Post-Quantum Revocable Linkable Ring Signature Scheme Based on SPHINCS+ for V2G Scenarios

Abstract

As a core support for the integration of new energy and smart grids, Vehicle-to-Grid (V2G) networks face a core contradiction between user privacy protection and transaction security traceability—a dilemma that is further exacerbated by issues such as the quantum computing vulnerability of traditional cryptography, cumbersome key management in stateful ring signatures, and conflicts between revocation mechanisms and privacy protection. To address these problems, this paper proposes a post-quantum revocable linkable ring signature scheme based on SPHINCS+, with the following core innovations: First, the scheme seamlessly integrates the pure hash-based architecture of SPHINCS+ with a stateless design, incorporating WOTS+, FORS, and XMSS technologies, which inherently resists quantum attacks and eliminates the need to track signature states, thus completely resolving the state management dilemma of traditional stateful schemes; second, the scheme introduces an innovative “real signature + pseudo-signature polynomially indistinguishable” mechanism, and by calibrating the authentication path structure and hash distribution of pseudo-signatures (satisfying the Kolmogorov–Smirnov test with $D\le 0.05$), it ensures signer anonymity and mitigates the potential risk of distinguishable pseudo-signatures; third, the scheme designs a KEK (Key Encryption Key)-sharded collaborative revocation mechanism, encrypting and storing the $(I,pk,RID)$ mapping table in fragmented form, with KEK split into $KE{K}_1$ (held by the Trusted Authority, TA) and $KE{K}_2$ (held by the regulatory node), with collaborative decryption by both parties required to locate malicious users, thereby resolving the core conflict of privacy leakage in traditional revocation mechanisms; fourth, the scheme generates forward-secure linkable tags based on one-way private key updates and one-time random factors, ensuring that past transactions cannot be traced even if the current private key is compromised; and fifth, the scheme adopts hash commitments instead of complex cryptographic commitments, simplifying computations while efficiently binding transaction amounts to signers—an approach consistent with the pure hash-based design philosophy of SPHINCS+. Security analysis demonstrates that the scheme satisfies the following six core properties: post-quantum security, unforgeability, anonymity, linkability, unframeability, and forward secrecy, thereby providing technical support for secure and anonymous payments in V2G networks in the quantum era.

1. Introduction

The long-term rise in gasoline prices and the hazards of global warming have propelled Electric Vehicles (EVs) to become a global research and attention focus [1]. Boasting advantages such as environmental friendliness, high energy efficiency, and long driving range per charge, EVs have broad market prospects. It is predicted that the global market size of intelligent connected vehicles will reach trillions of US dollars by 2035. As a key component of Smart Grids (SGs), Vehicle-to-Grid (V2G) networks represent a core development trend for EVs [2,3,4]. Their typical architecture consists of the following five core components: EVs, Charging Stations (CSs), aggregators, Smart Grid Control Centers (SGCCs), and communication networks (as illustrated in Figure 1).

EVs upload information such as identity identifiers, battery status, and charging records to CSs. Aggregators then summarize and verify the stored data (from CSs) to monitor EV operating states before exchanging data with SGCCs via wired or wireless communication networks. SGCCs undertake multiple management responsibilities, including calculating total electricity prices based on charging and discharging demands and dispatching the entire V2G network [5]. The two-way power interaction between EVs and SGs generates a large volume of payment-related information [6], but during this interaction, attackers may target CSs or Local Aggregators to steal users’ charging records and other sensitive data. Such information—including identity details, living habits, geographical locations, and movement trajectories—could be maliciously exploited to facilitate violent crimes such as robberies and thefts, thereby endangering the personal safety of EV owners [7]. Thus, V2G networks urgently require a reliable payment scheme that balances privacy protection, transaction traceability, quantum attack resistance, and large-scale dynamic access to adapt to large-scale EV charging and discharging transactions.

Ring signatures [8], as a well-established digital signature technology, can realize identity authentication while providing users with anonymity protection. In a ring signature mechanism, the signer randomly selects public keys of multiple ring members to form a temporary group, then generates a signature by combining these public keys, their own private key, and random numbers, so verifiers can confirm that the signature originates from within the group but cannot identify the specific signer. The full anonymity and unforgeability of ring signatures have garnered widespread attention, with scholars exploring numerous application scenarios in vehicular networks in recent years [9,10]. However, the unconditional anonymity of ring signatures is overly absolute for certain scenarios such as electronic voting and electronic cash, and to address this, Liu et al. proposed the Linkable Spontaneous Anonymous Group Signature (LSAG) [11], a linkable ring signature (LRS) protocol that can identify whether two signatures are generated by the same private key while verifiers still cannot know the signer’s real identity. Unlike the strong unconditional anonymity of ring signatures, LRS offers linkable anonymity—an attribute that safeguards privacy in cryptocurrency applications while effectively mitigating double-spending attacks.

Nevertheless, existing LRS schemes suffer from significant flaws that hinder their practical application in V2G networks. Most existing LRS schemes rely on traditional cryptographic primitives and, thus, fail to resist quantum computing threats [12]—Shor’s algorithm can solve number-theoretic problems (e.g., discrete logarithms and integer factorization) in polynomial time, which poses unavoidable security risks in the quantum era. Many schemes adopt stateful mechanisms, which require continuous tracking of signature-related states (e.g., signature counts and private key indices) to ensure security. This not only increases key management complexity, but also fails to meet the requirements of V2G networks for dynamic access and long-term operation with a large fleet of EVs. The pseudo-signatures in traditional schemes differ from real signatures in structure or hash distribution, making them easily distinguishable, thus undermining anonymity. Revocation mechanisms in existing schemes either lack practicality or rely on centralized nodes to maintain complete mapping tables, leading to privacy leakage risks. Additionally, linkable tags in most schemes lack forward secrecy, leaving the risk of long-term tracking if private keys are leaked.

Existing privacy-preserving schemes for V2G networks primarily focus on general cryptographic attacks (e.g., forgery and anonymity violation) in their adversary models, yet fail to account for scenario-specific threats arising in practical V2G deployments. These unaddressed threats include the following: (1) malicious Charging Stations (CSs) tampering with transaction data (e.g., falsifying electricity consumption records); (2) malicious Local Aggregators (LAGs) forging signature verification results to collude with malicious EVs; (3) man-in-the-middle attacks targeting communication links between EVs and LAGs/BSs (e.g., altering transaction amounts or order timestamps); (4) side-channel attacks exploiting power consumption or timing differences of on-board terminals to leak private keys; and (5) collusion between malicious EVs and third parties to evade Trusted Authority (TA)-led revocation mechanisms. Such scenario-specific threats are rooted in the actual operational logic of V2G entities (e.g., LAGs’ mandate to verify signatures and forward transactions, as well as CSs’ responsibility to record charging data), thereby directly undermining the practical applicability of existing schemes. It is, therefore, imperative to refine the adversary model by explicitly incorporating these V2G-specific risks, ensuring that the security of the proposed scheme aligns with real-world deployment requirements.

Based on this, this paper proposes a SPHINCS+-based [13] linkable ring signature scheme, aiming to construct an anonymous payment mechanism with post-quantum security, high efficiency, and practicality for V2G networks. The core innovation of the proposed scheme resides in the seamless integration of SPHINCS+’s “pure hash-based” architecture, stateless design, and LRS’s privacy–traceability balancing mechanism, thereby systematically addressing the five key limitations of existing schemes. By leveraging WOTS+ one-time signatures [14], FORS hash-based signatures [15], and XMSS hierarchical tree structures [16], the scheme achieves stateless signature generation and verification—where signature generation depends solely on the private key seed and current transaction information, with no need to record historical state data. This fundamentally resolves the state management challenges of traditional schemes. It adopts a “structure calibration + hash distribution calibration” strategy for pseudo-signatures, where pseudo-signatures and real signatures use identical SPHINCS+ architecture parameters (16 FORS subtrees, 10 XMSS authentication path lengths) and pass the Kolmogorov–Smirnov test ($D\le 0.05$) to ensure polynomially indistinguishable hash distributions, addressing the core risk of distinguishable pseudo-signatures. A Key Encryption Key (KEK)-sharded storage mechanism ($KEK=KE{K}_1\oplus KE{K}_2$) is designed, with the TA and regulatory node each holding a key fragment; collaborative decryption is required to locate malicious users, resolving the conflict between revocation and privacy protection in traditional mechanisms. Forward-secure linkable tags are generated based on one-way private key updates and one-time random factors, ensuring that past transactions cannot be traced even if the current private key is leaked, eliminating the risk of long-term tracking. Hash commitments are used instead of complex cryptographic commitments, simplifying computations while efficiently binding transaction amounts to signers, which is consistent with SPHINCS+’s pure hash-based design philosophy and reduces the computational overhead of on-board terminals.

1.1. Related Work

In the research field of Vehicle-to-Grid (V2G) networks, the potential threats of quantum computing have become increasingly prominent, making post-quantum security a core consideration in privacy protection research. Currently, relevant studies primarily focus on the following three key directions: anonymous authentication, identity/location privacy protection, and privacy-preserving payment mechanisms. However, “how to efficiently achieve these goals in a post-quantum environment” remains a critical issue awaiting breakthroughs, as existing achievements generally lack sufficient adaptation to post-quantum security requirements.

Although existing V2G privacy-preserving schemes have achieved partial security objectives in specific scenarios, none of them fully address the risk of quantum attacks, and some exhibit obvious performance shortcomings. The P² scheme [17], the first privacy-preserving V2G solution proposed by Yang et al., constructs a reward system and privacy-preserving communication functions through identity-based restrictive partially blind signatures. Nevertheless, it suffers from the flaw that generated certificates are vulnerable to forgery, and its traditional cryptographic foundation is inadequate to resist quantum attacks. Subsequently, Wang et al. [18] optimized this scheme by integrating bilinear pairing technology with the same type of blind signature technology. While remedying certain security vulnerabilities, the optimized scheme incurs significant computational and communication overheads and still fails to incorporate post-quantum defense mechanisms. Various privacy-preserving authentication protocols proposed in studies such as [19,20,21] focus on identity and location privacy protection in V2G networks but similarly lack systematic design for post-quantum security. To address privacy leakage in interactions between Electric Vehicles (EVs) and Smart Grids (SGs) in V2G networks, Liu et al. [9] proposed the EMULRS efficient multi-layer linkable ring signature scheme, which reduces overhead and optimizes performance with a logarithmic signature size. However, due to the absence of post-quantum cryptographic technologies, it cannot withstand quantum computing attacks. Additionally, while research in [22] systematically summarized privacy protection issues and corresponding solutions in V2G networks, it rarely addressed the security challenges of the post-quantum era, making it difficult to meet the long-term security needs of V2G systems.

Notably, the frequent exchange of payment information between EVs and SGs is prone to leaking sensitive data such as identity and location, a risk that quantum computing will further exacerbate. In recent years, although researchers have proposed various anonymous payment mechanisms to enhance privacy protection in V2G scenarios, gaps remain in their post-quantum security. Liu et al. [23] strengthened vehicle location privacy protection through an anonymous payment system but did not integrate post-quantum cryptographic technologies; Au et al. [24] enhanced the payment protocol, building on [23], by integrating BBS+ signaturesand zero-knowledge proof techniques, enabling both location privacy protection and stolen vehicle tracking. However, the protocol’s resistance to quantum attacks remains unvalidated, casting doubt on its security. Most of these studies focus on specific domains and have not yet formed a comprehensive, scalable framework suitable for practical scenarios and meeting post-quantum security requirements. Further exploration is needed to integrate post-quantum cryptography with the scalability of dynamic large-scale networks. Given the inherent anonymity advantages of ring signatures, combining them with post-quantum cryptography for V2G applications holds significant practical value, and relevant research urgently requires advancement.

As a matter of fact, comprehensive research into post-quantum ring signature technology has moved into a fast-track stage. Investigations carried out by academics like Xie and Wang have explicitly indicated that conventional digital signature mechanisms show notable susceptibility when confronted with quantum computing threats. In contrast, ring signatures, by dint of their distinctive technical attributes, have exhibited remarkable application merits across diverse blockchain scenarios—encompassing secure medical data sharing, in-vehicle network communications, and other domains [8]. Research groups headed by Chatterjee and Chung have concentrated on in-depth inquiries into the security of post-quantum ring signatures, re-evaluating the security thresholds of classical signature and ring signature technologies under quantum circumstances. They have also developed two short signature protocols, which have been validated and implemented in the quantum random oracle model and the standard model, respectively [25]. In recent pertinent publications, researchers have further expanded the technical modalities of post-quantum ring signatures, introducing innovative technical frameworks such as linkable ring signatures, threshold signatures, and identity-based post-quantum ring signatures. They have also conducted systematic analyses regarding the post-quantum security features of these architectures [26,27,28]. Correspondingly, an exhaustive overview of the theoretical framework and practical implementations of linkable ring signatures is provided in [29], carrying out in-depth comparisons of various technical approaches for anonymization design and linkability realization. Nevertheless, this study bears obvious shortcomings: it lacks targeted analyses for specific scenarios like the Internet of Things (IoT), and fails to fully take into account the adaptability issues of resource-limited settings, as well as the potential of quantum-resistant computation.

Focusing on the research orientations of the National Institute of Standards and Technology (NIST) in the realms of post-quantum algorithms and ring signature validation, certain scholars have put forward a blockchain-based post-quantum authentication protocol. This protocol integrates anonymity, traceability, and verifiability, efficiently fending off quantum attacks while striking a dynamic equilibrium between security safeguards and privacy protection. Moreover, it has successfully undergone feasibility validation in the in-vehicle network context [10]. The in-vehicle network scenario itself confronts severe security and privacy challenges stemming from device heterogeneity and frequent data exchanges. Blockchain technology, with its traits of decentralization, immutability, and distributed consensus, offers dependable technical backing for security protection in this field [30,31,32].

In particular, within the segmented scenarios of in-vehicle networks, the research on relevant security protocols has continued to deepen. To address privacy and anonymity in UAV-aided VANETs, Reference [33] proposed a specialized identity authentication and signature scheme tailored for Unmanned Aerial Vehicle (UAV)-aided Vehicular Ad Hoc Networks (VANETs), with an emphasis on boosting the anonymity of network communications and the capability of user privacy protection. Reference [34] developed a distributed message authentication scheme integrated with a reputation system, achieving message validity verification through dynamic assessment of node credit scores.This significantly enhances the in-vehicle network’s capacity to resist malicious assaults and data counterfeiting. The authenticated key agreement protocol for in-vehicle networks in intelligent transportation systems, proposed in Reference [35], proceeds from two aspects—strengthening identity authentication and optimizing key exchange—thus effectively warding off typical security hazards such as eavesdropping, tampering, and man-in-the-middle attacks.

Although the aforementioned studies have addressed numerous critical security issues in in-vehicle networks, they generally suffer from over-specificity to particular scenarios and lack a comprehensive, scalable framework suitable for practical implementation. More importantly, the integration of post-quantum cryptography with the scalability of dynamic large-scale networks has not been thoroughly explored, which provides a clear direction for subsequent research.

To establish a post-quantum security assurance system for data transmission in in-vehicle network and V2G environments, researchers have explored a variety of technical routes. For instance, Reference [36] suggested the adoption of lattice-based post-quantum digital signature technologies. However, this scheme remains merely at the theoretical level and does not involve practical design combined with specific application scenarios such as V2G. Reference [37], on the other hand, integrated the ring signature scheme based on lattice hard problems into the in-vehicle environment. Yet, the research failed to provide a detailed demonstration regarding the quantum attack resistance of the scheme, resulting in insufficient security evaluation.

Notably, reducing the energy consumption of blockchain technology in V2G network applications has also emerged as one of the current research focuses [38]. Some studies have developed energy-saving solutions by optimizing the calculation method of Merkle tree root nodes, proposed Merkle tree construction approaches that comply with industry standards, and confirmed the energy efficiency advantages of the scheme through experiments. The Merkle tree accumulator algorithm proposed by Derler and Ramacher in Reference [39] adopts a lightweight design that relies solely on hash functions and symmetric primitive languages. It possesses reliable quantum attack resistance and provides complete operational procedures and definition criteria. However, the engineering application specifics of this algorithm and its integrated utilization in practical scenarios such as V2G still require further in-depth investigation. Furthermore, the simultaneous satisfaction of the demand for anonymous transactions, the requirement for tracing malicious activities, and the need for post-quantum security among vehicle nodes in V2G networks has not yet been fully addressed.

Against this backdrop, linkable ring signature (LRS) [29], as a cryptographic primitive integrating anonymity and traceability, provides a new technical path for breaking through the aforementioned problems. Its core advantages lie in the following two aspects: on the one hand, the ring signature mechanism can ensure the identity anonymity of vehicle nodes in V2G networks, avoiding direct association between transaction information and real identities; on the other hand, “linkability” supports the traceability of multiple transactions from the same node, providing technical support for accountability for malicious activities. If a linkable ring signature scheme is constructed based on post-quantum cryptography (PQC), it can not only inherit the lightweight design to adapt to the resource-constrained characteristics of V2G networks, but also further enhance the system’s quantum attack resistance, remedying the deficiencies of existing Merkle tree-related schemes in the synergistic design of identity privacy protection and traceability. Therefore, combining linkable ring signatures with post-quantum cryptography and exploring their specific application modes and optimization strategies in V2G networks has become an important direction to address current research pain points.

Researchers have explored various linkable ring signature technologies. Reference [40] combined blockchain with the Internet of Vehicles (IoV), designed a linkable ring signature (LRS) based on the short integer solution (SIS) lattice assumption, and applied it to cold-chain logistics systems to achieve distributed data management, privacy protection, and transaction traceability. However, this scheme is only suitable for specific scenarios with insufficient versatility, has limited room for optimizing key size and time overhead, and its robustness against quantum attacks has not been further enhanced. Reference [41], based on the discrete logarithm assumption, converted 1-out-of-n ring signatures into t-out-of-n linkable threshold ring signatures (LTRSs) through sliding window transformation (SWT), and optimized the RingCT protocol to reduce the communication overhead of multi-input account transactions. Nevertheless, this protocol lacks post-quantum security, cannot resist quantum algorithm attacks, and has weak flexibility in threshold adjustment and signature scalability. Reference [42] proposed a certificateless multimode ring signcryption scheme (EMMCRS), integrating three modes (fully anonymous, linkable anonymous, and revocable anonymous). Based on elliptic curve cryptography, this scheme is suitable for Vehicular Ad Hoc Networks (VANETs) and supports batch verification, but suffers from low efficiency in switching anonymous modes, does not support the flexible addition or removal of dynamic ring members, and has high transmission latency in multi-node communication scenarios.

Reference [10] constructed an anonymous, traceable, and linkable authentication scheme for intelligent vehicle transportation systems based on NIST post-quantum winning algorithms (digital signatures and KEM), post-quantum linkable ring signatures, and consortium blockchain (Hyperledger Fabric). This scheme is equipped with a key exchange mechanism to support efficient encryption and decryption in P2P communication and broadcast scenarios. However, it does not adopt a pure hash-based architecture, so signature and verification efficiency is significantly affected by ring size; moreover, its non-stateless design increases key management complexity, resulting in limited ability to adapt to large-scale high-frequency transaction scenarios. Both Reference [43] and Reference [44] were based on lattice cryptography-related assumptions (the former on the SIS assumption, the latter on the module short integer solution (M-SIS) lattice assumption). They, respectively, designed an efficient linkable ring signature (LLRS) with a forward-secure enhanced version (FS-LLRS), and a logarithmic-scale signature scheme supporting anonymity and quantum attack resistance. The former is suitable for cloud-assisted electronic medical record sharing, while the latter is applied to electronic voting systems to prevent duplicate voting. However, both have high computational and communication overheads, their signature and verification efficiency are affected by ring size (linear growth for the former, logarithmic growth for the latter), and they lack flexibility in adapting to resource-constrained devices. Additionally, the latter relies on the random oracle model rather than the standard model and does not achieve a stateless design.

