Juxiu Zhong^*, Rongbo Lu^*, Wei Li
School of Computer and Artificial Intelligence, Huaihua University, Huaihua, China.
DOI: 10.4236/jqis.2026.163014   PDF    HTML   XML   9 Downloads   86 Views   Citations

Abstract

Traditional digital signatures are based on mathematical hard problems that are vulnerable to quantum attacks. For privacy-sensitive applications such as electronic cash and electronic voting, partially blind signatures are preferable because they protect private messages while allowing signers to verify necessary public information. This paper proposes an identity-based quantum partially blind signature scheme based on quantum teleportation. Each signing session is assigned a unique identifier. The user blinds the private binary message by applying Pauli-X operations with a one-time random string, while public information remains visible to the signer. A trusted PKG performs identity authentication, signature authorization, session-key distribution, and time-period-based key lifecycle management. Quantum tags and quantum authentication codes provide verification and arbitration evidence, while quantum teleportation is used to transmit quantum information. In case of disputes, an arbitrator can verify independently stored quantum evidence, and channel monitoring enables the detection of eavesdropping and tampering. Security analysis shows that the proposed scheme satisfies partial blindness, unforgeability, and non-repudiation, and resists malicious third-party attacks. It is suitable for privacy-preserving and restricted-authorization applications such as electronic cash and electronic voting.

Keywords

Quantum Teleportation, Partially Blind Quantum Signature, Quantum Tag, Quantum Arbitration

Share and Cite:

1. Introduction

Digital signatures are a core cryptographic mechanism in modern information security systems for achieving identity authentication, data integrity, non-forgeability, and non-repudiation. Following the introduction of public-key cryptography by Diffie and Hellman in 1976, the development of digital signatures was driven by the introduction of schemes such as the RSA signature scheme, the ElGamal signature, the Schnorr signature, and short signatures based on bilinear pairs [1]-[6]. However, the security of RSA, DSA, and Schnorr-type schemes primarily relies on integer factorization or the discrete logarithm problem, and Shor’s algorithm demonstrates that large-scale quantum computers with sufficient fault tolerance can solve these problems in polynomial time [7]. Consequently, in recent years, the focus of research has shifted significantly from optimizing the efficiency of classical signatures to the design, standardization, and migration implementation of post-quantum signatures, encompassing post-quantum signature approaches such as lattice, hash, coding, and multivariate schemes [8]. The advancement of quantum computing poses a fundamental threat to cryptosystems based on traditional number-theoretic problems [7] [9]. Against this backdrop, quantum signature schemes based on the principles of quantum mechanics have emerged; their security relies on physical properties such as the quantum no-cloning theorem and quantum entanglement, rather than the computational complexity of mathematical problems [10].

Blind signatures allow signers to complete a signature without knowing the content of the original message. The concept was first proposed by Chaum in 1983; its core feature is that the signer cannot see the specific content of the message being signed, and it is widely used in scenarios such as anonymous electronic cash, privacy-preserving authentication, and electronic voting [11]. Quantum blind signatures utilize mechanisms such as non-clonability, quantum one-time pad, and quantum key distribution to achieve the security properties of the signature scheme [12]. Early research on quantum blind signatures primarily focused on entanglement resources, trusted arbitration, verification efficiency, and anonymity [13]-[15]. Subsequently, entanglement-free quantum group-blind signatures and schemes based on BB84 single-photon states were proposed to enhance the anonymity of electronic voting and reduce the difficulty of quantum state preparation [16] [17]. In recent years, research in this field has continued to focus on protocol innovation while placing greater emphasis on applications, resource overhead, and formal security: In 2022, Luo et al. applied controlled quantum teleportation to proxy blind signatures [18]. In 2024, Gupta et al. constructed an electronic cash transaction scheme based on quantum blind signatures [19]. In 2025, Wang et al. proposed a bit-by-bit quantum blind signature protocol based on single-qubit rotations, utilizing qubit rotations to perform message obfuscation and signing, thereby reducing the complexity of the signing process, minimizing reliance on large amounts of quantum resources, and lowering implementation costs [20]. In 2026, Zhang et al. analyzed quantum blind signatures in supply chain finance, revealing risks such as insider attacks and entanglement measurement attacks. They constructed a security model and formally characterized the security properties of the improved scheme through four security games [21].

Although fully blind signatures can conceal the message and its session context, they make it difficult to restrict the use of the signature, which may be exploited by malicious requesters for unauthorized purposes. Partially blind signatures enhance controllability while maintaining blindness by binding public information—such as expiration dates or business categories—to private messages. In 1996, Abe and Fujisaki proposed the concept of partial blinding, which incorporates public attributes into blind signatures [22]; in 2000, Abe and Okamoto further provided a formal definition of partial blind signatures, defined completeness, partial blindness, and unforgeability, and constructed a classically provably secure scheme [23]. In the realm of quantum partially blind signatures, Cai and Niu were among the first to propose a partially blind signature scheme based on quantum cryptography, which attempts to balance the protection of private messages with control over the use of signatures by utilizing pre-negotiated shared information [24]. After analyzing existing quantum partially blind signature schemes, Zhong et al. proposed a quantum partially blind signature scheme that does not require entangled states, with the scheme’s security guaranteed by a secure quantum key distribution protocol and quantum one-time pad [25]. In contrast to the relatively limited literature on quantum partial blind signatures, the past five years have seen more systematic, provably secure research on classical post-quantum partial blind signatures. For example, in 2024, Katsumata et al. constructed the homomorphic cryptographic blind signature and partial blind signature scheme CSI-Otter based on the CSIDH group action [26], In 2026, Kuchta et al. constructed the post-quantum blind signature scheme MEBS based on the equivalence group action of the MEDS matrix code and extended it to a partial blind signature [27].

Identity-based signatures use an identity string as public verification information, which can reduce the certificate management overhead of traditional public-key infrastructure [28]. Since Shamir proposed identity-based cryptosystems and the concept of identity signatures in 1984, this technology has been widely applied in cloud computing, the Internet of Things, and lightweight authentication systems [29]. Identity-based quantum signatures integrate identity mapping with quantum cryptography, simplifying certificate management while leveraging the properties of quantum mechanics to enhance security [30]. In 2020, Xin et al. proposed an identity-based quantum signature based on Bell states, enabling verifiers to complete verification using the signer’s identity [31]. In the same year, they further developed an identity-based public-key quantum signature scheme that does not require long-term quantum storage and exhibits high efficiency in quantum key exchange [32]. In 2023, Huang et al. improved upon related schemes by generating a private key based on the signer’s identity and combining it with the verifier’s secret parameter to generate the signature; this eliminated the need for key exchange prior to signing, thereby improving protocol execution efficiency [33]. In 2024, Prajapat et al. constructed an identity-based quantum designated-verifier signature and analyzed its feasibility through quantum simulation [34]; Liu et al. further proposed an identity-based quantum signature scheme using Bell states, which reduced the implementation complexity by employing a classical bit string key and supporting key reuse [35]. In 2025, Mohanty et al. proposed an identity-based quantum signature scheme and verified its correctness and preliminary feasibility through instance runs on the IBM Qiskit simulator and the IBM Q Lima real quantum backend [36].

Quantum teleportation utilizes pre-shared entanglement, Bell-basis joint measurements, and classical auxiliary information to reconstruct the corresponding quantum state at a remote location without directly transmitting the original particle carrying the unknown input state. Bennett et al. first proposed the quantum teleportation protocol in 1993 [37]. Zeng and Keitel proposed an early quantum arbitration signature scheme by combining GHZ states, quantum one-time pad, and a trusted arbitration mechanism [38]. Wen et al. further constructed a quantum multi-signature protocol [39]; however, subsequent analysis revealed vulnerabilities to insider attacks and external attacks, indicating that the correctness of quantum teleportation cannot substitute for a security proof of the signature [40]. In 2019, Feng et al. introduced quantum walk teleportation, enabling the generation of entangled states during the signing phase [41]. In recent years, Lu et al. proposed a verifiable arbitration quantum signature scheme based on controlled quantum teleportation, incorporating identity authentication and eavesdropping detection mechanisms [42]; Singh et al. investigated the combined application of quantum digital signatures and quantum teleportation in protecting blockchain transactions [43]; Zhao et al. proposed a continuous-variable quantum digital signature protocol based on quantum teleportation, providing a continuous-variable implementation path for teleportation-based quantum signatures [44].

Existing quantum signature schemes still face limitations in privacy-sensitive applications. Conventional schemes may expose the complete message to the signer, whereas fully blind signatures conceal even the public information required for authorization or constraint verification. In addition, identity and session binding, one-time authorization, key revocation, dispute traceability, and the separation of signing and verification capabilities remain insufficiently addressed in many existing quantum blind and partially blind signature schemes. This paper proposes an identity-based quantum partially blind signature scheme based on quantum teleportation. In this scheme, users quantize classical binary information using a one-time random string and then apply Pauli-X blinding, while the pre-shared public information remains visible to the signer. The trusted private key generation center (PKG) is responsible for participant identity authentication, session establishment, blinding key freezing, signature authorization, and session key distribution. It also implements the lifecycle management of signature keys through session IDs, validity periods, and key states. The signer encodes the participants’ identities, public information, session identifiers, and other data into quantum tags, which are incorporated into the quantum authentication payload along with the blinded message to generate direct verification evidence for a designated verifier and independent arbitration evidence for an arbitrator, respectively. This scheme employs security-verified EPR entanglement resources and quantum teleportation to transmit the quantum payload. This paper presents the specific operations and quantum state evolutions for each phase and analyzes the scheme’s security in terms of correctness, partial blindness, forgery resistance, non-repudiation, resistance to third-party attacks, and dispute arbitration.

