A New Construction of Multisender Authentication Codes from Pseudosymplectic Geometry over Finite Fields

Abstract

Multisender authentication codes allow a group of senders to construct an authenticated message for one receiver such that the receiver can verify authenticity of the received message. In this paper, we construct one multisender authentication code from pseudosymplectic geometry over finite fields. The parameters and the probabilities of deceptions of this code are also computed.

1. Introduction

Multisender authentication code was firstly constructed by Gilbert et al. in [1] in 1974. Multisender authentication system refers to a group of senders that cooperatively send a message to the receiver, and then the receiver should be able to ascertain that the message is authentic. About this case, many scholars had also much researches and had made great contributions to multisender authentication codes [2–6].

In the actual computer network communications, multisender authentication codes include sequential model and simultaneous model. Sequential model is that each sender uses its own encoding message to the receiver, and the receiver receives the message and verifies whether the message is legal or not. Simultaneous model is that all senders use their own encoding rules to encode a source state, and each sender sends the encoded message to the synthesizer, respectively, and then the synthesizer forms an authenticated message and verifies whether the message is legal or not. In this paper, we will adopt the second model.

In a simultaneous model, there are four participants: a group of senders 𝑃={𝑃₁,𝑃₂,…,𝑃_𝑛}, the keys distribution center, he is responsible for the key distribution to senders and receiver, including solving the disputes between them, a receiver 𝑅, a synthesizer, he only runs the trusted synthesis algorithm. The code works as follows: each sender and receiver has their own cartesian authentication code, respectively. Let (𝑆,𝐸_𝑖,𝑇_𝑖;𝑓_𝑖)(𝑖=1,2,…,𝑛) be the senders’ cartesian authentication code,  (𝑆,𝐸_𝑅,𝑇;𝑔) be the receiver's cartesian authentication code, ℎ∶𝑇₁×𝑇₂×⋯×𝑇_𝑛→𝑇 the synthesis algorithm. 𝜋_𝑖∶𝐸→𝐸_𝑖 is a subkey generation algorithm, where 𝐸 is the key set of the key distribution center. When authenticating a message, the senders and the receiver should comply with the protocol. The key distribution center randomly selects an encoding rule 𝑒∈𝐸 and sends 𝑒_𝑖=𝜋_𝑖(𝑒) to the 𝑖th sender 𝑃_𝑖(𝑖=1,2,…,𝑛) secretly, and then he calculates 𝑒_𝑅 by 𝑒 according to an effective algorithm and secretly sends 𝑒_𝑅 to the receiver 𝑅; if the senders would like to send a source state 𝑠 to the receiver 𝑅, 𝑃_𝑖 computes 𝑡_𝑖=𝑓_𝑖(𝑠,𝑒_𝑖)(𝑖=1,2,…,𝑛) and sends 𝑚_𝑖=(𝑠,𝑡_𝑖)(𝑖=1,2,…,𝑛) to the synthesizer through an open channel; the synthesizer receives the message 𝑚_𝑖=(𝑠,𝑡_𝑖)(𝑖=1,2,…,𝑛) and calculates 𝑡=ℎ(𝑡₁,𝑡₂,…,𝑡_𝑛) by the synthesis algorithm ℎ and then sends message 𝑚=(𝑠,𝑡) to the receiver 𝑅, he checks the authenticity by verifying whether 𝑡=𝑔(𝑠,𝑒_𝑅) or not. If the equality holds, the message is authentic and is accepted. Otherwise, the message is rejected.

We assume that the key distribution center is credible, though he know the senders' and receiver's encoding rules, he will not participate in any communication activities. When transmitters and receiver are disputing, the key distribution center settles it. At the same time, we assume that the system follows Kerckhoff's principle in which except for the actual used keys, the other information of the whole system is public.

In a multisender authentication system, we assume that the whole senders are cooperating to form a valid message; that is, all senders as a whole and receiver are reliable. But there are some malicious senders which they together cheat the receiver, the part of senders and receiver are not credible, they can take impersonation attack and substitution attack. In the whole system, we assume that {𝑃₁,𝑃₂,…,𝑃_𝑛} are senders, 𝑅 is a receiver, 𝐸_𝑖 is the encoding rules set of the sender 𝑃_𝑖, and 𝐸_𝑅 is the decoding rules set of receiver 𝑅. If the source state space 𝑆 and the key space 𝐸_𝑅 of receiver 𝑅 are according to a uniform distribution, then the probability distribution of message space 𝑀 and tag space 𝑇 is determined by the probability distribution of 𝑆 and 𝐸_𝑅. Consider 𝐿={𝑖₁,𝑖₂,…,𝑖_𝑙}⊂{1,2,…,𝑛},𝑙<𝑛, 𝑃_𝐿={𝑝₁,𝑝₂,…,𝑝_𝑙}, and 𝐸_𝐿={𝐸_𝑝1,𝐸_𝑝2,…,𝐸_𝑝𝑙}. Now, let us consider the attacks from malicious groups of senders. Here, there still are two kinds of attacks.

