝑀. By Lemma 2.1, we may get a transmitter’s encoding rule 𝑅 contained in 𝑀. Let 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩. Here, 𝑀=𝑄+⟨𝑢₁,𝑢₂⟩,𝑣₂𝐾_𝑙𝑢^𝑇₂=1. Following the notation of Lemma 2.4, we can assume that 𝑄 has a matrix representation of the form 10000000100000000𝑄=𝐼^(𝑠−1)000000000000000000000000001000000000000000𝐼^(𝑠−1)000000000000000000000000000010000000𝐼^(𝑘−1)0000000,11𝑑𝑐𝑎𝑏11𝑑𝑐𝑎𝑏1𝑘−1𝑙−𝑘 (2.31) where 𝑎=𝑚₀−2𝑠₀−1,𝑏=𝜈+𝑠₀−𝑚,𝑐=𝑠₀−𝑠,and𝑑=𝑠−1. By 𝑣₂𝐾_𝑙𝑢^𝑇₂=1 and 𝑅 being the subspace of type (5,2,1), we can assume 𝑢₁=0,0,𝑎₃,𝑎₄,𝑎₅,𝑎₆,𝑏₁,0,𝑏₃,𝑏₄,𝑏₅,𝑏₆,0,𝑓₂,𝑓₃,𝑢₂=0,0,𝑐₃,𝑐₄,𝑐₅,𝑐₆,𝑑₁,1,𝑑₃,𝑑₄,𝑑₅,𝑑₆,0,𝑔₂,𝑔₃, (2.32) where 𝑏₁≠0. Then, 100000000010000000000𝐼𝑀=0^(𝑠−1)00𝑎₃𝑐₃0000000𝑎₄𝑐₄0000000𝑎₅𝑐₅0000000𝑎₆𝑐₆0010000𝑏₁𝑑₁0000000010000𝐼^(𝑠−1)00𝑏₃𝑑₃0000000𝑏₄𝑑₄0000000𝑏₅𝑑₅0000000𝑏₆𝑑₆000001000000000𝐼^(𝑘−1)𝑓₂𝑔₂0000000𝑓₃𝑔₃,11𝑑𝑐𝑎𝑏11𝑑𝑐𝑎𝑏1𝑘−1𝑙−𝑘 (2.33) where 𝑎=𝑚₀−2𝑠₀−1,𝑏=𝜈+𝑠₀−𝑚,𝑐=𝑠₀−𝑠,and𝑑=𝑠−1.(1)Note that 𝑀 is fixed, so, for 𝑢₁, the 𝑎₄,𝑎₅,𝑎₆,𝑏₄,𝑏₅,𝑏₆, and 𝑓₃ are fixed and, for 𝑢₂, the 𝑐₄,𝑐₅,𝑐₆,𝑑₄,𝑑₅,𝑑₆, and 𝑔₃ are fixed. Therefore, the number of 𝑢₁ is 𝑞^{2(𝑠−1)+(𝑘−1)}⋅(𝑞−1) and the number of 𝑢₂ is 𝑞^{2(𝑠−1)+(𝑘−1)+1}. Then, the number of 𝑒_𝑇 contained in 𝑚 is 𝑎=𝑞^{4𝑠−3+2(𝑘−1)}⋅𝑞−1. (2.34)(2)Let 𝐻=⟨𝑣₂,𝑢⟩ be a receiver’s encoding rule contained in 𝑀, where 𝑣₂𝐾_𝑙𝑢^𝑇=1. Clearly, 𝑢∉𝑄, then we can assume that 𝑢 has the form 𝑢=ℎ₁,0,ℎ₃,ℎ₄,ℎ₅,ℎ₆,𝑖₁,1,𝑖₃,𝑖₄,𝑖₅,𝑖₆,𝑗₁,𝑗₂,𝑗₃. (2.35) Note that ℎ₄,ℎ₅,ℎ₆,𝑖₄,𝑖₅,𝑖₆,𝑗₃=𝑘𝑎₄,𝑎₅,𝑎₆,𝑏₄,𝑏₅,𝑏₆,𝑓₃+𝑐₄,𝑐₅,𝑐₆,𝑑₄,𝑑₅,𝑑₆,𝑔₃, (2.36) where 𝑘∈𝐹_𝑞. Therefore, the number of (ℎ₄,ℎ₅,ℎ₆,𝑖₄,𝑖₅,𝑖₆,𝑗₃) is 𝑞. Then, the number of 𝑒_𝑅 contained in 𝑚 is 𝑏=𝑞⋅𝑞²⋅𝑞^2(𝑠−1)⋅𝑞^𝑘=𝑞^2𝑠+1+𝑘. (2.37)

