Algorithm 2 Incorrect Signatures Detection

Input:  A set of signatures $L_1=\left\{{\sigma }_1,{\sigma }_2,\dots ,{\sigma }_n\right\}$, $\left(hash,m,r,c\right)$, $m^{\prime }$ Output:  A set of incorrect signatures $L_3$  1: repeat  2:  Randomly select $k$ signatures from $\left\{{\sigma }_1,{\sigma }_2,\dots ,{\sigma }_n\right\}$ and form a set $\left\{{\sigma }_1^{\ast },{\sigma }_2^{\ast },\dots ,{\sigma }_k^{\ast }\right\}$  3:  $r^{\prime }=\left(g^{a^{\prime }},h{k}^{a^{\prime }}\right)\leftarrow DTCH.Forge\left(\left\{{\sigma }_1^{\ast },{\sigma }_2^{\ast },\dots ,{\sigma }_k^{\ast }\right\},m,m^{\prime },r\right)$  4:  $has{h}^{\prime }\leftarrow g^{a^{\prime }}{c}^{H_1\left(m^{\prime }\right)}$  5: until $\langle g,hk,g^{a^{\prime }},h{k}^{a^{\prime }}\rangle$ is a valid Diffie–Hallman tuple and $hash=has{h}^{\prime }$  6: $L_2\leftarrow \left\{{\sigma }_1^{+},{\sigma }_2^{+},\dots ,{\sigma }_k^{+}\right\}=\left\{{\sigma }_1^{\ast },{\sigma }_2^{\ast },\dots ,{\sigma }_k^{\ast }\right\}$  7: $L_4\leftarrow L_1-L_2=\left\{{\sigma }_{k+1}^{\prime },{\sigma }_{k+2}^{\prime },\dots ,{\sigma }_n^{\prime }\right\}$  8: $L_2\leftarrow \varnothing$  9: for ${\sigma }_t^{\prime }$ in $L_4$ do 10:  $r^{\prime }=\left(g^{a^{\prime }},h{k}^{a^{\prime }}\right)\leftarrow DTCH.Forge\left(\left\{{\sigma }_1^{+},{\sigma }_2^{+},\dots ,{\sigma }_{k-1}^{+},{\sigma }_t^{\prime }\right\},m,m^{\prime },r\right)$ 11:  $has{h}^{\prime }\leftarrow g^{a^{\prime }}{c}^{H_1\left(m^{\prime }\right)}$ 12:  if $\langle g,hk,g^{a^{\prime }},h{k}^{a^{\prime }}\rangle$ is not a valid Diffie–Hallman tuple or $hash\ne has{h}^{\prime }$ then 13:   add ${\sigma }_t^{\prime }$ into $L_2$ 14:  end if 15: end for 16: return $L_3$