(i) The Opponent's Impersonation Attack. 𝑃_𝐿 sends a message 𝑚 to receiver. 𝑃_𝐿 is successful if the receiver accepts it as legitimate message. Denote 𝑃_𝐼(𝐿) as the largest probability of some opponent's successful impersonation attack, and it can be expressed as 𝑃_𝐼(𝐿)=max_{𝑒𝐿∈𝐸𝐿}max_𝑚∈𝑀𝑃𝑅𝑚isacceptedby𝑒_𝐿. (1)

(ii) The Opponent's Substitution Attack. It is the largest probability of some opponent's successful substitution attack, and it can be expressed as 𝑃_𝑆(𝐿)=max_{𝑒𝐿∈𝐸𝐿}max_𝑚∈𝑀max_{𝑚′≠𝑚∈𝑀}𝑃𝑚^′𝑅isacceptedby𝑚,𝑒_𝐿. (2) In this paper, we give a construction about multisender authentication code from pseudosymplectic geometry over finite fields.

2. Pseudosymplectic Geometry

Let 𝐹_𝑞 be the finite field with 𝑞 elements, where 𝑞 is a power of 2, 𝑛=2𝜈+𝛿, and 𝛿=1,2. Let 𝐾=0𝐼^(𝜈)𝐼^(𝜈)0,𝑆₁=𝐾1,𝑆₂=𝐾01,11 (3) and 𝑆_𝛿 is a (2𝜈+𝛿)×(2𝜈+𝛿) nonalternate symmetric matrix.

The pseudosymplectic group of degree (2𝜈+𝛿) over 𝐹_𝑞 is defined to be the set of matrices 𝑃𝑠_2𝜈+𝛿(𝐹_𝑞)={𝑇∣𝑇𝑆_𝛿^𝑡𝑇=𝑆_𝛿} denoted by 𝑃𝑠_2𝜈+𝛿(𝐹_𝑞).

Let 𝐹_𝑞^(2𝜈+𝛿) be the (2𝜈+𝛿)-dimensional row vector space over 𝐹_𝑞. 𝑃𝑠_2𝜈+𝛿(𝐹_𝑞) has an action on 𝐹_𝑞^(2𝜈+𝛿) defined as follows: 𝐹_𝑞^(2𝜈+𝛿)×𝑃𝑠_2𝜈+𝛿𝐹_𝑞⟶𝐹_𝑞^(2𝜈+𝛿),𝑥₁,𝑥₂,…,𝑥_2𝜈+𝛿,𝑇⟶𝑥₁,𝑥₂,…,𝑥_2𝜈+𝛿𝑇. (4) The vector space 𝐹_𝑞^(2𝜈+𝛿) together with this group action is called the pseudosymplectic space over the finite field 𝐹_𝑞 of characteristic 2.

Let 𝑃 be an 𝑚-dimensional subspace of 𝐹_𝑞^(2𝜈+𝛿); then, 𝑃𝑆_𝛿^𝑡𝑃 is cogredient to one of the following three normal forms: 𝑀(𝑚,2𝑠,𝑠)=0𝐼^(𝑠)𝐼^(𝑠)00^{(𝑚−2𝑠)},𝑀(𝑚,2𝑠+1,𝑠)=0𝐼^(𝑠)𝐼^(𝑠)010^{(𝑚−2𝑠−1)},𝑀(𝑚,2𝑠+2,𝑠)=0𝐼^(𝑠)𝐼^(𝑠)000111_{(𝑚−2𝑠−2)}, (5) for some 𝑠 such that 0≤𝑠≤[𝑚/2]. We say that 𝑃 is a subspace of type (𝑚,2𝑠+𝜏,𝑠,𝜖), where 𝜏=0,1, or 2 and 𝜖=0 or 1, if (i)𝑃𝑆_𝛿^𝑡𝑃 is cogredient to 𝑀(𝑚,2𝑠+𝜏,𝑠);(ii)𝑒_2𝜈+1∉𝑃 or 𝑒_2𝜈+1∈𝑃 according to 𝜖=0 or 𝜖=1, respectively.

Let 𝑃 be an 𝑚-dimensional subspace of 𝐹_𝑞^(2𝜈+𝛿). Denote by 𝑃^⟂ the set of vectors which are orthogonal to every vector of 𝑃; that is, 𝑃^⟂=𝑦∈𝐹_𝑞^(2𝜈+𝛿)∣𝑦𝑆_𝛿^𝑡𝑥=0∀𝑥∈𝑃. (6) Obviously, 𝑃^⟂ is a (2𝜈+𝛿−𝑚)-dimensional subspace of 𝐹_𝑞^(2𝜈+𝛿).

More properties of pseudosymplectic geometry over finite fields can be found in [7].

In [2], Desmedt et al. gave two constructions for MRA-codes based on polynomials and finite geometries, respectively. There are other constructions of multisender authentication codes which are given in [3–6]. The construction of authentication codes is of combinational design in its nature. We know that the geometry of classical groups over finite fields, including symplectic geometry, pseudosymplectic geometry, unitary geometry, and orthogonal geometry, can provide a better combination of structure and can be easy to count. In this paper, we construct one multisender authentication code from pseudosymplectic geometry over finite fields. The parameters and the probabilities of deceptions of this code are also computed. We realize the generalization and application of the similar idea and method of article [8] from symplectic geometry to pseudosymplectic geometry over finite fields.

