Download - Research Article Secure Electronic Cash Scheme with Anonymity Revocationdownloads.hindawi.com/journals/misy/2016/2620141.pdf · Research Article Secure Electronic Cash Scheme with

Research ArticleSecure Electronic Cash Scheme with Anonymity Revocation

Baoyuan Kang and Danhui Xu

School of Computer Science and Software Tianjin Polytechnic University Tianjin 300387 China

Correspondence should be addressed to Baoyuan Kang baoyuankangaliyuncom

Received 8 September 2015 Revised 14 December 2015 Accepted 1 March 2016

Academic Editor Francesco Gringoli

Copyright copy 2016 B Kang and D Xu This is an open access article distributed under the Creative Commons Attribution Licensewhich permits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

In a popular electronic cash scheme there are three participants the bank the customer and the merchant First a customer opensan account in a bankThen he withdraws an 119890-cash from his account and pays it to a merchant After checking the electronic cashrsquosvalidity the merchant accepts it and deposits it to the bank There are a number of requirements for an electronic cash schemesuch as anonymity unforgeability unreusability divisibility transferability and portability Anonymity property of electronic cashschemes can ensure the privacy of payers However this anonymity property is easily abused by criminals In 2011 Chen et alproposed a novel electronic cash systemwith trustee-based anonymity revocation frompairingOndemand the trustee can disclosethe identity for 119890-cash But in this paper we point out that Chen et alrsquos scheme is subjected to some drawbacks To contributesecure electronic cash schemes we propose a new offline electronic cash scheme with anonymity revocation We also provide theformally security proofs of the unlinkability and unforgeability Furthermore the proposed scheme ensures the property of avoidingmerchant frauds

1 Introduction

Due to the fast progress of computer networks and Internetinformation technology is used in electronic commerceMany electronic commerce services can be found over theinternet So an electronic payment mechanism is necessaryfor electronic commerce And electronic payment is oneof the key issues of electronic commerce development Torealize the digitalization of traditional cash and electronicpayment in 1983 Chaum suggested the first electronic cashscheme [1] Popularly in an electronic cash scheme there arethree participants the bank the customer and the merchantFirst a customer opens an account in a bank Then he with-draws an 119890-cash from his account and pays it to a merchantAfter checking the electronic cashrsquos validity the merchantaccepts it and deposits it to the bank For security and effi-ciency there are a number of requirements for an electroniccash scheme such as anonymity unforgeability unreusabil-ity divisibility transferability and portability [2] Some ofthem are listed below

AnonymityUnlinkability The customer of the cash must beanonymous As long as the coin is spent legitimately neither

the merchant nor the bank can identify the customer of thecoin

Unforgeability Only authorized banks can generate electroniccash

Unreusability The electronic cash cannot be reused Thescheme can detect the malicious customer who spends thecash twice

Electronic cash schemes can be divided into two cate-gories online and offline In online schemes as paying a cointo a merchant the bank must attend to validate the coinand detect its reuse But in offline schemes double spendingcan only be figured out when the merchant deposits thecoin to the bank in the next phase After Chaumrsquos schemea lot of electronic cash schemes [3ndash9] have been proposedbased on blind signatures and restrictive blind signaturesAfterwardmanymore complex schemes have been proposed[10ndash13] Recently Eslami and Talebi proposed an untraceableelectronic cash scheme [2] and claimed that their schemesatisfies all main security requirements such as anonymityunreusability and date attachability However Baseri et al

Hindawi Publishing CorporationMobile Information SystemsVolume 2016 Article ID 2620141 10 pageshttpdxdoiorg10115520162620141

2 Mobile Information Systems

[14] showed that Eslami and Talebirsquos scheme is subjectedto some weaknesses in perceptibility of double spenderunforgeability and date attachability Baseri et al also con-tributed a novel electronic cash scheme

Untraceable electronic cash is an attractive payment toolfor electronic commerce because its anonymity propertycan ensure the privacy of payers However this anonymityproperty is easily abused by criminals In 2011 Chen et al[15] proposed an electronic cash system with trustee-basedanonymity revocation from pairing On demand the trusteecan disclose the identity of the owner of an 119890-cash Chen etal claimed that their scheme is the first attempt to incor-porate mutual authentication and key agreement into 119890-cashprotocols and their scheme satisfies the security requirementsof untraceability verifiability unforgeability and anonymityrevocation But in 2012 Chang [16] claimed that he findssomeweaknesses ofChen et alrsquos schemeThenChen et al [17]immediately provided a response to rebut Changrsquos attacksBy thoroughly investigating Chen et alrsquos scheme we findthat despite Changrsquos attacks being really wrong Chen et alrsquosscheme is surely insecure Chen et alrsquos scheme is subjected tosomedrawbacks (1)Thefirst flaw is the attack on the unforge-ability by the dishonest customer (2) The second flaw is theattack on double spending owner tracing (3) The third flawis the potential bank attack

To contribute secure electronic cash schemes we proposea new offline electronic cash scheme with anonymity revoca-tion Furthermore the proposed scheme ensures the propertyof avoiding merchant frauds

The remainder of this paper is organized as followsRelated concept of bilinear pairing and CDH problem areintroduced in Section 2 In Section 3 we show some weak-nesses of Chen et alrsquos scheme In Section 4 we propose anew electronic cash scheme with anonymity revocation InSection 5 we show the verifiability of the proposed schemeDouble spender detection is covered in Section 6 In Section 7we show that the proposed scheme satisfies uncheatability ofmerchants Provable security of our scheme is covered in Sec-tion 8 In Section 9 we compare our scheme with the othersFinally conclusions are given in Section 10

2 Preliminary

21 The Bilinear Pairing Let 1198661be a cyclic additive group

generated by119875 whose order is a prime 119902 and let1198662be a cyclic

multiplicative group of the same order Let 119890 1198661times 1198661rarr 1198662

be a pairing map which satisfies the following conditions

(1) Bilinearity for any119875119876 119877 isin 1198661 we have 119890(119875+119876 119877) =

119890(119875 119877)119890(119876 119877)

In particular for any 119886 119887 isin 119885119902 119890(119886119875 119887119875) = 119890(119875

119886119887119875) = 119890(119886119887119875 119875) = 119890(119875 119875)119886119887

(2) Nondegeneracy there exists 119875119876 isin 1198661 such that

119890(119875 119876) = 1

(3) Computability there is an efficient algorithm tocompute 119890(119875 119876) for all 119875119876 isin 119866

1

22 The CDH Problem Let 119866 be a cyclic additive group ofprime order 119902 and 119875 a generator of 119866 The computationalDiffie-Hellman (CDH) problem is to compute 119886119887119875 for given119875 119886119875 119887119875 isin 119866

3 Effective Attacks on Chen et alrsquos Scheme

In this section we show the drawbacks of Chen et alrsquos scheme[15] For the sake of brevity we omit the review of Chen et alrsquosscheme To know Chen et alrsquos scheme in detail readers canread literature [15]

31 Attack on the Unforgeability by the Dishonest CustomerWhen the customer obtains an 119890-cash 119862119873119874 119871119878119879 (119877 119878) hecan randomly select 119886 isin 119885lowast

119902and forge 119890-cash 119862119873119874 119886 sdot 119871119878119879

(119886 sdot 119877 119886 sdot 119878) because the 119890-cash 119862119873119874 119871119878119879 (119877 119878) satisfies

119890 (119878 119875) = 119890 (1198673(CNO) 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (1)

So

119890 (119878 119875)119886= 119890 (119867

3(CNO) 119876

119861 119877)119886

sdot 119890 (LST sdot 119876119861 119875pub)

119886

(2)

Then

119890 (119886 sdot 119878 119875) = 119890 (1198673(CNO) 119876

119861 119886 sdot 119877)

sdot 119890 (119886 sdot LST sdot 119876119861 119875pub)

(3)

That is to say the customer forges a valid 119890-cash 119862119873119874 119886 sdot119871119878119879 (119886 sdot 119877 119886 sdot 119878)

Of course in payment protocol when the merchant getsan 119890-cash from customers he also can similarly forge 119890-cashFurther these forged 119890-cash make the scheme fail in doublespending owner tracing because it is impossible to find thecustomer identity from 119886 sdot 119871119878119879

Note that (119877 119878) is a signature on 119862119873119874 and 119871119878119879 Further-more 119862119873119874 does not play distinction function to an 119890-cash119862119873119874 is only a randomly selected number Any customer canrandomly choose any119862119873119874 for their 119890-cash If119862119873119874 has somefunction it is only to certain customer It is not strange thatdifferent customers may choose same 119862119873119874 for their 119890-cashSo this attack is a successful forgery

