Provably Secure Identity-Based Multi-Proxy Signature Scheme in the Standard Model for UAV-Assisted Rescue

Abstract

Identity-based multi-proxy signatures (IBMPS) enable an original signer to delegate signing authority to multiple proxy signers, who jointly sign a common message on the original signer’s behalf using their identity-associated private keys. This supports authenticated collaborative reporting in unmanned aerial vehicle (UAV)-assisted rescue. We propose an IBMPS scheme for this application and a security model that captures adaptive queries and signer collusion. Under the computational Diffie–Hellman (CDH) assumption and the collision resistance of ${\widehat{H}}_2$ and ${\widehat{H}}_3$, we prove unforgeability for the three forgery scenarios of Game 1 in the standard model (SM), with explicit reduction bounds and no public-key replacement. We also analyze long-term private-key recovery under proxy signing-key exposure, assuming an honestly generated target public key that remains unchanged. The scheme verifies individual partial signatures before aggregation, while final verification requires a constant number of pairings and scalar multiplications; signer-list processing still depends on group size. Under historical benchmark timings and the adopted operation counts, with ten proxy signers, the estimated total computational cost is 19.34–44.00% lower than that of five of the six baseline schemes, and the estimated final verification cost is 50.26–74.06% lower than that of all six. Under the adopted encoding assumptions, the 20-byte long-term private-key representation is the smallest among the compared schemes, the 276-byte per-proxy delegation ties for the smallest, and the 532-byte final signature matches that of Shin et al.’s scheme. The cost figures are model-based estimates, and the byte counts are per-object representation sizes rather than complete end-to-end communication costs.

1. Introduction

Natural disasters continue to cause substantial loss of life and extensive property damage worldwide. The severe floods in Central Africa and wildfires in the Amazon rainforest in 2019, together with the extreme heatwaves in North America in 2021, underscore the importance of timely disaster assessment and effective emergency response. Unmanned aerial vehicles (UAVs) are increasingly deployed to collect information from disaster-affected areas and support search-and-rescue operations. Depending on their platforms and payloads, UAVs offer advantages such as rapid deployment, wide-area coverage, nighttime operation, precise delivery of emergency supplies, and relatively low operating costs. These capabilities make UAVs valuable tools for disaster assessment and rescue coordination [1,2,3,4].

In UAV-assisted rescue missions, the ground control center relies on timely and authenticated reports about disaster locations and people in distress to inform operational decisions. An identity-based multi-proxy signature (IBMPS) scheme supports this requirement by allowing a designated group of UAVs to jointly sign a common report under signing authority delegated by a rescue commander.

Figure 1 illustrates this workflow. The rescue commander first prepares a warrant w specifying the mission identifier, the identities of all authorized UAVs, the mission objectives, the geographical scope, the authorization validity period, and the reporting requirements. The commander then generates a delegation that binds w to the ordered public-key list L of the designated UAVs and distributes the delegation and L to the authorized group.

Figure 1. Application of IBMPS to UAV-assisted forest fire response.

Each designated UAV collects observations within the scope specified by w. To jointly endorse an incident report, the UAVs sign a common message m containing the mission identifier, the incident identifier, the incident location, the observation period, and a shared statement describing the incident. The signing procedure assumes that all designated UAVs have obtained the same encoded report m; report formation and distribution are outside the scope of the signature construction. Before signing, each UAV independently determines whether its observations support the report’s statement and whether the report satisfies the mission, geographical, temporal, and reporting constraints specified in w. Only when both conditions are satisfied does the UAV participate in the prescribed signing exchanges and generate a partial proxy signature on m.

A coordinating UAV, referred to as the clerk, collects and verifies the partial proxy signatures. The clerk belongs to the authorized group and also contributes its own partial proxy signature. After obtaining valid partial proxy signatures from all designated UAVs, the clerk aggregates them into a final multi-proxy signature and forwards the signed report to the ground control center. The center checks the report’s compliance with w, confirms that the declared UAV identities match those specified in the warrant, and verifies the multi-proxy signature using the corresponding public information. Acceptance provides authenticated evidence that the authorized group has jointly endorsed the report, thereby supporting disaster assessment and rescue decisions.

This workflow requires authentication of both the UAVs’ joint endorsement and the commander’s delegation of signing authority for the specified mission. Conventional digital signatures authenticate reports signed by individual UAVs, whereas aggregate signatures combine multiple signatures into a compact representation for aggregate verification. The unforgeability guarantees of an aggregate signature scheme depend on its underlying assumptions and the conditions imposed by its security model, including any key-registration requirements. Signature aggregation alone, however, does not establish that the rescue commander has authorized the participating UAVs to endorse reports for a particular mission within a specified validity period. An aggregate-signature-based solution therefore requires an additional mechanism to establish and verify this authorization.

IBMPS incorporates explicit delegation into the joint signing process, allowing the designated UAVs to collectively sign a common rescue report under the commander’s warrant. By verifying the resulting signature and checking the report and designated signer group against the warrant, the ground control center can authenticate the group’s joint endorsement under the specified delegation. This integration of delegated signing authority and joint report authentication motivates the use of IBMPS in UAV-assisted rescue missions.

1.1. Related Work

Proxy signatures (PS), introduced by Mambo et al. [5], allow an original signer to delegate signing authority to a proxy signer, who subsequently signs on the original signer’s behalf. Boldyreva et al. [6] established formal security foundations for this primitive by defining security requirements and presenting provably secure constructions. Malkin et al. [7] explored the relationship between proxy signatures and key-evolving signatures and developed a framework for hierarchical delegation. Schuldt et al. [8] extended the security treatment to explicitly address proxy signing-key exposure, emphasizing the need to distinguish the compromise of delegated signing keys from that of long-term private keys.

Subsequent research adapted proxy signatures to various cryptographic settings and delegation requirements. Zhang and Kim [9] developed identity-based blind and proxy signature constructions using bilinear pairings, while Lin and Jan [10] combined delegated signing with the blindness property to construct proxy blind signatures. Other extensions addressed revocation in multi-proxy signatures [11], proxy multi-signatures [12], and threshold proxy signatures [13,14,15]. These studies broadened the functionality of delegated signing to accommodate different authorization structures and operational requirements.

Multi-proxy signatures (MPS) extend signing delegation from an individual proxy to a group of cooperating proxy signers. Hwang and Shi [16] introduced a construction in which an original signer authorizes a proxy group to jointly sign on the original signer’s behalf without disclosing the original signer’s private key. Lee et al. [17] analyzed attacks against existing proxy signature schemes, developed stronger security classifications and constructions, and discussed applications to multiparty delegation. In a separate line of research, Qin et al. [18] investigated quantum multi-proxy signatures, which rely on quantum resources and signing mechanisms distinct from those of classical constructions.

Within the identity-based setting, Li and Chen [19] proposed pairing-based multi-proxy signature constructions and related variants. Their work demonstrated the integration of identity-based cryptography with collaborative delegation, although the security analysis did not include a formal reduction proof. Xu et al. [20] subsequently proposed an identity-based multi-proxy sequential signature scheme in which proxy signers contribute in a prescribed order. This construction supported sequential collaboration but also lacked a formal security proof. Cao and Cao [21] advanced the formal treatment of identity-based multi-proxy signatures (IBMPS) by defining a security model and presenting a construction with a security proof. However, Xiong et al. [22] later identified a forgery vulnerability in that construction and proposed a modification. This finding underscores the importance of distinguishing ordinary signatures from delegated signatures and accounting for their interaction in both scheme design and security analysis.

In parallel, Jin and Wen [23] introduced a certificateless multi-proxy signature (CLMPS) scheme with a formal security model capturing different adversarial capabilities. They analyzed its security under the computational Diffie–Hellman (CDH) assumption in the random oracle model (ROM). Although certificateless cryptography addresses the key-escrow issue inherent in identity-based systems, it introduces different key-management requirements and security assumptions. In the identity-based setting, Gu et al. [24] proposed an IBMPS construction in the standard model (SM), with a security framework covering self-proxy signing and proxy signing-key exposure. Its signature size and verification cost, however, grow linearly with the number of proxy signers, increasing the overhead for larger signing groups.

More recent work has emphasized computational efficiency and applications involving resource-constrained devices. Chen et al. [25] proposed an efficient IBMPS scheme with a security proof in the ROM. As noted by Shin et al. [26], the scheme generates partial signatures directly from long-term private keys and delegation information, without a separate randomized proxy signing-key generation procedure. This design raises further questions about the role of dedicated proxy signing keys in balancing signing efficiency and protection of long-term private keys.

Shin et al. [26] developed an IBMPS scheme for the Internet of Drones that incorporates randomized partial proxy signing keys. Each such key combines the proxy signer’s private key, the original signer’s delegation, and fresh randomness. Their construction supports partial signature verification and compact aggregation, and its security analysis accommodates proxy signing-key queries under the CDH assumption in the ROM. They also proposed an online/offline variant and evaluated computation time and energy consumption on a Raspberry Pi drone platform. Their surveillance and rescue scenarios demonstrate the practical relevance of delegated collaborative signing in UAV networks. Accordingly, randomized partial proxy signing keys, partial signature verification, compact aggregation, and UAV rescue applications constitute established capabilities on which subsequent IBMPS constructions can build.

The existing literature motivates further investigation of the trade-offs among delegation binding, proxy signing-key protection, security proof models, and computational efficiency. ROM proofs idealize hash functions as random oracles, whereas SM proofs avoid this idealization; this distinction alone does not establish that a ROM-based construction is insecure in practice. Taking Shin et al.’s scheme as the primary reference, our construction retains randomized proxy signing-key generation, partial signature verification, and compact aggregation while modifying the long-term key representation, the group-valued hash construction, and the binding of authorization context. Specifically, it uses an identity-associated private scalar together with an auxiliary public value, adopts Waters-style structured hashing based on collision-resistant hash functions, and binds delegation and report signing to the relevant mission and signer information. We refine the security model to account for signer collusion, proxy signing-key exposure, and released partial signatures. We establish a separate CDH-based reduction for each of the three forgery scenarios in Game 1, with explicit success-probability bounds and no public-key replacement. Finally, we estimate computational costs using a historical operation benchmark and compare the representation sizes of private keys, delegations, and signatures. These evaluations do not establish equivalent contemporary security levels or complete end-to-end communication costs.

1.2. Our Contributions

UAV-assisted rescue requires a designated group of UAVs to jointly endorse a common report under a commander’s mission-specific authorization. Meeting this requirement entails authenticating the participating UAVs, binding the delegation to the mission and designated signer group, and verifying their joint endorsement of the report. Building on the IBMPS scheme of Shin et al. [26], we retain randomized proxy signing-key generation, partial signature verification, and compact aggregation, while modifying the long-term key representation, hash construction, and authorization-context binding. Our main contributions are summarized as follows:

• Mission- and Group-Bound Delegation. We define a warrant w that specifies the mission identifier, authorized UAV identities, mission objectives, geographical scope, validity period, and reporting requirements. Whereas Shin et al. [26] use the delegation hash $H_2(w,R_0)$, our construction computes

  $$K_{OS}=H_2(w,I{D}_{OS},R_{OS},L),$$

  incorporating the original signer’s identity, auxiliary public value, and the ordered public-key list L of the designated UAVs. This binds the delegation to both the mission warrant and the selected proxy group. Before signing, each UAV checks the report against the warrant; before accepting the signed report, the ground control center checks report compliance and signer-group consistency. Together, these cryptographic bindings and application-level checks support reporting within the specified authorization scope.
• Scalar-Based Long-Term Keys and Conditional Key-Recovery Analysis. In contrast to the group-element representation of long-term private keys in Shin et al. [26], our construction uses an identity-associated private scalar together with an auxiliary public value. The corresponding private-key contribution to delegation and proxy-key generation takes the form $d_{i}E$. After verifying the delegation, each UAV derives its partial proxy signing key by combining the delegation, its private-key contribution, and fresh randomness:

  $$PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}.$$
  This formulation preserves randomized proxy-key generation while allowing subsequent partial signature generation to use the derived proxy signing key. We also analyze long-term private-key recovery under the specified proxy-key exposure conditions. Recovering the target user’s private scalar yields a solution to CDH, provided that the target public key is honestly generated and remains unchanged.
• Verifiable Aggregation with Authorization-Context Binding. We retain the partial signature verification and compact aggregation supported by Shin et al. [26], while extending the hash inputs used for report signing. Instead of $H_3(m,X)$, all designated UAVs use the common value

  $$K_{PS}=H_3(m,w,I{D}_{OS},R_{OS},U_{MPS}),$$

  which incorporates the report, warrant, original signer’s information, and aggregate proxy-key public value into the signing context. The coordinating UAV verifies each partial signature and rejects invalid contributions before aggregation. Once valid contributions from all designated UAVs have been obtained, they are combined into a final signature containing four group elements and the warrant, with the same representation size as the signature of Shin et al. Final verification requires a fixed number of pairings and scalar multiplications, although signer-list processing remains dependent on group size. The construction requires contributions from every designated UAV and does not provide threshold signing.
• Explicit Collusion Modeling and Standard-Model Reductions. Whereas Shin et al. [26] analyze security in the random oracle model, our analysis employs Waters-style group-valued hash functions defined by public parameters, together with collision-resistant hashing, in the standard model. We refine the security model to distinguish delegation forgery, forgery of an honest proxy’s participation by a malicious original signer colluding with the remaining proxies, and forgery of the original signer’s authorization by all colluding proxies. The model also tracks proxy signing-key exposure and releases partial signatures to define the freshness requirements for a valid forgery. We establish a separate CDH-based reduction for each forgery scenario in Game 1, which excludes public-key replacement. The reductions explicitly account for adaptive query simulation, target-identity guessing, coefficient events, and negligible collision-related loss.
• Model-Based Evaluation of Computational Costs and Representation Sizes. We evaluate the computational costs of delegation, proxy-key generation, signing, and final verification, as well as the representation sizes of private keys, delegations, and final signatures. Under the adopted operation counts and historical benchmark timings, the estimated total computational cost with ten proxy signers is 19.34–44.00% lower than that of five of the six comparison schemes; the estimated final verification cost is 50.26–74.06% lower than that of the six schemes. Relative to Shin et al. [26], the corresponding estimated differences are 26.16% and 68.80%. Under the adopted encoding assumptions, the long-term private-key representation is 20 bytes, compared with 128 bytes in Shin et al.’s scheme [26]; the delegation and final signature representations are 276 bytes and 532 bytes, respectively. These are model-based comparisons, not implementation measurements or comparisons at verified equivalent contemporary security levels.

1.3. Organization

The remainder of this paper is organized as follows. Section 2 introduces the preliminary concepts required for the subsequent discussion. Section 3 presents the system model of the proposed scheme. Section 4 formalizes the corresponding security model. Section 5 describes the detailed construction of the proposed scheme. Section 6 provides the security proofs. Section 7 compares the proposed scheme with representative multi-proxy signature schemes in terms of security-related features, estimated computational costs, and key, delegation, and signature sizes. Finally, Section 8 summarizes the paper and draws the main conclusions.

2. Preliminaries

Let $G_1$ be an additive group of prime order q, and let $G_2$ be a multiplicative cyclic group of the same order. Let $0_{G_1}$ and $1_{G_2}$ denote the identity elements of $G_1$ and $G_2$, respectively. Consider a map $e:G_1\times G_1\to G_2$ satisfying the following properties:

Non-degeneracy: There exist $P,Q\in G_1$ such that $e(P,Q)\ne 1_{G_2}$.

Efficient computability: The value $e(P,Q)$ can be computed efficiently for all $P,Q\in G_1$.

Bilinearity: For all $P,Q\in G_1$ and $\alpha ,\beta \in {\mathbb{Z}}_q$, $e(\alpha P,\beta Q)=e{(P,Q)}^{\alpha \beta }$.

• Computational Diffie–Hellman (CDH) problem: Given a generator P of $G_1$ and the elements $\alpha P$ and $\beta P$, where $\alpha ,\beta \in {\mathbb{Z}}_q^{*}$ are unknown, compute $\alpha \beta P$.
• CDH assumption: No probabilistic polynomial-time algorithm solves the CDH problem with non-negligible probability.

A hash function family $H=(HGen,HEval)$ consists of a probabilistic polynomial-time index generation algorithm $HGen$ and a deterministic polynomial-time evaluation algorithm $HEval$. Given a security parameter $\mu$, $HGen\left(1^{\mu }\right)$ outputs a public index s that defines a function

$$H_s:{\{0,1\}}^{*}\to Y_s,H_s\left(z\right)=HEval(s,z),$$

where $Y_s$ is the finite output space associated with s. The evaluation time is polynomial in $\mu$ and the input length.

The family H is collision resistant if, for every probabilistic polynomial-time adversary given s, the probability of finding distinct inputs $z,z^{\prime }$ such that $H_s\left(z\right)=H_s\left(z^{\prime }\right)$ is negligible in $\mu$. This probability is taken over the randomness of both the index generation algorithm and the adversary.

The index s is public and is not a secret key. Once s is fixed, the hash evaluation is deterministic. In the standard model, hash functions are evaluated according to their public descriptions rather than modeled as random oracles.

3. The System Model of IBMPS

To facilitate understanding of the proposed scheme, Table 1 summarizes the principal notation used throughout this paper.

Table 1. Notation and descriptions.