3. Construction

Let 𝔽_𝑞 be a finite field with 𝑞 elements and 𝑒_𝑖(1≤𝑖≤2𝜈+2) the row vector in 𝔽_𝑞^(2𝜈+2) whose 𝑖th coordinate is 1 and all other coordinates are 0. Assume that 2<𝑛+1<𝑟<𝜈. Let 𝑈=⟨𝑒₁,𝑒₂,…,𝑒_𝑛⟩; that is, 𝑈 is an 𝑛-dimensional subspace of 𝔽_𝑞^(2𝜈+2) generated by 𝑒₁,𝑒₂,…,𝑒_𝑛, and then 𝑈^⟂=⟨𝑒₁,…,𝑒_𝜈,𝑒_𝜈+𝑛+1,…,𝑒_2𝜈+2⟩. Consider 𝑊_𝑖=⟨𝑒₁,…,𝑒_𝑖−1,𝑒_𝑖+1,…,𝑒_𝑛⟩, 1≤𝑖≤𝑛; then, 𝑊_𝑖^⟂=⟨𝑒₁,…,𝑒_𝜈,𝑒_𝜈+𝑖,𝑒_𝜈+𝑛+1,…,𝑒_2𝜈+2⟩. The set of source states 𝑆={𝑠∣𝑠 is a subspace of type (2𝑟−𝑛+1,2(𝑟−𝑛),𝑟−𝑛,1) and 𝑈⊂𝑠⊂𝑈^⟂}; the set of 𝑖th sender's encoding rules 𝐸_𝑃𝑖={𝑒_𝑃𝑖∣𝑒_𝑃𝑖isasubspaceoftype(𝑛+1,0,0,0)and𝑈⊂𝑒_𝑃𝑖,𝑒_𝑃𝑖⟂𝑊_𝑖}, 1≤𝑖≤𝑛; the set of receiver's decoding rules 𝐸_𝑅={𝑒_𝑅∣𝑒_𝑅 is a subspace of type (2𝑛,2𝑛,𝑛,0) and𝑈⊂𝑒_𝑅}; the set of 𝑖th sender's tags 𝑇_𝑖={𝑡_𝑖∣𝑡_𝑖 is a subspace of type (2𝑟−𝑛+2,2(𝑟−𝑛+1),𝑟−𝑛+1,1) and 𝑈⊂𝑡_𝑖⊂𝑊_𝑖^⟂,𝑡_𝑖⊄𝑈^⟂}; the set of receiver's tags 𝑇={𝑡∣𝑡 is a subspace of type (2𝑟+1,2𝑟,𝑟,1) and 𝑈⊂𝑡}.

Define the encoding map 𝑓_𝑖∶𝑆×𝐸_𝑃𝑖→𝑇_𝑖,𝑓_𝑖(𝑠,𝑒_𝑃𝑖)=𝑠+𝑒_𝑃𝑖, 1≤𝑖≤𝑛.

The decoding map 𝑓∶𝑆×𝐸_𝑅→𝑇,𝑓(𝑠,𝑒_𝑅)=𝑠+𝑒_𝑅.

The synthesizing map ℎ∶𝑇₁×𝑇₂×⋯×𝑇_𝑛→𝑇,ℎ(𝑡₁,𝑡₂,…,𝑡_𝑛)=𝐴(𝑡₁+𝑡₂+⋯+𝑡_𝑛), where 𝐴 is a nonsingular matrix and 𝐴(𝑡₁+𝑡₂+⋯+𝑡_𝑛) is a subspace of type (2𝑟+1,2𝑟,𝑟,1).

The code works as follows.

(1) Key Distribution. The key distribution center randomly chooses an 𝑒_𝑅∈𝐸_𝑅 and selects a (2𝑛,𝑛) subspace 𝑒 such that 𝑈⊂𝑒, and it selects 𝑒_𝑃𝑖∈𝐸_𝑃𝑖 so that 𝑒_𝑃1+𝑒_𝑃2+⋯+𝑒_𝑃𝑛=𝑒, and 𝐴 is a nonsingular matrix satisfying 𝑒_𝑅=⟨𝑒,𝐴⟩. The key distribution center randomly secretly sends 𝑒_𝑅,𝑒_𝑃𝑖 to the receiver and the senders, respectively, and sends 𝐴 to the synthesizer.

(2) Broadcast. If the senders want to send a source state 𝑠∈𝑆 to the receiver 𝑅, the sender 𝑃_𝑖 calculates 𝑡_𝑖=𝑓_𝑖(𝑠,𝑒_𝑃𝑖)=𝑠+𝑒_𝑃𝑖 then sends 𝑡_𝑖(1≤𝑖≤𝑛) to the synthesizer.

(3) Synthesis. After the synthesizer receives 𝑡₁,𝑡₂,…,𝑡_𝑛, he calculates ℎ=(𝑡₁,𝑡₂,…,𝑡_𝑛)=𝐴(𝑡₁+𝑡₂+⋯+𝑡_𝑛) and then sends 𝑚=(𝑠,𝑡) to the receiver 𝑅.

(4) Verification. When the receiver 𝑅 receives 𝑚=(𝑠,𝑡), he calculates 𝑡^′=𝑔(𝑠,𝑒_𝑅)=𝑠+𝑒_𝑅. If 𝑡=𝑡^′, he accepts 𝑡; otherwise, he rejects it.

