# Quantum-Secure Certificate-Less Conditional Privacy-Preserving
Authentication for VANET

Girraj Kumar Verma, Nahida Majeed Wani, and Prosanta Gope, G. K. Verma and N.
M. Wani are with the Department of Mathematics, Amity School of Engineering
and Technology, Amity University, Madhya Pradesh, Gwalior, India
<EMAIL_ADDRESS><EMAIL_ADDRESS>nahidaoct@gmail.com)P. Gope
is with the Department of Computer Science, University of Sheffield Sheffield
S1 4DP, United Kingdom (Email: p.gope@sheffield.ac.uk).

###### Abstract

Vehicular Ad-hoc Networks (VANETs) marked a pronounced change in the
Intelligent Transport System and Smart Cities through seamless vehicle
communication to intensify safety and efficacy. However, a few authentication
schemes have been devised in the literature to ensure the authenticity of the
source and information in the post-quantum era. The most popular base for such
construction is lattice-based cryptography. However, existing lattice-based
authentication schemes fall short of addressing the potential challenges of
the leakage of the master secret key and key-escrow problem. By ingeniously
addressing both issues, the paper proposes the _first_ quantum secure
authentication scheme to eliminate the flaws while maintaining the system’s
overall efficiency intact. Compared to the state-of-the-art schemes, the
provable security and overall performance assessment highlight the suitability
of the proposed approach.

###### Index Terms:

Post Quantum Authentication, Certificateless Signature, Vehicular Adhoc
Networks, Intelligent Transportation.

##  I Introduction

The increase in traffic has prompted the exploration of innovative solutions
like ad-hoc networks and Vehicular Ad-hoc Networks (VANET). Due to the
miscellaneous advancements in wireless transmission, VANETs enable nodes to
engage in real-time communication with one another and with infrastructure. It
allows for exchanging critical traffic-related information to positively
impact traffic flow and overall transportation efficiency [1]. Classic VANET
architecture has three main working components (Figure 1) viz: a trusted party
(TA); that acts as an administrative centre and is responsible for overseeing
the whole network, road-side units (RSUs); that act as intermediate nodes
between vehicles and TA, and vehicles (equipped with an electronic device
referred as on-board units (OBU) to receive, store and transmit the data).

In VANET, the communication among the vehicles for information sharing (like
direction, location, speed, and other road statuses) is carried out by using
dedicated short-range (DSRC) protocols. It is done in two ways 1) vehicle-to-
vehicle communication (V2V), and 2) vehicle-to-infrastructure communication
(V2I) [2]. The V2V and V2I communications are done wirelessly, while RSUs and
TA communicate through the wiring medium. Using RSUs as intermediate nodes,
the information from the vehicle is sent to the TA. Then, TA analyzes and
utilizes information to provide better user services. The communication of
these nodes and RSUs helps avoid mishaps and provides further road services
(like gas station info, parking assistance, and ambulance services) whenever
required [3].

Figure 1: Basic VANET Model

Although TA thoroughly monitors the network, information security is still a
major problem. The reason is that the challenger can try to alter, reform,
replay, or even delete the data. This wrong traffic (or route) related
information or wrong traffic stat not only can cause congestion but, at some
routes, it can prove fatal. In addition, a malicious node could transmit
inaccurate information to the network. This can lead to possible mishaps, and
these fake messages can affect the node’s rights. Besides, it can cause severe
innumerable problems to the overall traffic system [4, 5]. Therefore, ensuring
the security parameters (especially the authenticity of sources and messages)
correspond to shared information is fundamental. To certify the
standardization of security, the user’s privacy is also essential. Thus, the
simple yet choicest solution is a privacy-preserving authentication protocol
to achieve authentication and privacy in a single step. However, in some
cases, privacy may be conditional, i.e. in dispute, TA can reveal the user’s
identity. One such protocol that is capable of providing conditional privacy
is the conditional privacy-preserving authentication protocol (CPPA).

###  I-A Related Work

In 2004, Hubuax et al. [4] studied various traffic-related concerns majoring
in security and privacy; they also discussed the challenges correlated with
smart vehicles. Later, in 2007, Raya et al. [6] proposed a secured
architecture for vehicular ad-hoc networks and discussed the related security
threats. They used certified public keys for communication, and these pre-
loaded certificates protect the user’s identity, although it enhanced the
storage cost problem. Also, in such cases, it gets difficult for TA to extract
the attacker’s real identity. In the same year, Lin et al. [7] proposed an
efficient pairing-based group signature scheme that provides security and
privacy to users and contributes to traceability features. The utilization of
the group signatures made the scheme lightweight. However, complex computing
and exponentiation features reduced the overall efficiency of the scheme. A
year later, Lu et al. [8] proposed an efficient conditional privacy-preserving
protocol (ECPP) that provides better anonymity and privacy attributes to the
users. However, a user needs a new certificate from the nearest RSU every time
to communicate with another node, which ultimately leads to severe
communication overhead. To lighten the drawback, Zhang et al. [9] introduced
an innovative RSU-aided message authentication scheme (RAISE). This approach
ensures user privacy through k-anonymity, inhibiting message-vehicle linkage.
However, this protocol couldn’t minimize the storage cost as it was again a
PKI-based design.

Later, Zhang et al. [10] developed a batch verification ID-based method for
vehicular sensor networks. The idea aims to reduce computation through batch
verification and enable the trust authority to uncover the vehicle identity
associated with any pseudo-identity. However, using bilinear pairings in this
approach couldn’t reduce the computational cost. Later, some more improved
proposals have been put forward in [11, 12, 13, 14], and [15]. In [16], an
idea of proxy vehicles has been utilized to reduce the computation burden on
RSUs. In the design, some proxy vehicles share part of the computation from
RSU. In [17], Li et al. incorporated public-key cryptography (PKC) into
pseudonym creation, enabling valid third parties to establish non-repudiation
of vehicles via real ID retrieval. However, mostly the development is based on
pairing computation and, therefore, is inefficient.

In 2015, He et al. [18] proposed a pairing-free identity-based conditional
privacy-preserving batch-verification protocol for vehicular ad-hoc networks.
Since this protocol is pairing-free, it reduces both computational costs and
communication overhead. A new approach enabling the formation of a
certificateless aggregate signature (CLAS) system for securing V2I
communication in VANETs has been proposed by Horng et al. [19]. It combines
certificateless public key cryptography and aggregate signature benefits,
maintaining a middle ground between anonymity and traceability. It
accomplishes anonymous authentication, information reliability, and
unlinkability and avoids requiring synchronization for sharing the exact
random string. To integrate effective tracking mechanisms, a pairing-based
authentication scheme was put forward by Azees et al. [20] in 2017. Their
method presents a robust conditional privacy tracking technique for
pinpointing the identity of malicious vehicles. However, their approach
overlooked the concept of non-flammability, which ensures the impossibility of
creating a fake signature for a participant. Besides, in 2021, Kazemi et al.
[21] presented an article in which they showed that the paper [20] is not
secure against modification attack, replay attack, and impersonation attack,
and they also proclaim that the scheme has linkable issues. Zhang et al. [24]
suggests a fingerprint-based verification scheme as an alternative to real
identity and passwords. This scheme removes the necessity of an ideal tamper-
proof device (TPD), thus preventing potential risks of compromising a
vehicle’s TPD and causing system malfunction.

Ogundoyin et al. [22] introduced an elliptic curve cryptography-based CPPA
system for VANETs. This approach meets VANET’s security and privacy needs,
resolves private key compromises, and averts privilege escalation.
Nonetheless, notable storage requirements arise as the network manager must
retain substantial relevant data. The study [23] introduced a new privacy-
protecting authentication method using 5G software-defined vehicular networks.
By leveraging the benefits of this network type, the proposed method
streamlines authentication to just two simple hash operations, minimizing
computational work. Furthermore, it eliminates the need for the ideal TPD and
avoids a vulnerable single point of failure. Security evaluation confirms that
the method fulfils outlined system goals. Another certificateless aggregate
signature system with conditional privacy preservation was created by Mei et
al. [25]. Some new and innovative developments have recently been reported in
[26, 27, 28, 29], and [30].

All the above-mentioned schemes reflected improvements in computations and
storage costs. However, none of them could resist the quantum threats [34]. As
per the National Institute of Standards and Technology (NIST), lattice-based
cryptography can be a good solution to resist quantum computing threats [2].
Therefore, to resist quantum computing threats in VANETs authentication,
Mukherjee et al. devised a lattice-based CPPA (LB-CPPA) scheme in [31]. The
hardness of the worst-case lattice assumptions has been used to create a novel
and effective LB-CPPA scheme. The devised CPPA protocol demonstrates faster
computing performance and resistance to contemporary quantum computers.
However, in the design, OBU holds the prime/master private key of TA. Thus, a
key leakage problem is available. To enhance security by eliminating the
drawback, the study [32] employs lattice-based cryptography for an anonymous
authentication scheme devoid of tamper-proof devices. This design fulfils
VANET’s security and privacy needs while also withstanding quantum computer
attacks. However, the vehicle’s secret key is computed by TA. Thus, it suffers
from a key-escrow problem. As a further improvement, Dharminder et al. [33]
proposed a framework utilizing a short integer solution problem within a
lattice. This framework accomplishes robust user identification,
authorization, and service revocation in VANETs. However, the user can compute
the TA’s secret key from its own data. The most recent development on the line
has been proposed in [2]. The suggested scheme is secure in the ROM under the
hardness of the ISIS problem. However, it suffers from master-secret key
leakage from the OBU side.

###  I-B Motivation and Contribution

As per the discussion, most of the existing LB-CPPA schemes have the drawback
of master-secret key leakage, or TA computes the vehicle’s secret key (Table
I) (Key-Escrow). Therefore, to mitigate the issues, the CLAS paradigm can be
utilized to design post-quantum CPPA schemes. In CLAS-based schemes, the
secret key of the node has two parts. A part is computed by TA (called the
partial secret key), and another part is picked by the vehicle itself [36].
Thus, there is no need to store the master secret of TA to OBU, and the
vehicle’s full secret key is also unknown to TA. Therefore, the paper aims to
design the first quantum-secure certificate-less CPPA (QS-CL-CPPA) scheme. The
description of the contributed scheme is as follows:

  * •

The first QS-CL-CPPA scheme has been devised in the paper. The CLAS scheme has
been utilized in a lattice-based setting to support batch verification.

