Efficient and Provable Secure Pairing-Free Security-Mediated Identity-Based Identification Schemes

Abstract

Security-mediated cryptography was first introduced by Boneh et al. in 2001. The main motivation behind security-mediated cryptography was the capability to allow instant revocation of a user’s secret key by necessitating the cooperation of a security mediator in any given transaction. Subsequently in 2003, Boneh et al. showed how to convert a RSA-based security-mediated encryption scheme from a traditional public key setting to an identity-based one, where certificates would no longer be required. Following these two pioneering papers, other cryptographic primitives that utilize a security-mediated approach began to surface. However, the security-mediated identity-based identification scheme (SM-IBI) was not introduced until Chin et al. in 2013 with a scheme built on bilinear pairings. In this paper, we improve on the efficiency results for SM-IBI schemes by proposing two schemes that are pairing-free and are based on well-studied complexity assumptions: the RSA and discrete logarithm assumptions.

1. Introduction

1.1. Background

Identification schemes allow one party, the prover, to prove itself to another party, the verifier, that it knows its secret key without revealing anything else about itself in the process. The main utilization of the identification primitive is to facilitate one-sided entity authentication and is conventionally deployed in access control mechanisms to facilitate resource control and distribution.

In traditional public key cryptography, certificates are used to ensure that a user’s public key is legitimately bound to a particular user and cannot be replaced. This certificate is usually issued by a certificate authority. However, certificate management can become an issue when the number of users in a cryptosystem grows larger. One of the methods of mitigating this potentially costly problem is through the deployment of the cryptographic primitive in an identity-based setting introduced by Shamir [1].

Another issue that traditional public key cryptography faces is the revocation of user secret keys. This would necessarily involve the revocation of a user’s certificate along with his public/secret key pair and is a costly operation. Timeliness is also a factor, as the procedure to revoke a user’s keys may be a (relatively) long one and creates additional load on the certificate authority, turning the revocation procedure into a potentially costly process exercise. All these compound the certificate management issue mentioned earlier.

In the identity-based setting, where certificates are not used, key revocation is conventionally done by tagging validity periods onto the user’s identity-string as an extension. This also creates an issue of timeliness since revocation is only possible at the end of those validity dates. Without checking certificates, it is also difficult to check if a user is still valid or if his user secret key has been revoked already.

In [2], Boneh et al. proposed the initial groundwork for instant revocation of user keys and privileges, including the public key and certificates by introducing the concept of security-mediated cryptography. The idea of security-mediated cryptography is to necessitate the cooperation of a security mediator, a trusted third party, in any form of transaction that a user needs to use. For example, in an encryption scheme, a security mediator needs to lend his cooperation to the user in order for the user to decrypt a particular ciphertext. And for signatures, a security mediator has to agree to cooperate with a signer in order to produce a valid signature.

Specifically, this is done by separating the user’s secret key into two portions during the key generation. One portion of the key is given to the mediator while the other is given to the user. Therefore, the security mediator cooperates in the form of providing his portion of the secret key to be combined with the user’s portion to create the full secret key for the transaction.

1.2. Related Work

Identification schemes were first introduced by Fiat and Shamir [3], while their identity-based counterparts, namely, identity-based identification schemes, were first formalized by Bellare et al. [4] and Kurosawa and Heng [5] independently. In recent years, there have been various advances in the area of identity-based identification, such as the introduction of identity-based identification schemes in the standard model [6, 7], hierarchical model [8–10], and certificateless model [11].

Following Boneh et al.’s initial work, Ding and Tsudik expanded on security-mediated cryptography to cover identity-based encryption using the RSA assumption [12]. Shortly thereafter, Libert and Quisquater proposed the first pairing-based security-mediated identity-based encryption schemes [13]. On the signature front, Cheng et al. proposed the first security-mediated identity-based signature [14].

Chow et al. [15] and Yap et al. [16] both extended security-mediated cryptography into the certificateless setting, where the issue of key escrow was addressed. In certificateless cryptography, first proposed by Al-Riyami and Paterson [17], the key generation center only produces half of the user secret key. The user then produces the other half of the user secret key to be combined into the full user secret key, thus securing their key from even the key generation center. However, the cryptographic primitives in the certificateless setting introduce more operational cost to the scheme and are known to be difficult to be proven secure [18].

1.3. Motivations and Contribution

In 2013, Chin et al. first combined the notion of security-mediated cryptography with identifications in the identity-based setting to propose the first security-mediated identity-based identification (SM-IBI) scheme [19]. In the paper, the authors provided the first formal definitions for SM-IBIs and also proposed a concrete construction. The motivation of the authors was to allow fast revocation of keys for identification schemes in the identity-based setting.

For SM-IBI schemes, a security mediator is required to participate in the identification protocol in order for a user to authenticate himself to a verifier. The security mediator can then hold a revocation list to identify which users’ secret keys have been revoked and refuse participation for those users.

However the first concrete scheme that was proposed by the authors was built based on bilinear pairings. The pairing operation is widely known by cryptographers to be a costly operation; thus, it would be beneficial to construct pairing-free alternatives to facilitate more efficient running of the cryptographic primitive.

In this paper, we propose two pairing-free SM-IBI constructs as faster alternatives to the pairing-based scheme proposed by Chin et al. Our two schemes are constructed based on the RSA assumption and the discrete logarithm assumption, respectively. The RSA-based scheme, which we name as the GQ-SM-IBI, is constructed based on the Guillou Quisquater identification scheme constructed by Bellare and Palacio [20]. On the other hand, the discrete logarithm-based scheme, which we name as the BNN-SM-IBI, is constructed based on the BNN identity-based identification scheme proposed by Bellare et al. [4]. We provide security analysis for both schemes, proving them secure against impersonation under passive attacks if the RSA assumption and the discrete logarithm assumption hold and secure against impersonation under active and concurrent attacks if the one-more RSA inversion assumption and the one-more discrete logarithm assumption hold. Lastly, we provide an efficiency analysis, both theoretically and practically, and show that both schemes are significantly faster than Chin et al.’s pairing-based SM-IBI scheme.

The rest of the paper is organized as follows. We begin with some preliminaries and review the formal definitions and security model of SM-IBI schemes in Section 2. Then we show the construction and security analysis for the GQ-SM-IBI scheme in Section 3. This is followed by the construction and security analysis for the BNN-SM-IBI scheme in Section 4. In Section 5 we show the operational costs of both schemes as well as presenting our implementation results. Finally we conclude in Section 6.

2. Preliminaries

2.1. Discrete Logarithm Assumption

Let 𝐺 be a cyclic group with prime order 𝑞 and let 𝑔 be a generator of 𝐺. The DL problem (DL) is defined as given a number 𝐴=𝑔^𝑎 in group 𝐺, output 𝑎.

Definition 1. The discrete logarithm assumption states that there exists no polynomial-time algorithm 𝑀 that is able to (𝑡_DL,𝜀_DL)-solve the discrete logarithm problem with nonnegligible probability such that Pr𝑀𝐺,𝑞,𝑔,𝐴=𝑎≥𝜀_DL. (1)

2.2. The One-More Discrete Logarithm Assumption

The one-more discrete logarithm (𝑂𝑀𝐷𝐿) problem was first introduced by Bellare and Palacio [20] in their proof against impersonation under active and concurrent attacks for the standard Schnorr identification scheme. Later work that involves proving security of identification schemes based on discrete logarithms to be secure against active and concurrent attacks for discrete logarithm also makes use of this assumption such as [4, 21].

Let 𝐺 be a finite cyclic group of order 𝑞 and let 𝑔 be a generator of 𝐺. Define an experiment 𝐸_DL where an adversary 𝑀 is given a challenge oracle 𝐶𝐻𝐴𝐿𝐿 that produces a random group element 𝑊_𝑖∈𝐺 when queried and a discrete log oracle 𝐷𝐿𝑂𝐺, which provides the discrete log 𝑤_𝑖∈𝑍_𝑞 corresponding to the query 𝑊_𝑖 where 𝑔^𝑤𝑖=𝑊_𝑖. 𝑀 wins if after making 𝑖 queries to 𝐶𝐻𝐴𝐿𝐿_DL, 𝑀 is able to output solutions to all 𝑖 challenges with only 𝑖−1 queries to 𝐷𝐿𝑂𝐺, meaning 𝑀 has to solve at least one instance of the discrete logarithm problem without relying on the discrete log oracle. 𝐸_DL returns 1 if 𝑀 is successful and 0 otherwise.

Definition 2. The 𝑂𝑀𝐷𝐿 assumption states that there exists no polynomial-time algorithm 𝑀 that is able to (𝑡_{𝑂𝑀𝐷𝐿},𝑞_{𝑂𝑀𝐷𝐿},𝜀_{𝑂𝑀𝐷𝐿})-solve the 𝑂𝑀𝐷𝐿 problem with nonnegligible probability where Pr𝐸_DL𝑀1^𝑘,𝐺,𝑔,𝐶𝐻𝐴𝐿𝐿_DL,𝐷𝐿𝑂𝐺=1≥𝜀_{𝑂𝑀𝐷𝐿}. (2)

2.3. RSA Inversion (RSAI) Assumption

Given (𝑁,𝑒,𝑋)←^$𝑘_𝑅𝑆𝐴(1^𝑘) compute 𝑌 such that 𝑌=𝑋^𝑑mod𝑁 where 𝑒𝑑=1mod𝜙(𝑁).

Definition 3. The 𝑅𝑆𝐴𝐼 assumption states that there exists no polynomial-time algorithm 𝑀 that is able to (𝑡_{𝑅𝑆𝐴𝐼},𝜀_{𝑅𝑆𝐴𝐼})-solve the 𝑅𝑆𝐴𝐼 problem with nonnegligible probability such that Pr𝑀1^𝑘,𝑁,𝑒,𝑋=𝑌∶𝑌=𝑋^𝑑and𝑒𝑑=1mod𝜙(𝑁)≥𝜀_{𝑅𝑆𝐴𝐼}. (3)

2.4. One-More RSA Inversion (OMRSAI) Assumption

This is the interactive variant of the 𝑅𝑆𝐴𝐼 problem first proposed by Bellare and Palacio [20] to prove security of the GQ identification scheme and is analogous to the 𝑂𝑀𝐷𝐿 assumption. This assumption is applied in the proof of security against active and concurrent attacks for RSA-based schemes.