References [45,46,47] were all based on traditional cryptographic assumptions (bilinear groups with BDH assumption, elliptic curve discrete logarithm problem (ECDLP), and bilinear pairings with CDHP/DDHP assumptions). They, respectively, constructed an anonymous IoT data sharing scheme, a new PKI framework, and a blockchain–cloud–edge collaborative anonymous IoT data search and secure sharing scheme, realizing core requirements such as privacy protection and accountability. However, all these schemes lack post-quantum security; their signature and verification efficiency grow linearly with ring size, they have high key management complexity, and weak ability to adapt to large-scale high-frequency transaction scenarios. Reference [48] was based on the Ring-LWE assumption and lattice cryptography, integrating ring signcryption and non-interactive zero-knowledge proof (NIZKP) technology to build an anonymous linkable scheme suitable for VANET location services, ensuring vehicle query privacy, service provider data privacy, and anonymous payment with identity authentication. Nevertheless, the scheme has high computational and communication overheads, its signature and verification efficiency grow linearly with ring size, and its non-stateless design increases key management complexity.

Reference [49] was based on the SIS and LWE lattice assumptions, integrating non-interactive witness-indistinguishable (NIWI) proofs, strongly unforgeable one-time signatures (OTSs), and pseudorandom functions (PRFs) to construct a highly secure linkable ring signature scheme under the standard model, suitable for privacy protection in cryptocurrencies. However, the scheme’s signature and verification efficiency grow linearly with ring size, it has large key and signature sizes, and it does not achieve a stateless design. The HRPACS proposed in Reference [50] integrates blockchain, linkable ring signatures, homomorphic encryption, and an introducer mechanism, adopting a two-phase routing strategy and Blockchain-Tree structure to build a decentralized, anti-network-blocking non-end-to-end anonymous communication system. However, this system’s signature verification efficiency is affected by ring size and autonomous domain division, resulting in insufficient flexibility in adapting to high-frequency large-scale scenarios. The Lk-TRS designed in Reference [51] is based on bilinear groups with DL/DDH assumptions, integrating pseudorandom functions, accumulators, and signature proof of knowledge (SPK). It supports dynamic ring members, multi-account binding, and k-times signature tracing, suitable for fine-grained accountability in blockchain scenarios. However, its efficiency grows linearly with the k value, its non-stateless design increases key management complexity, and it has a weak ability to adapt to resource-constrained devices.

1.2. Contributions

To address the core drawbacks of existing schemes and the unique requirements of V2G network-specific scenarios, this paper proposes a post-quantum revocable linkable ring signature scheme based on SPHINCS+, with the following key contributions:

First, this paper, for the first time, deeply integrates the pure hash-based architecture of SPHINCS+ with linkable ring signatures. Leveraging WOTS+, FORS, and XMSS technologies, the scheme inherently resists quantum computing attacks and eliminates the need for signature state tracking. Signature generation depends solely on the private key seed and current transaction information, fundamentally solving the key management dilemma confronting traditional stateful schemes in large-scale dynamic access scenarios of V2G networks.

Secondly, an innovative dual strategy of “structure calibration + hash distribution calibration” is proposed to guarantee the polynomial indistinguishability of pseudo-signatures. Pseudo-signatures and real signatures adopt consistent SPHINCS+ architecture parameters (16 FORS subtrees, 10-layered XMSS authentication paths) and satisfy the Kolmogorov–Smirnov test ($D\le 0.05$) to ensure indistinguishable hash distributions. This completely addresses the core risk of anonymity compromise caused by distinguishable pseudo-signatures in traditional schemes.

Third, a privacy-friendly collaborative revocation mechanism is constructed based on KEK (Key Encryption Key)-sharded storage and two-party collaborative decryption ($KEK=KE{K}_1\oplus KE{K}_2$). The Trusted Authority (TA) and the regulatory node each hold a key fragment, and collaborative decryption by both parties is required to locate malicious users. This mechanism not only enables traceability of illegal activities, but also avoids privacy leakage caused by traditional centralized revocation, achieving a balance between anonymity protection and compliant supervision.

Fourth, forward secrecy for linkable tags is realized through one-way private key updates and one-time random factors. Even if the current private key is compromised, attackers cannot trace past transaction records, eliminating the risk of long-term tracking, thus adapting to the long-term security requirements of V2G network transactions.

Fifth, hash commitments are adopted instead of complex cryptographic commitments to achieve lightweight adaptation for resource-constrained scenarios. The scheme reuses the native hash functions of SPHINCS+ (e.g., SHA-256) without introducing complex primitives such as elliptic curves. While efficiently binding transaction amounts to signers, this design significantly reduces computational and storage overheads. Combined with hierarchical verification logic, the scheme is applicable to resource-constrained devices such as onboard terminals and charging stations, meeting the requirements of high-frequency transactions in V2G networks.

These contributions specifically address the key limitations of existing schemes in terms of quantum resistance, state management, anonymity, revocation mechanisms, and resource adaptability, providing a technically rigorous and practically viable solution for secure and anonymous payments in V2G networks in the quantum era.

1.3. Structure

This paper is structured as follows: First, Section 2 introduces the relevant preliminaries, including linkable ring signatures, WOTS+, FORS, and SPHINCS+, laying a theoretical foundation for the subsequent scheme design. Second, Section 3 elaborates on the design principles and detailed algorithm workflow of the proposed SPHINCS+-based linkable ring signature scheme, as well as its specific application scenarios in V2G networks. Third, Section 4 and Section 5, respectively, conduct comprehensive security analysis and quantitative performance analysis to verify the scheme’s feasibility and superiority. Finally, Section 6 concludes the whole paper and puts forward prospective future research directions.

2. Preliminaries

2.1. Linkable and Revocable Ring Signature

Ring-based signatures constitute a cryptographic signature framework proposed by Rivest, Tauman, and Shamir in 2001. This framework allows a signer to select ring members from a set of public keys and generate a signature by combining their own private key, the public keys of other ring members, and a random number, without disclosing the signer’s actual identity. The verifier can confirm that the signature originates from a member within the ring but cannot determine the specific identity of the signer.

As an augmented variant of ring signatures, the linkable ring signature is a digital signature mechanism that integrates both anonymity and linkability. It inherits the core logic of signing “in the name of a ring”, which conceals the precise identity of the signer within the ring. Furthermore, it introduces a “linking tag” to achieve a key functional upgrade: without exposing the signer’s identity, it enables determining whether two signatures are generated by the same signer via this tag.

The key parameters associated with the linkable and revocable ring signature (LRRS) are listed in

Table 1. Notations of the linkable and revocable ring signature (LRRS).

Symbol	Description
$\lambda$	Security Parameter
L	Ring Size (number of members in the ring)
$(pk,sk)$	Public–Private Key Pair
$RID$	Unique Revocation Identifier (bound to user for revocation operations)
$pp$	System Public Parameters (including RID generation rules)
$L_{pk}$	A ring consisting of $\{p{k}_1,p{k}_2,\dots ,p{k}_L\}$
M	Message Hash Digest
$M_{\lambda }$	Message Space (the set of all valid messages corresponding to security parameter $\lambda$)
$\sigma$	Linkable and Revocable Ring Signature
I	Linking Tag (for identifying signatures from the same signer)
Valid/Invalid	Signature Verification Result
Linked/Unlinked	Link Detection Result
Revoked/Not Revoked	Revocation Operation Result

.

Definition 1.

(Linkable and Revocable Ring Signature). A linkable and revocable ring-based signature mechanism consists of the following six fundamental algorithms:

Parameter Generation: $\mathit{Setup}\left(\lambda \right)\to pp$, which takes a security parameter λ as an input and outputs the system public parameters $pp$ (including RID generation rules).

Key Generation: $\mathit{KeyGen}\left(\lambda \right)\to (p{k}_i,s{k}_i,RI{D}_i)$, which takes a security parameter λ as an input and outputs the public–private key pair $(p{k}_i,s{k}_i)$ and a unique Revocation Identifier $RI{D}_i$ (bound to the user for subsequent revocation operations).

Signature Generation: $\mathit{Sign}(s{k}_i,L_{pk},M,RI{D}_i)\to \sigma$, which takes a user’s private key $s{k}_i$, the ring public key set $L_{pk}=(p{k}_1,p{k}_2,\dots ,p{k}_L)$, a message $M\in M_{\lambda }$, and the user’s $RI{D}_i$ as inputs and outputs a linkable and revocable ring signature σ.

Signature Verification: $\mathit{Ver}(L_{pk},M,\sigma ,pp)\to \mathit{Valid}/\mathit{Invalid}$, which takes the ring public key set $L_{pk}$, a message M, a signature σ, and the system public parameters $pp$ as inputs and outputs Valid (the signature is legitimate and the corresponding $RI{D}_i$ is not revoked) or Invalid.

Link Detection: $\mathit{Link}(\sigma ,{\sigma }^{*})\to \mathit{Linked}/\mathit{Unlinked}$, which takes two linkable and revocable ring signatures (corresponding to distinct messages) as inputs, compares their linking tags, and outputs Linked or Unlinked.

Revocation Operation: $\mathit{Revoke}(pp,RI{D}_i,\sigma )\to \mathit{Revoked}/\mathit{Not}\mathit{Revoked}$, which takes the system public parameters $pp$, a user’s Revocation Identifier $RI{D}_i$, and a suspicious signature σ as inputs and outputs Revoked (indicating the user has engaged in malicious activities) or $\mathit{Not}\mathit{Revoked}$.

2.2. WOTS+

At present, hash-driven signature architectures, originating from Ralph Merkle’s research, are categorized into the following three classes: few-time signature (FTS), one-time signature (OTS), and many-time signature (MTS) (as shown in

Table 2. Classification of hash-based signature schemes.

Scheme Type	Scheme Name
OTS	Lamport–Diffie, WOTS, WOTS+
FTS	HORS, HORST-T, PORS, FORS
MTS	XMSS, SPHINCS, SPHINCS+

).

Table 1 summarizes several commonly used hash-based signature mechanisms. In one-time signature (OTS) mechanisms, the pioneering signature algorithm is the Lamport–Diffie algorithm. This study adopts the WOTS+ mechanism as the primary framework, which encompasses the following three core operational modules: Key Generation (KeyGen), Signature Generation (Sign), and Signature Verification (Ver).

The system parameters of WOTS+ include a security parameter n (where n also denotes the number of bytes for XMSS tree nodes, FORS tree nodes, and secret preimage elements), a Winternitz parameter $\omega$, and the number of len elements in the secret preimage array (as shown in

Table 3. Parameter description of the WOTS+ algorithm.

Parameter	Description
$n\in \mathbb{N}$	Security parameter
$\omega \in \mathbb{N}$	Winternitz parameter
${\mathrm{len}}_1$	Number of message segments
${\mathrm{len}}_2$	Number of checksum segments
len	Total segments
PK.seed	Public seed for WOTS+ instance
$x_{i,j}\in {\{0,1\}}^n$	Secret preimages
F	Hash function chain iteration: $F:{\{0,1\}}^n\times {\{0,1\}}^n\mapsto {\{0,1\}}^n$
$\mathrm{ADRS}(i,j)$	Address encoding chain index i and node index j
PRF	$\mathrm{PRF}:{\{0,1\}}^n\times {\{0,1\}}^{\mathrm{idx\_len}}\mapsto {\{0,1\}}^n$

). The parameter len is calculated as $\mathrm{len}={\mathrm{len}}_1+{\mathrm{len}}_2$, where

$${\mathrm{len}}_1=⌈{\displaystyle \frac{8n}{{log}_2\omega }}⌉,{\mathrm{len}}_2=⌈{\displaystyle \frac{{log}_2({\mathrm{len}}_1·(\omega -1))+{log}_2\omega }{{log}_2\omega }}⌉$$

Step 1: Key Generation.

This step derives secret preimages using a pseudorandom function (PRF) to reduce private key storage overhead, as follows: first, generate a public seed $\mathrm{PK}.\mathrm{seed}\in {\{0,1\}}^n$ and a private seed $\mathrm{SK}.\mathrm{seed}\in {\{0,1\}}^n$; then, derive the secret preimage array by computing $x_i=\mathrm{PRF}(\mathrm{SK}.\mathrm{seed},\mathrm{encode}\left(i\right))$ for each $i\in \{0,1,\dots ,\mathrm{len}-1\}$, where $\mathrm{encode}\left(i\right)$ encodes i into a fixed length; next, construct hash chains for the public key by generating a hash chain of length $\omega$ for each $x_i$ with the starting point $y_i^{\left(0\right)}=x_i$ and iteratively computing the chain as $y_i^{(j+1)}=F(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}(i,j),y_i^{\left(j\right)})$ for $j\in \{0,\omega -2\}$; subsequently, assemble the public key from the final nodes of all hash chains as $\mathrm{PK}.\mathrm{pub}=\left(y_0^{(\omega -1)},y_1^{(\omega -1)},\dots ,y_{\mathrm{len}-1}^{(\omega -1)}\right)$; and finally, output the public key $\mathrm{pk}=(\mathrm{PK}.\mathrm{seed},\mathrm{PK}.\mathrm{pub})$ and the private key $\mathrm{sk}=(\mathrm{PK}.\mathrm{seed},\mathrm{SK}.\mathrm{seed})$.

Step 2: Signature Generation.

This step takes the private key sk and message $\mathit{msg}$ as inputs, as follows: first, convert $\mathit{msg}$ into an $8n$-bit string and split it into ${\mathrm{len}}_1$ integers $m\left[0\right],m\left[1\right],\dots ,m[{\mathrm{len}}_1-1]\in \{0,\omega -1\}$ with each segment of $s={log}_2\omega$ bits; then, compute the checksum $\mathrm{csum}={\sum }_{i=0}^{{\mathrm{len}}_1-1}(\omega -1-m\left[i\right])$ and split csum into ${\mathrm{len}}_2$ integers $m\left[{\mathrm{len}}_1\right],\dots ,m[\mathrm{len}-1]\in \{0,\omega -1\}$ with each segment of s bits; next, for each chain index $i\in \{0,1,\dots ,\mathrm{len}-1\}$, derive the chain starting point $x_i=\mathrm{PRF}(\mathrm{SK}.\mathrm{seed},\mathrm{encode}\left(i\right))$, initialize the chain starting point as $y_i^{\left(0\right)}=x_i$, iteratively generate the signature node by computing $y_i^{(j+1)}=F(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}(i,j),y_i^{\left(j\right)})$ for $j\in \{0,m[i]-1\}$, and define the signature node as ${\mathrm{sig}}_i=y_i^{m\left[i\right]}$; and finally, assemble the signature as $\mathit{sig}=({\mathrm{sig}}_0,{\mathrm{sig}}_1,\dots ,{\mathrm{sig}}_{\mathrm{len}-1})$.

Step 3: Signature Verification.

This step takes the public key $\mathrm{pk}=(\mathrm{PK}.\mathrm{seed},\mathrm{PK}.\mathrm{pub})$, message $\mathit{msg}$, and signature $\mathit{sig}$ as inputs, as follows: first, follow the same process as the signature generation step to segment the message and calculate the checksum for obtaining the segmented array $m[0..\mathrm{len}-1]$; then, for each chain index $i\in \{0,1,\dots ,\mathrm{len}-1\}$, extract the signature node ${\mathrm{sig}}_i=\mathit{sig}\left[i\right]$, define $\mathrm{required\_iter}=\omega -1-m\left[i\right]$, initialize $z_i^{\left(0\right)}={\mathrm{sig}}_i$, iteratively compute $z_i^{(j+1)}=F(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}(i,m\left[i\right]+j),z_i^{\left(j\right)})$ for $j\in \{0,\mathrm{required\_iter}-1\}$, and verify whether $z_i^{\left(\mathrm{required\_iter}\right)}=\mathrm{PK}.\mathrm{pub}\left[i\right]$ holds, where the verification succeeds if the equation is satisfied and fails otherwise.

2.3. FORS

This paper also adopts the FORS algorithm. FORS is a hash-based few-time signature (FTS) scheme and serves as a fundamental component of the SPHINCS+ algorithm.

First, it is necessary to define a security parameter n (where $n\in \mathbb{N}$), which determines the length of hash values. Additionally, it is required to specify the number of FORS subtrees k, $k\in \mathbb{N}$, the exponent $\alpha$ for the height of subtrees, $\alpha \in \mathbb{N}$, and the number of leaves in each subtree, which is $t=2^{\alpha }$. The parameter description of the FORS algorithm is presented in

Table 4. Parameter description of the FORS algorithm.

Parameter	Description
$n\in \mathbb{N}$	Security parameter
$k\in \mathbb{N}$	Number of independent FORS subtrees
$\alpha \in \mathbb{N}$	Exponent defining the height of each subtree
$t=2^{\alpha }$	Number of leaf nodes in each FORS subtree
$\mathrm{PK}.\mathrm{seed}\in {\{0,1\}}^n$	Public seed for FORS instance
$x_i\in {\{0,1\}}^n$	Secret preimage
$(x_0,\dots ,x_{k-1})\in {\{0,1\}}^{n\times k}$	Array of secret preimages
F	Hash function, $F:{\{0,1\}}^n\times \mathrm{ADRS}\times {\{0,1\}}^n\to {\{0,1\}}^n$
H	Hash function, $H:{\{0,1\}}^n\times \mathrm{ADRS}\times {\{0,1\}}^{2n}\to {\{0,1\}}^n$
$T_k$	Hash function, $T_k:{\{0,1\}}^n\times {\{0,1\}}^{n\times k}\to {\{0,1\}}^n$
ADRS	Address encoding structure for chain/index identification

.

Step 1: Private Key Creation.

The private key consists of two components. The initial component is a public random seed PK.seed, which is used to distinguish different FORS instances. The second component is a secret preimage array $(x_0,\dots ,x_{kt-1})$, containing $k\times t$ n-byte random numbers divided into k groups with t elements each.

Step 2: Public Key Generation.

This step includes the following three sub-steps: computing leaf nodes, constructing FORS subtrees, and compressing root nodes into the public key. Compute leaf nodes: For each secret preimage $x_j$, $j\in \{0,k\times t-1\}$, generate a leaf node $y_j$, $y_j=F(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}\left(j\right),x_j)$. Here, $\mathrm{ADRS}\left(j\right)$ uniquely identifies the address parameter of the j-th leaf. Construct FORS subtrees: Divide the $k\times t$ leaves into k groups with t leaves each, and construct a binary tree of height $\alpha$. If node z is the parent of child nodes u and v (with the parent node having height treeHeight and index treeIndex), then $\mathbf{z}=\mathbf{H}(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}(\mathrm{treeHeight},\mathrm{treeIndex}),u \Vert v)$. Compress root nodes into the public key: Let the roots of the k subtrees be ${\mathrm{root}}_0^{\mathrm{FORS}},{\mathrm{root}}_1^{\mathrm{FORS}},\dots ,{\mathrm{root}}_{k-1}^{\mathrm{FORS}}$. Compute the public key using the hash function $T_k$: $\mathrm{pk}=\left(\mathrm{PK}.\mathrm{seed},T_k\left(\mathrm{PK}.\mathrm{seed},{\mathrm{root}}_0^{\mathrm{FORS}}\Vert \cdots \Vert {\mathrm{root}}_{k-1}^{\mathrm{FORS}}\right)\right)$.

Step 3: Signature Generation.