Notation	Description
$params$	Public system parameters.
$mk$	Master secret key.
$P_{pub}$	Master public key.
OS	Original signer.
${\left\{P{S}_i\right\}}_{i=1}^n$	Group of authorized proxy signers.
$P{S}_i$	The i-th proxy signer.
$P{S}_j$	Proxy signer designated as the clerk.
$I{D}_{OS}$	Identity of the original signer.
$I{D}_{P{S}_i}$	Identity of the i-th proxy signer.
${\left\{I{D}_{P{S}_i}\right\}}_{i=1}^n$	Set of identities of ${\left\{P{S}_i\right\}}_{i=1}^n$.
$d_{OS}/d_{P{S}_i}$	Private key of OS/$P{S}_i$.
$P{K}_{OS}/P{K}_{P{S}_i}$	Public key of OS/$P{S}_i$.
$PS{K}_{P{S}_i}$	Partial proxy signing key of $P{S}_i$.
L	Ordered public-key list of the designated proxy signers.
w	Warrant.
$(w,U_{OS},V_{OS})$	Delegation.
m	Report (message).
${\sigma }_{P{S}_i}$	Partial proxy signature generated by $P{S}_i$ on m.
${\sigma }_{MPS}$	Multi-proxy signature on m.

The proposed IBMPS system comprises five functional roles: a private key generator (PKG), an original signer (OS), a group of proxy signers ${\left\{P{S}_i\right\}}_{i=1}^n$, a clerk, and a verifier. In the UAV-assisted rescue scenario considered in this paper, the PKG serves as a trusted key-management authority, the OS represents the rescue commander, and the proxy signers correspond to the UAVs assigned to the mission. The clerk is a coordinating UAV $P{S}_j$, where $j\in \{1,\dots ,n\}$, selected from the proxy signer group and also acting as a proxy signer. The verifier represents the ground control center. Figure 2 illustrates the system architecture, and the responsibilities of each role are described below.

Figure 2. System architecture of the proposed IBMPS scheme.

PKG: The PKG generates the system parameters and issues identity-associated private keys, together with the corresponding auxiliary public values, to the original signer and the proxy signers.

OS:The rescue commander OS specifies the mission identifier, the identities of all authorized UAVs, the mission objectives, the geographical scope, the authorization validity period, and the reporting requirements in a warrant w. Using its private key, the OS generates a delegation $(w,U_{OS},V_{OS})$ bound to the designated proxy public-key list L. It then distributes the delegation and L to the authorized UAV group.

${\left\{P{S}_i\right\}}_{i=1}^n$: Each authorized UAV $P{S}_i$ verifies the received delegation and derives its partial proxy signing key from the delegation and its own private key. The UAV conducts observations within the authorized scope and assesses a common rescue report m, which specifies the mission identifier, the incident identifier, the incident location, the observation period, and a common incident statement. These five fields constitute the report m and are encoded in a fixed order using a canonical, unambiguous encoding. The mission identifier in m must match that specified in w. Each designated UAV participates in signing only if its observations support the statement and the report satisfies the constraints specified in w. It then completes the required signing exchanges, generates a partial proxy signature on m, and submits the resulting contribution to the clerk.

Clerk: The clerk is a coordinating UAV $P{S}_j$ selected from the proxy signer group. It participates in observation, report assessment, and signature generation. It additionally collects and verifies the partial proxy signatures on m. Once valid contributions have been obtained from all designated UAVs, including itself, the clerk constructs the final multi-proxy signature and forwards it, together with the report, to the ground control center.

Verifier: The ground control center checks that m satisfies the constraints specified in w and that the declared proxy identities and their corresponding public values match the authorized group. It then verifies the multi-proxy signature using the required public information. If all checks succeed, the report is accepted as jointly endorsed by the authorized UAV group and used to support rescue assessment and response decisions.

The proposed IBMPS scheme is defined by the following seven algorithms.

• Setup ($\mathit{\mu }$): Executed by the PKG, this algorithm takes a security parameter $\mu$ as input and generates the public system parameters $params$ and the master secret key $mk$. The PKG publishes the system parameters $params$ and keeps $mk$ secret.
• PriK-Extract (params,mk, ${\mathit{ID}}_{\mathit{i}}$): Executed by the PKG, this algorithm takes the system parameters $params$, the master secret key $mk$, and a user identity $I{D}_i$ as input. It generates the corresponding private key $d_i$ and the corresponding auxiliary public value $R_i$. The PKG delivers $d_i$ through a secure channel and provides $R_i$ to the user.
• PubK-Generate (${\mathit{ID}}_{\mathit{i}}$, ${\mathit{R}}_{\mathit{i}}$): This algorithm takes a user identity $I{D}_i$ and the corresponding auxiliary public value $R_i$ as input. The user sets its public key to $P{K}_i=R_i$.
• Dele-Generate (params,w, ${\mathit{ID}}_{\mathit{OS}},{\mathit{PK}}_{\mathit{OS}},{\mathit{d}}_{\mathit{OS}},\mathit{L}$): Executed by the OS, this algorithm generates a delegation for a designated group of proxy signers. Before executing the algorithm, the OS constructs a warrant w specifying the mission identifier, the identities of all authorized proxy signers, the mission objectives, the geographical scope, the authorization validity period, and the reporting requirements. It also determines the ordered public-key list $L=(P{K}_{P{S}_1},P{K}_{P{S}_2},\cdots ,P{K}_{P{S}_n})$, where $P{K}_{P{S}_i}=R_{P{S}_i}$. The algorithm takes $params$, w, the original signer’s identity $I{D}_{OS}$, public key $P{K}_{OS}$, and private key $d_{OS}$, together with L, as input. It outputs the delegation $(w,U_{OS},V_{OS})$, which the OS distributes alongside L to the designated proxy signers. Whenever L is included in a hash input, its entries follow the order of the corresponding proxy identities listed in w and are represented using a fixed, unambiguous encoding.
• ProK-Generate ($\mathit{params}$, $(\mathit{w},{\mathit{U}}_{\mathit{OS}},{\mathit{V}}_{\mathit{OS}})$, ${\mathit{ID}}_{\mathit{OS}}$, ${\mathit{PK}}_{\mathit{OS}}$, ${\mathit{ID}}_{{\mathit{PS}}_{\mathit{i}}}$, ${\mathit{PK}}_{{\mathit{PS}}_{\mathit{i}}}$, ${\mathit{d}}_{{\mathit{PS}}_{\mathit{i}}}$, $\mathit{L}$): This algorithm is executed by each proxy signer $P{S}_i$. It takes as input $params$, the delegation $(w,U_{OS},V_{OS})$, the original signer’s identity $I{D}_{OS}$ and public key $P{K}_{OS}$, the proxy public-key list L, and the proxy signer’s own identity $I{D}_{P{S}_i}$, public key $P{K}_{P{S}_i}$, and private key $d_{P{S}_i}$. Before verifying the delegation, $P{S}_i$ first checks whether its own identity $I{D}_{P{S}_i}$ belongs to the proxy group specified by w, and confirms that its own public key $P{K}_{P{S}_i}$ matches the corresponding entry in L. If either condition is not satisfied, it outputs ⊥ and terminates. Then, $P{S}_i$ verifies the delegation $(w,U_{OS},V_{OS})$. After successful verification, $P{S}_i$ derives its partial proxy signing key $PS{K}_{P{S}_i}$, and simultaneously generates and broadcasts the public value $U_{P{S}_i}$. The partial proxy signing key $PS{K}_{P{S}_i}$ is kept secret by $P{S}_i$ and is used to participate in the joint generation of multi-proxy signatures under the authorization specified in w; $U_{P{S}_i}$ is a public value used in partial signature verification and in computing $U_{MPS}$. The algorithm outputs $(PS{K}_{P{S}_i},U_{P{S}_i})$, or ⊥ on failure.
• MP-Sign $(\mathit{params},\mathit{m},(\mathit{w},{\mathit{U}}_{\mathit{OS}},{\mathit{V}}_{\mathit{OS}}),{\mathit{ID}}_{\mathit{OS}},{\mathit{PK}}_{\mathit{OS}},{\mathbf{\left\{}{\mathit{ID}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}},{\mathbf{\left\{}{\mathit{PK}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}},{\mathbf{\left\{}{\mathit{PSK}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}},{\mathbf{\left\{}{\mathit{U}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}})$: This distributed signing algorithm is jointly executed by the designated proxy signers, with $P{S}_j$ acting as the clerk. The collection ${\left\{PS{K}_{P{S}_i}\right\}}_{i=1}^n$ denotes the signers’ respective local secret inputs. The algorithm consists of two stages: (1) Partial signature generation. Each proxy signer $P{S}_i$ takes as input the system parameters $params$, the report m, the delegation $(w,U_{OS},V_{OS})$, the original signer’s identity $I{D}_{OS}$ and public key $P{K}_{OS}$, the designated proxy group’s public information, and its own partial proxy signing key $PS{K}_{P{S}_i}$ and the public values ${\left\{U_{P{S}_i}\right\}}_{i=1}^n$ generated during ProK-Generate. For $1\le i\le n$, $P{S}_i$ evaluates the common rescue report m, which contains the mission identifier, the incident identifier, the incident location, the observation period, and a common incident statement. Only when $P{S}_i$ verifies that m satisfies the constraints specified in w does $P{S}_i$ participate in the signing. It then outputs a partial proxy signature ${\sigma }_{P{S}_i}$ and transmits it to a designated proxy signer $P{S}_j$$(j\in \{1,2,\cdots ,n\left\}\right)$, who serves as the clerk to aggregate the signatures. (2) Signature aggregation. The clerk collects and verifies the n partial proxy signatures $\{{\sigma }_{P{S}_1},{\sigma }_{P{S}_2},\cdots ,{\sigma }_{P{S}_n}\}$ from all proxy signers, and outputs the multi-proxy signature ${\sigma }_{MPS}$ on m.
• MP-Verify $(\mathit{params},\mathit{m},{\mathit{\sigma }}_{\mathit{MPS}},{\mathit{ID}}_{\mathit{OS}},{\mathit{PK}}_{\mathit{OS}},{\mathbf{\left\{}{\mathit{ID}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}},{\mathbf{\left\{}{\mathit{PK}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}})$: Executed by the verifier, this algorithm takes the system parameters $params$, the report m, the multi-proxy signature ${\sigma }_{MPS}$, the original signer’s identity $I{D}_{OS}$ and the public key $P{K}_{OS}$, the identities ${\left\{I{D}_{P{S}_i}\right\}}_{i=1}^n$ of the proxy signers ${\left\{P{S}_i\right\}}_{i=1}^n$, and their public keys ${\left\{P{K}_{P{S}_i}\right\}}_{i=1}^n$ as input. The verifier first extracts the warrant w from ${\sigma }_{MPS}$ and checks whether m satisfies its constraints. It checks that the supplied proxy identities correspond one-to-one to those specified in w, constructs the ordered public-key list L from the corresponding supplied public keys, and uses this list to compute $K_{OS}$ for aggregate signature verification. Finally, it verifies whether ${\sigma }_{MPS}$ is a valid multi-proxy signature on m, generated under w by the designated proxy signer group on behalf of the OS. The algorithm accepts if all checks succeed and rejects otherwise.

4. Security Model

The IBMPS system comprises one original signer and n proxy signers. We consider both collusion among proxy signers and collusion between the original signer and a subset of the proxy signers. The adversary $\mathcal{A}$ is allowed to adaptively corrupt participants and obtain their long-term private keys. For a target forgery, $\mathcal{A}$ may corrupt at most n of the $n+1$ participants, subject to the requirement that at least one participant whose authorization or signature is being forged remains uncorrupted.

We denote the identity of such a participant by $I{D}^{\diamond }$. This requirement rules out the trivial case in which $\mathcal{A}$ obtains all long-term private keys needed to generate the target delegation or signature directly. Game 1 imposes additional restrictions on proxy signing-key queries and signing queries to exclude trivial forgeries derived from keys or signatures obtained through these queries.

The identity $I{D}^{\diamond }$ is determined by the adversary’s final forgery and need not be fixed before the interaction. Depending on the forgery scenario, $I{D}^{\diamond }$ corresponds to either the original signer or a proxy signer. Under this adversarial model, we distinguish the following three forgery scenarios.

• Delegation forgery. The adversary $\mathcal{A}$ impersonates an honest original signer with identity $I{D}^{\diamond }$ and produces a valid delegation $(w^{*},U_{OS}^{*},V_{OS}^{*})$, although the original signer has not authorized the designated proxy group under $w^{*}$. The adversary may have obtained delegations from the same original signer for other warrants or proxy groups.
• Signature forgery without an honest proxy signer’s participation. A malicious original signer colludes with $n-1$ corrupted proxy signers to produce a valid multi-proxy signature

  $${\sigma }_{MPS}^{*}=(w^{*},U_{OS}^{*},U_{MPS}^{*},X_{MPS}^{*},V_{MPS}^{*})$$

  on a report $m^{*}$. The signature purports to represent the participation of all n designated proxy signers, although the remaining honest proxy signer, with identity $I{D}^{\diamond }$, has not signed $m^{*}$ under the target authorization. The adversary has not obtained this signer’s long-term private key or its partial proxy signing key for the target authorization. It may, however, have requested signatures from the honest signer on other reports.
• Signature forgery without the original signer’s authorization. The adversary $\mathcal{A}$ corrupts all n proxy signers and produces a valid multi-proxy signature on a report $m^{*}$ under a warrant $w^{*}$, although the honest original signer, with identity $I{D}^{\diamond }$, has not authorized the designated proxy group under $w^{*}$. Delegations obtained from this original signer for other warrants or proxy groups do not constitute authorization for the target signature.

Game 1. We formalize the above forgery scenarios through the following game between a challenger $\mathcal{C}$ and a probabilistic polynomial-time adversary $\mathcal{A}$. An overview of the game is provided in Figure 3.

Figure 3. Overview of Game 1.

Setup phase. The challenger $\mathcal{C}$ runs the Setup algorithm to generate the public system parameters $params$ and the master secret key $mk$. It gives $params$ to $\mathcal{A}$ and keeps $mk$ secret.

Query phase. The adversary $\mathcal{A}$ may adaptively issue a polynomial number of the queries defined below. When a query involves an identity that has not yet been registered, the challenger $\mathcal{C}$ generates the corresponding key pair once, using PriK-Extract and PubK-Generate, and stores it for subsequent queries. The challenger’s internal use of a private key does not constitute disclosure of that key to $\mathcal{A}$. Each identity is associated with a single public key generated by the challenger. Public-key replacement is not allowed in this game. The challenger maintains the following lists, all initially empty:

• $L_{\mathrm{Key}}$ stores tuples $(I{D}_i,R_i,d_i)$, where $(R_i,d_i)$ is the key pair originally issued to $I{D}_i$.
• $L_{\mathrm{Pub}}$ stores tuples $(I{D}_i,P{K}_i)$, where $P{K}_i$ is the registered public key associated with $I{D}_i$ and is initially set to $R_i$.
• $L_{\mathrm{Pri}}$ records each identity $I{D}_i$ for which $d_i$ has been returned to $\mathcal{A}$.
• $L_{\mathrm{Dele}}$ stores tuples $(w,I{D}_{OS},P{K}_{OS},L,(w,U_{OS},V_{OS}))$ for delegations returned to $\mathcal{A}$, where $(w,U_{OS},V_{OS})$ is the delegation on w.
• $L_{\mathrm{Pro}}$ stores tuples $((w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,PS{K}_{P{S}_i},U_{P{S}_i})$, where $PS{K}_{P{S}_i}$ is the generated partial proxy signing key of $P{S}_i$, and $U_{P{S}_i}$ is its corresponding public value.
• $L_{\mathrm{Exp}}$ stores tuples $((w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,PS{K}_{P{S}_i},U_{P{S}_i})$ for partial proxy signing keys returned to $\mathcal{A}$ through $Q_{\mathrm{ProK}}$.
• $L_{\mathrm{Sign}}$ stores a tuple $(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},{\left\{I{D}_{P{S}_i}\right\}}_{i=1}^n,{\left\{P{K}_{P{S}_i}\right\}}_{i=1}^n,L,{\sigma }_{MPS})$ for each multi-proxy signature returned to $\mathcal{A}$. It also stores a tuple $(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,{\sigma }_{P{S}_i})$ for each partial signature released by an honest proxy signer. Both signature forms include the warrant w, which identifies the designated proxy signers.

In the reduction, $\mathcal{C}$ additionally maintains a reduction-only list $L_{\mathrm{Sim}}$ for proxy signing keys represented implicitly during signing-query simulations. Each entry records

$$((w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,u_{P{S}_i},U_{P{S}_i}),$$

where $u_{P{S}_i}$ and $U_{P{S}_i}$ are the proxy signer’s random scalar and corresponding public value. The corresponding $PS{K}_{P{S}_i}$ is not stored because $\mathcal{C}$ cannot compute it explicitly. Entries in $L_{\mathrm{Sim}}$ are internal simulation state: they are not returned to $\mathcal{A}$ and are not recorded in $L_{\mathrm{Exp}}$.

Public-key query ${\mathit{Q}}_{\mathbf{PubK}}\left({\mathit{ID}}_{\mathit{i}}\right)$. On receiving an identity $I{D}_i$, the challenger $\mathcal{C}$ returns its current public key $P{K}_i$ from $L_{\mathrm{Pub}}$. Initially, $P{K}_i=R_i$, where $R_i$ is generated during private key extraction.

Private-key query ${\mathit{Q}}_{\mathbf{PriK}}\left({\mathit{ID}}_{\mathit{i}}\right)$. On receiving an identity $I{D}_i$, the challenger $\mathcal{C}$ returns the registered private key $d_i$ from $L_{\mathrm{Key}}$ and records $I{D}_i$ in $L_{\mathrm{Pri}}$ if it is not yet recorded.