2. Relevant Basic Knowledge

Pauli gate: $I,X,Y,Z$ , where

$I=\left(\begin{array}{ll}1\hfill & 0\hfill \\ 0\hfill & 1\hfill \end{array}\right),X=\left(\begin{array}{ll}0\hfill & 1\hfill \\ 1\hfill & 0\hfill \end{array}\right),Y=\left(\begin{array}{ll}0\hfill & -i\hfill \\ i\hfill & 0\hfill \end{array}\right),Z=\left(\begin{array}{ll}1\hfill & 0\hfill \\ 0\hfill & -1\hfill \end{array}\right).$

The BB84 detection rule: The communicating parties randomly select $I$ qubits and $I$ qubits for measurement. Following communication, half of the measured qubits and their corresponding results are randomly disclosed. The average bit error rate $e$ of the channel is calculated, and a threshold $e_{\text{th}}$ is set. If $e>e_{\text{th}}$ , it is determined that the channel is under an eavesdropping attack.

Quantum Teleportation (Standard): The entangled pair shared by both parties is ${|{\Phi }^{+}\rangle }_{us}$ , where the signer holds $s$ and the user holds $u$ . The user has an unknown state $|\phi \rangle$ , then, ${|\phi \rangle }_q{|{\Phi }^{+}\rangle }_{us}=\frac{1}{2}{\displaystyle {\sum }_{x,z\in \left\{0,1\right\}}{|{\Phi }_{x,z}^{+}\rangle }_{qu}{X}^x{Z}^z{|\phi \rangle }_s}$ , where $|{\Phi }_{x,z}^{+}\rangle$ represents the Bell basis, and $\left(x,z\right)$ corresponds to the measurement result on $\left(|\phi \rangle ,u\right)$ .

Performing a Bell measurement yields a two-bit result $\gamma \in \left\{00,01,10,11\right\}$ , the uncorrected state at the signer’s end is ${|{\phi }_{\gamma }\rangle }_s=X^x{Z}^z{|\phi \rangle }_s$ .

The user sends $\gamma$ to the signer, and the signer performs the corresponding Pauli operation $U_{\gamma }$ on $s$ , causing $s$ to collapse into ${|\phi \rangle }_s$ : $Z^z{X}^x{|{\phi }_{\gamma }\rangle }_s=Z^z{X}^x{X}^x{Z}^z{|\phi \rangle }_s={\text{e}}^{i\theta }{|\phi \rangle }_s$ .

Quantum One-Time Pad (QOTP): Suppose the message to be encrypted is a quantum state ${\rho }_M$ consisting of $n$ qubits. The encryption algorithm is defined as $En{c}_{a,b}\left({\rho }_M\right)=P_{a,b}{\rho }_M{P}_{a,b}^{†}$ , where $P_{a,b}={\otimes }_{i=1}^n{X}_i^{a_i}{Z}_i^{b_i}$ , and $a,b\in {\left\{0,1\right\}}^n$ are uniformly random classical keys. Here, $a_i=1$ applies the Pauli-$X$ operator and $b_i=1$ applies the Pauli-$Z$ operator on the $i$ -th qubit.

The decryption algorithm is $De{c}_{a,b}\left(\sigma \right)=P_{a,b}^{†}\sigma P_{a,b}$ . Therefore, $De{c}_{a,b}\left(En{c}_{a,b}\left({\rho }_M\right)\right)=P_{a,b}^{†}{P}_{a,b}{\rho }_M{P}_{a,b}^{†}{P}_{a,b}={\rho }_M$ .

Furthermore, QOTP provides perfect secrecy: $\frac{1}{4^n}{\displaystyle {\sum }_{a,b}{P}_{a,b}{\rho }_M{P}_{a,b}^{†}}=\frac{I_M}{2^n}$ , which holds for any input state ${\rho }_M$ .

3. Detailed Design of a Quantum Partially Blind Signature Scheme

The proposed scheme is characterized by the following features. First, the protocol adopts a partially blind message structure in which the private message is hidden from the signer while the agreed public information $info$ remains visible and is explicitly bound to the corresponding session. Second, a globally unique session identifier $sid$ and a one-time authorization value ${\omega }_{sid}$ are introduced to bind identities, public information, temporal information, and verification labels to a unique protocol execution. Third, two independent evidence branches are generated during signing: direct-verification evidence ${\Sigma }_D$ and arbitration evidence ${\Sigma }_A$ , protected by independent session keys $k_D^{sid}$ and $k_A^{sid}$ , respectively. Finally, a temporal key-evolution and revocation mechanism is introduced to bind signing authority to a specific time period and support dynamic revocation.

Participants and Roles: The proposed quantum partial-blind signature scheme involves five types of participants: the PKG, User, Signer, Verifier, and Arbitrator.

PKG: The Private Key Generator (PKG) is responsible for key generation and management, EPR entangled state generation and distribution, as well as system parameter generation.

User: The user is the owner of the message to be signed and holds a conventional message awaiting signature. The identity information of the User is denoted as $I{D}_U$ .

Signer: The signer generates a signature for the User’s message. The identity information of the Signer is denoted as $I{D}_S$ , and the public information $info$ is shared with the User.

Verifier: The verifier is the unique entity responsible for validating the signature and verifying its legitimacy and correctness.

Arbitrator: The arbitrator participates only when disputes regarding signature information occur. Under normal circumstances, the arbitration procedure is not invoked.

Session ID and Label: Each protocol execution uses a globally unique session ID ($sid\in {\left\{0,1\right\}}^{{\lambda }_{sid}}$ ), where ${\lambda }_{sid}$ is the length of the session ID. PKG ensures that the same $sid$ is not reused. The complete information is: $Ctx\left[sid\right]=\left(I{D}_X,info,n,T\right)$ , where $T$ represents the validity period for this authorization and verification, $Ctx$ is a database record, and $sid$ is the unique index for that record. $I{D}_X$ is the identity information of the participants.

PKG generates a one-time authorization number when approving a signature: ${\omega }_{sid}^s\leftarrow {\left(0,1\right)}^{{\lambda }_{\omega }}$ . The protocol uses three short-purpose constants: AUTH, DIRECT, and ARBITRATION.

The authorization tag, direct verification tag, and arbitration tag are defined as follows:

$\begin{array}{l}{L}_{\text{auth}}=\text{Canon}\left(sid,{\omega }_{sid},\text{AUTH}\right),\\ L_D=\text{Canon}\left(sid,{\omega }_{sid},\text{DIRECT}\right),\\ L_A=\text{Canon}\left(sid,{\omega }_{sid},\text{ARBITRATION}\right).\end{array}$ (1)

Canon denotes a normalized encoding function that is unambiguous.

The quantum authentication code is defined as $Q_{\text{Auth}}.{\text{Enc}}_k\left(\rho \right)$ , $Q_{\text{Auth}}.{\text{Dec}}_k\left(\Sigma \right)=\left(f,{\rho }^{\prime }\right)$ .

Where $k$ denotes the one-time quantum authentication key, $\rho$ is the quantum payload to be authenticated, and Σ is the authenticated quantum state after encoding. The variable $f\in \left\{\text{acc},\text{rej}\right\}$ denotes the authentication result. When $f=\text{acc}$ , ${\rho }^{\prime }$ represents the recovered payload.

The security of the authentication scheme is characterized by the parameter ${\epsilon }_{\text{auth}}$ , satisfying $\text{Pr}\left[f=\text{acc}\wedge {\rho }^{\prime }=\rho \right]\le {\epsilon }_{\text{auth}}$ .

3.1. System Initialization Phase

(1) Parameter generation: PKG specifies the security parameters: $\lambda =\left({\lambda }_{sid},{\lambda }_{\omega },S_{\text{auth}},{\epsilon }_{\text{auth}},n_{\text{max}}\right)$ , where ${\lambda }_{sid}$ denotes the length of the session ID, ${\lambda }_{\omega }$ denotes the length of the one-time authorization code, $S_{\text{auth}}$ denotes the size of quantum authentication redundancy or trap qubits, ${\epsilon }_{\text{auth}}$ denotes the upper bound of the quantum authentication error acceptance probability, and $n_{\text{max}}$ denotes the maximum binary message length allowed by the system.

PKG selects a publicly available quantum authentication scheme: $Q_{\text{Auth}}=\left(Q_{\text{Auth}}.\text{Enc},Q_{\text{Auth}}.\text{Dec}\right)$ , and a normalized encoding rule: $\text{Canon}\left(x_1,\cdots ,x_t\right)$ .

The valid identity information of each participant is denoted as $I{D}_X$ , $X\in \left\{U,S,V,A\right\}$ .

Finally, PKG establishes a session database $D_{sid}$ for storing session keys.

(2) Participant identity registration: Each participant $X\in \left\{U,S,V,A\right\}$ submits identity verification information to the PKG. After successful verification, the PKG establishes an identity–key mapping: $I{D}_X\to k_X$ , where $I{D}_X$ denotes the identity information of participant $X$ , and $k_X$ denotes the corresponding one-time control key pool. The mapping information is stored securely in the PKG’s protected database.

(3) Establishing a session key based on identity:

1) Session establishment: The user, signer, and verifier submit their identities and public information to the PKG: $I{D}_U,I{D}_S,I{D}_V,I{D}_A,info,n,T$ . The PKG verifies $1\le n\le n_{\text{max}}$ , $T>t$ , and checks whether the permissions for each identity are valid. Upon successful verification, a unique session ID is generated: $sid\in {\left\{0,1\right\}}^{{\lambda }_{sid}}$ , ensuring that it does not duplicate any ID in the session database. The PKG records this information: $Ctx\left[sid\right]=\left(I{D}_U,I{D}_S,I{D}_V,I{D}_A,info,n,T\right)$ .

2) One-time control key: Based on the identities and the session, the PKG generates one-time quantum authentication keys: $k_{PU}^R,k_{PS}^{Req},k_{PS}^{Auth}$ , for subsequent processes.

Specifically, $k_{PU}^R$ is used by the user to register with the PKG and freeze the blinding key; $k_{PS}^{Req}$ is used by the signer to submit an authorization request to the PKG; $k_{PS}^{Auth}$ is used by the PKG to send a one-time quantum authorization token to the signer.

These keys are all bound to $sid$ , the sender’s and recipient’s identities, and the intended use, and are destroyed after this session

3) Entanglement resource initialization: Based on the security parameter $\lambda$ , the PKG generates $n$ independent sets of EPR entanglement pairs, where each pair is in a maximally entangled state: ${\otimes }_{i=1}^n{|{\varphi }^{+}\rangle }_{U_i{S}_i}={\otimes }_{i=1}^n\frac{1}{\sqrt{2}}{\left(|00\rangle +|11\rangle \right)}_{U_i{S}_i}$ .

The PKG distributes the particle set $S=\left\{S_1,S_2,\cdots ,S_n\right\}$ to the signer and the particle set $U=\left\{U_1,U_2,\cdots ,U_n\right\}$ to the user, thereby establishing a shared quantum channel between them.

(4) Identity-Based Quantum Private Key Extraction: The signer sends its identity to the PKG. The temporal revocable-key model divides the system’s operational lifetime into a sequence of discrete time periods and assigns each signer mutually independent or unidirectionally evolving signing keys for different periods.

Let $N$ denote the maximum number of signatures supported by the system. The corresponding set of time or state indices is defined as: $\mathcal{T}=\left\{1,2,\cdots ,N\right\}$ . For signer $S$ , its identity is denoted as $I{D}_S$ . In the $i$ -th time period, the signer holds a signing key $s{k}_{S,i}$ , $i\in \mathcal{T}$ , which is bound to its identity and time state. The corresponding key state is represented as: $s{t}_{S,i}=\left(I{D}_S,i,s{k}_{S,i},statu{s}_{S,i}\right)$ , where $statu{s}_{S,i}$ denotes the valid state of the signer in the $i$ -th time period. It can take the following values: $\begin{array}{c}statu{s}_{S,i}\in \{\text{CREATED},\text{FROZEN},\text{AUTHORIZED},\text{SIGNED},\text{DELIVERED},\\ \text{VERIFIED},\text{DISPUTED},\text{CLOSED},\text{ABORTED}\}.\end{array}$

The time-period-related revocation list $R{L}_i$ records identities that no longer possess signing authority during the $i$ -th time period and subsequent periods. If $I{D}_S\in R{L}_i$ , the signer is revoked from the $i$ -th time period, and the system no longer generates, extracts, or updates valid signing keys for this signer. For any $j\ge i$ , it holds that $I{D}_S\in R{L}_j$ , which provides backward revocation and terminates the signing authority for future periods. For a non-revoked signer, the signing key is updated according to the time period: $s{k}_{S,i+1}\leftarrow keyupd\left(s{k}_{S,i},I{D}_S,i\right)$ . After updating, the previous key is immediately deleted: $Erase\left(s{k}_{S,i}\right)$ . The key update mechanism only supports forward evolution and prevents recovery of previous keys. Therefore, given the current key $s{k}_{S,i}$ , it is infeasible to derive any previous key $s{k}_{S,j}$ , $j<i$ . During the $i$ -th time period, the signer uses only the valid key $s{k}_{S,i}$ to generate a signature: ${\sigma }_i\leftarrow Sign\left(params,s{k}_{S,i},I{D}_S,i,m\right)$ . When verifying a signature, the verifier must simultaneously check the correctness of the signature, the validity of the time state, and the signer’s revocation status. The verification algorithm is denoted as: $b\leftarrow Verify\left(params,I{D}_S,i,m,{\sigma }_i,R{L}_i\right),$ where $b\in \left\{0,1\right\}$ .

The verification algorithm outputs 1 if and only if all the following conditions are satisfied: $I{D}_S\notin R{L}_i$ , $1\le i\le N$ , and ${\sigma }_i$ is a valid signature generated by the valid key of the $i$ -th time period. Otherwise, the verification algorithm outputs 0.

(5) Signing authorization request: The signer requests signing authorization from the PKG by sending its identity information $I{D}_S$ and the session identifier $sid$ to the PKG. The PKG verifies whether the required conditions are satisfied, namely, whether the signer’s identity has been authenticated, whether the user has frozen the blinding key, and whether the current request has not expired. Once all conditions are satisfied, the PKG grants authorization and independently and randomly generates two session keys: $k_D^{sid}=\left(e_D,p_D\right)$ , $k_A^{sid}=\left(e_A,p_A\right)$ . The independence requirement is defined as follows: ${\mathscr{H}}_{k_A}$ and ${\mathscr{H}}_{k_D}$ are mutually independent Hilbert spaces, and ${\rho }_{k_A{k}_D}={\rho }_{k_A}\otimes {\rho }_{k_D}$ . There exists no quantum operation that can recover $k_A^{sid}$ from $k_D^{sid}$ . Therefore, even if one key is compromised, the other key cannot be derived. The PKG distributes $k_D^{sid}$ to the signer $S$ and the verifier $V$ , and distributes $k_A^{sid}$ to the signer $S$ and the arbitrator $A$ . The PKG then generates a unique authorization serial number ${\omega }_{sid}$ . The corresponding authorization content is defined as: $Aut{h}_{sid}=\text{Canon}\left(I{D}_X,sid,info,n,{\omega }_{sid}\right)$ . Finally, the PKG updates the signer’s state as: $statu{s}_{S,i}=\text{AUTHORIZED}$ .

3.2. Blinding Phase

Assume that the message to be signed by the user is a private binary message $msg=\left\{ms{g}_1,ms{g}_2,\cdots ,ms{g}_i,\cdots ,ms{g}_n\right\}$ , $ms{g}_i\in \left\{0,1\right\}$ , with the agreed-upon public message $info$ and the entangled-particle sequence $U=\left\{U_1,U_2,\cdots ,U_n\right\}$ , which is pre-shared through the PKG.

(1) The message is quantum-encoded and partially blinded. Specifically, only the private message $msg$ is blinded, while the public information $info$ remains unblinded. The user first uniformly and randomly generates a basis-selection string $b=\left(b_1,b_2,\cdots ,b_n\right)\stackrel{\text{\$}}{\leftarrow }{\left\{0,1\right\}}^n$, $b_i\in \left\{0,1\right\}$ , and an $n$ -bit classical blinding-key string $r=\left(r_1,r_2,\cdots ,r_n\right)\stackrel{\text{\$}}{\leftarrow }{\left\{0,1\right\}}^n$, $r_i\in \left\{0,1\right\}$ . For each private message bit $ms{g}_i$ , the user first performs a logical blinding operation using the Pauli-$X$ operator: $X_i^{r_i}|ms{g}_i\rangle =|ms{g}_i\oplus r_i\rangle$ . The resulting logical bit is then encoded according to the basis-selection bit $b_i$ . Thus, the $i$ th blinded message qubit is prepared as $|{\varphi }_i^B\rangle =H_i^{b_i}{X}_i^{r_i}|ms{g}_i\rangle =H_i^{b_i}|ms{g}_i\oplus r_i\rangle$ , namely,

$|{\varphi }_i^B\rangle =\{\begin{array}{ll}|0\rangle ,\hfill & ms{g}_i\oplus r_i=0,b_i=0,\hfill \\ |1\rangle ,\hfill & ms{g}_i\oplus r_i=1,b_i=0,\hfill \\ |+\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle +|1\rangle \right),\hfill & ms{g}_i\oplus r_i=0,b_i=1,\hfill \\ |-\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle -|1\rangle \right),\hfill & ms{g}_i\oplus r_i=1,b_i=1.\hfill \end{array}$ (2)

When $b_i=0$ , the blinded logical bit is encoded in the computational, or $Z$ , basis $Z=\left\{|0\rangle ,|1\rangle \right\}$ ; when $b_i=1$ , it is encoded in the Hadamard, or $X$ , basis $X=\left\{|+\rangle ,|-\rangle \right\}$ . Here, the symbol $X_i$ in the blinding operation denotes the Pauli-$X$ operator, whereas $X=\left\{|+\rangle ,|-\rangle \right\}$ denotes the Hadamard measurement basis.

Let $|msg\rangle ={\otimes }_{i=1}^n|ms{g}_i\rangle$ , $H^b={\otimes }_{i=1}^n{H}_i^{b_i}$ , $X^r={\otimes }_{i=1}^n{X}_i^{r_i}$ , therefore, the complete partially blinded quantum message is

$\begin{array}{c}|m_{\text{blind}}\rangle =\stackrel{n}{\underset{i=1}{\otimes }}{H}_i^{b_i}{X}_i^{r_i}|ms{g}_i\rangle \\ =\stackrel{n}{\underset{i=1}{\otimes }}{H}_i^{b_i}|ms{g}_i\oplus r_i\rangle \\ =H^b{X}^r|msg\rangle .\end{array}$ (3)

It should be noted that, in $H^b{X}^r|msg\rangle$ , the Pauli-$X$ blinding operation $X^r$ acts first on the logical message bits, followed by the basis-encoding operation $H^b$ . Hence, for both $b_i=0$ and $b_i=1$ , the random bit $r_i$ effectively maps the logical message bit $ms{g}_i$ to $ms{g}_i\oplus r_i$ .

To prevent the user from selecting a new blinding key or a new basis-selection string after obtaining the signature, the user must register the blinding information with the PKG before signing. The registration information is defined as $R_{sid}=\text{Canon}\left(sid,\text{block},b,r\right)$ . The user prepares the corresponding quantum state $|R_{sid}\rangle$ and encodes it as ${\Gamma }_R=Q_{\text{Auth}}.{\text{Enc}}_{k_{PU}^R}\left(|R_{sid}\rangle \langle R_{sid}|\right)$ , which is then sent to the PKG.