Lemma 2.7. The number of the messages is |𝑀|=|𝑆|𝐸_𝑇𝑞^{4𝑠−𝑘+2(𝑘−1)}.𝑞−1 (2.38)

Proof. For any 𝑚∈𝑀, there is uniquely 𝑠∈𝑆 and 𝑒_𝑇∈𝐸_𝑇 satisfying 𝑚=𝑠+𝑒_𝑇; the number of 𝑒_𝑇 is 𝑎. Thus, |𝑀|=|𝑆|𝐸_𝑇𝑎=|𝑆|𝐸_𝑇𝑞^{4𝑠−𝑘+2(𝑘−1)}.𝑞−1 (2.39)

Lemma 2.8. (1) For any 𝑒_𝑇∈𝐸_𝑇, the number of 𝑒_𝑅 contained in 𝑒_𝑇 is 𝑞³.
(2) For any 𝑒_𝑅∈𝐸_𝑅, the number of 𝑒_𝑇 containing 𝑒_𝑅 is (𝑞^2𝜈−4−𝑞^𝑚0−3)⋅𝑞^𝑙−1.

Proof. (1) Let 𝑅 be a transmitter’s encoding rule; we can assume that 𝑅=⟨𝑣₁,𝑣₂,𝑢₁,𝑢₂,𝑒_2𝜈+1⟩. Here, 𝑣₂𝐾_𝑙𝑢^𝑇₂=1,𝑣₁𝐾_𝑙𝑢^𝑇₁=1, and ⟨𝑣₁,𝑢₁⟩⟂⟨𝑣₂,𝑢₂⟩. Then, the receiver’s encoding rule 𝐻 contained in 𝑅 should have the form 𝐻=⟨𝑣₂,𝑘₁𝑣₁+𝑘₂𝑢₁+𝑢₂+𝑘₃𝑒_2𝜈+1⟩, where 𝑘₁,𝑘₂,𝑘₃∈𝐹_𝑞. So, the number of 𝐻 is 𝑞³.
(2) Let 𝐻 be a receiver’s encoding rule, and 𝐻=⟨𝑣₂,𝑢⟩, where 𝑣₂𝐾_𝑙𝑢^𝑇=1. Therefore, ⟨𝑣₁,𝑣₂,𝑢,𝑒_2𝜈+1⟩ is a subspace of type (4,1,1). The number of subspace ⟨𝑣₁,𝑣₂,𝑢,𝑢₁,𝑒_2𝜈+1⟩ of type (5,2,1) is 𝑞^2𝜈−4⋅𝑞^𝑙−1. Here, 𝑣₁𝐾_𝑙𝑢^𝑇₁≠0. Note that 𝑣₂∈𝑃^⟂₀ and 𝑣₁∉𝑝^⟂₀. It is easy to see that the number of 𝑢₁∈𝑃₀ such that ⟨𝑣₁,𝑣₂,𝑢₁,𝑒_2𝜈+1⟩ is a subspace of type (4,1,1) is 𝑞^𝑚0−3⋅𝑞^𝑙−1. So, the number of transmitter’s encoding rules 𝑒_𝑇 containing 𝐻 is (𝑞^2𝜈−4−𝑞^𝑚0−3)⋅𝑞^𝑙−1.