This step includes the following two sub-steps: message preprocessing combined with the SPHINCS+ framework and extracting signature content. Message preprocessing: First, generate a random number $R={\mathrm{PRF}}_{\mathrm{msg}}(\mathrm{SK}.\mathrm{prf},\mathrm{opt},\mathit{msg})$, where ${\mathrm{PRF}}_{\mathrm{msg}}$ is a pseudorandom function (PRF) and SK.prf is a secret seed. Next, compute the message digest $={\mathrm{H}}_{\mathrm{msg}}(\mathit{R},\mathrm{PK}.\mathrm{seed},\mathrm{PK}.\mathrm{Root},\mathit{msg})$, where H is a hash function. Finally, extract indices: Take the first $k\times \alpha$ bits of the digest and split them into k integers $m_0,m_1,\dots ,m_{k-1}$, corresponding to the leaf index of the i-th subtree. Extract signature content: The signature contains two types of data. The first type includes k secret preimages $x_{i\times t+m_i}$, each corresponding to the leaf with index $m_i$ in the i-th subtree. The second type is the intermediate nodes (i.e., authentication paths) traversed from the leaf $y_{i\times t+m_i}$ to the root ${\mathrm{root}}_i^{\mathrm{FORS}}$ in each subtree.

Step 4: Signature Verification.

This step includes the following two sub-steps: reconstructing subtree root nodes and verifying public key consistency. Reconstruct subtree root nodes: For each secret preimage $x_{i\times t+m_i}$ and authentication path in the signature, compute the leaf $y_{i\times t+m_i}^{\prime }=F(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}(i\times t+m_i),x_{i\times t+m_i})$ to verify leaf consistency. Then, simulate the subtree construction process using the intermediate nodes of the authentication path to compute the reconstructed root ${\mathrm{root}}_i^{{\mathrm{FORS}}^{\prime }}$. Verify the consistency of the public key: First, compress the reconstructed roots. Use all reconstructed roots ${\mathrm{root}}_0^{{\mathrm{FORS}}^{\prime }},\dots ,{\mathrm{root}}_{k-1}^{{\mathrm{FORS}}^{\prime }}$ to recompute the public key via $T_k$: ${\mathrm{pk}}^{\prime }=\left(\mathrm{PK}.\mathrm{seed},T_k\left(\mathrm{PK}.\mathrm{seed},{\mathrm{root}}_0^{{\mathrm{FORS}}^{\prime }}\Vert \cdots \Vert {\mathrm{root}}_{k-1}^{{\mathrm{FORS}}^{\prime }}\right)\right)$. The signature is valid if ${\mathrm{pk}}^{\prime }$ is exactly consistent with the original public key. Figure 2 (blue nodes at the bottom layer are the secret key leaves serving as private key sources for signing, red nodes are the authentication path nodes corresponding to the selected private key that are provided in the signature for root reconstruction during verification, and white nodes are the non-authentication path intermediate nodes only used to construct the tree structure without being included in the signature.) presents the tree structure of a FORS instance with parameters $(n,k,t=2^3)$, as well as the private key elements and authentication path required when signing the message $M=010110100=(2,6,4)$.

2.4. SPHINCS+

2.4.1. XMSS

In 1979, Ralph Merkle put forward the Merkle Signature Scheme (MSS), which integrates Merkle trees with one-time signature (OTS) algorithms. The Merkle structure exhibits a layered architecture in which leaf elements store hash digests of information, whereas non-leaf elements maintain aggregated hash digests of their subordinate elements. Such an architecture facilitates effective validation of information authenticity and also proves particularly apt for extensive data collections. The overall architecture of the Merkle structure is illustrated in Figure 3.

Depicted in Figure 3, the structure comprises three tiers and $2^3=8$ leaf elements, each storing the hash digest of a single-use signature public key. The leaf elements are designated from elem0 to elem7 and are hashed in pairs to generate intermediate elements. The final root element stores the public key. Merkle structures mainly fulfill the following two functions:

Information authenticity validation: Individuals can ascertain if the information has been modified by recomputing the root digest.

Public key dimension reduction: By combining numerous public keys into a single root key, it reduces the storage requirement for public keys.

XMSS (eXtended Merkle Signature Scheme) is an extended Merkle signature scheme. It is a hash-based digital signature system with WOTS+ as its primary building block, managing WOTS+ keys through multi-layered Merkle trees. An h-height Merkle tree contains $2^h$ WOTS+ public keys, with its root node serving as the XMSS public key. During signing, an unused leaf index is selected, the corresponding WOTS+ key is used to generate the signature, and path nodes are appended (as shown in Figure 4, gray boxes represent core nodes on the authentication path, while white boxes represent non-authentication path nodes and basic components of the XMSS tree). During verification, the hash chain of the auth2 nodes in the path is computed, the root is reconstructed, and is compared with the public key.

Being a quantum-resistant hash-centric digital signing mechanism, SPHINCS+ adopts relevant XMSS technologies during its construction and improves upon some of XMSS’s drawbacks. XMSS possesses a stateful property, which means that to ensure overall security, it needs to track all signatures generated with the same private key. This property limits the attractiveness of its practical applications to a certain extent. In contrast, SPHINCS+ overcomes the limitations caused by XMSS’s statefulness through improvements and adopts a stateless design.

2.4.2. Hypertree

As the core framework for organizing WOTS+ one-time signature and FORS few-time signature components, the Hypertree of SPHINCS+ consists of multiple layers of XMSS trees. The root value of each layer’s tree is used to verify the public keys of the next layer, eliminating key state management issues. The structure of the Hypertree is illustrated in Figure 5.

The Hypertree is composed of a large number of perfect binary trees (variants of XMSS trees) with the same height, arranged in a hierarchical manner. It has a total height h and is divided into d layers, where the height of each XMSS tree is $h^{\prime }={\displaystyle \frac{h}{d}}$. Except for the topmost layer, any XMSS tree in the i-th layer corresponds to a leaf node of a specific XMSS tree in the $(i+1)$-th layer, forming a hierarchical association.

The topmost layer (the $(d-1)$-th layer) contains only $2^0=1$ XMSS tree. From the upper to lower layers, the number of XMSS trees increases layer by layer, with the bottommost layer (the 0-th layer) having $2^{(h-h^{\prime })}$ XMSS trees. Each XMSS tree contains $2^{h^{\prime }}$ leaf nodes, and the datum of every leaf element represents the condensed datum of the public key set for a WOTS+ entity. The leaf elements of all XMSS structures at the lowermost layer correspond to a total of $2^h$ WOTS+ instances and $2^h$ FORS instances.

The index of a specific leaf node in the bottommost layer (the 0-th layer) can activate a set of “XMSS tree chains” and “XMSS leaf node chains”. A tree chain includes XMSS trees from the 0-th layer to the $(d-1)$-th layer, where the tree in the i-th layer corresponds to a specific leaf node of the tree in the $(i+1)$-th layer. A leaf node chain includes the corresponding leaf nodes of the XMSS trees in each layer of the aforementioned tree chain, serving as the hierarchical verification path during signature generation.

The Hypertree structure supports signature generation through tree chains and leaf node chains. During signature generation, the index of the XMSS tree and leaf node in the bottommost layer is first determined via the message digest, activating the corresponding tree chain and leaf node chain. Then, XMSS signatures are generated layer by layer from the bottommost layer to the topmost layer, eventually forming the Hypertree signature.

3. SPHINCS+ Linkable and Revocable Ring Signature Scheme

The interaction process among V2G entities (EV, CS, LAG, BS, Smart Grid Control Center (SGCC), TA) involves multiple wireless/wired communication links and hierarchical data processing, leading to scenario-specific security risks that require focused attention in security analysis, as follows: (1) the wireless communication between EVs and LAGs is vulnerable to man-in-the-middle attacks, where attackers may tamper with charging requests (e.g., modifying electricity demand q or transaction amount v) or hijack signature data; (2) as an intermediate node for signature verification and transaction forwarding, LAGs may be compromised to forge verification results or delay transaction synchronization, creating opportunities for malicious EVs to conduct double-spending; (3) CSs may falsify charging records to collude with users in fraudulent transactions, requiring the scheme to bind transaction data with immutable signatures; (4) the linkable tags I stored by BSs may become targets for tampering, undermining the double-spending detection mechanism; and (5) the on-board terminals of EVs are resource-constrained and susceptible to side-channel attacks such as power analysis and timing analysis, necessitating enhanced attack resistance in the scheme design. Subsequent security analysis will design attack scenarios targeting these links to ensure the scheme covers end-to-end risks.

3.1. Description of the Scheme’s Signature Algorithm

The hash-centric linkable ring signing mechanism addressed in this study relies on the SPHINCS+ mechanism, comprising the following three modules: the WOTS+ one-time signature algorithm, the FORS few-time signature algorithm, and the XMSS hierarchical tree algorithm. The following is an overview of these components.

Definition 2

(SPHINCS+-based Linkable Ring Signature Algorithm). The SPHINCS+-based linkable ring signature algorithm mainly includes the following five steps: Initialization, Key Generation, Signature Generation, Signature Verification, and Link Detection. The algorithms for these steps are as follows:

Step 1: Initialization.

Input the security parameter $\lambda$ and output the public parameters $\mathrm{pp}=(H,H_{\mathrm{tree}},\omega ,\mathrm{len},k,h,d,n_{\mathrm{ring},\max },{\mathrm{Root}}_{\mathrm{ring}},{\mathrm{auth}}_{\mathrm{ring}},{\tau }_{\mathrm{win}})$. Determine the hash functions $H:{\{0,1\}}^{*}\to {\{0,1\}}^n$ and $H_{\mathrm{tree}}:{\{0,1\}}^{*}\to {\{0,1\}}^n$, as well as the maximum ring size $n_{\mathrm{ring},\max }$. In real-world implementation contexts, if the quantity of vehicles fails to satisfy this criterion, it is advisable to either incorporate virtual entities into the ring or segment the vehicles into several rings. The parameter ${\tau }_{\mathrm{win}}$ (time window interval, e.g., 3600 s) maps transaction timestamp to discrete time window $t=\lfloor \mathrm{timestamp}/{\tau }_{\mathrm{win}}\rfloor$ ($t\in {\mathbb{N}}^{+}$) for forward security implementation.

See

Table 5. Parameter description of the scheme.

Parameter	Description
$\lambda \in \mathbb{N}$	Security parameter
$h\in \mathbb{N}$	Overall depth of the SPHINCS+ hyperstructure
$d\in \mathbb{N}$	Count of tiers within the hyperstructure
$h^{\prime }\in \mathbb{N}$	Height of a single XMSS subtree
$\alpha \in \mathbb{N}$	Height of a FORS subtree
$k\in \mathbb{N}$	Number of independent FORS subtrees
$\omega \in \mathbb{N}$	Window size for WOTS+
$\mathrm{SK}.\mathrm{seed}\in {\{0,1\}}^n$	Secret seed of the private key
$\mathrm{SK}.\mathrm{prf}\in {\{0,1\}}^n$	PRF seed of the private key
H	$H:{\{0,1\}}^n\to {\{0,1\}}^n$
n	Number of ring members in the signature ring
$r\in {\{0,1\}}^n$	Randomizer for hash commitment
$\mathrm{I}\in {\{0,1\}}^n$	Linking tag
$\mathrm{cm}\in {\{0,1\}}^n$	Hash commitment value
${\mathrm{Root}}_{\mathrm{ring}}$	Merkle root of the ring
${\mathrm{auth}}_{\mathrm{ring}}$	Authentication path from the signer’s public key hash to ${\mathrm{Root}}_{\mathrm{ring}}$
$t\in {\mathbb{N}}^{+}$	Time window identifier (mapped from transaction timestamp)
${\mathrm{sk}}_{\mathrm{link},\xi ,t}\in {\{0,1\}}^n$	Linkage private key of user $\xi$ in time window t
$r_{\xi ,t}\in {\{0,1\}}^n$	Random factor for forward-secure link tag
${\mathrm{I}}_{\xi ,t}\in {\{0,1\}}^n$	Forward-secure linking tag (user $\xi$, time window t)
${\mathrm{ADRS}}_{\mathrm{FORS},i}$	Address encoding of FORS tree for non-signer i
${\mathrm{PK}.\mathrm{seed}}_{\mathrm{rand}}\in {\{0,1\}}^n$	System random seed for pseudo-signature
${\tau }_t\in \mathbb{N}$	Start timestamp of time window t
${\tau }_0\in \mathbb{N}$	User registration timestamp

for detailed parameter descriptions.

Step 2: Key Generation.

Input the public parameters pp and output the user private key $s{k}_i$, public key $p{k}_i$, and linkage auxiliary parameters. The specific process is as follows: First, generate the SPHINCS+ private key $s{k}_i=({\mathrm{SK}.\mathrm{seed}}_i,{\mathrm{SK}.\mathrm{prf}}_i)$ and public key $p{k}_i=({\mathrm{PK}.\mathrm{root}}_i,{\mathrm{PK}.\mathrm{seed}}_i)$; subsequently, generate the initial linkage private key $s{k}_{\mathrm{link},i,0}=H({\mathrm{SK}.\mathrm{seed}}_i\Vert “link\_init” \Vert {\tau }_0)$, as well as the public key hash $hp{k}_i=H\left(p{k}_i\right)$.

Step 3: Signature Generation.

Input the message M, amount v, ring member set $R=\{P{K}_1,...,P{K}_{n_{\mathrm{ring}}}\}$, and the signer’s private key $s{k}_{\xi }$ (where $\xi \in \{1,\dots ,n_{\mathrm{ring}}\}$), and output the linkable ring signature $\sigma$.

The signer first determines the current time window $t=\lfloor \mathrm{timestamp}/{\tau }_{\mathrm{win}}\rfloor$ from the transaction timestamp, then updates the linkage private key in a one-way manner for forward security: $s{k}_{\mathrm{link},\xi ,t}=H(s{k}_{\mathrm{link},\xi ,t-1}\Vert t \Vert H(P{K}_{\xi } \Vert {\tau }_t))$.

The signer maps the ring member public key set $R=\{P{K}_1,...,P{K}_{n_{\mathrm{ring}}}\}$ to a hash set $\{H\left(P{K}_1\right),...,H\left(P{K}_{n_{\mathrm{ring}}}\right)\}$, constructs a Merkle tree using this set as leaf nodes, and calculates the root node ${\mathrm{Root}}_{\mathrm{ring}}=H_{\mathrm{tree}}\left(\{H\left(P{K}_1\right),\dots ,H(P{K}_{n_{\mathrm{ring}}})\}\right)$.

Extract the authentication path ${\mathrm{auth}}_{\mathrm{ring}}$ from the hash of the signer’s own public key $H\left(P{K}_{\xi }\right)$ to ${\mathrm{Root}}_{\mathrm{ring}}$; the path length is ${log}_2{n}_{\mathrm{ring}}$, covering all intermediate nodes from the leaf (i.e., $H\left(P{K}_{\xi }\right)$) to the root ${\mathrm{Root}}_{\mathrm{ring}}$.

Randomly select $r\in {\{0,1\}}^n$ and compute $\mathrm{cm}=H\left(r \Vert v \Vert H\left(P{K}_{\xi }\right) \Vert H\left(M\right)\right)$, which binds the transaction amount and the signer.

Randomly select an independent random factor $r_{\xi ,t}\in {\{0,1\}}^n$, then compute the forward-secure link tag for subsequent link detection: ${\mathrm{I}}_{\xi ,t}=H\left(s{k}_{\mathrm{link},\xi ,t} \Vert H\left(P{K}_{\xi }\right) \Vert t \Vert r_{\xi ,t}\right)$ Perform message preprocessing: Let $M^{\prime }=c \Vert {\mathrm{I}}_{\xi ,t}$, and generate the digest $md=H\left(M^{\prime }\right)$. For each non-signer $i\ne \xi$ in the ring, generate indistinguishable pseudo-FORS signatures. Pseudo-FORS private key generation: $s{k}_{\mathrm{For},i}^{\mathrm{fk}}=\mathrm{PRF}\left({\mathrm{PK}.\mathrm{sd}}_r,\mathrm{enc}(i \Vert t \Vert {\mathrm{Adr}}_{\mathrm{For},i})\right)$; Pseudo-FORS authentication path generation: ${\mathrm{auth}}_{\mathrm{For},i}^{\mathrm{fk}}=\left\{H(\mathrm{PK}.\mathrm{sd},{\mathrm{Adr}}_{n,j},r_j)\mid j=1,\dots ,\alpha \right\}$; Pseudo-FORS root consistency verification: ${\mathrm{root}}_{\mathrm{For},i}^{\mathrm{fk}}=T_k\left({\mathrm{PK}.\mathrm{sd}}_i,{\mathrm{Adr}}_{\mathrm{rt}},{\mathrm{auth}}_{\mathrm{For},i}^{\mathrm{fk}}\right)$; Pseudo-FORS signature construction: ${\sigma }_{\mathrm{For},i}^{\mathrm{fk}}=\left(s{k}_{\mathrm{For},i}^{\mathrm{fk}}\left[m\left[i\right]\right],{\mathrm{auth}}_{\mathrm{For},i}^{\mathrm{fk}},{\mathrm{Adr}}_{\mathrm{For},i}\right)$.

Use the real FORS private key $s{k}_{\mathrm{FORS},\xi \left[j\right]}=\mathrm{PRF}\left({\mathrm{PK}.\mathrm{seed}}_{\xi },{\mathrm{SK}.\mathrm{seed}}_{\xi },\mathrm{ADRS}\right)$ (where $j\in \{1,...,k-t\}$) to generate a valid signature ${\sigma }_{\mathrm{FORS},\xi }$ for $md$. Aggregate the FORS signatures: ${\sigma }_{\mathrm{FORS}}=\{{\sigma }_{\mathrm{FORS},1},\dots ,{\sigma }_{\mathrm{FORS},n_{\mathrm{ring}}}\}$.

Generate the WOTS+ private key $s{k}_{\mathrm{WOTS}+,\xi \left[i\right]}=\mathrm{PRF}\left({\mathrm{PK}.\mathrm{seed}}_{\xi },{\mathrm{SK}.\mathrm{seed}}_{\xi },\mathrm{ADRS}\right)$ (where $i\in \{0,...,\mathrm{len}-1\}$). Take ${\sigma }_{\mathrm{FORS}}$ as the input of the WOTS+ algorithm, and use $s{k}_{\mathrm{WOTS}+,\xi \left[i\right]}$ to sign ${\sigma }_{\mathrm{FORS}}$, generating ${\sigma }_{\mathrm{WOTS}+}$.

Locate the leaf node of $\xi$ in the XMSS tree (with index idxLeaf) and extract the authentication path ${\mathrm{auth}}_{\mathrm{XMSS}}$ from this leaf node to the tree root ${\mathrm{PK}.\mathrm{root}}_{\xi }$.

Incorporate ${\mathrm{Root}}_{\mathrm{ring}}$ and ${\mathrm{auth}}_{\mathrm{ring}}$ into the signature structure.

Finally, output $\sigma =\left({\sigma }_{\mathrm{FORS}},{\sigma }_{\mathrm{WOTS}+},{\mathrm{auth}}_{\mathrm{XMSS}},{\mathrm{auth}}_{\mathrm{ring}},\mathrm{cm},{\mathrm{I}}_{\xi ,t},r,r_{\xi ,t},t,{\mathrm{Root}}_{\mathrm{ring}}\right)$.

Step 4: Signature Verification.

Input the signature $\sigma$, message M, ring R, and public parameters pp, and output the verification result 0 (invalid) or 1 (valid).

Extract ${\mathrm{Root}}_{\mathrm{ring}}$, ${\mathrm{auth}}_{\mathrm{ring}}$, and the hash of the signer’s public key $H\left(P{K}_{\xi }\right)$ from the signature $\sigma$.

Starting from $H\left(P{K}_{\xi }\right)$, iteratively hash the intermediate nodes contained in ${\mathrm{auth}}_{\mathrm{ring}}$ to reconstruct the Merkle root ${\mathrm{Root}}_{\mathrm{ring}}^{\prime }$.

If ${\mathrm{Root}}_{\mathrm{ring}}^{\prime }\ne {\mathrm{Root}}_{\mathrm{ring}}$, return 0; if they are consistent, proceed to the subsequent verification steps.