Upon receiving ${\text{Γ}}_R$ , the PKG performs authentication decoding: $\left(f_R,{{\rho }^{\prime }}_{R_{sid}}\right)=Q_{\text{Auth}}.{\text{Dec}}_{k_{PU}^R}\left({\Gamma }_R\right)$ . Only when $f_R=\text{acc}$ and the decoded registration information matches the current session does the PKG store $\text{Rec}\left[sid\right].\left(b,r\right)=\left(b,r\right)$ . From that point onward, the registered basis-selection string $b$ and blinding-key string $r$ are frozen and cannot be modified for the current session.

(2) Quantum Teleportation (Teleporting a Blinded State to the Signer): The user performs a joint Bell measurement on the transmitted state particle and the EPR particle. Taking a single particle as an example: let ${|\varphi \rangle }_{m_{b_i}}=\alpha {|0\rangle }_{m_{b_i}}+\beta {|1\rangle }_{m_{b_i}}$ , and let the EPR state be ${|{\Phi }^{+}\rangle }_{U_i{S}_i}=\frac{1}{\sqrt{2}}{\left(|00\rangle +|11\rangle \right)}_{U_i{S}_i}$ . At this point, the entire system can be described as:

$\begin{array}{c}{|{\phi }_0\rangle }_{m_{b_i}{U}_i{S}_i}={|\varphi \rangle }_{m_{b_i}}\otimes {|{\Phi }^{+}\rangle }_{U_i{S}_i}\\ =\left(\alpha {|0\rangle }_{m_{b_i}}+\beta {|1\rangle }_{m_{b_i}}\right)\otimes \frac{1}{\sqrt{2}}\left({|0\rangle }_{U_i}{|0\rangle }_{S_i}+{|1\rangle }_{U_i}{|1\rangle }_{S_i}\right)\\ =\frac{1}{\sqrt{2}}{\left(\alpha |000\rangle +\alpha |011\rangle +\beta |100\rangle +\beta |111\rangle \right)}_{m_{b_i}{U}_i{S}_i}.\end{array}$ (4)

Then, the user performs a CNOT operation and obtains $|{\phi }_1\rangle$ :

$\begin{array}{c}{|{\phi }_1\rangle }_{m_{b_i}{U}_i{S}_i}=\left(\text{CNOT}\otimes I\right){|{\phi }_0\rangle }_{m_{b_i}{U}_i{S}_i}\\ =\left(\text{CNOT}\otimes I\right)\frac{1}{\sqrt{2}}{\left(\alpha |000\rangle +\alpha |011\rangle +\beta |100\rangle +\beta |111\rangle \right)}_{m_{b_i}{U}_i{S}_i}\\ =\frac{1}{\sqrt{2}}{\left(\alpha |000\rangle +\alpha |011\rangle +\beta |110\rangle +\beta |101\rangle \right)}_{m_{b_i}{U}_i{S}_i}.\end{array}$ (5)

The function of the H-Gate: $H|0\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle +|1\rangle \right)$ , $H|1\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle -|1\rangle \right)$ ; User applies an H-gate to the first qubit, resulting in $|{\phi }_2\rangle$ :

$\begin{array}{c}{|{\phi }_2\rangle }_{m_{b_i}{U}_i{S}_i}=\left(H\otimes I\otimes I\right){|{\phi }_1\rangle }_{m_{b_i}{U}_i{S}_i}\\ =\left(H\otimes I\otimes I\right)\frac{1}{\sqrt{2}}{\left(\alpha |000\rangle +\alpha |011\rangle +\beta |110\rangle +\beta |101\rangle \right)}_{m_{b_i}{U}_i{S}_i}\\ =\frac{1}{\sqrt{2}}[\alpha \frac{1}{\sqrt{2}}\left(|0\rangle +|1\rangle \right)\otimes \left(|00\rangle +|11\rangle \right)\\ +\beta \frac{1}{\sqrt{2}}\left(|0\rangle -|1\rangle \right)\otimes \left(|10\rangle +|01\rangle \right)]\\ =\frac{1}{2}(\alpha |000\rangle +\alpha |100\rangle +\alpha |011\rangle +\alpha |111\rangle \\ +\beta |010\rangle -\beta |110\rangle +\beta |001\rangle -{\beta |101\rangle )}_{m_{b_i}{U}_i{S}_i}.\end{array}$ (6)

To make the measurement results easier to read, we rearrange $|{\phi }_2\rangle$ to get:

$\begin{array}{c}{|{\phi }_2\rangle }_{m_{b_i}{U}_i{S}_i}=\frac{1}{2}({|00\rangle }_{m_{b_i}{U}_i}\otimes {\left(\alpha |0\rangle +\beta |1\rangle \right)}_{S_i}+{|10\rangle }_{m_{b_i}{U}_i}\otimes {\left(\alpha |0\rangle -\beta |1\rangle \right)}_{S_i}\\ +{|01\rangle }_{m_{b_i}{U}_i}\otimes {\left(\alpha |1\rangle +\beta |0\rangle \right)}_{S_i}+{|11\rangle }_{m_{b_i}{U}_i}\otimes {\left(\alpha |1\rangle -\beta |0\rangle \right)}_{S_i}).\end{array}$ (7)

Next, the user measures the two qubits in the computational basis $\left\{|0\rangle ,|1\rangle \right\}$ . The four possible measurement outcomes and the corresponding recovery operations are summarized in Table 1.

Table 1. Correspondence between the user’s measurement outcomes and the signer’s quantum-state recovery operations.

Measurement outcome	Post-measurement state of $S_i$	Recovery operation $U_{\gamma }$	Probability
00	$\alpha |0\rangle +\beta |1\rangle$	$I$	1/4
01	$\alpha |1\rangle +\beta |0\rangle$	$X$	1/4
10	$\alpha |0\rangle -\beta |1\rangle$	$Z$	1/4
11	$\alpha |1\rangle -\beta |0\rangle$	$ZX$	1/4

The quantum circuit design is as shown in Figure 1:

Figure 1. Three-qubit simulation circuit for quantum teleportation.

$U_3\left(\theta ,\varphi ,\lambda \right)=\left[\begin{array}{cc}\cos \frac{\theta }{2}& -{\text{e}}^{i\lambda }\sin \frac{\theta }{2}\\ {\text{e}}^{i\varphi }\sin \frac{\theta }{2}& {\text{e}}^{i\left(\lambda +\varphi \right)}\cos \frac{\theta }{2}\end{array}\right]$ , assume that $\theta =\pi /2$ , $\varphi =0$ , and $\lambda =0$ ; the three-Qubit measurement results are output as Figure 2:

Figure 2. Probability distribution of three-qubit measurement outcomes in the quantum teleportation circuit.

The simulator measures all three qubits and therefore reports eight three-bit outcomes, each occurring with an ideal probability of approximately 1/8. However, only the last two measured bits constitute the Bell-measurement outcome ${\gamma }_i=\left(x_i,z_i\right)$ . By marginalizing over the receiver-qubit measurement result, the corresponding Bell-outcome probabilities are

$\begin{array}{l}{P}_{\text{Bell}}\left(00\right)=P\left(000\right)+P\left(100\right),\\ P_{\text{Bell}}\left(01\right)=P\left(001\right)+P\left(101\right),\\ P_{\text{Bell}}\left(10\right)=P\left(010\right)+P\left(110\right),\\ P_{\text{Bell}}\left(11\right)=P\left(011\right)+P\left(111\right),\end{array}$ (8)

which are all approximately 1/4 under ideal teleportation.

Table 2. Measurement probabilities corresponding to different Bell measurement outcomes.

Bell measurement outcome $\left(x,z\right)$	Quantum state $\left(q_2,q_1,q_0\right)$	State probability	Measurement-outcome probability
00	$|000\rangle$	0.1220703	0.2529296
	$|100\rangle$	0.1308593
01	$|001\rangle$	0.1240234	0.2490234
	$|101\rangle$	0.1250000
10	$|010\rangle$	0.1250000	0.2470703
	$|110\rangle$	0.1220703
11	$|011\rangle$	0.1259765	0.2509765
	$|111\rangle$	0.1250000

The above results were obtained through online testing on the Origin Quantum platform, with the number of shots set to 1024. Table 2 presents the simulation results for the four possible Bell measurement outcomes. For each measurement outcome , the corresponding probability is obtained by summing the probabilities of the two associated computational-basis states. The resulting probabilities for the four outcomes are all close to the theoretical value of (1/4), indicating an approximately uniform distribution of the Bell measurement results.

The user performs a Bell-basis measurement on $\left(|m_{\text{blind}}\rangle ,U\right)$ and obtains a 2-bit classical result ${\gamma }_i=\left(x_i,z_i\right)\in {\left\{0,1\right\}}^2$ , ${\gamma }_i\in \left\{00,01,10,11\right\}$ , $\gamma =\left\{\left(x_1,z_1\right),\cdots ,\left(x_i,z_i\right),\cdots ,\left(x_n,z_n\right)\right\}\in {\left\{0,1\right\}}^{2n}$ .

Then the user sends $\left(sid,\gamma ,info\right)$ to the signer via a classical channel; the signer can only retrieve the message $info$ , but cannot access the original message $msg$ or quantum state $|msg\rangle$ to be signed.

In order to check whether the channel is secure, the user generates $d$ decoy states randomly, selecting them from four sets of non-orthogonal states: $|0\rangle$ , $|1\rangle$ , $|+\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle +|1\rangle \right)$ , $|-\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle -|1\rangle \right)$ . From each group, $X$ -basis and $Z$ -basis states are randomly selected to prepare the quantum states. The detection bit is then sent to the signer through the quantum channel.

3.3. Signing Phase

After receiving the decoy states sent by the user, both the user and the signer randomly select the $X$ basis or $Z$ basis for measurement. All measurement bases and measurement outcomes are stored. Half of the measurement bases and their corresponding measurement results are randomly disclosed, and the average channel error rate $e$ is calculated. Let $e_{\text{th}}$ denote the threshold. If $e>e_{\text{th}}$ , it is determined that an eavesdropping attack exists on the channel, and set $statu{s}_{S,i}=\text{ABORTED}$ ; otherwise, proceed with the subsequent signature operations.

Quantum collapse state: After the user performs the Bell-basis measurement, the particle $S$ in the hands of the remote signer collapses, and its state is denoted as: ${|{\phi }_{\gamma }\rangle }_{S_i}=U_{\gamma }^{†}|m_{\text{blind}}\rangle$ . If the signer performs the corresponding Pauli operation $U_{\gamma }$ on $S_i$ , where $U_{\gamma }=Z^{z_i}{X}^{x_i}$ , then

$\begin{array}{c}{U}_{\gamma }{|{\phi }_{\gamma }\rangle }_{S_i}=Z^{z_i}{X}^{x_i}{|{\phi }_{\gamma }\rangle }_{S_i}\\ =Z^{z_i}{X}^{x_i}{X}^{x_i}{Z}^{z_i}|m_{\text{blind}}\rangle \\ ={\text{e}}^{\text{i}\theta }|m_{\text{blind}}\rangle .\end{array}$ (9)

Since a global phase has no physical effect, this operation restores the blinded state: $|m_{\text{blind}}\rangle =U_{\gamma }{|{\phi }_{\gamma }\rangle }_{S_i}$ .

Therefore, after receiving $\left(sid,\gamma ,info\right)$ , the signer performs the Bell correction to obtain $|m_{\text{blind}}\rangle$ . The signer only signs when the following conditions are met: , $I{D}_S\notin R{L}_i$ , and $1\le i\le N$ . The generated state signature is as follows:

$\begin{array}{l}{\sigma }_i=En{c}_{s{k}_{S,i}}\left(|m_{\text{blind}}\rangle ,I{D}_S,i,sid\right).\hfill \end{array}$ (10)

The direct verification tag is $L_D=\text{Canon}\left(sid,{\omega }_{sid},i,\text{DIRECT}\right)$ , the arbitration tag is $L_A=\text{Canon}\left(sid,{\omega }_{sid},i,\text{ARBITRATION}\right)$ , and the signer prepares these as the computational basis quantum states: $|L_D\rangle ,|L_A\rangle$ .

The direct verification payload is $|W_D\rangle ={|m_{\text{blind}}\rangle }_D\otimes |L_D\rangle$ , with density operator ${\rho }_{W_D}=|W_D\rangle \langle W_D|$ ; and the signer computes

$\begin{array}{l}{\text{Σ}}_D=Q_{Auth}.En{c}_{k_D^{sid}}\left({\rho }_{W_D},{\sigma }_i\right).\hfill \end{array}$ (11)

${\Sigma }_D$ is the quantum signature evidence provided to the user and ultimately verified by the designated verifier. Execute $statu{s}_{S,i}=\text{SIGNED}$ , and share the temporal key $s{k}_{S,i}$ with the verifier after the signature is completed. This temporal key will immediately lose its signature capability after the signature is completed within the period, and can only be used for subsequent verification of the completed signature.

The arbitration payload is $|W_A\rangle ={|m_{\text{blind}}\rangle }_A\otimes |L_A\rangle$ , and its density operator is ${\rho }_{W_A}=|W_A\rangle \langle W_A|$ . The signer computes ${\Sigma }_A=Q_{\text{Auth}}.En{c}_{k_A^{sid}}\left({\rho }_{W_A},{\sigma }_i\right)$ ; ${\Sigma }_A$ must be delivered directly by the signer to the arbitrator and cannot be relayed through the user or verifier.

The signer sends ${\Sigma }_D\to U$ to the user, and the signer sends ${\text{Σ}}_A\to A$ to the arbitrator. The arbitrator only stores ${\Sigma }_A$ and the receipt time, without decoding it immediately.

After confirming that the arbitrator has received ${\Sigma }_A$ , PKG marks this session as signed.

Sign output: The user holds ${\Sigma }_D$ ; the arbitrator holds ${\Sigma }_A$ ; PKG stores ${\omega }_{sid}$ , $k_D^{sid}$ , $k_A^{sid}$ , and the frozen $\left(b,r\right)$ .

3.4. Verification Phase

The user sends the direct verification evidence ${\Sigma }_D$ to the designated verifier via quantum teleportation. To ensure that the verification input clearly corresponds to the message $m$ , the user can additionally prepare a reference message state $|M_{\text{ref}}\rangle \equiv |msg\rangle$ and deliver it to the verifier via quantum teleportation. Since $m$ is a classical binary string, preparing a reference state on a computational-basis state does not violate the no-cloning theorem.

The user sends an unblinding request $Ope{n}_{sid}=\text{Canon}\left(sid,\text{OPEN}\right)$ to the PKG. After the PKG verifies the user’s identity, session status, and arbitration-evidence receipt record, it securely releases the data $\left(r,b,k_D^{sid},{\omega }_{sid},Ctx\left[sid\right]\right)$ to the designated verifier. At this stage, only the value of $\left(b,r\right)$ frozen in the database prior to signing may be retrieved; the user cannot submit a new value $\left(b^{\prime },r^{\prime }\right)$ .

The unblinding output $\left({\Sigma }_D,|M_{\text{ref}}\rangle ,r,k_D^{sid},{\omega }_{sid},Ctx\left[sid\right]\right)$ is held by the verifier, who decodes it using a one-time direct verification key: $\left(f_D,{{\rho }^{\prime }}_{W_D},{{\sigma }^{\prime }}_i\right)=Q_{\text{Auth}}.De{c}_{k_D^{sid}}\left({\Sigma }_D\right)$ . If $f_D=\text{rej}$ , the request is immediately rejected. If authentication succeeds, the verifier records the recovered payload as ${{\rho }^{\prime }}_{W_D}=|{m^{\prime }}_{\text{blind}}\rangle \langle {m^{\prime }}_{\text{blind}}|\otimes |{L^{\prime }}_D\rangle \langle {L^{\prime }}_D|$ , where $|{m^{\prime }}_{\text{blind}}\rangle$ is the recovered blinded-message register; $|{L^{\prime }}_D\rangle$ is the recovered direct-verification-tag register. ${{\sigma }^{\prime }}_i$ is the temporal signature obtained after decoding. The verifier performs decryption on ${{\sigma }^{\prime }}_i$ using the temporal key $s{k}_{S,i}$ shared with the signer:

$De{c}_{s{k}_{S,i}}\left({{\sigma }^{\prime }}_i\right)=De{c}_{s{k}_{S,i}}\left(En{c}_{s{k}_{S,i}}\left(|m_{\text{blind}}\rangle ,I{D}_S,i,sid\right)\right)$ (12)

and obtains $\left(|{m^{″}}_{\text{blind}}\rangle ,I{D^{\prime }}_S,i^{\prime },si{d}^{\prime }\right)$ . It then compares $sid\stackrel{?}{=}si{d}^{\prime }$; if they are the same, verification continues; otherwise, the signature is declared invalid.

The verifier measures the tag register to obtain ${L^{\prime }}_D$ and computes $L_D^{\text{exp}}=\text{Canon}\left(sid,{\omega }_{sid},i,\text{DIRECT}\right)$ based on the values of $sid$ and ${\omega }_{sid}$ provided by the PKG. The verification condition is ${L^{\prime }}_D=L_D^{\text{exp}}$ . At the same time, the verifier checks the PKG’s immutable record: $Ctx\left[sid\right]=\left(I{D}_U,I{D}_S,I{D}_V,I{D}_A,info,n,T\right)$ , and confirms $Ctx\left[sid\right].I{D}_V=I{D}_V$ , $Ctx\left[sid\right].I{D}_S=I{D^{\prime }}_S$ , $Ctx\left[sid\right].info=info$ , and $Ctx\left[sid\right].T>t$ . This step enables the short tag to indirectly bind the complete public information through $sid$ and ${\omega }_{sid}$ .

Perform quantum unblinding: The verifier applies the inverse basis-encoding operation followed by the Pauli-$X$ unblinding operation to the blinded-message register: $|M^{\prime }\rangle =X^r{H}^b|m_{\text{blind}}\rangle$ . Under honest conditions, $|m_{\text{blind}}\rangle =H^b{X}^r|msg\rangle$ . Therefore,

$\begin{array}{c}|M^{\prime }\rangle =X^r{H}^b|m_{\text{blind}}\rangle \\ =X^r{H}^b{H}^b{X}^r|msg\rangle \\ =X^r{X}^r|msg\rangle \\ =|msg\rangle .\end{array}$ (13)

Then, the verifier performs the same unblinding operation on the blinded-message state $|{m^{″}}_{\text{blind}}\rangle$ recovered from the temporal protected payload: $|M^{″}\rangle =X^r{H}^b|{m^{″}}_{\text{blind}}\rangle$ . If the temporal protection is correct, then $|{m^{″}}_{\text{blind}}\rangle =|m_{\text{blind}}\rangle =H^b{X}^r|msg\rangle$ . Hence,

$\begin{array}{c}|M^{″}\rangle =X^r{H}^b|{m^{″}}_{\text{blind}}\rangle \\ =X^r{H}^b{H}^b{X}^r|msg\rangle \\ =X^r{X}^r|msg\rangle \\ =|msg\rangle .\end{array}$ (14)

The verifier can perform a quantum equality check without immediately measuring the complete message. It prepares two independent auxiliary registers, ${|0\rangle }_{C_1}^{\otimes n}$ and ${|0\rangle }_{C_2}^{\otimes n}$ , and executes the following sequence:

${\displaystyle \prod _{i=1}^n{\text{CNOT}}_{{M^{\prime }}_i\to C_{1,i}}{\text{CNOT}}_{M_{\text{ref},i}\to C_{1,i}}},{\displaystyle \prod _{i=1}^n{\text{CNOT}}_{M_{\text{ref},i}\to C_{2,i}}{\text{CNOT}}_{{M^{″}}_i\to C_{2,i}}}.$ (15)

If $|M^{\prime }\rangle =|M_{\text{ref}}\rangle$ , then the auxiliary register $C_1$ retains the value ${|0\rangle }_{C_1}^{\otimes n}$ . If $|M_{\text{ref}}\rangle =|M^{″}\rangle$ , then the auxiliary register $C_2$ retains the value ${|0\rangle }_{C_2}^{\otimes n}$ . The auxiliary-register measurement result is defined as:

$f_M=\{\begin{array}{ll}1,\hfill & C_1=0^n\text{and}{C}_2=0^n,\hfill \\ 0,\hfill & \text{otherwise}.\hfill \end{array}$ (16)

The final acceptance criterion is defined as follows: $\text{Accept}\iff \left[f_D=\text{acc}\right]\wedge \left[{L^{\prime }}_D=L_D^{\text{exp}}\right]\wedge \left[f_M=1\right]\wedge \left[Ctx\left[sid\right]\text{valid}\right]$ . The verifier then declares the signature valid and sets $statu{s}_{S,i}=\text{VERIFIED}$ .

3.5. Arbitration Phase

When a user, signer, or verifier disputes the verification result, the arbitrator uses ${\Sigma }_A$ —which was submitted directly by the signer and stored during the signing phase—to render a decision.

The PKG securely releases $\left(r,k_A^{sid},{\omega }_{sid},Ctx\left[sid\right]\right)$ to the arbitrator. The arbitrator decodes the arbitration evidence as

$\left(f_A,{{\rho }^{\prime }}_{W_A},{{\sigma }^{″}}_i\right)=Q_{\text{Auth}}.De{c}_{k_A^{sid}}\left({\Sigma }_A\right).$ (17)

If $f_A=\text{rej}$ , the arbitration evidence is declared invalid. If authentication succeeds, the arbitrator recovers

${{\rho }^{\prime }}_{W_A}=|{m^{\prime }}_{\text{blind}}\rangle \langle {m^{\prime }}_{\text{blind}}|\otimes |{L^{\prime }}_A\rangle \langle {L^{\prime }}_A|,$ (18)

where ${{\sigma }^{″}}_i$ is the temporal signature obtained after decoding.

The arbitrator decrypts ${{\sigma }^{″}}_i$ using the temporal key $s{k}_{S,i}$ shared with the signer:

$\begin{array}{c}De{c}_{s{k}_{S,i}}\left({{\sigma }^{″}}_i\right)=De{c}_{s{k}_{S,i}}\left(En{c}_{s{k}_{S,i}}\left(|m_{\text{blind}}\rangle ,I{D}_S,i,sid\right)\right)\\ =\left(|{m^{″}}_{\text{blind}}\rangle \rangle I{D^{\prime }}_S,i^{\prime },si{d}^{\prime }\right).\end{array}$ (19)

The arbitrator then compares $sid\stackrel{?}{=}si{d}^{\prime }$. If the two session identifiers are equal, the arbitration procedure continues; otherwise, the signature is declared invalid.

Then, the arbitrator calculates the expected label $L_A^{\text{exp}}=\text{Canon}\left(sid,{\omega }_{sid},i,\text{ARBITRATION}\right)$ , and checks ${L^{\prime }}_A=L_A^{\text{exp}}$ , then performs unblinding: $|M_A\rangle =X^r{H}^b|{m^{\prime }}_A\rangle$ , $|M^{″}\rangle =X^r{H}^b|{m^{″}}_{\text{blind}}\rangle$ . The arbitrator performs an equality check between $|M_A\rangle$ , $|M^{″}\rangle$ , and the reference state $|M_{\text{dis}}\rangle$ of the disputed message. The condition for arbitration acceptance is $\text{Accept}\iff \left[f_A=\text{acc}\right]\wedge \left[{L^{\prime }}_A=L_A^{\text{exp}}\right]\wedge \left[|M_A\rangle =|M^{″}\rangle =|M_{\text{dis}}\rangle \right]\wedge \left[Ctx\left[sid\right]\text{valid}\right]$ . Since ${\Sigma }_A$ is evidence sent directly by the signer to the arbitrator and protected by an independent key $k_A^{sid}$ , neither the user nor the verifier can fabricate valid arbitration evidence by modifying or re-encoding ${\Sigma }_D$ . If the results of routine verification do not match the arbitration results, the protocol treats ${\Sigma }_A$ stored by the arbitrator as the official evidence of the dispute.

4. Security Analysis

In our security model, both the PKG and the arbitrator are assumed to be trusted and non-colluding entities; scenarios in which either the PKG or the arbitrator is fully compromised are outside the scope of this work.

4.1. Correctness Analysis

The correctness of the proposed scheme requires that, when all participants honestly follow the protocol and the quantum channels are ideal, a legitimately generated signature is accepted by the designated verifier.

The user’s original message is represented by the computational-basis state $|msg\rangle$ . Before signing, the user randomly selects a basis-selection string $b\in {\left\{0,1\right\}}^n$ and a blinding key $r\in {\left\{0,1\right\}}^n$ , and performs the bitwise Pauli-$X$ operation followed by the basis encoding, $|m_{\text{blind}}\rangle =H^b{X}^r|msg\rangle$ . During quantum teleportation, the user performs Bell-basis measurements and obtains the classical outcome $\gamma =\left(\left(x_1,z_1\right),\cdots ,\left(x_n,z_n\right)\right)$ .

After receiving $\gamma$ , the signer applies $U_{\gamma }$ and obtains $|m_{\text{blind}}\rangle$ . The signer then generates the temporal signature ${\sigma }_i$ and constructs the direct-verification evidence ${\text{Σ}}_D$ . Under honest execution, quantum authentication decoding succeeds: $\left(f_D,{{\rho }^{\prime }}_{W_D},{{\sigma }^{\prime }}_i\right)=Q_{\text{Auth}}.{\text{Dec}}_{k_D^{sid}}\left({\Sigma }_D\right)$ . Using the corresponding temporal key $s{k}_{S,i}$ , the verifier recovers $\left(|{m^{″}}_{\text{blind}}\rangle ,I{D}_{S^{\prime }},i^{\prime },si{d}^{\prime }\right)=\left(|m_{\text{blind}}\rangle ,I{D}_S,i,sid\right)$ .

After the PKG releases the basis-selection string $b$ and the blinding key $r$ that were frozen before signing, the verifier performs unblinding:

$\begin{array}{c}|M^{\prime }\rangle =X^r{H}^b|{m^{\prime }}_{\text{blind}}\rangle \\ =X^r{H}^b{H}^b{X}^r|msg\rangle \\ =X^r{X}^r|msg\rangle \\ =|msg\rangle ,\end{array}$ (20)

and similarly, $|M^{″}\rangle =X^r{H}^b|{m^{″}}_{\text{blind}}\rangle =|msg\rangle$ .

Since the reference state satisfies $|M_{\text{ref}}\rangle =|msg\rangle$ , the message-consistency test yields $|M^{\prime }\rangle =|M^{″}\rangle =|M_{\text{ref}}\rangle$ . Therefore, every legitimately generated signature is accepted by the designated verifier, which establishes the correctness of the proposed scheme.

4.2. Non-Forgeability Analysis

If an attacker does not know $k_D^{sid}$ or $k_A^{sid}$ , the probability that an unauthorized modification to ${\Sigma }_D$ or ${\Sigma }_A$ is erroneously accepted is at most ${\epsilon }_{\text{auth}}$ . Moreover, since the authorization tag is bound to the one-time values $sid$ and ${\omega }_{sid}$ , the attacker cannot transplant authentication evidence from another session into the current session.

If the verifier accepts a different payload ${\tilde{m}}_1\ne msg$ , or a different tag ${\tilde{L}}_D\ne L_D$ , then the attacker has compromised the integrity of the quantum authentication code. Therefore,

$\text{Pr}\left[f_D=\text{acc}\wedge \left({\tilde{m}}_1,{\tilde{L}}_D\right)\ne \left(m,L_D\right)\right]\le {\epsilon }_{\text{auth}}.$(21)

To forge a valid signature, an external attacker must generate direct verification evidence that can pass the verifier’s authentication procedure:

${\Sigma }_D=Q_{\text{Auth}}.{\text{Enc}}_{k_D^{sid}}\left({\rho }_{W_D},{\sigma }_i\right).$ (22)

Assume that the session key $k_D^{sid}$ is a uniformly random classical key of length $2n$ . If the attacker has no information about this key, the probability of correctly guessing the entire key is

${\left(\frac{1}{2}\right)}^{2n}=\frac{1}{2^{2n}},$ (23)

which decreases exponentially with $n$ .

The temporal signature ${\sigma }_i$ is generated using the temporal signing key $s{k}_{S,i}$ :

${\sigma }_i={\text{Enc}}_{s{k}_{S,i}}\left(|m_{\text{blind}}\rangle ,I{D}_S,i,sid\right).$ (24)

Assume that $s{k}_{S,i}$ is a uniformly random $n$ -bit key. Without knowledge of the key, an attacker attempting to forge a temporal signature can guess each key bit correctly with probability 1/2. Consequently, the probability of correctly guessing the entire key is $\frac{1}{2^n}$ , which also decreases exponentially with $n$ .

4.3. Non-Repudiation Analysis

(1) Non-repudiation of the signer

The signer’s non-repudiation is mainly guaranteed by the independent arbitration evidence ${\Sigma }_A$ . The evidence ${\Sigma }_A$ is generated by the signer during the signing phase and is delivered directly to the arbitrator for storage. Unlike the direct-verification evidence ${\Sigma }_D$ used for routine verification, ${\Sigma }_A$ is protected by the independent arbitration key $k_A^{sid}$ and is not transmitted through either the user or the designated verifier. Therefore, other participants cannot replace or regenerate valid arbitration evidence.