Lemma 2.9. For any 𝑚∈𝑀 and 𝑒_𝑅⊂𝑚, the number of 𝑒_𝑇 contained in 𝑚 and containing 𝑒_𝑅 is 𝑞^{2(𝑠−1)+(𝑘−1)}⋅𝑞−1. (2.40)

Proof. Let 𝑀 be a message, and let 𝐻=⟨𝑣₂,𝑢⟩ be a receiver’s encoding rule contained in 𝑀; we can assume that 𝑢=(0,0,0,0,0,1,0,0,0,0,0,0), and 𝑀 has a matrix representation of the form 100000000010000000000𝐼𝑀=0^(𝑠−1)𝑎₃00000000𝑎₄00000100𝑏₁0000000001000000𝐼^(𝑠−1)𝑏₃00000000𝑏₄00000000001000000𝑓₂00𝐼^(𝑘−1)00000𝑓₃000,11𝑎𝑏11𝑎𝑏1𝑘−1𝑙−𝑘 (2.41) where 𝑏₁≠0,𝑎=𝑠−1,and𝑏=𝜈−𝑠−1.
Note that 𝑀 is fixed, so 𝑎₄,𝑏₄,𝑓₃ are fixed. Assume that 𝑅 is a transmitter’s encoding rule contained in 𝑀 and containing 𝐻. Let 𝑅=⟨𝑣₁,𝑣₂,𝑢,𝑢₁,𝑒_2𝜈+1⟩, where 𝑣₁𝐾_𝑙𝑢^𝑇₁≠0. Thus, 𝑢₁ has the form 𝑢₁=0,0,𝑐₃,𝑐₄,𝑑₁,0,𝑑₃,𝑑₄,0,𝑔₂,𝑔₃, (2.42) where 𝑑₁≠0. Note that (𝑐₄,𝑑₄,𝑔₃)=𝑘(𝑎₄,𝑏₄,𝑓₃) and 𝑢₁∉𝑃₀, so 𝑘≠0. Hence, 𝑢₁, 𝑐₄,𝑑₄, and 𝑔₃ are fixed. Then, the number of 𝑢₁ is 𝑞^{2(𝑠−1)+(𝑘−1)}⋅(𝑞−1); that is, the number of 𝑅 is 𝑞^{2(𝑠−1)+(𝑘−1)}⋅(𝑞−1).

Lemma 2.10. Assume that 𝑚₁ and 𝑚₂ are two distinct messages which commonly contain a transmitter’s encoding rule 𝑒^′_𝑇. 𝑠₁ and 𝑠₂ contained in 𝑚₁ and 𝑚₂ are two source states, respectively. Assume that 𝑠₀=𝑠₁⋂𝑠₂, dim𝑠₀=𝑘₁, then 3≤𝑘₁≤2𝑠+𝑘, and(1)the number of 𝑒_𝑅 contained in 𝑚₁⋂𝑚₂ is𝑞^𝑘1;(2)for any 𝑒_𝑅⊂𝑚₁⋂𝑚₂, the number of 𝑒_𝑇 containing𝑒_𝑅 is 𝑞^𝑘1−4.