Let𝐼𝑈=0^(𝑙)0𝐼^{(𝑛−𝑙)}0000000000000000𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11; (7)then,𝑈^⟂=𝐼^(𝑙)000000𝐼^{(𝑛−𝑙)}000000𝐼^{(𝜈−𝑛)}000000000000000000000000000000𝐼^{(𝜈−𝑛)}00000010000001,𝑊𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11_𝑖⟂=𝐼^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝐼^{(𝜈−𝑛)}000000000000000000000100000000000000𝐼^{(𝜈−𝑛)}0000000100000001.𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11 (8)

Lemma 1. Let 𝐶_𝑖=(𝑆,𝐸_𝑃𝑖,𝑇_𝑖;𝑓_𝑖); the code is a cartesian authentication code, 1≤𝑖≤𝑛.

Proof. For any 𝑒_𝑝𝑖∈𝐸_𝑝𝑖,𝑠∈𝑆. Because 𝑒_𝑝𝑖 is a subspace of type (𝑛+1,0,0,0) and 𝑈⊂𝑒_𝑝𝑖⊂𝑈^⟂, we can assume that𝑒_𝑝𝑖=𝐼^(𝑙)000𝐼^{(𝑛−𝑙)}000000000000100000𝑅₈00𝑅₉000𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11. (9)Obviously, 𝑒_𝑝𝑖∩𝑈^⟂=𝑈. Let 𝑠∈𝑆; since 𝑈⊂𝑠⊂𝑈^⟂, 𝑠 has the form as follows: 𝐼𝑠=^(𝑛)000000𝐵₂0𝐵₄00000010, (10) where 𝐵₂,𝐵₄ is a subspace of type (2(𝑟−𝑛),2(𝑟−𝑛),𝑟−𝑛,0) in the pseudosymplectic space 𝐹_𝑞^(2𝜈+2). Let 𝑡_𝑖=𝑠+𝑒_𝑝𝑖; then,𝑡_𝑖=𝐼^(𝑙)00000𝐼^{(𝑛−𝑙)}00000𝐵₂000000000000000100000000𝐵₄𝑅₈00000100000,𝑡𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11_𝑖𝑆₂^𝑡𝑡_𝑖∼𝐼^{(𝑟−𝑛)}0000𝐼^{(𝑟−𝑛)}.0000100001 (11)Obviously, 𝑡_𝑖⊄𝑈^⟂. So, 𝑡_𝑖 is a subspace of type (2𝑟−𝑛+2,2(𝑟−𝑛+1),𝑟−𝑛+1,1) satisfying 𝑈⊂𝑡_𝑖⊂𝑊_𝑖^⟂; that is, 𝑡_𝑖∈𝑇_𝑖. Furthermore, we know that 𝑡_𝑖∩𝑈^⟂=(𝑠+𝑒_𝑝𝑖)∩𝑈^⟂=𝑠+(𝑒_𝑝𝑖∩𝑈^⟂)=𝑠+𝑈=𝑠.
Conversely, for any 𝑡_𝑖∈𝑇_𝑖, let 𝑠=𝑡_𝑖∩𝑈^⟂,𝐿⊂𝑡_𝑖, satisfying 𝑡_𝑖=𝑠⊕𝐿. Obviously, 𝑈⊂𝑠⊂𝑈^⟂. For 𝑈⊂𝑡_𝑖⊂𝑊_𝑖^⟂, let𝑡_𝑖=𝐼^(𝑙)00000𝐼^{(𝑛−𝑙)}00000𝐵₂000000000000000100000000𝐵₄𝑅₈00000100000𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11. (12)Obviously,𝑡_𝑖∩𝑈^⟂=𝐼^(𝑙)0000𝐼^{(𝑛−𝑙)}0000𝐶₂0000000000000000000𝐶₄000010000𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11. (13)For 𝑡_𝑖 being a subspace of type (2𝑟−𝑛+2,2(𝑟−𝑛+1),𝑟−𝑛+1,1), then 𝑡_𝑖∩𝑈^⟂ is a subspace of type (2𝑟−𝑛+1,2(𝑟−𝑛),𝑟−𝑛,1); that is, 𝑠∈𝑆. Choose 𝐿=00𝐵₂0010𝐵₄00. (14) Let 𝑒_𝑃𝑖=𝑈+𝐿; then, 𝑒_𝑃𝑖∈𝐸_𝑃𝑖, and 𝑠⊕𝐿=𝑠⊕𝑒_𝑃𝑖. Therefore, 𝑓_𝑖 is a surjection. For any 𝑡_𝑖∈𝑇_𝑖,𝑒_𝑃𝑖∈𝐸_𝑃𝑖, if there exist 𝑠∈𝑆 so that 𝑡_𝑖=𝑠+𝑒_𝑃𝑖; then, 𝑠∈𝑡_𝑖∩𝑈^⟂. However, dim𝑠=2𝑟−𝑛+1=dim(𝑡_𝑖∩𝑈^⟂), and so 𝑠=𝑡_𝑖∩𝑈^⟂; that is, 𝑠 is determined by 𝑡_𝑖 and 𝑒_𝑃𝑖.

Lemma 2. Let 𝐶=(𝑆,𝐸_𝑅,𝑇;𝑔); the code is a cartesian authentication code.