Define an experiment 𝐸_{𝑅𝑆𝐴𝐼} where an adversary 𝑀 is given (𝑁,𝑒)←^$𝑘_𝑅𝑆𝐴(1^𝑘) as input and access to two oracles 𝐶𝐻𝐴𝐿𝐿 and 𝑅𝑆𝐴. 𝐶𝐻𝐴𝐿𝐿 on any input returns a random point 𝑊_𝑖, while 𝑅𝑆𝐴 on any input ℎ will return ℎ^𝑑 where 𝑒𝑑=1mod𝑁. 𝑀 is required to compute the 𝑅𝑆𝐴𝐼 solutions to all the target points 𝑊₀,…,𝑊_𝑛 while using strictly less queries to the 𝑅𝑆𝐴 oracle. In other words, 𝑀 is required to find 𝑊^𝑑₀,…,𝑊^𝑑_𝑛 while using the 𝑅𝑆𝐴 oracle only 𝑖<𝑛 times. 𝐸_{𝑅𝑆𝐴𝐼} returns 1 if 𝑀 is successful and 0 otherwise.

Definition 4. The 𝑂𝑀𝑅𝑆𝐴𝐼 assumption states that there exists no polynomial-time algorithm 𝑀 that is able to (𝑡_{𝑂𝑀𝑅𝑆𝐴𝐼},𝑞_{𝑂𝑀𝑅𝑆𝐴𝐼},𝜀_{𝑂𝑀𝑅𝑆𝐴𝐼})-win the 𝑂𝑀𝑅𝑆𝐴𝐼 problem with nonnegligible probability where Pr𝐸_{𝑅𝑆𝐴𝐼}𝑀1^𝑘,𝑁,𝑒,𝐶𝐻𝐴𝐿𝐿_𝑅𝑆𝐴,𝑅𝑆𝐴=1≥𝜀_{𝑅𝑆𝐴𝐼}. (4)

2.5. Definition of Security-Mediated IBI Schemes

In this section, we review the definition of SM-IBI schemes as defined by [19]. The definition follows closely to that of conventional IBI schemes, with the difference being that the prover segment is extended to encompass obtaining tokens from the security mediator. The SM-IBI scheme is defined as five probabilistic polynomial-time algorithms.(i)Setup. It takes in the security parameter 1^𝑘 as input and outputs the system parameters params  along with the master secret key MSK.(ii)Extract. Upon receiving a user’s request for a key, it takes in params MSK and a user’s identity ID. Once the secret key is created, the PKG separates the key into two portions, one for the user, 𝖴𝖲𝖪_{𝑢𝑠𝑒𝑟}, and one for the security mediator, 𝖴𝖲𝖪_𝑠𝑒𝑚, and returns the portions to the respective parties.(iii)Identification Protocol. The identification protocol is an interactive protocol run by the 3 algorithms: User-Prover and SEM-prover on the prover side trying to authenticate himself to the Verifier. Both provers are used cooperatively in the interactive three-step canonical honest verifier zero knowledge proof of knowledge protocol with the verifier as follows.(1)User-Prover initiates by sending his identity to ID to the SEM-prover. SEM-prover checks whether ID’s keys have been revoked and stops with an error code if true. If ID is legitimate then it generates and sends SEM-COMMIT to User-Prover who then combines SEM-COMMIT with his own USER-COMMIT to form FULL-COMMIT to send to Verifier.(2)Verifier selects a random CHALLENGE and sends it to the User-Prover.(3)User-Prover relays CHALLENGE to SEM-Prover and receives SEM-RESPONSE from SEM-Prover which it then combines with his own USER-RESPONSE to form FULL-RESPONSE and sends to the Verifier. The Verifier will choose to either accept or reject it.

2.6. Security Model for Security-Mediated IBI

Adversaries of SM-IBI follow the description of standard identification schemes: passive and active/concurrent attackers. However, the adversary for SM-IBI is able to query additionally partial conversation components, specifically the user’s prover and the security mediator’s prover besides the usual full prover query.

The security of SM-IBI schemes is modelled as a game played by an adversary 𝐼 against a challenger 𝐶 as follows.(i)Setup. 𝐶 runs Setup, creates the system parameters params, and passes them to 𝐼 while keeping the master secret key MSK to itself.(ii)Phase 1. This is the training phase. 𝐼 is allowed to adaptively make the following queries to 𝐶.(a)User-Extract (ID). 𝐶 will run Extract but returns only the user’s portion of the secret key to 𝐼.(b)SEM-Extract (ID). 𝐶 will run Extract but returns only the security mediator’s portion of the secret key to 𝐼.(c)Full-Extract (ID). 𝐶 will run Extract and returns both the user’s portion of the secret key and the security mediator’s portion of the secret key to 𝐼.(d)Identification Queries (ID). For passive adversaries, 𝐶 will generate transcripts of valid conversations for 𝐼. For active/concurrent adversaries, 𝐶 will act as the cheating prover, engaging 𝐼 as the cheating verifier in conversations. 𝐼 is able to issue any one of the following identification queries.(1)SEM-Identification (ID). 𝐶 runs the security mediator’s half of the prover session.(2)User-Identification (ID). 𝐶 runs the user’s half of the prover session.(3)Full-Identification (ID). 𝐶 combines both security mediator’s and user’s session to generate a full and valid conversation.(iii)Phase 2. 𝐼 will eventually output 𝖨𝖣^∗ on which it wants to be challenged on and begins its role as the cheating prover for both security mediator and user prover sessions. 𝐶 on the other hand assumes the role of the verifier. 𝐼 wins the game if it manages to convince 𝐶 to accept with nonnegligible probability.

We say a security-mediated IBI scheme Π is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-secure under passive or active/concurrent attacks if for any passive or active/concurrent Type-1 impersonator 𝐼 who runs in time 𝑡_{𝑆𝑀𝐼𝐵𝐼}, Pr[𝐼canimpersonate]<𝜀_{𝑆𝑀𝐼𝐵𝐼}, where 𝐼 can make at most 𝑞_{𝑆𝑀𝐼𝐵𝐼} full extract queries.

It is interesting to point out that extracting the security mediator’s half of the secret key gives no information about the full user key and that neither security mediator’s prover sessions nor user’s prover sessions done alone will provide a valid conversation, but only the combined session will. This models the security requirement that any user cannot legitimately prove himself to a verifier without the security mediator’s help.

3. GQ-SMIBI: RSA-Based Security-Mediated IBI Scheme

The GQ-SM-IBI scheme is derived from the GQ identification scheme proposed in [20] and is provably secure against passive attackers assuming the 𝑅𝑆𝐴𝐼 assumption and against active/concurrent attackers assuming the 𝑂𝑀𝑅𝑆𝐴𝐼 assumption.

The GQ-SM-IBI scheme is constructed as follows.(1)Setup (1^𝑘). It takes in the security parameter 1^𝑘, runs the key generation algorithm for RSA, and obtains an RSA instance, (𝑁,𝑒,𝑑)←^$𝑘_𝑅𝑆𝐴(1^𝑘). It chooses a hash function 𝐻∶{0,1}^∗→ℤ^∗_𝑁 and publishes the system parameters 𝗆𝗉𝗄=⟨𝑁,𝑒,𝐻⟩. The master secret key 𝗆𝗌𝗄=𝑑 is kept secret.(2)Extract (𝗆𝗉𝗄,𝗆𝗌𝗄,𝖨D). It takes in 𝗆𝗉𝗄,𝗆𝗌𝗄=𝑠, and 𝖨D as input. It calculates 𝐻(𝖨D) and sets 𝑋_{𝐹𝑈𝐿𝐿}=𝐻(𝖨D)^𝑑. It further chooses 𝑑←_𝑆𝐸𝑀^$ℤ^∗_𝜙(𝑁), sets 𝑑_{𝑈𝑆𝐸𝑅}=𝑑−𝑑_𝑆𝐸𝑀, and calculates 𝑋_{𝑈𝑆𝐸𝑅}=𝐻(𝖨D)^{𝑑𝑈𝑆𝐸𝑅} and 𝑋_𝑆𝐸𝑀=𝐻(𝖨D)^{𝑑𝑆𝐸𝑀}. It gives 𝑋_{𝑈𝑆𝐸𝑅} to the user as its partial secret key and 𝑋_𝑆𝐸𝑀 to the security mediator as its partial private key and keeps 𝑋_{𝐹𝑈𝐿𝐿} secret.(3)Identification Protocol. It is run by the User-Prover and SEM-Prover with Verifier as such.(a)User-Prover sends its 𝖨D to Sem-Prover and chooses 𝑦←_{𝑈𝑆𝐸𝑅}^$ℤ^∗_𝑁 and sets 𝑌_{𝑈𝑆𝐸𝑅}=𝑦^𝑒_{𝑈𝑆𝐸𝑅}. SEM-Prover upon receiving 𝖨D checks if it is still valid and returns error if it is revoked. Otherwise, SEM-Prover chooses 𝑦←_𝑆𝐸𝑀^$ℤ^∗_𝑁 and sends 𝑌_𝑆𝐸𝑀=𝑦^𝑒_𝑆𝐸𝑀 to User-Prover. User-Prover combines 𝑌_{𝐹𝑈𝐿𝐿}=𝑌_𝑆𝐸𝑀×𝑌_{𝑈𝑆𝐸𝑅} and sends 𝑌_{𝐹𝑈𝐿𝐿} to Verifier.(b)Verifier chooses a random challenge 𝑐←^$𝑍₂^𝑙(𝑘) where 𝑙(⋅) is a super-logarithmic challenge length such that 2^𝑙(𝑘)<𝑒. Verifier then sends it to User-Prover. User-Prover relays 𝑐 to SEM-Prover.(c)SEM-Prover calculates its half of the response 𝑧_𝑆𝐸𝑀=𝑦_𝑆𝐸𝑀𝑋^𝑐_𝑆𝐸𝑀 and sends it to User-Prover. User-Prover combines it with his response 𝑧_{𝑈𝑆𝐸𝑅}=𝑦_{𝑈𝑆𝐸𝑅}𝑋^𝑐_{𝑈𝑆𝐸𝑅} to create 𝑧_{𝐹𝑈𝐿𝐿}=𝑧_𝑆𝐸𝑀×𝑧_{𝑈𝑆𝐸𝑅} and sends it as a response to Verifier.

 Verifier checks if 𝑧^𝑒_{𝐹𝑈𝐿𝐿}=𝑌_{𝐹𝑈𝐿𝐿}𝐻(𝖨𝖣)^𝑐 and accepts if yes; otherwise it outputs reject.