Delegation query ${\mathit{Q}}_{\mathbf{Dele}}(\mathit{w},{\mathit{ID}}_{\mathit{OS}},{\mathit{PK}}_{\mathit{OS}},\mathit{L})$. The adversary $\mathcal{A}$ submits the warrant w, the original signer’s identity $I{D}_{OS}$ and public key $P{K}_{OS}$, and the public-key list L of all designated proxy signers. The challenger $\mathcal{C}$ checks that the supplied public keys match the current public keys of their corresponding identities and that L is consistent with the proxy group specified in w. If either check fails, it returns ⊥. Otherwise, it uses the corresponding original signer’s private key internally to run Dele-Generate. The challenger $\mathcal{C}$ returns the delegation $(w,U_{OS},V_{OS})$ together with L and records $(w,I{D}_{OS},P{K}_{OS},L,(w,U_{OS},V_{OS}))$ in $L_{\mathrm{Dele}}$.

Proxy signing-key query ${\mathit{Q}}_{\mathbf{ProK}}((\mathit{w},{\mathit{U}}_{\mathit{OS}},{\mathit{V}}_{\mathit{OS}}),{\mathit{ID}}_{\mathit{OS}},{\mathit{PK}}_{\mathit{OS}},{\mathit{ID}}_{{\mathit{PS}}_{\mathit{i}}},{\mathit{PK}}_{{\mathit{PS}}_{\mathit{i}}},\mathit{L})$. The adversary $\mathcal{A}$ submits a delegation $(w,U_{OS},V_{OS})$, the original signer’s identity $I{D}_{OS}$ and public key $P{K}_{OS}$, a proxy signer’s identity $I{D}_{P{S}_i}$ and public key $P{K}_{P{S}_i}$, and the designated proxy public-key list L. The challenger $\mathcal{C}$ verifies the delegation, checks the supplied public keys, and confirms that $I{D}_{P{S}_i}$ belongs to the proxy group specified in w. If any check fails, it returns ⊥. Otherwise, the challenger proceeds as follows:

(1)

If $L_{\mathrm{Pro}}$ contains an entry matching the delegation, the original signer, the proxy signer, and the designated proxy group, including their public keys, the challenger retrieves the stored $PS{K}_{P{S}_i}$ and $U_{P{S}_i}$.

(2)

Otherwise, the challenger uses the corresponding private key $d_{P{S}_i}$ internally to run ProK-Generate and obtains $PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS},U_{P{S}_i}=u_{P{S}_i}P$. It stores these values, together with the associated delegation, identities, and public keys, in $L_{\mathrm{Pro}}$.

(3)

The challenger returns $(PS{K}_{P{S}_i},U_{P{S}_i})$ to the adversary $\mathcal{A}$ and records the corresponding key exposure in $L_{\mathrm{Exp}}$. Its internal use of $d_{P{S}_i}$ does not constitute disclosure of that private key.

Multi-proxy signing query ${\mathit{Q}}_{\mathbf{MPS}}(\mathit{m},(\mathit{w},{\mathit{U}}_{\mathit{OS}},{\mathit{V}}_{\mathit{OS}}),{\mathit{ID}}_{\mathit{OS}},{\mathit{PK}}_{\mathit{OS}},{\mathbf{\left\{}{\mathit{ID}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}},{\mathbf{\left\{}{\mathit{PK}}_{{\mathit{PS}}_{\mathit{i}}}\mathbf{\right\}}}_{\mathit{i}=\mathit{1}}^{\mathit{n}})$. The challenger $\mathcal{C}$ verifies the delegation, checks that m satisfies the conditions in w, and confirms that the supplied public keys match $L_{\mathrm{Pub}}$ and the designated proxy group. If any check fails, it returns ⊥. Otherwise, it carries out the following steps:

(1)

Partial signature generation. For each proxy signer $P{S}_i$, the challenger $\mathcal{C}$ retrieves a matching partial proxy signing key from $L_{\mathrm{Pro}}$. If no matching entry exists, it obtains $d_{P{S}_i}$ from $L_{\mathrm{Key}}$, runs ProK-Generate internally, and stores the resulting key and public value in $L_{\mathrm{Pro}}$.

The challenger $\mathcal{C}$ then performs the partial signing steps of MP-Sign, ensuring that all participating signers use the same $U_{MPS}$ and $K_{PS}$. For each honest signer whose partial signature is released, it records $(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,{\sigma }_{P{S}_i})$ in $L_{\mathrm{Sign}}$. If the adversary $\mathcal{A}$ controls some participants, the challenger $\mathcal{C}$ performs only the honest signers’ steps and exchanges the prescribed public messages and partial signatures with the adversary $\mathcal{A}$. Records of released partial signatures are retained even if aggregation is not completed.

(2)

Verification and aggregation. Once all partial signatures are available, the challenger $\mathcal{C}$ verifies them according to MP-Sign. If any partial signature is invalid, it returns ⊥. Otherwise, it aggregates them into ${\sigma }_{MPS}=(w,U_{OS},U_{MPS},X_{MPS},V_{MPS})$, returns ${\sigma }_{MPS}$ to the adversary $\mathcal{A}$, and records $(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},{\left\{I{D}_{P{S}_i}\right\}}_{i=1}^n,{\left\{P{K}_{P{S}_i}\right\}}_{i=1}^n,L,{\sigma }_{MPS})$ in $L_{\mathrm{Sign}}$.

The challenger’s internal generation or use of secret keys does not constitute key disclosure. Queries involving a participant who remains honest in the final forgery are permitted, subject to the winning conditions below.

Forgery phase. Before evaluating the winning conditions, the challenger checks that all identities in the final output are registered and that their supplied public keys match the corresponding entries in $L_{\mathrm{Pub}}$. It also checks that the proxy identities are distinct and correspond exactly, in the prescribed order, to those specified in $w^{*}$. If any check fails, the adversary loses. The adversary $\mathcal{A}$ outputs the target original signer’s identity and public key, the identities and public keys of the designated proxy signers, and either a delegation $(w^{*},U_{OS}^{*},V_{OS}^{*})$ or a report $m^{*}$ accompanied by a multi-proxy signature ${\sigma }_{MPS}^{*}=(w^{*},U_{OS}^{*},U_{MPS}^{*},X_{MPS}^{*},V_{MPS}^{*})$. The adversary $\mathcal{A}$ wins if all conditions of at least one of the following scenarios are satisfied.

Scenario 1: Delegation forgery. The adversary $\mathcal{A}$ impersonates an original signer with identity $I{D}_{OS}^{*}$ and outputs $(w^{*},U_{OS}^{*},V_{OS}^{*})$ such that:

(1)

The delegation passes verification for the specified original signer and designated proxy group.

(2)

$I{D}_{OS}^{*}\notin L_{\mathrm{Pri}}$; hence, the adversary $\mathcal{A}$ has not obtained the original signer’s long-term private key through $Q_{\mathrm{PriK}}\left(I{D}_{OS}^{*}\right)$.

(3)

$L_{\mathrm{Dele}}$ contains no delegation issued for the same original signer identity and public key, warrant $w^{*}$, and designated proxy identities and public keys.

Scenario 2: Signature forgery without an honest proxy signer’s participation. The adversary $\mathcal{A}$ corrupts the original signer and $n-1$ proxy signers and outputs ${\sigma }_{MPS}^{*}$ on $m^{*}$ under $w^{*}$. Without loss of generality, let $P{S}_1$ be the remaining honest proxy signer. The adversary $\mathcal{A}$ wins if:

(1)

MP-Verify accepts ${\sigma }_{MPS}^{*}$ on $m^{*}$.

(2)

$I{D}_{P{S}_1}^{*}\notin L_{\mathrm{Pri}}$; hence, the adversary has not obtained this signer’s long-term private key through a private-key query.

(3)

$L_{\mathrm{Exp}}$ contains no record showing that the adversary $\mathcal{A}$ obtained $P{S}_1$’s partial proxy signing key for the target warrant, original signer identity and public key, and designated proxy identities and public keys.

(4)

$L_{\mathrm{Sign}}$ contains no record of $P{S}_1$ signing $m^{*}$ under the same warrant, original signer identity and public key, and designated proxy identities and public keys. This condition applies to both released partial signatures and returned multi-proxy signatures.

Scenario 3: Signature forgery without the original signer’s authorization. The adversary $\mathcal{A}$ corrupts all n proxy signers and outputs ${\sigma }_{MPS}^{*}$ on $m^{*}$ under $w^{*}$, claiming authorization from an original signer with identity $I{D}_{OS}^{*}$. The adversary $\mathcal{A}$ wins if:

(1)

MP-Verify accepts ${\sigma }_{MPS}^{*}$ on $m^{*}$.

(2)

$I{D}_{OS}^{*}\notin L_{\mathrm{Pri}}$; hence, the adversary $\mathcal{A}$ has not obtained the original signer’s long-term private key through $Q_{\mathrm{PriK}}\left(I{D}_{OS}^{*}\right)$.

(3)

$L_{\mathrm{Dele}}$ contains no delegation issued for the same original signer identity and public key, warrant $w^{*}$, and designated proxy identities and public keys.

(4)

$L_{\mathrm{Sign}}$ contains no multi-proxy signature returned on $m^{*}$ under the same warrant, original signer identity and public key, and designated proxy identities and public keys.

These winning conditions permit queries concerning other reports and authorizations, subject to the stated private-key and proxy signing-key restrictions. We denote existential unforgeability against adaptive chosen-warrant, chosen-message, and chosen-identity attacks by EUF-CWMIA. The adversary’s advantage is its probability of winning Game 1:

$$Ad{v}_{\mathcal{A}}^{EUF-CWMIA}\left(\mu \right)=\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right].$$

The scheme is secure in this model if the advantage is negligible in $\mu$ for every probabilistic polynomial-time adversary $\mathcal{A}$.

5. Scheme Construction

The proposed IBMPS scheme comprises seven algorithms: Setup, PriK-Extract, PubK-Generate, Dele-Generate, ProK-Generate, MP-Sign, and MP-Verify. The original signer first issues a delegation that binds the authorization warrant w to the designated proxy signers. Upon validating the delegation, each proxy signer derives a partial proxy signing key using its private key and fresh randomness. To sign a common report m, the proxy signers generate partial signatures using a common hash value $K_{PS}$. A designated clerk verifies these contributions and aggregates them into a multi-proxy signature. The correctness of the aggregate verification equation follows from the signature construction and the bilinearity of the pairing.

• Setup: Given a security parameter $\mu$, the PKG selects an additive cyclic group $G_1$ and a multiplicative cyclic group $G_2$ of the same prime order $q>2^{\mu }$, together with an efficiently computable, non-degenerate bilinear pairing

  $$e:G_1\times G_1\to G_2.$$

Let P be a generator of $G_1$. The PKG samples E uniformly from $G_1\setminus \left\{0_{G_1}\right\}$ and independently samples $T_0,\dots ,T_{\ell },S_0,\dots ,S_{\ell }$ uniformly from $G_1$, where $\ell =\ell \left(\mu \right)$ is a polynomially bounded positive integer.

It also samples $x\in {\mathbb{Z}}_q^{*}$, sets the master secret key to $mk=x$, and computes $P_{pub}=xP$.

The PKG specifies the public indices of

$$H_1:{\{0,1\}}^{*}\to {\mathbb{Z}}_q^{*},{\widehat{H}}_2,{\widehat{H}}_3:{\{0,1\}}^{*}\to {\{0,1\}}^{\ell },$$

where ${\widehat{H}}_2$ and ${\widehat{H}}_3$ are independently selected from collision-resistant hash families. Their indices are omitted from the notation for brevity.

For an input z, let

$$(z_1,\dots ,z_{\ell })={\widehat{H}}_2\left(z\right),(z_1^{\prime },\dots ,z_{\ell }^{\prime })={\widehat{H}}_3\left(z\right).$$

The group-valued functions $H_2,H_3:{\{0,1\}}^{*}\to G_1$ are defined by

$$H_2\left(z\right)=T_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j{T}_j,H_3\left(z\right)=S_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j^{\prime }{S}_j.$$

All multipart hash inputs are encoded canonically and unambiguously, with field boundaries and list ordering preserved. In particular, the proxy public-key list is represented as the ordered tuple

$$L=(P{K}_{P{S}_1},P{K}_{P{S}_2},\dots ,P{K}_{P{S}_n}),$$

whose entries follow the order of the corresponding proxy identities specified in the warrant w.

The PKG publishes

$$params=(G_1,G_2,q,e,P,E,P_{pub},{\left\{T_j\right\}}_{j=0}^{\ell },{\left\{S_j\right\}}_{j=0}^{\ell },H_1,{\widehat{H}}_2,{\widehat{H}}_3),$$

including the public hash indices and function descriptions, and keeps the master secret key $mk=x$ secret. The functions $H_2$ and $H_3$ are evaluated directly from these public parameters.

• PriK-Extract: For a user with identity $I{D}_i$, the PKG samples $r_i\in {\mathbb{Z}}_q^{*}$ and computes

  $$R_i=r_{i}P,h_i=H_1(I{D}_i,R_i),d_i=(r_i+h_{i}x)\mathrm{mod}q.$$

The PKG sends $R_i$ to the user and delivers the private key $d_i$ through a secure channel. The user recomputes $h_i=H_1(I{D}_i,R_i)$ and accepts $d_i$ if and only if

$$d_{i}P=R_i+h_i{P}_{pub}.$$

Otherwise, the user rejects the key.

• PubK-Generate: The user with identity $I{D}_i$ sets $P{K}_i=R_i$, where $R_i$ is obtained from the PKG during PriK-Extract. After this step, the original signer $OS$ holds the public-private key pair $(R_{OS},d_{OS})$, and each proxy signer $P{S}_i$ holds the public-private key pair $(R_{P{S}_i},d_{P{S}_i})$, for $i=1,\dots ,n$.
• Dele-Generate: The original signer $OS$ specifies an authorization warrant w and the ordered public-key list

  $$L=(P{K}_{P{S}_1},P{K}_{P{S}_2},\dots ,P{K}_{P{S}_n})$$

  of the designated proxy signers. The warrant specifies the mission identifier, the identities of all authorized proxy signers, the mission objectives, the geographical scope, the authorization validity period, and the reporting requirements.

The original signer samples $u_{OS}\in {\mathbb{Z}}_q^{*}$ and computes

$$\begin{array}{cc}\hfill U_{OS}& =u_{OS}P,\hfill \\ \hfill K_{OS}& =H_2(w,I{D}_{OS},R_{OS},L),\hfill \\ \hfill V_{OS}& =d_{OS}E+u_{OS}{K}_{OS}.\hfill \end{array}$$

It sends the delegation $(w,U_{OS},V_{OS})$ and the ordered list L to each designated proxy signer $P{S}_i$. The input to $H_2$ binds the delegation to the warrant, the original signer’s identity and public value, and the ordered public-key list of the designated proxy group.

• ProK-Generate: Before verifying the delegation, $P{S}_i$ checks that $I{D}_{P{S}_i}$ belongs to the proxy group specified in w and that $P{K}_{P{S}_i}$ matches the corresponding entry in L. If either check fails, it returns ⊥.

The proxy signer computes

$$K_{OS}=H_2(w,I{D}_{OS},R_{OS},L),h_{OS}=H_1(I{D}_{OS},R_{OS}),$$

and verifies the delegation by checking

$$e(V_{OS},P)=e(E,R_{OS}+h_{OS}{P}_{pub})e(K_{OS},U_{OS}).$$

If verification fails, $P{S}_i$ returns ⊥. Otherwise, it samples $u_{P{S}_i}\in {\mathbb{Z}}_q^{*}$ and computes

$$U_{P{S}_i}=u_{P{S}_i}P,PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}.$$

The partial proxy signing key $PS{K}_{P{S}_i}$ combines the verified delegation, the proxy signer’s private-key contribution, and fresh randomness. The signer broadcasts $U_{P{S}_i}$ to the proxy group and keeps $PS{K}_{P{S}_i}$ secret for subsequent partial signature generation. The public value $U_{P{S}_i}$ is used in partial signature verification and in computing

$$U_{MPS}={\displaystyle \sum _{i=1}^n}{U}_{P{S}_i}.$$

The algorithm outputs $(PS{K}_{P{S}_i},U_{P{S}_i})$, or ⊥ on failure.

• MP-Sign: To sign a common rescue report m on behalf of the original signer $OS$ under the warrant w, all designated proxy signers generate partial proxy signatures. A clerk $P{S}_j$, where $j\in \{1,\dots ,n\}$, verifies and aggregates their contributions. The clerk also contributes its own partial proxy signature.

(1) Partial signature generation Each proxy signer $P{S}_i$ first checks whether its local observation supports the common statement in the report m and whether m satisfies the authorization conditions in w. If either check fails, it returns ⊥.

Using the public values broadcast during ProK-Generate, each proxy signer computes

$$U_{MPS}={\displaystyle \sum _{i=1}^n}{U}_{P{S}_i},K_{PS}=H_3(m,w,I{D}_{OS},R_{OS},U_{MPS}).$$

This step requires the public values of all designated proxy signers to be available. All participating signers use the same report m, warrant w, and aggregate value $U_{MPS}$.

The proxy signer samples $x_{P{S}_i}\in {\mathbb{Z}}_q^{*}$ and computes

$$X_{P{S}_i}=x_{P{S}_i}P,V_{P{S}_i}=x_{P{S}_i}{K}_{PS}+PS{K}_{P{S}_i}.$$

It sends the partial proxy signature

$${\sigma }_{P{S}_i}=(w,U_{OS},V_{OS},X_{P{S}_i},V_{P{S}_i})$$

and its public key $R_{P{S}_i}$ to the clerk.

(2) Partial signature verification and aggregation

The clerk uses the ordered public-key list

$$L=(P{K}_{P{S}_1},P{K}_{P{S}_2},\dots ,P{K}_{P{S}_n})$$

specified in the delegation. It checks that each received contribution corresponds to a designated proxy signer and that the supplied public key matches the corresponding entry in L. If either check fails, it returns ⊥.