Proof. (1) For any 𝑠∈𝑆, 𝑒_𝑅∈𝐸_𝑅. From the definition of 𝑠 and 𝑒_𝑅, we assume that 𝑈𝑄𝑒𝑠=_2𝜈+1𝑛2()1,𝑈𝑄𝑒𝑟−𝑛_2𝜈+1𝑆₂^𝑡𝑈𝑄𝑒_2𝜈+1=0^(𝑛)00000𝐼^{(𝑟−𝑛)}00𝐼^{(𝑟−𝑛)},𝑒000000_𝑅=𝑈𝑉𝑛𝑛,𝑈𝑉𝑆₂^𝑡𝑈𝑉𝑆₂^𝑡𝑈𝑉=0𝐼^(𝑛)𝐼^(𝑛)0. (15) Obviously, for any 𝑣∈𝑉 and 𝑣≠0, 𝑣∉𝑠; therefore, 𝑡=𝑠+𝑒_𝑅=𝑈𝑉𝑄𝑒_2𝜈+1𝑈𝑉𝑄𝑒_2𝜈+1,𝑆₂^𝑡𝑈𝑉𝑄𝑒_2𝜈+1=0𝐼^(𝑛)𝐼000_(𝑛)0000000𝐼^{(𝑟−𝑛)}000𝐼^{(𝑟−𝑛)}.0000000 (16)(17) From the above mentioned, 𝑡 is a subspace of type (2𝑟+1,2𝑟,𝑟,1) and 𝑈⊂𝑡; that is, 𝑡∈𝑇.
(2) For 𝑡∈𝑇, 𝑡 is a subspace of type (2𝑟+1,2𝑟,𝑟,1) and 𝑈⊂𝑡; so, there is a subspace 𝑉⊂𝑡, satisfying 𝑈𝑉𝑆₂^𝑡𝑈𝑉=0𝐼^(𝑛)𝐼^(𝑛)0. (18) Then, we can assume that 𝑈𝑉𝑄𝑒𝑡=_2𝜈+1 (19) satisfying 𝑈𝑉𝑄𝑒_2𝜈+1𝑆₂^𝑡𝑈𝑉𝑄𝑒_2𝜈+1=0𝐼^(𝑛)𝐼000_(𝑛)0000000𝐼^{(𝑟−𝑛)}000𝐼^{(𝑟−𝑛)}.0000000 (20) Let 𝑈𝑄𝑒𝑠=_2𝜈+1, (21) for 𝑠 is a subspace of type (2𝑟−𝑛+1,2(𝑟−𝑛),𝑟−𝑛,1) and 𝑈⊂𝑠⊂𝑈^⟂; that is, 𝑠∈𝑆 is a source state. For any 𝑣∈𝑉 and 𝑣≠0, 𝑣∉𝑠 is obvious; that is, 𝑉∩𝑈^⟂={0}. Therefore, 𝑡∩𝑈^⟂=^𝑈𝑄_𝑒2𝜈+1=𝑠. Let 𝑒_𝑅=^𝑈_𝑉; then, 𝑒_𝑅 is receiver's decoding rule satisfying 𝑡=𝑠+𝑒_𝑅.
If 𝑠^′ is another source state contained in 𝑡, then 𝑈⊂𝑠^′⊂𝑈^⟂. Therefore, 𝑠^′⊂𝑡∩𝑈^⟂=𝑠, while dim 𝑠^′=dim𝑠, and so 𝑠^′=𝑠; that is, 𝑠 is the uniquely source state contained in 𝑡.
From Lemmas 1 and 2, we know that such construction of multisender authentication codes is reasonable, and there are 𝑛 senders in this system. Next, we compute the parameters of this code and the maximum probability of success in impersonation attack and substitution attack by group of senders.

Lemma 3. Some parameters of this code are |𝑆|(2()());𝐸=𝑁𝑟−𝑛,2𝑟−𝑛,𝑟−𝑛,0;2𝜈+2_𝑃𝑖=𝑞^{𝜈−𝑛+1}(1≤𝑖≤𝑛). (22)

Proof. Since 𝑈⊂𝑠⊂𝑈^⟂, 𝑠 has the following form: 𝐼𝑠=^(𝑛)000000𝐵₂0𝐵₄00000010, (23) where 𝐵₂,𝐵₄ is a subspace of type (2(𝑟−𝑛),2(𝑟−𝑛),𝑟−𝑛,0) in the pseudosymplectic space 𝐹_𝑞^(2𝜈+2). So, |𝑆|=𝑁(2(𝑟−𝑛),2(𝑟−𝑛),𝑟−𝑛,0;2𝜈+2).
For any 𝑒_𝑝𝑖∈𝐸_𝑝𝑖, we can assume that 𝑒_𝑃𝑖 has the following form:𝑒_𝑃𝑖=𝐼^(𝑙)000𝐼^{(𝑛−𝑙)}000𝑅₃00000000100000𝑅₈00𝑅₉00𝑅₁₀𝑙𝑛−𝑙𝜈−𝑛𝑙𝑖−𝑙−11𝑛−𝑖𝜈−𝑛11. (24)Since 𝑒_𝑝𝑖 is a subspace of type (𝑛+1,0,0,0), so 𝑅₃=0 and 𝑅₁₀=0, 𝑅₈,𝑅₉ arbitrarily. Therefore, |𝐸_𝑃𝑖|=𝑞^{𝜈−𝑛+1}.