To check for completeness, 𝑍^𝑒_{𝐹𝑈𝐿𝐿}=𝑦_𝑆𝐸𝑀𝑋^𝑐_𝑆𝐸𝑀𝑦_{𝑈𝑆𝐸𝑅}𝑋^𝑐_{𝑈𝑆𝐸𝑅}^𝑒=𝑦_𝑆𝐸𝑀𝑦_{𝑈𝑆𝐸𝑅}𝑋_𝑆𝐸𝑀𝑋_{𝑈𝑆𝐸𝑅}^𝑐𝑒=𝑦^𝑒_𝑆𝐸𝑀𝑦^𝑒_{𝑈𝑆𝐸𝑅}𝐻(𝖨𝖣)^{(𝑑𝑆𝐸𝑀+𝑑𝑈𝑆𝐸𝑅)𝑒𝑐}=𝑌_𝑆𝐸𝑀𝑌_{𝑈𝑆𝐸𝑅}𝐻(𝖨𝖣)^𝑑𝑒𝑐=𝑌_{𝐹𝑈𝐿𝐿}𝐻(𝖨𝖣)^𝑐. (5)

3.1. Security Analysis: Impersonation under Passive Attack

Theorem 5. The GQ-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-secure against impersonation under passive attacks in the random oracle if the RSA Inversion Problem is (𝑡_{𝑅𝑆𝐴𝐼},𝜀_{𝑅𝑆𝐴𝐼})-hard where 𝜀_{𝑆𝑀𝐼𝐵𝐼}≤𝜀_{𝑅𝑆𝐴𝐼}𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}+1+12^𝑙(𝑘). (6)

Proof. Assume the GQ-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-breakable; then a simulator 𝑀 that (𝑡_{𝑅𝑆𝐴𝐼},𝜀_{𝑅𝑆𝐴𝐼})-breaks the 𝑅𝑆𝐴𝐼 problem can be shown. 𝑀 takes in input (𝑁,𝑒,𝑦) and runs the impersonator 𝐼 as a subroutine. Without loss of generality, it can be assumed that any SEM-Extract, User-Extract, SEM-Identification, User-Identification, and Full-Identification queries are preceded by a Create-User query. To avoid collision and consistently respond to these queries, 𝑀 maintains a list 𝐿_𝐻=⟨𝖨𝖣_𝑖,𝑄_𝖨𝖣𝑖,𝑓_𝖨𝖣𝑖,𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣},𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣},𝑑_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑑_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ which is initially empty. The following shows how 𝑀 simulates the environment and oracle queries for 𝐼. (1)Setup. 𝑀 selects a hash function 𝐻∶{0,1}^∗→ℤ^∗_𝑁 and sets the system parameters as 𝗆𝗉𝗄=⟨𝑁,𝑒,𝐻⟩. It sends 𝗆𝗉𝗄 to 𝐼.(2)Create-User (𝖨𝖣_𝑖). 𝑀 chooses 𝑙∈{1,…,𝑞_𝐻} randomly and lets 𝖨𝖣_𝑙=𝖨𝖣^∗ at this point. Whenever 𝐼 makes a 𝐻 query on 𝖨𝖣_𝑖, consider the following.(a)If 𝑖=𝑙, 𝑀 will choose 𝑓←_𝖨𝖣∗^$ℤ^∗_𝑁 sets 𝑄_𝖨𝖣^∗=𝑦𝑓^𝑒_𝖨𝖣∗ and will return 𝑄_𝖨𝖣^∗ to 𝐼. It adds ⟨𝖨𝖣_𝑙,𝑄_𝖨𝖣^∗,𝑓_𝖨𝖣∗,𝑋_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=⟂,𝑋_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂,𝑋_{𝑆𝐸𝑀∗𝖨𝖣}=⟂,𝑑_{𝑆𝐸𝑀∗𝖨𝖣}=⟂,𝑑_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑏𝑜𝑡⟩ to 𝐿_𝐻.(b)Otherwise, for 𝑖≠𝑙, 𝑀 chooses 𝑓←_𝖨𝖣𝑖^$ℤ^∗_𝑞, sets 𝑄_𝖨𝖣𝑖=𝑓^𝑒_𝖨𝖣𝑖, and returns 𝑄_𝖨𝖣𝑖 to 𝐼. 𝑀 also sets 𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}=𝑓_𝖨𝖣𝑖, chooses 𝑑←_{𝑈𝑆𝐸𝑅∗𝖨𝖣}^$ℤ^∗_𝜙(𝑁), and sets 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣}=𝑄^{𝑑𝑖𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣𝑖 as the SEM portion of the user private key and 𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑓_𝖨𝖣𝑖𝑄^{−𝑑𝑖𝑈𝑆𝐸𝑅𝖨𝖣}_𝖨𝖣𝑖 as the user portion of the user private key. It can be seen that 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣}×𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑄^{𝑑𝑖𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣𝑖×𝑓_𝖨𝖣𝑖𝑄^{−𝑑𝑖𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣𝑖=𝑓_𝖨𝖣𝑖=𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}. (7)𝑀 adds ⟨𝖨𝖣_𝑖, 𝑄_𝖨𝖣𝑖, 𝑓_𝖨𝖣𝑖, 𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑑_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑑_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ to 𝐿_𝐻. 𝑀 returns 𝑄_𝖨𝖣𝑖 to 𝐼.(3)SEM-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and USER-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but USER-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 chooses 𝑑←_{𝑆𝐸𝑀∗𝖨𝖣}^$ℤ^∗_𝜙(𝑁) and sets 𝑋_{𝑆𝐸𝑀∗𝖨𝖣}=𝑄^{𝑑∗𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣∗ as the SEM portion of the user private key, saves it in 𝐿_𝐻, and returns it to 𝐼. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣} in 𝐿_𝐻 and returns it to 𝐼.(4)USER-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and USER-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but SEM-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 chooses 𝑑←_{𝑈𝑆𝐸𝑅∗𝖨𝖣}^$ℤ^∗_𝜙(𝑁) and sets 𝑋_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑄^{𝑑∗𝑈𝑆𝐸𝑅𝖨𝖣}_𝖨𝖣∗ as the USER portion of the user private key, saves it in 𝐿_𝐻, and returns it to 𝐼. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves 𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣} in 𝐿_𝐻 and returns it to 𝐼.(5)Identification (𝖨𝖣_𝑗, 𝑠𝑒𝑠𝑠𝑖𝑜𝑛). 𝐼 will act as the cheating verifier to learn information from valid conversation transcripts from 𝑀. If 𝖨𝖣_𝑖≠𝖨𝖣^∗𝑀 just retrieves 𝖨𝖣_𝑖’s entry in 𝐿_𝐻 and runs the identification protocol for either the SEM’s interactions, the user’s interactions, or both combined as in the protocol. Otherwise, for 𝖨𝖣_𝑗=𝖨𝖣^∗, 𝑀 then creates a full valid transcript for each 𝑚th query by picking 𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣},𝑧←_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}^$ℤ^∗_𝑞, and 𝑐←_{𝑚,𝖨𝖣}^∗$ℤ^∗_𝑞 and sets 𝑍_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}×𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}. 𝑀 also sets 𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑧^𝑒_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑄^{−(𝑐∗𝑚,𝖨𝖣/2)}_𝖨𝖣∗, 𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}=𝑧^𝑒_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑄^{−(𝑐∗𝑚,𝖨𝖣/2)}_𝖨𝖣∗, and 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑧^𝑒_{𝑚,𝐹𝑈𝐿𝐿∗𝐼𝐷}𝑄^{−𝑐∗𝑚,𝖨𝖣}_𝖨𝖣∗. 𝑀 tags the session with 𝑠𝑒𝑠𝑠𝑖𝑜𝑛=𝑚. If 𝐼 queries(i) SEM-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will return ⟨𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣},𝑐_{𝑚,𝖨𝖣}^∗,𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}⟩;(ii) User-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will return ⟨𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣},𝑐_{𝑚,𝖨𝖣}^∗,𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}⟩;(iii) Full-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will return ⟨𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣},𝑐_{𝑚,𝖨𝖣}^∗,𝑧_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}⟩. If no session is specified for the query, 𝑀 just returns the next session in sequence. One can see that SEM-Identification (𝖨𝖣^∗, 𝑚) and User-Identification (𝖨𝖣^∗, 𝑚) can be combined to create a full and valid transcript on session 𝑚: 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}𝐻𝖨𝖣^{∗𝑐∗𝑚,𝖨𝖣}=𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑄^{𝑐∗𝑚,𝖨𝖣}_𝖨𝖣∗=𝑧^𝑒_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑄^{−(𝑐∗𝑚,𝖨𝖣/2)}_𝖨𝖣∗𝑧^𝑒_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑄^{−(𝑐∗𝑚,𝖨𝖣/2)}_𝖨𝖣∗𝑄^{𝑐∗𝑚,𝖨𝖣}_𝖨𝖣∗=𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}^𝑒𝑄^{−𝑐∗𝑚,𝖨𝖣}_𝖨𝖣∗𝑄^{𝑐∗𝑚,𝖨𝖣}_𝖨𝖣∗=𝑧^𝑒_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑧^𝑒_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑧^𝑒_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}. (8)Eventually, 𝐼 stops Phase 1 and outputs the challenge 𝖨𝖣, 𝖨𝖣^∗ on which it wishes to be challenged on. 𝑀 checks if 𝖨𝖣^∗=𝖨𝖣_𝑙 from 𝐿_𝐻 and aborts if not. Otherwise, 𝑀 runs 𝐼 now as a cheating prover on 𝖨𝖣^∗ by obtaining its commitment, 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selecting a challenge 𝑐←₁^$ℤ^∗_𝑞 and obtaining the response 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1} from 𝐼.𝑀 then resets 𝐼 to the step whereby 𝐼 just sent 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selects a second challenge 𝑐←₂^$ℤ^∗_𝑞, and receives 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2} as response. It should hold that 𝑧^𝑒_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}=𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝐻(𝖨𝖣)^𝑐1 and 𝑧^𝑒_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}=𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝐻(𝖨𝖣)^𝑐2. One can then obtain (𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}/𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2})^𝑒=𝐻(𝖨𝖣)^{𝑐1−𝑐2}. Since 𝑒 is a prime and −𝑒<𝑐₁−𝑐₂<𝑒, 𝐺𝐶𝐷(𝑒,𝑐₁−𝑐₂)=1. Use the extended Euclidean algorithm to obtain integers 𝑆 and 𝑇 such that 𝑒𝑆+(𝑐₁−𝑐₂)𝑇=1. It follows that 𝐻𝖨𝖣^∗=𝑄^{𝑒𝑆+(𝑐1−𝑐2)𝑇}_𝖨𝖣∗=mod𝑁𝑦𝑓^𝑒_𝖨𝖣∗^{𝑒𝑆+(𝑐1−𝑐2)𝑇}=mod𝑁𝑦𝑓^𝑒2𝑆_𝖨𝖣∗𝑦𝑓^{𝑒(𝑐1−𝑐2)𝑇}_𝖨𝖣∗=mod𝑁𝑦𝑓^𝑒2𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑒𝑇=mod𝑁𝑦𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}z_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑒mod𝑁. (9)𝑀 then calculates the solution to the 𝑅𝑆𝐴𝐼 problem as follows: 𝑦𝑓^𝑒_𝖨𝖣∗=𝑦𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑒𝑦mod𝑁,_𝑑𝑓_𝖨𝖣∗=𝑦𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑦mod𝑁,_𝑑=𝑦𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}/𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑓_𝖨𝖣∗𝑦mod𝑁,_𝑑=𝑦𝑓^𝑒𝑆−1_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇mod𝑁. (10)
It remains to calculate the probability of 𝑀 solving the 𝑅𝑆𝐴𝐼 problem and winning the game. The probability of 𝑀 successfully extracting two valid conversation transcripts from 𝐼 is bounded by (𝜀_𝐼𝐵𝐼−(1/2^𝑙(𝑘)))² as given by the reset lemma [20]: Pr[𝑀wins𝑅𝑆𝐴𝐼]=Pr𝑀computes𝑔^𝑎𝑏¬abort=Pr𝑀computes𝑔^𝑎𝑏[]𝜀∣¬abortPr¬abort_{𝑅𝑆𝐴𝐼}≥𝜀_{𝑆𝑀𝐼𝐵𝐼}−12^𝑙(𝑘)2Pr[¬abort]. (11) Finally calculate Pr[¬abort]. Let 𝛿 be the probability that 𝐼 issues both a SEM-Extract and a USER-Extract query on 𝖨𝖣^∗ and that 𝐼 makes a total of 𝑞_{𝑆𝑀𝐼𝐵𝐼} of such queries. The probability of 𝑀 answering all the extraction queries is 𝛿^𝑞_{𝑆𝑀𝐼𝐵𝐼}. In Phase 2, the probability of 𝑀 not aborting is if 𝐼 outputs the challenge identity 𝖨𝖣^∗ that was not queried before. This is given by the probability 1−𝛿. Compiling them, the probability of 𝑀 not aborting is 𝛿^{𝑞𝑆𝑀𝐼𝐵𝐼}(1−𝛿). This probability is maximised at 𝛿_𝑜𝑝𝑡=1−(1/(𝑞_{𝑆𝑀𝐼𝐵𝐼}+1)). Using 𝛿_𝑜𝑝𝑡, the probability that 𝑀 does not abort is at least 1/(2^𝑙(𝑘)(𝑞_{𝑆𝑀𝐼𝐵𝐼}+1)) because the value (1−(1/(𝑞_{𝑆𝑀𝐼𝐵𝐼}+1)))^{𝑞𝑆𝑀𝐼𝐵𝐼} approaches 1/𝑒 for large 𝑞_{𝑆𝑀𝐼𝐵𝐼}. Therefore, the advantage of 𝑀, 𝜀_{𝑅𝑆𝐴𝐼}, and the bound of the simulation are given as follows:𝜀_{𝑅𝑆𝐴𝐼}≥𝜀_{𝑆𝑀𝐼𝐵𝐼}−12^𝑙(𝑘)21𝑞_{𝑆𝑀𝐼𝐵𝐼}𝜀+1_{𝑅𝑆𝐴𝐼}𝑞_{𝑆𝑀𝐼𝐵𝐼}+1≥𝜀_{𝑆𝑀𝐼𝐵𝐼}−12^𝑙(𝑘)2𝜀_{𝑆𝑀𝐼𝐵𝐼}≤𝜀_{𝑅𝑆𝐴𝐼}𝑞_{𝑆𝑀𝐼𝐵𝐼}+1+12^𝑙(𝑘). (12)

