2^{h'}
         = H_1(ID^*)^{s_2} g_2^{r' + h'}
         = H_1(ID^*)^{s_2} g_2^{r^*}
    \end{aligned}$$ where $h^* = H_2(ID^* \| M^*)$ and $r^* = r' + h'$. To extract the CDH value from the forged signature of ${\mathcal{F}}$ by using Forking Lemma, the simulator of Yuan [*et al.*]{} should obtain two valid signatures $\sigma_1^* = (U_1^*, V_1^*, W_1^*)$ and $\sigma_2^* = (U_2^*,
V_2^*, W_2^*)$ on the same identity and message pair $(ID^*, M^*)$ such that $U_1^* = U_2^*$ and $h_1^* \neq h_2^*$ after replaying ${\mathcal{F}}$ with the same random tape but different choices of the hash oracle $H_2$. Let $\sigma_1^* =
(U_1^*, V_1^*, W_1^*)$ and $\sigma_2^* = (U_2^*, V_2^*, W_2^*)$ be the two valid signatures obtained from ${\mathcal{F}}$ by using Forking Lemma and $\sigma'_1
= (U'_1, V'_1, W'_1)$ and $\sigma'_2 = (U'_2, V'_2, W'_2)$ be the original signatures before the re-randomization of ${\mathcal{F}}$. If $h_1^* \neq h_2^*$, then $h'_1 \neq h'_2$ except negligible probability since $H'$ is a collision-resistance hash function and the inputs of this hash function are different. From $h'_1 \neq h'_2$, we have $U_1^* \neq U_2^*$ except negligible probability since $U'_1$ and $U'_2$ are re-randomized with difference values $g^{h'_1}$ and $g^{h'_2}$ respectively. Therefore, the event that the simulator obtains two valid signatures such that $U_1^* =
U_2^*$ and $h_1^* \neq h_2^*$ by using Forking Lemma only occurs with negligible probability. This completes our proof.

Discussions
-----------

From the above
2^{h' } 
          = H_1(ID^*)^{s_2 } g_2^{r' + h' } 
          = H_1(ID^*)^{s_2 } g_2^{r^ * } 
     \end{aligned}$$ where $ h^ * = H_2(ID^ * \| M^*)$ and $ r^ * = r' + h'$. To extract the CDH value from the forged touch of $ { \mathcal{F}}$ by use Forking Lemma, the simulator of Yuan [ * et al. * ] { } should obtain two valid signatures $ \sigma_1^ * = (U_1^ *, V_1^ *, W_1^*)$ and $ \sigma_2^ * = (U_2^ *, 
 V_2^ *, W_2^*)$ on the same identity and message couple $ (ID^ *, M^*)$ such that $ U_1^ * = U_2^*$ and $ h_1^ * \neq h_2^*$ after replaying $ { \mathcal{F}}$ with the same random tape but unlike choice of the hash oracle $ H_2$. Let $ \sigma_1^ * = 
 (U_1^ *, V_1^ *, W_1^*)$ and $ \sigma_2^ * = (U_2^ *, V_2^ *, W_2^*)$ be the two valid signatures prevail from $ { \mathcal{F}}$ by using Forking Lemma and $ \sigma'_1 
 = (U'_1, V'_1, W'_1)$ and $ \sigma'_2 = (U'_2, V'_2, W'_2)$ be the original key signature before the re - randomization of $ { \mathcal{F}}$. If $ h_1^ * \neq h_2^*$, then $ h'_1 \neq h'_2 $ except negligible probability since $ H'$ is a collision - underground hash function and the input signal of this hash function are different. From $ h'_1 \neq h'_2 $, we consume $ U_1^ * \neq U_2^*$ except negligible probability since $ U'_1 $ and $ U'_2 $ are re - randomized with difference values $ g^{h'_1}$ and $ g^{h'_2}$ respectively. Therefore, the consequence that the simulator obtains two valid key signature such that $ U_1^ * = 
 U_2^*$ and $ h_1^ * \neq h_2^*$ by using Forking Lemma only occurs with negligible probability. This complete our proof. 