Lemma 4. (1) For any 𝑡_𝑖∈𝑇_𝑖, the number of 𝑡_𝑖 containing 𝑒_𝑃𝑖 is 𝑞^{𝑟−𝑛+1}(1≤𝑖≤𝑛);
(2) The number of the 𝑖th sender's tag is |𝑇_𝑖|=𝑞^𝜈−𝑟𝑁(2(𝑟−𝑛),2(𝑟−𝑛),𝑟−𝑛,0;2𝜈+2)(1≤𝑖≤𝑛).

Proof. (1) Considering the transitivity properties of the same subspaces under the pseudosymplectic groups, we may take 𝑡_𝑖 as follows:𝑡_𝑖=𝐼^(𝑙)000000𝐼^{(𝑛−𝑙)}000000𝐼^{(𝑟−𝑛)}0000000000000000000000001000000000000𝐼^{(𝑟−𝑛)}0000000000001000000𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑖−𝑙−11𝑛−𝑖𝑟−𝑛𝜈−𝑟11. (25)If 𝑒_𝑃𝑖⊂𝑡_𝑖, then we assume that𝑒_𝑃𝑖=𝐼^(𝑙)000𝐼^{(𝑛−𝑙)}000000000000000𝑅₇00000𝑅₉00000𝑅₁₁000𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑖−𝑙−11𝑛−𝑖𝑟−𝑛𝜈−𝑟11; (26)from 𝑒_𝑃𝑖⟂𝑊_𝑖, we know that 𝑅₇=1, where 𝑅₉,𝑅₁₁ arbitrarily, and therefore the number of 𝑡_𝑖 containing 𝑒_𝑃𝑖 is 𝑞^{𝑟−𝑛+1} (1≤𝑖≤𝑛).
(2) We know that every 𝑡_𝑖 contains only one source state 𝑡_𝑖∩𝑈^⟂and the number of 𝑡_𝑖 containing 𝑒_𝑃𝑖. Therefore, we have |𝑡_𝑖|=|𝑆||𝐸_𝑃𝑖|/𝑞^{𝑟−𝑛+1}=|𝑆|𝑞^{𝜈−𝑛+1}/𝑞^{𝑟−𝑛+1}=𝑞^𝜈−𝑟𝑁(2(𝑟−𝑛),2(𝑟−𝑛),𝑟−𝑛,0;2𝜈+2).

Lemma 5. (1) The number of the receiver's decoding rules is |𝐸_𝑅|=𝑞^{𝑛(𝜈−𝑛+1)}.
(2) For any 𝑡∈𝑇, the number of 𝑒_𝑅 which contained 𝑡 is 𝑞^{𝑛(𝑟−𝑛+1)}(1≤𝑖≤𝑛).
(3) The number of the receiver's tag is |𝑇|=𝑞^{𝑛(𝜈−𝑟)}𝑁(2(𝑟−𝑛),2(𝑟−𝑛),𝑟−𝑛,0;2𝜈+2).

Proof. (1) Let 𝑒_𝑅∈𝐸_𝑅; 𝑒_𝑅 has the following form:𝑒_𝑅=𝐼^(𝑛)00𝑅₂0𝐼^(𝑛)0𝑅₄0𝑅₅0𝑅₆𝑛𝜈−𝑛𝑛𝜈−𝑛11. (27)For 𝑒_𝑅 being a subspace of type (2𝑛,2𝑛,𝑛,0), so 𝑅₂ and 𝑅₆=0;𝑅₄,𝑅₅ arbitrarily. Therefore,|𝐸_𝑅|=𝑞^{𝑛(𝜈−𝑛+1)}.
(2) Considering the transitivity properties of the same subspaces under the pseudosymplectic groups, we may choose 𝑡 as follows:𝐼𝑡=^(𝑛)00000𝐼^{(𝑟−𝑛)}0000000000𝐼^(𝑛)00000𝐼^{(𝑟−𝑛)}0000000000100000𝑛𝑟−𝑛𝜈−𝑟𝑛𝑟−𝑛𝜈−𝑟11. (28)If 𝑒_𝑅⊂𝑡, then𝑒_𝑅=𝐼^(𝑛)000000𝐼^(𝑛)0𝑅₅000𝑅₇00𝑛𝑟−𝑛𝜈−𝑟𝑛𝑟−𝑛𝜈−𝑟11, (29)where 𝑅₅ and 𝑅₇ arbitrarily. Therefore, the number of 𝑒_𝑅 which contained 𝑡 is 𝑞^{𝑛(𝑟−𝑛+1)}.
(3) Similar to Lemma 4(2), |𝑇|=|𝑆||𝐸_𝑅|/𝑞^{𝑟−𝑛+1}=|𝑆|𝑞^{𝑛(𝜈−𝑛+1)}/𝑞^{𝑟−𝑛+1}=𝑞^{𝑛(𝜈−𝑟)}𝑁(2(𝑟−𝑛), 2(𝑟−𝑛), 𝑟−𝑛,0; 2𝜈+2).
Without loss of generality, we assume that 𝐿={𝑖₁,𝑖₂,…,𝑖_𝑙}⊂{1,2,…,𝑛},𝑙<𝑛, 𝑃_𝐿={𝑝₁,𝑝₂,…,𝑝_𝑙}, and 𝐸_𝐿={𝐸_𝑝1,𝐸_𝑝2,…,𝐸_𝑝𝑙}. Now, let us consider the attacks on 𝑅 from malicious groups of senders.