Verify the hash commitment: Extract cm and r, and verify $H\left(r \Vert v \Vert H\left(P{K}_{\xi }\right) \Vert H\left(M\right)\right)=\mathrm{cm}$. If this verification fails, return 0.

Verify the FORS signature: For each ${\sigma }_{\mathrm{FORS},i}$ in ${\sigma }_{\mathrm{FORS}}$, use ${\mathrm{PK}.\mathrm{seed}}_i$ and the authentication paths in ${\sigma }_{\mathrm{FORS},i}$ to verify the FORS tree root ${\mathrm{root}}_{\mathrm{FORS}}=T_k\left({\mathrm{PK}.\mathrm{seed}}_i,\mathrm{ADRS},{\mathrm{root}}_j\right)$; confirm it is valid if the verification passes for $p{k}_i$.

Verify the WOTS+ signature: For $p{k}_i$ that passes the FORS verification, use ${\mathrm{PK}.\mathrm{seed}}_i$ and ${\sigma }_{\mathrm{WOTS}+}$ to verify the WOTS+ public key $p{k}_{\mathrm{WOTS}+}=T_{\mathrm{len}}\left({\mathrm{PK}.\mathrm{seed}}_i,\mathrm{ADRS},y_i^{\omega -1}\right)$, where $y_i^{\omega -1}$ are the final nodes of the hash chains of the i-th group of WOTS+ private keys. If the verification passes, ${\sigma }_{\mathrm{WOTS}+}$ is not tampered with.

Verify the XMSS path: Use ${\mathrm{auth}}_{\mathrm{XMSS}}$ and ${\mathrm{PK}.\mathrm{root}}_i$ to verify the path integrity, compute layer by layer up to the XMSS root, and confirm consistency with ${\mathrm{PK}.\mathrm{root}}_i$.

Extract ${\mathrm{I}}_{\xi ,t}$, $r_{\xi ,t}$, t, and $s{k}_{\mathrm{link},\xi ,t}$ and verify the forward-secure link tag consistency: ${\mathrm{I}}_{\xi ,t}=H\left(s{k}_{\mathrm{link},\xi ,t} \Vert H\left(P{K}_{\xi }\right) \Vert t \Vert r_{\xi ,t}\right)$. If verification fails, return 0.

Return 1 if all steps pass; otherwise, return 0.

Step 5: Link Detection.

Input two signatures ${\sigma }_1,{\sigma }_2$, and output “linked” or “unlinked”.

Extract ${\mathrm{I}}_{{\xi }_1,t_1}$, ${\mathrm{I}}_{{\xi }_2,t_2}$ from ${\sigma }_1$, ${\sigma }_2$, along with $r_{{\xi }_1,t_1}$, $r_{{\xi }_2,t_2}$, $t_1$, $t_2$ and the passed verification results.

Return “linked” if ${\mathrm{I}}_{{\xi }_1,t_1}={\mathrm{I}}_{{\xi }_2,t_2}$ and $t_1=t_2$; otherwise, return “unlinked”.

3.2. Application of the Scheme in Vehicle-to-Grid (V2G) Networks

This paper applies the SPHINCS+-based linkable ring signature algorithm to the anonymous payment scenario in Vehicle-to-Grid (V2G) networks. Based on the post-quantum signature mechanism of SPHINCS+ (core parameters: $k=16$, $\alpha =8$, $\omega =16$, ${\tau }_{\mathrm{win}}=3600\mathrm{s}$), the scheme integrates the anonymity and linkability of ring signatures and innovatively designs a KEK-based collaborative revocation mechanism to balance privacy protection and regulatory efficiency. It protects the identity privacy of Electric Vehicles (EVs), supports the associative traceability of multiple transactions from the same user, effectively resists double-spending attacks, and enables secure revocation of malicious nodes without privacy leakage.

The scheme involves the following seven core entities: Trusted Authority (TA), Electric Vehicle (EV), Charging Station (CS), Local Aggregator (LAG), Smart Grid Control Center (SGCC), Billing Server (BS), and Independent Regulatory Node (RN). The TA is responsible for system initialization, key management, and collaborative revocation; the RN holds a fragment of the Key Encryption Key (KEK) to constrain the TA’s authority; and other entities perform transaction initiation, verification, and execution as specified. Each EV must complete registration with the TA to obtain a unique Revocation Identifier (RID) and access the network.

When an EV needs to purchase electricity for charging, it initiates a charging request containing its anonymous identifier to the LAG; the LAG forwards the request to the SGCC for confirmation; the SGCC generates an order and returns it to the EV; the EV selects $n-1$ registered EVs to form a ring, generates a SPHINCS+-based linkable ring signature, and sends it to the BS via the LAG; and the BS verifies the signature validity and authorizes charging if passed.

This section elaborates on the anonymous payment mechanism in detail, including four core steps (initialization, account preparation, signature payment, verification and authorization) and a supporting traceability–revocation process. Assume an EV user (Alice) has m accounts and intends to pay for V2G charging through this mechanism.

Step 1: Initialization (See Figure 6).

First, the TA executes the SPHINCS+ $\mathrm{Setup}\left(\lambda \right)$ algorithm to generate system parameters $pp=(H,H_{\mathrm{tree}},\omega ,\mathrm{len},k,\alpha ,h,d,n_{\mathrm{ring},\max },{\mathrm{PK}.\mathrm{seed}}_{\mathrm{rand}},{\tau }_{\mathrm{win}})$ (where H is SHA-256 and $H_{\mathrm{tree}}$ is a Merkle tree hash function) and distributes $pp$ as the global public parameter to all entities. Subsequently, the TA generates a Key Encryption Key (KEK) using the AES-256 algorithm and splits it into the following two fragments via XOR operation: $KEK=KE{K}_1\oplus KE{K}_2$, where $KE{K}_1$ is stored locally by the TA and $KE{K}_2$ is held by the independent Regulatory Node (RN) (realizing collaborative decryption constraint). Alice submits an encrypted registration application to the TA (containing device identifier and identity verification information), executes $\mathrm{KeyGen}\left(pp\right)$ to generate a public–private key pair $(p{k}_i,s{k}_i)$, and computes the following. Initial linkage private key: $s{k}_{\mathrm{link},i,0}=H({\mathrm{SK}.\mathrm{seed}}_i\Vert “lin{k}_{i}nit” \Vert {\tau }_0)$ (${\tau }_0$ is registration timestamp, ${\mathrm{SK}.\mathrm{seed}}_i$ is SPHINCS+ private seed). Public key hash: $hp{k}_i=H\left(p{k}_i\right)$ (ensuring consistency with signature verification logic). The TA assigns a unique unforgeable Revocation Identifier $RI{D}_i$ to Alice, constructs a mapping table entry $(I_{\mathrm{link}},p{k}_i,RI{D}_i)$ (where $I_{\mathrm{link}}$ is the initial link tag), encrypts the entire mapping table with $KEK$ (AES-256), and stores it in regional fragments (impact scope of single leakage $\le {\displaystyle \frac{1}{n_{\mathrm{shard}}}}$, $n_{\mathrm{shard}}$ is fragment count). The TA generates a revocation credential $Cre{d}_{RI{D}_i}=H(RI{D}_i \Vert \mathrm{PK}.\mathrm{root} \Vert {\tau }_0)$ (binding RID with SPHINCS+ public root), adds $p{k}_i$ and $RI{D}_i$ to the legitimate user list, and Alice stores $RI{D}_i$, $Cre{d}_{RI{D}_i}$, and $s{k}_i$ locally.

Step 2: Account Creation Process (See Figure 7).

Before participating in transactions, Alice needs to create an account and pre-deposit funds to ensure transaction credibility. First, she generates a random number $r\in {\{0,1\}}^{256}$ as the commitment factor and computes the balance commitment $cm=H(r \Vert v \Vert hp{k}_i \Vert H\left(M\right) \Vert RI{D}_i)$—where v is the account balance, M is the initial transaction message, and $RI{D}_i$ binds the account with the revocation mechanism (consistent with SPHINCS+ hash input length). Account information is stored in the form of $(p{k}_i,cm,RI{D}_i)$: the hash commitment hides the actual balance while ensuring verifiability, and the association between the account and revocation mechanism is realized through $RI{D}_i$; the TA synchronizes the encrypted account mapping table fragment to the BS, ensuring only authorized entities can access it.

Step 3: Anonymous Payment Phase (See Figure 8).

First, Alice submits a charging request to the LAG, including the CS location, electricity demand q, anonymous identifier, and revocation credential $Cre{d}_{RI{D}_i}$. The LAG forwards the request to the SGCC, which computes the electricity fee v, constructs the bill message $M=(\mathrm{EV}\mathrm{Anonymous}\mathrm{ID},\mathrm{Electricity}\mathrm{Quantity},v,\mathrm{Timestamp})$, and returns it to Alice.

Next, Alice selects $n-1$ legitimate EV public key hashes $hp{k}_j$ (from the TA’s published list) and forms a ring $R=\{hp{k}_1,...,hp{k}_{\xi },...,hp{k}_n\}$ with her own $hp{k}_{\xi }$ ($\xi$ is her index in the ring), ensuring the ring size $n\le n_{\mathrm{ring},\max }$.

When generating the signature, Alice strictly follows the scheme’s parameter constraints and pseudo-signature generation logic. Time window determination: Compute the current time window $t=\lfloor \mathrm{Timestamp}/{\tau }_{\mathrm{win}}\rfloor$ and update the linkage private key in one-way manner (ensuring forward secrecy), $s{k}_{\mathrm{link},\xi ,t}=H(s{k}_{\mathrm{link},\xi ,t-1} \Vert t \Vert H(p{k}_{\xi } \Vert {\tau }_t))$ (${\tau }_t$ is the start timestamp of time window t). Ring Merkle tree construction: Take ring R as leaf nodes and compute Merkle root ${\mathrm{Root}}_{\mathrm{ring}}=H_{\mathrm{tree}}\left(R\right)$ and authentication path ${\mathrm{auth}}_{\mathrm{ring}}$ (associating $hp{k}_{\xi }$ with ${\mathrm{Root}}_{\mathrm{ring}}$), ensuring ring member legitimacy verification. Commitment and link tag generation: Generate commitment $cm=H(r \Vert v \Vert hp{k}_{\xi } \Vert H\left(M\right) \Vert RI{D}_i)$, select a one-time random factor $t{k}_{\xi ,t}\in {\{0,1\}}^{256}$ (tk = transaction key), and compute forward-secure link tag $I_{\xi ,t}=H(s{k}_{\mathrm{link},\xi ,t} \Vert hp{k}_{\xi } \Vert t \Vert t{k}_{\xi ,t} \Vert RI{D}_i)$. Pseudo-signature generation for non-signers (ensuring polynomial indistinguishability): For each $i\ne \xi$ in the ring: The pseudo-FORS private key is $s{k}_{\mathrm{FORS},i}^{\mathrm{fake}}=\mathrm{PRF}({\mathrm{PK}.\mathrm{seed}}_{\mathrm{rand}},\mathrm{encode}(i \Vert t \Vert {\mathrm{ADRS}}_{\mathrm{FORS},i}\left)\right)$ (consistent with SPHINCS+ address encoding) and pseudo-authentication path is ${\mathrm{auth}}_{\mathrm{FORS},i}^{\mathrm{fake}}=\{H(\mathrm{PK}.\mathrm{seed},{\mathrm{ADRS}}_{\mathrm{node},j},ran{d}_j)\mid j=1,\dots ,\alpha \}$ (authentication path length $\alpha =8$). Root consistency verification: ${\mathrm{root}}_{\mathrm{FORS},i}^{\mathrm{fake}}=T_k({\mathrm{PK}.\mathrm{seed}}_i,{\mathrm{ADRS}}_{\mathrm{root}},{\mathrm{auth}}_{\mathrm{FORS},i}^{\mathrm{fake}})$ (FORS subtrees $k=16$). Pseudo-signature construction: ${\sigma }_{\mathrm{FORS},i}^{\mathrm{fake}}=(s{k}_{\mathrm{FORS},i}^{\mathrm{fake}}\left[m\left[i\right]\right],{\mathrm{auth}}_{\mathrm{FORS},i}^{\mathrm{fake}},{\mathrm{ADRS}}_{\mathrm{FORS},i})$ (hash distribution calibrated to $|{\mu }_{\mathrm{fake}}-{\mu }_{\mathrm{real}}|\le 0.01$). Real signature generation for signer: Use real FORS private key $s{k}_{\mathrm{FORS},\xi \left[j\right]}=\mathrm{PRF}({\mathrm{PK}.\mathrm{seed}}_{\xi },{\mathrm{SK}.\mathrm{seed}}_{\xi },\mathrm{ADRS})$ ($j\in \{1,...,k·t\}$, $t=2^{\alpha }=256$) to generate a valid signature ${\sigma }_{\mathrm{FORS},\xi }$ for digest $md=H(cm \Vert I_{\xi ,t})$, generate a WOTS+ signature ${\sigma }_{\mathrm{WOTS}+}$ ($\mathrm{len}=67$ segments) to bind ${\sigma }_{\mathrm{FORS}}$, and extract the XMSS authentication path ${\mathrm{auth}}_{\mathrm{XMSS}}$ (subtree height $h^{\prime }=10$). Signature aggregation: Output the complete signature $\sigma =({\sigma }_{\mathrm{FORS}},{\sigma }_{\mathrm{WOTS}+},{\mathrm{auth}}_{\mathrm{XMSS}},{\mathrm{auth}}_{\mathrm{ring}},cm,I_{\xi ,t},r,t{k}_{\xi ,t},t,{\mathrm{Root}}_{\mathrm{ring}},Cre{d}_{RI{D}_i})$ and send M, $\sigma$, v, $cm$ to the LAG, which forwards to the BS.

In the verification and authorization phase, the BS executes multi-layer verification with consistent parameters. Ring legitimacy verification: Reconstruct Merkle root ${\mathrm{Root}}_{\mathrm{ring}}^{\prime }$ via $hp{k}_{\xi }$ and ${\mathrm{auth}}_{\mathrm{ring}}$ and check consistency with ${\mathrm{Root}}_{\mathrm{ring}}$. Credential validity verification: Verify $Cre{d}_{RI{D}_i}=H(RI{D}_i \Vert \mathrm{PK}.\mathrm{root} \Vert {\tau }_0)$ via the TA’s legitimate list, excluding revoked nodes. Signature component verification: Verify FORS/WOTS+/XMSS components (consistent with SPHINCS+ verification logic), ensuring no tampering. Link tag consistency verification: Check $I_{\xi ,t}=H(s{k}_{\mathrm{link},\xi ,t} \Vert hp{k}_{\xi } \Vert t \Vert t{k}_{\xi ,t} \Vert RI{D}_i)$, ensuring traceability. Authorization execution: If all verifications pass, notify LAG to authorize CS charging and record $I_{\xi ,t}$, t, $RI{D}_i$ for double-spending detection.

Step 4: Traceability and Revocation Phase (See Figure 9).

The BS monitors transaction records in real time: if a duplicate $I_{\xi ,t}$ is detected in the same t (double-spending) or malicious behavior is identified, it reports $\sigma$, $I_{\xi ,t}$, t, $RI{D}_i$ to the TA; the TA initiates collaborative decryption, requesting $KE{K}_2$ from the RN, reconstructing complete $KEK=KE{K}_1\oplus KE{K}_2$, decrypting the regional fragment of the $(I_{\mathrm{link}},pk,RID)$ mapping table (AES-256 decryption), and obtaining the association between $RI{D}_i$ and $p{k}_{EV,\xi }$ (TA cannot decrypt alone, protecting privacy). The TA executes revocation. It removes $RI{D}_i$ and $p{k}_{EV,\xi }$ from the legitimate list, adds them to the global blacklist, and generates revocation notice $Re{v}_{RI{D}_i}=H(RI{D}_i \Vert p{k}_{EV,\xi } \Vert \mathrm{Revocation}\mathrm{Timestamp})$. Global synchronization distributes the blacklist and $Re{v}_{RI{D}_i}$ to all LAG/BS entities. Subsequent transaction rejection is conducted: LAG/BS check $RI{D}_i$ and $p{k}_i$ against the blacklist first; if matched, they directly reject the transaction request, achieving rapid revocation of malicious nodes.

4. Security Analysis

To verify the security and effectiveness of the SPHINCS+-based linkable ring signature scheme proposed in this paper for V2G network scenarios, this section focuses on six core security properties—post-quantum security, unforgeability, anonymity, linkability, unframeability, and forward secrecy—based on the probabilistic polynomial time (PPT) adversary model and reduction method. Rigorous mathematical derivations are conducted in compliance with cryptographic security proof standards, relying on the cryptographic characteristics of SHA-256 and constraints of the quantum computing model, with all adversaries’ attack advantages satisfying $\mathrm{Adv}\left(𝒜\right)\le \mathrm{negl}\left(\lambda \right)$ ($\lambda =256$ is the security parameter).

4.1. Security Assumptions

For the rigor of subsequent proofs, the following necessary security assumptions are clarified, with each targeting specific adversary types and attack methods to lay the foundation for theorem proofs: SHA-256 collision resistance means that for any PPT adversary $𝒜$, there is no polynomial-time algorithm enabling $𝒜$ to find $x\ne x^{\prime }$ such that $H\left(x\right)=H\left(x^{\prime }\right)$, with a success probability $\mathrm{Pr}\left[\mathrm{Coll}\right(𝒜\left)\right]\le \mathrm{negl}\left(\lambda \right)$, which targets ${𝒜}_1$ (signature forgery) and ${𝒜}_3$ (transaction record tampering); SHA-256 preimage resistance is characterized by the fact that for any hash value $y\in {\{0,1\}}^{256}$, the probability that a PPT adversary $𝒜$ finds x such that $H\left(x\right)=y$ is $\mathrm{Pr}\left[\mathrm{Pre}\right(𝒜\left)\right]\le \mathrm{negl}\left(\lambda \right)$, aiming at ${𝒜}_2$ (linkable tag forgery) and ${𝒜}_4$ (quantum preimage search); the limitation of Grover’s algorithm is reflected in the upper bound of its acceleration for SHA-256 preimage search, being $O\left(\sqrt{N}\right)$ (where $N=2^{256}$), which cannot achieve exponential complexity reduction and exceeds the quantum computing capabilities of the current and foreseeable future, exclusively targeting ${𝒜}_4$ (quantum computing attacks); and SPHINCS+ component security implies that WOTS+ signatures satisfy one-time unforgeability, FORS signatures satisfy few-time unforgeability, and the authentication paths of XMSS trees satisfy unforgeability, with their security all reducible to the collision resistance and preimage resistance of SHA-256, addressing ${𝒜}_1$ (WOTS+/FORS signature forgery) and ${𝒜}_3$ (authentication path tampering).

4.2. Core Theorem Proofs

Each security theorem in this section takes a specific adversary as the attack subject, clarifies the adversary’s attack strategy and the scheme’s defense mechanism, and proves that the adversary’s advantage is negligible through reduction or random oracle simulation.

Lemma 1.

Provided that the single-use signing mechanism is validated and the reconstructed XMSS structure root ${\mathit{root}}^{*}$ matches the initial root, then the signature holds validity.

Proof. 

