Algorithm 2: The MSign algorithm in IBMSCR−2.

Input: the master public key $mpk$, the private key $sk$, the identity set $IDSet$, the message to be signed m;  Output: a multi-signature $m\sigma$.   1. Each $M{S}_i$ randomly selects $r_i\in {\mathbb{Z}}_N^{*}$ and calculates $R_i=r_i^3(modN)$ and $t_i=h_2(R_i)$.   2. Each $M{S}_i$ broadcasts $t_i$ to co-signers $M{S}_j$ ($j\ne i$).   3. After obtaining $t_i$ from $M{S}_i$, $M{S}_1$ broadcasts $R_1$ to other $M{S}_i$.   4. After receiving $R_i$ from other signers, $M{S}_1$ checks whether $t_i=h_2(R_i)$ for $2⩽i⩽n$ is satisfied.   5. If one of these fails, the algorithm stops, which means the attackers have mixed invalid partial signatures. Otherwise, $M{S}_1$ sets $R={\prod }_{i=1}^n{R}_i(modN)$, $w=h_3(R\parallel IDSet\parallel m)$, and $u_1=r_1·s{k}_1^w(modN)$.   6. $S_1$ broadcasts $u_1$ to other $M{S}_i$.   7. After receiving $u_i$ from $M{S}_i$, $M{S}_1$ aggregates these by $u={\prod }_{i=1}^n{u}_i(modN)$.   8. Each $M{S}_i$ locally generates a multi-signature $m\sigma =(w,u)$.  Return $m\sigma$;