3.2. Security Analysis: Impersonation under Active/Concurrent Attack

Theorem 6. The GQ-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-secure against impersonation under active/concurrent attacks in the random oracle if the 𝑂𝑀𝐶𝐷𝐻 Problem is (𝑡_{𝑂𝑀𝑅𝑆𝐴𝐼},𝑞_{𝑂𝑀𝑅𝑆𝐴𝐼},𝜀_{𝑂𝑀𝑅𝑆𝐴𝐼})-hard where 𝜀_{𝑆𝑀𝐼𝐵𝐼}≤𝜀_{𝑂𝑀𝑅𝑆𝐴𝐼}𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}+1+12^𝑙(𝑘). (13)

Proof. Assume the GQ-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-breakable; then a simulator 𝑀 that (𝑡_{𝑂𝑀𝑅𝑆𝐴𝐼},𝑞_{𝑂𝑀𝑅𝑆𝐴𝐼},𝜀_{𝑂𝑀𝑅𝑆𝐴𝐼})-breaks the 𝑂𝑀𝑅𝑆𝐴𝐼 problem can be shown. 𝑀 takes in input (𝑁,𝑒), is given access to 𝐶𝐻𝐴𝐿𝐿 and 𝑅𝑆𝐴 oracles, and runs the impersonator 𝐼 as a subroutine. Any SEM-Extract, User-Extract, SEM-Identification, User-Identification, and Full-Identification queries are preceded by a Create-User query. 𝑀 maintains a list 𝐿_𝐻=⟨𝖨𝖣_𝑖,𝑄_𝖨𝖣𝑖,𝑓_𝖨𝖣𝑖,𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣},𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣},𝑑_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑑_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ which is initially empty. The following shows how 𝑀 simulates the environment and oracle queries for 𝐼. (1)Create-User (𝖨𝖣_𝑖). 𝑀 chooses 𝑙∈{1,…,𝑞_𝐻} randomly and lets 𝖨𝖣_𝑙=𝖨𝖣^∗ at this point. Whenever 𝐼 makes a 𝐻 query on 𝖨𝖣_𝑖, consider the following.(i)If 𝑖=𝑙, 𝑀 will choose 𝑓←_𝖨𝖣∗^$ℤ^∗_𝑁, queries 𝐶𝐻𝐴𝐿𝐿 for 𝑤₀, and sets 𝑄_𝖨𝖣^∗=𝑤₀𝑓^𝑒_𝖨𝖣∗ and will return 𝑄_𝖨𝖣^∗ to 𝐼. It adds ⟨𝖨𝖣_𝑙, 𝑄_𝖨𝖣^∗, 𝑓_𝖨𝖣∗, 𝑋_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=⟂, 𝑋_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂, 𝑋_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑑_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑑_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂⟩ to 𝐿_𝐻.(ii)Otherwise, for 𝑖≠𝑙, 𝑀 chooses 𝑓←_𝖨𝖣𝑖^$ℤ^∗_𝑞, sets 𝑄_𝖨𝖣𝑖=𝑓^𝑒_𝖨𝖣𝑖, and returns 𝑄_𝖨𝖣𝑖 to 𝐼. 𝑀 also sets 𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}=𝑓_𝖨𝖣𝑖, chooses 𝑑←_{𝑈𝑆𝐸𝑅∗𝖨𝖣}^$ℤ^∗_𝜙(𝑁), and sets 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣}=𝑄^{𝑑𝑖𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣𝑖 as the SEM portion of the user private key and 𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑓_𝖨𝖣𝑖𝑄^{−𝑑𝑖𝑈𝑆𝐸𝑅𝖨𝖣}_𝖨𝖣𝑖 as the user portion of the user private key. It can be seen that 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣}×𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑄^{𝑑𝑖𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣𝑖×𝑓_𝖨𝖣𝑖𝑄^{−𝑑𝑖𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣𝑖=𝑓_𝖨𝖣𝑖=𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}. (14)𝑀 adds ⟨𝖨𝖣_𝑖,𝑄_𝖨𝖣𝑖, 𝑓_𝖨𝖣𝑖, 𝑋_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑑_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑑_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ to 𝐿_𝐻. 𝑀 returns 𝑄_𝖨𝖣𝑖 to 𝐼.(2)SEM-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and USER-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but USER-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 chooses 𝑑←_{𝑆𝐸𝑀∗𝖨𝖣}^$ℤ^∗_𝜙(𝑁) and sets 𝑋_{𝑆𝐸𝑀∗𝖨𝖣}=𝑄^{𝑑∗𝑆𝐸𝑀𝖨𝖣}_𝖨𝖣∗ as the SEM portion of the user private key, saves it in 𝐿_𝐻, and returns it to 𝐼. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves 𝑋_{𝑆𝐸𝑀𝑖𝖨𝖣} in 𝐿_𝐻 and returns it to 𝐼.(3)USER-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and SEM-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but SEM-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 chooses 𝑑←_{𝑈𝑆𝐸𝑅∗𝖨𝖣}^$ℤ^∗_𝜙(𝑁) and sets 𝑋_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑄^{𝑑∗𝑈𝑆𝐸𝑅𝖨𝖣}_𝖨𝖣∗ as the USER portion of the user private key, saves it in 𝐿_𝐻, and returns it to 𝐼. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves 𝑋_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣} in 𝐿_𝐻 and returns it to 𝐼.(4)Identification (𝖨𝖣_𝑖, 𝑠𝑒𝑠𝑠𝑖𝑜𝑛). 𝐼 will act as the cheating verifier to learn information from valid conversation interactions from 𝑀. If 𝖨𝖣_𝑖≠𝖨𝖣^∗𝑀 just retrieves 𝖨𝖣_𝑖’s entry in 𝐿_𝐻 and runs the identification protocol for either the SEM’s interactions, the user’s interactions, or both combined as in the protocol.
 Otherwise, for 𝖨𝖣^∗=𝖨𝖣^∗, 𝑀 then creates a full valid conversation for each 𝑚th query by querying 𝐶𝐻𝐴𝐿𝐿 for 𝑊_𝑚 and setting 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑊_𝑚. Additionally, 𝑀 chooses 𝑌←_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}^$ℤ^∗_𝑁 and sets 𝑌_{𝑚,𝑈𝑠𝑒𝑟∗𝖨𝖣}=𝑊_𝑚/𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}. Upon receiving 𝑐_{𝑚,𝖨𝖣}^∗ from 𝐼, 𝑀 will query 𝑅𝑆𝐴(𝑊_𝑚(𝑊₀𝑓^𝑒_𝖨𝖣∗)^{𝑐∗𝑚,𝖨𝖣}) to receive 𝑉_𝑚=(𝑊_𝑚(𝑊₀𝑓^𝑒_𝖨𝖣∗)^{𝑐∗𝑚,𝖨𝖣})^𝑑 and sets 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑉_𝑚. 𝑀 then chooses 𝑧←_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}^$ℤ^∗_𝑁 and then sets 𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑉_𝑚/𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}. 𝑀 tags the session with 𝑠𝑒𝑠𝑠𝑖𝑜𝑛=𝑚.(i)If 𝐼 queries SEM-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will commit 𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣} and respond with 𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣} upon receiving 𝑐_{𝑚,𝖨𝖣}^∗.(ii) If 𝐼 queries User-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will commit 𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣} and respond with 𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣} upon receiving 𝑐_{𝑚,𝖨𝖣}^∗.(iii) If 𝐼 queries Full-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will commit 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣} and respond with 𝑧_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣} upon receiving 𝑐_{𝑚,𝖨𝖣}^∗. If no session is specified for the query, 𝑀 just returns the next session in sequence. One can see that SEM-Identification   (𝖨𝖣^∗, 𝑚) and User-Identification   (𝖨𝖣^∗, 𝑚) can be combined to create a full and valid conversation on session 𝑚: 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}𝐻𝖨𝖣^{∗𝑐∗𝑚,𝖨𝖣}=𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑄^{𝑐∗𝑚,𝖨𝖣}_𝖨𝖣∗=𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑊_𝑚𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑊₀𝑓^𝑒_𝖨𝖣∗^{𝑐∗𝑚,𝖨𝖣}=𝑊_𝑚𝑊₀𝑓^𝑒_𝖨𝖣∗^{𝑐∗𝑚,𝖨𝖣}=𝑊_𝑚𝑊₀𝑓^𝑒_𝖨𝖣∗^{𝑐∗𝑚,𝖨𝖣𝑑𝑒}=𝑊_𝑚𝑊₀𝑓^𝑒_𝖨𝖣∗^{𝑐∗𝑚,𝖨𝖣𝑑𝑒}=𝑉_𝑚^𝑒=𝑉_𝑚𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}^𝑒𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}^𝑒=𝑧^𝑒_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑧^𝑒_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑧^𝑒_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}. (15)
Eventually, 𝐼 stops Phase 1 and outputs the challenge 𝖨𝖣, 𝖨𝖣^∗ on which it wishes to be challenged on. 𝑀 checks if 𝖨𝖣^∗=𝖨𝖣_𝑙 from 𝐿_𝐻 and aborts if not. Otherwise, 𝑀 runs 𝐼 now as a cheating prover on 𝖨𝖣^∗. 𝑀 runs by obtaining its commitment, 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selects a challenge 𝑐←₁^$ℤ^∗_𝑞, and obtains the response 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1} from 𝐼. 𝑀 then resets 𝐼 to the step whereby 𝐼 just sent 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selects a second challenge 𝑐←₂^$ℤ^∗_𝑞, and receives 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2} as response. It should hold that 𝑧^𝑒_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}=𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝐻(𝖨𝖣)^𝑐1 and 𝑧^𝑒_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}=𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝐻(𝖨𝖣)^𝑐2. One can then obtain (𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}/𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2})^𝑒=𝐻(𝖨𝖣)^{𝑐1−𝑐2}. Since 𝑒 is a prime and −𝑒<𝑐₁−𝑐₂<𝑒, 𝐺𝐶𝐷(𝑒,𝑐₁−𝑐₂)=1. Use the extended Euclidean algorithm to obtain integers 𝑆 and 𝑇 such that 𝑒𝑆+(𝑐₁−𝑐₂)𝑇=1. It follows that 𝐻𝖨𝖣^∗=𝑄^{𝑒𝑆+(𝑐1−𝑐2)𝑇}_𝖨𝖣∗=𝑤mod𝑁₀𝑓^𝑒_𝖨𝖣∗^{𝑒𝑆+(𝑐1−𝑐2)𝑇}=𝑤mod𝑁₀𝑓^𝑒2𝑆_𝖨𝖣∗𝑤₀𝑓^{𝑒(𝑐1−𝑐2)𝑇}_𝖨𝖣∗=𝑤mod𝑁₀𝑓^𝑒2𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑒𝑇=𝑤mod𝑁₀𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑒mod𝑁. (16)
𝑀 then calculates the solution to the 𝑅𝑆𝐴𝐼 problem as follows: 𝑤₀𝑓^𝑒_𝖨𝖣∗=𝑤₀𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑒𝑤mod𝑁,_𝑑0𝑓_𝖨𝖣∗=𝑤₀𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑤mod𝑁,_𝑑0=𝑤₀𝑓^𝑒𝑆_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}/𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇𝑓_𝖨𝖣∗𝑤mod𝑁,_𝑑0=𝑤₀𝑓^𝑒𝑆−1_𝖨𝖣∗𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}^𝑇mod𝑁. (17)
𝑀 proceeds to calculate the solutions to the other challenges as follows: 𝑤_𝑗=𝑉_𝑗𝑤₀𝑓_𝖨𝖣∗^{−𝑐𝑚,𝖨𝖣∗}. (18) The probability study for the simulation above is similar to that of the impersonation under passive attack game and is therefore omitted.