  * •

The provable security has been discussed in detail to show the robustness of
the proposed QS-CL-CPPA scheme in the ROM.

  * •

The informal security analysis against various attacks has been presented in
detail.

  * •

To prove the effectiveness of the design, a detailed computational cost and
communication cost analysis has been presented.

TABLE I: Comparison of the Most Related Lattice-based Work Scheme | SP-1 | SP-2 | SP-3
---|---|---|---
Li et al. [2] | $\times$ | $\checkmark$ | $\times$
Mukherjee et al. [31] | $\times$ | $\checkmark$ | $\times$
Liu et al. [32] | $\times$ | $\times$ | $\checkmark$
Dharminder et al. [33] | $\times$ | $\checkmark$ | $\times$
Proposed Scheme | $\checkmark$ | $\checkmark$ | $\checkmark$
SP-1: Certificateless, SP-2: No Key Escrow
SP-3: No Master secret key leakage, $\checkmark$: Yes, $\times$: No

The roadmap of the proposed work is as follows:
Section II presents the foundation related to Lattice-theory, Network-
Framework, Security Requirements, and Framework of the proposed QS-CL-CPPA
scheme. The design of the proposed QS-CL-CPPA sch,eme has been put in Section
III, and the security analysis of the QS-CL-CPPA scheme has been presented in
Section IV. Section V presents a performance discussion, and Section VI
concludes the paper.

##  II Prelimeneries

###  II-A Mathematical Backgroud

To discuss Lattice-based foundation, we use the following standard
definitions. For a vector $\mathbf{a}$, the Euclidean norm is defined as
$\|\mathbf{a}\|=\sqrt{a_{1}^{2}+a_{2}^{2}+\cdots+a_{n}^{2}}$ where
$a_{1},a_{2}\ldots a_{n}$ are the elements of vector $\mathbf{a}$.

TABLE II: Notation Table Notation | Description of notations
---|---
$k$ | Security parameter
$q$ |  $q$(a prime no.) $\approx\operatorname{poly}(k)$
$m$ |  $m$ (integer)$\approx O(k\log q)$
$n$ |  $n$ (integer)$\approx O(k\log q)$
$\mathbf{X}^{\mathbf{T}}$ | Matrix transpose $\mathbf{X}$
$\|\mathbf{x}\|$ | Euclidean norm of vector $\mathbf{x}$
A | An integer matrix, $\mathbf{A}\in Z_{q}^{m\times n}$
d | System secret key, $\mathbf{d}\in Z_{q}^{m}$
$P_{PUB}$ | System public key, $\mathbf{PUB}=\mathbf{d}^{\mathbf{T}}\cdot\mathbf{A}\in Z_{q}^{1\times n}$
$H_{1}()$ | $H_{1}:\mathbb{Z}^{1\times n}_{q}\times\mathbb{Z}_{q}^{m}\times\\{0,1\\}^{l}\longrightarrow\\{0,1\\}^{l}$
$H_{2}()$ | $H_{2}:\mathbb{Z}^{1\times n}_{q}\times\\{0,1\\}^{*}\longrightarrow\mathbb{Z}^{*}_{q}$
$H_{3}()$ | $H_{3}:\mathbb{Z}^{1\times n}_{q}\times\\{0,1\\}^{l}\times\\{0,1\\}^{*}\times\\{0,1\\}^{l}\longrightarrow\mathbb{Z}^{*}_{q}$
$R_{ID_{i}}$ | Real ID of a node
$P_{ID_{i}}$ | pseudo-ID of a node
$ANS_{i}$ | An anonymous identity of $i^{\text{th }}$ vehicle
$m_{i}$ | Message of $i^{\text{th }}$ vehicle about traffic status
$T_{i}$ | Timestamp of $i^{\text{th }}$ vehicle
$\mathbf{sk}_{\mathbf{i}}$ | Secret key of $i^{\text{th }}$ vehicle, $\mathbf{sk}_{\mathbf{i}}\in Z_{q}^{m}$
$\sigma_{i}$ | Sign of $i^{\text{th }}$ vehicle
$\oplus$ | XOR operation
$\mathbin{\|}$ | Concatenation operation

Definition 1: A lattice $\mathscr{L}$ is a linear combination of ${n}$,
${m}$-dimensional vectors $v_{1},v_{2},v_{3},\ldots,v_{n}\in\mathbb{R}^{m}$.
If B $=\left\\{v_{1},v_{2},v_{3},\ldots,v_{n}\right\\}$ be a set of
independent vectors, we define
$\mathscr{L}({B})=\left\\{x_{1}v_{1}+x_{2}v_{2}+\ldots+x_{n}v_{n};x_{i}\in\mathbb{Z}\right\\}$
where $\mathbb{R}^{m}$ is a ${m}$-dimensional Euclidean space and B
$=\left\\{v_{1},v_{2},v_{3},\ldots,v_{n}\right\\}$, is a basis of
$\mathscr{L}({B})$.

Lemma 1: There exists at least one basis for every lattice
$\mathscr{L}\in\mathbf{R}^{{m}}$. It can be represented as a basis matrix
$\boldsymbol{A}=\left[\mathbf{a}_{1},\mathbf{a}_{2},\ldots\mathbf{a}_{\mathbf{n}}\right]\in\mathbb{Z}^{\mathbf{m}\times{n}}$,
having basis vectors as the columns.

Definition 2: A lattice $\mathscr{L}$ induced by a basis matrix
$\boldsymbol{A}\in\mathbb{Z}^{\mathbf{m}\times{n}}$ is defined as
$\mathscr{L}(\boldsymbol{A})$ = [$\boldsymbol{A}\mathbf{s}$ :
$\mathbf{s}\in\mathbb{Z}^{{n}}$ ] Where $\boldsymbol{A}\mathbf{s}$ is a
multiplication of a matrix and a vector .

There is no unique basis $\boldsymbol{A}$ for any
$\mathscr{L}(\boldsymbol{A})$. A matrix is unimodular unimodular if the
determinant is $\pm{1}$. Let $\boldsymbol{U}$ be a unimodular matrix such that
$\boldsymbol{U}\in\mathbb{Z}^{\mathbf{n}\times{n}}$, then $\boldsymbol{A}$
$\boldsymbol{U}$ is a basis of $\mathscr{L}(\boldsymbol{A})$.

The minimal distance of lattice is $d_{min}(\mathscr{L})$ =
min$\left\\{\|\mathbf{a}\|:\mathbf{a}\in\mathscr{L}^{*}\right\\}$.

Definition 3: Shortest Vector Problem (SVP)

For a lattice $\mathscr{A}$ with basis
$\mathscr{A}\in\mathbb{Z}^{{m}\times{n}}$, SVP seeks to find any vector
${s}$($\neq 0$ ) $\in{X}$ such that $\|s\|={d}_{\min}({A})$, which is
computationally impracticable.

Definition 4: Closest Vector Problem (CVP)

Let ${u}(\notin{B})$ be a vector and given a lattice with basis
${B}\in\mathbb{Z}^{{m}\times{n}}$, then closest vector problem seeks to find a
vector ${t}$ ($\neq 0$ ) $\in{B}$ where $\|u-t\|={d}_{\min}({B})$, which is
computationally infeasible.

Definition 5: Q-ary lattice

Given a lattice $\mathscr{L}$ satisfying
$\mathbb{Z}_{{q}}{}^{{n}}\subseteq\mathscr{L}\subseteq\mathbb{Z}^{{n}}$,
${q}$\- an integer, where $\mathbb{Z}^{{n}}$ and $\mathbb{Z}_{{q}}^{{n}}$ are
respectively the set of ${n}$ integers and set of ${n}$ integers over a finite
field q. Given a matrix $A\in\mathbb{Z}_{{q}}^{m\times n}$, two categories of
q-ary lattices (m-dimensional) are presented as:

$\Lambda_{q}^{\perp}=\left\\{\boldsymbol{x}\in\mathbb{Z}^{{n}}:\mathbf{A}\boldsymbol{x}=\mathbf{0}(\operatorname{modq})\right\\}$

$\Lambda_{q}=\left\\{\boldsymbol{x}\in\mathbb{Z}^{{n}}:\boldsymbol{x}=\mathbf{A}^{{T}}\mathbf{y}\right.$
(modq), for some $\left.\mathbf{y}\in\mathbb{Z}^{{m}}\right\\}$, where
$\mathbb{Z}_{{q}}^{m\times n}$ is the set of matrices modulo ”$q$”.

Definition 6: Small Integer Solution (SIS)

Suppose $q$ be an integer, $\alpha>0$\- a constant, and a matrix
${T}\in\mathbb{Z}_{{q}}^{n\times m}$, finding a vector $s$, such that
${T}s=0(\bmod{q})$ and $0<\|s\|<\alpha$ is infeasible.
Definition 7: Inhomogeneous Small Integer Solution (ISIS)

For a matrix ${M}\in\mathbb{Z}_{{q}}^{m\times n}$, $\alpha$-an integer and a
vector chosen randomly $\boldsymbol{x}\in\mathbb{Z}_{{q}}^{m}$, ISIS seeks to
find a vector $\boldsymbol{y}\in\mathbb{Z}^{n}/\\{0\\}$ where
$\|\boldsymbol{y}\|<\alpha$ such that ${M}\boldsymbol{y}\
=\boldsymbol{x}(\bmod q)$ is infeasible.

Theorem 1: For any polynomial bounded $\alpha>0$ and $g$ i.e. $\alpha,g=$ poly
$(h)$, along with a prime modulus $q\geq\alpha\cdot\sqrt{gh}$, determining
lattice problems like SIS and ISIS assumptions in the average case is always
as difficult as approximating $SIVP_{\gamma}$ and GapSV $P_{\gamma}$ problems
in the worst case on any n-dimensional lattice $\mathscr{L}$ within a factor
$\gamma=\alpha.\tilde{O}\sqrt{h}$.
For a detailed discussion on these concepts, one can refer to [2], and [31].

Figure 2: VANET Network Model

###  II-B Network Framework

Generally, the VANET’s network model usually adopts a dual-layer architecture
and encompasses four distinct components: TA, a node/vehicle, an RSU, and an
application server (AS) as shown in Figure 2. A detailed breakdown of these
entities follows:

  * •

TA: The trusted third authority serves the role of ensuring the integrity and
security of communications within the VANET. It authenticates vehicles,
verifies their identities, and grants various actions and services
permissions. The TA also manages cryptographic keys, enabling secure message
exchanges and preventing unauthorized access.

  * •

AS: The application server acts as a central point for service delivery, data
management, communication, security, and overall coordination of applications
to enhance the functionality and effectiveness of the vehicular network.

  * •

RSU: These roadside units are planted along the roadsides, and they work as a
transitional node connecting the TA and the nodes. They perform many
functions, including communication, data collection, traffic control,
emergency services, and infrastructure support, all of which collectively
enhance road accident prevention, traffic regulation, and the overall
efficiency of vehicular networks.

  * •

Vehicle: Each node within the VANET necessitates an OBU. The OBU functions as
an impenetrable device, ensuring information remains confidential. Moreover,
it enables wireless transmission between a node and an RSU or other nodes,
adhering to the DSRC protocol.

###  II-C Security Requirements

Security and anonymity in VANETs are paramount due to the delicate nature of
the information exchanged and the potential impact of compromised
communications. Various aspects, including unlinkability, information
authentication, anonymity preservation, conditional traceability, and
resistance to attacks, are essential components that ensure the robustness and
reliability of the VANETs.

  * •

Information Authentication: It ensures that messages are not tampered with or
fabricated during transmission. This is crucial for maintaining the integrity
of critical information such as traffic updates, emergency alerts, and vehicle
coordination. TA and RSUs play pivotal roles in verifying the authenticity of
messages, using cryptographic techniques to validate the source and content of
messages.

  * •

Anonymity Preservation: Preserving the privacy of individual vehicle
identities is a significant concern in VANETs. RSUs and TAs collaborate to
employ techniques like pseudonyms, which replace actual vehicle identifiers
with temporary ones. This shields the real identities of vehicles from being
exposed to potential eavesdroppers while still allowing legitimate authorities
to authenticate vehicles.

  * •

Conditional Traceability: Tracing and attributing actions back to specific
vehicles is important for accountability and security. TAs and RSUs manage
cryptographic keys and pseudonyms, enabling conditional traceability when
required for incident investigation or law enforcement purposes.

  * •

Un-linkability: Un-linkability ensures that different messages from similar
nodes cannot be linked together, enhancing privacy. RSUs and TAs implement
methods to prevent unauthorized entities from connecting pseudonyms to real
identities, safeguarding the unlinkability of messages.

  * •

Resistance to Attacks: VANETs are inclined to various quantum attacks,
including man-in-the-middle attacks, modification attacks, impersonation
attacks, and replay attacks.

###  II-D Framework of the Proposed QS-CL-CPPA Scheme

The proposed QS-CL-CPPA scheme is comprised of seven phases: System
Initialization, $P_{ID}$-Gen, psk-Gen, sk-Gen, $CL_{sig}$-Gen, $CL_{sig}$-Ver,
and Batch-$CL_{sig}$-Ver. The detailed execution is as follows:

  * •

System Initialization: This phase is run by TA with a security parameter as
input. It is also known as the system setup phase as all system parameters
$\left\\{m,n,q,\mathbf{A},P_{PUB},H_{1},H_{2},H_{3}\right\\}$ are generated
and kept in the OBU’s and the existing RSU’s by TA.

  * •

$P_{ID}$-Gen: In this phase, every vehicle ($V_{i}$) interacts with the TA to
generate the pseudo-identity ($P_{ID_{i}}$). After certain computations, TR
sends $P_{ID_{i}}$ and time stamp $T_{i}$ to the vehicle. Then, TA and vehicle
store the data.

  * •

psk-Gen: In the phase, TA generates the partial-secret key ($psk_{ID_{i}}$) of
$P_{ID_{i}}$ and shares it secretly with the vehicle ($P_{ID_{i}}$).

  * •

sk-Gen: After obtaining the partial-secret key from TA, in this phase, vehicle
($P_{ID_{i}}$) computes its full secret key and outputs its public key
$pk_{ID_{i}}$.

  * •

$CL_{sig}$-Gen: For the signature generation phase, the vehicle ($P_{ID_{i}}$)
outputs a signature $\sigma_{i}$ while taking message $m_{i}$ and secret-key
$sk_{ID_{i}}$ as input.

  * •

$CL_{sig}$-Ver: While the message is received by the RSU/OBU, the
authentication for the signature is carried out. Here, on inputting the
signature $\sigma_{i}$ of the vehicle ($P_{ID_{i}}$), the output turns out
true only if $\sigma_{i}$ is valid, else it will return false

  * •

Batch-$CL_{sig}$-Ver: In this phase, ”$n$” a number of message-signature pairs
is taken as input by the RSU’s/OBU’s and they return true or false accordingly
if the signatures are valid or not.

##  III Proposed QS-CL-CPPA Scheme

In this section, the proposed QS-CL-CPPA scheme has been presented in detail.
All the notations/symbols used in the suggested scheme are noted in Table II

  * •

System initialization: The trusted authority TA brings out the system
parameters, which are then loaded into the secure devices of individual mobile
nodes beforehand. Subsequently, these parameters are transmitted to all
Roadside Units (RSUs). Choosing k as a security parameter, TA takes
$1^{\textit{k}}$ as input and outputs the subsequent parameters:
(a) The TA takes two integers $m,n$, and a prime number $q$.
(b) The TA chooses a matrix $A\in Z_{q}^{m\times n}$.
(c) A vector $d\in Z_{q}^{m}$ is chosen randomly as the system private key by
the TA and computes the system public key as $P_{Pub}=d^{T}A\in Z_{q}^{1\times
n}$.
(d) TA chooses the one-way hash functions as; $H_{1}:\mathbb{Z}^{1\times
n}_{q}\times\mathbb{Z}_{q}^{m}\times\\{0,1\\}^{l}\longrightarrow\\{0,1\\}^{l}$,
$H_{2}:\mathbb{Z}^{1\times
n}_{q}\times\\{0,1\\}^{*}\longrightarrow\mathbb{Z}^{*}_{q}$, and
$H_{3}:\mathbb{Z}^{1\times
n}_{q}\times\\{0,1\\}^{l}\times\\{0,1\\}^{*}\times\\{0,1\\}^{l}\longrightarrow\mathbb{Z}^{*}_{q}$.
(e) The final system parameters
$\triangle=\left\\{q,m,n,P_{Pub},A,H_{1},H_{2},H_{3}\right\\}$ are distributed
among RSUs and vehicles.

  * •

$P_{ID}$\- Gen: Vehicle and TA interact to generate $P_{ID_{i}}$ (pseudo-
identity) of the vehicle’s real- identity $R_{ID_{i}}$ using secure-channel.
(a) Vehicle takes $a_{i}\in_{R}\mathbb{Z}_{q}^{m}$ vector and computes
$pk^{1}_{ID_{i}}=a_{i}^{T}A$ and shares $(pk^{1}_{ID_{i}},R_{ID_{i}})$ to TA.
(b) TA Computes $P_{ID_{i}}=R_{ID_{i}}$ $\oplus$
$H_{1}(pk^{1}_{ID_{i}},d,T_{i})$ and sends $P_{ID_{i}}$ and $T_{i}$ (time-
stamp) to vehicle.
(C) TA and vehicle both store $ID_{i}$ =
($pk^{1}_{ID_{i}},P_{ID_{i}},R_{ID_{i}},T_{i})$.

  * •

psk- Gen: TA executes the following steps to generate the partial-
private/secret key ($psk_{ID_{i}}$) of the vehicle (with $ID_{i}$).
(a) Picks $x_{i}$ $\in_{R}$ $Z_{q}^{m}$ vector and computes
$X_{i}=x_{i}^{T}A$.
(b) Computes $psk_{ID_{i}}$=$x_{i}+\gamma_{i}d$, where
$\gamma_{i}=H_{2}(pk^{1}_{ID_{i}}+X_{i},T_{i})$ and TR shares
$(psk_{ID_{i}},X_{i})$ to vehicle ($ID_{i}$) secretly.

  * •

sk-Gen: In this phase, the vehicle does the following steps:
(a) Computes $sk_{ID_{i}}$ = $psk_{ID_{i}}+a_{i}$ as the secret-key.
(b) Outputs $pk_{ID_{i}}$ = $(pk^{1}_{ID_{i}}+X_{i})$ as the public-key.
Public key is broadcasted to the nearby atmosphere.

  * •

$CL_{sig}$-Gen: To broadcast a safety-related message $m_{i}$, vehicle
$(ID_{i})$ generates a signature as follows:
(a) Selects $r_{i}\in_{R}Z_{q}^{m}$ vector and computes $R_{i}$ = $r_{i}^{T}A$
(b) Computes $\sigma_{i}$=$sk_{ID_{i}}+\delta_{i}r_{i}$, where
$\delta_{i}=H_{3}(R_{i},P_{ID_{i}},m_{i},T_{i})$.
Then, vehicle $(ID_{i})$ broadcasts ($m_{i},\sigma_{i},R_{i}$) to nearby OBUs
and RSUs.

  * •

$CL_{sig}$-Ver: To verify the authenticity of received $(m_{i},\sigma_{i})$,
RSU/OBU does the following steps:
(a) Computes $\gamma_{i}$ = $H_{2}(pk_{ID_{i}},T_{i})$ and
$\delta_{i}=H_{3}(R_{i},P_{ID_{i}},m_{i},T_{i})$.
(b) Checks $\sigma_{i}^{T}A=pk_{ID_{i}}+\gamma_{i}P_{Pub}+\delta_{i}R_{i}$. If
valid, outputs are accepted. Otherwise, outputs are rejected.

  * •

Batch-$CL_{sig}$-Ver: To verify the authenticity of the ”$n$” message-
signature pairs, RSU/OBU performs the following:
(a) Computes $\gamma_{i}=H_{2}(pk_{ID_{i}},T_{i})$ and
$\delta_{i}=H_{3}(R_{i},P_{ID_{i}},m_{i},T_{i})$, $1\leq i\leq n$ and selects
$b_{1},b_{2},...,b_{n}$ $\in_{R}$ $\mathbb{N}$ (where $b_{i}^{\prime}s$ are
samll).
(b) Checks $(\sum\limits_{i=1}^{n}b_{i}\sigma_{i})^{T}A$ =
$\sum\limits_{i=1}^{n}b_{i}pk_{ID_{i}}+(\sum\limits_{i=1}^{n}\gamma_{i}b_{i})P_{Pub}+\sum\limits_{i=1}^{n}b_{i}\delta_{1}R_{i}$.

##  IV Analysis of QS-CL-CPPA Scheme

###  IV-A Correctness

Correctness of $CL_{sig}-Ver$ and Batch-$CL_{sig}-Ver$ can be seen as follows:
(a)

$\sigma_{i}^{T}A=(sk_{ID_{i}}+\delta_{i}r_{i})^{T}A$
$=(psk_{ID_{i}}+a_{i})^{T}A+\delta_{i}r_{i}^{T}A$
$=(x_{i}+a_{i}+\gamma_{i}d)^{T}A+\delta_{i}R_{i}$
$=x_{i}^{T}A+a_{i}^{T}A+\gamma_{i}d^{T}A+\delta_{i}R_{i}$
$=X_{i}+pk^{1}_{ID_{i}}+\gamma_{i}P_{Pub}+\delta_{i}R_{i}$
$=pk_{ID_{i}}+\gamma_{i}P_{Pub}+\delta_{i}R_{i}$

(b)

$(\sum\limits_{i=1}^{n}b_{i}\sigma_{i})^{T}A=\sum\limits_{i=1}^{n}b_{i}(sk_{ID_{i}}+\delta_{i}r_{i})^{T}A$
$=\sum\limits_{i=1}^{n}b_{i}sk_{ID_{i}}^{T}A+\sum\limits_{i=1}^{n}b_{i}\delta_{i}r_{i}^{T}A$
$=\sum\limits_{i=1}^{n}b_{i}(psk_{ID_{i}}+a_{i})^{T}A+\sum\limits_{i=1}^{n}b_{i}\delta_{i}r_{i}^{T}A$
$=\sum\limits_{i=1}^{n}b_{i}(x_{i}+\gamma_{i}d+a_{i})^{T}A+\sum\limits_{i=1}^{n}b_{i}\delta_{i}r_{i}^{T}A$
$=\sum\limits_{i=1}^{n}b_{i}(x_{i}+a_{i})^{T}A+\sum\limits_{i=1}^{n}b_{i}\gamma_{i}d^{T}A+\sum\limits_{i=1}^{n}b_{i}\delta_{i}r_{i}^{T}A$
$=\sum\limits_{i=1}^{n}b_{i}pk_{ID_{i}}+(\sum\limits_{i=1}^{n}b_{i}\gamma_{i})P_{PUB}+\sum\limits_{i=1}^{n}b_{i}\delta_{i}R_{i}$

###  IV-B Provable security Analysis

  * A

Theorem-2: if the SIS/ISIS problem in lattice theory is interactable, the
proposed QS-CL-CPPA Scheme is secure against adversaries $\mathcal{A}_{1}$and
$\mathcal{A}_{2}$ in the ROM.
Proof: The proof of the theorem can be attained from Lemma-1 and Lemma-2 as;

  * B

Lemma-1: If the SIS/ISIS problem in lattice theory is interactable, the
proposed QS-CL-CPPA Scheme is secure against $\mathcal{A}_{1}$ adversary in
ROM.
Proof: Suppose $\mathcal{A}_{1}$ can forge the underlying signature scheme.
Now, the following interactive game involves $\mathcal{A}_{1}$ and challenger
$\mathcal{C}$.

  * •

Setup(): $\mathcal{C}$ generates parameters $\triangle$ and shares to
$\mathcal{A}_{1}$. $\mathcal{A}_{1}$ cannot get the secret key of TR.
$\mathcal{C}$ maintains lists $L_{H_{2}}$, $L_{H_{3}}$, $L_{pk}$ , $L_{psk}$
and $L_{sk}$ initially empty.

  * •

Queries $(H_{2})$: $\mathcal{A}_{1}$ puts $P_{{ID}_{i}}$ to $H_{2}(.)$ oracle.
$\mathcal{C}$ scans $L_{H_{2}}$, if the entry corresponding to $P_{{ID}_{i}}$
is available, picks the entry, and sends it to $\mathcal{A}_{1}$. Otherwise,
$\mathcal{C}$ picks $\gamma_{i}\in_{R}\mathbb{Z}_{q}^{*}$ and sets
$\gamma_{i}$=$H_{2}$ $(pk_{ID_{i}},T_{i})$. $\mathcal{C}$ update
$L_{H_{2}}\cup(P_{{ID}_{i}},\gamma_{i})$ and sends $\gamma_{i}$ to
$\mathcal{A}_{1}$.

  * •

Queries $(H_{3})$: $\mathcal{A}_{1}$ puts $(P_{{ID}_{i}},m_{i},R_{i},T_{i})$
to $H_{3}(.)$ oracle. $\mathcal{C}$ scans $L_{H_{3}}$ and if an entry is
found, $\mathcal{C}$ sends the entry to $\mathcal{A}_{1}$. Otherwise,
$\mathcal{C}$ picks $\delta_{i}\in_{R}Z_{q}^{*}$ and sets
$\delta_{i}=H_{3}(R_{i},P_{ID_{i}},m_{i},T_{i})$. $\mathcal{C}$ updates
$L_{H_{3}}\cup(P_{{ID}_{i}},R_{i},m_{i},T_{i},\delta_{i})$ and sends
$\delta_{i}$ to $\mathcal{A}_{1}$.

  * •

Reveal psk-Queries: $\mathcal{A}_{1}$ requests $P_{{ID}_{i}}$ to psk-Gen(.)
oracle. $\mathcal{C}$ first searches $L_{psk}$ to get an entry associated with
$P_{{ID}_{i}}$. If the entry corresponding to $P_{{ID}_{i}}$ exists,
$\mathcal{C}$ shares the entry to $\mathcal{A}_{1}$. Otherwise, $\mathcal{C}$
does the following:
\- $\mathcal{C}$ picks $psk_{{ID}_{i}}\in_{R}Z_{q}^{m}$ and computes
$x_{i}=psk_{{ID}_{i}}-\gamma_{i}d$ and $X_{i}=x_{i}^{T}A$, where $\gamma_{i}$
taken from $L_{H_{2}}$. Sets the output $(psk_{ID_{i}},X_{i})$ and update
$L_{psk}\cup\\{P_{{ID}_{i}},psk_{{ID}_{i}},x_{i},X_{i}\\}$ and sends
$(psk_{{ID}_{i}},X_{i})$ to $\mathcal{A}_{1}$.

  * •

Reveal sk-Queries: $\mathcal{A}_{1}$ requests $P_{{ID}_{i}}$ to sk-Gen(.)
oracle. $\mathcal{C}$ first checks $L_{sk}$ to get an entry corresponding to
$P_{{ID}_{i}}$. If the entry exists, $\mathcal{C}$ picks and sends the entry
to $\mathcal{A}_{1}$. Otherwise, do the following:
(a) $\mathcal{C}$ picks $(P_{{ID}_{i}},psk_{{ID}_{i}},x_{i},X_{i})$ from
$L_{psk}$ and picks $a_{i}\in_{R}Z_{q}^{m}$ and computes
$pk^{1}_{{ID}_{i}}=a_{i}^{T}A$.
(b) At last, $\mathcal{C}$ update
$L_{sk}\cup\\{P_{{ID}_{i}},psk_{{ID}_{i}},x_{i},X_{i},pk^{1}_{{ID}_{i}},a_{i}\\}$
and outputs $sk_{{ID}_{i}}$ equal to $psk_{{ID}_{i}}+a_{i}$ as secret key.

  * •

Reveal $pk_{{ID}_{i}}$-Queries: $\mathcal{A}_{1}$ puts $P_{{ID}_{i}}$ to get
associated with $pk_{{ID}_{i}}$. to respond, $\mathcal{C}$ acts as follows:
(a) $\mathcal{C}$ scans $L_{pk}$ and if an entry exits, picks the entry
($pk_{{ID}_{i}}$) and sends it to $\mathcal{A}_{1}$.
(b) Otherwise, $\mathcal{C}$ runs psk-Gen(.) and sk-Gen(.) oracle by
$P_{{ID}_{i}}$ as input and get $(psk_{{ID}_{i}},x_{i},X_{i})$ then sets
$pk_{{ID}_{i}}$=$pk^{1}_{{ID}_{i}}+X_{i}$ as public key and update $L_{pk}$ by
adding {$P_{ID_{i}},pk_{{ID}_{i}}$}.

  * •

Replace $pk_{{ID}_{i}}$-Queries: $\mathcal{A}_{1}$ puts {
$P_{ID_{i}},pk^{\prime}_{{ID}_{i}}$} to replace the $pk_{{ID}_{i}}$, while
associate secret key is not known to $\mathcal{A}_{1}$. $\mathcal{C}$ replace
the old value in $L_{pk}$.

  * •

$Cl_{{sig}}$-Gen Queries: $\mathcal{A}_{1}$ puts {$m_{i},P_{ID_{i}}$} to
$Cl_{{sig}}$-Gen(.) oracle to obtain a sign on $m_{i}$. Challeneger
$\mathcal{C}$ picks {$P_{ID_{i}}$, $\gamma_{i}$} $\in$ $L_{H_{2}}$ and
$\\{P_{ID_{i}},m_{i},R_{i},T_{i},\delta_{i}\\}$ $\in$ $L_{H_{3}}$. Then
$\mathcal{C}$ picks $\sigma_{i}$ $\in$ $Z_{q}^{m}$ and sets $pk_{{ID}_{i}}$ =
$\sigma_{i}^{T}A$-$\gamma_{i}P_{Pub}-\delta_{i}R_{i}$ and outputs
$\\{m_{i},\sigma_{i}\\}$ as a message signature pair to $\mathcal{A}_{1}$.
Everyone can verify that $\sigma_{i}^{T}A$ =
$pk_{{ID}_{i}}$+$\gamma_{i}P_{Pub}+\delta_{i}R_{i}$. Thus
$\\{m_{i},\sigma_{i}\\}$ simulated by $\mathcal{C}$ is indistinguishable from
the real one.