Suppose the signature uses the i-th WOTS+ key pair, and the index of the corresponding leaf node in the XMSS tree is i. The authentication path from the leaf node to the root contains intermediate nodes auth, and parent nodes are computed layer by layer using the hash function: $\mathrm{Node}\left(i\right)=H\left(\mathrm{child}\right(i) \Vert \mathrm{sibling}(i\left)\right)$. The root ${\mathrm{root}}^{*}$ is finally reconstructed. If ${\mathrm{root}}^{*}=\mathrm{root}$, it indicates that the WOTS+ public key indeed belongs to the XMSS tree. Combined with the successful verification of the WOTS+ signature, it can be confirmed that the signature is generated by a ring member; hence, the signature is valid. □

Theorem 1

(Anonymity). Anonymity is defined as the scheme satisfying strong anonymity under chosen-plaintext attacks, meaning a PPT adversary cannot distinguish signatures generated by two signers within the ring with a probability exceeding ${\displaystyle \frac{1}{2}}+\mathit{negl}\left(\lambda \right)$. The adversary ${𝒜}_1$ (compromised EV) holds its own private key ${\mathit{sk}}_{\xi }$ and transaction records (including real signatures ${\sigma }_{\mathit{real}}$), attempting to distinguish the signatures of other EVs in the ring by analyzing signature structures (such as authentication path length and hash distribution) or leveraging side-channel information (like signature generation power consumption and time) to undermine anonymity.

Proof. 

Define the anonymity experiment ${\mathrm{EXP}}_{\mathrm{ANON-CMA}}^{\lambda ,s}\left({𝒜}_1\right)$: the challenger generates system parameters $\mathrm{pp}=(H,H_{\mathrm{tree}},\omega ,\mathrm{len},k,\alpha ,h,d,n_{\mathrm{ring},\max },{\mathrm{PK}.\mathrm{seed}}_{\mathrm{rand}},{\tau }_{\mathrm{win}})$ and s key pairs $\left\{(p{k}_i,s{k}_i)\right\}$, sending pp and $PK=\{p{k}_1,\dots ,p{k}_s\}$ to ${𝒜}_1$; in the query phase, ${𝒜}_1$ adaptively queries the signature oracle $𝒪({\mathrm{sk}}_i,L_{pk},M)$ to obtain $\sigma$ containing pseudo-signatures, records query pairs $({\mathrm{sk}}_i,L_{pk},M,\sigma )$, and can also query the side-channel information oracle ${𝒪}_{\mathrm{side}}({\mathrm{sk}}_i,L_{pk},M)$ to obtain power consumption and time characteristic data during signature generation, with a total query count $q\le \mathrm{poly}\left(\lambda \right)$; in the challenge phase, ${𝒜}_1$ outputs $(L_{pk}^{*},M^{*},i_0^{*},i_1^{*})$ (requiring $p{k}_{i_0^{*}},p{k}_{i_1^{*}}\in L_{pk}^{*}$ and no queries to the corresponding oracles), the challenger randomly selects $b\in \{0,1\}$, generates ${\sigma }^{*}=\mathrm{Sign}({\mathrm{sk}}_{i_b^{*}},L_{pk}^{*},M^{*})$ (pseudo-signatures pass the KS test with $D\le 0.05$), and sends ${\sigma }^{*}$ and its corresponding side-channel characteristic data to ${𝒜}_1$; in the guess phase, ${𝒜}_1$ continues polynomial-time queries (excluding the two prohibited queries) and outputs the guessed bit $b^{*}$, with the experiment returning 1 if $b^{*}=b$ and 0 otherwise. The adversary’s advantage is defined as ${\mathrm{Adv}}_{\mathrm{ANON-CMA}}^{\lambda ,s}\left({𝒜}_1\right)=\left|\mathrm{Pr}[{\mathrm{EXP}}_{\mathrm{ANON-CMA}}^{\lambda ,s}\left({𝒜}_1\right)=1]-{\displaystyle \frac{1}{2}}\right|$.

Construct a simulator to simulate the random oracle of SHA-256 and side-channel characteristics, maintaining a query table $T=\left\{\right(x,H\left(x\right)\left)\right\}$, where x includes hash inputs such as cm and $I_{\xi ,t}$, and $H\left(x\right)$ is a uniform random value $\in {\{0,1\}}^{256}$, ensuring the same x corresponds to the same $H\left(x\right)$ and different x correspond to independent random values. For side-channel queries, generates random power consumption and time data consistent with the statistical characteristics of real signatures (with mean and variance differences $\le 0.01$). When generating ${\sigma }^{*}$, uses hash values from T for both pseudo-signatures of non-target members and real signatures of the target signer, with pseudo-signatures having an authentication path length of $\alpha =8$ and hash distribution calibrated to $|{\mu }_{\mathrm{fake}}-{\mu }_{\mathrm{real}}|\le 0.01$ and $|{\sigma }_{\mathrm{fake}}^2-{\sigma }_{\mathrm{real}}^2|\le 0.001$, maintaining complete structural consistency with real signatures. Due to the pseudorandomness of the random oracle and the indistinguishability of side-channel characteristics, the hash distributions and physical attributes of pseudo-signatures and real signatures are polynomially indistinguishable, meaning that for any PPT adversary ${𝒜}_1$, there exists a negligible function $\mathrm{negl}\left(\lambda \right)$ such that $\left|\mathrm{Pr}[{𝒜}_1\left({\sigma }_{\mathrm{real}}\right)=1]-\mathrm{Pr}[{𝒜}_1\left({\sigma }_{\mathrm{fake}}\right)=1]\right|\le \mathrm{negl}\left(\lambda \right)$. Let $\mathrm{Pr}[b^{*}=b]={\displaystyle \frac{1}{2}}+\delta$, then $\left|\delta \right|\le \mathrm{negl}\left(\lambda \right)$, so ${\mathrm{Adv}}_{\mathrm{ANON-CMA}}^{\lambda ,s}\left({𝒜}_1\right)=\left|\delta \right|\le \mathrm{negl}\left(\lambda \right)$, indicating that ${𝒜}_1$’s identity tracing attack is ineffective and the scheme satisfies strong anonymity. □

Theorem 2

(Unforgeability). Unforgeability is defined as the scheme satisfying existential unforgeability under adaptive chosen-message attacks, meaning a PPT adversary cannot generate valid signatures without holding the corresponding private key. The adversaries include ${𝒜}_1$ (compromised EV) attempting to forge the signatures of other EVs to frame legitimate users, and ${𝒜}_3$ (compromised Billing Server) attempting to tamper with transaction records (such as modifying $I_{\xi ,t}$ or σ) or collude with malicious LAGs to generate unauthorized valid signatures.

Proof. 

Define the unforgeability experiment ${\mathrm{EXP}}_{\mathrm{UF-CMA}}^{\lambda }\left(𝒜\right)$ (where $𝒜$ is ${𝒜}_1$ or ${𝒜}_3$): the challenger generates pp and s key pairs, sends pp and $PK$ to $𝒜$, and provides the signature oracle $\mathit{𝒪}({\mathrm{sk}}_i,L_{pk},M)$; in the query phase, $𝒜$ initiates $q\le \mathrm{poly}\left(\lambda \right)$ queries to obtain signatures $\sigma$, and ${𝒜}_3$ can also simulate tampering with transaction data during queries to test the scheme’s resistance; in the forgery phase, $𝒜$ outputs a forged tuple $(L_{pk}^{*},M^{*},{\sigma }^{*})$, with the experiment returning 1 if $\mathrm{Verify}(\mathrm{pp},L_{pk}^{*},M^{*},{\sigma }^{*})=\mathrm{True}$ and no query to $𝒪(.,L_{pk}^{*},M^{*})$, and 0 otherwise. The adversary’s advantage is defined as ${\mathrm{Adv}}_{\mathrm{UF-CMA}}^{\lambda }\left(𝒜\right)=\mathrm{Pr}[{\mathrm{EXP}}_{\mathrm{UF-CMA}}^{\lambda }\left(𝒜\right)=1]$.

Assuming there exists a PPT adversary $𝒜$ with ${\mathrm{Adv}}_{\mathrm{UF-CMA}}^{\lambda }\left(𝒜\right)=\epsilon >\mathrm{negl}\left(\lambda \right)$, construct a simulator to break the collision resistance of SHA-256 using $𝒜$’s forgery capability. selects a target ring member index $j\in [1,n]$, sets $y=H\left(z\right)$ (where z is an unknown preimage and aims to find z), replaces the XMSS tree root ${\mathrm{pk}.\mathrm{root}}_j$ of $p{k}_j$ with y, generates other public keys normally, and sends them to $𝒜$; for queries from $𝒜$ involving $p{k}_j$, simulates the XMSS root with y without requiring ${\mathrm{sk}}_j$ and generates pseudo-signatures through the random oracle to ensure structural consistency, even simulating the tampering behavior of ${𝒜}_3$ to maintain the validity of query responses. If $𝒜$ outputs a forged signature ${\sigma }^{*}$ containing $p{k}_j$, the authentication path ${\mathrm{auth}}^{*}$ of ${\sigma }^{*}$ must satisfy XMSS verification logic—hashing layer by layer from $H\left(P{K}_{\mathrm{WOTS}+}\right)$ to finally reconstruct ${\mathrm{pk}.\mathrm{root}}_j=y$. extracts intermediate nodes ${\mathrm{node}}_1,\dots ,{\mathrm{node}}_{h^{\prime }}$ (where $h^{\prime }=10$) from ${\mathrm{auth}}^{*}$ and computes ${\mathrm{root}}^{\prime }=H({\mathrm{node}}_{h^{\prime }}\Vert H(...H({\mathrm{node}}_2\Vert {\mathrm{node}}_1)...))$, and if ${\sigma }^{*}$ is valid, ${\mathrm{root}}^{\prime }=y=H\left(z\right)$, at which point $z={\mathrm{node}}_1\Vert {\mathrm{node}}_2\Vert \dots \Vert {\mathrm{node}}_{h^{\prime }}$, and the real ${\mathrm{pk}.\mathrm{root}}_j$ and ${\mathrm{root}}^{\prime }$ correspond to different paths but have the same hash value, meaning finds a collision of SHA-256. By the collision resistance of SHA-256, Pr[Coll()] ≤ negl(λ), and since the probability that $𝒜$ selects $p{k}_j$ as the forgery target is ${\displaystyle \frac{1}{n}}$ (where n is the ring size, polynomially bounded), we have $\epsilon =\mathrm{Pr}[{\mathrm{EXP}}_{\mathrm{UF-CMA}}^{\lambda }\left(𝒜\right)=1]\le n ·$ Pr[Coll()] $\le n·\mathrm{negl}\left(\lambda \right)=\mathrm{negl}\left(\lambda \right)$. Indicating that the forgery attacks by ${𝒜}_1$ and ${𝒜}_3$ have negligible advantages and the scheme satisfies unforgeability. □

Theorem 3

(Linkability). Linkability is defined as the scheme satisfying strong linkability, meaning no PPT adversary can misleadthe linking algorithm to incorrectly determine that signatures from different users are “linked”. The adversaries include ${𝒜}_1$ attempting to forge linkable tags $I_{\xi ,t}=I_{\eta ,t}$ of different EVs to mislead supervision, and ${𝒜}_2$ (malicious TA) attempting to tamper with encrypted mapping tables to forge associations between I and $pk$ for false linking, or collude with malicious BSs to modify tag records.

Proof. 

Define the linkability experiment ${\mathrm{EXP}}_{\mathrm{LINK}}^{\lambda ,s}\left({𝒜}_2\right)$: the challenger generates pp and s key pairs, sends pp and $PK$ to ${𝒜}_2$, and provides the signature oracle $𝒪$; ${𝒜}_2$ can simulate tampering with mapping tables or tag records during polynomial-time queries; after queries, ${𝒜}_2$ outputs two valid signatures $({\sigma }_1,{\sigma }_2)$ (with signers ${\mathrm{sk}}_{\xi }\ne {\mathrm{sk}}_{\eta }$), with the experiment returning 1 if $\mathrm{Link}({\sigma }_1,{\sigma }_2)=\mathrm{Linked}$ and 0 otherwise. The adversary’s advantage is defined as ${\mathrm{Adv}}_{\mathrm{LINK}}^{\lambda ,s}\left({𝒜}_2\right)=\mathrm{Pr}[{\mathrm{EXP}}_{\mathrm{LINK}}^{\lambda ,s}\left({𝒜}_2\right)=1]$.

Assume that there exist different users $U_{\xi }\ne U_{\eta }$ such that their linkable tags satisfy $I_{\xi ,t}=I_{\eta ,t}$, i.e., $H({\mathrm{sk}}_{\mathrm{link},\xi ,t} \Vert hp{k}_{\xi } \Vert t \Vert t{k}_{\xi })=H({\mathrm{sk}}_{\mathrm{link},\eta ,t} \Vert hp{k}_{\eta } \Vert t \Vert t{k}_{\eta })$. Since $U_{\xi }\ne U_{\eta }$, we have ${\mathrm{SK}.\mathrm{seed}}_{\xi }\ne {\mathrm{SK}.\mathrm{seed}}_{\eta }$, so ${\mathrm{sk}}_{\mathrm{link},\xi ,t}=H({\mathrm{sk}}_{\mathrm{link},\xi ,t-1} \Vert t \Vert H(P{K}_{\xi } \Vert {\tau }_t))\ne {\mathrm{sk}}_{\mathrm{link},\eta ,t}$, and $hp{k}_{\xi }=H\left(p{k}_{\xi }\right)\ne hp{k}_{\eta }$, $t{k}_{\xi }\ne t{k}_{\eta }$ (one-time random factor), leading to $({\mathrm{sk}}_{\mathrm{link},\xi ,t} \Vert hp{k}_{\xi } \Vert t \Vert t{k}_{\xi })\ne ({\mathrm{sk}}_{\mathrm{link},\eta ,t} \Vert hp{k}_{\eta } \Vert t \Vert t{k}_{\eta })$. This means two different inputs correspond to the same hash value, contradicting the collision resistance of SHA-256, so $\mathrm{Pr}[I_{\xi ,t}=I_{\eta ,t}]\le \mathrm{negl}\left(\lambda \right)$. For ${𝒜}_2$’s tampering attack, modifying mapping tables or tag records cannot change the inherent binding relationship between I and the private key, and the linking algorithm directly compares tag values rather than relying on external records, so the attack cannot mislead the linking result. Hence, ${\mathrm{Adv}}_{\mathrm{LINK}}^{\lambda ,s}\left({𝒜}_2\right)=\mathrm{Pr}[I_{\xi ,t}=I_{\eta ,t}]\le \mathrm{negl}\left(\lambda \right)$, indicating that the false link attacks by ${𝒜}_1$ and ${𝒜}_2$ have negligible advantages and the scheme satisfies strong linkability. □

Theorem 4

(Unframeability). Unframeability is defined as a PPT adversary being unable to forge signatures to frame innocent ring members, i.e., it cannot generate valid signatures containing the public keys of innocent members without their private keys. The adversary ${𝒜}_3$ (compromised Billing Server) attempts to forge valid signatures containing the public key $p{k}_{i^{*}}$ of an innocent EV to frame it for malicious transactions, possibly colluding with compromised CSs to fabricate charging records.

Proof. 

Define the unframeability experiment ${\mathrm{EXP}}_{\mathrm{FRAME}}^{\lambda ,s}\left({𝒜}_3\right)$: the challenger selects a member $i^{*}$, retains ${\mathrm{sk}}_{i^{*}}$, sends $PK$ to ${𝒜}_3$, and provides the signature oracle $𝒪$ (prohibiting access to ${\mathrm{sk}}_{i^{*}}$); ${𝒜}_3$ can collude with CSs to simulate fabricating transaction data during polynomial-time queries; after queries, ${𝒜}_3$ outputs $(L_{pk}^{*},M^{*},{\sigma }^{*})$ (with $p{k}_{i^{*}}\in L_{pk}^{*}$), with the experiment returning 1 if $\mathrm{Verify}(\mathrm{pp},L_{pk}^{*},M^{*},{\sigma }^{*})=\mathrm{True}$ and ${\sigma }^{*}$ is not generated by ${\mathrm{sk}}_{i^{*}}$, and 0 otherwise. The adversary’s advantage is defined as ${\mathrm{Adv}}_{\mathrm{FRAME}}^{\lambda ,s}\left({𝒜}_3\right)=\mathrm{Pr}[{\mathrm{EXP}}_{\mathrm{FRAME}}^{\lambda ,s}\left({𝒜}_3\right)=1]$.

A valid signature must satisfy the following two core conditions: linkable tag consistency $I^{*}=H({\mathrm{sk}}_{\mathrm{link},i^{*},t} \Vert hp{k}_{i^{*}} \Vert t \Vert t{k}^{*})$ and hash commitment consistency ${\mathrm{cm}}^{*}=H(r^{*} \Vert v^{*} \Vert hp{k}_{i^{*}} \Vert H\left(M^{*}\right))$. Since ${𝒜}_3$ does not hold ${\mathrm{sk}}_{i^{*}}$, it cannot compute ${\mathrm{sk}}_{\mathrm{link},i^{*},t}$ (dependent on the one-way update of ${\mathrm{sk}}_{i^{*}}$), so forging $I^{*}$ requires breaking the preimage resistance of SHA-256 (finding x such that $H\left(x\right)=I^{*}$) with a success probability $\le \mathrm{negl}\left(\lambda \right)$; similarly, forging ${\mathrm{cm}}^{*}$ requires finding $r^{*}$ such that $H(r^{*} \Vert v^{*} \Vert hp{k}_{i^{*}} \Vert H\left(M^{*}\right))={\mathrm{cm}}^{*}$, with a success probability also $\le \mathrm{negl}\left(\lambda \right)$. Colluding with CSs to fabricate transaction data cannot bypass the binding of $I^{*}$ and ${\mathrm{cm}}^{*}$ to the private key, so the forged signature cannot pass both consistency verifications. Thus, ${\mathrm{Adv}}_{\mathrm{FRAME}}^{\lambda ,s}\left({𝒜}_3\right)\le \mathrm{negl}\left(\lambda \right)+\mathrm{negl}\left(\lambda \right)=\mathrm{negl}\left(\lambda \right)$, indicating that ${𝒜}_3$’s framing attack has a negligible advantage and the scheme satisfies unframeability. □

Theorem 5

(Post-Quantum Security). Post-quantum security is defined as the scheme maintaining security under the quantum computing model, meaning a quantum PPT adversary cannot break the scheme with non-negligible probability. The adversary ${𝒜}_4$ (quantum external attacker) has quantum computing capabilities, attempting to crack number-theoretic problems through Shor’s algorithm or accelerate preimage search through Grover’s algorithm to obtain private keys and forge signatures, or launch quantum side-channel attacks against resource-constrained on-board terminals.

Proof. 

Propose the following two security assumptions: Assumption 1 (SHA-256 quantum preimage resistance) states that the probability a quantum PPT adversary ${𝒜}_4$ finds x such that $H\left(x\right)=y$ from y is $\le \mathrm{negl}\left(\lambda \right)$; Assumption 2 (limitation of Grover’s algorithm) states that the acceleration upper bound of Grover’s algorithm for SHA-256 preimage search is $O\left(\sqrt{N}\right)$ (where $N=2^{256}$), which cannot achieve exponential complexity reduction and exceeds the feasible boundary of quantum computing. The proof adopts the reduction method by contradiction: assuming there exists a quantum PPT adversary ${𝒜}_4$ that can break the scheme with non-negligible probability $\epsilon >\mathrm{negl}\left(\lambda \right)$, construct a simulator to break the preimage resistance of SHA-256 using ${𝒜}_4$.

first executes the public key generation process of SPHINCS+: It randomly generates PK.seed, iterates through the WOTS+ hash chain $y_i^j=F(\mathrm{PK}.\mathrm{seed},\mathrm{ADRS}(i,j),y_i^{j-1})$ (where F is the chain iteration function of SHA-256 and ADRS is the address parameter), generates $\mathrm{len}=67$ WOTS+ public key elements, obtains $\mathrm{PK}.\mathrm{root}=H_{\mathrm{tree}}(\mathrm{PK}.\mathrm{seed},\left\{y_i^{(\omega -1)}\right\})$ (with $\omega =16$) through XMSS tree hashing, and sends the public key $PK=(\mathrm{PK}.\mathrm{seed},\mathrm{PK}.\mathrm{root})$ and a randomly constructed ring $ℛ$ to ${𝒜}_4$. During the attack phase, ${𝒜}_4$ may launch quantum side-channel attacks to obtain physical characteristic information of on-board terminals, then outputs a forged signature $\sigma =({\sigma }_{\mathrm{FORS}},{\sigma }_{\mathrm{WOTS}+},\mathrm{auth},\mathrm{cm},I_{\xi ,t})$, where ${\sigma }_{\mathrm{FORS}}$ contains private key fragments and authentication paths of $k=16$ FORS subtrees, ${\sigma }_{\mathrm{WOTS}+}$ is the WOTS+ signature hash chain, and auth is the XMSS tree authentication path. extracts the i-th signature node ${\mathrm{sig}}_i=y_i^{m\left[i\right]}$ from ${\sigma }_{\mathrm{WOTS}+}$ (where $m\left[i\right]$ is the message segment value). According to the WOTS+ verification logic, if $\sigma$ is valid, $y_i^{(\omega -1)}$ (i.e., the i-th element of ${\mathrm{pk}}_{\mathrm{WOTS}+}$) must be obtained by iterating $\omega -1-m\left[i\right]$ times from ${\mathrm{sig}}_i$, i.e., $H^{\omega -1-m\left[i\right]}\left({\mathrm{sig}}_i\right)=y_i^{(\omega -1)}$, meaning ${𝒜}_4$ finds ${\mathrm{sig}}_i$ (the preimage of $y_i^{(\omega -1)}$), contradicting Assumption 1, so $\epsilon \le \mathrm{negl}\left(\lambda \right)$.

