(1) Parameter generation: PKG specifies the security parameters: λ = ( λ s i d , λ ω , S auth , ε auth , n max ) , where λ s i d denotes the length of the session ID, λ ω denotes the length of the one-time authorization code, S auth denotes the size of quantum authentication redundancy or trap qubits, ε auth denotes the upper bound of the quantum authentication error acceptance probability, and n max denotes the maximum binary message length allowed by the system.

PKG selects a publicly available quantum authentication scheme: Q Auth = ( Q Auth . Enc , Q Auth . Dec ) , and a normalized encoding rule: Canon ( x 1 , ⋯ , x t ) .

The valid identity information of each participant is denoted as I D X , X ∈ { U , S , V , A } .

Finally, PKG establishes a session database D s i d for storing session keys.

(2) Participant identity registration: Each participant X ∈ { U , S , V , A } submits identity verification information to the PKG. After successful verification, the PKG establishes an identity–key mapping: I D X → k X , where I D X denotes the identity information of participant X , and k X denotes the corresponding one-time control key pool. The mapping information is stored securely in the PKG’s protected database.

(3) Establishing a session key based on identity:

1) Session establishment: The user, signer, and verifier submit their identities and public information to the PKG: I D U , I D S , I D V , I D A , i n f o , n , T . The PKG verifies 1 ≤ n ≤ n max , T > t , and checks whether the permissions for each identity are valid. Upon successful verification, a unique session ID is generated: s i d ∈ { 0 , 1 } λ s i d , ensuring that it does not duplicate any ID in the session database. The PKG records this information: C t x [ s i d ] = ( I D U , I D S , I D V , I D A , i n f o , n , T ) .

2) One-time control key: Based on the identities and the session, the PKG generates one-time quantum authentication keys: k P U R , k P S R e q , k P S A u t h , for subsequent processes.

Specifically, k P U R is used by the user to register with the PKG and freeze the blinding key; k P S R e q is used by the signer to submit an authorization request to the PKG; k P S A u t h is used by the PKG to send a one-time quantum authorization token to the signer.

These keys are all bound to s i d , the sender’s and recipient’s identities, and the intended use, and are destroyed after this session

3) Entanglement resource initialization: Based on the security parameter λ , the PKG generates n independent sets of EPR entanglement pairs, where each pair is in a maximally entangled state: ⊗ i = 1 n | ϕ + 〉 U i S i = ⊗ i = 1 n 1 2 ( | 00 〉 + | 11 〉 ) U i S i .

The PKG distributes the particle set S = { S 1 , S 2 , ⋯ , S n } to the signer and the particle set U = { U 1 , U 2 , ⋯ , U n } to the user, thereby establishing a shared quantum channel between them.

(4) Identity-Based Quantum Private Key Extraction: The signer sends its identity to the PKG. The temporal revocable-key model divides the system’s operational lifetime into a sequence of discrete time periods and assigns each signer mutually independent or unidirectionally evolving signing keys for different periods.

Let N denote the maximum number of signatures supported by the system. The corresponding set of time or state indices is defined as: T = { 1 , 2 , ⋯ , N } . For signer S , its identity is denoted as I D S . In the i -th time period, the signer holds a signing key s k S , i , i ∈ T , which is bound to its identity and time state. The corresponding key state is represented as: s t S , i = ( I D S , i , s k S , i , s t a t u s S , i ) , where s t a t u s S , i denotes the valid state of the signer in the i -th time period. It can take the following values: s t a t u s S , i ∈ { CREATED , FROZEN , AUTHORIZED , SIGNED , DELIVERED ,       VERIFIED , DISPUTED , CLOSED , ABORTED } .

The time-period-related revocation list R L i records identities that no longer possess signing authority during the i -th time period and subsequent periods. If I D S ∈ R L i , the signer is revoked from the i -th time period, and the system no longer generates, extracts, or updates valid signing keys for this signer. For any j ≥ i , it holds that I D S ∈ R L j , which provides backward revocation and terminates the signing authority for future periods. For a non-revoked signer, the signing key is updated according to the time period: s k S , i + 1 ← k e y u p d ( s k S , i , I D S , i ) . After updating, the previous key is immediately deleted: E r a s e ( s k S , i ) . The key update mechanism only supports forward evolution and prevents recovery of previous keys. Therefore, given the current key s k S , i , it is infeasible to derive any previous key s k S , j , j < i . During the i -th time period, the signer uses only the valid key s k S , i to generate a signature: σ i ← S i g n ( p a r a m s , s k S , i , I D S , i , m ) . When verifying a signature, the verifier must simultaneously check the correctness of the signature, the validity of the time state, and the signer’s revocation status. The verification algorithm is denoted as: b ← V e r i f y ( p a r a m s , I D S , i , m , σ i , R L i ) , where b ∈ { 0 , 1 } .