Proof. Since 𝑚₁=𝑠₁+𝑒^′_𝑇, 𝑚₂=𝑠₂+𝑒^′_𝑇, and 𝑚₁≠𝑚₂, then 𝑠₁≠𝑠₂. Again because of 𝑠₁⊃𝑃₀ and 𝑠₂⊃𝑃₀, 3≤𝑘₁≤2𝑠+𝑘. From 𝑚_𝑖=𝑠_𝑖+𝑒^′_𝑇=𝑠₀+𝑠^′_𝑖+𝑒^′_𝑇, it is easy to know that 𝑚₁⋂𝑚₂=𝑠₀+𝑒^′_𝑇. Therefore, dim𝑚₁𝑚₂=dim𝑠₀+dim𝑒^′_𝑇−dim𝑠₀𝑒^′_𝑇=𝑘₁+5−3=𝑘₁+2. (2.43)(1)By the definition of the message, we can assume that 𝑚₁ and 𝑚₂ have the form as follows, respectively:𝑚₁=10000000100000000𝐴₁𝑎₃𝑏₃000100𝑏₄00000100000𝐴₂𝑎₆𝑏₆0000000𝐴₃1112()11𝑙11𝑣−211𝑣−2𝑙𝑠−1, (2.44) where 𝑏₄≠0, 𝑚₂=10000000100000000𝐵₁𝑐₃𝑑₃000100𝑑₄00000100000𝐵₂𝑐₆𝑑₆0000000𝐵₃1112()11𝑙11𝑣−211𝑣−2𝑙𝑠−1, (2.45) where 𝑑₄≠0. Thus, 𝑚₁⋂𝑚₂=10000000100000000𝐷₁𝑓₃𝑔₃000100𝑔₄00000100000𝐷₂𝑓₆𝑔₆0000000𝐷₃1112()11𝑙11𝑣−211𝑣−2𝑙𝑠−1, (2.46) where 𝑔₄≠0. Since dim(𝑚₁∩𝑚₂)=𝑘₁+2, therefore dim00𝐷₁00𝐷₂000𝑓₃01𝑓₆000𝑔₃𝑔₄0𝑔₆0000000𝐷₃=𝑘₁+2−3=𝑘₁−1. (2.47) If 𝑒_𝑅⊂𝑚₁∩𝑚₂, then 𝑒_𝑅=0𝑅₁100𝑅₃0𝑅₄010𝑅₆0𝑅₇.11𝑣−211𝑣−2𝑙 (2.48)
Since 𝑅₁,𝑅₄ are arbitrary, every row of (00𝑅₃01𝑅₆𝑅₇) is the linear combination of the base 00𝐷₁00𝐷₂000𝑓₃01𝑓₆000𝑔₃𝑔₄0𝑔₆0000000𝐷₃, (2.49) thus the number of it is 𝑞^𝑘1−2. So, it is easy to know that the number of 𝑒_𝑅 contained in 𝑚₁⋂𝑚₂ is 𝑞^𝑘1−2⋅𝑞²=𝑞^𝑘1. (2.50)
(2)Assume that 𝑚₁⋂𝑚₂ has the form of (2.46), then, for any 𝑒_𝑅⊂𝑚₁⋂𝑚₂, we can assume that 𝑒_𝑅=0𝑅₁100𝑅₃0𝑅₄010𝑅₆0𝑅₇.11𝑣−211𝑣−2𝑙 (2.51) If 𝑒_𝑅⊂𝑒_𝑇 and 𝑒_𝑇⊂𝑚₁⋂𝑚₂, then 𝑒_𝑇=100000100000𝑅₃𝑅^′₃000𝑅₄100010000𝑅₆𝑅^′₆00000100𝑅₇𝑅^′₇011111,11𝑣−211𝑣−21𝑙−1 (2.52) where 00𝑅^′₃00𝑅^′₆0𝑅^′₇00000010 (2.53) is the linear combination on the basis of 00𝐷₁00𝐷₂000𝑓₃01𝑓₆000𝑔₃𝑔₄0𝑔₆0000000𝐷₃, (2.54) then the number of 𝑒_𝑇 containing 𝑒_𝑅 is 𝑞^𝑘1−4.