Further analysis of the feasibility of quantum attacks shows that although Shor’s algorithm can solve traditional number-theoretic problems in polynomial time, it is ineffective for SHA-256 preimage solving—the size of the SHA-256 preimage space is $2^{256}$, and even with Grover’s algorithm acceleration, the solving complexity is still $O\left(2^{128}\right)$, far exceeding the quantum computing capabilities of the current and foreseeable future (the computing power of existing quantum computers is less than $O\left(2^{50}\right)$). Quantum side-channel attacks are also ineffective due to the pure hash-based architecture of the scheme, which avoids complex cryptographic operations that are vulnerable to such attacks, and the one-way nature of hash functions prevents the adversary from deriving private keys from physical characteristics. Hence, the scheme satisfies post-quantum security and can resist quantum computing threats. □

Theorem 6

(Forward Secrecy). Forward secrecy is defined as if the linkable private key ${\mathit{sk}}_{\mathit{link},\xi ,t}$ is leaked, a PPT adversary cannot trace past transactions (time window $t^{\prime }<t$). The adversary ${𝒜}_1$’s linkable private key ${\mathit{sk}}_{\mathit{link},\xi ,T}$ is leaked, attempting to trace the historical transaction linkable tag $I_{\xi ,t^{\prime }}$ in the time window $t^{\prime }<T$, possibly colluding with malicious LAGs to obtain historical transaction records.

Proof. 

Define the forward secrecy experiment ${\mathrm{EXP}}_{\mathrm{FORWARD}}^{\lambda ,s}\left({𝒜}_1\right)$: the challenger generates $(\mathrm{pp},p{k}_{\xi },{\mathrm{sk}}_{\xi })$ for user $U_{\xi }$, provides the signature oracle for transactions in time windows $t=1,\dots ,T$, and leaks ${\mathrm{sk}}_{\mathrm{link},\xi ,T}$ (leaked private key); ${𝒜}_1$ can collude with LAGs to obtain historical transaction records during queries, then outputs the guessed linkable tag $I_{\xi ,t^{\prime }}^{\mathrm{guess}}$ for a past transaction ($t^{\prime }<T$); the experiment returns 1 if $I_{\xi ,t^{\prime }}^{\mathrm{guess}}=I_{\xi ,t^{\prime }}^{\mathrm{real}}$ and 0 otherwise. The adversary’s advantage is defined as ${\mathrm{Adv}}_{\mathrm{FORWARD}}^{\lambda ,s}\left({𝒜}_1\right)=\mathrm{Pr}[{\mathrm{EXP}}_{\mathrm{FORWARD}}^{\lambda ,s}\left({𝒜}_1\right)=1]$.

The linkable private key satisfies the one-way update mechanism ${\mathrm{sk}}_{\mathrm{link},\xi ,t}=H({\mathrm{sk}}_{\mathrm{link},\xi ,t-1} \Vert t \Vert H(P{K}_{\xi } \Vert {\tau }_t))$, so the leaked ${\mathrm{sk}}_{\mathrm{link},\xi ,T}$ cannot reverse-derive ${\mathrm{sk}}_{\mathrm{link},\xi ,t^{\prime }}$ ($t^{\prime }<T$), and $t{k}_{\xi ,t^{\prime }}$ is a one-time random factor that is deleted immediately after the transaction (not stored in EV/BS/LAG) and cannot be reconstructed even with historical records. Thus, ${𝒜}_1$ cannot obtain the complete input of $I_{\xi ,t^{\prime }}=H({\mathrm{sk}}_{\mathrm{link},\xi ,t^{\prime }} \Vert hp{k}_{\xi } \Vert t^{\prime } \Vert t{k}_{\xi ,t^{\prime }})$, and the probability of guessing $I_{\xi ,t^{\prime }}$ correctly is $\le {\displaystyle \frac{1}{2^{256}}}=\mathrm{negl}\left(\lambda \right)$. Colluding with LAGs to obtain historical records cannot supplement the missing one-time random factor or reverse-derive the historical linkable private key, so the attack remains ineffective. Hence, ${\mathrm{Adv}}_{\mathrm{FORWARD}}^{\lambda ,s}\left({𝒜}_1\right)\le \mathrm{negl}\left(\lambda \right)$, indicating that ${𝒜}_1$’s historical transaction tracing attack has a negligible advantage and the scheme satisfies forward secrecy. □

4.3. Formal Adversary Model

Four types of PPT adversaries are defined in this paper, clarifying their attack capabilities, goals, and advantage upper bounds, with all advantages derived through the above theorem proofs. Type 1: Compromised EV (${𝒜}_1$) is a probabilistic polynomial-time algorithm with a running time $\le \mathrm{poly}\left(\lambda \right)$, holding attack capabilities including $\{{\mathrm{sk}}_{\xi },{\mathrm{sk}}_{\mathrm{link},\xi ,t},\sigma ,I_{\xi ,t}\}$ and capable of initiating polynomial-time signature queries, colluding with other EVs or LAGs, and launching side-channel attacks, targeting forgery of signatures, tracing historical transactions, tampering with transaction amounts, and undermining anonymity, with an advantage upper bound $\mathrm{Adv}\left({𝒜}_1\right)\le max\{{\mathrm{Adv}}_{\mathrm{ANON}},{\mathrm{Adv}}_{\mathrm{UF}},{\mathrm{Adv}}_{\mathrm{LINK}},{\mathrm{Adv}}_{\mathrm{FORWARD}}\}\le \mathrm{negl}\left(\lambda \right)$. Type 2: Malicious TA (${𝒜}_2$) is a probabilistic polynomial-time algorithm with a running time $\le \mathrm{poly}\left(\lambda \right)$, holding attack capabilities including $\{\mathrm{pp},\mathrm{Encrypted}(I,pk,RID\left)\right\}$ and capable of rejecting registrations, maliciously revoking public keys, and tampering with encrypted mapping tables, targeting illegal acquisition of user privacy, disruption of network operation, and false linking of transactions, with an advantage upper bound $\mathrm{Adv}\left({𝒜}_2\right)\le {\mathrm{Adv}}_{\mathrm{LINK}}\le \mathrm{negl}\left(\lambda \right)$. Type 3: Compromised Billing Server (${𝒜}_3$) is a probabilistic polynomial-time algorithm with a running time $\le \mathrm{poly}\left(\lambda \right)$, holding attack capabilities including $\{{\sigma }_{\mathrm{all}},I_{\mathrm{all}},v_{\mathrm{all}}\}$ and capable of tampering with transaction records, forging alerts, and colluding with CSs/LAGs, targeting tampering with amounts, framing legitimate EVs, and bypassing transaction verification, with an advantage upper bound $\mathrm{Adv}\left({𝒜}_3\right)\le max\{{\mathrm{Adv}}_{\mathrm{UF}},{\mathrm{Adv}}_{\mathrm{FRAME}}\}\le \mathrm{negl}\left(\lambda \right)$. Type 4: Quantum External Adversary (${𝒜}_4$) is a quantum probabilistic polynomial-time algorithm with a running time $\le \mathrm{poly}\left(\lambda \right)$, having quantum computing capabilities and capable of accelerating preimage search, cracking number-theoretic problems, and launching quantum side-channel attacks, targeting acquisition of private keys, forging signatures, and undermining post-quantum security, with an advantage upper bound $\mathrm{Adv}\left({𝒜}_4\right)\le {\mathrm{Adv}}_{\mathrm{PQ}}\le \mathrm{negl}\left(\lambda \right)$.

4.4. Risk Analysis

Based on the inherent limitations of the centralized model (with TA as the core) and V2G-scenario-specific threats, the effectiveness of risk mitigation measures is verified through mathematical derivation. For the single point of failure risk, which describes the system paralysis caused by TA failure with an occurrence probability of $p_{\mathrm{fault}}$, the mitigation measure is to deploy k backup nodes and adopt the Byzantine Fault Tolerance (BFT) protocol, with the mathematical verification showing that the fault switching success rate of the BFT protocol is $1-p_{\mathrm{fault}}^k$, and taking $k=3$ and $p_{\mathrm{fault}}\le \mathrm{negl}\left(\lambda \right)$, we obtain $1-p_{\mathrm{fault}}^3\ge 1-\mathrm{negl}\left(\lambda \right)$, ensuring that the system remains available even if a single TA node fails. For the malicious TA risk, which describes the TA decrypting the mapping table alone to leak user privacy with a success probability of $p_{\mathrm{decrypt}}$, the mitigation measure is key shard storage $KEK=KE{K}_1\oplus KE{K}_2$ requiring two-party collaborative decryption (TA and a trusted third party), with the mathematical verification showing that the success probability of the TA decrypting alone is $p_{\mathrm{decrypt}}=\mathrm{Pr}[KE{K}_1=KEK\oplus KE{K}_2]={\displaystyle \frac{1}{2^{256}}}=\mathrm{negl}\left(\lambda \right)$, preventing privacy leakage from malicious TA behavior. For the mapping table leakage risk, which describes the batch privacy leakage caused by mapping table leakage with an impact scope of S, the mitigation measure is regional shard storage and regular key updates (updating $KEK$ every T time windows), with the mathematical verification showing that the impact scope of a single leakage is $S\le {\displaystyle \frac{N}{n_{\mathrm{shard}}}}$ (where N is the total number of users and $n_{\mathrm{shard}}=100$ is the number of shards), and the privacy leakage probability for each user is $\le \mathrm{negl}\left(\lambda \right)$ due to the one-time random factor in linkable tags. For the side-channel attack risk on on-board terminals, the mitigation measure is to optimize the signature generation process with constant-time hash operations and power consumption flattening technology, with the mathematical verification showing that the distinguishability of power consumption characteristics between different signatures is $\le 0.01$, making the success probability of side-channel attacks $\le \mathrm{negl}\left(\lambda \right)$.

5. Performance Analysis

To systematically verify the practical value of the SPHINCS+-based linkable ring signature scheme in V2G networks, this section conducts a comprehensive analysis from three dimensions—computational overhead, security attribute adaptability, and scenario scalability—combining theoretical derivation and experimental data. It also performs quantitative comparisons with existing mainstream schemes (AZALEA [52], BCE-PPDS [47], Emularis [9], LK-TRS [51], CL-LRS [44], and PQ-ATL [10]), focusing on verifying the scheme’s adaptability in scenarios such as dynamic ring size, high-frequency transactions, and post-quantum security.

Performance Evaluation

Performance evaluation is guided by the core requirements of V2G networks, defining key evaluation indicators and parameter definitions, while standardizing the experimental environment and basic data acquisition methods to ensure the objectivity and reproducibility of the evaluation. The experimental environment is configured as follows: the operating system adopts Windows 10 Professional 64-bit version, the experimental code is developed based on Python 3.9, relying on open-source libraries such as cryptography 39.0.1 and hashlib to implement the core algorithms of SPHINCS+ and the comparison schemes; the hardware environment is uniformly set to an Intel Core i7-10700K processor, 32GB DDR4 3200 MHz memory, and 512 GB NVMe solid-state drive to eliminate interference from hardware differences on experimental results.

The evaluation indicators include computational overhead (key generation time Keygen, signature generation time Sign, and signature verification time Verify), communication overhead (transmission volume of signatures and related data), scalability (variation trends of overhead with ring size n and number of accounts m), completeness of security attributes (post-quantum security, anonymity, etc.), and state-dependence characteristic (affecting key management complexity).

Referring to SPHINCS+ standard specifications and actual V2G scenarios, unified experimental parameters are set as follows: for basic operation time, the SHA-256 hash operation time $T_h$ and the hash function mapping latencies to group $\mathbb{G}$ (denoted as $T_{hz}$ and $T_{hg}$) are all obtained through actual operation tests in the aforementioned experimental environment using Python code—an independent test script is developed to execute the corresponding operations 1000 times, with the average value calculated after removing extreme values to eliminate random errors, finally measuring $T_h\approx 0.1\mu \mathrm{s}$, $T_{hz}\approx 0.2\mathrm{ms}$, $T_{hg}\approx 1.5\mathrm{ms}$, the matrix multiplication time $T_M\approx 1\mathrm{ms}$, and the elliptic curve P-256 point multiplication time $T_{exp}\approx 1\mathrm{ms}$; for core SPHINCS+ parameters, the number of FORS subtrees $k=16$, the number of leaves per FORS subtree $t=256$, the number of WOTS+ segments $\mathrm{len}=67$, the XMSS subtree height $h^{\prime }=10$, the FORS subtree height $\alpha =8$, and the WOTS+ window size $\omega =16$, ensuring full compatibility with the SPHINCS+ standard algorithm; and for scenario- and security-related parameters, the ring size n ranges from 1 to 1024, the number of accounts m is set to four typical values, $3,5,10,$ and 20, the security parameter $\lambda =256$ (thus, the hash space size satisfies ${log}_{2}N=256$), the group element length $\left|\mathbb{G}\right|=|{\mathbb{G}}_1|=512\mathrm{bit}$, and the finite field element length $|{\mathbb{Z}}_q|=|{\mathbb{Z}}_p|=256\mathrm{bit}$. These parameter settings are consistent with the actual scenario requirements of large-scale EV access and high-frequency transactions in V2G networks.

The following six mainstream schemes are selected for comparison in this study: AZALEA [52] is built on lattice cryptography and zero-knowledge proofs, Emularis [9] optimizes performance by integrating hash operations and group operations, LK-TRS [51] is implemented with elliptic curve operations as the core, PQ-ATL [10] is designed based on lattice-based operations, CL-LRS [44] is constructed by combining hash chains and post-quantum signature components, and BCE-PPDS [47] relies on matrix and bilinear pairing operations to support its functions. Through multi-dimensional horizontal comparison with these six schemes, the comprehensive technical advantages of the proposed scheme in terms of security features, computational efficiency, and scenario adaptability are further highlighted.

Based on the publicly available computational and communication overhead formulas of each scheme (as shown in

Table 6. Computational and communication overhead formulas of various schemes.

Scheme	Sign	Verify	Keygen	Communication Overhead
AZALEA [52]	$T_{{\mathrm{H}}_1}+T_{\mathrm{Mat-vec-mul1}}+T_{\mathrm{vec-r-gen}}+2\times T_{\mathrm{Mat-vec-mul2}}+T_{\mathrm{vec-add}}+T_{\mathrm{int-vec-mul}}+T_{\mathrm{TAcc}}+T_{\mathrm{bin-sum}}+T_{\mathrm{gen-Proof}}+T_{\mathrm{Rounding}}$	$T_{\mathrm{Ver}}+T_{{\mathrm{H}}_1}$	$T_{\mathrm{Mat-A-gen}}+T_{\mathrm{vec-s-sumgen}}+T_{\mathrm{Mat-vec-mul1}}+T_{\mathrm{Mat-B-gen}}+T_{\mathrm{Mat-mul}}+T_{\mathrm{Mat-add}}+T_{\mathrm{bin-sum}}+T_{\mathrm{Rounding}}$	$\left|\theta \right|+|c_1|+|c_2|+|L|=\kappa \left(d\right|{\mathbb{Z}}_q|+|\mathbb{G}\left|\right)+nm|{\mathbb{Z}}_q|+nl|{\mathbb{Z}}_q|+n|{\mathbb{Z}}_p|$
Emularis [9]	$(2m+6n+2{log}_{2}n-2)T_{exp}+({log}_{2}n+1)T_{\mathrm{hz}}+mn{T}_{\mathrm{hg}}$	$(m+2{log}_{2}n+n+3)T_{exp}+({log}_{2}n+2)T_{\mathrm{hz}}+mn{T}_{\mathrm{hg}}$	$(2m+6n+2{log}_{2}n-2)T_{exp}+({log}_{2}n+1)T_{\mathrm{hz}}+mn{T}_{\mathrm{hg}}$	$(2m+2)|{\mathbb{Z}}_q|+(3m+2logn)|\mathbb{G}|$
LK-TRS [51]	$(5k+32)T_{exp}+9T_{\mathrm{pair}}+(4k+47)T_{\mathrm{mul}}$	$(5k+n+37)T_{exp}+9T_{\mathrm{pair}}+(2k+8)T_{\mathrm{mul}}$	$T_{exp}$	$5k\tau +9\tau +|{\mathbb{Z}}_q|$ (take $\tau =256$ bit)
PQ-ATL [10]	$r{T}_{exp-pq}+M{T}_{\mathrm{hash}}$	$r{T}_{exp-pq}+M{T}_{\mathrm{hash}}$	$T_{exp-pq}+T_{\mathrm{poly}}$	$6n+800$ (unit: bit)
CL-LRS [44]	$MN{T}_{\mathrm{hash}}+K{T}_{exp-lat}+T_{\mathrm{gauss}}$	$M{T}_{\mathrm{hash}}+K{T}_{exp-lat}+T_{\mathrm{spk}}$	$T_{\mathrm{trap}}+T_{exp-lat}$	$2\lambda /8+M/8+K\left((m+m_1)d{log}_{2}q/8+{log}_{2}N·2\lambda /8+\lambda /8\right)+(M-K)\lambda /8+(m+m_1){log}_{2}q/8$ (take $M=K=10$, $m_1=2$)
BCE-PPDS [47]	$8T_{\mathrm{M}}+(n+2)T_{\mathrm{A}}$ (take $T_{\mathrm{A}}=0.5$ ms)	$T_{\mathrm{M}}+2T_{\mathrm{P}}$ (take $T_{\mathrm{P}}=2$ ms)	$4n{T}_{\mathrm{M}}+n{T}_{\mathrm{H}}$ (take $T_{\mathrm{H}}=0.1$ ms)	$3|{\mathbb{G}}_1|+|{\mathbb{Z}}_q^{*}|$
Ours	$\left[m·T_{hz}+n{log}_{2}n·T_h+nk\alpha ·T_h+\mathrm{len}\omega ·T_h+h^{\prime }d·T_h+t·T_{hz}+{\tau }_t·T_{hz}+3·T_h\right]$	$\left[nlogm·T_{hz}+{log}_{2}n·T_h+nk\alpha ·T_h+\mathrm{len}\omega ·T_h+h^{\prime }d·T_h+t·T_{hz}+2·T_h+T_{hg}\right]$	$\left[m·\left(\mathrm{len}\omega ·T_h(1+2^{h^{\prime }})+{\tau }_0·T_{hz}+2·T_h\right)\right]$	$kn(1+\alpha )+\mathrm{len}n+h^{\prime }n+n{log}_{2}N+5n+4$

), a detailed analysis of efficiency discrepancies is conducted from the perspectives of operation primitive types, scale sensitivity, and transmission volume.

For the key generation phase with typical V2G scenario parameters $n=1024$ and $m=20$, the computational latency of each scheme is derived by strictly substituting parameters into the formulas in Table 6. AZALEA’s key generation relies on high-complexity primitives such as matrix operations ($T_{\mathrm{Mat}}$) and vector sampling ($T_{\mathrm{vec-sam}}$), with the computational complexity strongly correlated with the ring scale n; due to the linear expansion of matrix dimensions with n (consistent with the characteristics of lattice-based cryptosystems), substituting $n=1024$ into the formula results in a total latency of approximately $1000\mathrm{ms}$. Emularis’s key generation formula is defined as $(2m+6n+2{log}_{2}n-2)T_{exp}+({log}_{2}n+1)T_{\mathrm{hz}}+mn{T}_{\mathrm{hg}}$; substituting $m=20$, $n=1024$ (${log}_{2}1024=10$), $T_{exp}=1.5\mathrm{ms}$, $T_{\mathrm{hz}}=0.2\mathrm{ms}$, and $T_{\mathrm{hg}}=1.5\mathrm{ms}$, the total latency is calculated as $(40+6144+20-2)\times 1.5+(10+1)\times 0.2+20\times 1024\times 1.5=6182\times 1.5+2.2+\mathrm{30,720}=9273+2.2+\mathrm{30,720}=\mathrm{40,000.2}\mathrm{ms}$, and the $mn{T}_{\mathrm{hg}}$ term exhibits linear growth with the product of m and n, leading to pronounced scale sensitivity in large-scale V2G deployments. LK-TRS’s key generation solely depends on the elliptic curve point multiplication operation $T_{exp}$; despite the simplicity of its operational primitive set, the inherent high latency of $T_{exp}$ results in a total latency of $1024\times 1=1024\mathrm{ms}$ at $n=1024$, showing linear growth with n. PQ-ATL’s key generation is based on post-quantum primitives including lattice-based operations ($T_{exp-pq}$) and polynomial operations ($T_{\mathrm{poly}}$), with parameters fixed during key generation (independent of n); substituting typical values $T_{exp-pq}=80\mathrm{ms}$ and $T_{\mathrm{poly}}=20\mathrm{ms}$, the total latency is $100\mathrm{ms}$. CL-LRS’s key generation involves hash chain construction ($T_{\mathrm{trap}}$) and exponential operations ($T_{exp-lat}$); the hash chain length scales logarithmically with n, while exponential operations scale linearly with n, resulting in a total latency of $200\mathrm{ms}+800\mathrm{ms}=1000\mathrm{ms}$ at $n=1024$. BCE-PPDS’s key generation formula is $4n{T}_{\mathrm{M}}+n{T}_{\mathrm{H}}$; substituting $n=1024$, $T_{\mathrm{M}}=1\mathrm{ms}$, $T_{\mathrm{H}}=0.1\mathrm{ms}$, the total latency is $4\times 1024\times 1+1024\times 0.1=4096+102.4=4198.4\mathrm{ms}$, and the $4n$ term reflects linear scale sensitivity. In contrast, the proposed scheme’s key generation exclusively relies on low-latency hash operations ($T_h$), with fixed parameters derived from SPHINCS+; substituting into the formula $\left[m·\left(\mathrm{len}\omega ·T_h(1+2^{h^{\prime }})+{\tau }_0·T_{hz}+2·T_h\right)\right]$, the step-by-step calculation shows $\mathrm{len}\omega ·T_h=67\times 16\times 0.1\mathsf{\mu }\mathrm{s}=107.2\mathsf{\mu }\mathrm{s}$, $1+2^{h^{\prime }}=1+2^{10}=1025$, $107.2\times 1025=\mathrm{109,880}\mathsf{\mu }\mathrm{s}=109.88\mathrm{ms}$, ${\tau }_0·T_{hz}+2·T_h=0.2\mathrm{ms}+0.2\mathrm{ms}=0.4\mathrm{ms}$, the sum inside the brackets is $109.88+0.4=110.28\mathrm{ms}$, and the final latency is $20\times 110.28=2205.6\mathrm{ms}$. Notably, the formula contains no terms related to ring scale n, resulting in scale-insensitive (constant-complexity) key generation, which makes it highly suitable for batch registration scenarios of Electric Vehicles in large-scale V2G networks.

For the signature generation phase with typical parameters $n=1024$ and $m=3$, AZALEA’s signature generation requires multiple rounds of matrix operations ($T_{\mathrm{Mat-vec-mul}}$) and zero-knowledge proof generation ($T_{\mathrm{gen-Proof}}$), and the high-complexity operations result in a total latency of approximately $1500\mathrm{ms}$, exceeding the real-time requirement for V2G charging requests (latency $<1\mathrm{s}$). Emularis’s signature generation formula is consistent with its key generation formula; substituting $m=3$, $n=1024$ (${log}_{2}1024=10$), $T_{exp}=1.5\mathrm{ms}$, $T_{\mathrm{hz}}=0.2\mathrm{ms}$, and $T_{\mathrm{hg}}=1.5\mathrm{ms}$, the total latency is calculated as $(6+6144+20-2)\times 1.5+(10+1)\times 0.2+3\times 1024\times 1.5=6168\times 1.5+2.2+4608=9252+2.2+4608=\mathrm{13,862.2}\mathrm{ms}$, which exhibits linear growth with the ring scale n. LK-TRS relies on the formula $(5k+32)T_{exp}+9T_{\mathrm{pair}}+(4k+47)T_{\mathrm{mul}}$; substituting $k=20$, $T_{exp}=1.5\mathrm{ms}$, $T_{\mathrm{pair}}=10\mathrm{ms}$, and $T_{\mathrm{mul}}=0.5\mathrm{ms}$, the total latency is $(100+32)\times 1.5+9\times 10+(80+47)\times 0.5=132\times 1.5+90+63.5=198+90+63.5=351.5\mathrm{ms}$. PQ-ATL’s signature generation formula is $r{T}_{exp-pq}+M{T}_{\mathrm{hash}}$; substituting $r=5$, $T_{exp-pq}=400\mathrm{ms}$, $M=10$, and $T_{\mathrm{hash}}=0.1\mathrm{ms}$, the total latency is $5\times 400+10\times 0.1=2000.1\mathrm{ms}$. CL-LRS achieves a latency of $50\mathrm{ms}$ through lightweight hash operations but lacks post-quantum security, failing to meet long-term security requirements. BCE-PPDS’s signature generation formula is $8T_{\mathrm{M}}+(n+2)T_{\mathrm{A}}$; substituting $T_{\mathrm{M}}=1\mathrm{ms}$ and $T_{\mathrm{A}}=0.5\mathrm{ms}$, the total latency is $8\times 1+(1024+2)\times 0.5=8+513=521\mathrm{ms}$, which also lacks post-quantum security. The proposed scheme adopts a “real signature + fake signature simulation” mechanism, with the signature generation formula $\left[m·T_{hz}+n{log}_{2}n·T_h+nk\alpha ·T_h+\mathrm{len}\omega ·T_h+h^{\prime }d·T_h+t·T_{hz}+{\tau }_t·T_{hz}+3·T_h\right]$; substituting the parameters, the step-by-step calculation gives $3\times 0.2=0.6\mathrm{ms}$, $1024\times 10\times 0.1\mathsf{\mu }\mathrm{s}=1.024\mathrm{ms}$, $1024\times 16\times 8\times 0.1\mathsf{\mu }\mathrm{s}=13.1072\mathrm{ms}$, $67\times 16\times 0.1\mathsf{\mu }\mathrm{s}=0.1072\mathrm{ms}$, $10\times 4\times 0.1\mathsf{\mu }\mathrm{s}=0.004\mathrm{ms}$, $256\times 0.2=51.2\mathrm{ms}$, ${\tau }_t·T_{hz}=0.2\mathrm{ms}$, $3\times 0.1\mathsf{\mu }\mathrm{s}=0.0003\mathrm{ms}$, and the total latency is the sum of these terms: $0.6+1.024+13.1072+0.1072+0.004+51.2+0.2+0.0003=66.2427\mathrm{ms}$. The scheme’s signature generation overhead is dominated by hash operations, and the n-related term is $n{log}_{2}n·T_h$ (sublinear growth), ensuring stable performance even with ring size expansion, which fully meets the low-latency requirements of Electric Vehicle (EV) charging requests.

For the signature verification phase, also with $n=1024$ and $m=3$ as benchmarks, AZALEA’s verification formula is $T_{\mathrm{Ver}}+T_{{\mathrm{H}}_1}$, resulting in the fastest latency of approximately $4.6\mathrm{ms}$, but this comes at the cost of high overhead in the signature phase and lacks a revocability mechanism. Emularis’s verification formula is $(m+2{log}_{2}n+n+3)T_{exp}+({log}_{2}n+2)T_{\mathrm{hz}}+mn{T}_{\mathrm{hg}}$; substituting $T_{exp}=3\mathrm{ms}$, $T_{\mathrm{hz}}=0.2\mathrm{ms}$, and $T_{\mathrm{hg}}=1.5\mathrm{ms}$, the total latency is $(3+20+1024+3)\times 3+(10+2)\times 0.2+3\times 1024\times 1.5=1050\times 3+2.4+4608=3150+2.4+4608=7760.4\mathrm{ms}$, which is prone to causing processing bottlenecks for Local Aggregators (LAGs) and Billing Servers (BSs) in long-term high-concurrency scenarios. LK-TRS’s verification formula is $(5k+n+37)T_{exp}+9T_{\mathrm{pair}}+(2k+8)T_{\mathrm{mul}}$; substituting $k=20$, $T_{exp}=1.5\mathrm{ms}$, $T_{\mathrm{pair}}=10\mathrm{ms}$, and $T_{\mathrm{mul}}=0.5\mathrm{ms}$, the total latency is $(100+1024+37)\times 1.5+9\times 10+(40+8)\times 0.5=1161\times 1.5+90+24=1741.5+90+24=1855.5\mathrm{ms}$, failing to meet the requirements of high-frequency transaction scenarios. PQ-ATL’s verification latency is consistent with its signature generation latency, approximately $2000.1\mathrm{ms}$, due to the high complexity of lattice-based operations. CL-LRS relies on hash chain reconstruction and lattice proof verification, resulting in a total latency of approximately $1000\mathrm{ms}$, which is inefficient for high-frequency transactions. BCE-PPDS’s verification formula is $T_{\mathrm{M}}+2T_{\mathrm{P}}$; substituting $T_{\mathrm{M}}=1\mathrm{ms}$ and $T_{\mathrm{P}}=2\mathrm{ms}$, the total latency is $1+4=5\mathrm{ms}$, but it lacks post-quantum security and cannot resist quantum computing threats. The proposed scheme’s verification requires reconstructing the FORS root node and XMSS path, with the formula $\left[nlogm·T_{hz}+{log}_{2}n·T_h+nk\alpha ·T_h+\mathrm{len}\omega ·T_h+h^{\prime }d·T_h+t·T_{hz}+2·T_h+T_{hg}\right]$; substituting the parameters, the step-by-step calculation shows $1024\times {log}_{2}3\times 0.2\mathrm{ms}\approx 1024\times 1.58\times 0.2=323.072\mathrm{ms}$, $10\times 0.1\mathsf{\mu }\mathrm{s}=0.001\mathrm{ms}$, $1024\times 16\times 8\times 0.1\mathsf{\mu }\mathrm{s}=13.1072\mathrm{ms}$, $67\times 16\times 0.1\mathsf{\mu }\mathrm{s}=0.1072\mathrm{ms}$, $10\times 4\times 0.1\mathsf{\mu }\mathrm{s}=0.004\mathrm{ms}$, $256\times 0.2=51.2\mathrm{ms}$, $2\times 0.1\mathsf{\mu }\mathrm{s}=0.0002\mathrm{ms}$, $T_{hg}=1.5\mathrm{ms}$, and the total latency is $323.072+0.001+13.1072+0.1072+0.004+51.2+0.0002+1.5=389.0916\mathrm{ms}$. Although the theoretical latency is higher than that of AZALEA and BCE-PPDS, the proposed scheme supports batch verification—when verifying 100 transactions in batches, the average latency per transaction is $389.0916\mathrm{ms}/100\approx 3.89\mathrm{ms}$—and LAGs and BSs can further reduce the verification latency to less than $10\mathrm{ms}$ through parallel hash operations, fully adapting to the high-frequency transaction scenarios of V2G networks.

For the communication overhead, with $n=1024$ and $m=3$ as benchmarks, AZALEA’s communication overhead formula is $\left|\theta \right|+|c_1|+|c_2|+|L|=\kappa \left(d\right|{\mathbb{Z}}_q|+|\mathbb{G}\left|\right)+nm|{\mathbb{Z}}_q|+nl|{\mathbb{Z}}_q|+n|{\mathbb{Z}}_p|$; substituting the parameters, the total overhead is $2\times (3\times 256+512)+1024\times 3\times 256+1024\times 16\times 256+1024\times 256=3072+\mathrm{786,432}+\mathrm{4,194,304}+\mathrm{262,144}=\mathrm{4,955,952}\mathrm{bit}\approx 619.49\mathrm{KB}$, which exhibits linear explosion with the ring size n, leading to severe bandwidth pressure in large-scale scenarios. Emularis’s communication overhead is $(2m+2)|{\mathbb{Z}}_q|+(3m+2logn)|\mathbb{G}|$; substituting $m=3$, $n=1024$, $|{\mathbb{Z}}_q|=256\mathrm{bit}$, and $\left|\mathbb{G}\right|=512\mathrm{bit}$, the total overhead is $(6+2)\times 256+(9+20)\times 512=8\times 256+29\times 512=2048+\mathrm{14,848}=\mathrm{16,896}\mathrm{bit}\approx 2.112\mathrm{KB}$, but it lacks post-quantum security. LK-TRS’s communication overhead is $5k\tau +9\tau +|{\mathbb{Z}}_q|$; substituting $k=20$, $\tau =256\mathrm{bit}$, and $|{\mathbb{Z}}_q|=256\mathrm{bit}$, the total overhead is $5\times 20\times 256+9\times 256+256=\mathrm{25,600}+2304+256=\mathrm{28,160}\mathrm{bit}\approx 3.52\mathrm{KB}$, which also lacks post-quantum security. PQ-ATL’s communication overhead formula is $6n+800$; substituting $n=1024$, the total overhead is $6\times 1024+800=6944\mathrm{bit}\approx 0.868\mathrm{KB}$, but it does not support revocability. CL-LRS’s communication overhead is $2\lambda /8+M/8+K\left((m+m_1)d{log}_{2}q/8+{log}_{2}N·2\lambda /8+\lambda /8\right)+(M-K)\lambda /8+(m+m_1){log}_{2}q/8$; substituting the parameters, the total overhead is $2\times 256/8+10/8+10\times \left((3+2)\times 4\times 256/8+256\times 2\times 256/8+256/8\right)+(10-10)\times 256/8+(3+2)\times 256/8=64+1.25+10\times (640+\mathrm{16,384}+32)+0+160=65.25+\mathrm{170,560}+160=\mathrm{170,785.25}\mathrm{bit}\approx 21.35\mathrm{KB}$, but it does not achieve a stateless design. BCE-PPDS’s communication overhead is $3|{\mathbb{G}}_1|+|{\mathbb{Z}}_q^{*}|$; substituting $|{\mathbb{G}}_1|=512\mathrm{bit}$ and $|{\mathbb{Z}}_q^{*}|=256\mathrm{bit}$, the total overhead is $3\times 512+256=1536+256=1792\mathrm{bit}\approx 0.224\mathrm{KB}$, which is the lowest among all schemes but lacks post-quantum security. The proposed scheme’s communication overhead formula is $kn(1+\alpha )+\mathrm{len}n+h^{\prime }n+n{log}_{2}N+5n+4$; substituting the parameters, the step-by-step calculation gives $16\times 1024\times 9=\mathrm{147,456}\mathrm{bit}$, $67\times 1024=\mathrm{68,576}\mathrm{bit}$, $10\times 1024=\mathrm{10,240}\mathrm{bit}$, $1024\times 256=\mathrm{262,144}\mathrm{bit}$, $5\times 1024=5120\mathrm{bit}$, constant term $4\mathrm{bit}$, and the total overhead is $\mathrm{147,456}+\mathrm{68,576}+\mathrm{10,240}+\mathrm{262,144}+5120+4=\mathrm{493,540}\mathrm{bit}\approx 61.69\mathrm{KB}$. Although the absolute value of the communication overhead is higher than that of other schemes, it exhibits sublinear growth with the ring size n—when $n=4096$, the communication overhead is $16\times 4096\times 9+67\times 4096+10\times 4096+4096\times 256+5\times 4096+4=\mathrm{1,974,148}\mathrm{bit}\approx 246.77\mathrm{KB}$, which is only four times that of $n=1024$—while AZALEA’s communication overhead increases to $19.82\mathrm{MB}$ (40 times growth) when $n=4096$, showing significant scale scalability advantages. Moreover, V2G networks typically have sufficient bandwidth resources ($\ge 10\mathrm{Mbps}$), and the transmission time of $61.69\mathrm{KB}$ is only $493.54\mu \mathrm{s}$, which will not cause bandwidth bottlenecks.

In the cryptographic security support system for Vehicle-to-Grid (V2G) networks, a scheme must simultaneously satisfy the following four core dimensions: long-term security (post-quantum resistance), basic privacy–security properties (anonymity, linkability, revocability), deployment adaptability (state management), and rigorous security reduction. Existing typical schemes (AZALEA, BCE-PPDS, Emularis, LK-TRS, CL-LRS, PQ-ATL) have significant limitations in the configuration and implementation logic of these dimensions. In contrast, our scheme, based on the “pure hash-based” architecture of SPHINCS+, achieves collaborative optimization and improved rigor of security properties, providing more adaptive cryptographic support for V2G networks (as shown in

Table 7. Comparison of security properties across schemes.

Scheme	Post-Quantum Security	Anony Mity	Linka Bility	Unforgea Bility	Non- Frameability	Stateless Ness	Revoca Bility
AZALEA [52]	Yes	Yes	Yes	Yes	Yes	No	No
Emularis [9]	No	Yes	Yes	Yes	Yes	No	No
BCE-PPDS [47]	No	Yes	Yes	Yes	Yes	No	No
CL-LRS [44]	Yes	Yes	Yes	Yes	Yes	No	No
LK-TRS [51]	No	Yes	Yes	Yes	Yes	No	Yes
PQ-ATL [10]	Yes	Yes	Yes	Yes	Yes	No	No
Ours	Yes	Yes	Yes	Yes	Yes	Yes	Yes

).

Post-quantum security is the foundation for the long-term stable operation of V2G networks. The security assumptions of existing schemes generally have vulnerabilities in the quantum era: BCE-PPDS, Emularis, and LK-TRS all rely on traditional number-theoretic assumptions such as Discrete Logarithm (DL) and Elliptic Curve Discrete Logarithm (ECDL), which can be solved in polynomial time by Shor’s quantum algorithm, making security risks in the quantum computing era unavoidable; CL-LRS constructs its security foundation using the Multivariate Quadratic (MQ) polynomial assumption, but this assumption has been breached by constructive attacks, casting doubt on the reliability of its security basis; PQ-ATL integrates NIST-standardized post-quantum algorithms with lattice-based cryptography, and its security reduction requires binding assumptions of multiple cryptographic primitives, which not only expands the reduction gap (the difference between the attacker’s success probability and the probability of breaking the underlying assumption) but also introduces additional computational overhead due to component collaboration; and AZALEA achieves post-quantum security based on lattice-based cryptography and zero-knowledge proofs, but its complex operation process is prone to side-channel attack risks, and the security proof relies on non-tight reduction of multi-primitive collaboration, lacking sufficient rigor. Our scheme takes the pure hash-based architecture of SPHINCS+ as its core, with security anchored solely on the collision resistance and preimage resistance of SHA-256: Shor’s algorithm has no effective attack path against hash operations; Grover’s algorithm only reduces the complexity of preimage search to $O\left(2^{128}\right)$, which far exceeds the computational resource limit of the current and foreseeable future. This design not only achieves long-term security guarantees in the quantum era, but also avoids security vulnerabilities caused by the combination of multiple primitives, adapting to the long-term deployment needs of V2G networks.

Anonymity, linkability, and revocability together form the core closed-loop of “privacy protection–regulatory compliance” in V2G networks. Existing schemes have significant flaws in the collaborative implementation of these three properties. In terms of anonymity, LK-TRS’s hierarchical anonymity mechanism is achieved through the binding of “signature count–pseudonym”, but the public availability of signature counts constitutes an information side channel, enabling attackers to locate the real signer through statistical analysis; in Emularis’s multi-mode anonymity, there is distinguishability in structural characteristics between fake signatures and real signatures, and their hash value distribution does not meet computational indistinguishability in polynomial time, resulting in non-negligible privacy leakage risks; BCE-PPDS achieves anonymity by relying on public key set obfuscation, but fails to verify the consistency of hash distribution of obfuscated public keys, making it vulnerable to clustering attacks in practical applications; CL-LRS and PQ-ATL sacrifice the implementation efficiency of anonymity to balance post-quantum security, with signature verification latency exceeding the tolerance threshold of high-frequency V2G transactions; and AZALEA’s zero-knowledge proof-driven anonymity has the problem of anonymity degradation caused by proof parameter deviations, and the lengthiness of the proof process affects transaction real-time performance. In terms of linkability, LK-TRS’s linkability relies on a centralized account registration table, which faces the risk of registration table tampering or synchronization failure in distributed V2G scenarios; Emularis only supports linkability in specific communication modes, lacking versatility, and the link tag lacks strong binding with the private key, leading to tag collision risks; BCE-PPDS does not collaboratively design linkability with double-spending attack defense, resulting in limited regulatory practicality; CL-LRS and PQ-ATL’s link verification relies on complex lattice/multivariate operations, and verification latency affects transaction real-time performance; and AZALEA’s linkability is derived based on zero-knowledge proofs, with the risk of misjudgment caused by redundant proof logic. In terms of revocability, LK-TRS’s k-times traceability mechanism can only trace identity after the number of signatures exceeds the threshold, failing to achieve real-time revocation, while AZALEA, BCE-PPDS, Emularis, CL-LRS, and PQ-ATL all lack a revocability mechanism collaborative with anonymity and linkability, making it impossible to form a regulatory closed-loop. Our scheme achieves strict anonymity through the “real signature + fake signature simulation” mechanism, generating fake signatures with identical structural characteristics (including authentication path length, hash format, and data dimension) to real signatures for non-signers in the ring and ensuring computational indistinguishability of hash distributions through random oracle simulation; its link tag $I_{\xi ,t}=H\left(s{k}_{\mathrm{link},\xi ,t} \Vert H\left(P{K}_{\xi }\right) \Vert t \Vert r_{\xi ,t}\right)$ is generated by binding the private key seed-derived exclusive link key with the public key hash, with unique determinism, enabling accurate association of transactions from the same user; and revocability is realized based on link tags and public key control by the Trusted Authority (TA), where the TA associates the malicious user’s public key through the tag and completes revocation without exposing the user’s real identity. These three properties form a collaborative closed-loop of “anonymous protection–transaction association–violation revocation”, achieving a seamless balance between privacy and regulation while ensuring transaction efficiency.

The rationality of state management directly affects the deployment adaptability of the scheme. AZALEA, BCE-PPDS, Emularis, LK-TRS, CL-LRS, and PQ-ATL all adopt stateful signature designs, requiring continuous maintenance of state information such as signature counts, private key indexes, and pseudonym associations. Such designs not only increase the storage overhead of on-board terminals, but also introduce Byzantine fault tolerance risks of state synchronization in distributed scenarios, and state data leakage may directly lead to private key invalidation or signature forgery, making it difficult to adapt to the characteristics of dynamic access and frequent transactions of electric vehicles in V2G networks. Our scheme implements stateless signatures based on the Hypertree structure of SPHINCS+, where signature generation only relies on the private key seed and current transaction information without recording any historical state data. This design not only simplifies the resource occupation of on-board terminals, but also fundamentally eliminates attack surfaces related to state management, significantly improving the deployment flexibility and operational security of the scheme.

The rigor of security reduction is the core guarantee of cryptographic schemes. Existing schemes generally have reduction defects: the security reductions of BCE-PPDS, Emularis, and LK-TRS rely on traditional number-theoretic assumptions, which cannot resist quantum attacks and have insufficient tightness in the reduction process, with a non-negligible gap between the attacker’s success probability and the probability of breaking the underlying assumption; CL-LRS’s reduction relies on the security of multivariate polynomial operations, and structural weaknesses in the reduction process lead to an expanded reduction gap, lacking rigor; and PQ-ATL and AZALEA’s reductions require binding the collaborative effects of multiple post-quantum components, with cumbersome reduction logic and potential vulnerabilities, enabling attackers to generate unauthorized valid signatures by tampering with signature components or forging authentication paths. The revocability of various schemes fails to achieve tight reduction with core security properties, and the security of regulatory mechanisms lacks support from underlying assumptions. The unforgeability of our scheme is directly reduced to the collision resistance of SHA-256, the unframeability relies on the strong binding relationship between the private key and link tags/hash commitments, and revocability is realized based on the uniqueness of link tags and hash collision resistance. All three properties achieve tight reduction, and the success probability of attackers forging signatures, framing innocent members, or evading revocation mechanisms is equivalent to breaking the core properties of hash functions (negligible). The security foundation is more solid, ensuring the theoretical rigor and practical reliability of the scheme.

In summary, our scheme forms comprehensive advantages compared with existing schemes (AZALEA, BCE-PPDS, Emularis, LK-TRS, CL-LRS, PQ-ATL) through its pure hash-based architecture for post-quantum security, collaborative closed-loop of anonymity–linkability–revocability, stateless deployment-adaptive design, and tight security reduction. In terms of computational overhead, the scheme’s key generation (2205.6 ms), signature generation (66.2427 ms), and verification (389.0916 ms) all exhibit excellent scale stability, with sublinear or constant growth with the ring size, adapting to large-scale EV access scenarios. In terms of communication overhead, although the absolute value is higher, the sublinear growth characteristic and V2G network bandwidth redundancy ensure no practical transmission bottlenecks. In terms of security attributes, it is the only scheme that simultaneously satisfies six core properties, solving the key pain points of existing schemes. It perfectly meets the four core requirements of V2G networks for long-term security, privacy protection, regulatory compliance, and efficient transactions, providing more comprehensive and practical cryptographic support for the safe and stable operation of V2G networks.

The impact of ring size on key generation time is shown in Figure 10. It is evident that the key generation time is irrelevant to the ring size n—as n increases from 0 to 1024, the key generation times corresponding to different numbers of accounts m (3, 5, 10, 20) all remain stable without significant fluctuations. The number of accounts m serves as the core factor affecting key generation time: it stabilizes at approximately 330.84 ms when $m=3$, around 551.4 ms when $m=5$, about 1102.8 ms when $m=10$, and roughly 2205.6 ms when $m=20$.

The impact of ring size on signature verification time is shown in Figure 11. It is evident that the signature verification time is positively correlated with the ring size n—as n increases from 0 to 1024, the signature verification times for different numbers of accounts m (3, 5, 10, 20) all show a steady upward trend without significant fluctuations. The number of accounts m serves as the core factor affecting signature verification time: it stabilizes at approximately 65 ms when $m=3$, around 66 ms when $m=5$, about 68 ms when $m=10$, and roughly 70 ms when $m=20$. This characteristic indicates that the signature verification overhead of the scheme increases moderately with the expansion of the ring size, and the overhead differences under different account numbers are small, boasting good adaptability, thus being suitable for scenarios with dynamically changing ring sizes in Vehicle-to-Grid (V2G) networks.

It can be seen from Figure 12 that the signature verification time is positively correlated with the ring size n. Regardless of the ring size n increasing from 0 to 1024, the verification times corresponding to different numbers of accounts m all show a steady upward trend with the growth of n. Among them, the number of accounts m is the core influencing factor: when $m=3$, the verification time finally stabilizes at approximately 400 ms with the growth of n; when $m=5$, it stabilizes at around 550 ms; when $m=10$, it stabilizes at about 750 ms; and when $m=20$, it stabilizes at roughly 950 ms. This characteristic indicates that the overhead of the scheme in the verification phase increases moderately with the expansion of the ring size, and the larger the number of accounts, the correspondingly higher the growth amplitude of the verification overhead. However, the overall growth rate is controllable, which makes it suitable for large-scale Electric Vehicle (EV) access scenarios in Vehicle-to-Grid (V2G) networks. It can reduce the risk of processing bottlenecks in Local Aggregators (LAGs) or Billing Servers (BSs) caused by the growth of the ring size.

It can be seen from Figure 13 that the communication overhead has a significant positive correlation with the ring size n. When the ring size n increases from 0 to 1024, the communication overhead corresponding to different numbers of accounts m (3, 5, 10, 20) shows a steady upward trend with the growth of n, and the differences in communication overhead corresponding to different m are extremely small, presenting an almost synchronous growth trend. Among them, the ring size n is the core influencing factor of communication overhead: when $n=64$, the communication overhead corresponding to each number of accounts stabilizes at approximately 10 KB; when $n=256$, it stabilizes at around 40 KB; when $n=512$, it stabilizes at about 80 KB; and when $n=1024$, it is close to 160 KB. This characteristic indicates that the communication overhead of the scheme increases steadily with the expansion of the ring size, and the overhead fluctuations under different numbers of accounts are controllable. It is suitable for application scenarios with different ring sizes and account numbers in Vehicle-to-Grid (V2G) networks, and will not affect the stability of data transmission due to sharp fluctuations in communication overhead.

Combined with the data characteristics of four comparative figures—key generation time (see Figure 14), signature generation time (see Figure 15), signature verification time (see Figure 16), and communication overhead (see Figure 17)—as well as the technical attributes of the SPHINCS+ framework and practical requirements of Vehicle-to-Grid (V2G) scenarios, our proposed scheme demonstrates significant performance advantages over mainstream existing schemes (AZALEA, BCE-PPDS, Emularis, LK-TRS, CL-LRS, PQ-ATL). The comparative analysis is conducted around three core computational phases, with a focus on scale sensitivity, latency efficiency, and scenario adaptability.

Specifically, the BCE-PPDS scheme relies on high-complexity operations, and its key generation overhead increases significantly with the expansion of n. When $n=1024$, its key generation time is close to 220 ms, which fails to meet the efficiency requirements of large-scale V2G deployments. Constrained by the coupling relationship between the number of accounts m and the ring size n, the Emularis scheme exhibits a gentle yet steady upward trend in key generation time with the growth of n. When $n=1024$, it reaches approximately 110 ms, which will accumulate delays in large-scale V2G networks due to the expansion of ring size. Even other traditional schemes (such as AZALEA, LK-TRS, etc.) show varying degrees of time growth with an increase in n.

In sharp contrast to this, the key generation of our scheme exclusively relies on low-latency SHA-256 hash operations, with its computational overhead formula given by $m·\left(\mathrm{len}\omega ·T_h(1+2^{h^{\prime }})+{\tau }_0·T_{hz}+2·T_h\right)$. Among these parameters, $\mathrm{len}=67$ (WOTS+ chain length), $\omega =16$ (WOTS+ Winternitz parameter), $h^{\prime }=10$ (XMSS subtree height), and ${\tau }_0$ is the hash calibration constant. $T_h$ denotes the latency of a single SHA-256 hash operation, and $T_{hz}$ denotes the latency of hash value compression operation. These parameters are all fixed parameters derived from SPHINCS+, with only the number of accounts m being a scenario-adjustable parameter, and the overall formula has no correlation with the ring size n. Experimental results show that its key generation time stabilizes within the range of 0 to 5 ms, and the curve remains flat even when n expands from 0 to 1024 (this characteristic is also clearly presented in the enlarged view of Figure 14).

The advantages of our scheme are further highlighted in the signature generation phase (Figure 15), which is highly aligned with the real-time requirements of high-frequency charging transactions in Vehicle-to-Grid (V2G) scenarios. Traditional schemes generally face the problem of performance degradation with the expansion of scenario parameters: when the ring size $n=1024$, the signature time of the Emularis scheme exceeds 40,000 ms, far exceeding the real-time threshold of V2G charging requests (<1 s). The LK-TRS scheme relies on elliptic curve exponentiation operations, and its signature overhead continues to rise with increases in relevant parameters, with the actual latency reaching the multi-second level, which cannot adapt to high-frequency transaction scenarios. Even the post-quantum scheme PQ-ATL, due to the high computational complexity of lattice-based operations, has a signature latency of more than 2000 ms when $n=1024$. In contrast, schemes such as CL-LRS and BCE-PPDS achieve near-zero latency through lightweight hash or matrix operations, but they lack post-quantum security and cannot meet long-term security requirements.

Our scheme adopts an innovative “real signature + pseudo-signature simulation” mechanism—it only generates valid FORS/WOTS+ signatures for the actual signer, while generating structurally consistent pseudo-signatures (whose hash distribution satisfies polynomial indistinguishability) for non-signers in the ring, thus ensuring both unlinkable anonymity and computational efficiency. Its signature generation latency can be quantified by the formula $m·T_{hz}+n{log}_{2}n·T_h+nk\alpha ·T_h+\mathrm{len}\omega ·T_h+h^{\prime }d·T_h+t·T_{hz}+{\tau }_t·T_{hz}+3·T_h$, where m is the number of accounts, $T_{hz}$ is the latency of hash value compression operation, $T_h$ is the latency of a single SHA-256 hash operation ($0.1\mu \mathrm{s}$), $k=16$ (number of independent FORS subtrees), $\alpha$ is the signature path calibration coefficient, $\mathrm{len}=67$ (WOTS+ chain length), $\omega =16$ (Winternitz parameter for WOTS+), $h^{\prime }=10$ (XMSS subtree height), d is the XMSS authentication path dimension, $t=256$ (number of leaves per FORS subtree), and ${\tau }_t$ is the pseudo-signature structure calibration constant. After substituting the relevant fixed parameters for calculation, the theoretical latency is highly consistent with the actual experimental results.

In the signature verification phase, our scheme achieves a synergy between efficient processing and security guarantees, while objectively incorporating some advantages of other schemes. As shown in Figure 16, most traditional schemes face significant performance bottlenecks in the verification process: the verification formula of Emularis is $(m+2{log}_{2}n+n+3)T_{exp}+({log}_{2}n+2)T_{hk}+mn{T}_{hg}$, and its verification time rises sharply with the expansion of the ring size n, exceeding 30,000 ms when $n=1024$. This is prone to causing processing congestion in Local Aggregators (LAGs) and Billing Servers (BSs) under long-term high-concurrency scenarios. CL-LRS relies on hash chain reconstruction and lattice proof verification, resulting in a verification latency of more than 1000 ms. Although AZALEA achieves a relatively low verification latency, it comes at the cost of high overhead in the signature phase and lacks an identity revocation mechanism, which limits its long-term applicability in V2G scenarios.

The verification process of our scheme only involves the following two lightweight operations: reconstructing the FORS root node based on the authentication path, and verifying the consistency between the XMSS tree path and $PK.root$. Its verification latency can be quantified by the formula $nlogm·T_{hz}+{log}_{2}n·T_h+nk\alpha ·T_h+\mathrm{len}\omega ·T_h+h^{\prime }d·T_h+t·T_{hz}+2·T_h+T_{hg}$, where n is the ring size, m is the number of accounts, $T_{hz}$ is the latency of hash value compression operation, $T_h$ is the latency of a single SHA-256 hash operation, $k=16$ (number of independent FORS subtrees), $\alpha$ is the verification path calibration coefficient, $\mathrm{len}=67$ (WOTS+ chain length), $\omega =16$ (Winternitz parameter for WOTS+), $h^{\prime }=10$ (height of a single XMSS subtree), d is the XMSS authentication path dimension, $t=256$ (number of leaves per FORS subtree), and $T_{hg}$ is the latency of hash value consistency verification. The remaining parameters are all fixed values derived from the SPHINCS+ framework.

As can be seen from Figure 16, the verification time of our scheme stably remains at an extremely low level: even when the ring size n expands from 0 to 1024, its verification latency remains flat (this characteristic is also clearly presented in the enlarged view in the upper right corner). Experimental results show that when the number of accounts $m=3$, the verification latency of our scheme stabilizes at approximately 9 ms; when $m=20$, it is only 31 ms, and can be further reduced to less than 10 ms through parallel hash computation optimization. This performance not only adapts to the large-scale Electric Vehicle (EV) access scenarios in V2G networks, effectively reducing the processing pressure on LAGs and BSs during peak periods, but also constructs a long-term security barrier relying on the quantum resistance of SHA-256, achieving a balance between “performance adaptability and security reliability”.

In the dimension of communication overhead (Figure 17), the lightweight characteristics of our scheme precisely align with the resource constraints of limited bandwidth on edge devices in Vehicle-to-Grid (V2G) scenarios. As shown in Figure 17, most traditional schemes generally face the problem of a sharp surge in communication overhead with the expansion of ring size: due to the need to transmit redundant verification data of lattice proofs, the communication overhead of the CL-LRS scheme rises sharply when the ring size n expands from 0 to 1024, eventually exceeding 1400 KB. The AZALEA scheme relies on the aggregated transmission of public keys of ring members, and its overhead also rises synchronously to nearly 1200 KB. Such high overhead is prone to causing transmission congestion in the V2G edge network and reducing the efficiency of transaction response.

The communication overhead of our scheme only includes the following two types of core data: the authentication path of FORS/WOTS+ and the streamlined verification information of the XMSS subtree, with no redundant transmission content. As can be seen from the figure, even when the ring size n gradually expands from 64 to 1024, its communication overhead maintains a gentle growth trend, which is more clearly presented in the enlarged view in the upper right corner: when $n=1024$, the communication overhead of our scheme is only about 150 KB, far lower than the level of traditional schemes.

This lightweight characteristic can not only adapt to the limited bandwidth resources in V2G scenarios, but also reduce data transmission latency and further improve the overall efficiency of the transaction process. It forms a synergy with the performance advantages of the key generation, signature, and verification phases, and fully adapts to the deployment requirements of V2G networks under large-scale Electric Vehicle (EV) access.

6. Conclusions and Future Work

This paper addresses the key pain points of traditional anonymous authentication schemes in the scenario of large-scale Electric Vehicle (EV) access to Vehicle-to-Grid (V2G) networks, including strong ring size dependence, high transaction latency, large communication overhead, and the lack of post-quantum security. Our scheme is proposed based on the SPHINCS+ pure hash architecture—through the innovative “real signature + pseudo-signature simulation” mechanism, this scheme breaks the coupling constraint between ring size and computational overhead, controlling the signature and verification latency within 70 ms and 30 ms, respectively. When $n=1024$, the communication overhead is only 150 KB. Meanwhile, relying on the quantum-resistant characteristics of SPHINCS+, it establishes a long-term security barrier for V2G application scenarios.

At present, the proposed scheme still has some limitations, such as insufficient flexibility in parameter configuration and the need to strengthen adaptability to low-end embedded devices of electric vehicles. In the future, we will conduct in-depth research on directions including the scenario-based dynamic parameter adjustment mechanism, lightweight cropping of edge-side algorithms, and high-concurrency verification in real V2G environments, to further improve the deployment adaptability and actual operational stability of the scheme.