32 Attack by the Dishonest Merchant In practice there arealways many merchants from different shops After receivingan 119890-cash 119862119873119874 119871119878119879 (119877 119878) from a customer the merchantmay spend 119862119873119874 119871119878119879 (119877 119878) to another merchant Thisattack is correct due to the fact that the verification equation

119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (4)

is only related to 119862119873119874 119871119878119879 119877 119878 And no extra informationshould be provided by customers in the verification processLater even if the bank finds double spending the bank andthe trustee cannot find real double spender because thedouble spender may not be the customer himself

Mobile Information Systems 3

33 Potential Attack by the Bank However in payment pro-tocol the only verification to the 119890-cash 119862119873119874 119871119878119879 (119877 119878) isto examine whether the following equation holds

119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (5)

But when let 119877 = 119886119875pub (119886 is a randomly selected number in119885lowast

119902) in the above equation then

119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119886119875pub)

sdot 119890 (LST sdot 119876119861 119875pub)

= 119890 (119886 sdot 1198673(CNO) sdot 119876

119861 119875pub)

sdot 119890 (LST sdot 119876119861 119875pub)

= 119890 ((119886 sdot 1198673(CNO) + LST) sdot 119876

119861 119875pub)

= 119890 ((119886 sdot 1198673(CNO) + LST) sdot 119878

119861 119875)

(6)

So the bank can randomly select 119862119873119874 and 119871119878119879 Then Let119877 = 119886119875pub 119878 = (119886 sdot1198673(119862119873119874)+119871119878119879) sdot 119878119861 to generate an 119890-cash119862119873119874 119871119878119879 (119877 119878)

This apparently violates the withdrawal protocol abovethe customer and the bank together performing a blindsignature function to complete the 119890-cash withdrawal

4 Our Proposed Scheme

Based on an id-based signature scheme [21] proposed byHessand an efficient id-based blind signature [22] proposed byZhang andKim we propose an offline electronic cash schemewith anonymity revocation In the proposed scheme thereare four participants Trustee 119879 the bank 119861 the customer 119862and themerchant119872There are five protocols license issuingwithdrawal payment deposit and 119890-cash owner tracingHere any communication between any two entities shouldbe encrypted and this can be done by incorporating mutualauthentication and key agreement protocols likely in [15]Here for brevity we omit those encryptions in five protocols

41 System Setup In this stage the Key Generation Center(KGC) chooses a cyclic additive group 119866

1which is generated

by 119875 with prime order 119902 and chooses a cyclic multiplicativegroup 119866

2of the same order and a bilinear map 119890 119866

1times1198661rarr

1198662 KGC also chooses a random 119904 isin 119885

lowast

119902as the master key

and sets 119875pub = 119904119875 public and chooses cryptographic hashfunctions119867

1 0 1

lowastrarr 11986611198672 0 1

lowastrarr 119885lowast

119902 The system

parameter list is params = (1198661 1198662 119890 119875 119875pub 1198671 1198672)

When the customer 119862 submits his identity ID119862to the

KGC the KGC computes the public key 119876119862= 1198671(ID119862) and

private key 119878119862= 119904119876119862for the customer 119862 Similarly the KGC

generates the publicprivate key pairs (119876119879 119878119879) (119876119861 119878119861) and

(119876119872 119878119872) for Trustee 119879 the Bank 119861 and the Merchant 119872

respectively

42 License-Issuing Protocol Before withdrawing 119890-cashfrom the bank customer119862 needs to ask trustee119879 to issue him

a license The following steps describe the protocol which isalso illustrated in Box 1

(1) Customer 119862 selects four random numbers 119887 119911 1199081

1199082isin 119885lowast

119902 and sends ID

119862 119887 119911 119908

1 1199082 to Trustee 119879

(2) 119879 chooses a random number 119909 isin 119885lowast

119902 and computes

119871119878119879 as 119871119878119879 = 119864119870119879(ID119862oplus 119909) Here 119864 is a symmetric

encryption algorithm and119870119879 is a secret key(3) To sign on 119887minus1119871119878119879 trustee119879 selects a randomnumber

119903 isin 119885lowast

119902 and computes

119877 = 119890 (119875 119875)119903

119906 = 1198672(119887minus1LST 119877)

119881 = 119906119878119879+ 119903119875

(7)

The trustee 119879 also signs on1198601+1198602+1198603+1198604 here119860

1=

(119887119911 + 119911)119875pub 1198602 = (1199081+ 1199082)119875pub 1198603 = 119908

1119875pub and 1198604 =

119887119911119875pub 119879 selects a random number 119910 isin 119885lowast119902 and computes

119884 = 119890 (119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

119865 = 119889119878119879+ 119910119875

(8)

After that trustee 119879 stores (119871119878119879 119909) to the database andsends (119871119878119879 119906 119881 119889 119865) to the customer 119862

(4) The customer 119862 computes

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

(9)

and checks whether

119906 = 1198672(119887minus1119871119878119879 119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(10)

If so The customer 119862 obtains the license (119871119878119879 119906 119881) andthe signature (119889 119865) on 119860

1+ 1198602+ 1198603+ 1198604

43 Withdrawal Protocol To complete the 119890-cash with-drawal customer 119862 and bank 119861 together perform the follow-ing steps This protocol is also illustrated in Box 2

(1) Customer119862 sends ID119862 (119887minus1119871119878119879 119906 119881) to the bank 119861

(2) 119861 first computes

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1 (11)

and checks whether

119906 = 1198672(119887minus1119871119878119879 119877

1015840) (12)

If so the bank 119861 selects a random number 119896 isin 119885lowast

119902

computes 119870 = 119896119876119861 and sends 119870 to the customer 119862


Customer TrusteeSelects random numbers119887 119911 119908

1 1199082isin 119885lowast

119902

ID1198621198871199111199081 1199082997888997888997888997888997888997888997888997888997888997888997888rarr

Chooses random number119909 isin 119885

lowast

119902 computes

119871119878119879 = 119864119870119879(ID119862oplus 119909)

Selects a random number119903 isin 119885

lowast

119902 computes

119877 = 119890(119875 119875)119903

119906 = 1198672(119887minus1119871119878119879119877)

119881 = 119906119878119879+ 119903119875

Selects random number119910 isin 119885

lowast

119902 and computes

119884 = 119890(119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)119884)

119865 = 119889119878119879+ 119910119875

(119871119878119879119906119881119889119865)

larr997888997888997888997888997888997888997888997888997888

Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1

1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

And checks whether119906 = 119867

2(119887minus1119871119878119879119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Obtains the license (119871119878119879 119906 119881)and the signature (119889 119865) on 119860

1+ 1198602+ 1198603+ 1198604

Box 1 License-issuing protocol

Customer BankID119862(119887minus1119871119878119879119906119881)997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1

Checks whether119906 = 119867

2(119887minus1119871119878119879119877

1015840)


lowast

119902 computes

119870 = 119896119876119861

119870

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888

Selects two random number119886 119888 isin 119885

lowast

119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879119870

1015840) + 119888

ℎ

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes119878 = (119896 + ℎ)119878

119861

119878

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198781015840= 119886119878

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840119876119861 119875pub)

Obtains an 119890-cash (1198711198781198791198701015840 1198781015840)

Box 2 Withdrawal protocol


Customer Merchant(119871119878119879119870

10158401198781015840)

997888997888997888997888997888997888997888997888rarr

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

Selects random number119897 isin 119885lowast

119902 computes

119871 = 119890(119875 119875)119897

119895 = 1198672(119871119878119879119870

10158401198781015840119871)

119863 = 119895119878119872+ 119897119875

(119895119863)

larr997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198711015840= 119890(119863 119875)119890(119895119876

119872 119875pub)

minus1


2(119871119878119879119870

101584011987810158401198711015840)

Computes1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(1198911 1198912 1198601 1198602 1198603 1198604 119895119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Checks whether119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Accepts the payment

Box 3 Payment protocol

(3) The customer 119862 selects two random numbers 119886 119888 isin119885lowast

119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879 119870

1015840) + 119888

(13)

and sends ℎ to the bank 119861(4) The bank 119861 computes

119878 = (119896 + ℎ) 119878119861 (14)

and sends 119878 to the customer 119862(5) Customer 119862 computes

1198781015840= 119886119878 (15)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (16)

If so the customer 119862 obtains an 119890-cash (1198711198781198791198701015840 1198781015840)

44 Payment Protocol When the customer 119862wants to spendhis cash at the shop the customer 119862 and the merchant119872 dothe following steps This protocol is also illustrated in Box 3