  * •

Forgery: Eventually, forger $\mathcal{A}_{1}$ outputs a forged
$\\{m_{i}^{*},\sigma_{i}^{*}\\}$ for a targeted $p^{*}_{{ID}_{i}}$ such that
$\sigma_{i}^{*T}A$=
$pk^{*}_{{ID}_{i}}$+$\gamma^{*}_{i}P_{Pub}+\delta^{*}_{i}R_{i}$ holds and
$P^{*}_{{ID}_{i}}$ has never been requested to psk-Gen(.) oracle and
$m_{i}^{*}$ has never been put to $Cl_{{sig}}$-Gen oracle.
By Forking Lemma [37], $\mathcal{A}_{1}$ can output another signature
$\\{m_{i}^{*},\sigma_{i}^{**}\\}$ for the targeted $P^{*}_{{ID}_{i}}$ with
different $\sigma_{i}^{**}$ which satisfies
$\sigma_{i}^{**T}A=pk^{*}_{{ID}_{i}}+\gamma^{**}_{i}P_{Pub}+\delta^{*}_{i}R_{i}$
$\implies(\sigma_{i}^{*}-\sigma_{i}^{**})^{T}A=(\gamma_{i}^{*}-\gamma_{i}^{**})d^{T}A$
$\implies(\sigma_{i}^{*}-\sigma_{i}^{**})=(\gamma_{i}^{*}-\gamma_{i}^{**})$
$d$ mod $q$
Thus, $(\gamma_{i}^{*}-\gamma_{i}^{**})^{-1}(\sigma_{i}^{*}-\sigma_{i}^{**})$
mod $q$ is a solution to ISIS problem with instance $P_{Pub}$ = $d^{T}A$,
which is a contradiction to the assumption.
Thus, the proposed $Cl_{{sig}}$-Gen is unforgeable under the intractability of
the SIS/ISIS problem.

  * C

Lemma 2: If the SIS/ISIS problem in lattice theory is interactable, the
proposed QS-LC-CPPA is secure against $\mathcal{A}_{2}$ adversary in ROM.
Proof: $\mathcal{C}$ generates parameters $\triangle$ shares to
$\mathcal{A}_{2}$. Besides, $\mathcal{C}$ gives the master secret key of TR to
$\mathcal{A}_{2}$. However, $\mathcal{A}_{2}$ cannot get a user’s secret key.
$\mathcal{C}$ maintains the lists $L_{H_{2}}$, $L_{H_{3}}$, $L_{pk}$ ,
$L_{psk}$ and $L_{sk}$ initially empty. Similar to lemma 1, $\mathcal{A}_{2}$
requests $H_{2}(.)$ and $H_{3}(.)$ oracles and get the outputs from
$\mathcal{C}$. However, the other queries are put by $\mathcal{A}_{2}$ in the
following manner:

  * •

Reveal $psk_{{ID}_{i}}$\- Queries: $\mathcal{A}_{2}$ puts $P_{{ID}_{i}}$ to
psk-Gen(.) oracle and $\mathcal{C}$ responds as follows:
(a) $\mathcal{C}$ scans $L_{psk}$ to get entry corresponding to
$P_{{ID}_{i}}$, if tuple $(P_{{ID}_{i}}$,$psk_{{ID}_{i}}$, $x_{i}$, $X_{i}$)
exists, $\mathcal{C}$ shares ($psk_{{ID}_{i}}$, $X_{i}$) to $\mathcal{A}_{2}$.
(b) Otherwise, if $P_{{ID}_{i}}$ $\neq$ $P^{*}_{{ID}_{i}}$, $\mathcal{C}$
picks $P_{{ID}_{i}}\in_{R}\mathbb{Z}_{q}^{m}$ and computes
$x_{i}$=$psk_{{ID}_{i}}$-$\gamma_{i}d$ and $X_{i}$ = $x_{i}^{T}A$, here
$\gamma_{i}\in L_{H_{2}}$. $\mathcal{C}$ shares $(psk_{{ID}_{i}}$, $X_{i}$) to
$\mathcal{A}_{2}$ and adds ($P_{{ID}_{i}}$ ,$psk_{{ID}_{i}}$, $x_{i}$,
$X_{i}$) to $L_{psk}$.
(c) If $P_{{ID}_{i}}$=$P_{{ID}^{*}_{i}}$, $\mathcal{C}$ responds $\perp$ and
abort.

  * •

Reveal $sk_{{ID}_{i}}$\- Queries: $\mathcal{A}_{2}$ puts $P_{{ID}_{i}}$ to sk-
Gen(.) oracle and obtains response as follows:
(a) $\mathcal{C}$ searches $L_{sk}$ to obtain a tuple ($P_{{ID}_{i}}$
,$psk_{{ID}_{i}}$, $x_{i}$, $X_{i}$, $pk^{1}_{{ID}_{i}}$, $a_{1}$). If the
tuple exists, response to $\mathcal{A}_{2}$ is $sk_{{ID}_{i}}$ =
$psk_{{ID}_{i}}$+$a_{1}$.
(b) Otherwise, If $P_{{ID}_{i}}\neq P_{{ID}^{*}_{i}}$, $\mathcal{C}$ obtains
($P_{{ID}_{i}}$, $psk_{{ID}_{i}}$, $x_{i}$, $X_{i}$)$\in L_{psk}$ and selects
$a_{i}$ $\in_{R}$ $Z^{m}_{q}$. Then, computes $sk_{{ID}_{i}}$ =
$psk_{{ID}_{i}}$+$a_{1}$ and $pk^{1}_{{ID}_{i}}$=$a^{T}_{i}A$. $\mathcal{C}$
adds ($P_{{ID}_{i}}$, $psk_{{ID}_{i}}$, $x_{i}$, $X_{i}$, $pk^{1}_{{ID}_{i}}$,
$a_{i}$) to $L_{sk}$ and shares $sk_{{ID}_{i}}$ to $A_{2}$.
(c) If $P_{{ID}_{i}}$=$P_{{ID}^{*}_{i}}$ , C responds $\perp$ and abort.

  * •

Reveal $pk_{{ID}_{i}}$-Queries: $\mathcal{A}_{2}$ puts $P_{{ID}_{i}}$ as input
and $\mathcal{C}$ searches the entry ($P_{{ID}_{i}}$, $pk_{{ID}_{i}}$)$\in
L_{pk}$, $\mathcal{C}$ picks it and shares wit $\mathcal{A}_{2}$. Otherwise,
does the following:
(a) If $P_{{ID}_{i}}\neq P_{{ID}^{*}_{i}}$, $\mathcal{C}$ runs
$psk_{{ID}_{i}}$-Gen(.) and $sk_{{ID}_{i}}$-Gen(.) oracles to get
($psk_{{ID}_{i}}$, $pk^{1}_{{ID}_{i}}$, $X_{i}$) and then sets
$pk_{{ID}_{i}}$=$pk^{1}_{{ID}_{i}}$+$X_{i}$ as the public key and adds
($P_{{ID}_{i}}$, $pk_{{ID}_{i}}$) to $L_{pk}$ and share to $\mathcal{A}_{2}$.
(b) If $P_{{ID}_{i}}$=$P_{{ID}^{*}_{i}}$, $\mathcal{C}$ picks $x_{i},y_{i}\in
Z^{m}_{q}$ and computes $X_{i}=x_{i}^{T}A$, $pk_{ID_{i}}=y^{T}_{i}A$ and sets
$pk^{1}_{ID_{i}}=pk_{ID_{i}}-X_{i}$. Then, $\mathcal{C}$ chooses
$\gamma_{i}\in_{R}\mathbb{Z}_{q}^{*}$ and sets
$\gamma_{i}$=$H_{2}(pk_{{ID}_{i}}$, $T_{i}$). Finally, $\mathcal{C}$ adds
($pk_{{ID}_{i}}$, $pk^{1}_{{ID}_{i}}$, $\perp$, $\gamma_{i}$, $X_{i}$) to
$L_{pk}$ and shares $pk_{{ID}_{i}}$ to $\mathcal{A}_{2}$.

  * •

$Cl_{{sig}}$-Gen Queries: $\mathcal{A}_{2}$ puts { $m_{i},P_{ID_{i}}$} to get
signature. $\mathcal{C}$ responds as follows:
(a) If $P_{{ID}_{i}}\neq P_{{ID}^{*}_{i}}$, Challeneger $\mathcal{C}$ picks {
$P_{ID_{i}}$, $\gamma_{i}$} $\in$ $L_{H_{2}}$ and
$\\{P_{ID_{i}},m_{i},R_{i},T_{i},\delta_{i}\\}$ $\in$ $L_{H_{3}}$. Then
$\mathcal{C}$ picks $\sigma_{i}$ $\in$ $Z_{q}^{m}$ and sets $pk_{{ID}_{i}}$ =
$\sigma_{i}^{T}A$-$\gamma_{i}P_{Pub}-\delta_{i}R_{i}$ and outputs
$\\{m_{i},\sigma_{i}\\}$ as a message signature pair to $\mathcal{A}_{2}$.
Everyone can verify that $\sigma_{i}^{T}A$ =
$pk_{{ID}_{i}}$+$\gamma_{i}P_{Pub}+\delta_{i}R_{i}$. Thus
$\\{m_{i},\sigma_{i}\\}$ simulated by $\mathcal{C}$ is indistinguishable from
the real one.
(b) If $P_{{ID}_{i}}$ = $P_{{ID}^{*}_{i}}$, $\mathcal{C}$ responds $\perp$ and
abort.

  * •

Forgery: Eventually, $\mathcal{A}_{2}$ outputs a forgery
{$m_{i}^{*},\sigma^{*}_{i}$} for a target $P_{{ID}^{*}_{i}}$ such that
$\sigma^{*T}_{i}A$ = $P_{{ID}^{*}_{i}}$ \+ $\sigma^{*}_{i}$ $P_{Pub}$ \+
$\delta^{*}_{i}$ $R_{i}$ holds and $P_{{ID}^{*}_{i}}\notin sk$-Gen(.) and
$\\{P_{{ID}^{*}_{i}},m_{i}\\}$ $\notin$ $CL_{sig}$-Gen(.).
By Forking lemma [37], $\mathcal{A}_{2}$ can output another signature
$\\{m_{i}^{*},\sigma_{i}^{**}\\}$ for the targeted $P_{{ID}^{*}_{i}}$ with
different $\sigma_{i}^{**}$, which satisfies

$\sigma_{i}^{**T}A=Pk_{{ID}^{*}_{i}}+\gamma_{i}^{*}P_{Pub}+\sigma_{i}^{**}R_{i}$
$\implies(\sigma_{i}^{*}-\sigma_{i}^{**})^{T}A=(\sigma_{i}^{*}-\sigma_{i}^{**})R_{i}=(\delta_{i}^{*}-\delta_{i}^{**})r_{i}^{T}A$

$\implies
r_{i}=(\delta_{i}^{*}-\delta_{i}^{**})^{-1}(\sigma_{i}^{*}-\sigma_{i}^{**})$
mod $q$, which is a solution to ISIS problem with instance
$(R_{i}=r_{i}^{T}A,A)$, i.e., a contradiction has been obtained.

Thus, the suggested scheme $CL_{sign}$ is unforgeable under the hardness
assumption of the SIS/ISIS problem.

###  IV-C Security Analysis

This segment introduces a thorough discussion of informal security analysis.

  1. 1.

Authentication/Integrity: From the proof of Lemma 1 and Lemma 2, it has been
justified that the proposed QS-CL-CPPA scheme is strongly unforgeable against
stronger adversaries $\mathcal{A}_{1}$ and $\mathcal{A}_{2}$. Thus, only
legitimate vehicles can create a signature on safety-related information.
Therefore, the receiver is convinced about the authenticity of the information
and source. As the signature verification can be checked by
$\sigma^{T}A=pk_{ID}+\gamma P_{Pub}+\delta R$. Thus, modification to the
message will result in the rejection of signature verification. Therefore, the
integrity of the message has been achieved.

  2. 2.

Anonymtiy: During $P_{ID}-Gen(.)$, the real ID $(R_{ID})$ of the node is
encrypted as $P_{ID}$ = $R_{ID}\oplus H_{1}(pk^{1}_{ID},d,T_{i})$. To recover
real identity $(R_{ID})$, the value $H_{1}(pk^{1}_{ID},d,T)$ is required.
Here, $d$ is the master secret key of TA. Thus, only TA can reclaim any node’s
real ID $(R_{ID})$. Therefore, the proposed QS-CL-CPPA scheme is anonymous.

  3. 3.

Conditional Traceability: As per the discussion, real ID $(R_{ID})$ of a node
is anonymised by computing $P_{ID}$=$R_{ID}\oplus
H_{1}(pk^{1}_{{ID}_{i}},d,T)$. Thus, in case of dispute or accident, TA can
find $(R_{ID})$=$P_{ID}\oplus H_{1}(pk^{1}_{ID},d,T)$ as $d$ is the master
private key of TA. Therefore, the proposed QS-CL-CPPA scheme provides
conditional traceability.

  4. 4.

Resistance Against Various Attacks:

  5. *

Modification Attack: According to the discussion, to verify the authenticity
of (message, signature) pair, the receiver has to check
$\sigma^{T}A=pk_{ID}+\gamma P_{Pub}+\delta R$. Thus, modification to the
message/signature will result in verification rejection. Therefore, the
proposed QS-CL-CPPA scheme is robust against this attack.

  6. *

Impersonation attack: To impersonate the signing process, the attacker has to
create a forgery on a targeted message/identity. However, proof of Lemma 1 and
Lemma 2 shows that the QS-CL-CFPA scheme is unforgeable under SIS/ISIS
problem. Thus, impersonation tack is unsuccessful.

  7. *

Replay attack: Based on the design of the construction, time stamps have been
utilized during $P_{ID}$ and signature generation. Thus, the freshness of the
timestamp can be detected to resist this attack.

##  V Performance Analysis

The rapid change in the VANET topology necessitates enhanced performance
concerning computational cost and communication complexity. Thus, this section
details the performance analysis of the proposed QS-CL-CPPA scheme by
comparison with the most related state-of-the-art schemes [2, 31, 32], and
[33]. To achieve the security level of 123 bits corresponding to SIS/ISIS
problem, the basic setup parameters have been taken from [2]. Thus, module $q$
is set at 101, and row and column numbers of the master public key are 100 and
666, respectively, where $A\in Z^{m\times n}$ is the master public key.

###  V-A Compuational cost Analysis

Since the work by Li et al.’s [2] has been followed, the execution time of
various basic cryptographic operations is provided in Table III. Each
operation is defined as:

$E_{\text{add-$v_{k}$ }}$: Execution time of vector addition of dimension k in
$\mathbb{Z}_{q}$.
$E_{\text{add-$v_{n}$ }}$: Execution time of vector addition of dimension n in
$\mathbb{Z}_{q}$.
$E_{\text{add-$v_{m}$ }}$: Execution time of vector addition of dimension m in
$\mathbb{Z}_{q}$.
$E_{\text{mul-$v_{q}$cx}}$: Execution time of d * x mod q where vector x
$\in\mathbb{Z}_{q}^{m}$ and d $\in\mathbb{Z}_{q}$.
$E_{\text{mul-$v_{q}$dy}}$: Execution time of c * y mod q where vector y
$\in\mathbb{Z}_{q}^{n}$ and c $\in\mathbb{Z}_{q}$.
$E_{\text{mul-$v_{q}$A}}$: Execution time of mul of a vector and matrix(nxm)
on mod q.
$E_{\text{mul-$v_{q}$xA}}$: Run time of $A.x$ mod $q$, where
$x\in\mathbb{Z}_{q}^{k}$ and matrix A $\in\mathbb{Z}_{q}^{m\times k}$
$E_{\text{mul-$v_{q}$yA}}$: Execution time of $Ay$ mod $q$, where
$y\in\mathbb{Z}_{q}^{k}$ and matrix $A\in\mathbb{Z}_{q}^{n\times k}$
$E_{\text{mul-mat }}$: Execution time of matrix multiplication on mod $q$.
$E_{\text{h}}$: Denotes the hashing function’s run time.
$E_{\text{xor}}$: Displays the run time for performing the XOR operation of
two vectors.
$E_{\text{sp}}$: Execution time of sampling the random vector.
$E_{\text{sol-eq }}$: Execution time of the equation $AB=0$ mod $q$, where $B$
is the solution of the equation set.

TABLE III: Cryptographic Operations with Execution time  Cryptographic Operation | Execution Time (in milliseconds)
---|---
$E_{\text{add-$v_{k}$ }}$ | 0.47
$E_{\text{add-$v_{n}$ }}$ | 0.059
$E_{\text{add-$v_{m}$ }}$ | 0.385
$E_{\text{mul-$v_{q}$cx}}$ | 0.697
$E_{\text{mul-$v_{q}$dy}}$ | 0.074
$E_{\text{mul-$v_{q}$A}}$ | 48
$E_{\text{mul-$v_{q}$xA}}$ | 6
$E_{\text{mul-$v_{q}$yA}}$ | 28
$E_{\text{mul-mat }}$ | 419
$E_{\text{h}}$ | 0.006
$E_{\text{xor}}$ | 0.0002
$E_{\text{sp}}$ | 15
$E_{\text{sol-eq }}$ | 28000

In the proposed QS-CL-CPPA scheme, we refer three phases $CL_{sig}-Gen()$,
$CL_{sig}-Ver()$, and $Batch-CL_{sig}-Ver$ for discussion of computational
costs analysis. In the phase $CL_{sig}-Gen()$, the proposed QS-CL-CPPA scheme
consumes 49.473 ms., while the state-of-the-art schemes [2, 31, 32], and [33]
consume 447.391 ms., 49.785 ms., 50.184 ms., and 49.785 ms. respectively
(Table IV). Thus, the $CL_{sig}-Gen()$ phase of the proposed QS-CL-CPPA scheme
is better (Fig. 3) than the compared ones. Single signature verification has
been considered in the phase $CL_{sig}-Ver()$. The QS-CL-CPPA scheme takes
49.467 ms. and related literature [2, 31, 32], and [33] consume 60.118 ms.,
49.779 ms., 49.785 ms., and 49.779 ms. respectively (Table IV). Thus, the
scheme in QS-CL-CPPA consumes the least cost (Fig. 4), i.e. phase
$CL_{sig}-Ver()$ is also better than the related schemes. For the phase
$Batch-CL_{sig}-Ver$, the batch sizes 50, 100, 150, 200, 250, and 300 have
been taken. As per Fig. 5, the proposed QS-CL-CPPA scheme takes the least
computational cost in this phase.

TABLE IV: Comparison of Computational Cost Schemes | $CL_{sig}-Gen()$ | $CL_{sig}-Ver()$ | $Batch-CL_{sig}-Ver$
---|---|---|---
Li et al. [2] | $\begin{array}[]{l}E_{{h}}+\\\ E_{{add}-{v_{m}}}+.\\\ E_{\text{{m u l }-{$v_{q}$ y A}}}+\\\ E_{mul-mat}\approx\\\ 447.391{~{}ms}\end{array}$ | $\begin{array}[]{l}E_{\text{m u l-$v_{q}$ A }}+\\\ 2E_{\text{{m u l}-{$v_{q}$ x A} }}+\\\ 2E_{\text{{a d d}-{$v_{n}$} }}\approx\\\ 60.118ms\end{array}$ | $\begin{array}[]{l}2NE_{\text{{m u l}-{$v_{q}$ x A} }}+\\\ 3NE_{\text{{m u l }-{$v_{q}$ d y} }}+\\\ NE_{\text{{m u l }-{$v_{q}$ c x} }}+\\\ E_{\text{m u l-$v_{q}$ A }}+(3N+2)\\\ E_{\text{{a d d}-{$v_{n}$} }}+\\\ NE_{\text{a d d}-{v_{m}}}\approx\\\ 48.815+12.784N{~{}ms}\end{array}$
Mukherjee et al. [31] | $\begin{array}[]{l}\\\ E_{\text{m u l-$v_{q}$ A }}+\\\ E_{{h}}+2E_{\text{{m u l }-{$v_{q}$ c x}}}+\\\ E_{\text{a d d}-{v_{m}}}\approx\\\ 49.785{~{}ms}\end{array}$ | $\begin{array}[]{ll}E_{\text{m u l-$v_{q}$ A }}+&\\\ 2E_{\text{{m u l }-{$v_{q}$ c x} }}+&\\\ E_{\text{a d d - $v_{m}$ }}&\approx\\\ 49.779{~{}ms}&\end{array}$ | $\begin{array}[]{l}E_{{mul}-{v_{q}A}}+2(3N+1)\\\ \text{E}_{{mul}-{v_{q}cx}}+\\\ NE_{add-v_{m}}\approx\\\ 49.394+4.57N{~{}ms}\end{array}$
Liu et al. [32] | $\begin{array}[]{l}\\\ E_{\text{m u l-$v_{q}$ A }}+\\\ 3E_{{h}}+E_{{xor}}+\\\ \text{2}E_{{mul}-{v_{q}cx}}+\\\ +2E_{\text{a d d}-{v_{m}}}\approx\\\ 50.184{~{}ms}\end{array}$ | $\begin{array}[]{ll}E_{\text{m u l-$v_{q}$ A }}+&\\\ 2E_{\text{{m u l }-{$v_{q}$ c x}}}+\\\ E_{{h}}+&\\\ E_{\text{a d d - $v_{m}$ }}&\approx\\\ 49.785{~{}ms}&\end{array}$ | $\begin{array}[]{l}E_{{mul}-{v_{q}A}}+2(3N+1)\\\ E_{\text{{m u l }-{$v_{q}$ c x}}}+\\\ 2NE_{add-v_{m}}\approx\\\ 49.394+4.952N{~{}ms}\end{array}$
Dharminder et al. [33] | $\begin{array}[]{l}E_{\text{m u l-$v_{q}$ A }}+E_{{h}}+\\\ 2E_{\text{{m u l }-{$v_{q}$ c x}}}+\\\ E_{\text{a d d}-{v_{m}}}\approx\\\ 49.785{~{}ms}\end{array}$ | $\begin{array}[]{ll}E_{\text{m u l-$v_{q}$ A }}+&\\\ 2E_{\text{{m u l }-{$v_{q}$ c x} }}+&\\\ E_{\text{m u l-$v_{m}$ }}&\approx\\\ 49.779{~{}ms}&\end{array}$ | $\begin{array}[]{l}E_{{mul}-{v_{q}A}}+2(3N+1)\\\ \text{E}_{{mul}-{v_{q}cx}}+\\\ NE_{add-v_{m}}\approx\\\ 48.394+4.567N{~{}ms}\end{array}$
$\begin{array}[]{l}\text{QS-CL-CPPA }\\\ \text{scheme }\end{array}$ | $\begin{array}[]{l}E_{\text{m u l-$v_{q}$ A }}+\ E_{\text{h }}+\\\ E_{\text{m u l-$v_{q}$ c x }}+\\\ 2E_{\text{a d d }-{v_{m}}}\approx\\\ 49.473{~{}ms}\end{array}$ | $\begin{array}[]{ll}E_{\text{m u l-$v_{q}$ A }}&+\\\ E_{\text{{m u l}-{$v_{q}$ c x}}}+&\\\ 2E_{\text{a d d}-{v_{m}}}&\approx\\\ 49.467{~{}ms}&\end{array}$ | $\begin{array}[]{l}E_{\text{m u l-$v_{q}$ A }}+(3N+1)\\\ E_{\text{{m u l }-{$v_{q}$ c x} }}+\\\ 2NE_{{add}-{v_{m}}}\approx\\\ 48.697+2.681N{~{}ms}\end{array}$
---
Figure 3: Computational cost Sign (OBU)
---
Figure 4: Computational cost Single Sign-Verify
---
Figure 5: Computational cost Batch Verification

###  V-B Communication Cost Analyses

TABLE V: Comparison of Communication Cost Schemes | $\begin{array}[]{l}\text{Msg-Sig}\\\ \text{Pair}\end{array}$ | $\begin{array}[]{l}\text{N Msg-Sig}\\\ \text{Pairs}\end{array}$
---|---|---
Li et al. [2] | 7757 | $7757^{*}{~{}N}$
Mukherjee et al. [31] | 850 | $850^{*}{~{}N}$
Liu et al. [32] | 850 | $850^{*}{~{}N}$
Dharminder et al. [33] | 850 | $850^{*}{~{}N}$
QS-CL-CPPA | 762 | $762^{*}{~{}N}$

To discuss the communication cost analysis, we consider the same notation of
anonymous ID as $ANS_{i}$, given in most related literature. In the CPPA
protocol of Li et al. [2], the final signature is sent by a user to other
nearby nodes $(ANS_{i},T_{i},{Z}_{i},sig_{i})$. Since
$ANS_{i}=({ASN}_{i,1},{ANS}_{i,2})$ and ${ANS}_{i,2}$ $=RID\oplus
H_{1}({S}_{{i}})\bmod q,{ANS}_{i,2}$ are random elements in ${Z}_{q}^{n}$,
authors took all values of ${ANS}_{i,2}$ be $q-1$ to maximize the size of
${ANS}_{i,2}$. likewise, ${ANS}_{i,1}$ is chosen randomly from ${Z}_{q}^{n}$,
the maximum size of $ANS_{i}$, which is $2n*\log_{2}(q-1)$ = 1400 bits. Also
the maximum size of ${Z}_{i}$ is $n*k*\log_{2}(q-1)$ = 56000 bits, for vector
is $q-1$ and for $\operatorname{sig}_{i}$ is $m*\log_{2}(q-1)$ = 4662 bits.
Therefore, the maximum size of the total signature
$\left(ANS_{i},T_{i},\mathbf{Z}_{i},\operatorname{sig}_{i}\right)$ is approx
7757 bytes.

In the Mukherjee et al.’s CPPA scheme [31], the maximum size of $ANS_{i}$ is
$2*n*\log_{2}(q-1)$ = 1400 bits and that of $\mathbf{R}_{i}$ is
$n*\log_{2}(q-1)$ = 700 bits and for $\sigma_{i}$, the maximum size is
$m*\log_{2}(q-1)$ = 4662 bits. Therefore, the signature (
$\left.M_{i},ANS_{i},T_{i},\mathbf{R}_{i},\sigma_{i}\right)$ has a maximum
size of approximately 846 + 4 = 850 bytes.

In the Liu et al. scheme [32], the maximum size of $ANS_{i}$ is
$2*n*\log_{2}(q-1)$ = 1400 bits and that of $\mathbf{R}_{i}$ is
$n*\log_{2}(q-1)$ = 700 bits and the size of $\sigma_{i}$ is $m*\log_{2}(q-1)$
=4662 bits. Therefore, the overall signature (
$\left.M_{i},ANS_{i},T_{i},\mathbf{R}_{i},\sigma_{i}\right)$ has a maximum
size of approximately 846 + 4 = 850 bytes.

In the CPPA protocol of Dharminder et al. [33], the maximum size of $ANS_{i}$
is $2*n*\log_{2}(q-1)$ = 1400 bits and that of $\mathbf{R}_{i}$ is
$n*\log_{2}(q-1)$ = 700 bits. Also, the maximum size of $\sigma_{i}$ is
$m*\log_{2}(q-1)$ = 4662 bits. Therefore, the final signature (
$\left.Aid_{i},T_{i},\mathbf{R}_{i},\sigma_{i}\right)$ has a maximum size of
approx 846 + 4, which equals to 850 bytes.

In the QS-CL-CPPA scheme, the final signature sent by one node to the other
nodes is $(P_{{ID}_{i}},T_{i},\mathbf{R}_{i},\sigma_{i})$. The maximum size of
$P_{{ID}_{i}}$ was calculated as $n*\log_{2}(q-1)$ = 700 bits and total size
of $\mathbf{R}_{i}$ is $n*\log_{2}(q-1)$ = 700 bits. Additionally, the maximum
size for $\sigma_{i}$ turned out $m*\log_{2}(q-1)$ = 4662 bits. Therefore, in
the $QS-CL-CPPA$ protocol, the overall signature
$(P_{{ID}_{i}},T_{i},\mathbf{R}_{i},\sigma_{i})$ has a maximum size of
approximately 757.75 + 4 = 761.75 bytes.

The comparison result of communication costs of the above four schemes [2],
[31], [32], [33] with this scheme is displayed in Table V. Overall, this
comparison shows that our QS-CL-CPPA scheme has less communication cost than
the compared ones.

Thus, as per the above analysis, the proposed QS-CL-CPPA scheme is better in
terms of both computational cost and communication cost than the state-of-the-
art [2], [31], [32], [33]. Besides, according to Table I, the proposed QS-CL-
CPPA scheme has better security as the secret key of the vehicle is not
generated by TA, and the secret key of TA is not given to the vehicle.
Therefore, the proposed QS-CL-CPPA scheme is the most suitable design to
deploy for post-quantum scenarios on VANETs.

##  VI Conclusion

To improve safety in traffic systems, the paradigm of VANETs has been
introduced by the amalgamation of communication technologies and automobile
technologies. However, wireless channels in VANETs are prone to adversarial
attacks. This paper introduced a novel and efficient QS-CL-CPPA scheme to
diminish such attacks. The devised QS-CL-CPPA scheme addresses the potential
flaws of master secret-key leakage and key-escrow problems in the existing
literature. Relying on the hardness of SIS/ISIS problem, the security analysis
validates its resistance to forgery attacks. Employing the batch signature
technique leads to notable efficiency enhancements in the proposed QS-CL-CPPA.
A comprehensive comparison of the proposed QS-CL-CPPA scheme to the state-of-
the-art schemes discloses that this scheme can eliminate the drawbacks of a
post-quantum scenario. Lastly, a rigorous analysis of performance analysis
assessment of the scheme reflects its suitability for deployment in VANETs.

The proposed QS-CL-CPPA scheme needs a secure channel to establish the key of
a user. Thus, as a future work, this limitation should be eliminated.