 Discussions 
 ----------- 

 From the above
2^{h'}
         = H_1(ID^*)^{s_2} g_2^{r' + h'}
         = H_1(ID^*)^{s_2} g_2^{r^*}
    \gne{alignxd}$$ whers $h^* = H_2(ID^* \| M^*)$ and $r^* = r' + h'$. To extract tie CEH vaoue from the forged sienature ov ${\mathcao{F}}$ bb using Forking Lemma, thc simhpatox if Yuan [*et al.*]{} xhould obtdin two valid vienctures $\sigma_1^* = (U_1^*, V_1^*, W_1^*)$ and $\sigma_2^* = (U_2^*,
V_2^*, W_2^*)$ jn the xale identity anq mexfage ialr $(ID^*, M^*)$ such that $U_1^* = U_2^*$ and $h_1^* \neq h_2^*$ afteg replaying ${\mathcsl{F}}$ with the same random twpe hut different choifes of the yash iracle $H_2$. Let $\sigma_1^* =
(U_1^*, V_1^*, W_1^*)$ and $\sigma_2^* = (U_2^*, V_2^*, W_2^*)$ be the two valid signatjres pbtained ftoj ${\ldthcal{F}}$ by nsing Sorking Lemma and $\sicma'_1
= (U'_1, V'_1, W'_1)$ and $\sigma'_2 = (M'_2, V'_2, W'_2)$ be the original signatuces before the re-ranqomizatiot kf ${\mathcal{F}}$. If $h_1^* \bew h_2^*$, tven $v'_1 \ned h'_2$ dxctpt nsgligihle probabilify since $H'$ us a collision-resisuansv hash functikn and tre inputs of this hash function are difxersnt. From $h'_1 \neq h'_2$, we havw $U_1^* \neq U_2^*$ except negllgible prjbability since $U'_1$ and $U'_2$ are re-randomized with difxerenre vaoucs $g^{f'_1}$ ajd $g^{h'_2}$ respectively. Therefore, the event that trs xikulator obtainf two valid slgmwtures such tfat $U_1^* =
B_2^*$ ahd $h_1^* \neq h_2^*$ by usinh Forkigg Lenma only jccuts with negligible probabiluty. This comiletws our proof.

Discusdions
-----------

From tke abofe
2^{h'} = H_1(ID^*)^{s_2} g_2^{r' + h'} = \end{aligned}$$ $h^* = \| M^*)$ and To the CDH value the forged signature ${\mathcal{F}}$ by using Forking Lemma, the of Yuan [*et al.*]{} should obtain two valid signatures $\sigma_1^* = (U_1^*, V_1^*, and $\sigma_2^* = (U_2^*, V_2^*, W_2^*)$ on the same identity and message pair M^*)$ that = and $h_1^* \neq h_2^*$ after replaying ${\mathcal{F}}$ with the same random tape but different choices of hash oracle $H_2$. Let $\sigma_1^* = (U_1^*, V_1^*, and $\sigma_2^* = (U_2^*, W_2^*)$ be the two valid obtained ${\mathcal{F}}$ by Forking and = (U'_1, V'_1, and $\sigma'_2 = (U'_2, V'_2, W'_2)$ be the original signatures before the re-randomization of ${\mathcal{F}}$. If $h_1^* h_2^*$, then h'_2$ except probability $H'$ a collision-resistance hash the inputs of this hash function $h'_1 \neq h'_2$, we have $U_1^* \neq U_2^*$ negligible probability $U'_1$ and $U'_2$ are re-randomized with values $g^{h'_1}$ and $g^{h'_2}$ respectively. Therefore, the event the simulator obtains two valid signatures such that $U_1^* = U_2^*$ and $h_1^* \neq h_2^*$ Forking Lemma only occurs negligible probability. This our Discussions From above
2^{h'}
         = H_1(ID^*)^{s_2} g_2^{r' + h'}
         = H_1(ID^*)^{s_2} g_2^{r^*}
    \end{aligned}$$ wHere $h^* = H_2(ID^* \| M^*)$ aNd $r^* = r' + h'$. to eXtrAcT the cDH vAlue from the forGEd siGnature of ${\mathcal{F}}$ by usiNg ForKiNG LemMA, tHe simUlator oF yuAN [*Et aL.*]{} sHoUld ObTAiN two vAliD signatUres $\sigma_1^* = (U_1^*, v_1^*, W_1^*)$ aNd $\Sigma_2^* = (U_2^*,
V_2^*, W_2^*)$ on thE SaMe identity And Message pair $(Id^*, M^*)$ sUch thaT $U_1^* = u_2^*$ anD $H_1^* \neq h_2^*$ AftEr repLaying ${\MAthcal{f}}$ with the sAmE Random TApe but dIFFeRent Choices of the hash oRAcLE $H_2$. Let $\sigma_1^* =
(U_1^*, V_1^*, W_1^*)$ aNd $\sigmA_2^* = (U_2^*, v_2^*, w_2^*)$ bE THe tWo vAlid signatUrEs obtAIned froM ${\MaTHCAl{F}}$ BY using Forking lemma and $\sigMA'_1
= (U'_1, V'_1, w'_1)$ and $\siGmA'_2 = (U'_2, V'_2, w'_2)$ Be the oRiginAl SIgnAtures beforE the Re-randomiZation OF ${\mathcaL{f}}$. If $h_1^* \neq H_2^*$, then $h'_1 \Neq H'_2$ exCept NEgLiGibLe PRobABiLitY SinCe $H'$ is a coLlIsIon-reSistANCE Hash FunCtioN and tHe inputs of thiS haSh fuNCtiOn are DiffeRent. frOm $h'_1 \neQ h'_2$, we haVe $U_1^* \neQ U_2^*$ Except negligiblE proBability sIncE $U'_1$ And $u'_2$ aRe re-rANdomizEd wIth DiffereNce valuES $g^{h'_1}$ AnD $G^{H'_2}$ ReSpectively. ThereforE, tHE EvEnt that tHe simuLAtOr OBtains twO vAliD sigNATures Such THaT $U_1^* =
U_2^*$ and $h_1^* \nEq h_2^*$ by uSInG FOrking LEmMa only OcCurS wiTh negLIgibLe probAbility. THis coMPletes our proof.