The verification algorithm outputs 1 if and only if all the following conditions are satisfied: I D S ∉ R L i , 1 ≤ i ≤ N , and σ i is a valid signature generated by the valid key of the i -th time period. Otherwise, the verification algorithm outputs 0.

(5) Signing authorization request: The signer requests signing authorization from the PKG by sending its identity information I D S and the session identifier s i d to the PKG. The PKG verifies whether the required conditions are satisfied, namely, whether the signer’s identity has been authenticated, whether the user has frozen the blinding key, and whether the current request has not expired. Once all conditions are satisfied, the PKG grants authorization and independently and randomly generates two session keys: k D s i d = ( e D , p D ) , k A s i d = ( e A , p A ) . The independence requirement is defined as follows: ℋ k A and ℋ k D are mutually independent Hilbert spaces, and ρ k A k D = ρ k A ⊗ ρ k D . There exists no quantum operation that can recover k A s i d from k D s i d . Therefore, even if one key is compromised, the other key cannot be derived. The PKG distributes k D s i d to the signer S and the verifier V , and distributes k A s i d to the signer S and the arbitrator A . The PKG then generates a unique authorization serial number ω s i d . The corresponding authorization content is defined as: A u t h s i d = Canon ( I D X , s i d , i n f o , n , ω s i d ) . Finally, the PKG updates the signer’s state as: s t a t u s S , i = AUTHORIZED .

Assume that the message to be signed by the user is a private binary message m s g = { m s g 1 , m s g 2 , ⋯ , m s g i , ⋯ , m s g n } , m s g i ∈ { 0 , 1 } , with the agreed-upon public message i n f o and the entangled-particle sequence U = { U 1 , U 2 , ⋯ , U n } , which is pre-shared through the PKG.

(1) The message is quantum-encoded and partially blinded. Specifically, only the private message m s g is blinded, while the public information i n f o remains unblinded. The user first uniformly and randomly generates a basis-selection string b = ( b 1 , b 2 , ⋯ , b n )   ← $   { 0 , 1 } n , b i ∈ { 0 , 1 } , and an n -bit classical blinding-key string r = ( r 1 , r 2 , ⋯ , r n )   ← $   { 0 , 1 } n , r i ∈ { 0 , 1 } . For each private message bit m s g i , the user first performs a logical blinding operation using the Pauli- X operator: X i r i | m s g i 〉 = | m s g i ⊕ r i 〉 . The resulting logical bit is then encoded according to the basis-selection bit b i . Thus, the i th blinded message qubit is prepared as | ϕ i B 〉 = H i b i X i r i | m s g i 〉 = H i b i | m s g i ⊕ r i 〉 , namely,

When b i = 0 , the blinded logical bit is encoded in the computational, or Z , basis Z = { | 0 〉 , | 1 〉 } ; when b i = 1 , it is encoded in the Hadamard, or X , basis X = { | + 〉 , | − 〉 } . Here, the symbol X i in the blinding operation denotes the Pauli- X operator, whereas X = { | + 〉 , | − 〉 } denotes the Hadamard measurement basis.

Let | m s g 〉 = ⊗ i = 1 n | m s g i 〉 , H b = ⊗ i = 1 n H i b i , X r = ⊗ i = 1 n X i r i , therefore, the complete partially blinded quantum message is

It should be noted that, in H b X r | m s g 〉 , the Pauli- X blinding operation X r acts first on the logical message bits, followed by the basis-encoding operation H b . Hence, for both b i = 0 and b i = 1 , the random bit r i effectively maps the logical message bit m s g i to m s g i ⊕ r i .

To prevent the user from selecting a new blinding key or a new basis-selection string after obtaining the signature, the user must register the blinding information with the PKG before signing. The registration information is defined as R s i d = Canon ( s i d , block , b , r ) . The user prepares the corresponding quantum state | R s i d 〉 and encodes it as Γ R = Q Auth . Enc k P U R ( | R s i d 〉 〈 R s i d | ) , which is then sent to the PKG.