Theorem 2.11. The above construction yields an𝐴²-code with the following size parameters: |𝑆|=𝑞^{(𝑚0−2𝑠−1)+(2𝑠−1)(𝑙−𝑘)}⋅𝑁(2(𝑠−1),𝑠−1;2(𝜈−2))⋅𝑁𝑚₀−(2𝑠+1),𝑠₀−𝑠;2(𝜈−𝑠−1)⋅𝑁(𝑘−1,𝑙−1)𝑁𝑚₀−3,𝑠₀(),𝐸−1;2𝜈−2_𝑇=𝑞^{(𝑚0−3)+2(𝜈−2)+2(𝑙−1)}⋅𝑞^{2𝜈−𝑚0−1},𝐸−1_𝑅=𝑞^{2𝜈−2+𝑙},|𝑀|=|𝑆|𝐸_𝑇𝑞^{4𝑠−3+2(𝑘−1)}⋅.𝑞−1 (2.55) Moreover, assume that the encoding rules 𝑒_𝑇 and 𝑒_𝑅 are chosen according to a uniform probability distribution, the largest probabilities of success for different types of deceptions: 𝑃_𝐼=1𝑞^{2𝜈−2𝑠−3}⋅𝑞^𝑙−𝑘,𝑃_𝑆=1𝑞,𝑃_𝑇=1𝑞²;𝑃_𝑅0=𝑞−1𝑞^{𝑚0−2𝑠−1}⋅𝑞^𝑙−𝑘𝑞^{2𝜈−𝑚0−1}−1,𝑃_𝑅1=1.𝑞⋅𝑞−1 (2.56)

Proof. (1) The number of 𝑚 containing 𝑒_𝑅 is 𝑏,then𝑃_𝐼=𝑞^2𝑠+1⋅𝑞^𝑘𝑞^2𝜈−2⋅𝑞^𝑙=1𝑞^{2𝜈−2𝑠−3}⋅𝑞^𝑙−𝑘. (2.57)(2)Assume that opponent gets 𝑚₁, which is from transmitter, and sends 𝑚₂ instead of 𝑚₁, when 𝑠₁ contained in 𝑚₁ is different from 𝑠₂ contained in 𝑚₂; the opponent’s substitution attack can be successful. Because 𝑒_𝑅⊂𝑒_𝑇⊂𝑚₁, the opponent selects 𝑒^′_𝑇⊂𝑚₁ satisfying 𝑚₂=𝑠₂+𝑒^′_𝑇 and dim(𝑠₁⋂𝑠₂)=𝑘₁, then𝑃_𝑆=𝑞^𝑘1𝑞^2𝑠+1⋅𝑞^𝑘=1𝑞, (2.58) where 𝑘₁=2𝑠+𝑘.(3)Assume that 𝑅 is transmitter’s encoding rules, 𝑄 is a source state, and 𝑀=𝑅+𝑄. Therefore, the number of receiver’s encoding rules contained in 𝑅 is 𝑞³. Let 𝑀^′ be another message, such that 𝑀^′=𝑅^′+𝑄 and 𝑅≠𝑅^′. Then, 𝑒_𝑅 contained 𝑅⋂𝑀^′ is at most 𝑞. So,𝑃_𝑇=𝑞𝑞³=1𝑞². (2.59)(4)From Lemmas 2.8 and 2.9, thus𝑃_𝑅0=𝑞^{2(𝑠−1)⋅(𝑞−1)⋅𝑞𝑘−1}𝑞^2𝜈−4−𝑞^𝑚0−3⋅𝑞^𝑙−1=𝑞−1𝑞^{𝑚0−2𝑠−1}⋅𝑞^𝑙−𝑘𝑞^{2𝜈−𝑚0−1}−1. (2.60)(5)Assume that the receiver declares to receive a message 𝑚₂ instead of 𝑚₁,when 𝑠₂ contained in 𝑚₁ is different from 𝑠₂ contained in 𝑚₂; the receiver’s substitution attack can be successful. Since 𝑒_𝑅⊂𝑒_𝑇⊂𝑚₁, receiver is superior to select 𝑒^′_𝑇, satisfying 𝑒_𝑅⊂𝑒^′_𝑇⊂𝑚₁, thus 𝑚₂=𝑠₂+𝑒^′_𝑇, and dim(𝑠₁∩𝑠₂)=𝑘₁ as large as possible. Therefore, the probability of a receiver’s successful substitution attack is𝑃_𝑅1=𝑞^𝑘1−4𝑞^{2(𝑠−1)+(𝑘−1)}⋅=1𝑞−1𝑞𝑞−1, (2.61) where 𝑘₁=2𝑠+𝑘.