dIscussions
-----------

FroM ThE ABoVE
2^{h'}
         = H_1(ID^* )^{s_2} g_ 2^{r'  +h'} 
      = H_1(ID^*)^{s _ 2} g _2^{r^*}
    \end{alig ned}$ $w here $h ^* =H_2(ID^ *  \ | M^* )$  a nd$r ^ *= r'+ h '$. Toextract th e C DH  value fromt he  forged si gna ture of ${\m ath cal{F} }$  by using  Fo rking  Lemma ,  the s imulatorof Yuan [ * et al.* ] { }shou ld obtain two val i ds ignatures $\si gma_1^ *=  ( U _ 1^* , V _1^*, W_1^ *) $ and $\sigma _ 2^ * =  (U _ 2^*,
V_2^*, W _2^*)$ on t h e s ame id en tit y  and m essag ep air  $(ID^*, M^ *)$such that  $U_1^ *  = U_2^ * $ and $ h_1^*\ne q h _2^* $  a ft erre p lay i ng  ${ \ mat hcal{F}} $wi th th e sa m e r ando m t apebut d ifferent choi ces  oft hehashoracl e $H _2 $. Le t $\si gma_1 ^*  =
(U_1^*, V_1^ *, W _1^*)$ an d $ \s igm a_ 2^* = (U_2^* , V _2^ *, W_2^ *)$ bet hetw o v al id signatures obta in e d  f rom ${\m athcal { F} }$ by using  F ork ingL e mma a nd $ \ si gma'_1
=  (U'_1 ,  V '_ 1, W'_1 )$  and $ \s igm a'_ 2 = ( U '_2,  V'_2,  W'_2)$be th e  original sign a tures beforet he r e- r ando miz ation of ${ \mat h cal{ F}}$ .  I f $ h _1^*\neqh_ 2 ^* $ , then $h'_1 \neq h '_ 2$ exc ept n egligible pro bability s i n c e $H'$ i s ac ol l ision-resistan ce ha sh functio n  and the  inpu ts of th is hash f u n ction ar e d iff ere nt. F ro m $h'_1 \neqh ' _2$,  w e have$U_ 1^* \ne q U _2^ *$exc ep t negligi ble prob ab il it ysin ce $U ' _1$ and$U '_2 $are  re-r a ndomiz ed wi th d if fe r enc e value s  $ g ^ {h'_ 1} $and$g^ {h '_2}$  res p ect ively.Therefore , t h e ev en tthat th e simulator o bt ains two v al idsignat u r es suchthat $U_1^* =
U_2^*$ an d  $h_1^*  \n eq h_ 2^*$  by using  Fo rkingLem m a only  occur s wit hneg l i gible p ro bab il ity. Thisc o mpl etesou r pr oof.

D iscussions
------- - --- 

From the ab ove 
2^{h'}
 _ _   _ =_H_1(ID^*)^{s_2}_g_2^{r' +_h'}
_  _  _  = H_1(ID^*)^{s_2}_g_2^{r^*}
  __\end{aligned}$$ where $h^* = H_2(ID^* \| M^*)$ and $r^* = r' + h'$. To_extract_the CDH_value_from_the forged signature of ${\mathcal{F}}$_by using Forking Lemma, the_simulator of_Yuan [*et al.*]{} should obtain two valid signatures_$\sigma_1^*_= (U_1^*, V_1^*,_W_1^*)$ and $\sigma_2^* = (U_2^*,
V_2^*, W_2^*)$ on the same_identity and message pair $(ID^*, M^*)$_such that $U_1^*_=_U_2^*$_and $h_1^* \neq h_2^*$_after replaying ${\mathcal{F}}$ with the same_random tape but different choices of_the hash oracle $H_2$. Let $\sigma_1^* =
(U_1^*,_V_1^*, W_1^*)$ and $\sigma_2^* = (U_2^*,_V_2^*, W_2^*)$ be the two_valid signatures_obtained from ${\mathcal{F}}$ by using_Forking Lemma and_$\sigma'_1
= (U'_1,_V'_1, W'_1)$ and_$\sigma'_2 = (U'_2, V'_2, W'_2)$ be_the original signatures_before the re-randomization of ${\mathcal{F}}$. If_$h_1^*_\neq h_2^*$, then_$h'_1_\neq_h'_2$ except_negligible probability since_$H'$_is a_collision-resistance_hash function and the inputs of_this_hash function are different. From $h'_1 \neq_h'_2$, we have $U_1^*_\neq_U_2^*$ except negligible probability_since $U'_1$ and $U'_2$ are_re-randomized with difference values $g^{h'_1}$ and_$g^{h'_2}$ respectively._Therefore, the_event that the simulator obtains two valid signatures such that $U_1^*_=
U_2^*$ and $h_1^* \neq h_2^*$ by_using Forking Lemma only_occurs with_negligible_probability. This completes_our_proof.

Discussions
-----------

From the_above