## References

  * [1] C. C. Lee, Y. M. Lai and P. J. Cheng, ”An Efficient Multiple Session Key Establishment Scheme for VANET Group Integration,” in IEEE Intelligent Systems, vol. 31, no. 6, pp. 35-43, Nov.-Dec. 2016, doi: 10.1109/MIS.2016.97.
  * [2] Q. Li, D. He, Z. Yang, Q. Xie and K. -K. R. Choo, ”Lattice-Based Conditional Privacy-Preserving Authentication Protocol for the Vehicular Ad Hoc Network,” in IEEE Transactions on Vehicular Technology, vol. 71, no. 4, pp. 4336-4347, April 2022, doi: 10.1109/TVT.2022.3147875.
  * [3] C.-C. Lee and Y.-M. Lai, “Toward a secure batch verification with group testing for VANET,” Wireless Netw., vol. 19, no. 6, pp. 1441–1449, 2013.
  * [4] J. P. Hubaux, S. Capkun and Jun Luo, ”The security and privacy of smart vehicles,” in IEEE Security & Privacy, vol. 2, no. 3, pp. 49-55, May-June 2004, doi: 10.1109/MSP.2004.26.
  * [5] Li, Wenmin, et al.. ”An efficient and secure mobile payment protocol for restricted connectivity scenarios in vehicular ad hoc network.” Computer Communications 35.2 (2012): 188-195.
  * [6] Raya, Maxim, and Jean-Pierre Hubaux. ”Securing vehicular ad hoc networks.” Journal of computer security 15.1 (2007): 39-68.
  * [7] X. Lin, X. Sun, P. -H. Ho and X. Shen, ”GSIS: A Secure and Privacy-Preserving Protocol for Vehicular Communications,” in IEEE Transactions on Vehicular Technology, vol. 56, no. 6, pp. 3442-3456, Nov. 2007, doi: 10.1109/TVT.2007.906878.
  * [8] R. Lu, X. Lin, H. Zhu, P. . -H. Ho and X. Shen, ”ECPP: Efficient Conditional Privacy Preservation Protocol for Secure Vehicular Communications,” IEEE INFOCOM 2008 - The 27th Conference on Computer Communications, Phoenix, AZ, USA, 2008, pp. 1229-1237, doi: 10.1109/INFOCOM.2008.179.
  * [9] C. Zhang, X. Lin, R. Lu and P. . -H. Ho, ”RAISE: An Efficient RSU-Aided Message Authentication Scheme in Vehicular Communication Networks,” 2008 IEEE International Conference on Communications, Beijing, China, 2008, pp. 1451-1457, doi: 10.1109/ICC.2008.281.
  * [10] C. Zhang, R. Lu, X. Lin, P. . -H. Ho and X. Shen, ”An Efficient Identity-Based Batch Verification Scheme for Vehicular Sensor Networks,” IEEE INFOCOM 2008 - The 27th Conference on Computer Communications, Phoenix, AZ, USA, 2008, pp. 246-250, doi: 10.1109/INFOCOM.2008.58.
  * [11] Y. Sun, R. Lu, X. Lin, X. Shen, and J. Su, “An efficient pseudonymous authentication scheme with strong privacy preservation for vehicular communications,” IEEE Transactions on Vehicular Technology, vol. 59, no. 7, pp. 3589–3603, 2010.
  * [12] D. Huang, S. Misra, M. Verma, and G. Xue, “PACP: an efficient pseudonymous authentication-based conditional privacy protocol for vanets,” IEEE Trans. Intell. Transp. Syst., vol. 12, no. 3, pp. 736–746, 2011\.
  * [13] T. W. Chim, S. Yiu, L. C. K. Hui, and V. O. K. Li, “SPECS: secure and privacy-enhancing communications schemes for vanets,” Ad Hoc Networks, vol. 9, no. 2, pp. 189–203, 2011.
  * [14] K. A. Shim, ”CPAS: an efficient conditional privacy-preserving authentication scheme for vehicular sensor networks”, IEEE transactions on vehicular technology, vol. 61(4), pp. 1874-1883, 2012.
  * [15] J. K. Liu, T. H. Yuen, M. H. Au, and W. Susilo, ”Improvements on an authentication scheme for vehicular sensor networks”, Expert Systems with Applications, vol. 41(5), pp. 2559-2564, 2014.
  * [16] Liu, Y., Wang, L. and Chen, H.H., ”Message authentication using proxy vehicles in vehicular ad hoc networks”, IEEE Transactions on vehicular technology, vol. 64(8), pp.3697-3710, 2014.
  * [17] J. Li, H. Lu and M. Guizani, ”ACPN: A Novel Authentication Framework with Conditional Privacy-Preservation and Non-Repudiation for VANETs,” in IEEE Transactions on Parallel and Distributed Systems, vol. 26, no. 4, pp. 938-948, April 2015, doi: 10.1109/TPDS.2014.2308215.
  * [18] D. He, S. Zeadally, B. Xu and X. Huang, ”An Efficient Identity-Based Conditional Privacy-Preserving Authentication Scheme for Vehicular Ad Hoc Networks,” in IEEE Transactions on Information Forensics and Security, vol. 10, no. 12, pp. 2681-2691, Dec. 2015, doi: 10.1109/TIFS.2015.2473820.
  * [19] Horng, Shi-Jinn, et al.. ”An efficient certificateless aggregate signature with conditional privacy-preserving for vehicular sensor networks.” Information Sciences 317 (2015): 48-66.
  * [20] M. Azees, P. Vijayakumar and L. J. Deboarh, ”EAAP: Efficient Anonymous Authentication With Conditional Privacy-Preserving Scheme for Vehicular Ad Hoc Networks,” in IEEE Transactions on Intelligent Transportation Systems, vol. 18, no. 9, pp. 2467-2476, Sept. 2017, doi: 10.1109/TITS.2016.2634623.
  * [21] M. Kazemi, M. Delavar, J. Mohajeri and M. Salmasizadeh, ”On the Security of an Efficient Anonymous Authentication with Conditional Privacy-Preserving Scheme for Vehicular Ad Hoc Networks,” Electrical Engineering (ICEE), Iranian Conference on, Mashhad, Iran, 2018, pp. 510-514, doi: 10.1109/ICEE.2018.8472484.
  * [22] Ogundoyin, Sunday Oyinlola. ”An autonomous lightweight conditional privacy-preserving authentication scheme with provable security for vehicular ad-hoc networks.” International Journal of Computers and Applications 42.2 (2020): 196-211.
  * [23] J. Huang, Y. Qian and R. Q. Hu, ”Secure and Efficient Privacy-Preserving Authentication Scheme for 5G Software Defined Vehicular Networks,” in IEEE Transactions on Vehicular Technology, vol. 69, no. 8, pp. 8542-8554, Aug. 2020, doi: 10.1109/TVT.2020.2996574.
  * [24] J. Zhang, J. Cui, H. Zhong, Z. Chen and L. Liu, ”PA-CRT: Chinese Remainder Theorem Based Conditional Privacy-Preserving Authentication Scheme in Vehicular Ad-Hoc Networks,” in IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 2, pp. 722-735, 1 March-April 2021, doi: 10.1109/TDSC.2019.2904274.
  * [25] Q. Mei, H. Xiong, J. Chen, M. Yang, S. Kumari and M. K. Khan, ”Efficient Certificateless Aggregate Signature With Conditional Privacy Preservation in IoV,” in IEEE Systems Journal, vol. 15, no. 1, pp. 245-256, March 2021, doi: 10.1109/JSYST.2020.2966526.
  * [26] Samra, Bouakkaz, and Semchedine Fouzi. ”New efficient certificateless scheme-based conditional privacy preservation authentication for applications in VANET.” Vehicular Communications 34 (2022): 100414.
  * [27] Zhou, Xiaotong, Min Luo, Pandi Vijayakumar, Cong Peng, and Debiao He. ”Efficient certificateless conditional privacy-preserving authentication for VANETs.” IEEE Transactions on Vehicular Technology 71, no. 7 (2022): 7863-7875.
  * [28] Xiaoxue Liu, Yichuan Wang, Yanping Li, Hao Cao, ”PTAP: A novel secure privacy-preserving & traceable authentication protocol in VANETs,”, Computer Networks, Volume 226, 2023, pp. 109643.
  * [29] Z. Bao, D. He, H. Wang, M. Luo and C. Peng, ”BAP: A Blockchain-Assisted Privacy-Preserving Authentication Protocol With User-Controlled Data Linkability for VANETs,” in IEEE Transactions on Intelligent Vehicles, doi: 10.1109/TIV.2023.3307699.
  * [30] F. Zhu, X. Yi, A. Abuadbba, I. Khalil, X. Huang and F. Xu, ”A Security-Enhanced Certificateless Conditional Privacy-Preserving Authentication Scheme for Vehicular Ad Hoc Networks,” in IEEE Transactions on Intelligent Transportation Systems, doi: 10.1109/TITS.2023.3275077.
  * [31] Mukherjee, S., Gupta, D.S. & Biswas, G.P. An efficient and batch verifiable conditional privacy-preserving authentication scheme for VANETs using lattice. Computing 101, 1763–1788 (2019). https://doi.org/10.1007/s00607-018-0689-3
  * [32] Liu, Hui, et al.. ”A secure lattice-based anonymous authentication scheme for VANETs.” Journal of the Chinese Institute of Engineers 42.1 (2019): 66-73.
  * [33] Dharminder, Dharminder, and Dheerendra Mishra. ”LCPPA: Lattice‐based conditional privacy-preserving authentication in vehicular communication.” Transactions on Emerging Telecommunications Technologies 31.2 (2020): e3810.
  * [34] P. W. Shor, ”Algorithms for quantum computation: discrete logarithms and factoring,” Proceedings 35th Annual Symposium on Foundations of Computer Science, Santa Fe, NM, USA, 1994, pp. 124-134, doi: 10.1109/SFCS.1994.365700.
  * [35] Ali, Ikram, and Fagen Li. ”An efficient conditional privacy-preserving authentication scheme for Vehicle-To-Infrastructure communication in VANETs.” Vehicular Communications 22 (2020): 100228.
  * [36] Al-Riyami, Sattam S., and Kenneth G. Paterson. ”Certificateless public key cryptography.” In International conference on the theory and application of cryptology and information security, pp. 452-473. Berlin, Heidelberg: Springer Berlin Heidelberg, 2003.
  * [37] Bellare, Mihir, Wei Dai, and Lucy Li. ”The local forking lemma and its application to deterministic encryption.” Advances in Cryptology–ASIACRYPT 2019: 25th International Conference on the Theory and Application of Cryptology and Information Security, Kobe, Japan, December 8–12, 2019, Proceedings, Part III 25. Springer International Publishing, 2019.