Using the public values of all designated proxy signers, the clerk recomputes

$$\begin{array}{cc}\hfill U_{MPS}& ={\displaystyle \sum _{i=1}^n}{U}_{P{S}_i},\hfill \\ \hfill K_{OS}& =H_2(w,I{D}_{OS},R_{OS},L),\hfill \\ \hfill h_{OS}& =H_1(I{D}_{OS},R_{OS}),\hfill \\ \hfill K_{PS}& =H_3(m,w,I{D}_{OS},R_{OS},U_{MPS}),\hfill \\ \hfill h_{P{S}_i}& =H_1(I{D}_{P{S}_i},R_{P{S}_i}),i=1,\dots ,n.\hfill \end{array}$$

For each $i\in \{1,\dots ,n\}$, including its own contribution, the clerk checks

$$\begin{array}{cc}\hfill e(V_{P{S}_i},P)=& e\left(E,R_{OS}+R_{P{S}_i}+(h_{OS}+h_{P{S}_i})P_{pub}\right)\hfill \\ & ·e(X_{P{S}_i},K_{PS})·e(U_{OS}+U_{P{S}_i},K_{OS}).\hfill \end{array}$$

This verification equation follows by expanding the partial signature as

$$V_{P{S}_i}=x_{P{S}_i}{K}_{PS}+(u_{P{S}_i}+u_{OS})K_{OS}+(d_{P{S}_i}+d_{OS})E$$

and applying the private-key relations and the bilinearity of the pairing.

If any verification fails, the clerk returns ⊥. Aggregation is performed only after one valid partial signature has been obtained from every designated proxy signer, including the clerk. If any required contribution is unavailable, the joint signature cannot be completed. The algorithm does not permit aggregation over a subset of the designated proxy group.

Once all required partial signatures have been verified, the clerk computes

$$V_{MPS}={\displaystyle \sum _{i=1}^n}{V}_{P{S}_i},X_{MPS}={\displaystyle \sum _{i=1}^n}{X}_{P{S}_i},$$

and outputs the multi-proxy signature

$${\sigma }_{MPS}=(w,U_{OS},U_{MPS},X_{MPS},V_{MPS})$$

for the report m.

Since all partial signatures use the same $K_{PS}$ and $K_{OS}$, their corresponding terms can be added in $G_1$. Each partial signature contains one occurrence of $V_{OS}$; therefore, $V_{MPS}$ contains $n{V}_{OS}$. This determines the coefficients of the original signer’s terms in the aggregate verification equation.

• MP-Verify: Given the report m, the original signer’s identity–public-key pair $(I{D}_{OS},R_{OS})$, the proxy signers’ pairs ${\left\{(I{D}_{P{S}_i},R_{P{S}_i})\right\}}_{i=1}^n$, and the multi-proxy signature

  $${\sigma }_{MPS}=(w,U_{OS},U_{MPS},X_{MPS},V_{MPS}),$$

  the verifier checks whether m satisfies the conditions specified in w. It also checks that the supplied proxy identities are distinct and correspond exactly to those specified in w. It constructs the ordered public-key list

  $$L=(P{K}_{P{S}_1},P{K}_{P{S}_2},\dots ,P{K}_{P{S}_n})$$

  according to the identity order in w, where $P{K}_{P{S}_i}=R_{P{S}_i}$. If any check fails, it rejects the signature.

Otherwise, the verifier computes

$$\begin{array}{cc}\hfill K_{OS}& =H_2(w,I{D}_{OS},R_{OS},L),\hfill \\ \hfill h_{OS}& =H_1(I{D}_{OS},R_{OS}),\hfill \\ \hfill K_{PS}& =H_3(m,w,I{D}_{OS},R_{OS},U_{MPS}),\hfill \\ \hfill h_{P{S}_i}& =H_1(I{D}_{P{S}_i},R_{P{S}_i}),i=1,\dots ,n.\hfill \end{array}$$

The list L uses the same ordering and canonical encoding convention as in Dele-Generate. The verifier accepts ${\sigma }_{MPS}$ if and only if

$$\begin{array}{cc}\hfill e(V_{MPS},P)& =e(K_{PS},X_{MPS})\hfill \\ & ·e\left(E,{\displaystyle \sum _{i=1}^n}{R}_{P{S}_i}+n{R}_{OS}+\left({\displaystyle \sum _{i=1}^n}{h}_{P{S}_i}+n{h}_{OS}\right)P_{pub}\right)\hfill \\ & ·e(K_{OS},n{U}_{OS}+U_{MPS}).\hfill \end{array}$$

Otherwise, it rejects the signature.

The correctness of the scheme follows from the definition of $V_{P{S}_i}$:

$$V_{P{S}_i}=x_{P{S}_i}{K}_{PS}+(u_{P{S}_i}+u_{OS})K_{OS}+(d_{P{S}_i}+d_{OS})E.$$

Using bilinearity and the private-key relations

$$d_{OS}P=R_{OS}+h_{OS}{P}_{pub},d_{P{S}_i}P=R_{P{S}_i}+h_{P{S}_i}{P}_{pub},$$

we obtain

$$\begin{array}{cc}\hfill e(V_{MPS},P)& =e\left({\displaystyle \sum _{i=1}^n}{V}_{P{S}_i},P\right)\hfill \\ \hfill & =e\left({\displaystyle \sum _{i=1}^n}(x_{P{S}_i}{K}_{PS}+PS{K}_{P{S}_i}),P\right)\hfill \\ \hfill & =e\left({\displaystyle \sum _{i=1}^n}{x}_{P{S}_i}{K}_{PS},P\right)\hfill \\ \hfill & ·e\left({\displaystyle \sum _{i=1}^n}\left((u_{P{S}_i}+u_{OS})K_{OS}+(d_{P{S}_i}+d_{OS})E\right),P\right)\hfill \\ \hfill & =e\left(K_{PS},{\displaystyle \sum _{i=1}^n}{X}_{P{S}_i}\right)·e\left(K_{OS},n{U}_{OS}+{\displaystyle \sum _{i=1}^n}{U}_{P{S}_i}\right)\hfill \\ \hfill & ·e\left(E,{\displaystyle \sum _{i=1}^n}{R}_{P{S}_i}+n{R}_{OS}+\left({\displaystyle \sum _{i=1}^n}{h}_{P{S}_i}+n{h}_{OS}\right)P_{pub}\right)\hfill \\ \hfill & =e(K_{PS},X_{MPS})·e(K_{OS},n{U}_{OS}+U_{MPS})\hfill \\ \hfill & ·e\left(E,{\displaystyle \sum _{i=1}^n}{R}_{P{S}_i}+n{R}_{OS}+\left({\displaystyle \sum _{i=1}^n}{h}_{P{S}_i}+n{h}_{OS}\right)P_{pub}\right).\hfill \end{array}$$

Hence, every correctly generated multi-proxy signature satisfies the verification equation.

6. Security Proof

6.1. Security Proof of Unforgeability

Theorem 1.

Under the CDH assumption in $G_1$ and the collision resistance of ${\widehat{H}}_2,{\widehat{H}}_3$, the proposed IBMPS scheme is existentially unforgeable in Game 1, which permits adaptive queries and the specified collusion but excludes public-key replacement. For any PPT adversary $\mathcal{A}$ and each Scenario i, there exists a PPT CDH solver ${\mathcal{C}}_i$ satisfying

$${\epsilon }_i\le L_i{\mathrm{Adv}}_{{\mathcal{C}}_i}^{\mathrm{CDH}}+\mathrm{negl}\left(\mu \right),i\in \{1,2,3\},$$

where ${\epsilon }_i$ is the Scenario i winning probability, ${\mathrm{Adv}}_{{\mathcal{C}}_i}^{\mathrm{CDH}}$ is the solver’s success probability, and

$$\begin{array}{cc}\hfill L_1& =4q_{PU}{Q}_1(\ell +1),\hfill \\ \hfill L_2& =16q_{PU}{Q}_1{Q}_2{(\ell +1)}^2,\hfill \\ \hfill L_3& =16q_{PU}{Q}_1{(\ell +1)}^2.\hfill \end{array}$$

The query bounds are defined below, with $q>2\max \{Q_1,Q_2\}(\ell +1)$, $1\le n<q$, and $Q_2=1$ in Scenario 3. Simulation and extraction coefficient events are accounted for in $L_i$, not assumed separately.

Proof. 

Let $\mathcal{A}$ be a probabilistic polynomial-time adversary in Game 1. The reduction algorithm $\mathcal{C}$ receives a CDH instance $(P,aP,bP)$ for the scheme’s group parameters, where $a,b$ are independently and uniformly chosen from ${\mathbb{Z}}_q^{*}$, and aims to compute $abP$.

Setup Phase. The reduction completes the setup phase in the following three steps.

(1) Generates master key and public parameters.

The reduction uniformly selects $x\in {\mathbb{Z}}_q^{*}$ and sets

$$mk=x,P_{pub}=xP,E=bP.$$

It retains $mk$ privately. Since b is uniform in ${\mathbb{Z}}_q^{*}$, E is a uniformly random generator of $G_1$.

(2) Generates Waters hash parameters.

The reduction generates $H_1$, ${\widehat{H}}_2$, and ${\widehat{H}}_3$ as in the real Setup algorithm, with

$$H_1:{\{0,1\}}^{*}\to {\mathbb{Z}}_q^{*},{\widehat{H}}_2,{\widehat{H}}_3:{\{0,1\}}^{*}\to {\{0,1\}}^{\ell }.$$

Let $Q_1,Q_2\ge 1$ be fixed polynomial upper bounds on the numbers of distinct inputs for which the simulation requires nonzero coefficients $J_2$ and $J_3$, respectively. In Scenario 2, $Q_2$ bounds all distinct $H_3$ inputs at which the target proxy releases a partial signature, including queries answered using explicit keys. This conservative set contains every input requiring nonzero $J_3$ in an implicit-key simulation. Repeated inputs are counted once. The bounds are fixed before the interaction. Set

$$M_1=2Q_1,M_2=2Q_2,$$

and assume

$$q>\max \{M_1,M_2\}(\ell +1).$$

The reduction independently and uniformly samples

$$\begin{array}{cc}\hfill c_0,\dots ,c_{\ell }& \in \{0,\dots ,M_1-1\},\hfill \\ \hfill c_0^{\prime },\dots ,c_{\ell }^{\prime }& \in \{0,\dots ,M_2-1\},\hfill \\ \hfill k_1,k_2& \in \{0,\dots ,\ell \},\hfill \end{array}$$

and defines the integer coefficients

$$\begin{array}{cccc}\hfill {\alpha }_0& =c_0-M_1{k}_1,\hfill & \hfill {\alpha }_j& =c_j,j=1,\dots ,\ell ,\hfill \\ \hfill {\gamma }_0& =c_0^{\prime }-M_2{k}_2,\hfill & \hfill {\gamma }_j& =c_j^{\prime },j=1,\dots ,\ell .\hfill \end{array}$$

It independently samples

$${\beta }_0,\dots ,{\beta }_{\ell },{\eta }_0,\dots ,{\eta }_{\ell }\stackrel{\$}{\leftarrow }{\mathbb{Z}}_q$$

and computes

$$T_j={\alpha }_{j}E+{\beta }_{j}P,S_j={\gamma }_{j}E+{\eta }_{j}P,j=0,\dots ,\ell .$$

It does not resample if any $T_j$ or $S_j$ equals $0_{G_1}$. Since ${\beta }_j$ and ${\eta }_j$ are sampled independently and uniformly from ${\mathbb{Z}}_q$, and P generates $G_1$, each $T_j$ and $S_j$ is uniformly distributed over $G_1$, including $0_{G_1}$, as in the Setup algorithm.

Parameter-distribution consistency. The value $E=bP$ is uniformly distributed over $G_1\setminus \left\{0_{G_1}\right\}$, as specified in the real Setup. For every $j\in \{0,\dots ,\ell \}$, since ${\beta }_j$ and ${\eta }_j$ are independently uniform in ${\mathbb{Z}}_q$ and P generates $G_1$, the values

$$T_j={\alpha }_{j}E+{\beta }_{j}P,S_j={\gamma }_{j}E+{\eta }_{j}P$$

are independently uniform in $G_1$, including $0_{G_1}$, as in the real Setup. Moreover, the target public key $aP$ is uniformly distributed over $G_1\setminus \left\{0_{G_1}\right\}$, exactly as an ordinary public key $rP$ for $r\leftarrow {\mathbb{Z}}_q^{*}$.

For an encoded input z, let

$$(z_1,\dots ,z_{\ell })={\widehat{H}}_2\left(z\right),(z_1^{\prime },\dots ,z_{\ell }^{\prime })={\widehat{H}}_3\left(z\right).$$

The public hash functions are

$$H_2\left(z\right)=T_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j{T}_j,H_3\left(z\right)=S_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j^{\prime }{S}_j.$$

Using its stored coefficients, $\mathcal{C}$ can compute

$$\begin{array}{cccc}\hfill J_2\left(z\right)& ={\alpha }_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j{\alpha }_j,\hfill & \hfill B_2\left(z\right)& ={\beta }_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j{\beta }_j,\hfill \\ \hfill J_3\left(z\right)& ={\gamma }_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j^{\prime }{\gamma }_j,\hfill & \hfill B_3\left(z\right)& ={\eta }_0+{\displaystyle \sum _{j=1}^{\ell }}{z}_j^{\prime }{\eta }_j,\hfill \end{array}$$

so that

$$H_2\left(z\right)=J_2\left(z\right)E+B_2\left(z\right)P,H_3\left(z\right)=J_3\left(z\right)E+B_3\left(z\right)P.$$

The coefficients $J_2,J_3$ are defined over the integers; group scalar operations are performed modulo q.

(3) Distributes parameters.

The reduction sends

$$params=(G_1,G_2,q,e,P,E,P_{pub},{\left\{T_j\right\}}_{j=0}^{\ell },{\left\{S_j\right\}}_{j=0}^{\ell },H_1,{\widehat{H}}_2,{\widehat{H}}_3)$$

to $\mathcal{A}$, including the public hash indices and descriptions. It retains $mk$ and the decomposition coefficients privately.

Query phase. The reduction $\mathcal{C}$ maintains the lists defined in Game 1. In addition to the lists defined in Game 1, $\mathcal{C}$ maintains a reduction-only list $L_{Sim}$ for proxy signing keys that are represented implicitly during signing-query simulations. Each entry records the matching delegation, identities, public keys, the ordered list L, and the random scalar $u_{P{S}_i}$ and public value $U_{P{S}_i}$. The corresponding proxy signing key is not stored in $L_{Sim}$ because $\mathcal{C}$ cannot compute it explicitly. Entries in $L_{Sim}$ do not represent key disclosure and are not entries in $L_{Exp}$. Let $q_{PU}$ be a polynomial upper bound on the number of distinct identities registered during the interaction, including registrations triggered by queries other than $Q_{\mathrm{PubK}}$. Before answering queries, $\mathcal{C}$ uniformly guesses one of these registration positions. When the identity at the guessed registration position is registered, $\mathcal{C}$ sets its public key to $aP$. Since a is uniform in ${\mathbb{Z}}_q^{*}$, this public key is distributed exactly as $rP$ for $r\leftarrow {\mathbb{Z}}_q^{*}$ in the real key-generation algorithm. The identity registered at that position is denoted by $I{D}^{\diamond }$. This is an internal guess by the reduction and does not require $\mathcal{A}$ to select its target identity in advance.

$Q_{\mathrm{PubK}}\left(I{D}_i\right)$: If $I{D}_i$ is already registered, $\mathcal{C}$ returns its current public key from $L_{Pub}$. Otherwise, it registers $I{D}_i$ as follows.

(1) If this is the guessed registration position, $\mathcal{C}$ sets

$$I{D}^{\diamond }=I{D}_i,R_i=aP.$$

It stores $(I{D}_i,R_i,\perp )$ in $L_{Key}$ and $(I{D}_i,R_i)$ in $L_{Pub}$, where ⊥ indicates that the corresponding private key is unknown to $\mathcal{C}$.

(2) Otherwise, $\mathcal{C}$ uniformly selects $r_i\in {\mathbb{Z}}_q^{*}$ and computes

$$R_i=r_{i}P,h_i=H_1(I{D}_i,R_i),d_i=(r_i+h_{i}x)\mathrm{mod}q.$$

It stores $(I{D}_i,R_i,d_i)$ in $L_{Key}$ and $(I{D}_i,R_i)$ in $L_{Pub}$.

In both cases, $\mathcal{C}$ returns $R_i$. The same registration procedure is used whenever another query first introduces an unregistered identity. Internal key generation does not add an entry to $L_{Pri}$. Since a is uniformly distributed over ${\mathbb{Z}}_q^{*}$, the initial public key $aP$ has the same distribution as an honestly generated public key $r_{i}P$.

$Q_{\mathrm{PriK}}\left(I{D}_i\right)$: If $I{D}_i$ is unregistered, $\mathcal{C}$ first registers it using the procedure described in $Q_{\mathrm{PubK}}$. It then proceeds as follows.

(1) If $I{D}_i=I{D}^{\diamond }$, $\mathcal{C}$ aborts the simulation, since the corresponding private key is unknown.

(2) Otherwise, $\mathcal{C}$ retrieves $(I{D}_i,R_i,d_i)$ from $L_{Key}$ and returns $d_i$ to $\mathcal{A}$. It adds $I{D}_i$ to $L_{Pri}$ if it is not already recorded. Repeated queries return the same private key.

$Q_{\mathrm{Dele}}(w,I{D}_{OS},P{K}_{OS},L)$: The reduction $\mathcal{C}$ registers any unregistered identities using the procedure described in $Q_{\mathrm{PubK}}$. It checks the supplied public keys and the designated proxy group as specified in Game 1. If any check fails, it returns ⊥.

It computes

$$h_{OS}=H_1(I{D}_{OS},R_{OS}),$$

and proceeds as follows.

(1) If $I{D}_{OS}\ne I{D}^{\diamond }$, $\mathcal{C}$ retrieves the corresponding private key $d_{OS}$, computes

$$K_{OS}=H_2(w,I{D}_{OS},R_{OS},L),$$

samples $u_{OS}$ uniformly from ${\mathbb{Z}}_q^{*}$, and computes

$$U_{OS}=u_{OS}P,V_{OS}=d_{OS}E+u_{OS}{K}_{OS}.$$

(2) If $I{D}_{OS}=I{D}^{\diamond }$, then $R_{OS}=aP$. $\mathcal{C}$ computes

$$K_{OS}=H_2(w,I{D}_{OS},R_{OS},L),$$

and, using its stored hash-generation coefficients, computes the integer coefficient J and a scalar $B\in {\mathbb{Z}}_q$ such that

$$K_{OS}=JE+BP.$$

If $J=0$, it aborts the simulation. Otherwise, it samples t uniformly from ${\mathbb{Z}}_q$ and computes

$$U_{OS}=tP-J^{-1}\left(aP\right).$$

If $U_{OS}=0_{G_1}$, it resamples t and recomputes $U_{OS}$ until $U_{OS}\ne 0_{G_1}$. It then computes

$$V_{OS}=h_{OS}xE+t{K}_{OS}-B{J}^{-1}\left(aP\right).$$

In either case, $\mathcal{C}$ returns $(w,U_{OS},V_{OS})$ together with L and stores

$$(w,I{D}_{OS},P{K}_{OS},L,(w,U_{OS},V_{OS}))$$

in $L_{Dele}$. No entry is added to $L_{Pri}$.

$Q_{\mathrm{ProK}}$: The reduction $\mathcal{C}$ registers any unregistered identities as described in $Q_{\mathrm{PubK}}$. It verifies the delegation and checks the supplied public keys and the membership of $P{S}_i$ according to Game 1. If any check fails, it returns ⊥.

A matching entry is determined by the delegation, the original signer, the proxy signer, their public keys, and the ordered list L.

If a matching entry exists in $L_{\mathrm{Pro}}$, $\mathcal{C}$ retrieves the stored $(PS{K}_{P{S}_i},U_{P{S}_i})$. It records the corresponding exposure tuple in $L_{\mathrm{Exp}}$ if it is not already present, and returns $(PS{K}_{P{S}_i},U_{P{S}_i})$ to $\mathcal{A}$.

If no matching entry exists in $L_{\mathrm{Pro}}$ but a matching entry exists in $L_{\mathrm{Sim}}$, the corresponding proxy signing key is represented implicitly and cannot be returned to $\mathcal{A}$. In this case, $\mathcal{C}$ aborts this query simulation. It does not add an entry to $L_{\mathrm{Exp}}$.

If no matching entry exists in either list, $\mathcal{C}$ computes

$$K_{OS}=H_2(w,I{D}_{OS},R_{OS},L),h_{P{S}_i}=H_1(I{D}_{P{S}_i},R_{P{S}_i}),$$

and proceeds as follows.

(1) If $I{D}_{P{S}_i}\ne I{D}^{\diamond }$, $\mathcal{C}$ retrieves the corresponding private key $d_{P{S}_i}$ from $L_{\mathrm{Key}}$, uniformly selects $u_{P{S}_i}\in {\mathbb{Z}}_q^{*}$, and computes

$$U_{P{S}_i}=u_{P{S}_i}P,PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}.$$

(2) If $I{D}_{P{S}_i}=I{D}^{\diamond }$ and $R_{P{S}_i}=aP$, $\mathcal{C}$ uses its stored hash-generation coefficients to compute the integer coefficient J and a scalar $B\in {\mathbb{Z}}_q$ such that

$$K_{OS}=JE+BP.$$

If $J=0$, $\mathcal{C}$ aborts this query simulation. Otherwise, it uniformly selects $t\in {\mathbb{Z}}_q$ and computes

$$U_{P{S}_i}=tP-J^{-1}\left(aP\right).$$

If $U_{P{S}_i}=0_{G_1}$, it resamples t and recomputes $U_{P{S}_i}$ until $U_{P{S}_i}\ne 0_{G_1}$. It then computes

$$PS{K}_{P{S}_i}=h_{P{S}_i}xE+t{K}_{OS}-B{J}^{-1}\left(aP\right)+V_{OS}.$$

This computation is consistent with ProK-Generate. For the implicit scalar $u_{P{S}_i}=t-a{J}^{-1}$,

$$\begin{array}{cc}\hfill u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}& =(t-a{J}^{-1})(JE+BP)+(a+h_{P{S}_i}x)E+V_{OS}\hfill \\ & =t{K}_{OS}-B{J}^{-1}\left(aP\right)+h_{P{S}_i}xE+V_{OS}.\hfill \end{array}$$

If $I{D}_{P{S}_i}=I{D}^{\diamond }$ but $R_{P{S}_i}\ne aP$, $\mathcal{C}$ aborts this query simulation.

For either newly generated explicit key, $\mathcal{C}$ stores

$$((w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,PS{K}_{P{S}_i},U_{P{S}_i})$$

in $L_{\mathrm{Pro}}$. It records the corresponding exposure tuple in $L_{\mathrm{Exp}}$ and returns $(PS{K}_{P{S}_i},U_{P{S}_i})$ to $\mathcal{A}$. Internal generation of a key does not add an entry to $L_{\mathrm{Pri}}$.

$Q_{\mathrm{MPS}}(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},{\left\{I{D}_{P{S}_i}\right\}}_{i=1}^n,{\left\{P{K}_{P{S}_i}\right\}}_{i=1}^n)$:

The reduction $\mathcal{C}$ verifies the delegation, checks that m complies with w, and checks the supplied public keys and designated proxy group according to Game 1. If any check fails, it returns ⊥. Otherwise, it proceeds as follows.

(1) Partial signature generation.

For each honest proxy signer $P{S}_i$, $\mathcal{C}$ searches $L_{\mathrm{Pro}}$ and $L_{\mathrm{Sim}}$ for a matching proxy signing-key record. A matching record has the same delegation, original signer, proxy signer, public keys, and ordered list L.

If a matching explicit key $(PS{K}_{P{S}_i},U_{P{S}_i})$ exists in $L_{\mathrm{Pro}}$, $\mathcal{C}$ retrieves and uses it.

If a matching implicit-key record exists in $L_{\mathrm{Sim}}$, $\mathcal{C}$ retrieves $(u_{P{S}_i},U_{P{S}_i})$. The corresponding proxy signing key is represented as

$$PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS},$$

but is not computed explicitly.

If no matching record exists and $I{D}_{P{S}_i}\ne I{D}^{\diamond }$, $\mathcal{C}$ samples $u_{P{S}_i}\in {\mathbb{Z}}_q^{*}$ and computes

$$U_{P{S}_i}=u_{P{S}_i}P,PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}.$$

It stores this explicit key and its public value in $L_{\mathrm{Pro}}$. This internal generation does not add an entry to $L_{\mathrm{Exp}}$.

If no matching record exists and $I{D}_{P{S}_i}=I{D}^{\diamond }$, $\mathcal{C}$ computes

$$z_2=(w,I{D}_{OS},R_{OS},L),K_{OS}=H_2\left(z_2\right)=J_2\left(z_2\right)E+B_2\left(z_2\right)P.$$

If $J_2\left(z_2\right)\ne 0$, $\mathcal{C}$ uses the internal explicit-key simulation described in $Q_{\mathrm{ProK}}$. It stores the resulting key in $L_{\mathrm{Pro}}$ without recording an exposure in $L_{\mathrm{Exp}}$.

If $J_2\left(z_2\right)=0$, $\mathcal{C}$ samples $u_{P{S}_i}\in {\mathbb{Z}}_q^{*}$ and computes

$$U_{P{S}_i}=u_{P{S}_i}P.$$

It stores the matching delegation, identities, public keys, ordered list L, and the pair $(u_{P{S}_i},U_{P{S}_i})$ in $L_{\mathrm{Sim}}$. It does not compute $PS{K}_{P{S}_i}$ explicitly.

If any required internal key-generation simulation aborts, $\mathcal{C}$ aborts this signing-query simulation.

When $\mathcal{A}$ controls some participants, it supplies their protocol messages as specified in Game 1. Using the public values from the signing interaction, $\mathcal{C}$ computes

$$U_{MPS}={\displaystyle \sum _{i=1}^n}{U}_{P{S}_i},K_{PS}=H_3(m,w,I{D}_{OS},R_{OS},U_{MPS}).$$

For each honest signer with an explicit proxy signing key, $\mathcal{C}$ samples $x_{P{S}_i}\in {\mathbb{Z}}_q^{*}$ and computes

$$X_{P{S}_i}=x_{P{S}_i}P,V_{P{S}_i}=x_{P{S}_i}{K}_{PS}+PS{K}_{P{S}_i}.$$

For an honest signer whose proxy signing key is represented implicitly in $L_{\mathrm{Sim}}$, let

$$z_3=(m,w,I{D}_{OS},R_{OS},U_{MPS}),K_{PS}=H_3\left(z_3\right)=J_3\left(z_3\right)E+B_3\left(z_3\right)P.$$

If $J_3\left(z_3\right)=0$, $\mathcal{C}$ aborts this signing-query simulation. Otherwise, it samples $t\in {\mathbb{Z}}_q$ and computes

$$X_{P{S}_i}=tP-J_3{\left(z_3\right)}^{-1}\left(aP\right).$$

If $X_{P{S}_i}=0_{G_1}$, it resamples t until $X_{P{S}_i}\ne 0_{G_1}$. It then computes

$$V_{P{S}_i}=t{K}_{PS}-B_3\left(z_3\right)J_3{\left(z_3\right)}^{-1}\left(aP\right)+u_{P{S}_i}{K}_{OS}+h_{P{S}_i}xE+V_{OS},$$

where

$$h_{P{S}_i}=H_1(I{D}_{P{S}_i},R_{P{S}_i}).$$

This partial signature is consistent with MP-Sign. For the implicit signing scalar

$$x_{P{S}_i}=t-a{J}_3{\left(z_3\right)}^{-1},$$

and the implicitly represented key

$$PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+(a+h_{P{S}_i}x)E+V_{OS},$$

we have

$$\begin{array}{cc}\hfill x_{P{S}_i}{K}_{PS}+PS{K}_{P{S}_i}=& (t-a{J}_3{\left(z_3\right)}^{-1})(J_3\left(z_3\right)E+B_3\left(z_3\right)P)\hfill \\ & +u_{P{S}_i}{K}_{OS}+(a+h_{P{S}_i}x)E+V_{OS}\hfill \\ \hfill =& t{K}_{PS}-B_3\left(z_3\right)J_3{\left(z_3\right)}^{-1}\left(aP\right)\hfill \\ & +u_{P{S}_i}{K}_{OS}+h_{P{S}_i}xE+V_{OS}.\hfill \end{array}$$

The resampling condition ensures that $x_{P{S}_i}\in {\mathbb{Z}}_q^{*}$. For each signing query, $\mathcal{C}$ uses fresh signing randomness and reuses the matching cached key state.

For each honest signer, $\mathcal{C}$ forms

$${\sigma }_{P{S}_i}=(w,U_{OS},V_{OS},X_{P{S}_i},V_{P{S}_i})$$

and records

$$(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},I{D}_{P{S}_i},P{K}_{P{S}_i},L,{\sigma }_{P{S}_i})$$

in $L_{\mathrm{Sign}}$.

$\mathcal{C}$ returns the prescribed public messages and partial signatures to $\mathcal{A}$. The records of released honest partial signatures are retained even if aggregation is not completed.

(2) Verification and aggregation.

When all n partial signatures are available, $\mathcal{C}$ verifies them according to MP-Sign. If any verification fails, it returns ⊥. Otherwise, it computes

$$V_{MPS}={\displaystyle \sum _{i=1}^n}{V}_{P{S}_i},X_{MPS}={\displaystyle \sum _{i=1}^n}{X}_{P{S}_i},$$

and returns

$${\sigma }_{MPS}=(w,U_{OS},U_{MPS},X_{MPS},V_{MPS}).$$

It stores

$$(m,(w,U_{OS},V_{OS}),I{D}_{OS},P{K}_{OS},{\left\{I{D}_{P{S}_i}\right\}}_{i=1}^n,{\left\{P{K}_{P{S}_i}\right\}}_{i=1}^n,L,{\sigma }_{MPS})$$

in $L_{\mathrm{Sign}}$.

Internal proxy-key generation does not constitute key disclosure and does not add an entry to $L_{\mathrm{Exp}}$.

Lemma 1 (Coupling of the query simulation).

The real experiment and the reduction’s simulation can be coupled so that their adversary-visible transcripts agree until the first simulation abort.

Proof. 

Uniform masking in $T_j={\alpha }_{j}E+{\beta }_{j}P$ and $S_j={\gamma }_{j}E+{\eta }_{j}P$ makes the public parameters independent of the hidden coefficient vectors. For analysis, generate a complete real execution $\mathcal{T}$ using independent real-game randomness, and sample the hidden coefficients independently of $\mathcal{T}$; the corresponding masking scalars give an equivalent representation of the parameter generation.

Couple simulated randomness to real randomness by $t=u+a/J$ for delegation and explicit-key simulation, and $t=x_{\mathrm{sig}}+a/J_3$ for implicit-key signing, where u denotes the corresponding real key-generation or delegation randomness and $x_{\mathrm{sig}}$ denotes the real signing randomness $x_{P{S}_i}$. For the probability analysis, the target and query bit strings are read from the independently generated real execution $\mathcal{T}$. Whenever the denominators are nonzero, these translations preserve the required distributions and produce identical responses. Both executions reuse matching cached keys. On the sufficient coefficient event, any target proxy key later exposed has nonzero $J_2$ and is therefore generated explicitly from its first use.

Identical visible histories induce identical subsequent adaptive queries. Thus the executions agree without abort on this event, while the bit strings determined by $\mathcal{T}$ remain independent of the hidden coefficients. □

Lemma 2 (Coefficient event bound).

Let $Q\ge 1$, $M=2Q$, and sample $c_0,\dots ,c_{\ell }$ uniformly and independently from $\{0,\dots ,M-1\}$, and k uniformly and independently from $\{0,\dots ,\ell \}$. Define

$$J\left(\mathbf{v}\right)=c_0+{\displaystyle \sum _{j=1}^{\ell }}{v}_j{c}_j-Mk.$$

For fixed bit strings ${\mathbf{v}}^{*},{\mathbf{v}}^{\left(1\right)},\dots ,{\mathbf{v}}^{\left(N\right)}\in {\{0,1\}}^{\ell }$, independent of these samples, with $0\le N\le Q$ and ${\mathbf{v}}^{\left(i\right)}\ne {\mathbf{v}}^{*}$ for every i,

$$\mathrm{Pr}\left[J\left({\mathbf{v}}^{*}\right)=0,J\left({\mathbf{v}}^{\left(i\right)}\right)\ne 0\forall i\right]\ge {\displaystyle \frac{1}{4Q(\ell +1)}}.$$

Proof. 

Write $S\left(\mathbf{v}\right)=c_0+{\sum }_j{v}_j{c}_j$ and $F\left(\mathbf{v}\right)=S\left(\mathbf{v}\right)\mathrm{mod}M$. The uniform choice of $c_0$ gives $\mathrm{Pr}[F\left({\mathbf{v}}^{*}\right)=0]=1/M$. For each i, the strings differ at some coordinate h. Conditional on the remaining coefficients, the map from $(c_0,c_h)$ to $(F\left({\mathbf{v}}^{*}\right),F\left({\mathbf{v}}^{\left(i\right)}\right))$ has determinant $v_h^{\left(i\right)}-v_h^{*}=\pm 1$, and is therefore invertible modulo M. Hence,

$$\mathrm{Pr}\left[F\left({\mathbf{v}}^{\left(i\right)}\right)=0\mid F\left({\mathbf{v}}^{*}\right)=0\right]={\displaystyle \frac{1}{M}}.$$

By the union bound, all query residues are nonzero with conditional probability at least $1-N/M$.

When $F\left({\mathbf{v}}^{*}\right)=0$, the bound $0\le S\left({\mathbf{v}}^{*}\right)<M(\ell +1)$ ensures a unique $k=S\left({\mathbf{v}}^{*}\right)/M\in \{0,\dots ,\ell \}$, selected with probability $1/(\ell +1)$. Nonzero query residues imply nonzero integer coefficients. Therefore,

$$\begin{array}{cc}& \mathrm{Pr}\left[J\left({\mathbf{v}}^{*}\right)=0,J\left({\mathbf{v}}^{\left(i\right)}\right)\ne 0\forall i\right]\hfill \\ & \ge {\displaystyle \frac{1-N/M}{M(\ell +1)}}\ge {\displaystyle \frac{1}{4Q(\ell +1)}}.\hfill \end{array}$$

Moreover, under the parameter condition $q>M(\ell +1)$, $\left|J\right(\mathbf{v}\left)\right|<M(\ell +1)<q$, so integer nonzero coefficients remain nonzero modulo q. □

Forgery Phase. The adversary $\mathcal{A}$ outputs either a multi-proxy signature

$${\sigma }_{MPS}^{*}=(w^{*},U_{OS}^{*},U_{MPS}^{*},X_{MPS}^{*},V_{MPS}^{*})$$

or a delegation $(w^{*},U_{OS}^{*},V_{OS}^{*})$, together with the identities and public keys required by Game 1.

Scenario 1: Delegation forgery.

Suppose that $(w^{*},U_{OS}^{*},V_{OS}^{*})$ satisfies the winning conditions of Scenario 1 in Game 1.

If $I{D}_{OS}^{*}\ne I{D}^{\diamond }$, or if the public key used to verify the forgery is not $R_{OS}^{*}=aP$, $\mathcal{C}$ aborts. Otherwise, it computes

$$h_{OS}^{*}=H_1(I{D}_{OS}^{*},R_{OS}^{*}),K_{OS}^{*}=H_2(w^{*},I{D}_{OS}^{*},R_{OS}^{*},L^{*}).$$

Using its stored hash-generation coefficients, $\mathcal{C}$ obtains $J_2^{*}\in \mathbb{Z}$ and $B_2^{*}\in {\mathbb{Z}}_q$ such that

$$K_{OS}^{*}=J_2^{*}E+B_2^{*}P.$$

If $J_2^{*}\ne 0$, $\mathcal{C}$ aborts. Otherwise, $K_{OS}^{*}=B_2^{*}P$.

Since the final delegation passes verification,

$$\begin{array}{cc}\hfill e(V_{OS}^{*},P)& =e(E,aP+h_{OS}^{*}xP)e(B_2^{*}P,U_{OS}^{*})\hfill \\ & =e(abP+h_{OS}^{*}xE+B_2^{*}{U}_{OS}^{*},P).\hfill \end{array}$$

By non-degeneracy and the prime order of $G_1$, the map $V\mapsto e(V,P)$ is injective. Therefore,

$$V_{OS}^{*}=abP+h_{OS}^{*}xE+B_2^{*}{U}_{OS}^{*}.$$

The reduction outputs

$$abP=V_{OS}^{*}-h_{OS}^{*}xE-B_2^{*}{U}_{OS}^{*}.$$

Probability Analysis for Scenario 1.

Let $q_{PU}$ be a polynomial upper bound on the number of distinct identity registrations. Let $Q_1\ge 1$ be a fixed polynomial upper bound on the number of distinct $H_2$ inputs for which the simulation requires a nonzero coefficient $J_2$. These inputs include the target identity’s delegation queries and any other simulation queries for which $J_2\ne 0$ is required. Set $M_1=2Q_1$.

Let ${\epsilon }_1^{\mathrm{good}}$ denote the probability that $\mathcal{A}$ produces a successful Scenario 1 forgery with an unchanged target public key, with all required non-target private keys available to $\mathcal{C}$, and with no collision under ${\widehat{H}}_2$ between the target input and a distinct input requiring a nonzero $J_2$.

Define the events:

$$\begin{array}{cc}\hfill {\pi }_1& :\mathrm{such}\mathrm{a}\mathrm{successful}\mathrm{Scenario}1\mathrm{forgery}\mathrm{occurs},\hfill \\ \hfill {\pi }_2& :\mathcal{C}\mathrm{correctly}\mathrm{guesses}\mathrm{the}\mathrm{target}\mathrm{identity}’\mathrm{s}\mathrm{registration}\mathrm{position},\hfill \\ \hfill {\pi }_3& :\mathrm{the}\mathrm{query}\mathrm{simulation}\mathrm{completes}\mathrm{and}{J}_2^{*}=0.\hfill \end{array}$$

Then

$$\mathrm{Pr}\left[{\pi }_1\right]={\epsilon }_1^{\mathrm{good}},\mathrm{Pr}[{\pi }_2\mid {\pi }_1]={\displaystyle \frac{1}{q_{PU}}}.$$

For a fixed eligible real-game execution, let ${\mathbf{v}}^{*}$ be the target bit string output by ${\widehat{H}}_2$, and let ${\mathbf{v}}^{\left(1\right)},\dots ,{\mathbf{v}}^{\left(N\right)}$ be the distinct query bit strings requiring nonzero $J_2$, where $N\le Q_1$. Eligibility ensures that ${\mathbf{v}}^{\left(i\right)}\ne {\mathbf{v}}^{*}$ for every i. Applying the Coefficient event bound lemma with $Q=Q_1$ and $M=M_1$ gives

$$\begin{array}{cc}\hfill \mathrm{Pr}[{\pi }_3\mid {\pi }_1\wedge {\pi }_2]& \ge {\displaystyle \frac{1}{M_1}}\left(1-{\displaystyle \frac{N}{M_1}}\right){\displaystyle \frac{1}{\ell +1}}\hfill \\ & \ge {\displaystyle \frac{1}{4Q_1(\ell +1)}}.\hfill \end{array}$$

By the coupling lemma, the complete real execution $\mathcal{T}$ is independent of the hidden coefficient vector. Conditional on any eligible $\mathcal{T}$, the target and query bit strings are fixed, so the Coefficient event bound lemma applies. Averaging this pointwise lower bound over eligible real executions gives the same bound for adaptive queries.

Whenever ${\pi }_1,{\pi }_2,{\pi }_3$ occur, the extraction in Scenario 1 outputs the correct CDH value. Hence,

$$\begin{array}{cc}\hfill \mathrm{Pr}\left[\mathcal{C}\mathrm{solves}\mathrm{CDH}\right]& \ge \mathrm{Pr}\left[{\pi }_1\right]\mathrm{Pr}[{\pi }_2\mid {\pi }_1]\mathrm{Pr}[{\pi }_3\mid {\pi }_1\wedge {\pi }_2]\hfill \\ & \ge {\displaystyle \frac{{\epsilon }_1^{\mathrm{good}}}{4q_{PU}{Q}_1(\ell +1)}}.\hfill \end{array}$$

By the collision resistance of ${\widehat{H}}_2$ and the polynomial number of queries, the probability that the target input collides with a distinct, relevant query input is negligible. Hence, ${\epsilon }_1^{\mathrm{good}}$ differs from the Scenario 1 winning probability by at most a negligible amount.

Scenario 2: CDH extraction.

Suppose that $\mathcal{A}$ outputs a signature

$${\sigma }_{MPS}^{*}=(w^{*},U_{OS}^{*},U_{MPS}^{*},X_{MPS}^{*},V_{MPS}^{*})$$

on $m^{*}$ satisfying the winning conditions of Scenario 2 in Game 1. Let $P{S}_1$ denote the honest proxy signer.

If $I{D}_{P{S}_1}^{*}\ne I{D}^{\diamond }$, or if the public key used in the forgery is not $R_{P{S}_1}^{*}=aP$, $\mathcal{C}$ aborts. Otherwise,

$$h_{P{S}_1}^{*}=H_1(I{D}_{P{S}_1}^{*},R_{P{S}_1}^{*}),d_{P{S}_1}^{*}=(a+h_{P{S}_1}^{*}x)\mathrm{mod}q.$$

The reduction evaluates

$$\begin{array}{cc}\hfill K_{OS}^{*}& =H_2(w^{*},I{D}_{OS}^{*},R_{OS}^{*},L^{*}),\hfill \\ \hfill K_{PS}^{*}& =H_3(m^{*},w^{*},I{D}_{OS}^{*},R_{OS}^{*},U_{MPS}^{*}).\hfill \end{array}$$

Using the coefficients retained during its parameter generation, $\mathcal{C}$ computes

$$K_{OS}^{*}=J_2^{*}E+B_2^{*}P,K_{PS}^{*}=J_3^{*}E+B_3^{*}P.$$

The extraction requires

$$J_2^{*}=0,J_3^{*}=0,$$

and knowledge of $d_{OS}^{*},d_{P{S}_2}^{*},\dots ,d_{P{S}_n}^{*}$ for the corresponding public keys in the forgery. These private keys are available from $L_{\mathrm{Key}}$ for the corrupted participants in Scenario 2. If any extraction condition fails, $\mathcal{C}$ does not output a CDH solution in this execution.

Since MP-Verify accepts the final forgery, its verification equation, bilinearity, and non-degeneracy imply

$$V_{MPS}^{*}=\left(n{d}_{OS}^{*}+{\displaystyle \sum _{i=1}^n}{d}_{P{S}_i}^{*}\right)E+B_2^{*}(n{U}_{OS}^{*}+U_{MPS}^{*})+B_3^{*}{X}_{MPS}^{*}.$$

Substituting $d_{P{S}_1}^{*}=(a+h_{P{S}_1}^{*}x)\mathrm{mod}q$ gives

$$\begin{array}{cc}\hfill V_{MPS}^{*}=& abP+\left(n{d}_{OS}^{*}+h_{P{S}_1}^{*}x+{\displaystyle \sum _{i=2}^n}{d}_{P{S}_i}^{*}\right)E\hfill \\ & +B_2^{*}(n{U}_{OS}^{*}+U_{MPS}^{*})+B_3^{*}{X}_{MPS}^{*}.\hfill \end{array}$$

Therefore, $\mathcal{C}$ outputs

$$\begin{array}{cc}\hfill abP=& V_{MPS}^{*}-B_2^{*}(n{U}_{OS}^{*}+U_{MPS}^{*})-B_3^{*}{X}_{MPS}^{*}\hfill \\ & -\left(n{d}_{OS}^{*}+h_{P{S}_1}^{*}x+{\displaystyle \sum _{i=2}^n}{d}_{P{S}_i}^{*}\right)E.\hfill \end{array}$$

All terms on the right-hand side are known to $\mathcal{C}$ under the stated conditions. The reduction performs this extraction only from the adversary’s final forgery.

Probability Analysis for Scenario 2.

Let $q_{PU}$ be a polynomial upper bound on the number of distinct identity registrations. Let $Q_1,Q_2\ge 1$ be fixed polynomial upper bounds on the numbers of distinct query bit strings that impose nonzero-coefficient conditions for $H_2$ and $H_3$, respectively. Set

$$M_1=2Q_1,M_2=2Q_2.$$

For a fixed real execution $\mathcal{T}$ and the guessed target identity, let ${\mathcal{Z}}_2\left(\mathcal{T}\right)$ contain the distinct $H_2$ inputs of valid delegation queries in which the target is the original signer, and valid proxy-key exposure queries in which the target is the proxy signer. Its size is bounded by $Q_1$. Requiring nonzero $J_2$ on this set ensures that a key later exposed is generated explicitly from its first use.

Let ${\mathcal{Z}}_3\left(\mathcal{T}\right)$ contain all distinct $H_3$ inputs at which the target proxy releases a partial signature, including queries answered using explicit keys. Its size is bounded by $Q_2$. This conservative set covers every implicit-key signing query. Both sets are determined by $\mathcal{T}$ and the target identity, independently of the hidden coefficients.

Let ${\epsilon }_2^{\mathrm{good}}$ be the probability that $\mathcal{A}$ produces a successful Scenario 2 forgery with an unchanged target public key, with the other private keys required for extraction are available, and with no collision under either ${\widehat{H}}_2$ or ${\widehat{H}}_3$ between distinct relevant inputs. The relevant inputs include the target inputs and all query inputs are counted in $Q_1$ and $Q_2$.

Define the events:

$$\begin{array}{cc}\hfill {\pi }_1& :\mathrm{such}\mathrm{a}\mathrm{successful}\mathrm{Scenario}2\mathrm{forgery}\mathrm{occurs},\hfill \\ \hfill {\pi }_2& :\mathcal{C}\mathrm{correctly}\mathrm{guesses}\mathrm{the}\mathrm{honest}\mathrm{proxy}’\mathrm{s}\mathrm{registration}\mathrm{position},\hfill \\ \hfill {\pi }_3& :\mathrm{the}{H}_2-\mathrm{coefficient}\mathrm{conditions}\mathrm{hold}\mathrm{and}\mathrm{all}{H}_2-\mathrm{dependent}\mathrm{queries}\mathrm{are}\mathrm{answered},\hfill \\ \hfill {\pi }_4& :J_3^{*}=0\mathrm{and}\mathrm{all}{H}_3-\mathrm{dependent}\mathrm{signing}\mathrm{queries}\mathrm{are}\mathrm{answered}.\hfill \end{array}$$

Here, ${\pi }_3$ requires $J_2^{*}=0$ and requires $J_2\ne 0$ for every distinct $H_2$ query input counted in $Q_1$. Event ${\pi }_4$ requires $J_3^{*}=0$ and requires $J_3\ne 0$ for every distinct $H_3$ query input counted in $Q_2$.

Fix an eligible real execution $\mathcal{T}$ and a correct target-identity guess. By the coupling lemma, the target bit strings and the sets ${\mathcal{Z}}_2\left(\mathcal{T}\right)$ and ${\mathcal{Z}}_3\left(\mathcal{T}\right)$ are fixed independently of the hidden coefficients. Freshness and collision exclusion ensure that each target bit string differs from the query bit strings in its corresponding set.

Applying the Coefficient event bound lemma to the two independently sampled coefficient families gives a lower bound of $1/\left[16Q_1{Q}_2{(\ell +1)}^2\right]$ for the joint coefficient event. On this event, the coupled simulation completes and extraction succeeds. Averaging over eligible real executions therefore yields

$$\mathrm{Pr}[{\pi }_3\wedge {\pi }_4\mid {\pi }_1\wedge {\pi }_2]\ge {\displaystyle \frac{1}{16Q_1{Q}_2{(\ell +1)}^2}}.$$

No independence between ${\pi }_3$ and ${\pi }_4$ is assumed.

The target identity’s registration position is guessed with probability at least $1/q_{PU}$. Therefore,

$$\begin{array}{cc}\hfill \mathrm{Pr}\left[\mathcal{C}\mathrm{solves}\mathrm{CDH}\right]& \ge \mathrm{Pr}\left[{\pi }_1\right]\mathrm{Pr}[{\pi }_2\mid {\pi }_1]\mathrm{Pr}[{\pi }_3\wedge {\pi }_4\mid {\pi }_1\wedge {\pi }_2]\hfill \\ & \ge {\displaystyle \frac{{\epsilon }_2^{\mathrm{good}}}{16q_{PU}{Q}_1{Q}_2{(\ell +1)}^2}}.\hfill \end{array}$$

The probability of a collision under either collision-resistant hash family is negligible for a polynomial number of queries. The freshness conditions in Scenario 2 exclude the target signing input from the corresponding prohibited signing queries. Consequently, the collision-related loss between the Scenario 2 winning probability and ${\epsilon }_2^{\mathrm{good}}$ is negligible.

Since $q_{PU},Q_1,Q_2$, and ℓ are polynomially bounded, a non-negligible Scenario 2 winning probability yields a non-negligible CDH success probability, up to negligible collision-related loss. This contradicts the CDH assumption. Hence, the scheme is existentially unforgeable under Scenario 2 of Game 1. The coupling and coefficient-event lemmas establish the required simulation and extraction probabilities; these are not additional assumptions.

Scenario 3: CDH extraction.

Suppose that $\mathcal{A}$ outputs a signature

$${\sigma }_{MPS}^{*}=(w^{*},U_{OS}^{*},U_{MPS}^{*},X_{MPS}^{*},V_{MPS}^{*})$$

on $m^{*}$ satisfying Scenario 3 of Game 1. The original signer remains honest, whereas all n proxy signers are compromised. Assume that $1\le n<q$.

If $I{D}_{OS}^{*}\ne I{D}^{\diamond }$, or if the original signer’s public key in the forgery is not $aP$, $\mathcal{C}$ aborts. Otherwise,

$$R_{OS}^{*}=aP,d_{OS}^{*}=(a+h_{OS}^{*}x)\mathrm{mod}q,$$

where

$$h_{OS}^{*}=H_1(I{D}_{OS}^{*},R_{OS}^{*}).$$

The reduction evaluates

$$\begin{array}{cc}\hfill K_{OS}^{*}& =H_2(w^{*},I{D}_{OS}^{*},R_{OS}^{*},L^{*}),\hfill \\ \hfill K_{PS}^{*}& =H_3(m^{*},w^{*},I{D}_{OS}^{*},R_{OS}^{*},U_{MPS}^{*}).\hfill \end{array}$$

Using the coefficients retained during its parameter generation, $\mathcal{C}$ computes

$$K_{OS}^{*}=J_2^{*}E+B_2^{*}P,K_{PS}^{*}=J_3^{*}E+B_3^{*}P.$$

The extraction requires

$$J_2^{*}=0,J_3^{*}=0,$$

and knowledge of the private keys $d_{P{S}_1}^{*},\dots ,d_{P{S}_n}^{*}$ corresponding to the proxy public keys used in the forgery. Since all proxy signers are compromised in Scenario 3, these private keys are available to $\mathcal{C}$ from the key-generation and exposure records, provided their public keys are unchanged. If any required private key is unavailable, or either coefficient condition fails, $\mathcal{C}$ aborts this extraction.

Since MP-Verify accepts the forgery, the verification equation, bilinearity, and nondegeneracy imply

$$V_{MPS}^{*}=(n{d}_{OS}^{*}+{\displaystyle \sum _{i=1}^n}{d}_{P{S}_i}^{*})E+B_2^{*}(n{U}_{OS}^{*}+U_{MPS}^{*})+B_3^{*}{X}_{MPS}^{*}.$$

Substituting $E=bP$ and $d_{OS}^{*}=(a+h_{OS}^{*}x)\mathrm{mod}q$ yields

$$\begin{array}{cc}\hfill V_{MPS}^{*}=& nabP+(n{h}_{OS}^{*}x+{\displaystyle \sum _{i=1}^n}{d}_{P{S}_i}^{*})E\hfill \\ & +B_2^{*}(n{U}_{OS}^{*}+U_{MPS}^{*})+B_3^{*}{X}_{MPS}^{*}.\hfill \end{array}$$

Since $1\le n<q$, the inverse $n^{-1}$ exists in ${\mathbb{Z}}_q$. Therefore, $\mathcal{C}$ computes

$$\begin{array}{cc}\hfill abP=n^{-1}[& V_{MPS}^{*}-B_2^{*}(n{U}_{OS}^{*}+U_{MPS}^{*})-B_3^{*}{X}_{MPS}^{*}\hfill \\ & -(n{h}_{OS}^{*}x+{\displaystyle \sum _{i=1}^n}{d}_{P{S}_i}^{*})E].\hfill \end{array}$$

Every term on the right-hand side is computable under the stated conditions.