Upon receiving Γ R , the PKG performs authentication decoding: ( f R , ρ ′ R s i d ) = Q Auth . Dec k P U R ( Γ R ) . Only when f R = acc and the decoded registration information matches the current session does the PKG store Rec [ s i d ] . ( b , r ) = ( b , r ) . From that point onward, the registered basis-selection string b and blinding-key string r are frozen and cannot be modified for the current session.

(2) Quantum Teleportation (Teleporting a Blinded State to the Signer): The user performs a joint Bell measurement on the transmitted state particle and the EPR particle. Taking a single particle as an example: let | ϕ 〉 m b i = α | 0 〉 m b i + β | 1 〉 m b i , and let the EPR state be | Φ + 〉 U i S i = 1 2 ( | 00 〉 + | 11 〉 ) U i S i . At this point, the entire system can be described as:

Then, the user performs a CNOT operation and obtains | φ 1 〉 :

The function of the H-Gate: H | 0 〉 = 1 2 ( | 0 〉 + | 1 〉 ) , H | 1 〉 = 1 2 ( | 0 〉 − | 1 〉 ) ; User applies an H-gate to the first qubit, resulting in | φ 2 〉 :

To make the measurement results easier to read, we rearrange | φ 2 〉 to get:

Next, the user measures the two qubits in the computational basis { | 0 〉 , | 1 〉 } . The four possible measurement outcomes and the corresponding recovery operations are summarized in Table 1.

Table 1.Correspondence between the user’s measurement outcomes and the signer’s quantum-state recovery operations.

The quantum circuit design is as shown in Figure 1:

Figure 1.Three-qubit simulation circuit for quantum teleportation.

U 3 ( θ , ϕ , λ ) = [ cos θ 2 − e i λ sin θ 2 e i ϕ sin θ 2 e i ( λ + ϕ ) cos θ 2 ] , assume that θ = π / 2 , ϕ = 0 , and λ = 0 ; the three-Qubit measurement results are output as Figure 2:

Figure 2. Probability distribution of three-qubit measurement outcomes in the quantum teleportation circuit.

The simulator measures all three qubits and therefore reports eight three-bit outcomes, each occurring with an ideal probability of approximately 1/8. However, only the last two measured bits constitute the Bell-measurement outcome γ i = ( x i , z i ) . By marginalizing over the receiver-qubit measurement result, the corresponding Bell-outcome probabilities are

which are all approximately 1/4 under ideal teleportation.

Table 2.Measurement probabilities corresponding to different Bell measurement outcomes.

The above results were obtained through online testing on the Origin Quantum platform, with the number of shots set to 1024. Table 2 presents the simulation results for the four possible Bell measurement outcomes. For each measurement outcome , the corresponding probability is obtained by summing the probabilities of the two associated computational-basis states. The resulting probabilities for the four outcomes are all close to the theoretical value of (1/4), indicating an approximately uniform distribution of the Bell measurement results.

The user performs a Bell-basis measurement on ( | m blind 〉 , U ) and obtains a 2-bit classical result γ i = ( x i , z i ) ∈ { 0 , 1 } 2 , γ i ∈ { 00 , 01 , 10 , 11 } , γ = { ( x 1 , z 1 ) , ⋯ , ( x i , z i ) , ⋯ , ( x n , z n ) } ∈ { 0 , 1 } 2 n .

Then the user sends ( s i d , γ , i n f o ) to the signer via a classical channel; the signer can only retrieve the message i n f o , but cannot access the original message m s g or quantum state | m s g 〉 to be signed.

In order to check whether the channel is secure, the user generates d decoy states randomly, selecting them from four sets of non-orthogonal states: | 0 〉 , | 1 〉 , | + 〉 = 1 2 ( | 0 〉 + | 1 〉 ) , | − 〉 = 1 2 ( | 0 〉 − | 1 〉 ) . From each group, X -basis and Z -basis states are randomly selected to prepare the quantum states. The detection bit is then sent to the signer through the quantum channel.

After receiving the decoy states sent by the user, both the user and the signer randomly select the X basis or Z basis for measurement. All measurement bases and measurement outcomes are stored. Half of the measurement bases and their corresponding measurement results are randomly disclosed, and the average channel error rate e is calculated. Let e th denote the threshold. If e > e th , it is determined that an eavesdropping attack exists on the channel, and set s t a t u s S , i = ABORTED ; otherwise, proceed with the subsequent signature operations.