3. The Second Construction

In this section, from singular symplectic geometry and the first construction, we construct an authentication code with a transmitter and multi-receivers and compute the probabilities of success for different types of deceptions. For the definition of multi-receiver authentication codes, refer to [9].

Let 2𝑠≤2𝑠₀<𝑚₀≤𝜈+𝑚₀, 𝑚₀<2𝜈−1, and 1≤𝑘<𝑙. Let 𝑝 be a subspace ⟨𝑣₁,𝑣₂,𝑒_2𝜈+1⟩ of type (3,0,1) in 𝐹_𝑞^(2𝜈+𝑙), and let 𝑃₀ be a fixed subspace of type (𝑚₀+𝑙,𝑠₀,𝑙) which contains 𝑃 and orthogonal to 𝑣₂, but not orthogonal to 𝑣₁. Let 𝑆={𝑠∣𝑠𝑖𝑠𝑎𝑠𝑢𝑏𝑠𝑝𝑎𝑐𝑒𝑜𝑓𝑡𝑦𝑝𝑒(2𝑠+1+𝑘,𝑠,𝑘),𝑃⊂𝑠⊂𝑃₀}, Let 𝐸={𝑒∣𝑒𝑖𝑠𝑎𝑠𝑢𝑏𝑠𝑝𝑎𝑐𝑒𝑜𝑓𝑡𝑦𝑝𝑒(5,2,1),𝑒_𝑇⋂𝑃₀=𝑃}, Let 𝑀={𝑚∣𝑚𝑖𝑠𝑎𝑠𝑢𝑏𝑠𝑝𝑎𝑐𝑒𝑜𝑓𝑡𝑦𝑝𝑒(2𝑠+3+𝑘,𝑠+1,𝑘),𝑃⊂𝑚,𝑣₂∉𝑚^⟂,𝑚⋂𝑃₀𝑖𝑠𝑎𝑠𝑢𝑏𝑠𝑝𝑎𝑐𝑒𝑜𝑓𝑡𝑦𝑝𝑒(2𝑠+1+𝑘,𝑠,𝑘)}, and let 𝑀^∗={(𝑚₁,𝑚₂,…,𝑚^𝜆)|𝑚₁⋂𝑈^⟂=𝑚₂⋂𝑈^⟂=…=𝑚_𝜆⋂𝑈^⟂}.

First, we construct (𝜆+1)𝐴-codes. Let 𝐶=(𝑆,𝐸^𝜆,𝑀^∗,𝑓), where 𝑆,𝐸^𝜆,and𝑀^∗ are the sets of source states, keys, and authenticators of 𝐶, respectively, and 𝑓∶𝑆×𝐸^𝜆→𝑀^∗,𝑓(𝑠,𝑒)=(𝑠+𝑒₁,𝑠+𝑒₂,…,𝑠+𝑒_𝜆) for 𝑒=(𝑒₁,𝑒₂,…,𝑒_𝜆)∈𝐸^𝜆 is the authentication mapping of 𝐶. Let 𝐶_𝑖=(𝑆,𝐸_𝑖,𝑀_𝑖;𝑓_𝑖), where 𝑆,𝐸_𝑖=𝐸 and 𝑀_𝑖=𝑀 are the sets of source states, keys, and authenticators of 𝐶_𝑖, respectively, and 𝑓_𝑖∶𝑆×𝐸_𝑖→𝑀_𝑖,𝑓_𝑖(𝑠,𝑒_𝑖)=𝑠+𝑒_𝑖 for 𝑒_𝑖∈𝐸_𝑖, is the authentication mapping of 𝐶_𝑖. It is easy to know that 𝐶 and 𝐶_𝑖 are well-defined 𝐴-codes.

Our authentication scheme is a (𝜆+1)-tuple𝐶;𝐶₁,𝐶₂,…,𝐶_𝜆. Let 𝜏_𝑖∶𝐸^𝜆→𝐸_𝑖,𝜏_𝑖(𝑒)=𝑒_𝑖 for 𝑒=(𝑒₁,𝑒₂,…,𝑒_𝜆)∈𝐸^𝜆, and let 𝜋_𝑖∶𝑀^∗→𝑀_𝑖,𝜋_𝑖(𝑚)=𝑚_𝑖 for 𝑚=(𝑚₁,𝑚₂,…,𝑚_𝜆). Then,𝜋_𝑖𝑓(𝑠,𝑒)=𝜋𝑠+𝑒₁,𝑠+𝑒₂,…,𝑠+𝑒_𝜆=𝑠+𝑒_𝑖,𝑓_𝑖𝐼_𝑠×𝜏_𝑖(𝑠,𝑒)=𝑓_𝑖𝐼_𝑠(𝑠),𝜏_𝑖(𝑒)=𝑓_𝑖𝑠,𝑒_𝑖=𝑠+𝑒_𝑖. (3.1)

Therefore, 𝜋_𝑖(𝑓(𝑠,𝑒))=𝑓_𝑖((𝐼_𝑠×𝜋_𝑖)(𝑠,𝑒)). Thus, our scheme is indeed a well-defined authentication code with a transmitter and multi-receivers.

Theorem 3.1. In the construction of multi-receiver authentication codes, if the encoding rules are chosen according to a uniform probability distribution, then the probabilities of impersonation attack and substitution attack are, respectively, 𝑃_𝐼[]=1𝑖,𝐽𝑞^{𝑚0+2𝜈+2𝑙−4𝑠−2𝑘−4}⋅𝑞^{2𝜈−𝑚0−1},𝑃−1_𝑆[]=1𝑖,𝐽𝑞^{𝑚0+2𝜈+2𝑙−2𝑠−𝑘−5}⋅𝑞^{2𝜈−𝑚0−1},−1 (3.2) where 𝐽={𝑖₁,𝑖₂,…,𝑖_𝑗},𝑖∉𝐽.