Probability Analysis for Scenario 3.

Let $q_{PU}$ bound the number of distinct identity registrations, and let $Q_1\ge 1$ bound the number of distinct $H_2$ inputs for the target original signer that require a nonzero coefficient during simulation. The bound includes every target delegation query whose simulation requires $J_2\ne 0$. Set

$$M_1=2Q_1,Q_2=1,M_2=2.$$

Let ${\epsilon }_3^{\mathrm{good}}$ denote the probability of a successful Scenario 3 forgery for which the original signer’s public key is unchanged, all proxy private keys required for extraction are available, and the target $H_2$ bit string differs from every target $H_2$ query bit string requiring a nonzero coefficient.

Define:

${\pi }_1$: such a successful forgery occurs;

${\pi }_2$: $\mathcal{C}$ correctly guesses the original signer’s registration position;

${\pi }_3$: all query simulations complete without aborting, including satisfaction of every required nonzero-coefficient condition;

${\pi }_4$: $J_2^{*}=J_3^{*}=0$.

Under the distribution-preserving coupling, the chain rule gives

$$\begin{array}{cc}\hfill \mathrm{Pr}\left[\mathcal{C}\mathrm{solves}\mathrm{CDH}\right]=& \mathrm{Pr}\left[{\pi }_1\right]\mathrm{Pr}[{\pi }_2\mid {\pi }_1]\mathrm{Pr}[{\pi }_3\mid {\pi }_1\wedge {\pi }_2]\hfill \\ & ·\mathrm{Pr}[{\pi }_4\mid {\pi }_1\wedge {\pi }_2\wedge {\pi }_3].\hfill \end{array}$$

By definition and the hidden uniform guess,

$$\mathrm{Pr}\left[{\pi }_1\right]={\epsilon }_3^{\mathrm{good}},\mathrm{Pr}[{\pi }_2\mid {\pi }_1]={\displaystyle \frac{1}{q_{PU}}}.$$

For a fixed eligible real-game execution, let $N_1\le Q_1$ be the number of distinct target ${\widehat{H}}_2$ query bit strings requiring nonzero $J_2$. By eligibility, each of these query bit strings differs from the target forgery bit string. Applying the Coefficient event bound lemma with $Q=Q_1$, $M=M_1$, and $N=N_1$ gives

$$\mathrm{Pr}[J_2^{*}=0,\mathrm{all}\mathrm{required}{J}_2\ne 0]\ge {\displaystyle \frac{1}{4Q_1(\ell +1)}}.$$

In Scenario 3, all proxy private keys are available to $\mathcal{C}$. Thus, proxy-key generation and signing do not require a nonzero coefficient for $H_3$ in order to be simulated. The reduction evaluates $H_3$ directly. Accordingly, there are no $H_3$ query constraints to satisfy, and the target condition $J_3^{*}=0$ is the only $H_3$ coefficient condition. Applying the Coefficient event bound lemma with $Q=Q_2=1$, $M=M_2=2$, and $N=0$ gives

$$\mathrm{Pr}[J_3^{*}=0]\ge {\displaystyle \frac{1}{4(\ell +1)}}.$$

Fix an eligible real execution $\mathcal{T}$ and a correct target-identity guess. By the coupling lemma, the target and query bit strings are independent of the hidden coefficients. Applying the Coefficient event bound lemma to the two independent coefficient families gives a joint coefficient-event probability of at least $1/\left[16Q_1{(\ell +1)}^2\right]$. On this event, simulation and extraction succeed. Averaging over eligible real executions yields

$$\mathrm{Pr}[{\pi }_3\wedge {\pi }_4\mid {\pi }_1\wedge {\pi }_2]\ge {\displaystyle \frac{1}{16Q_1{(\ell +1)}^2}}.$$

No independence between ${\pi }_3$ and ${\pi }_4$ is required.

Consequently,

$$\mathrm{Pr}\left[\mathcal{C}\mathrm{solves}\mathrm{CDH}\right]\ge {\displaystyle \frac{{\epsilon }_3^{\mathrm{good}}}{16q_{PU}{Q}_1{(\ell +1)}^2}}.$$

By the collision resistance of ${\widehat{H}}_2$ and the polynomial number of queries, the probability that the target input collides with a distinct relevant query input is negligible. Hence, ${\epsilon }_3^{\mathrm{good}}$ differs from the Scenario 3 winning probability by at most a negligible amount.

If $\mathcal{A}$ wins Scenario 3 with non-negligible probability ${\epsilon }_3^{\mathrm{good}}$, then $\mathcal{C}$ solves the CDH problem with non-negligible probability at least

$${\displaystyle \frac{{\epsilon }_3^{\mathrm{good}}}{16q_{PU}{Q}_1{(\ell +1)}^2}}.$$

Since $q_{PU}$, $Q_1$, and ℓ are polynomially bounded, this contradicts the CDH assumption. Therefore, the scheme is existentially unforgeable under Scenario 3 of Game 1 in the standard model.

By the union bound, the probability of winning Game 1 is at most ${\epsilon }_1+{\epsilon }_2+{\epsilon }_3$. Since each term is negligible, the overall winning probability is negligible, completing the proof of Theorem 1.

6.2. Further Security Discussion

Separate generation of partial proxy signing keys.

The scheme includes a separate proxy signing key generation procedure. After verifying the delegation, each proxy signer computes

$$PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}.$$

Subsequent signing uses $PS{K}_{P{S}_i}$ rather than directly accessing the long-term private key $d_{P{S}_i}$. This separates proxy-key generation from online signature generation.

Long-term private-key protection under proxy-key exposure.

We consider an honestly generated target public key that has not been replaced. The adversary may obtain the target user’s partial proxy signing keys and the associated public information, but not its long-term private scalar through a private-key extraction query. The objective is to recover that scalar.

Suppose that an adversary can recover $d_{P{S}_i}$ under these conditions. Given a CDH instance $(P,aP,bP)$, a reduction uniformly selects $x,s\in {\mathbb{Z}}_q^{*}$ and sets

$$P_{pub}=xP,E=sP,R_{P{S}_i}=aP.$$

All remaining parameters are generated as in the real scheme. The target key satisfies

$$h_{P{S}_i}=H_1(I{D}_{P{S}_i},R_{P{S}_i}),d_{P{S}_i}=a+h_{P{S}_i}x\left(\mathrm{mod}q\right).$$

Although the reduction does not know $d_{P{S}_i}$, it can compute

$$d_{P{S}_i}E=s\left(aP\right)+h_{P{S}_i}xE.$$

Consequently, for each valid delegation, the reduction selects $u_{P{S}_i}$ as in the real algorithm and computes

$$PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+s\left(aP\right)+h_{P{S}_i}xE+V_{OS}.$$

The resulting partial proxy signing key has exactly the distribution prescribed by the scheme. The reduction can return this key and $U_{P{S}_i}=u_{P{S}_i}P$, and can generate partial signatures using the simulated proxy key. It can also disclose $u_{P{S}_i}$ if this is included in the exposure experiment.

If the adversary outputs the correct scalar $d_{P{S}_i}$, the reduction computes

$$a=d_{P{S}_i}-h_{P{S}_i}x\left(\mathrm{mod}q\right)$$

and returns

$$abP=(d_{P{S}_i}-h_{P{S}_i}x)\left(bP\right).$$

Thus, for a fixed target identity, successful private-scalar recovery yields a CDH solution with the same success probability.

Partial multi-proxy signature verification.

Before aggregation, the clerk verifies every partial signature using

$$\begin{array}{cc}\hfill e(V_{P{S}_i},P)=& e\left(E,R_{OS}+R_{P{S}_i}+(h_{OS}+h_{P{S}_i})P_{pub}\right)\hfill \\ & ·e(X_{P{S}_i},K_{PS})\hfill \\ & ·e(K_{OS},U_{OS}+U_{P{S}_i}).\hfill \end{array}$$

The clerk aggregates the partial signatures only if all verification equations hold. Otherwise, it rejects the invalid partial signature and does not produce the aggregate signature from that collection. This provides an explicit check of each partial signature before aggregation. □

7. Performance Analysis

We compare the security-related features of representative identity-based multi-proxy signature schemes. For the computational-cost and representation-size comparisons, we additionally include a certificateless multi-proxy signature scheme as a reference.

Table 2 compares the security-related features and reported security analyses of the identity-based multi-proxy signature schemes. The certificateless multi-proxy signature scheme is excluded from this table because it uses a different key-generation framework and adversarial model, including public-key replacement and attacks by a malicious key-generation center. Its security guarantees are therefore not directly comparable under the same criteria. Nevertheless, it is included in the subsequent computational-cost and representation-size comparisons as a reference for collaborative proxy signing.

Table 2. Security-related features and reported analyses of representative IBMPS schemes.

Scheme	PSK Generation	Reported Proof	Proof Model	Main Assumptions	Key-Recovery Resistance	PMPV
Xu [20]	Yes	No	N/A	N/A	N/A	No
Li [19]	Yes	No	N/A	N/A	No	Yes
Cao [21]	Yes	Yes	ROM	CDH	No	Yes
Gu [24]	Yes	Yes	SM	CDH	Yes	No
Chen [25]	No	Yes	ROM	CDH	N/A	Yes
Shin [26]	Yes	Yes	ROM	CDH	Yes	Yes
Proposed scheme	Yes	Yes	SM	CDH; CR for ${\widehat{H}}_2,{\widehat{H}}_3$	Yes	Yes

PSK: Partial proxy signing key. PMPV: verification of individual partial multi-proxy signatures before aggregation. ROM: random oracle model. SM: standard model. CDH: computational Diffie–Hellman assumption. CR: collision resistance of ${\widehat{H}}_2$ and ${\widehat{H}}_3$. N/A: not applicable to the considered recovery mechanism or proof classification. Note: Key-recovery resistance refers to resistance to recovering the long-term private key following proxy signing-key (PSK) exposure under the conditions specified in the text. For the proposed scheme, the analysis assumes an honestly generated target public key that has not been replaced. This property does not prevent an adversary from signing with a compromised PSK.

Table 2 distinguishes reported unforgeability proofs, partial proxy signing-key generation, resistance to long-term private-key recovery under PSK exposure, and verification of individual partial signatures. These are separate properties and should not be interpreted as interchangeable measures of security. The table records the proof models and principal assumptions reported for the compared constructions; it does not rank their overall security.

Li et al. [19] and Xu et al. [20] discuss individual security properties without providing formal reduction proofs. Cao et al. [21], Chen et al. [25], and Shin et al. [26] report CDH-based proofs in the ROM, whereas Gu et al. [24] present a construction and security analysis in the SM. A reported proof alone does not establish that a construction is secure. For example, Xiong et al. [22] showed that Cao et al.’s scheme permits an ordinary signature to be used to construct an unauthorized multi-proxy signature. Our unforgeability analysis is in the SM and relies on the CDH assumption and the collision resistance of ${\widehat{H}}_2$ and ${\widehat{H}}_3$. It provides a separate reduction for each of the three forgery scenarios in Game 1. Each reduction’s success probability accounts for its query simulation, extraction conditions, and negligible collision-related loss, as detailed in the preceding section.

The schemes of Li, Cao, Gu, and Shin include a proxy signing-key generation procedure [19,21,24,26]. In Xu et al.’s scheme [20], the original signer generates the partial proxy signing keys without using the proxies’ long-term private keys. Consequently, the recovery mechanism considered here, which extracts a proxy’s long-term private key from a PSK containing that key’s contribution, is not applicable. Chen et al.’s scheme [25] generates partial signatures directly from the long-term private key and delegation information, without a separate proxy signing-key generation procedure. In our scheme, each proxy first verifies the delegation and then derives an individual PSK for subsequent signing.

Separate proxy signing-key generation does not automatically prevent long-term private-key recovery. In the schemes of Li and Cao, the algebraic relationship between a PSK and the corresponding delegation allows recovery of the proxy’s long-term private key by removing the delegation contribution and, where necessary, inverting a known scalar [19,21]. Shin et al. [26] analyze these recovery mechanisms and report protection for Gu et al.’s construction and their own construction under the exposure settings they consider. These results must be interpreted with respect to the information available to the adversary. In particular, Shin et al.’s construction uses independent secret randomness in the PSK, and the direct recovery argument changes if that randomness is also disclosed.

In our scheme, the partial proxy signing key is

$$PS{K}_{P{S}_i}=u_{P{S}_i}{K}_{OS}+d_{P{S}_i}E+V_{OS}.$$

If the PSK, delegation, and random scalar $u_{P{S}_i}$ are exposed, the adversary can compute

$$PS{K}_{P{S}_i}-u_{P{S}_i}{K}_{OS}-V_{OS}=d_{P{S}_i}E.$$

This calculation reveals a group element rather than the private scalar $d_{P{S}_i}$. The preceding private-key recovery analysis shows how recovery of that scalar yields a CDH solution for an honestly generated target public key that has not been replaced. This property concerns protection of the long-term private scalar; it does not prevent signing with a compromised PSK.

The schemes of Li, Cao, Chen, and Shin support verification of individual partial multi-proxy signatures before aggregation [19,21,25,26]. Xu’s sequential construction and Gu’s construction do not provide the same per-contribution verification procedure [20,24]. In our scheme, the clerk verifies every partial signature and constructs the aggregate signature only if all checks succeed. This allows invalid contributions to be rejected before aggregation. By contrast, failure of a final aggregate verification alone does not identify which individual contribution is invalid.

The construction requires valid contributions from all designated proxy signers and does not provide threshold signing. If any designated UAV becomes unavailable, loses connectivity, or refuses to contribute, the joint signature cannot be completed until all required contributions are available. Partial signature verification detects invalid contributions but does not resolve missing contributions. Changing the signer group requires a new warrant and delegation binding the revised identities and ordered public-key list L. The following analysis therefore evaluates the specified cryptographic operations and representation sizes under explicit counting and encoding assumptions.

We next compare the computational cost of our scheme with those of existing schemes [19,21,23,24,25,26]. We use the primitive-operation timings reported in Table 1 of He et al. [27] as a common benchmark. These operations were measured using the MIRACL library on a Samsung Galaxy S5 smartphone with a quad-core processor, 2 GB RAM, and Android 4.4.2. The pairing benchmark uses a supersingular elliptic curve with a 160-bit subgroup order and a 512-bit underlying field parameter.

Let $W_2$ and $W_3$ denote the evaluation costs of the structured hashes $H_2$ and $H_3$, respectively. For an underlying hash output of Hamming weight t, direct evaluation requires one general hash computation and t group additions. Thus,

$$W_2,W_3\approx T_{gh}+t{T}_{add}.$$

Using the benchmark timings $T_{gh}=0.006$ ms and $T_{add}=0.056$ ms, setting $\ell =256$, and assuming an average Hamming weight of 128, we obtain

$$W_2=W_3\approx 7.174\mathrm{ms}.$$

This value is a model-based estimate under the stated assumptions, not a measured structured-hash runtime reported in the reference.

The same primitive-operation timings are applied to the operation counts of all compared schemes to provide a common cost model. This normalization does not imply that the schemes use identical cryptographic parameters or provide equivalent security levels. The choices $\ell =256$ and average Hamming weight 128 are assumptions used to estimate the costs of $H_2$ and $H_3$ in the proposed scheme; they are not a security-level normalization for the other schemes.

Table 3 lists the operation symbols and benchmark timings. The comparison results for the computational costs of the schemes are presented in Table 4 and Table 5. These estimates cover the operations listed in Table 3. Unless included in $W_2$ and $W_3$, general hashing, group additions, scalar additions, and protocol-level checks are omitted. Accordingly, the reported values are operation-based estimates rather than complete execution-time measurements.

Table 3. Operation symbols, benchmark timings, and structured-hash cost estimates.

Symbols	Definition
$T_{bp}$	Execution time of a bilinear pairing operation, $T_{bp}\approx$ 32.713 ms
$T_{htp}$	Execution time of a hash-to-point operation, $T_{htp}\approx$ 33.582 ms
$T_{sm}$	Execution time of a scalar multiplication operation in $G_1$, $T_{sm}\approx$ 13.405 ms
$T_{exp}$	Execution time of one exponentiation operation in $G_2$, $T_{exp}\approx$ 2.249 ms
$T_{gh}$	Benchmark execution time of one general hash computation: $T_{gh}\approx 0.006$ ms
$T_{add}$	Benchmark execution time of one group addition in $G_1$: $T_{add}\approx 0.056$ ms
$W_2$,$W_3$	Estimated evaluation times of the structured hash functions $H_2$ and $H_3$, respectively; $W_2=W_3\approx 7.174$ ms

Note: The timings are adopted from a historical benchmark. $W_2$ and $W_3$ are model-based estimates rather than measured runtimes of the structured hashes.

Table 4. Comparison of computational costs of various schemes.