(1) Customer 119862 sends (1198711198781198791198701015840 1198781015840) to the merchant119872(2) The merchant119872 checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (17)

If so he selects a random number 119897 isin 119885lowast119902and computes

119871 = 119890 (119875 119875)119897

119895 = 1198672(LST 1198701015840 1198781015840 119871)

119863 = 119895119878119872+ 119897119875

(18)

Then he sends (119895 119863) to the customer 119862(3) The customer 119862 computes

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1 (19)

and checks whether

119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (20)

If so he computes

1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(21)

Then he sends (1198911 1198912 1198601 1198602 1198603 1198604 119895 119889 119865) to themerchant

119872(4) The merchant119872 checks whether

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602) (22)


Merchant Bank(119871119878119879119870

101584011987810158401198911 1198912 1198951198601 1198602 1198603 1198604 119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

119890(1198911119876119879 119875pub) = 119890(119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Checks whether the 119890-cash is being double spentif it is fresh reedits the merchantrsquos account

Box 4 Deposit protocol

and computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (23)

and checks whether

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (24)

If so the merchant accepts the payment

45Deposit Protocol When themerchant119872wants to depositthe received 119890-cash into his account in the bank 119861 the follow-ing steps are done between the bank 119861 and the merchant119872This protocol is also illustrated in Box 4

(1) The merchant 119872 sends (1198711198781198791198701015840 1198781015840 1198911 1198912 119895 1198601 1198602

1198603 1198604 119889 119865) to the bank 119861

(2) The bank 119861 first checks whether the coin exists in itsdeposit If the coin exists it runs the double spender detectionprocedure Else the bank computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (25)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(26)

If the above four equations hold the bank accepts the coinstores it in the deposit table and transfers money to themerchant119872

46 Revoking the Anonymity In the case that an 119890-cash(119871119878119879119870

1015840 1198781015840) is abused by a criminal whether the cash is spent

twice or not the trustee can revoke the anonymity of the 119890-cash by the 119871119878119879 provided by the bank As soon as the trustee119879 receives the request of revoking anonymity 119879 checks hisdatabase to find record (119871119878119879 119909) and computes the identityinformation ID

119862= 119863119870119879(119871119878119879)oplus119909 by using his secret key119870119879

5 Verifiability of the Proposed Scheme

Firstly we show that the blind license 119887minus1119871119878119879 can be verifiedby equation

119906 = 1198672(119887minus1LST 1198771015840) (27)

Since

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

= 119890 (119881 119875) 119890 (minus119906119878119879 119875)

= 119890 (119881 minus 119906119878119879 119875) = 119890 (119903119875 119875) = 119877

(28)

119906 = 1198672(119887minus1119871119878119879 119877) = 119867

2(119887minus1119871119878119879 119877

1015840)

Secondly we show that the 119890-cash can be verified byequation

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (29)

In fact

119890 (1198781015840 119875) = 119890 (119886119878 119875) = 119890 (119886 (119896 + ℎ) 119878

119861 119875)

= 119890 (119886 (119896 + 119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

= 119890 (119886119896119876119861+ 119886119888119876

119861+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(30)

Thirdly we show that the signature (119895 119863) on (LST 1198701015840 1198781015840)by merchant can be verified by equation

119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (31)

Since

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1

= 119890 (119863 119875) 119890 (minus119895119878119872 119875)

= 119890 (119863 minus 119895119878119872 119875) = 119890 (119897119875 119875) = 119871

(32)

119895 = 1198672(119871119878119879 119870

1015840 1198781015840 119871) = 119867

2(119871119878119879 119870

1015840 1198781015840 1198711015840)

Fourthly we show that the information (1198911 1198912) can be

verified by the equations

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

(33)


In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)

Finally we show that the signature (119889 119865) on 1198601+ 1198602+

1198603+ 1198604by trustee can be verified by the equation

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)

6 Double Spender Detection

In the case that the customer spends an 119890-cash twice or morethe bank 119861 can compute

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)

Then the bank 119861 checks its databases in the withdrawalprotocol to find the record ID

119862 (119887minus1LST 119906 119881) and knows

the identity information ID119862of the malicious customer 119862

Here (1198911 1198912) and (1198911015840

1 1198911015840

2) are information the customer

119862 sends to the merchant 119872 in payment phase in twiceconsumption respectively In fact

1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)

Hence the bank 119862 can compute 119887minus1119871119878119879 and obtain theidentity information ID

119862of the malicious customer 119862

7 Uncheatability of Merchants

When the customer sends 119890-cash (1198711198781198791198701015840 1198781015840) to the mer-

chant the merchant computes signature (119895 119863) on (11987111987811987911987010158401198781015840) When the merchant sends (119895 119863) to the customer the

customer first verifies it using the public key 119876119872

of themerchant119872 When (119895 119863) satisfies the verification equationthe customer sends (119891

1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-

chant If later the merchant uses 119890-cash (1198711198781198791198701015840 1198781015840) and

(1198911 1198912 1198601 1198602 1198603 1198604 119889 119865) to spend to other merchants and

cheats the customer the customer can show the merchantrsquossignature to some arbitration agency So the scheme caneffectively resist merchants cheat attack

8 Provable Security

In this section we show that the proposed scheme satisfiesthe property of unlinkability and unforgeability

Definition 1 (the linkability game) Let 120578 be a security param-eter and let119862

1and119862

2be two customers119862

1 1198622 and the bank

119861 are involved in the following game

Step 1 The bank 119861 outputs two Licenses 1198711198781198790and 119871119878119879

1

Step 2 We randomly choose a bit 1198871015840 isin 0 1 and place(1198701198871015840 119871119878119879

1198871015840) and (119870

1minus1198871015840 119871119878119879

1minus1198871015840) on the private input tapes

of 1198621and 119862

2 respectively The bit 1198871015840 will not be disclosed to

the bank 119861

Step 3 The bank 119861 and two customers 1198621 1198622perform the

withdrawal protocol of the proposed scheme

Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840

1minus1198871015840) on their private tapes respectively we

give the two 3 tuples in a randomorder to the bank otherwiseperp is given to 119861

Step 5 The bank 119861 outputs 1198871015840lowast isin 0 1 as the guess of 1198871015840 119861wins the game if 1198871015840lowast = 1198871015840 We define the advantage of 119861 as

AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)

Definition 2 (unlinkability) The proposed scheme satisfiesthe unlinkability property if the advantage AdvTraceality

119861(120578) is

negligible

Theorem 3 The proposed scheme satisfies the unlinkabilityproperty

Proof ofTheorem3 Weconsider the condition inDefinition 1Let (1198711198781198791198701015840 1198781015840) be one of the two 119890-cash given to the bankand let (119870 ℎ 119878) be the view of the bank in one of thewithdrawal protocols It is sufficient to show that there existtwo random factors (119886 119888) that map (119870 ℎ 119878) to (1198711198781198791198701015840 1198781015840)We know

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)


So by equation 1198781015840 = 119886119878 there is a unique 119886 Then byequation ℎ = 119886

minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888

Furthermore when 119878 and 1198781015840 are correctly computed the

following equation holds

119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)

So it holds when 1198701015840 = 119886119870+119886119888119876119861 It is to say that (119886 119888) always

exists regardless of the values (1198711198781198791198701015840 1198781015840) and (119870 ℎ 119878)Therefore even an infinitely powerful bank outputs a correctvalue 1198871015840 with probability of exactly 12 So the proposedscheme satisfies the unlinkability property

Definition 4 (the forgeability game) The adversary F and thechallenger A play the following game

Step 1 The challenger A takes a security parameter andgenerates the public parameters params and sends params tothe adversary F

Step 2 The adversary F can perform polynomially boundednumber of hash queries extract queries and 119890-cash queriesThese three kinds of queries answer the hash function privatekey and 119890-cash query by the adversary F respectively

Step 3 The adversary F outputs a tuple 120590 = ((1198711198781198791198701015840

1198781015840) ID119861) This tuple satisfies the following requirements

(1) (1198711198781198791198701015840 1198781015840) is a valid 119890-cash with regard to the bank119861

(2) The adversary F has never requested the private keyof the bank 119861

(3) 120590 = ((1198711198781198791198701015840 1198781015840) ID119861) has never been queried

during the 119890-cash query

Definition 5 (unforgeability) An adversary F is said to bean (120576 119905 119902

119864 119902119868 119902119867)-forger if it has advantage at least 120576 in the

above game runs in time at most 119905 and makes at most 119902119864

119902119868 and 119902

119867extract 119890-cash and hashing queries respectively

A scheme is said to be (120576 119905 119902119864 119902119868 119902119867)-secure against A in the

sense of unforgeable against 119890-cash existential forgery attackif no (120576 119905 119902