Lemma 6. For any 𝑒_𝐿={𝐸_𝑝1,𝐸_𝑝2,…,𝐸_𝑝𝑙}∈𝐸_𝐿, the number of 𝑒_𝑅 containing 𝑒_𝐿 is 𝑞^{(𝜈−𝑛+1)(𝑛−𝑙)}.

Proof. For any 𝑒_𝐿={𝐸_𝑝1,𝐸_𝑝2,…,𝐸_𝑝𝑙}∈𝐸_𝐿, we assume 𝑒_𝐿 to be as follows:𝑒_𝐿=𝐼^(𝑙)000𝐼^{(𝑛−𝑙)}000000𝐼^(𝑙)00000𝑅₆00𝑅₇000𝑙𝑛−𝑙𝜈−𝑛𝑙𝑛−𝑙𝜈−𝑛11. (30)If 𝑒_𝑅⊃𝑒_𝐿, then 𝑒_𝑅 has the following form:𝑒_𝑅=𝐼^(𝑙)0000𝐼^{(𝑛−𝑙)}00000000𝐼^(𝑙)0000𝐼^{(𝑛−𝑙)}00𝑅₆𝑅^′₆00𝑅₇𝑅^′₇0000𝑙𝑛−𝑙𝜈−𝑛𝑙𝑛−𝑙𝜈−𝑛11, (31)where 𝑅^′₆,𝑅^′₇ arbitrarily. Therefore, the number of 𝑒_𝑅 containing 𝑒_𝐿 is 𝑞^{(𝜈−𝑛+1)(𝑛−𝑙)}.

Lemma 7. For any 𝑡∈𝑇 and 𝑒_𝐿={𝐸_𝑝1,𝐸_𝑝2,…,𝐸_𝑝𝑙}∈𝐸_𝐿, the number of 𝑒_𝑅which contained in 𝑡 and containing 𝑒_𝐿 is 𝑞^{(𝑟−𝑛+1)(𝑛−𝑙)}.

Proof. For any 𝑡∈𝑇, we assume 𝑡 to be as follows:𝐼𝑡=^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝐼^{(𝑟−𝑛)}00000000000000𝐼^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝐼^{(𝑟−𝑛)}0000000000000010000000𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11. (32)If 𝑒_𝐿⊂𝑡, then 𝑒_𝐿 has the following form:𝑒_𝐿=𝐼^(𝑙)000𝐼^{(𝑛−𝑙)}000000000𝐼^(𝑙)00000𝑅₇00000𝑅₉000𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11. (33)Since 𝑒_𝐿⊂𝑒_𝑅⊂𝑡, then we assume 𝑒_𝑅 to be as follows:𝑒_𝑅=𝐼^(𝑙)00000𝐼^{(𝑛−𝑙)}0000000000000000𝐼^(𝑙)00000𝐼^{(𝑛−𝑙)}000𝑅₇𝐻₇00000000𝑅₉𝐻₉00000𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11, (34)where 𝐻₇ and 𝐻₉ arbitrarily. Therefore, the number of 𝑒_𝑅which contained in 𝑡 and containing 𝑒_𝐿 is 𝑞^{(𝑟−𝑛+1)(𝑛−𝑙)}.

Lemma 8. Assume that 𝑡₁ and 𝑡₂ are two distinct tags (𝑡₁,𝑡₂∈𝑇) decoded by receiver's key 𝑒_𝑅, and 𝑠₁ and 𝑠₂ contained in 𝑡₁ and 𝑡₂ are two source states, respectively. Let 𝑠₀=𝑠₁∩𝑠₂, dim𝑠₀=𝑘; then, 𝑛≤𝑘≤2𝑟−𝑛, and the number of 𝑒_𝑅 which contained in 𝑡₁∩𝑡₂ and containing 𝑒_𝐿 is 𝑞^{(𝑘−𝑟)(𝑛−1)}.

Proof. Since 𝑡₁=𝑠₁+𝑒_𝑅,𝑡₂=𝑠₂+𝑒_𝑅, and 𝑡₁≠𝑡₂, then 𝑠₁≠𝑠₂. For any 𝑠∈𝑆, 𝑈∈𝑠, obviously 𝑛≤𝑘≤2𝑟−𝑛. Assume that 𝑠^′_𝑖 is the complementary subspace of 𝑠₀ in the 𝑠_𝑖; then, 𝑠_𝑖=𝑠₀+𝑠^′_𝑖(𝑖=1,2). From 𝑡_𝑖=𝑠_𝑖+𝑒_𝑅=𝑠₀+𝑠^′_𝑖+𝑒_𝑅 and 𝑠_𝑖=𝑡_𝑖∩𝑈^⟂, we know that 𝑠₀=(𝑡₁∩𝑈^⟂)∩(𝑡₂∩𝑈^⟂)=𝑡₁∩𝑡₂∩𝑈^⟂=𝑠₁∩𝑡₂=𝑠₂∩𝑡₁, and 𝑡₁∩𝑡₂=(𝑠₁+𝑒_𝑅)∩𝑡₂=(𝑠₀+𝑠^′₁+𝑒_𝑅)∩𝑡₂=((𝑠₀+𝑒_𝑅)+𝑠^′₁)∩𝑡₂, since 𝑠₀+𝑒_𝑅⊆𝑡₂; then, 𝑡₁∩𝑡₂=(𝑠₀+𝑒_𝑅)+(𝑠^′₁∩𝑡₂), while 𝑠^′₁∩𝑡₂⊆𝑠₁∩𝑡₂=𝑠₀, and so we have 𝑡₁∩𝑡₂=𝑠₀+𝑒_𝑅.
From the definition of 𝑡, we may take 𝑡_𝑖,𝑖=1,2, as follows:𝑡_𝑖=𝐼^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝐼^{(𝑟−𝑛)}00000000000000𝐼^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝑃_𝑖70000000000000010000000𝑙𝑙1𝑛−𝑙𝑟−𝑛𝑛−𝑙𝑟−𝑛𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11. (35)Let𝑡₁∩𝑡₂=𝐼^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝐼^{(𝑟−𝑛)}00000000000000𝐼^(𝑙)0000000𝐼^{(𝑛−𝑙)}0000000𝑃₇0000000000000010000000𝑙𝑙1𝑛−𝑙𝑟−𝑛𝑛−𝑙𝑟−𝑛𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11. (36)From the above mentioned, we know that 𝑡₁∩𝑡₂=𝑠₀+𝑒_𝑅, and then dim(𝑡₁∩𝑡₂)=𝑘+2𝑛−𝑛=𝑘+𝑛; therefore,dim0𝑃₇()00000010=𝑘+𝑛−2𝑛+𝑟−𝑛=𝑘−𝑟. (37)For any 𝑒_𝐿,𝑒_𝑅⊂𝑡₁∩𝑡₂, we can assume that𝑒_𝐿=𝐼^(𝑙)000𝐼^{(𝑛−𝑙)}000000000𝐼^(𝑙)00000𝑅₇00000𝑅₉000𝑙𝑙,𝑒𝑛−𝑙𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11_𝑅=𝐼^(𝑙)0000𝐼^{(𝑛−𝑙)}000000000000𝐼^(𝑙)0000𝐼^{(𝑛−𝑙)}00𝑅₇𝐻₇000000𝑅₉𝐻₉0000𝑙𝑙,𝑛−𝑙𝑛−𝑙𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟𝑙𝑛−𝑙𝑟−𝑛𝜈−𝑟11 (38)where every row of 0𝐻₇0𝐻₉0 (39) is the linear combination of the base of 0𝑃₇00000010. (40) Therefore, the number of 𝑒_𝑅⊂𝑡₁∩𝑡₂and containing 𝑒_𝐿 is 𝑞^{(𝑘−𝑟)(𝑛−𝑙)}.

Theorem 9. In the constructed multisender authentication codes, the largest probabilities of success for impersonation attack and substitution attack from 𝑃_𝐿 on a receiver 𝑅 are 𝑃_𝐼(𝐿)=1𝑞^{(𝜈−𝑟)(𝑛−𝑙)},𝑃_𝑆(𝐿)=1𝑞^{2(𝑛−𝑙)}, (41) respectively.

Proof. Impersonation Attack. 𝑃_𝐿, after receiving his secret keys, encodes a message and sends it to receiver. 𝑃_𝐿 is successful if the receiver accepts it as legitimate message. So, 𝑃_𝐼(𝐿)=max_{𝑒𝐿∈𝐸𝐿}max_𝑚∈𝑀𝑒_𝑅∈𝐸_𝑅∣𝑒_𝐿⊂𝑒_𝑅and𝑒_𝑅⊂𝑡𝑒_𝑅∈𝐸_𝑅∣𝑒_𝐿⊂𝑒_𝑅=𝑞^{(𝑛−𝑙)(𝑟−𝑛+1)}𝑞^{(𝑛−𝑙)(𝜈−𝑛+1)}=1𝑞^{(𝜈−𝑟)(𝑛−𝑙)}. (42)Substitution Attack. 𝑃_𝐿 replaces 𝑡 with another message 𝑡^′, after it observes a legitimate message 𝑡. 𝑃_𝐿 is successful if the receiver accepts it as legitimate message. So, 𝑃_𝑆(𝐿)=max_{𝑒𝐿∈𝐸𝐿}max_𝑚∈𝑀max_{𝑚′≠𝑚∈𝑀}𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑡,𝑡^′and𝑒_𝐿⊂𝑒_𝑅𝑒_𝑅∈𝐸_𝑅∣𝑒_𝑅⊂𝑡and𝑒_𝐿⊂𝑒_𝑅=max_{𝑛≤𝑘≤2𝑟−𝑛}𝑞^{(𝑛−𝑙)(𝑘−𝑟)}𝑞^{(𝑛−𝑙)(𝑟−𝑛+1)}=max_{𝑛≤𝑘≤2𝑟−𝑛}1𝑞^{(2𝑟−𝑛+1−𝑘)(𝑛−𝑙)}=1𝑞^{(𝑛−𝑙)}. (43)

Acknowledgments

This work is supported by the NSF of China (61179026) and Fundamental Research of the Central Universities of China Civil Aviation University of Science special (ZXH2012k003).