Scheme	Dele-Generate	ProK-Generate	MP-Sign	MP-Verify
Li [19]	$3T_{sm}$	$2n{T}_{sm}+n{T}_{exp}+3n{T}_{bp}+2n{T}_{htp}$	$4n{T}_{sm}+n{T}_{exp}+3n{T}_{bp}+(n+1)T_{htp}$	$n{T}_{sm}+T_{exp}+3T_{bp}+(n+1)T_{htp}$
Cao [21]	$2T_{sm}+T_{htp}$	$n{T}_{sm}+3n{T}_{bp}+2n{T}_{htp}$	$2n{T}_{sm}+n{T}_{exp}+5n{T}_{bp}+(2n+2)T_{htp}$	$3T_{sm}+4T_{bp}+(n+3)T_{htp}$
Jin [23]	$4T_{sm}+2T_{htp}$	$n{T}_{sm}+4n{T}_{bp}+3n{T}_{htp}$	$(5n+1)T_{sm}+4(n+1)T_{bp}+(3n+1)T_{htp}$	$(n+1)T_{sm}+4T_{bp}+(n+3)T_{htp}$
Gu [24]	$4n{T}_{sm}$	$3n{T}_{sm}+n{T}_{exp}+4n{T}_{bp}$	$3n{T}_{sm}$	$(n+3)T_{sm}+T_{exp}+6T_{bp}$
Chen [25]	$2T_{sm}+T_{htp}$	$3n{T}_{bp}+2n{T}_{htp}$	$4n{T}_{sm}+3n{T}_{bp}+(2n+1)T_{htp}$	$3T_{sm}+3T_{bp}+(n+2)T_{htp}$
Shin [26]	$2T_{sm}+T_{htp}$	$2n{T}_{sm}+3n{T}_{bp}+2n{T}_{htp}$	$2n{T}_{sm}+4n{T}_{bp}+(2n+2)T_{htp}$	$2T_{sm}+4T_{bp}+(n+3)T_{htp}$
Proposed scheme	$3T_{sm}+W_2$	$4n{T}_{sm}+3n{T}_{bp}+n{W}_2$	$3n{T}_{sm}+4n{T}_{bp}+W_2+n{W}_3$	$3T_{sm}+4T_{bp}+W_2+W_3$

Table 5. Comparison of total computational costs.

Scheme	Total Cost Expression	Estimated Total Cost (ms)
Li [19]	$\begin{array}{cc}& (7n+3)T_{sm}+(2n+1)T_{exp}\hfill \\ & +(6n+3)T_{bp}+(4n+2)T_{htp}\hfill \end{array}$	$428.939n+207.767$
Cao [21]	$\begin{array}{cc}& (3n+5)T_{sm}+n{T}_{exp}\hfill \\ & +(8n+4)T_{bp}+(5n+6)T_{htp}\hfill \end{array}$	$472.078n+399.369$
Jin [23]	$\begin{array}{cc}& (7n+6)T_{sm}+(8n+8)T_{bp}\hfill \\ & +(7n+6)T_{htp}\hfill \end{array}$	$590.613n+543.626$
Gu [24]	$\begin{array}{cc}& (11n+3)T_{sm}+(n+1)T_{exp}\hfill \\ & +(4n+6)T_{bp}\hfill \end{array}$	$280.556n+238.742$
Chen [25]	$\begin{array}{cc}& (4n+5)T_{sm}+(6n+3)T_{bp}\hfill \\ & +(5n+4)T_{htp}\hfill \end{array}$	$417.808n+299.492$
Shin [26]	$\begin{array}{cc}& (4n+4)T_{sm}+(7n+4)T_{bp}\hfill \\ & +(5n+6)T_{htp}\hfill \end{array}$	$450.521n+385.964$
Proposed scheme	$\begin{array}{cc}& (7n+6)T_{sm}+(7n+4)T_{bp}\hfill \\ & +(n+3)W_2+(n+1)W_3\hfill \end{array}$	$337.174n+239.978$

Note: The numerical totals are analytical estimates under the adopted operation counts and historical timings. Equivalent contemporary security levels have not been verified across the schemes.

The adopted timings provide a common historical cost model for weighting primitive-operation counts. They do not establish equivalent contemporary security levels across the compared schemes. The resulting numerical comparisons therefore describe costs within this model rather than a definitive performance advantage at a common security level. No timing measurements from an implementation of the proposed scheme on UAV or representative embedded hardware are reported in this study.

Table 4 compares the computational costs of the schemes, where n denotes the number of proxy signers. Using the adopted benchmark timings, we estimate the costs of Dele-Generate, ProK-Generate, MP-Sign, and MP-Verify. The total cost is the sum of these four phases, as shown in Table 5. ProK-Generate includes delegation verification by all proxies, while MP-Sign includes partial signature generation, verification where specified, and aggregation.

For the scheme of Li et al. [19], the Dele-Generate, ProK-Generate, MP-Sign, and MP-Verify costs are $40.215$ ms, $194.362n$ ms, $187.590n+33.582$ ms, and $46.987n+133.970$ ms, respectively. The total cost is $428.939n+207.767$ ms.

For the scheme of Cao et al. [21], the corresponding costs are $60.392$ ms, $178.708n$ ms, $259.788n+67.164$ ms, and $33.582n+271.813$ ms, giving a total of $472.078n+399.369$ ms.

For the scheme of Jin et al. [23], the costs are $120.784$ ms, $245.003n$ ms, $298.623n+177.839$ ms, and $46.987n+245.003$ ms. The total cost is $590.613n+543.626$ ms.

For the scheme of Gu et al. [24], the costs are $53.620n$ ms, $173.316n$ ms, $40.215n$ ms, and $13.405n+238.742$ ms, resulting in a total of $280.556n+238.742$ ms. Its MP-Sign cost excludes individual partial signature verification before aggregation, which is not included in the construction.

For the scheme of Chen et al. [25], the costs are $60.392$ ms, $165.303n$ ms, $218.923n+33.582$ ms, and $33.582n+205.518$ ms. The total cost is $417.808n+299.492$ ms. Since this scheme has no separate partial proxy signing key generation procedure, the ProK-Generate entry accounts only for delegation verification.

For the scheme of Shin et al. [26], the costs are $60.392$ ms, $192.113n$ ms, $224.826n+67.164$ ms, and $33.582n+258.408$ ms, giving a total of $450.521n+385.964$ ms.

For the proposed IBMPS scheme, the costs of Dele-Generate, ProK-Generate, MP-Sign, and MP-Verify are estimated as $47.389$ ms, $158.933n$ ms, $178.241n+7.174$ ms, and $185.415$ ms, respectively. The total estimated cost is $337.174n+239.978$ ms.

Under the stated counting rules and hash-cost assumptions, our scheme has a lower estimated total cost than the schemes of Li, Cao, Jin, Chen, and Shin. Gu’s scheme has a lower total cost, but omits partial signature verification before aggregation. Our scheme combines this verification capability with a fixed number of pairings and scalar multiplications in final signature verification.

As shown in Figure 4, the estimated Dele-Generate cost is independent of the number of proxy signers for all compared schemes except that of Gu et al. [24]. Li et al.’s scheme [19] has the lowest estimated cost of $40.215$ ms, while our scheme requires $47.389$ ms. The additional $7.174$ ms comes from evaluating the structured hash $H_2$, corresponding to a 17.84% increase over Li et al.’s scheme. The cost of Gu et al.’s scheme is $53.620n$ ms and exceeds those of all other compared schemes when $n\ge 3$.

Figure 4. Comparison of the estimated computational costs of Delegate-Generate among the schemes of Li et al. [19], Cao et al. [21], Jin et al. [23], Gu et al. [24], Chen et al. [25], Shin et al. [26], and the proposed scheme.

As shown in Figure 5, the estimated cost of the phase reported as ProK-Generate grows linearly with the number of proxy signers. This phase includes delegation verification and, where applicable, proxy signing-key generation. Chen et al.’s scheme [25] has no separate proxy signing-key generation procedure, so its entry accounts only for delegation verification. Under the adopted counting rules, our scheme has the lowest estimated cost of $158.933n$ ms, followed by Chen et al.’s scheme at $165.303n$ ms. Jin and Wen’s scheme [23] has the highest estimated cost of $245.003n$ ms, followed by Li et al.’s scheme [19] at $194.362n$ ms.

Figure 5. Comparison of the estimated computational costs of ProK-Generate among the schemes of Li et al. [19], Cao et al. [21], Jin et al. [23], Gu et al. [24], Chen et al. [25], Shin et al. [26], and the proposed scheme.

As shown in Figure 6, the estimated MP-Sign costs grow linearly with the number of proxy signers. Jin and Wen’s scheme [23] has the highest estimated cost, followed by Cao et al.’s scheme [21]. Gu et al.’s scheme [24] has the lowest cost, but does not include partial signature verification before aggregation. Among the compared schemes that support this verification, our scheme has the lowest estimated MP-Sign cost under the adopted counting rules. Its cost is $178.241n+7.174$ ms, compared with $187.590n+33.582$ ms for Li et al.’s scheme [19]. The comparison with Gu et al.’s scheme therefore involves a trade-off between computational cost and partial signature verification.

Figure 6. Comparison of the estimated computational costs of MP-Sign among the schemes of Li et al. [19], Cao et al. [21], Jin et al. [23], Gu et al. [24], Chen et al. [25], Shin et al. [26], and the proposed scheme.

As shown in Figure 7, the estimated MP-Verify costs of the other compared schemes increase linearly with the number of proxy signers. Under the adopted operation-count model, our scheme requires $3T_{sm}+4T_{bp}+W_2+W_3$, giving an estimated cost of $185.415$ ms. At $n=1$, this is $4.458$ ms higher than the cost of Li et al.’s scheme [19]; for $n\ge 2$, it is lower than the estimated costs of all six reference schemes. The fixed estimate concerns the operations included in the model. Processing signer identities, public-key lists, and warrant information still depends on the input size.

Figure 7. Comparison of the estimated computational costs of MP-Verify among the schemes of Li et al. [19], Cao et al. [21], Jin et al. [23], Gu et al. [24], Chen et al. [25], Shin et al. [26], and the proposed scheme.

As shown in Figure 8, the estimated total computational costs of all compared schemes increase linearly with the number of proxy signers n. Jin et al.’s scheme [23] has the highest estimated total cost, followed by Cao et al.’s scheme [21]. Gu et al.’s scheme [24] has the lowest cost, while the proposed scheme has the second-lowest cost under the adopted operation counts and benchmark assumptions. Although at $n=10$ this cost is 18.64% higher than that of Gu et al.’s scheme, our scheme additionally supports partial signature verification before aggregation. The comparison therefore reflects a trade-off between total computational cost and verification functionality. These estimates represent the aggregate computational cost across the four evaluated phases, rather than the end-to-end latency of a UAV rescue application.

Figure 8. Comparison of the estimated total computational costs among the schemes of Li et al. [19], Cao et al. [21], Jin et al. [23], Gu et al. [24], Chen et al. [25], Shin et al. [26], and the proposed scheme.

For $n=10$, under the stated operation counts and structured-hash cost assumptions, the estimated Dele-Generate cost of our scheme is $47.389$ ms. This is lower than those of Cao, Jin, Gu, Chen, and Shin by 21.53%, 60.77%, 91.16%, 21.53%, and 21.53%, respectively. Although it is 17.84% higher than Li’s cost, the absolute difference is only $7.174$ ms and does not offset the savings in subsequent phases.

In ProK-Generate, our estimated cost is $1589.330$ ms, which is lower than the corresponding costs of all six reference schemes. Compared with Li, Cao, Jin, Gu, Chen, and Shin, the reductions are 18.23%, 11.07%, 35.13%, 8.30%, 3.85%, and 17.27%, respectively. Within the adopted cost model, the preparation phase has a lower estimated cost than the corresponding entries of the six reference schemes, subject to their differences in functionality.

In MP-Sign, our estimated cost is $1789.584$ ms, representing reductions of 6.28%, 32.85%, 43.44%, 19.49%, and 22.71% compared with Li, Cao, Jin, Chen, and Shin, respectively. Gu’s signing cost is lower, but its signing procedure does not include partial signature verification before aggregation. Our scheme checks each partial signature and rejects invalid inputs, enabling the coordinating UAV to detect invalid partial signatures before aggregation. The comparison with Gu must therefore account for both computational cost and verification functionality.

In MP-Verify, our estimated cost is $185.415$ ms, which is lower than the corresponding costs of all six reference schemes. Compared with Li, Cao, Jin, Gu, Chen, and Shin, the reductions are 69.29%, 69.49%, 74.06%, 50.26%, 65.75%, and 68.80%, respectively. This estimate suggests potential savings in final verification under the adopted cost model. The actual computational burden at the ground control center remains to be measured.

Across the four phases, our total estimated cost is $3611.718$ ms, which is lower than those of Li, Cao, Jin, Chen, and Shin by 19.69%, 29.46%, 44.00%, 19.34%, and 26.16%, respectively. Although the total is 18.64% higher than Gu’s, our scheme supports partial signature verification before aggregation and reduces the final verification cost by 50.26%. Under the adopted operation counts and historical timings, the scheme combines partial signature verification with lower estimated total costs than five reference schemes at $n=10$. These comparisons remain model-dependent and do not establish practical performance superiority on UAV hardware.

These results compare the encoded sizes of individual cryptographic objects rather than the complete end-to-end communication cost. The latter also includes distribution of the ordered public-key list L, exchange of proxy-key public values and partial signatures, and additional protocol messages or retransmissions.

Let $|G_1|$, $|G_2|$, and $|{\mathbb{Z}}_q|$ denote the encoded lengths of a group element or scalar, rather than the cardinalities of the corresponding sets. Under the adopted representation, we assume $|G_1|=|G_2|=128$ bytes and $|{\mathbb{Z}}_q|=20$ bytes. The warrant is denoted by w, with an assumed length of $\left|w\right|=20$ bytes. Table 6 compares the sizes of a user’s complete private key, a delegation delivered to one proxy, and a final multi-proxy signature. These sizes exclude public parameters, separately transmitted public keys, and protocol headers.

Table 6. Comparison of private-key, delegation, and multi-proxy signature sizes.

Scheme	Private Key (Bytes)	Delegation (Bytes)	Multi-Proxy Signature (Bytes)
Li [19]	$|G_1|=128$	$\left|w\right|+2|G_1|=276$	$\left|w\right|+3|G_1|=404$
Cao [21]	$|G_1|=128$	$\left|w\right|+2|G_1|=276$	$\left|w\right|+3|G_1|=404$
Jin [23]	$|G_1|+|{\mathbb{Z}}_q|=148$	$\left|w\right|+2|G_1|=276$	$\left|w\right|+(n+2)|G_1|=128n+276$
Gu [24]	$2|G_1|=256$	$\left|w\right|+3|G_1|=404$	$\left|w\right|+(n+4)|G_1|=128n+532$
Chen [25]	$|G_1|=128$	$\left|w\right|+2|G_1|=276$	$\left|w\right|+3|G_1|=404$
Shin [26]	$|G_1|=128$	$\left|w\right|+2|G_1|=276$	$\left|w\right|+4|G_1|=532$
Proposed scheme	$|{\mathbb{Z}}_q|=20$	$\left|w\right|+2|G_1|=276$	$\left|w\right|+4|G_1|=532$

Note: The reported sizes describe individual object representations and exclude the complete protocol communication overhead.

Under the adopted encoding assumptions, Figure 9 shows that the proposed scheme has the smallest long-term private-key size and matches the smallest per-proxy delegation size among the compared schemes. Its final multi-proxy signature has the same size as that of Shin et al.’s scheme [26], but is larger than those of the schemes of Li, Cao, and Chen [19,21,25]. The comparisons are summarized as follows:

Figure 9. Comparison of private-key, delegation, and multi-proxy signature sizes among the schemes of Li et al. [19], Cao et al. [21], Jin et al. [23], Gu et al. [24], Chen et al. [25], Shin et al. [26], and the proposed scheme.

• Private-key size: Our long-term private key occupies 20 bytes, corresponding to 15.63% of the 128-byte keys in [19,21,25,26], 13.51% of the 148-byte key in [23], and 7.81% of the 256-byte key in [24].
• Delegation size: Our per-proxy delegation occupies 276 bytes, matching the delegation sizes of the schemes in [19,21,23,25,26]. It is 68.32% of the 404-byte per-proxy delegation in [24].
• Multi-proxy signature size: Our final signature occupies 532 bytes, matching that of the scheme in [26]. It is 31.68% larger than the 404-byte signatures in [19,21,25]. Relative to the signature sizes of the schemes in [23,24], the corresponding ratios are

  $${\displaystyle \frac{532}{128n+276}}\times 100\%\mathrm{and}{\displaystyle \frac{532}{128n+532}}\times 100\%,$$

  respectively. For $n=10$, these ratios are 34.19% and 29.36%.

8. Conclusions

This paper presented an identity-based multi-proxy signature scheme for UAV-assisted rescue operations. The construction integrates mission-specific delegation, individual proxy signing keys, and partial signature verification to authenticate the authorized UAV group’s joint endorsement of rescue reports. We formulated Game 1 to capture adaptive queries and signer collusion without public-key replacement, and proved unforgeability for its three forgery scenarios under the CDH assumption and collision-resistant hashing, with explicit reduction bounds. We also separately analyzed resistance to long-term private-key recovery under proxy signing-key exposure.

Under the adopted operation counts and historical benchmark timings, the cost model estimates lower preparation-phase and final-verification costs for the proposed scheme than for the six reference schemes. For $n=10$, it estimates a total cost 19.34–44.00% below that of five reference schemes, while Gu et al.’s scheme has a lower estimated total cost. These figures are model-based comparisons and do not establish an advantage at equivalent contemporary security levels or predict performance on UAV hardware. The proposed scheme also supports individual partial signature verification before aggregation, a functionality not provided by Gu et al.’s scheme. Compact long-term private-key storage and a fixed number of group elements in the final signature further support its potential applicability to collaborative UAV reporting. Future work will evaluate the scheme on UAV hardware and investigate its operation under intermittent connectivity and signer unavailability.