119864 119902119868 119902119867)-forger exists

Theorem 6 If the CDH problem is hard then the proposedscheme is secure against 119890-cash existential forgery attack

Proof of Theorem 6 Suppose that F is a forger who can forge119890-cash in the proposed schemeACDH instance (119875 119909119875 119910119875) isgiven for 119909 119910 isin

119877119885lowast

119902 By using the forgery algorithm F we will

construct an algorithm A which outputs the CDH solution119909119910119875 in 119866 Algorithm A performs the following simulation byinteracting with the forger F

Setup Algorithm A sets 119875pub = 119909119875 and starts by giving F thesystem parameters including (119875 119875pub)

Table 1 Comparison of features of our schemewith recent schemes

F1 F2 F3 F4 F5 F6Chen et al [15] Yes Fail Yes Yes Yes FailFan et al [18] Yes Yes No Yes Yes NoJuang [19] Yes Yes Yes Yes No NoZhang et al [20] Yes Yes Yes No No NoOurs Yes Yes Yes Yes Yes YesF1 anonymityunlinkability F2 unforgeability F3 verification F4 double-spending owner tracing F5 anonymity revocation F6 uncheatability ofmerchant

Table 2 Required number of rounds for each protocol in comparedschemes

P1 P2 P3 P4 P5Chen et al [15] 2 2 1 1 1Fan et al [18] mdash 4 3 1 mdashJuang [19] 3 3 1 1 2Zhang et al [20] mdash 3 2 1 mdashOurs 2 4 3 1 1P1 license-issuing protocol P2 withdrawal protocol P3 payment protocolP4 deposit protocol P5 owner tracing

At any time F can query the random oracle 1198671 1198672and

extract and cash queries To answer these queries A does thefollowing

1198671-Queries At any time F can query the random oracle 119867

1

To respond to these queries A maintains a list 1198671-list of

tuples (ID119882 119905 119890) as explained below When an identity IDis submitted to the 119867

1oracle A responds as follows If the

query ID already appears on the1198671-list in a tuple (ID119882 119905 119890)

A responds with 1198671(ID) = 119882 Otherwise A generates a

random coin 119890 isin 0 1 If 119890 = 0 then A computes119882 = 119905(119910119875)

for a random 119905 isin 119885lowast

119902 If 119890 = 1 then A computes119882 = 119905119875 A

adds the tuple (ID119882 119905 119890) to 1198671-list and responds to F with

1198671(ID) = 119882

1198672-Queries To respond to 119867

2-Queries A maintains a list

referred to as1198672-list of tuples (119871119878119879 1198701015840 119889) When F queries

the 1198672oracle at (119871119878119879 119870

1015840) A responds as follows If the

query (119871119878119879 1198701015840) already appears on the 119867

2-list in a tuple

(119871119878119879 1198701015840 119889) then A responds with119867

2(119871119878119879 119870

1015840) = 119889 isin 119885

119902

Otherwise A generates a random 119889 isin 119885119902and adds the tuples

(119871119878119879 1198701015840 119889) to 119867

2-list and responds to F with 119867

2(119871119878119879

1198701015840) = 119889

Extract Queries When F queries the private key correspond-ing to ID A first finds the corresponding (ID119882 119905 119890) fromthe 119867

1-list If 119890 = 0 then A fails and halts Otherwise A

computes the private key 119878ID = 119905 sdot 119875pub = 119905(119909119875) by using thetuple (ID119882 119905 119890) in the119867

1-list and responds to F with 119878ID

Cash Queries If F requests an 119890-cash on 119871119878119879 under ID Aresponds to this query as follows A first finds the corre-sponding tuple (ID119882 119905 119890) from 119867

1-list and chooses one

random number 119897 119889 isin 119885lowast

119902and computes 1198701015840 = 119897119875 minus 119889119882


Table 3 Comparison of computation costs

P1 P2 P3 P4 P5Chen et al [15] E + 2H + 3B 4H + 6B H + 3B H + 3B DZhang et al [20] mdash 2H + 2B + L 2H + 3B 2H + 3B mdashOurs E + 4H + 5B + 2L 2H + 4B 4H + 9B 2H + 8B DP1 license-issuing protocol P2 withdrawal protocol P3 payment protocol P4 deposit protocol P5 owner tracingE symmetrical encryption D symmetrical decryption H hash computation B bilinear pairings L modular exponentiation

If (119871119878119879 1198701015840 119889) already appears on the 119867

2-list A chooses

another 119897 119889 isin 119885lowast

119902and tries again Otherwise A computes

1198781015840= 119897 sdot 119875pub and stores (119871119878119879 119870

1015840 119889) on the 119867

2-list Then A

responds to F with (1198781015840 1198701015840) Indeed the output is valid 119890-cashon 119871119878119879 for ID In fact

119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)

Output If A does not abort as a result of Frsquos extract querythen Frsquos view is identical to its view in the real attack ByForking Lemma after replying F with the same random tapeA obtains two valid 119890-cash

(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)

Correspondingly there are two valid signatures (119878 119870) and(119878lowast 119870) because

119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)

So by the security proof of [22] A obtains (119909119910)119875 = 119878119861=

(ℎ minus ℎlowast)minus1(119878 minus 119878

lowast)

This completes the proof

9 Comparisons

In this section we compare our scheme with [15 18ndash20] insome features communication efficiency and computationcost The features are anonymityunlinkability unforgeabil-ity verification double-spending owner tracing anonymityrevocation and uncheatability of merchant Our schemesatisfies all of above features but the others do not We showthe comparison result in Table 1 In Table 2 we compare thecommunication efficiency of our schemewith other schemesFan et alrsquos scheme [18] and Zhang et alrsquos scheme [20] are nottrustee based and therefore they do not have license-issuingprotocol and owner tracing protocol Juangrsquos scheme [19] alsodoes not have license-issuing protocol and owner tracingprotocol but has the initializing phase and recovering phaseFor comparison the numbers of rounds of initializing phase

and recovering phase in Juangrsquos scheme are computed tolicense-issuing protocol and owner tracing protocol respec-tively By Table 2 the proposed scheme demonstrates bettercommunication efficiency under enhanced security Ourscheme and schemes [15 20] are all id-based scheme usingbilinear pairings So in Table 3 we compare the computationcost of our scheme with schemes [15 20] It is necessary toillustrate that Zhang et alrsquos scheme [20] has no license-issuingprotocol and owner tracing protocol and for fair comparisonwe have not computed the computation cost of encryptionand its related computation cost in Chen et alrsquos schemeCompared with Chen et alrsquos scheme there are eleven morepairings computations in the proposed scheme These elevenpairings computations are in payment protocol and depositprotocol and useful to prevent the merchant from cheatIn practice we can use elliptic curves to reduce the computa-tion cost of bilinear pairings

10 Conclusion

In this paper we show thatChen et alrsquos electronic cash schemeis suffering from some weaknesses in unforgeability andmerchant frauds To contribute a secure scheme we proposea new offline electronic cash scheme with anonymity revo-cation We also provide the formally security proofs of theunlinkability and unforgeability Furthermore the proposedscheme ensures the property of avoiding merchant frauds

Competing Interests

The authors declare that they have no competing interests

Acknowledgments

This work is supported by the Applied Basic and AdvancedTechnology Research Programs of Tianjin (no 15JCY-BJC15900)

References

[1] D Chaum ldquoBlind signatures for untraceable paymentsrdquo inCrypto 82 pp 199ndash203 Plenum Press New York NY USA1983

[2] Z Eslami and M Talebi ldquoA new untraceable off-line electroniccash systemrdquo Electronic Commerce Research and Applicationsvol 10 no 1 pp 59ndash66 2011

[3] R Anderson C Manifavas and C Sutherland ldquoNetCardmdasha practical electronic-cash systemrdquo in Security Protocols vol


1189 of Lecture Notes in Computer Science pp 49ndash57 SpringerBerlin Germany 1997

[4] G Davida Y Frankel Y Tsiounis and M Yung ldquoAnonymitycontrol in e-cash systemsrdquo in Financial Cryptography vol 1318of Lecture Notes in Computer Science pp 1ndash16 Springer BerlinGermany 1997

[5] GMaitland andC Boyd ldquoFair electronic cash based on a groupsignature schemerdquo in Information and Communication Securitypp 461ndash465 Springer 2001

[6] D Chaum and S Brands ldquolsquoMintingrsquo electronic cashrdquo IEEESpectrum vol 34 no 2 pp 30ndash34 1997