The temporal signature contained in the arbitration evidence is record as ${\sigma }_i$ and the arbitration tag is defined as ${\text{Ł}}_A$ . The arbitration evidence is bound to the signer identity $I{D}_S$ , the session identifier $sid$ , the time period $i$ , the one-time authorization value ${\omega }_{sid}$ , and the corresponding blinded message. Valid arbitration evidence generated in one authorized session cannot be transferred to another signer, time period, or session without causing the corresponding identity, session, or tag-consistency verification to fail.

Moreover, the blinding key $r$ and the basis-selection string $b$ is frozen by the PKG before the signing operation, and the corresponding session information is stored in the immutable record: $Ctx\left[sid\right]$ . Therefore, after the signature has been generated, the signer cannot deny the completed signing operation by modifying the message, identity information, authorization information, or session parameters, since such a claim would be inconsistent with the arbitration evidence and the session record maintained by the PKG.

In addition, the arbitration key $k_A^{sid}$ and the direct-verification key $k_D^{sid}$ are independently generated, and $k_A^{sid}$ is not disclosed to the user or the designated verifier. Therefore, neither the user nor the verifier can construct valid arbitration evidence ${\Sigma }_A$ from the direct-verification evidence ${\Sigma }_D$ . If an adversary modifies or forges ${\Sigma }_A$ without authorization and the forged evidence is nevertheless accepted, then the integrity of the underlying quantum authentication scheme has been compromised. Thus, $\text{Pr}\left[f_A=\text{acc}\wedge \left({\tilde{\rho }}_{W_A},{\tilde{\sigma }}_i\right)\ne \left({\rho }_{W_A},{\sigma }_i\right)\right]\le {\epsilon }_{\text{auth}}$.

Therefore, under the assumptions that the PKG is trustworthy, the session record is immutable, and the arbitration key $k_A^{sid}$ remains secret, once ${\Sigma }_A$ passes authentication and its identity, time-period, session, and message information are consistent with the system records, the signer cannot deny having completed the signature in the corresponding authorized session.

(2) Non-repudiation of the user

The user’s non-repudiation mainly ensures that the user cannot deny participation in the corresponding signing session or the blinding information submitted and frozen before signing. Before the signing operation begins, the user generates the blinding key $r$ and the basis-selection string $b$ , and registers $R_{sid}$ with the PKG. The PKG stores $\text{Rec}\left[sid\right].\left(b,r\right)=\left(b,r\right)$ only if authentication succeeds and the $sid$ contained in the authenticated data matches the current session. Once this record has been established, the blinding key $r$ and the basis-selection string $b$ are frozen for the current session and cannot be replaced by different value $b\text{'},r\text{'}$ after signing.

Since $sid$ is a globally unique session identifier and $Ctx\left[sid\right]$ records the user identity $I{D}_U$ together with the parameters of the corresponding session, the user identity, signing session, and frozen basis-selection string and blinding key are bound to the same session record. If the user later denies participation in the session or claims that a different basis-selection string $b^{\prime }\ne b$ or blinding key $r^{\prime }\ne r$ was used, such a claim will be inconsistent with the authenticated registration record stored by the PKG.

Furthermore, the corresponding blinded message is contained in the arbitration evidence. Under honest protocol execution, $|m_{\text{blind}}\rangle =H^b{X}^r|msg\rangle$ . Using the basis-selection string $b$ and the blinding key $r$ frozen by the PKG before signing, the original message can be recovered as $X^r{H}^b|m_{\text{blind}}\rangle =|msg\rangle$ . If the user attempts to replace the original blinding key with a different value $r^{\prime }\ne r$ after signing, then $X^{r^{\prime }}{H}^b|m_{\text{blind}}\rangle =X^{r^{\prime }}{H}^b{H}^b{X}^r|msg\rangle =|msg\oplus r\oplus r^{\prime }\rangle$ , which, in general, differs from the original message $|msg\rangle$ . Therefore, the result cannot simultaneously satisfy the consistency requirements of the arbitration evidence and the frozen blinding information maintained by the PKG.

Moreover, if an adversary attempts to forge or modify the user’s blinding-key registration information, it must construct authenticated data without knowledge of $k_{PU}^R$ . According to the security of the quantum authentication scheme, the probability that a forged or modified registration is nevertheless accepted satisfies $\text{Pr}\left[f_R=\text{acc}\wedge {\tilde{R}}_{sid}\ne R_{sid}\right]\le {\epsilon }_{\text{auth}}$.

Therefore, under the assumptions that the PKG is trustworthy, the session record is immutable, $k_{PU}^R$ remains secret, and the blinding key $r$ is correctly frozen before signing, the user cannot deny participation in the corresponding signing session or alter the signing result by replacing the blinding parameter after the signature has been generated.

4.4. Partial Blindness Analysis

Given public information $info$ and two distinct private messages $ms{g}_0\ne ms{g}_1$ , corresponding to the quantum states $|ms{g}_0\rangle$ and $|ms{g}_1\rangle$ , the protocol satisfies partial blindness if the signer’s complete views for the two messages are indistinguishable, i.e., ${\rho }_{\left(ms{g}_0|info\right)}={\rho }_{\left(ms{g}_1|info\right)}$ .

User blindness and the Bell-measurement process: Let the private message quantum state be $|msg\rangle ={\otimes }_{i=1}^n|ms{g}_i\rangle$ , $ms{g}_i\in \left\{0,1\right\}$ . Before signing, the user uniformly and randomly selects a basis-selection string $b$ and a blinding-key string $r$ . The user first performs the Pauli-$X$ blinding operation on the logical message bits and then performs the basis encoding. Thus, $|m_{\text{blind}}\rangle =H^b{X}^r|msg\rangle$ .

For the ith message bit, $|{\varphi }_i^B\rangle =H_i^{b_i}{X}_i^{r_i}|ms{g}_i\rangle =H_i^{b_i}|ms{g}_i\oplus r_i\rangle$ . When $b_i=0$ , $|{\varphi }_i^B\rangle =|ms{g}_i\oplus r_i\rangle$ , whereas when $b_i=1$ , $|{\varphi }_i^B\rangle =H_i|ms{g}_i\oplus r_i\rangle$ . Hence, the random bit $r_i$ blinds the logical value before either encoding basis is applied.

Let $U_i$ and $S_i$ denote the user’s and signer’s entangled particles, respectively. The shared EPR state is ${|{\Phi }^{+}\rangle }_{U_i{S}_i}=\frac{1}{\sqrt{2}}{\left(|00\rangle +|11\rangle \right)}_{U_i{S}_i}$ . The joint system is expressed as

$|\Psi \rangle ={|{\varphi }_i^B\rangle }_{m_{U_i}}\otimes {|{\Phi }^{+}\rangle }_{U_i{S}_i}.$ (25)

The user performs the Bell-basis operations ${\text{CNOT}}_{m_{U_i}\to U_i}$ and $H_{m_{U_i}}$ , where

$\text{CNOT}|a\rangle |b\rangle =|a\rangle |a\oplus b\rangle ,$ (26)

and

$H|0\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle +|1\rangle \right),H|1\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle -|1\rangle \right).$ (27)

For the ith qubit, the Bell-basis measurement produces the two-bit classical result ${\gamma }_i=\left(x_i,z_i\right)\in \left\{00,01,10,11\right\}$ . For the complete $n$ -qubit message, the Bell-measurement result is $\gamma =\left(\left(x_1,z_1\right),\cdots ,\left(x_n,z_n\right)\right)\in {\left\{0,1\right\}}^{2n}$ . Under ideal teleportation, the Bell-measurement outcomes are uniformly distributed and independent of the input state, and hence $\text{Pr}\left[\gamma \right]=\frac{1}{4^n}$ .

Quantum state received by the signer: According to the quantum teleportation protocol, the Bell-measurement result $\gamma$ determines the Pauli correction

$U_{\gamma }=\stackrel{n}{\underset{i=1}{\otimes }}{Z}_i^{z_i}{X}_i^{x_i}\in {\left\{I,X,Z,XZ\right\}}^{\otimes n}.$ (28)

After receiving $\gamma$ , the signer performs the corresponding correction and obtains $U_{\gamma }|{\phi }_{\gamma }\rangle \doteq |m_{\text{blind}}\rangle =H^b{X}^r|msg\rangle$ , where $\doteq$ denotes equality up to an irrelevant global phase.

Therefore, the blindness analysis must consider the signer’s state after the Bell-measurement result $\gamma$ has been received and the corresponding correction has been completed. For any fixed basis-selection string $b$ and Bell-measurement result $\gamma$ , since the blinding-key string $r$ is uniformly random and remains unknown to the signer, the density operator observed by the signer is

$\begin{array}{c}\rho \left(msg|b,\gamma \right)=\frac{1}{2^n}{\displaystyle \sum }_{r\in {\left\{0,1\right\}}^n}{H}^b{X}^r|msg\rangle \langle msg|X^r{H}^b\\ =H^b\left[\frac{1}{2^n}{\displaystyle \sum }_{r\in {\left\{0,1\right\}}^n}|msg\oplus r\rangle \langle msg\oplus r|\right]H^b\\ =H^b\frac{I_{2^n}}{2^n}{H}^b\\ =\frac{I_{2^n}}{2^n}.\end{array}$ (29)

For any two distinct private messages $ms{g}_0\ne ms{g}_1$ , we therefore have

$\rho \left(ms{g}_0|b,\gamma \right)=\frac{I_{2^n}}{2^n},\rho \left(ms{g}_1|b,\gamma \right)=\frac{I_{2^n}}{2^n}.$ (30)

Consequently, ${\rho }_S\left(ms{g}_0|b,\gamma \right)={\rho }_S\left(ms{g}_1|b,\gamma \right)$ .