4. BNN-SM-IBI: An DL-Based Security-Mediated IBI Scheme

The BNN-SM-IBI scheme is derived from the BNN-IBI scheme proposed in the work of [4] and is provably secure against passive attackers assuming the DL assumption and against active/concurrent attackers assuming the 𝑂𝑀𝐷𝐿 assumption.

The BNN-SM-IBI scheme is constructed as follows.(1)Setup (1^𝑘). It takes in the security parameter 1^𝑘. It randomly selects 𝑥←^$ℤ_𝑞, a generator 𝑔←^$𝐺 and computes 𝑋=𝑔^𝑥. Setup also chooses 𝐻∶{0,1}^∗→ℤ_𝑞 and publishes the system parameters 𝗆𝗉𝗄=⟨𝐺,𝑞,𝑔,𝑋,𝐻⟩. The master private key 𝗆𝗌𝗄=𝑥 is kept secret.(2)Extract (𝗆𝗉𝗄,𝗆𝗌𝗄,𝖨D). It takes in 𝗆𝗉𝗄,𝗆𝗌𝗄=𝑠, and 𝖨𝖣 as input. It calculates 𝐻(𝖨𝖣), picks 𝑟_{𝐹𝑈𝐿𝐿},𝑟_𝑆𝐸𝑀,𝑠←_𝑆𝐸𝑀^$ℤ_𝑞, calculates 𝑠_{𝐹𝑈𝐿𝐿}=𝑟_{𝐹𝑈𝐿𝐿}+𝑥𝐻(𝖨𝖣) and 𝑅_{𝐹𝑈𝐿𝐿}=𝑔^{𝑟𝐹𝑈𝐿𝐿}, and sets the full user private key as 𝑢𝑠𝑘_{𝐹𝑈𝐿𝐿}=⟨𝑠_{𝐹𝑈𝐿𝐿},𝑅_{𝐹𝑈𝐿𝐿}⟩. Additionally, it sets 𝑠_{𝑈𝑆𝐸𝑅}=𝑠_{𝐹𝑈𝐿𝐿}−𝑠_𝑆𝐸𝑀, 𝑟_{𝑈𝑆𝐸𝑅}=𝑟_{𝐹𝑈𝐿𝐿}−𝑟_𝑆𝐸𝑀, 𝑅_{𝑈𝑆𝐸𝑅}=𝑔^{𝑟𝑈𝑆𝐸𝑅}, 𝑅_𝑆𝐸𝑀=𝑔^{𝑟𝑆𝐸𝑀}. It then sets 𝑢𝑠𝑘_{𝑈𝑆𝐸𝑅}=⟨𝑠_{𝑈𝑆𝐸𝑅},𝑅_{𝑈𝑆𝐸𝑅}⟩ and 𝑢𝑠𝑘_𝑆𝐸𝑀=⟨𝑠_𝑆𝐸𝑀,𝑅_𝑆𝐸𝑀⟩. It gives 𝑢𝑠𝑘_{𝑈𝑆𝐸𝑅} to the user as its partial private key and 𝑢𝑠𝑘_𝑆𝐸𝑀 to the security mediator as its partial private key and keeps 𝑢𝑠𝑘_{𝐹𝑈𝐿𝐿} secret.(3)Identification Protocol. It is run by the User-Prover and SEM-Prover with Verifier as such.(a)User-Prover sends its 𝖨𝖣 to Sem-Prover, chooses 𝑦←_{𝑈𝑆𝐸𝑅}^$ℤ_𝑞, and sets 𝑌_{𝑈𝑆𝐸𝑅}=𝑔^{𝑦𝑈𝑆𝐸𝑅} and 𝑆_{𝑈𝑠𝑒𝑟}=𝑔^{𝑠𝑈𝑆𝐸𝑅}. SEM-Prover upon receiving 𝖨𝖣 checks if it is still valid and returns error if it is revoked. Otherwise, SEM-Prover chooses 𝑦←_𝑆𝐸𝑀^$ℤ_𝑞 and sends 𝑌_𝑆𝐸𝑀=𝑔^{𝑦𝑆𝐸𝑀}, 𝑆_𝑆𝐸𝑀=𝑔^{𝑠𝑆𝐸𝑀}, and 𝑅_𝑆𝐸𝑀 to User-Prover. User-Prover combines 𝑌_{𝐹𝑈𝐿𝐿}=𝑌_𝑆𝐸𝑀×𝑌_{𝑈𝑆𝐸𝑅}, 𝑆_{𝐹𝑈𝐿𝐿}=𝑆_𝑆𝐸𝑀×𝑆_{𝑈𝑆𝐸𝑅}, 𝑅_{𝐹𝑈𝐿𝐿}=𝑅_𝑆𝐸𝑀×𝑅_{𝑈𝑆𝐸𝑅} and sends 𝑌_{𝐹𝑈𝐿𝐿},𝑆_{𝐹𝑈𝐿𝐿}, and 𝑅_{𝐹𝑈𝐿𝐿} to Verifier.(b)Verifier chooses a random challenge 𝑐←^$ℤ_𝑞 and sends it to User-Prover. User-Prover relays 𝑐 to SEM-Prover.(c)SEM-Prover calculates its half of the response 𝑧_𝑆𝐸𝑀=𝑦_𝑆𝐸𝑀+𝑐𝑠_𝑆𝐸𝑀 and sends it to User-Prover. User-Prover combines it with his response 𝑧_{𝑈𝑆𝐸𝑅}=𝑦_{𝑈𝑆𝐸𝑅}+𝑐𝑠_{𝑈𝑆𝐸𝑅} to create 𝑧_{𝐹𝑈𝐿𝐿}=𝑧_𝑆𝐸𝑀+𝑧_{𝑈𝑆𝐸𝑅} and sends it as a response to Verifier.

 Verifier checks if 𝑔^{𝑧𝐹𝑈𝐿𝐿}=𝑌_{𝐹𝑈𝐿𝐿}𝑅^𝑐_{𝐹𝑈𝐿𝐿}𝑋^{𝐻(𝖨𝖣)𝑐} and accepts if yes; otherwise it outputs reject.

To check for completeness, 𝑔^{𝑧𝐹𝑈𝐿𝐿}=𝑔^{𝑧𝑆𝐸𝑀+𝑧𝑈𝑆𝐸𝑅}=𝑔^{𝑦𝑆𝐸𝑀+𝑐𝑠𝑆𝐸𝑀+𝑦𝑈𝑆𝐸𝑅+𝑐𝑠𝑈𝑆𝐸𝑅}=𝑔^{𝑦𝑆𝐸𝑀+𝑦𝑈𝑆𝐸𝑅+𝑐(𝑠𝑆𝐸𝑀+𝑠𝑈𝑆𝐸𝑅)}=𝑔^{𝑦𝐹𝑈𝐿𝐿+𝑐(𝑠𝐹𝑈𝐿𝐿)}=𝑔^{𝑦𝐹𝑈𝐿𝐿+𝑐(𝑟𝐹𝑈𝐿L+𝑥𝐻(𝖨𝖣))}=𝑔^{𝑦𝐹𝑈𝐿𝐿}𝑔^{𝑟𝐹𝑈𝐿𝐿𝑐}𝑔^{𝑥𝐻(𝖨𝖣)𝑐}=𝑌_{𝐹𝑈𝐿𝐿}𝑅^𝑐_{𝐹𝑈𝐿𝐿}𝑋^{𝐻(𝖨𝖣)𝑐}. (19)

4.1. Security Analysis: Impersonation under Passive Attack

Theorem 7. The BNN-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-secure against impersonation under passive attacks in the random oracle if the DL problem is (𝑡_𝐷𝐿,𝜀_𝐷𝐿)-hard where 𝜀_{𝑆𝑀𝐼𝐵𝐼}≤𝜀_𝐷𝐿𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}+1+1𝑞. (20)

Proof. Assume the BNN-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-breakable; then a simulator 𝑀 that (𝑡_𝐷𝐿,𝜀_𝐷𝐿)-breaks the DL problem can be shown. 𝑀 takes in input (𝑔,𝐴=𝑔^𝑎) and runs the impersonator 𝐼 as a subroutine. Without loss of generality, it can be assumed that any SEM-Extract, User-Extract, SEM-Identification, User-Identification, and Full-Identification queries are preceded by a Create-User query. To avoid collision and consistently respond to these queries, 𝑀 maintains a list 𝐿_𝐻=⟨𝖨𝖣_𝑖,𝑄_𝖨𝖣𝑖, 𝑆_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑆_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑆_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑟_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑅_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑅_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ which is initially empty. The following shows how 𝑀 simulates the environment and oracle queries for 𝐼. (1)Setup. 𝑀 sets the system parameters as 𝗆𝗉𝗄=⟨𝐺,𝑞,𝑔,𝑋=𝑔^𝑥,𝐻⟩ and keeps master private key 𝑥 secret. It sends 𝗆𝗉𝗄 to 𝐼.(2)Create-User (𝖨𝖣_𝑖). 𝑀 chooses 𝑙∈{1,…,𝑞_𝐻} randomly and lets 𝖨𝖣_𝑙=𝖨𝖣^∗ at this point. Whenever 𝐼 makes a 𝐻 query on 𝖨𝖣_𝑖, consider the following.(i)If 𝑖=𝑙, 𝑀 chooses 𝑄←_𝖨D^∗$ℤ_𝑞 and sets 𝑆_{𝐹𝑈𝐿𝐿𝖨D∗}=𝐴 and 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝐴𝑋^{𝑄∗𝖨𝖣} and returns 𝑄_𝖨𝖣^∗ to 𝐼. 𝑀 adds ⟨𝖨𝖣_𝑙, 𝑄_𝖨𝖣^∗, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}, 𝑠_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=⟂, 𝑠_{𝑆𝐸𝑀∗𝖨𝖣}, 𝑠_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂, 𝑟_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=⟂, 𝑟_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑟_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂⟩ to 𝐿_𝐻.(ii)Otherwise, for 𝑖≠𝑙, 𝑀 chooses 𝑄←_𝖨𝖣𝑖^$ℤ^∗_𝑞 and returns 𝑄_𝖨𝖣𝑖. It then chooses 𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣},𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑠←_{𝑆𝐸𝑀𝑖𝖨𝖣}^$ℤ^∗_𝑞, calculates 𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}=𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}+𝑥𝑄, and sets 𝑟_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}−𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣} and 𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}−𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣}. 𝑀 adds ⟨𝖨𝖣_𝑖, 𝑄_𝖨𝖣𝑖, 𝑆_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑆_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑆_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑟_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑅_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑅_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ to 𝐿_𝐻.(3)SEM-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and USER-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but USER-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 will choose 𝑟_{𝑆𝐸𝑀∗𝖨𝖣},𝑠←_{𝑆𝐸𝑀∗𝖨𝖣}^$ℤ_𝑞 and sets 𝑅_{𝑆𝐸𝑀∗𝖨𝖣}=𝑔^{𝑟∗𝑆𝐸𝑀𝖨𝖣} and 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}=𝑔^{𝑠∗𝑆𝐸𝑀𝖨𝖣}. 𝑀 also sets 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑆_{𝑆𝐸𝑀∗𝖨𝖣} and 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑅_{𝑆𝐸𝑀∗𝖨𝖣}, saves these values in 𝐿_𝐻, and returns them to 𝐼. These values will be used in the event of an Identification query later on. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves ⟨𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑅_{𝑆𝐸𝑀𝑖𝖨𝖣}⟩ in 𝐿_𝐻 and returns it to 𝐼.(4)USER-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and SEM-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but SEM-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 will choose 𝑟_{𝑈𝑆𝐸𝑅∗𝖨𝖣},𝑠←_{𝑈𝑆𝐸𝑅∗𝖨𝖣}^$ℤ_𝑞 and sets 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑔^{𝑟∗𝑈𝑆𝐸𝑅𝖨𝖣} and 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑔^{𝑠∗𝑈𝑆𝐸𝑅𝖨𝖣}. 𝑀 also sets 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}=𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣} and 𝑅_{𝑆𝐸𝑀∗𝖨𝖣}=𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}, saves these values in 𝐿_𝐻, and returns them to 𝐼. These values will be used in the event of an Identification query later on. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves ⟨𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣},𝑅_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ in 𝐿_𝐻 and returns it to 𝐼.(5)Identification (𝖨𝖣_𝑗, 𝑠𝑒𝑠𝑠𝑖𝑜𝑛). 𝐼 will act as the cheating verifier to learn information from valid conversation transcripts from 𝑀. If 𝖨𝖣_𝑗≠𝖨𝖣^∗, 𝑀 just retrieves 𝖨𝖣_𝑗’s entry in 𝐿_𝐻 and runs the identification protocol for either the SEM’s interactions, the user’s interactions, or both combined as in the protocol. Otherwise, for 𝖨𝖣_𝑗=𝖨𝖣^∗, 𝑀 then creates a full valid transcript for each 𝑚th query by picking 𝑧_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣},𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣},𝑐←_{𝑚,𝖨𝖣}^∗$ℤ_𝑞. 𝑀 retrieves 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣} and sets 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑔^{𝑧∗𝑚,𝐹𝑈𝐿𝐿𝖨𝖣}𝑆^{−𝑐∗𝑚,𝖨𝖣}_{𝐹𝑈𝐿𝐿∗𝖨𝖣}. Additionally, 𝑀 chooses 𝑧←_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}^$ℤ_𝑞, calculates 𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑧_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}−𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}, and retrieves 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}, 𝑅_{𝑆𝐸𝑀∗𝖨𝖣} and 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}, 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣} from 𝐿_𝐻 as well. 𝑀 then sets 𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}=𝑔^{𝑧∗𝑚,𝑆𝐸𝑀𝖨𝖣}𝑆^{𝑐∗𝑚,𝖨𝖣}_{𝑆𝐸𝑀∗𝖨𝖣} and 𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑔^{𝑧∗𝑚,𝑈𝑆𝐸𝑅𝖨𝖣}𝑆^{𝑐∗𝑚,𝖨𝖣}_{𝑈𝑆𝐸𝑅∗𝖨𝖣}. 𝑀 tags the session with 𝑠𝑒𝑠𝑠𝑖𝑜𝑛=𝑚. If 𝐼 queries(i) SEM-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will return ⟨𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣},𝑆_{𝑆𝐸𝑀∗𝖨𝖣},𝑅_{𝑆𝐸𝑀∗𝖨𝖣},𝑐_{𝑚,𝖨𝖣}^∗,𝑧_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}⟩;(ii) User-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will return ⟨𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}, 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}, 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}, 𝑐_{𝑚,𝖨𝖣}^∗𝑧_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}⟩;(iii)Full-Identification (𝖨𝖣^∗, 𝑚), 𝑀 will return ⟨𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑐_{𝑚,𝖨𝖣}^∗𝑧_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}⟩. If no session is specified for the query, 𝑀 just returns the next session in sequence. One can see that SEM-Identification  (𝖨𝖣^∗, 𝑚) and User-Identification  (𝖨𝖣^∗,𝑚) can be combined to create a full and valid transcript on session 𝑚: 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}𝑅^{𝑐∗𝑚,𝖨𝖣}_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝑋^{𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}=𝑌_{𝑚,𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑌_{𝑚,𝑆𝐸𝑀∗𝖨𝖣}𝑅^{𝑐∗𝑚,𝖨𝖣}_{𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑅^{𝑐∗𝑚,𝖨𝖣}_{𝑆𝐸𝑀∗𝖨𝖣}×𝑋^{𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}=𝑔^{𝑧∗𝑚,𝑈𝑆𝐸𝑅𝖨𝖣}𝑆^{−𝑐∗𝑚,𝖨𝖣}_{𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑔^{𝑧∗𝑚,𝑆𝐸𝑀𝖨𝖣}𝑆^{−𝑐∗𝑚,𝖨𝖣}_{𝑆𝐸𝑀∗𝖨𝖣}×𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑅_{𝑆𝐸𝑀∗𝖨𝖣}^{𝑐∗𝑚,𝖨𝖣}𝑋^{𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}=𝑔^{𝑧∗𝑚,𝑈𝑆𝐸𝑅𝖨𝖣}𝑔^{𝑧∗𝑚,𝑆𝐸𝑀𝖨𝖣}𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑆_{𝑆𝐸𝑀∗𝖨𝖣}^{−𝑐∗𝑚,𝖨𝖣}×𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}𝑅_{𝑆𝐸𝑀∗𝖨𝖣}^{𝑐∗𝑚,𝖨𝖣}𝑋^{𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}=𝑔^{𝑧∗𝑚,𝑈𝑆𝐸𝑅𝖨𝖣}𝑔^{𝑧∗𝑚,𝑆𝐸𝑀𝖨𝖣}𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝑆_{𝑆𝐸𝑀∗𝖨𝖣}𝑆_{𝑆𝐸𝑀∗𝖨𝖣}^{−𝑐∗𝑚,𝖨𝖣}×𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}𝑅_{𝑆𝐸𝑀∗𝖨𝖣}𝑅_{𝑆𝐸𝑀∗𝖨𝖣}^{𝑐∗𝑚,𝖨𝖣}𝑋^{𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}=𝑔^{𝑧∗𝑚,𝐹𝑈𝐿𝐿𝖨𝖣}𝐴^{−𝑐∗𝑚,𝖨𝖣}𝐴^{𝑐∗𝑚,𝖨𝖣}𝑋^{−𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}×𝑋^{𝐻(𝖨𝖣∗)𝑐∗𝑚,𝖨𝖣}=𝑔^{𝑧∗𝑚,𝐹𝑈𝐿𝐿𝖨𝖣}. (21)Eventually, 𝐼 stops Phase 1 and outputs the challenge 𝖨𝖣, 𝖨𝖣^∗ on which it wishes to be challenged on. 𝑀 checks if 𝖨𝖣=𝖨𝖣_𝑙 from 𝐿_𝐻 and aborts if not. Otherwise, 𝑀 runs 𝐼 now as a cheating prover on 𝖨𝖣^∗ by obtaining its commitment, 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣} selecting a challenge 𝑐←₁^$ℤ^∗_𝑞 and obtaining the response 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1} from 𝐼. 𝑀 then resets 𝐼 to the step whereby 𝐼 just sent 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selects a second challenge 𝑐←₂^$ℤ^∗_𝑞, and receives 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2} as response. 𝑀 is then able to extract the full user private key as follows: 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}−𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}𝑐₁−𝑐₂=𝑦_{𝐹𝑈𝐿𝐿∗𝖨𝖣}+𝑐₁𝑎−𝑦_{𝐹𝑈𝐿𝐿∗𝖨𝖣}+𝑐₂𝑎𝑐₁−𝑐₂=𝑐₁−𝑐₂𝑎𝑐₁−𝑐₂=𝑎. (22)𝑀 outputs 𝑎 as the discrete log solution.
It remains to calculate the probability of 𝑀 solving the CDH problem and winning the game. The probability of 𝑀 successfully extracting two valid conversation transcripts from 𝐼 is bounded by (𝜀_{𝑆𝑀𝐼𝐵𝐼}−(1/𝑞))² as given by the reset lemma [20]: [][]𝜀Pr𝑀winsDL=Pr𝑀computes𝑎¬abort=Pr𝑀computes𝑎∣¬abortPr¬abort_DL≥𝜀_{𝑆𝑀𝐼𝐵𝐼}−1𝑞²Pr[¬abort]. (23) Finally, let 𝛿 be the probability that 𝐼 issues a SEM-Extract and a USER-Extract query on 𝖨𝖣^∗ and that 𝐼 makes a total of 𝑞_{𝑆𝑀𝐼𝐵𝐼} of such queries. The probability of 𝑀 answering all the extraction queries is 𝛿^𝑞_𝐼. In Phase 2, the probability of 𝑀 not aborting is if 𝐼 outputs the challenge identity 𝖨𝖣^∗ that was not queried before. This is given by the probability 1−𝛿. Compiling them, the probability of 𝑀 not aborting is 𝛿^{𝑞𝑆𝑀𝐼𝐵𝐼}(1−𝛿). This value is maximised at 𝛿_𝑜𝑝𝑡=1−(1/(𝑞_{𝑆𝑀𝐼𝐵𝐼}+1)). Using 𝛿_𝑜𝑝𝑡, The probability that 𝑀 does not abort is at least 1/𝑒(𝑞_{𝑆𝑀𝐼𝐵𝐼}+1) because the value (1−(1/(𝑞_{𝑆𝑀𝐼𝐵𝐼}+1)))^{𝑞𝑆𝑀𝐼𝐵𝐼} approaches 1/𝑒 for large 𝑞_{𝑆𝑀𝐼𝐵𝐼}. Therefore, the advantage of 𝑀, 𝜀_DL, and the bound of the simulation is given as follows: 𝜀_DL≥𝜀_{𝑆𝑀𝐼𝐵𝐼}−1𝑞²1𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}𝜀+1_DL𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}+1≥𝜀_{𝑆𝑀𝐼𝐵𝐼}−1𝑞²𝜀_{𝑆𝑀𝐼𝐵I}≤𝜀_𝐷𝐿𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}+1+1𝑞. (24)

4.2. Security Analysis: Impersonation under Active/Concurrent Attack

Theorem 8. The BNN-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-secure against impersonation under active/concurrent attacks in the random oracle if the 𝑂𝑀𝐶𝐷𝐻 Problem is (𝑡_{𝑂𝑀𝐶𝐷𝐻},𝑞_{𝑂𝑀𝐶𝐷𝐻},𝜀_{𝑂𝑀𝐶𝐷𝐻})-hard where 𝜀_{𝑆𝑀𝐼𝐵𝐼}≤𝜀_{𝑂𝑀𝐶𝐷𝐻}𝑒𝑞_{𝑆𝑀𝐼𝐵𝐼}+1+1𝑞. (25)

Proof. Assume the BNN-SM-IBI scheme is (𝑡_{𝑆𝑀𝐼𝐵𝐼},𝑞_{𝑆𝑀𝐼𝐵𝐼},𝜀_{𝑆𝑀𝐼𝐵𝐼})-breakable; then a simulator 𝑀 that (𝑡_{𝑂𝑀𝐶𝐷𝐻},𝑞_{𝑂𝑀𝐶𝐷𝐻},𝜀_{𝑂𝑀𝐶𝐷𝐻})-breaks the 𝑂𝑀𝐶𝐷𝐻 Problem can be shown. 𝑀 takes in input (𝑔,𝑔^𝑎), is given access to 𝐶𝐻𝐴𝐿𝐿 and 𝐷𝐿𝑂𝐺 oracles, and runs the impersonator 𝐼 as a subroutine. Without loss of generality, it can be assumed that any SEM-Extract, User-Extract, SEM-Identification, User-Identification, and Full-Identification queries are preceded by a Create-User query. To avoid collision and consistently respond to these queries, 𝑀 maintains a list 𝐿_𝐻=⟨𝖨𝖣_𝑖,𝑄_𝖨𝖣𝑖, 𝑆_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑆_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑆_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑟_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑅_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑅_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ which is initially empty. The following shows how 𝑀 simulates the environment and oracle queries for 𝐼. (1)Setup. 𝑀 sets the system parameters as mpk =⟨𝐺,𝑞,𝑔,𝑋=𝑔^𝑥,𝐻⟩ and keeps master private key 𝑥 secret. It sends mpk to 𝐼.(2)Create-User (𝖨𝖣_𝑖). 𝑀 chooses 𝑙∈{1,…,𝑞_𝐻} randomly and lets 𝖨𝖣_𝑙=𝖨𝖣^∗ at this point. Whenever 𝐼 makes a 𝐻 query on 𝖨𝖣_𝑖, consider the following. (i)If 𝑖=𝑙, 𝑀 chooses 𝑄←_𝖨𝖣^∗$ℤ_𝑞, queries 𝐶𝐻𝐴𝐿𝐿 for 𝑊₀, and sets 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑊₀ and 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑊₀𝑋^{𝑄∗𝖨𝖣}. 𝑀 returns 𝑄_𝖨𝖣^∗ to 𝐼. 𝑀 adds 𝐿_𝐻=⟨𝖨𝖣_𝑙, 𝑄_𝖨𝖣^∗, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂, 𝑠_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=⟂, 𝑠_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑠_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂, 𝑟_{𝐹𝑈𝐿𝐿∗𝖨𝖣}=⟂, 𝑟_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑟_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝑆𝐸𝑀∗𝖨𝖣}=⟂, 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=⟂⟩ to 𝐿_𝐻.(ii)Otherwise, for 𝑖≠𝑙, 𝑀 chooses 𝑄←_𝖨𝖣𝑖^$ℤ^∗_𝑞 and returns 𝑄_𝖨𝖣𝑖. It then chooses 𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣},𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑠←_{𝑆𝐸𝑀𝑖𝖨𝖣}^$ℤ^∗_𝑞, calculates 𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}=𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}+𝑥𝑄, and sets 𝑟_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}−𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣} and 𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}=𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}−𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣}. 𝑀 adds 𝐿_𝐻=⟨𝖨𝖣_𝑖,𝑄_𝖨𝖣𝑖, 𝑆_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑆_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑆_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑠_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑟_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑟_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑟_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿𝑖𝖨𝖣}, 𝑅_{𝑆𝐸𝑀𝑖𝖨𝖣}, 𝑅_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ to 𝐿_𝐻.(3)SEM-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and USER-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but USER-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 will choose 𝑟_{𝑆E𝑀∗𝖨𝖣},𝑠←_{𝑆𝐸𝑀∗𝖨𝖣}^$ℤ_𝑞 and sets 𝑅_{𝑆𝐸𝑀∗𝖨𝖣}=𝑔^{𝑟∗𝑆𝐸𝑀𝖨𝖣} and 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}=𝑔^{𝑠∗𝑆𝐸𝑀𝖨𝖣}. 𝑀 also sets 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑆_{𝑆𝐸𝑀∗𝖨𝖣} and 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑅_{𝑆𝐸𝑀∗𝖨𝖣}, saves these values in 𝐿_𝐻, and returns them to 𝐼. These values will be used in the event of an Identification query later on. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves ⟨𝑠_{𝑆𝐸𝑀𝑖𝖨𝖣},𝑅_{𝑆𝐸𝑀𝑖𝖨𝖣}⟩ in 𝐿_𝐻 and returns it to 𝐼.(4)USER-Extract (𝖨𝖣_𝑖). If 𝖨𝖣_𝑖=𝖨𝖣^∗ and SEM-Extract (𝖨𝖣^∗) has been queried before, 𝑀 aborts. If 𝖨𝖣_𝑖=𝖨𝖣^∗, but SEM-Extract (𝖨𝖣^∗) has not been queried before, 𝑀 will choose 𝑟_{𝑈𝑆𝐸𝑅∗𝖨𝖣},𝑠←_{𝑈𝑆𝐸𝑅∗𝖨𝖣}^$ℤ_𝑞 and sets 𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑔^{𝑟∗𝑈𝑆𝐸𝑅𝖨𝖣} and 𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣}=𝑔^{𝑠∗𝑈𝑆𝐸𝑅𝖨𝖣}. 𝑀 also sets 𝑆_{𝑆𝐸𝑀∗𝖨𝖣}=𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑆_{𝑈𝑆𝐸𝑅∗𝖨𝖣} and 𝑅_{𝑆𝐸𝑀∗𝖨𝖣}=𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}/𝑅_{𝑈𝑆𝐸𝑅∗𝖨𝖣}, saves these values in 𝐿_𝐻, and returns them to 𝐼. These values will be used in the event of an Identification query later on. Otherwise for all other 𝖨𝖣_𝑖≠𝖨𝖣^∗, 𝑀 just retrieves ⟨𝑠_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣},𝑅_{𝑈𝑆𝐸𝑅𝑖𝖨𝖣}⟩ in 𝐿_𝐻 and returns it to 𝐼.(5)Identification (𝖨𝖣_𝑗, 𝑠𝑒𝑠𝑠𝑖𝑜𝑛). 𝐼 will act as the cheating verifier to learn information from valid conversations from 𝑀. If 𝖨𝖣_𝑗≠𝖨𝖣^∗, 𝑀 just retrieves 𝖨𝖣_𝑗’s entry in 𝐿_𝐻 and runs the identification protocol for either the SEM’s interactions, the user’s interactions, or both combined as in the protocol.
 Otherwise, for 𝖨𝖣_𝑖=𝖨𝖣^∗, 𝑀 then creates a full valid conversation for each 𝑚th query by querying 𝐶𝐻𝐴𝐿𝐿 for 𝑊_𝑚 and setting 𝑌_{𝑚,𝐹𝑈𝐿𝐿∗𝖨𝖣}=𝑊_𝑚. 𝑀 also retrieves. Additionally, 𝑀 chooses 𝑌←_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}^$𝐺 and sets 𝑌_{𝑚,𝑈𝑠𝑒𝑟𝑗𝖨𝖣}=𝑊_𝑚/𝑌_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}. 𝑀 also retrieves 𝑆_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}, 𝑆_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}, 𝑆_{𝑚,𝑈𝑆𝐸𝑅𝑗𝖨𝖣}, 𝑅_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}, 𝑅_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}, and 𝑅_{𝑚,𝑈𝑆𝐸𝑅𝑗𝖨𝖣} from 𝐿_𝐻. Upon receiving 𝑐_{𝑚,𝖨𝖣𝑗} from 𝐼, 𝑀 will query 𝑧_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}=𝐷𝐿𝑂𝐺(𝑊_𝑚𝑊^{𝑐𝑗𝑚,𝖨𝖣}₀), selects 𝑧←_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}^$ℤ_𝑞, and sets 𝑧_{𝑚,𝑈𝑆𝐸𝑅𝑗𝖨𝖣}=𝑧_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}−𝑧_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}. 𝑀 tags the session with 𝑠𝑒𝑠𝑠𝑖𝑜𝑛=𝑚.(a)If 𝐼 queries SEM-Identification (𝖨𝖣_𝑗, 𝑚), 𝑀 will commit 𝑌_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}, 𝑆_{𝑆𝐸𝑀𝑗𝖨𝖣}, 𝑅_{𝑆𝐸𝑀𝑗𝖨𝖣} and respond with 𝑧_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣} upon receiving 𝑐_{𝑚,𝖨𝖣𝑗}.(b) If 𝐼 queries User-Identification (𝖨𝖣_𝑗, 𝑚), 𝑀 will commit 𝑌_{𝑚,𝑈𝑆𝐸𝑅𝑗𝖨𝖣}, 𝑆_{𝑈𝑆𝐸𝑅𝑗𝖨𝖣}, 𝑅_{𝑈𝑆𝐸𝑅𝑗𝖨𝖣} and respond with 𝑧_{𝑚,𝑈𝑆𝐸𝑅𝑗𝖨𝖣} upon receiving 𝑐_{𝑚,𝖨𝖣𝑗}.(c) If 𝐼 queries Full-Identification (𝖨𝖣_𝑗,𝑚), M will commit 𝑌_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}, 𝑆_{𝐹𝑈𝐿𝐿𝑗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿𝑗𝖨𝖣} and respond with 𝑧_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣} upon receiving 𝑐_{𝑚,𝖨𝖣𝑗}. If no session is specified for the query, 𝑀 just returns the next session in sequence. One can see that SEM-Identification (𝖨𝖣_𝑗, 𝑚) and User-Identification (𝖨𝖣^∗, 𝑚) can be combined to create a full and valid conversation on session 𝑚: 𝑌_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}𝑅^{𝑐𝑗𝑚,𝖨𝖣}_{𝐹𝑈𝐿𝐿𝑗𝖨𝖣}𝑋^{𝐻(𝖨𝖣𝑗)𝑐𝑗𝑚,𝖨𝖣}=𝑌_{𝑚,𝑈𝑆𝐸𝑅𝑗𝖨𝖣}𝑌_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}𝑅^{𝑐𝑗𝑚,𝖨𝖣}_{𝑈𝑆𝐸𝑅𝑗𝖨𝖣}𝑅^{𝑐𝑗𝑚,𝖨𝖣}_{𝑆𝐸𝑀𝑗𝖨𝖣}𝑋^{𝐻(𝖨𝖣𝑗)𝑐𝑗𝑚,𝖨𝖣}=𝑊_𝑚𝑌_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}𝑌_{𝑚,𝑆𝐸𝑀𝑗𝖨𝖣}𝑊₀𝑋^{−𝐻(𝖨𝖣)}𝑅_{𝑆𝐸𝑀𝑗𝖨𝖣}^{𝑐𝑗𝑚,𝖨𝖣}×𝑅^{𝑐𝑗𝑚,𝖨𝖣}_{𝑆𝐸𝑀𝑗𝖨𝖣}𝑋^{𝐻(𝖨𝖣𝑗)𝑐𝑗𝑚,𝖨𝖣}=𝑊_𝑚𝑊^{𝑐𝑗𝑚,𝖨𝖣}₀𝑋^{−𝐻(𝖨𝖣)𝑐𝑗𝑚,𝖨𝖣}𝑋^{𝐻(𝖨𝖣𝑗)𝑐𝑗𝑚,𝖨𝖣}=𝑊_𝑚𝑊^{𝑐𝑗𝑚,𝖨𝖣}₀=𝑔^{𝐷𝐿𝑂𝐺(𝑊𝑚(𝑊𝑐𝑗0𝑚,𝖨𝖣)}=𝑔^{𝑧𝑗𝑚,𝐹𝑈𝐿𝐿𝖨𝖣}. (26)Eventually, 𝐼 stops Phase 1 and outputs the challenge 𝖨𝖣, 𝖨𝖣^∗ on which it wishes to be challenged on. 𝑀 checks if 𝖨𝖣^∗=𝖨𝖣_𝑙 from 𝐿_𝐻 and aborts if not. Otherwise, 𝑀 runs 𝐼 now as a cheating prover on 𝖨𝖣^∗. 𝑀 runs by obtaining its commitment, 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selects a challenge 𝑐←₁^$ℤ^∗_𝑞, and obtains the response 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1} from 𝐼. 𝑀 then resets 𝐼 to the step whereby 𝐼 just sent 𝑌_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑆_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, 𝑅_{𝐹𝑈𝐿𝐿∗𝖨𝖣}, selects a second challenge 𝑐←₂^$ℤ^∗_𝑞, and receives 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2} as response. 𝑀 is then able to extract the full user private key as follows: 𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,1}−𝑧_{𝐹𝑈𝐿𝐿∗𝖨𝖣,2}𝑐₁−𝑐₂=𝑦_{𝐹𝑈𝐿𝐿∗𝖨𝖣}+𝑐₁𝑤₀−𝑦_{𝐹𝑈𝐿𝐿∗𝖨𝖣}+𝑐₂𝑤₀𝑐₁−𝑐₂=𝑐₁−𝑐₂𝑤₀𝑐₁−𝑐₂=𝑤₀. (27)𝑀 outputs 𝑤₀ as the initial discrete log challenge solution.
𝑀 proceeds to calculate the solutions to the other challenges as follows: 𝑧_{𝑚,𝐹𝑈𝐿𝐿𝑗𝖨𝖣}−𝑤₀𝑐_{𝑚,𝖨𝖣𝑗}=𝐷𝐿𝑂𝐺𝑊_𝑚𝑊^{𝑐𝑗𝑚,𝖨𝖣}₀−𝑤₀𝑐_{𝑚,𝖨𝖣𝑗}=𝑤_𝑚+𝑤₀𝑐_{𝑚,𝖨𝖣𝑗}−𝑤₀𝑐_{𝑚,𝖨𝖣𝑗}=𝑤_𝑚. (28) The probability study for the simulation above is similar to that of the impersonation under passive attack game and is therefore omitted.

5. Efficiency Analysis

In this section we provide the breakdown of operation costs for both the GQ-SM-IBI scheme and the BNN-SM-IBI scheme.

We measure the operation costs of the GQ-SM-IBI scheme in terms of addition operations in ℤ_𝜙(𝑁), multiplication operations in ℤ_𝜙(𝑁) and ℤ^∗_𝑁, and exponentiation operations in ℤ^∗_𝑁. Overall, the operational costs of the GQ-SM-IBI scheme are given in Table 1.

Table 1 

Operation costs for the GQ-SM-IBI scheme.

We also provide the communication costs of the GQ-SM-IBI scheme in Table 2.

Table 2 

Communication costs between algorithms for the GQ-SM-IBI scheme.

As for the BNN-SM-IBI scheme, we measure the operational costs in terms of group operational costs of addition modulo 𝑞, multiplication modulo 𝑞, multiplication in group 𝐺, and exponentiations modulo 𝑞. Overall, the operational costs of the BNN-SM-IBI scheme are given in Table 3.

Table 3 

Operation costs for the BNN-SM-IBI scheme.

We also provide the communication costs of the BNN-SM-IBI scheme in Table 4.

Table 4 

Communication costs between algorithms for the BNN-SM-IBI scheme.

However, it is difficult to compare all these operational costs since the schemes are using operations defined in different fields and groups. Therefore, we built a simulator to generate running time results using a common platform.

We compare the running time of only the identification protocol, since the protocol is invoked every time a prover wishes to perform an interaction with a verifier. We compare the running times of the GQ-SM-IBI scheme and BNN-SM-IBI scheme as well as the original pairing-based scheme by [19]. We name the scheme from [19] as BLS-SM-IBI since its design follows the BLS signature scheme by Boneh et al. from [22]. For GQ-SM-IBI and BNN-SM-IBI the level of security used was 1024-bits, 2048-bits, and 3072-bits. We also compared the results with the equivalent level of security for BLS-SM-IBI pairing-based scheme of 512-bits, 1024-bits, and 1536-bits, respectively.

The simulation was run on a i7-2630QM platform with 4 GB RAM running 64-bit Windows 7. The library used was Java Cryptography Extension. We ran the simulation 100 iterations for each algorithm and took the average running time, measured in nanoseconds as presented in Table 5.

Table 5 

Comparison of average simulated runtimes for SM-IBI schemes.

From the results, one can see that the GQ-SM-IBI scheme has the fastest identification protocol running time with the BNN-SM-IBI scheme trailing behind. However, both pairing-free schemes vastly outperform the BLS-SM-IBI that is pairing-based with at least an approximate factor of 6 to 7 for all three security levels. Therefore we obtain faster SM-IBI schemes from pairing-free alternatives.

6. Conclusion

We proposed two SM-IBI schemes that have an instant revocation feature and are very efficient. Our schemes outperform the only pairing-based SM-IBI currently known and are provably secure in the random oracle model against both passive and active/concurrent attackers.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgment

The authors would like to acknowledge the Ministry of Education, Malaysia, for financially aiding this research through the Fundamental Research Grant Scheme FRGS/2/2013/ICT07/MMU/03/5.