Proof. Let 𝑒_𝐽=(𝑒_𝑖1,𝑒_𝑖2,…,𝑒_𝑖𝑗), then 𝜏_𝐽(𝑒)=𝑒_𝐽⟺𝑒=…,𝑒_𝑖1,…,𝑒_𝑖𝑗,…. (3.3) It is easy to know that |𝑒∈𝐸^𝜆∣𝜏_𝐽(𝑒)=𝑒_𝐽|=|𝐸|^𝜆−𝑗, and 𝑓_𝑖𝑠,𝑒_𝑖=𝜋_𝑖(𝑚),𝑠+𝑒_𝑖=𝑚_𝑖=𝜋_𝑖(𝑚). (3.4) From Lemma 2.6, we know that the number of 𝑒_𝑖 satisfying (3.4) is 𝑎. For any 𝑒_𝑖 satisfying (3.4), the number of 𝑒 satisfying 𝜏_𝐽(𝑒),𝜏_𝑖(𝑒)=𝑒_𝑖 is |𝐸|^{𝜆−𝐽−1}. So, 𝑒∈𝐸^𝜆∣𝜏_𝐽(𝑒)=𝑒_𝐽,𝜏_𝑖(𝑒)=𝑒_𝑖,𝑓_𝑖𝑠,𝑒_𝑖=𝜋_𝑖(𝑚)=|𝐸|^{𝜆−𝑗−1} (3.5) and 𝑎=𝑞^{4𝑠+2𝑘−5}, thus 𝑃_𝐼[𝑖,𝐽]=max_{𝑒𝐽∈𝐸𝐽}max_𝑠∈𝑆max_𝑚∈𝑀𝑒∈𝐸^𝜆∣𝜏_𝐽(𝑒)=𝑒_𝐽,𝜏_𝑖(𝑒)=𝑒_𝑖,𝑓_𝑖𝑠,𝑒_𝑖=𝜋_𝑖(𝑚)𝑒∈𝐸^𝜆∣𝜏_𝐽(𝑒)=𝑒_𝐽=max_{𝑒𝐽∈𝐸𝐽}max_𝑠∈𝑆max_𝑚∈𝑀𝑎|𝐸|=𝑞^{4𝑠+2𝑘−5}𝑞^{(𝑚0−3)+2(𝜈−2)+2(𝑙−1)}⋅𝑞^{2𝜈−𝑚0−1}=1−1𝑞^{𝑚0+2𝜈+2𝑙−4𝑠−2𝑘−4}⋅𝑞^{2𝜈−𝑚0−1}.−1 (3.6) Now, we compute the probability of substitution attack: we know that 𝑚=𝑓(𝑠,𝑒)=𝑠+𝑒₁,𝑠+𝑒₂,…,𝑠+𝑒_𝜆=𝑚₁,𝑚₂,…,𝑚_𝜆 (3.7) and 𝜏_𝐽(𝑒)=(𝑒_𝑖1,𝑒_𝑖2,…,𝑒_𝑖𝑗), whenever 𝑒=(𝑒₁,𝑒₂,…,𝑒_𝑖1,…,𝑒_𝑖𝑗,𝑒_𝑘,…,𝑒_𝜆), while 𝑒∈𝐸^𝜆∣𝑚=𝑓(𝑠,𝑒),𝜏_𝐽(𝑒)=𝑒_𝐽=|𝐸|^𝜆−𝑗,𝑒∈𝐸^𝜆∣𝑚=𝑓(𝑠,𝑒),𝜏_𝐽(𝑒)=𝑒_𝐽,𝜏_𝑖(𝑒)=𝑒_𝑖∈𝐸_𝑖,𝑓_𝑖𝑠^′,𝑒_𝑖=𝜋_𝑖(𝑚)=|𝐸|^{𝜆−𝑗−1}⋅𝑑 (3.8) and 𝑑=𝑞^𝑘1−4, therefore 𝑃_𝑆[𝑖,𝐽]=max_{𝑒𝑗∈𝐸𝐽}max_{𝑠∈𝑆,𝑚∈𝑀}max_{𝑠≠𝑠′∈𝑆,𝑚∈𝑀}𝑒∈𝐸^𝜆∣𝑚=𝑓(𝑠,𝑒),𝜏_𝐽(𝑒)=𝑒_𝐽,𝜏_𝑖(𝑒)=𝑒_𝑖∈𝐸_𝑖,𝑓_𝑖𝑠^′,𝑒_𝑖=𝜋_𝑖𝑚^′𝑒∈𝐸^𝜆∣𝑚=𝑓(𝑠,𝑒),𝜏_𝐽(𝑒)=𝑒_𝐽=max_{𝑒𝑗∈𝐸𝐽}max_{𝑠∈𝑆,𝑚∈𝑀}max_{𝑠≠𝑠′∈𝑆,𝑚∈𝑀}𝑑|𝐸|=max_{𝑒𝑗∈𝐸𝐽}max_{𝑠∈𝑆,𝑚∈𝑀}max_{𝑠≠𝑠′∈𝑆,𝑚∈𝑀}𝑞^𝑘1−4𝑞^{(𝑚0−3)+2(𝜈−2)+2(𝑙−1)⋅(𝑞02𝜈−𝑚−1−1)}=1𝑞^{𝑚0+2𝜈+2𝑙−2𝑠−𝑘−5}⋅𝑞^{2𝜈−𝑚0−1},−1 (3.9) where 𝑘₁=2𝑠+𝑘.

Two types of construction of authentication codes from singular symplectic geometry over finite fields are given. Among them, in the first construction, based on singular symplectic geometry structure of the authentication code with arbitration, the greatest probabilities of success for different types of deceptions are relatively lower, therefore there are some advantages. In addition, the second construction is based on singular symplectic geometry and is a multi-receiver authentication code. The probabilities of success for different types of deceptions are also computed. The results about multi-receiver authentication codes based on singular symplectic geometry are fewer. Thus, the structure of authentication code and the theory for further discussion are very meaningful.

Acknowledgments

This work is supported by the National Natural Science Foundation of China under Grant no. 61179026 and the Natural Science Foundation of Tianjin City under Grant no. 08JCYBJC13900.