Quantum collapse state: After the user performs the Bell-basis measurement, the particle S in the hands of the remote signer collapses, and its state is denoted as: | φ γ 〉 S i = U γ † | m blind 〉 . If the signer performs the corresponding Pauli operation U γ on S i , where U γ = Z z i X x i , then

Since a global phase has no physical effect, this operation restores the blinded state: | m blind 〉 = U γ | φ γ 〉 S i .

Therefore, after receiving ( s i d , γ , i n f o ) , the signer performs the Bell correction to obtain | m blind 〉 . The signer only signs when the following conditions are met:

, I D S ∉ R L i , and 1 ≤ i ≤ N . The generated state signature is as follows:

The direct verification tag is L D = Canon ( s i d , ω s i d , i , DIRECT ) , the arbitration tag is L A = Canon ( s i d , ω s i d , i , ARBITRATION ) , and the signer prepares these as the computational basis quantum states: | L D 〉 , | L A 〉 .

The direct verification payload is | W D 〉 = | m blind 〉 D ⊗ | L D 〉 , with density operator ρ W D = | W D 〉 〈 W D | ; and the signer computes

Σ D is the quantum signature evidence provided to the user and ultimately verified by the designated verifier. Execute s t a t u s S , i = SIGNED , and share the temporal key s k S , i with the verifier after the signature is completed. This temporal key will immediately lose its signature capability after the signature is completed within the period, and can only be used for subsequent verification of the completed signature.

The arbitration payload is | W A 〉 = | m blind 〉 A ⊗ | L A 〉 , and its density operator is ρ W A = | W A 〉 〈 W A | . The signer computes Σ A = Q Auth . E n c k A s i d ( ρ W A , σ i ) ; Σ A must be delivered directly by the signer to the arbitrator and cannot be relayed through the user or verifier.

The signer sends Σ D → U to the user, and the signer sends Σ A → A to the arbitrator. The arbitrator only stores Σ A and the receipt time, without decoding it immediately.

After confirming that the arbitrator has received Σ A , PKG marks this session as signed.

Sign output: The user holds Σ D ; the arbitrator holds Σ A ; PKG stores ω s i d , k D s i d , k A s i d , and the frozen ( b , r ) .

The user sends the direct verification evidence Σ D to the designated verifier via quantum teleportation. To ensure that the verification input clearly corresponds to the message m , the user can additionally prepare a reference message state | M ref 〉 ≡ | m s g 〉 and deliver it to the verifier via quantum teleportation. Since m is a classical binary string, preparing a reference state on a computational-basis state does not violate the no-cloning theorem.

The user sends an unblinding request O p e n s i d = Canon ( s i d , OPEN ) to the PKG. After the PKG verifies the user’s identity, session status, and arbitration-evidence receipt record, it securely releases the data ( r , b , k D s i d , ω s i d , C t x [ s i d ] ) to the designated verifier. At this stage, only the value of ( b , r ) frozen in the database prior to signing may be retrieved; the user cannot submit a new value ( b ′ , r ′ ) .

The unblinding output ( Σ D , | M ref 〉 , r , k D s i d , ω s i d , C t x [ s i d ] ) is held by the verifier, who decodes it using a one-time direct verification key: ( f D , ρ ′ W D , σ ′ i ) = Q Auth . D e c k D s i d ( Σ D ) . If f D = rej , the request is immediately rejected. If authentication succeeds, the verifier records the recovered payload as ρ ′ W D = | m ′ blind 〉 〈 m ′ blind | ⊗ | L ′ D 〉 〈 L ′ D | , where | m ′ blind 〉 is the recovered blinded-message register; | L ′ D 〉 is the recovered direct-verification-tag register. σ ′ i is the temporal signature obtained after decoding. The verifier performs decryption on σ ′ i using the temporal key s k S , i shared with the signer:

and obtains ( | m ″ blind 〉 , I D ′ S , i ′ , s i d ′ ) . It then compares s i d   = ?   s i d ′ ; if they are the same, verification continues; otherwise, the signature is declared invalid.

The verifier measures the tag register to obtain L ′ D and computes L D exp = Canon ( s i d , ω s i d , i , DIRECT ) based on the values of s i d and ω s i d provided by the PKG. The verification condition is L ′ D = L D exp . At the same time, the verifier checks the PKG’s immutable record: C t x [ s i d ] = ( I D U , I D S , I D V , I D A , i n f o , n , T ) , and confirms C t x [ s i d ] . I D V = I D V , C t x [ s i d ] . I D S = I D ′ S , C t x [ s i d ] . i n f o = i n f o , and C t x [ s i d ] . T > t . This step enables the short tag to indirectly bind the complete public information through s i d and ω s i d .