[7] J Camenisch S Hohenberger and A Lysyanskaya ldquoCompacte-cashrdquo in Advances in CryptologymdashEUROCRYPT 2005 RCramer Ed vol 3494 of Lecture Notes in Computer Science pp302ndash321 Springer 2005

[8] H Wang and Y Zhang ldquoUntraceable off-line electronic cashflow in e-commercerdquo in Proceedings of the 24th AustralasianComputer Science Conference (ACSC rsquo01) pp 191ndash198 IEEEGold Coast Australia January-February 2001

[9] S Brands ldquoUntraceable off-line cash in wallet with observersrdquoinAdvances in CryptologymdashCRYPTO rsquo93 pp 302ndash318 Springer1994

[10] C-Y Ku C-J Tsao Y-H Lin and C-Y Chen ldquoAn escrowelectronic cash system with limited traceabilityrdquo InformationSciences vol 164 no 1ndash4 pp 17ndash30 2004

[11] T Cao D Lin and R Xue ldquoA randomized RSA-based partiallyblind signature scheme for electronic cashrdquo Computers ampSecurity vol 24 no 1 pp 44ndash49 2005

[12] W-S Juang ldquoD-cash a flexible pre-paid e-cash scheme for date-attachmentrdquo Electronic Commerce Research and Applicationsvol 6 no 1 pp 74ndash80 2007

[13] C Fan and W Sun ldquoEfficient encoding scheme for date attach-able electronic cashrdquo in Proceedings of the 24th Workshop onCombinatorial Mathematics and Computation Theory (CMCTrsquo07) pp 405ndash410 Nantou Taiwan 2007

[14] Y Baseri B Takhtaei and J Mohajeri ldquoSecure untraceable off-line electronic cash systemrdquo Scientia Iranica vol 20 no 3 pp637ndash646 2013

[15] Y Chen J-S Chou H-M Sun and M-H Cho ldquoA novel elec-tronic cash system with trustee-based anonymity revocationfrom pairingrdquo Electronic Commerce Research and Applicationsvol 10 no 6 pp 673ndash682 2011

[16] Y-F Chang ldquoA critique of lsquoa novel electronic cash system withtrustee-based anonymity revocation from pairingrsquo by ChenChou Sun and Cho (2011)rdquo Electronic Commerce Research andApplications vol 11 no 4 pp 441ndash442 2012

[17] Y L Chen J-S ChouH-M Sun andM-S Cho ldquoA response toa critique of lsquoA novel electronic cash system with trustee-basedanonymity revocation from pairingrsquo by Chen Chou Sun andCho (2011)rdquo Electronic Commerce Research and Applicationsvol 11 no 4 pp 443ndash444 2012

[18] C-I Fan V S Huang and Y-C Yu ldquoUser efficient recoverableoff-line e-cash scheme with fast anonymity revokingrdquo Mathe-matical and Computer Modelling vol 58 no 1-2 pp 227ndash2372013

[19] W-S Juang ldquoRO-cash an efficient and practical recoverablepre-paid offline e-cash scheme using bilinear pairingsrdquo Journalof Systems and Software vol 83 no 4 pp 638ndash645 2010

[20] L Zhang F Zhang B Qin and S Liu ldquoProvably-secure elec-tronic cash based on certificateless partially-blind signaturesrdquoElectronic Commerce Research and Applications vol 10 no 5pp 545ndash552 2011

[21] F Hess ldquoEfficient identity based signature schemes based onpairingsrdquo in Selected Areas in Cryptography 9th Annual Inter-nationalWorkshop SAC 2002 St Johnrsquos Newfoundland CanadaAugust 15-16 2002 Revised Papers vol 2595 of Lecture Notes inComputer Science pp 310ndash324 Springer BerlinGermany 2003

[22] F Zhang and F Kim ldquoEfficient ID-based blind signature andproxy signature from bilinear pairingsrdquo in Proceedings of the8thAustralasianConference on Information Security and Privacy(ACISP rsquo03) Wollongong Australia July 2003 Lecture Notes inComputer Science pp 312ndash323 Springer 2003

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014


Distributed Sensor Networks


Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014


ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014


Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014


Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications


Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia


Biomedical Imaging


ArtificialNeural Systems

Advances in


RoboticsJournal of



Computational Intelligence and Neuroscience

Industrial EngineeringJournal of


Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014


Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in



[14] showed that Eslami and Talebirsquos scheme is subjectedto some weaknesses in perceptibility of double spenderunforgeability and date attachability Baseri et al also con-tributed a novel electronic cash scheme

Untraceable electronic cash is an attractive payment toolfor electronic commerce because its anonymity propertycan ensure the privacy of payers However this anonymityproperty is easily abused by criminals In 2011 Chen et al[15] proposed an electronic cash system with trustee-basedanonymity revocation from pairing On demand the trusteecan disclose the identity of the owner of an 119890-cash Chen etal claimed that their scheme is the first attempt to incor-porate mutual authentication and key agreement into 119890-cashprotocols and their scheme satisfies the security requirementsof untraceability verifiability unforgeability and anonymityrevocation But in 2012 Chang [16] claimed that he findssomeweaknesses ofChen et alrsquos schemeThenChen et al [17]immediately provided a response to rebut Changrsquos attacksBy thoroughly investigating Chen et alrsquos scheme we findthat despite Changrsquos attacks being really wrong Chen et alrsquosscheme is surely insecure Chen et alrsquos scheme is subjected tosomedrawbacks (1)Thefirst flaw is the attack on the unforge-ability by the dishonest customer (2) The second flaw is theattack on double spending owner tracing (3) The third flawis the potential bank attack

To contribute secure electronic cash schemes we proposea new offline electronic cash scheme with anonymity revoca-tion Furthermore the proposed scheme ensures the propertyof avoiding merchant frauds

The remainder of this paper is organized as followsRelated concept of bilinear pairing and CDH problem areintroduced in Section 2 In Section 3 we show some weak-nesses of Chen et alrsquos scheme In Section 4 we propose anew electronic cash scheme with anonymity revocation InSection 5 we show the verifiability of the proposed schemeDouble spender detection is covered in Section 6 In Section 7we show that the proposed scheme satisfies uncheatability ofmerchants Provable security of our scheme is covered in Sec-tion 8 In Section 9 we compare our scheme with the othersFinally conclusions are given in Section 10

2 Preliminary

21 The Bilinear Pairing Let 1198661be a cyclic additive group

generated by119875 whose order is a prime 119902 and let1198662be a cyclic

multiplicative group of the same order Let 119890 1198661times 1198661rarr 1198662

be a pairing map which satisfies the following conditions

(1) Bilinearity for any119875119876 119877 isin 1198661 we have 119890(119875+119876 119877) =

119890(119875 119877)119890(119876 119877)

In particular for any 119886 119887 isin 119885119902 119890(119886119875 119887119875) = 119890(119875

119886119887119875) = 119890(119886119887119875 119875) = 119890(119875 119875)119886119887

(2) Nondegeneracy there exists 119875119876 isin 1198661 such that

119890(119875 119876) = 1

(3) Computability there is an efficient algorithm tocompute 119890(119875 119876) for all 119875119876 isin 119866

1

22 The CDH Problem Let 119866 be a cyclic additive group ofprime order 119902 and 119875 a generator of 119866 The computationalDiffie-Hellman (CDH) problem is to compute 119886119887119875 for given119875 119886119875 119887119875 isin 119866

3 Effective Attacks on Chen et alrsquos Scheme

In this section we show the drawbacks of Chen et alrsquos scheme[15] For the sake of brevity we omit the review of Chen et alrsquosscheme To know Chen et alrsquos scheme in detail readers canread literature [15]

31 Attack on the Unforgeability by the Dishonest CustomerWhen the customer obtains an 119890-cash 119862119873119874 119871119878119879 (119877 119878) hecan randomly select 119886 isin 119885lowast

119902and forge 119890-cash 119862119873119874 119886 sdot 119871119878119879

(119886 sdot 119877 119886 sdot 119878) because the 119890-cash 119862119873119874 119871119878119879 (119877 119878) satisfies

119890 (119878 119875) = 119890 (1198673(CNO) 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (1)

So

119890 (119878 119875)119886= 119890 (119867

3(CNO) 119876

119861 119877)119886

sdot 119890 (LST sdot 119876119861 119875pub)

119886

(2)

Then

119890 (119886 sdot 119878 119875) = 119890 (1198673(CNO) 119876

119861 119886 sdot 119877)

sdot 119890 (119886 sdot LST sdot 119876119861 119875pub)

(3)

That is to say the customer forges a valid 119890-cash 119862119873119874 119886 sdot119871119878119879 (119886 sdot 119877 119886 sdot 119878)

Of course in payment protocol when the merchant getsan 119890-cash from customers he also can similarly forge 119890-cashFurther these forged 119890-cash make the scheme fail in doublespending owner tracing because it is impossible to find thecustomer identity from 119886 sdot 119871119878119879

Note that (119877 119878) is a signature on 119862119873119874 and 119871119878119879 Further-more 119862119873119874 does not play distinction function to an 119890-cash119862119873119874 is only a randomly selected number Any customer canrandomly choose any119862119873119874 for their 119890-cash If119862119873119874 has somefunction it is only to certain customer It is not strange thatdifferent customers may choose same 119862119873119874 for their 119890-cashSo this attack is a successful forgery

32 Attack by the Dishonest Merchant In practice there arealways many merchants from different shops After receivingan 119890-cash 119862119873119874 119871119878119879 (119877 119878) from a customer the merchantmay spend 119862119873119874 119871119878119879 (119877 119878) to another merchant Thisattack is correct due to the fact that the verification equation

119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (4)

is only related to 119862119873119874 119871119878119879 119877 119878 And no extra informationshould be provided by customers in the verification processLater even if the bank finds double spending the bank andthe trustee cannot find real double spender because thedouble spender may not be the customer himself



119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (5)



119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119886119875pub)

sdot 119890 (LST sdot 119876119861 119875pub)

= 119890 (119886 sdot 1198673(CNO) sdot 119876

119861 119875pub)

sdot 119890 (LST sdot 119876119861 119875pub)

= 119890 ((119886 sdot 1198673(CNO) + LST) sdot 119876

119861 119875pub)

= 119890 ((119886 sdot 1198673(CNO) + LST) sdot 119878

119861 119875)

(6)






1which is generated



1times1198661rarr


lowast



1 0 1

lowastrarr 11986611198672 0 1


119902 The system







respectively





119902 and sends ID

119862 119887 119911 119908

1 1199082 to Trustee 119879


119902 and computes




119902 and computes

119877 = 119890 (119875 119875)119903

119906 = 1198672(119887minus1LST 119877)

119881 = 119906119878119879+ 119903119875

(7)


1=

(119887119911 + 119911)119875pub 1198602 = (1199081+ 1199082)119875pub 1198603 = 119908

1119875pub and 1198604 =


119884 = 119890 (119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

119865 = 119889119878119879+ 119910119875

(8)



1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

(9)

and checks whether

119906 = 1198672(119887minus1119871119878119879 119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(10)


1+ 1198602+ 1198603+ 1198604




1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1 (11)

and checks whether

119906 = 1198672(119887minus1119871119878119879 119877

1015840) (12)


119902




1 1199082isin 119885lowast

119902

ID1198621198871199111199081 1199082997888997888997888997888997888997888997888997888997888997888997888rarr


lowast

119902 computes

119871119878119879 = 119864119870119879(ID119862oplus 119909)


lowast

119902 computes

119877 = 119890(119875 119875)119903

119906 = 1198672(119887minus1119871119878119879119877)

119881 = 119906119878119879+ 119903119875


lowast

119902 and computes

119884 = 119890(119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)119884)

119865 = 119889119878119879+ 119910119875

(119871119878119879119906119881119889119865)

larr997888997888997888997888997888997888997888997888997888

Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1

1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2(119887minus1119871119878119879119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)


1+ 1198602+ 1198603+ 1198604



Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1


2(119887minus1119871119878119879119877

1015840)


lowast

119902 computes

119870 = 119896119876119861

119870

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888


lowast

119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879119870

1015840) + 119888

ℎ

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes119878 = (119896 + ℎ)119878

119861

119878

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198781015840= 119886119878

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840119876119861 119875pub)

Obtains an 119890-cash (1198711198781198791198701015840 1198781015840)




10158401198781015840)

997888997888997888997888997888997888997888997888rarr

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)


119902 computes

119871 = 119890(119875 119875)119897

119895 = 1198672(119871119878119879119870

10158401198781015840119871)

119863 = 119895119878119872+ 119897119875

(119895119863)

larr997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198711015840= 119890(119863 119875)119890(119895119876

119872 119875pub)

minus1


2(119871119878119879119870

101584011987810158401198711015840)

Computes1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(1198911 1198912 1198601 1198602 1198603 1198604 119895119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr


Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Accepts the payment



119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879 119870

1015840) + 119888

(13)


119878 = (119896 + ℎ) 119878119861 (14)


1198781015840= 119886119878 (15)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (16)




119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (17)


119871 = 119890 (119875 119875)119897

119895 = 1198672(LST 1198701015840 1198781015840 119871)

119863 = 119895119878119872+ 119897119875

(18)


1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1 (19)

and checks whether

119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (20)

If so he computes

1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(21)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602) (22)


Merchant Bank(119871119878119879119870

101584011987810158401198911 1198912 1198951198601 1198602 1198603 1198604 119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

119890(1198911119876119879 119875pub) = 119890(119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)



and computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (23)

and checks whether

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (24)




1198603 1198604 119889 119865) to the bank 119861


1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (25)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(26)








119906 = 1198672(119887minus1LST 1198771015840) (27)

Since

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

= 119890 (119881 119875) 119890 (minus119906119878119879 119875)

= 119890 (119881 minus 119906119878119879 119875) = 119890 (119903119875 119875) = 119877

(28)

119906 = 1198672(119887minus1119871119878119879 119877) = 119867

2(119887minus1119871119878119879 119877

1015840)


119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (29)

In fact

119890 (1198781015840 119875) = 119890 (119886119878 119875) = 119890 (119886 (119896 + ℎ) 119878

119861 119875)

= 119890 (119886 (119896 + 119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

= 119890 (119886119896119876119861+ 119886119888119876

119861+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(30)


119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (31)

Since

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1

= 119890 (119863 119875) 119890 (minus119895119878119872 119875)

= 119890 (119863 minus 119895119878119872 119875) = 119890 (119897119875 119875) = 119871

(32)

119895 = 1198672(119871119878119879 119870

1015840 1198781015840 119871) = 119867

2(119871119878119879 119870

1015840 1198781015840 1198711015840)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

(33)


In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)



119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)



119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)




Here (1198911 1198912) and (1198911015840

1 1198911015840



1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)








1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-




8 Provable Security



1and119862





1


1198871015840) and (119870

1minus1198871015840 119871119878119879


of 1198621and 119862


the bank 119861



Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840




AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)


119861(120578) is

negligible



1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)



minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in





119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119877) sdot 119890 (LST sdot 119876

119861 119875pub) (5)



119890 (119878 119875) = 119890 (1198673(CNO) sdot 119876

119861 119886119875pub)

sdot 119890 (LST sdot 119876119861 119875pub)

= 119890 (119886 sdot 1198673(CNO) sdot 119876

119861 119875pub)

sdot 119890 (LST sdot 119876119861 119875pub)

= 119890 ((119886 sdot 1198673(CNO) + LST) sdot 119876

119861 119875pub)

= 119890 ((119886 sdot 1198673(CNO) + LST) sdot 119878

119861 119875)

(6)






1which is generated



1times1198661rarr


lowast



1 0 1

lowastrarr 11986611198672 0 1


119902 The system







respectively





119902 and sends ID

119862 119887 119911 119908

1 1199082 to Trustee 119879


119902 and computes




119902 and computes

119877 = 119890 (119875 119875)119903

119906 = 1198672(119887minus1LST 119877)

119881 = 119906119878119879+ 119903119875

(7)


1=

(119887119911 + 119911)119875pub 1198602 = (1199081+ 1199082)119875pub 1198603 = 119908

1119875pub and 1198604 =


119884 = 119890 (119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

119865 = 119889119878119879+ 119910119875

(8)



1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

(9)

and checks whether

119906 = 1198672(119887minus1119871119878119879 119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(10)


1+ 1198602+ 1198603+ 1198604




1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1 (11)

and checks whether

119906 = 1198672(119887minus1119871119878119879 119877

1015840) (12)


119902




1 1199082isin 119885lowast

119902

ID1198621198871199111199081 1199082997888997888997888997888997888997888997888997888997888997888997888rarr


lowast

119902 computes

119871119878119879 = 119864119870119879(ID119862oplus 119909)


lowast

119902 computes

119877 = 119890(119875 119875)119903

119906 = 1198672(119887minus1119871119878119879119877)

119881 = 119906119878119879+ 119903119875


lowast

119902 and computes

119884 = 119890(119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)119884)

119865 = 119889119878119879+ 119910119875

(119871119878119879119906119881119889119865)

larr997888997888997888997888997888997888997888997888997888

Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1

1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2(119887minus1119871119878119879119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)


1+ 1198602+ 1198603+ 1198604



Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1


2(119887minus1119871119878119879119877

1015840)


lowast

119902 computes

119870 = 119896119876119861

119870

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888


lowast

119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879119870

1015840) + 119888

ℎ

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes119878 = (119896 + ℎ)119878

119861

119878

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198781015840= 119886119878

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840119876119861 119875pub)

Obtains an 119890-cash (1198711198781198791198701015840 1198781015840)




10158401198781015840)

997888997888997888997888997888997888997888997888rarr

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)


119902 computes

119871 = 119890(119875 119875)119897

119895 = 1198672(119871119878119879119870

10158401198781015840119871)

119863 = 119895119878119872+ 119897119875

(119895119863)

larr997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198711015840= 119890(119863 119875)119890(119895119876

119872 119875pub)

minus1


2(119871119878119879119870

101584011987810158401198711015840)

Computes1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(1198911 1198912 1198601 1198602 1198603 1198604 119895119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr


Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Accepts the payment



119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879 119870

1015840) + 119888

(13)


119878 = (119896 + ℎ) 119878119861 (14)


1198781015840= 119886119878 (15)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (16)




119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (17)


119871 = 119890 (119875 119875)119897

119895 = 1198672(LST 1198701015840 1198781015840 119871)

119863 = 119895119878119872+ 119897119875

(18)


1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1 (19)

and checks whether

119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (20)

If so he computes

1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(21)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602) (22)


Merchant Bank(119871119878119879119870

101584011987810158401198911 1198912 1198951198601 1198602 1198603 1198604 119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

119890(1198911119876119879 119875pub) = 119890(119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)



and computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (23)

and checks whether

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (24)




1198603 1198604 119889 119865) to the bank 119861


1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (25)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(26)








119906 = 1198672(119887minus1LST 1198771015840) (27)

Since

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

= 119890 (119881 119875) 119890 (minus119906119878119879 119875)

= 119890 (119881 minus 119906119878119879 119875) = 119890 (119903119875 119875) = 119877

(28)

119906 = 1198672(119887minus1119871119878119879 119877) = 119867

2(119887minus1119871119878119879 119877

1015840)


119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (29)

In fact

119890 (1198781015840 119875) = 119890 (119886119878 119875) = 119890 (119886 (119896 + ℎ) 119878

119861 119875)

= 119890 (119886 (119896 + 119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

= 119890 (119886119896119876119861+ 119886119888119876

119861+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(30)


119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (31)

Since

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1

= 119890 (119863 119875) 119890 (minus119895119878119872 119875)

= 119890 (119863 minus 119895119878119872 119875) = 119890 (119897119875 119875) = 119871

(32)

119895 = 1198672(119871119878119879 119870

1015840 1198781015840 119871) = 119867

2(119871119878119879 119870

1015840 1198781015840 1198711015840)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

(33)


In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)



119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)



119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)




Here (1198911 1198912) and (1198911015840

1 1198911015840



1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)








1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-




8 Provable Security



1and119862





1


1198871015840) and (119870

1minus1198871015840 119871119878119879


of 1198621and 119862


the bank 119861



Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840




AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)


119861(120578) is

negligible



1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)



minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in





1 1199082isin 119885lowast

119902

ID1198621198871199111199081 1199082997888997888997888997888997888997888997888997888997888997888997888rarr


lowast

119902 computes

119871119878119879 = 119864119870119879(ID119862oplus 119909)


lowast

119902 computes

119877 = 119890(119875 119875)119903

119906 = 1198672(119887minus1119871119878119879119877)

119881 = 119906119878119879+ 119903119875


lowast

119902 and computes

119884 = 119890(119875 119875)119910

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)119884)

119865 = 119889119878119879+ 119910119875

(119871119878119879119906119881119889119865)

larr997888997888997888997888997888997888997888997888997888

Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1

1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2(119887minus1119871119878119879119877

1015840)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)


1+ 1198602+ 1198603+ 1198604



Computes1198771015840= 119890(119881 119875)119890(119906119876

119879 119875pub)

minus1


2(119887minus1119871119878119879119877

1015840)


lowast

119902 computes

119870 = 119896119876119861

119870

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888


lowast

119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879119870

1015840) + 119888

ℎ

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes119878 = (119896 + ℎ)119878

119861

119878

larr997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198781015840= 119886119878

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840119876119861 119875pub)

Obtains an 119890-cash (1198711198781198791198701015840 1198781015840)




10158401198781015840)

997888997888997888997888997888997888997888997888rarr

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)


119902 computes

119871 = 119890(119875 119875)119897

119895 = 1198672(119871119878119879119870

10158401198781015840119871)

119863 = 119895119878119872+ 119897119875

(119895119863)

larr997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198711015840= 119890(119863 119875)119890(119895119876

119872 119875pub)

minus1


2(119871119878119879119870

101584011987810158401198711015840)

Computes1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(1198911 1198912 1198601 1198602 1198603 1198604 119895119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr


Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Accepts the payment



119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879 119870

1015840) + 119888

(13)


119878 = (119896 + ℎ) 119878119861 (14)


1198781015840= 119886119878 (15)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (16)




119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (17)


119871 = 119890 (119875 119875)119897

119895 = 1198672(LST 1198701015840 1198781015840 119871)

119863 = 119895119878119872+ 119897119875

(18)


1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1 (19)

and checks whether

119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (20)

If so he computes

1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(21)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602) (22)


Merchant Bank(119871119878119879119870

101584011987810158401198911 1198912 1198951198601 1198602 1198603 1198604 119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

119890(1198911119876119879 119875pub) = 119890(119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)



and computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (23)

and checks whether

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (24)




1198603 1198604 119889 119865) to the bank 119861


1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (25)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(26)








119906 = 1198672(119887minus1LST 1198771015840) (27)

Since

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

= 119890 (119881 119875) 119890 (minus119906119878119879 119875)

= 119890 (119881 minus 119906119878119879 119875) = 119890 (119903119875 119875) = 119877

(28)

119906 = 1198672(119887minus1119871119878119879 119877) = 119867

2(119887minus1119871119878119879 119877

1015840)


119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (29)

In fact

119890 (1198781015840 119875) = 119890 (119886119878 119875) = 119890 (119886 (119896 + ℎ) 119878

119861 119875)

= 119890 (119886 (119896 + 119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

= 119890 (119886119896119876119861+ 119886119888119876

119861+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(30)


119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (31)

Since

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1

= 119890 (119863 119875) 119890 (minus119895119878119872 119875)

= 119890 (119863 minus 119895119878119872 119875) = 119890 (119897119875 119875) = 119871

(32)

119895 = 1198672(119871119878119879 119870

1015840 1198781015840 119871) = 119867

2(119871119878119879 119870

1015840 1198781015840 1198711015840)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

(33)


In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)



119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)



119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)




Here (1198911 1198912) and (1198911015840

1 1198911015840



1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)








1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-




8 Provable Security



1and119862





1


1198871015840) and (119870

1minus1198871015840 119871119878119879


of 1198621and 119862


the bank 119861



Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840




AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)


119861(120578) is

negligible



1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)



minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in





10158401198781015840)

997888997888997888997888997888997888997888997888rarr

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)


119902 computes

119871 = 119890(119875 119875)119897

119895 = 1198672(119871119878119879119870

10158401198781015840119871)

119863 = 119895119878119872+ 119897119875

(119895119863)

larr997888997888997888997888997888997888997888997888997888997888997888997888997888

Computes1198711015840= 119890(119863 119875)119890(119895119876

119872 119875pub)

minus1


2(119871119878119879119870

101584011987810158401198711015840)

Computes1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(1198911 1198912 1198601 1198602 1198603 1198604 119895119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr


Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1


2((1198601+ 1198602+ 1198603+ 1198604)1198841015840)

Accepts the payment



119902 computes

1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(119871119878119879 119870

1015840) + 119888

(13)


119878 = (119896 + ℎ) 119878119861 (14)


1198781015840= 119886119878 (15)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (16)




119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (17)


119871 = 119890 (119875 119875)119897

119895 = 1198672(LST 1198701015840 1198781015840 119871)

119863 = 119895119878119872+ 119897119875

(18)


1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1 (19)

and checks whether

119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (20)

If so he computes

1198911= 119887119895119911 + 119908

1

1198912= 119895119911 + 119908

2

(21)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602) (22)


Merchant Bank(119871119878119879119870

101584011987810158401198911 1198912 1198951198601 1198602 1198603 1198604 119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