The above result holds for every basis-selection string $b$ and every Bell-measurement result $\gamma$ . In particular, when $b_i=0$ , the Pauli-$X$ operation gives $X_i^{r_i}|ms{g}_i\rangle =|ms{g}_i\oplus r_i\rangle$ . When $b_i=1$ , the logical value is first blinded by $X_i^{r_i}$ and then encoded in the Hadamard basis: $H_i{X}_i^{r_i}|ms{g}_i\rangle =H_i|ms{g}_i\oplus r_i\rangle$ . Thus, the logical message value is randomized by $r_i$ under either message-encoding basis.

Finally, the signer obtains not only the restored blinded quantum state, but also the Bell-measurement result $\gamma$ and the public information $info$ . Hence, the signer’s complete classical–quantum view can be written as

$\begin{array}{l}\rho \left(msg|b,info\right)=\frac{1}{4^n}{\displaystyle \sum }_{\gamma \in {\left\{0,1\right\}}^{2n}}|\gamma \rangle \langle \gamma |\otimes \frac{I_{2^n}}{2^n}\otimes |info\rangle \langle info|.\hfill \end{array}$ (31)

Therefore, for any two distinct private messages $ms{g}_0$ and $ms{g}_1$ associated with the same public information $info$ , $\rho \left(ms{g}_0|b,info\right)=\rho \left(ms{g}_1|b,info\right)$ . Hence, even after receiving the complete Bell-measurement result $\gamma$ and restoring the blinded quantum state, the signer cannot distinguish the user’s private message, while the agreed public information $info$ remains visible. Therefore, the proposed protocol satisfies partial blindness.

4.5. Resistance against Third-Party Attacks

Entangling-Probe Attack: The attacker Eve prepares a blank ancillary particle in the state $|e\rangle$ and applies an interaction $V$ satisfying

$V|0\rangle |e\rangle =|0\rangle |e_{00}\rangle +|1\rangle |e_{01}\rangle ,V|1\rangle |e\rangle =|1\rangle |e_{10}\rangle +|1\rangle |e_{11}\rangle ,$ (32)

where the ancillary vectors satisfy the unitarity condition $V^{†}V=I.$ For uniformly distributed inputs in the $Z$ basis, the induced error rate is

$e_Z=\frac{1}{2}\left(\langle e_{01}|e_{01}\rangle +\langle e_{10}|e_{10}\rangle \right).$ (33)

If the attacker introduces strictly zero errors in both the $Z$ and $X$ bases, then the attacker cannot obtain any information about the original bit. Zero error in the $Z$ basis requires

$V|0\rangle |e\rangle =|0\rangle |e_0\rangle ,V|1\rangle |e\rangle =|1\rangle |e_1\rangle .$ (34)

For $|+\rangle =\frac{1}{\sqrt{2}}\left(|0\rangle +|1\rangle \right)$ , linearity gives: $V|+\rangle |e\rangle =\frac{|0\rangle |e_0\rangle +|1\rangle |e_1\rangle }{\sqrt{2}}$ . For

$|0\rangle =\frac{1}{\sqrt{2}}\left(|+\rangle +|-\rangle \right),|1\rangle =\frac{1}{\sqrt{2}}\left(|+\rangle -|-\rangle \right),$ (35)

we obtain

$V|+\rangle |e\rangle =\frac{1}{2}\left[|+\rangle \left(|e_0\rangle +|e_1\rangle \right)+|-\rangle \left(|e_0\rangle -|e_1\rangle \right)\right].$ (36)

If the interaction also introduces no error in the $X$ basis, the coefficient of $|-\rangle$ must vanish. Hence, $|e_0\rangle =|e_1\rangle \equiv |e^{\prime }\rangle$ . Consequently,

$V|0\rangle |e\rangle =|0\rangle |e^{\prime }\rangle ,V|1\rangle |e\rangle =|1\rangle |e^{\prime }\rangle .$ (37)

For an arbitrary input state $\left|\psi \rangle =\alpha \right|0\rangle +\beta |1\rangle ,$ it follows that

$V|\psi \rangle |e\rangle =|\psi \rangle |e^{\prime }\rangle .$ (38)

Therefore, the state of the attacker’s ancillary system is independent of the input state, and Eve cannot obtain any information without introducing detectable errors.

Intercept-Measure-Resend Attack: Assume that an external attacker, Eve, intercepts particles transmitted to the user or the signer. Eve measures each intercepted particle and, according to the measurement outcome, prepares a new particle and sends it to the legitimate participant. Eve randomly selects either the $Z$ basis or the $X$ basis for measurement.

The channel-security test requires the insertion of decoy states. For a single decoy particle, the probability of detecting Eve is $p_{\text{det}}=\frac{1}{4}$ , whereas the probability that Eve escapes detection is $p_{\text{und}}=\frac{3}{4}$ . When $d$ decoy particles are used, the probability that Eve is detected is

$P_{\text{det}}\left(d\right)=1-{\left(\frac{3}{4}\right)}^d.$ (39)

If Eve attacks each transmitted particle independently with probability $\eta$ , then the probability that none of the $d$ decoy particles reveals the attack is

$P_{\text{und}}\left(d,\eta \right)={\left(1-\frac{\eta }{4}\right)}^d.$ (40)

Accordingly, the overall detection probability is

$P_{\text{det}}\left(d,\eta \right)=1-{\left(1-\frac{\eta }{4}\right)}^d.$ (41)

Therefore, the detection probability increases with both the attack ratio $\eta$ and the number of decoy particles $d$ .

4.6. Communication Resource Analysis

In terms of communication resource overhead, let $n$ denote the length of the private message, and let $q_D$ and $q_A$ denote the lengths of the direct verification evidence and arbitration evidence, respectively. During one complete execution of the protocol, the blinded message $U\to S$ , the direct verification evidence $S\to U$ and $U\to V$ , the arbitration evidence $S\to A$ , and the reference message $U\to V$ are transmitted through quantum teleportation. Therefore, the total number of logical qubits to be teleported is $Q=2n+2q_D+q_A.$

Since teleporting a $q$ -qubit register requires $q$ fresh EPR pairs and $2q$ authenticated classical bits for Bell-measurement correction, the total number of consumed EPR pairs is $N_{\text{EPR}}=Q$ , and the corresponding classical correction cost is $q_c^{\text{tele}}=2\left(2n+2q_D+q_A\right)$ .

Let $d$ denote the number of decoy particles used for the quantum transmission, the total quantum and classical communication costs can be expressed as $q_t=3\left(2n+2q_D+q_A\right)+d+q_{\text{key}}$ , and $q_c=2\left(2n+2q_D+q_A\right)+L$ , respectively, where $q_{\text{key}}$ denotes the additional quantum resources required for key establishment, and $L$ includes the session identifier, authorization information, participant identities, and other authenticated classical control data. The comparison analysis with existing schemes is illustrated in Table 3.

Table 3. Comparison of functionality and resource overhead with related schemes.

Scheme	Partial blindness	Teleportation	Arbitration	Designated verification	Temporal protection	Signature size $q_s$	Quantum cost $q_t$	Classical cost $q_c$
Cai and Niu [24]	Yes	NR	No	No	No	NR	NR	NR
Zhong et al. [25]	Yes	No	No	No	No	NR	NR	NR
Xia et al. [45]	No	No	NR	No	No	$n$	$27n$	$2n$
Tan and Ye [46]	No	Yes	No	No	No	$2n$	$30n$	$l+4n$
Proposed scheme	Yes	Yes	Yes	Yes	Yes	$q_D+q_A$	$\begin{array}{l}3\left(2n+2q_D+q_A\right)\\ +d+q_{\text{key}}\end{array}$	$\begin{array}{l}2\left(2n+2q_D+q_A\right)\\ +L\end{array}$

Note: NR denotes that the corresponding quantity is not reported or is not directly comparable under a unified resource-counting convention.

5. Conclusions

This paper proposes an identity-based quantum partially blind signature scheme based on quantum teleportation. With the aid of a random bit string of length $n$ , the user encodes binary information into a quantum state, blinds it according to the blinding key $r$ , and keeps the public information $info$ openly visible, thereby achieving the partially blind signature property.

The PKG is responsible for participant identity authentication, session establishment, blind-key freezing, signature authorization, and one-time session-key distribution, and implements key lifecycle management through a unique session identifier, validity period, and state records. Signers generate direct verification evidence for a designated verifier and independent arbitration evidence for an arbitrator, respectively; the relevant quantum information is transmitted via security-verified EPR entanglement resources and quantum teleportation.

Verifiers perform routine verification through quantum authentication decoding, tag verification, and message de-blinding; in the event of a dispute, the arbitrator renders a decision based on the quantum evidence independently preserved during the signing phase. Security analysis shows that, under conditions such as a trusted PKG and arbitrator, secure classical communication channels, an ideal random source, one-time session keys, and secure quantum authentication codes, this scheme can achieve security properties including correctness, partial blindness, forgery resistance, and non-repudiation, while also providing resistance to third-party attacks.

However, its security is based on information-theoretic security under explicit attack models and trust assumptions; at the same time, quantum labels, authentication-assisting qubits, and two-branch evidence also entail certain quantum resource and storage overheads.

Acknowledgements

We express our gratitude to all contributors who engaged in the discussion of this work. This work was supported by the Hunan Provincial Natural Science Foundation of China (GrantNos.2025JJ70445), the Joint Open Fund Project of “Hunan Provincial Science and Technology Innovation Team, Hunan Provincial Key Laboratory and Provincial Characteristic Discipline of Control Science and Engineering” (Grant NO.ZNKZN2024-4).

Author Contributions

Conceptualization, Juxiu Zhong and Rongbo Lu; methodology, Juxiu Zhong; validation, Juxiu Zhong, Rongbo Lu and Wei Li; writing-original draft preparation, Juxiu Zhong; writing-review and editing, Rongbo Lu and Wei Li. All authors have read and agreed to the published version of the manuscript.