Algorithm 1: Encryption protocol performed by $V_b$

Input: Pseudonym $P{N}_{(a,i)}^j$ of $V_b$ and message M. 1: Verify $SIG({\tau }_{(a,i)}^j,t_{(a,i)},S_{R_i})$, and compute ${\lambda }_{(a,i)}^j=e({\tau }_{(a,i)}^j,{\sigma }_a^{j}P)$ 2: Choose $k\in {\{0,1\}}^n$ randomly. 3: Compute $\rho =H_2(k,M)$ 4: Compute cipher text as $C=\langle H(\rho P)\oplus {({\lambda }_{(a,i)}^j)}^k,e{(P,{\sigma }_a^j|P)}^k,M\oplus H_1(e({\sigma }_a^{j}P,H(\rho P)P))\rangle$ 5: Transmit C to $V_a$.