119890(1198911119876119879 119875pub) = 119890(119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)



and computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (23)

and checks whether

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (24)




1198603 1198604 119889 119865) to the bank 119861


1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (25)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(26)








119906 = 1198672(119887minus1LST 1198771015840) (27)

Since

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

= 119890 (119881 119875) 119890 (minus119906119878119879 119875)

= 119890 (119881 minus 119906119878119879 119875) = 119890 (119903119875 119875) = 119877

(28)

119906 = 1198672(119887minus1119871119878119879 119877) = 119867

2(119887minus1119871119878119879 119877

1015840)


119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (29)

In fact

119890 (1198781015840 119875) = 119890 (119886119878 119875) = 119890 (119886 (119896 + ℎ) 119878

119861 119875)

= 119890 (119886 (119896 + 119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

= 119890 (119886119896119876119861+ 119886119888119876

119861+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(30)


119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (31)

Since

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1

= 119890 (119863 119875) 119890 (minus119895119878119872 119875)

= 119890 (119863 minus 119895119878119872 119875) = 119890 (119897119875 119875) = 119871

(32)

119895 = 1198672(119871119878119879 119870

1015840 1198781015840 119871) = 119867

2(119871119878119879 119870

1015840 1198781015840 1198711015840)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

(33)


In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)



119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)



119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)




Here (1198911 1198912) and (1198911015840

1 1198911015840



1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)








1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-




8 Provable Security



1and119862





1


1198871015840) and (119870

1minus1198871015840 119871119878119879


of 1198621and 119862


the bank 119861



Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840




AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)


119861(120578) is

negligible



1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)



minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in




Merchant Bank(119871119878119879119870

101584011987810158401198911 1198912 1198951198601 1198602 1198603 1198604 119889119865)

997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr

Computes1198841015840= 119890(119865 119875)119890(119889119876

119879 119875pub)

minus1

Checks whether119890(1198781015840 119875) = 119890(119870

1015840+ 1198672(119871119878119879119870

1015840)119876119861 119875pub)

119890((1198911+ 1198912)119876119879 119875pub) = 119890(119876119879 1198951198601 + 1198602)

119890(1198911119876119879 119875pub) = 119890(119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604)1198841015840)



and computes

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (23)

and checks whether

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (24)




1198603 1198604 119889 119865) to the bank 119861


1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1 (25)

and checks whether

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(26)








119906 = 1198672(119887minus1LST 1198771015840) (27)

Since

1198771015840= 119890 (119881 119875) 119890 (119906119876

119879 119875pub)

minus1

= 119890 (119881 119875) 119890 (minus119906119878119879 119875)

= 119890 (119881 minus 119906119878119879 119875) = 119890 (119903119875 119875) = 119877

(28)

119906 = 1198672(119887minus1119871119878119879 119877) = 119867

2(119887minus1119871119878119879 119877

1015840)


119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub) (29)

In fact

119890 (1198781015840 119875) = 119890 (119886119878 119875) = 119890 (119886 (119896 + ℎ) 119878

119861 119875)

= 119890 (119886 (119896 + 119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

= 119890 (119886119896119876119861+ 119886119888119876

119861+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(30)


119895 = 1198672(LST 1198701015840 1198781015840 1198711015840) (31)

Since

1198711015840= 119890 (119863 119875) 119890 (119895119876

119872 119875pub)

minus1

= 119890 (119863 119875) 119890 (minus119895119878119872 119875)

= 119890 (119863 minus 119895119878119872 119875) = 119890 (119897119875 119875) = 119871

(32)

119895 = 1198672(119871119878119879 119870

1015840 1198781015840 119871) = 119867

2(119871119878119879 119870

1015840 1198781015840 1198711015840)



119890 ((1198911+ 1198912) 119876119879 119875pub) = 119890 (119876119879 1198951198601 + 1198602)

119890 (1198911119876119879 119875pub) = 119890 (119876119879 1198603 + 1198951198604)

(33)


In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)



119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)



119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)




Here (1198911 1198912) and (1198911015840

1 1198911015840



1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)








1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-




8 Provable Security



1and119862





1


1198871015840) and (119870

1minus1198871015840 119871119878119879


of 1198621and 119862


the bank 119861



Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840




AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)


119861(120578) is

negligible



1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)



minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in




In fact

119890 ((1198911+ 1198912) 119876119879 119875pub)

= 119890 ((119887119895119911 + 1199081+ 119895119911 + 119908

2) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879+ (1199081+ 1199082) 119876119879 119875pub)

= 119890 ((119887119895119911 + 119895119911)119876119879 119875pub) 119890 ((1199081 + 1199082) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119895119911) 119875pub) 119890 (119876119879 (1199081 + 1199082) 119875pub)

= 119890 (119876119879 1198951198601) 119890 (119876119879 1198602) = 119890 (119876

119879 1198951198601+ 1198602)

119890 (1198911119876119879 119875pub) = 119890 ((119887119895119911 + 1199081) 119876119879 119875pub)

= 119890 (119876119879 (119887119895119911 + 119908

1) 119875pub) = (119876119879 1198603 + 1198951198604)

(34)



119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840) (35)

Since

1198841015840= 119890 (119865 119875) 119890 (119889119876

119879 119875pub)

minus1

= 119890 (119865 119875) 119890 (minus119889119878119879 119875)

= 119890 (119865 minus 119889119878119879 119875) = 119890 (119910119875 119875) = 119884

119889 = 1198672((1198601+ 1198602+ 1198603+ 1198604) 119884)

= 1198672((1198601+ 1198602+ 1198603+ 1198604) 1198841015840)

(36)



119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

119887minus1119871119878119879

(37)




Here (1198911 1198912) and (1198911015840

1 1198911015840



1198911= 1198871198951119911 + 1199081

1198911015840

1= 1198871198952119911 + 1199081

1198912= 1198951119911 + 1199082

1198911015840

2= 1198952119911 + 1199082

(38)

So

119887 =

1198911minus 1198911015840

1

1198912minus 1198911015840

2

(39)








1 1198912 1198601 1198602 1198603 1198604 119889 119865) to the mer-




8 Provable Security



1and119862





1


1198871015840) and (119870

1minus1198871015840 119871119878119879


of 1198621and 119862


the bank 119861



Step 4 If 1198621and 119862

2output two 119890-cash (119871119878119879

1198871015840 1198701015840

1198871015840 1198781015840

1198871015840) and

(1198711198781198791minus1198871015840 1198701015840

1minus1198871015840 1198781015840




AdvTraceality119861

(120578) =

100381610038161003816100381610038162119901 [1198871015840lowast= 1198871015840] minus 1

10038161003816100381610038161003816 (40)


119861(120578) is

negligible



1198701015840= 119886119870 + 119886119888119876

119861

ℎ = 119886minus11198672(LST 1198701015840) + 119888

1198781015840= 119886119878

(41)



minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in





minus11198672(119871119878119879 119870

1015840) + 119888 there is a unique 119888



119890 (119878 119875) = 119890 (119870 + (119886minus11198672(LST 1198701015840) + 119888)119876

119861 119875pub)

119890 (1198781015840 119875) = 119890 (119870

1015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

(42)















119902119868 and 119902




119864 119902119868 119902119867)-forger exists



119877119885lowast











1










1198671(ID) = 119882




the 1198672oracle at (119871119878119879 119870



2-list in a tuple


2(119871119878119879 119870

1015840) = 119889 isin 119885

119902


(119871119878119879 1198701015840 119889) to 119867


2(119871119878119879

1198701015840) = 119889













2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in







2-list A chooses




1015840 119889) on the 119867

2-list Then A


119890 (1198701015840+ 1198672(LST 1198701015840)119876

119861 119875pub)

= 119890 (119897119875 minus 119889119882 + 119889119882119875pub) = 119890 (119897119875 119875pub)

= 119890 (119897119875pub 119875) = 119890 (1198781015840 119875)

(43)


(1198711198781198791198701015840 1198781015840)

(1198711198781198791198701015840 1198781015840lowast)

(44)


119878 = (119896 + ℎ) 119878119861

119878lowast= (119896 + ℎ

lowast) 119878119861

(45)



lowast)


9 Comparisons



10 Conclusion


Competing Interests


Acknowledgments


References
































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in































Advances in

FuzzySystems


Volume 2014












Journal of

Journal of





Advances in

Multimedia


Biomedical Imaging



Advances in


RoboticsJournal of










Advances in



Download - Research Article Secure Electronic Cash Scheme with Anonymity Revocationdownloads.hindawi.com/journals/misy/2016/2620141.pdf · Research Article Secure Electronic Cash Scheme with

Top Related