Perform quantum unblinding: The verifier applies the inverse basis-encoding operation followed by the Pauli- X unblinding operation to the blinded-message register: | M ′ 〉 = X r H b | m blind 〉 . Under honest conditions, | m blind 〉 = H b X r | m s g 〉 . Therefore,

Then, the verifier performs the same unblinding operation on the blinded-message state | m ″ blind 〉 recovered from the temporal protected payload: | M ″ 〉 = X r H b | m ″ blind 〉 . If the temporal protection is correct, then | m ″ blind 〉 = | m blind 〉 = H b X r | m s g 〉 . Hence,

The verifier can perform a quantum equality check without immediately measuring the complete message. It prepares two independent auxiliary registers, | 0 〉 C 1 ⊗ n and | 0 〉 C 2 ⊗ n , and executes the following sequence:

If | M ′ 〉 = | M ref 〉 , then the auxiliary register C 1 retains the value | 0 〉 C 1 ⊗ n . If | M ref 〉 = | M ″ 〉 , then the auxiliary register C 2 retains the value | 0 〉 C 2 ⊗ n . The auxiliary-register measurement result is defined as:

The final acceptance criterion is defined as follows: Accept ⇔ [ f D = acc ] ∧ [ L ′ D = L D exp ] ∧ [ f M = 1 ] ∧ [ C t x [ s i d ]   valid ] . The verifier then declares the signature valid and sets s t a t u s S , i = VERIFIED .

When a user, signer, or verifier disputes the verification result, the arbitrator uses Σ A —which was submitted directly by the signer and stored during the signing phase—to render a decision.

The PKG securely releases ( r , k A s i d , ω s i d , C t x [ s i d ] ) to the arbitrator. The arbitrator decodes the arbitration evidence as

If f A = rej , the arbitration evidence is declared invalid. If authentication succeeds, the arbitrator recovers

where σ ″ i is the temporal signature obtained after decoding.

The arbitrator decrypts σ ″ i using the temporal key s k S , i shared with the signer:

The arbitrator then compares s i d   = ?   s i d ′ . If the two session identifiers are equal, the arbitration procedure continues; otherwise, the signature is declared invalid.

Then, the arbitrator calculates the expected label L A exp = Canon ( s i d , ω s i d , i , ARBITRATION ) , and checks L ′ A = L A exp , then performs unblinding: | M A 〉 = X r H b | m ′ A 〉 , | M ″ 〉 = X r H b | m ″ blind 〉 . The arbitrator performs an equality check between | M A 〉 , | M ″ 〉 , and the reference state | M dis 〉 of the disputed message. The condition for arbitration acceptance is Accept ⇔ [ f A = acc ] ∧ [ L ′ A = L A exp ] ∧ [ | M A 〉 = | M ″ 〉 = | M dis 〉 ] ∧ [ C t x [ s i d ]   valid ] . Since Σ A is evidence sent directly by the signer to the arbitrator and protected by an independent key k A s i d , neither the user nor the verifier can fabricate valid arbitration evidence by modifying or re-encoding Σ D . If the results of routine verification do not match the arbitration results, the protocol treats Σ A stored by the arbitrator as the official evidence of the dispute.

The correctness of the proposed scheme requires that, when all participants honestly follow the protocol and the quantum channels are ideal, a legitimately generated signature is accepted by the designated verifier.

The user’s original message is represented by the computational-basis state | m s g 〉 . Before signing, the user randomly selects a basis-selection string b ∈ { 0 , 1 } n and a blinding key r ∈ { 0 , 1 } n , and performs the bitwise Pauli- X operation followed by the basis encoding, | m blind 〉 = H b X r | m s g 〉 . During quantum teleportation, the user performs Bell-basis measurements and obtains the classical outcome γ = ( ( x 1 , z 1 ) , ⋯ , ( x n , z n ) ) .

After receiving γ , the signer applies U γ and obtains | m blind 〉 . The signer then generates the temporal signature σ i and constructs the direct-verification evidence Σ D . Under honest execution, quantum authentication decoding succeeds: ( f D , ρ ′ W D , σ ′ i ) = Q Auth . Dec k D s i d ( Σ D ) . Using the corresponding temporal key s k S , i , the verifier recovers ( | m ″ blind 〉 , I D S ′ , i ′ , s i d ′ ) = ( | m blind 〉 , I D S , i , s i d ) .

After the PKG releases the basis-selection string b and the blinding key r that were frozen before signing, the verifier performs unblinding: